Rajeev Alur

Eugène Asarin

Jean-François Raskin

Krishnendu Chatterjee

Claude Jard

Kim G Larsen

I am grateful to Patricia and Nicolas who introduced me to timed automata and robustness problems. Throughout my master's and PhD, we explored many aspects of timed automata; they have been supportive, and

Résumé

Les automates temporisés sont un formalisme qui permet de modéliser, vérifier, et synthétiser des systèmes temps-réels. Ils sont dotés d'une sémantique abstraite et mathématique, qui permet de formaliser et résoudre plusieurs problèmes de vérification et de synthèse. Cependant, les automates temporisés sont utilisés pour concevoir des modèles, plutôt que décrire des systèmes temps-réels entiers. Ainsi, une fois la phase de conception terminée, il reste à déterminer si les comportements du modèle correspondent à ceux d'un vrai système. Une étape importante de l'implémentation consiste à s'assurer de la robustesse du système. On considère une notion de robustesse sur les automates temporisés qui exige que les comportements soient préservés quand le modèle est sujet à des perturbations bornées. Dans cette thèse, plusieurs approches sont étudiées : Dans l'analyse de robustesse, on se demande si un automate temporisés donné préserve ses comportements sous divers types de perturbations, et on cherche à calculer un majorant sur les perturbations tolérées. La synthèse robuste s'intéresse au calcul d'une loi de contrôle (ou une stratégie) qui guide le système, et tolère des perturbations d'une magnitude calculable. Enfin, dans l'implémentation robuste, on s'intéresse à transformer automatiquement un modèle donné pour le rendre robuste, tout en préservant ses comportements.

Plusieurs modèles de perturbations sont considérés : erreurs de mesure de temps (élargissement de gardes), élimination des comportements limites (contraction de gardes), et la restriction du domaine du temps aux valeurs discrètes. On formalise également les problèmes de synthèse robuste comme des jeux entre le contrôleur et un environnement qui perturbe systèmatiquement tout délai choisi par une quantité bornée. Ces problèmes sont étudiés pour les automates temporisés, ainsi que leurs extensions; les jeux temporisés, et les automates et jeux temporisés pondérés.

Plusieurs algorithmes d'analyse de robustesse parametrée contre l'élargissement de gardes et la contraction de gardes sont proposés. Deux variantes de la sémantique de jeu pour le problème de synthèse robuste sont également étudiées pour les automates temporisés et leurs extensions. Un logiciel d'analyse de robustesse contre la contraction de gardes, ainsi que des résultats expérimentaux sont présentés. Le problème de l'implémentation robuste est étudié dans deux contextes différents. Tous les algorithmes calculent également un majorant sur les perturbations que le modèle donné est capable de tolérer.

Özet

Zamanlı otomatlar, gerçek zamanlı sistemlerin modellenmesi, doğrulanması, ve sentezlenmesine olanak sağlayan bir formalizmdir. Bu modelin soyut ve matematiksel semantiği, bu sistemler üzerinde birçok problemin biçimsel olarak tanımlanıp bilgisayarla¸cözülmesini olanaklı kılar. Öte yandan, zamanlı otomatlar sistemin kendisinden ziyade soyut bir modelini ifade etmek için kullanılır. Dolayısıyla, doğrulama süreci bittiğinde, soyut modelin gerçekleştiriminin ne derece model ile aynı davranışlara sahip olduğunun saptanması gerekir. Bir modelin gerçekleştirilmesi sürecinde önemli bir adım dayanıklılığının sağlanmasıdır. Gerçek zamanlı sistemler bağlamında dayanıklılık, sistemin zamanlaması gürültüye maruz kaldığında, sistemin davranışının korunmasını gerektirir. Dayanıklılığın incelenmesinde birçok yaklaşım ele alınmıştır: Dayanıklılık çözümlemesinde amaç, verilen bir sistemin gürültü altında davranışlar kümesinin değişip değişmediğinin saptanması, ve mümkünse sistemin dayandığı ençok gürültü miktarının hesaplanmasıdır. Dayanıklı sentez, verilen bir sistemi yöneten ve gürültüye dayanıklı bir kontrol yasası (veya strateji) hesaplanmasıyla ilgilenir. Dayanıklı gerçekleştirimde ise amaç, verilen bir zamanlı sistemi otomatik olarak, davranışlarını değiştirmeden gürültüye dayanıklı hale getirmektir.

Bu tezde birçok parametreli gürültü modeli ele alınmıştır. Bu modeller arasında, zaman ölçümüne belirsizlik eklenmesi (önkoşul genişlemesi), zaman koşullarının sınırında bulunan davranışların göz ardı edilmesi (önkoşul daraltması), zaman doğrusunun örneklemlenerek kısıtlanması vardır. Ayrıca, dayanıklı sentez problemi, kontrol yasası ile, yasanın seçtiği girdileri sistematik olarak değiştiren bir ortam arasında oynanan bir oyun olarak modellenip incelenmiştir. Bu gürültü modelleri zamanlı otomatlar, ve bu formalizmin uzantıları olan zamanlı oyunlar, ve ağırlıklı zamanlı otomat ve oyunlara uygulanmıştır.

Bu çalışmada sunulan sonuçlar, önkoşul genişlemesi ve daraltması modelleri için parametrik dayanıklılık çözümlemesi algoritmaları, dayanıklı sentez probleminin iki çeşit oyun semantiğinde, zamanlı otomatlar, oyunlar, ve ağırlıklı uzantıları için çözümleridir. Ayrıca, iki değişik bağlamda dayanıklı gerçekleştirim sorunu ele alınmıştır. İşlenen tüm algoritmalar verilen zamanlı otomatın dayandığı gürültü miktarının bir üstsınırını hesaplar. Önerilen önkoşul daraltmasına karşı dayanıklılık çözümlemesini gerçekleştiren bir yazılım hazırlanmış, bilimsel yazında ele alınmış olan birçok model üzerinde sınanmıştır.

Chapter 1

Introduction

Real-time systems

Digital systems have become a part of our lives: personal computers, smartphones, even espresso machines, but also parts of cars, trains, and airplanes. In fact, thanks to the wide availability of microprocessors, many physical systems are today controlled by computers. For instance, the automotive and the aerospace industries have long been turned to X-by-wire systems, where the control mechanism is ensured by electronic components. Among these systems, real-time systems are of particular interest. These are heterogeneous systems made of physical machines and software parts, and are moreover subject to real-time constraints such as response times and operational deadlines. Thus, designing such systems not only involves developing correct software in the classical sense, but also requires ensuring task execution times, response time guarantees, and other quantitative constraints such as low energy consumption. As real-time systems have gained in complexity, the correctness of critical systems (e.g. airplanes, nuclear plants), and consequently the safety of people involved in these systems have become an issue. In complex real-time systems, small design errors can stay unnoticed during the development and testing phase and have serious consequences. While some of these errors are implementation errors that are introduced during development, some others are design errors that could be corrected before manufacturing even begins. Some publicly known examples to such errors is the Toyota Prius brake system software error1 , which caused a reaction delay of the braking system of almost one second, and the priority inversion bug in the NASA Mars Pathfinder2 , which required restarting the system, thus reducing precious cruise time.

Why are some serious errors not detected? One reason is perhaps the difficulty of applying techniques from software engineering to real-time systems. For instance, the classical testing and debugging of real-time systems is often difficult, since reproducing a physical state of the environment and of the system is often impossible. Also, one cannot simply stop time while debugging and analyze the system. Another source of complexity is due to the distributed nature of some real-time systems, which is already a known issue for concurrent software systems. Most importantly, usual techniques for software development do not take into account non-functional properties such as timing constraints in the executions of the system and physical quantities on which the behavior of the system may depend. Classical control theory does not provide a solution neither since it is not well suited for systems with a software control structure. A comparison between developing systems with classical control theory and developing embedded software systems is given in [START_REF] Caspi | From control loops to real-time programs. Handbook of networked and embedded control systems[END_REF]. In fact, real-time systems require specialized techniques, depending on the application area; see e.g. [START_REF] Kopetz | Real-Time Systems: Design Principles for Distributed Embedded Applications[END_REF]. Finding design methods and techniques to ensure the correctness of various kinds of real-time systems is largely an open research problem today. In [START_REF] Henzinger | The embedded systems design challenge[END_REF], the authors identify the design of embedded systems as an important challenge, and suggest research directions to develop theories and tools for the development of reliable embedded systems.

Formal Verification and Timed Automata

Formal verification consists in proving or disproving the correctness of the design of a system described in a mathematical formalism. Several techniques have been developped for formal verification. Among these, model-checking has an important place. It consists in an exhaustive exploration of the mathematical model of a system, in order to prove or disprove that it satisfies a given property. Model-checking has first been applied to verify finite-state models against properties expressed in temporal logic; see [START_REF]25 Years of Model Checking -History, Achievements, Perspectives[END_REF] for the first applications of model-checking and the history of its development. Richer formalisms have then been considered in order to apply model-checking on infinite-state systems that have unbounded data, communication, probabilities, and time.

In this thesis, we concentrate on model-checking timed automata [AD90, AD94], an extension of finite automata with analog clock variables. This is an abstract and convenient formalism to express several kinds of systems with timing constraints. Several model-checking tools are available for timed automata such as Uppaal [BDL + 06], Kronos [BDM + 98], RED [START_REF] Wang | Redlib for the formal verification of embedded systems[END_REF], Rabbit [START_REF] Beyer | Rabbit: A tool for bdd-based verification of real-time systems[END_REF]. The timed automata technology has been used to prove the correctness of communication protocols [START_REF] David | Modelling and analysis of a commercial field bus protocol[END_REF], clock synchronization algorithms [START_REF] Rodriguez-Navas | Using uppaal to model and verify a clock synchronization protocol for the controller area network[END_REF], audio/video protocols [START_REF] Havelund | Formal modeling and analysis of an audio/video protocol: an industrial case study using uppaal[END_REF], and tool support is available specifically for scheduling analysis of real-time tasks, see e.g. the Times Tool [AFM + 02].

We will explain timed automata on an example. We consider a simple model of a computer mouse controller whose aim is to distinguish between simple and double clicks. We would like any click to be interpreted as a double click whenever it is preceeded by a simple click in less than 100 milliseconds. The timed automaton is given in Fig. 1.1. The underlying finite automaton is simple: it has two locations, and three transitions labelled by click. Notice that the system does not make much sense if we do not take into account time delays between actions: seen as a finite automaton, the system can generate any sequence of clicks, while it can return to location double only after going through location simple. Timing constraints are ensured by the clock x. In timed automata, clocks always grow at a constant rate, and cannot be stopped; they can only be reset (to 0) during transitions. Here, the clock x is reset during clicks. Furthermore, the transition from simple to double is guarded by x < 100, which means that a double click is realizable only if x < 100. A simple click is realizable after a previous click if x ≥ 100, that is, at least 100 milliseconds has elapsed since the latest click. double simple click, x := 0 x ≥ 100, click, x := 0 x < 100, click Figure 1.1: A timed automaton specifying a simple mouse controller detecting simple and double clicks. The clock x is reset when a simple click is realized. After that, any click event received in less than 100 time units gives rise to a double click. Otherwise it is another simple click.

Model-checking algorithms for timed automata allow one to exhaustively verify whether all runs satisfy a property. The problem was shown to be decidable; for instance, PSPACE-complete for location-based Büchi properties [START_REF] Alur | A theory of timed automata[END_REF], and for timed properties expressed in the timed computationtree logic [START_REF] Alur | Model-checking in dense real-time[END_REF]. For example, on the timed automaton of Fig. 1.1, one could check whether two consecutive visits to double are possible (it is not), or whether two consecutive visits to simple separated by more than 100 milliseconds are possible (it is).

Robustness

In this thesis, we are interested in extending model-checking algorithms to take into account robustness constraints, that is, not only checking the correctness of the behaviors in the standard semantics, but also checking for vulnerabilities of a given timed automaton to small perturbations in timings. Robustness is a crucial property of hard real-time systems, requiring them to resist to errors or failures, such as unexpected input; the behavior of a good real-time system should not change drastically if a small error occurs. In control theory, robustness is expressed in terms of continuity:

The response of a system should be a continuous function of its input, thus small variations in the input should cause small variations in the output. It is difficult to define such a continuity notion in real-time systems taking into account errors in discrete behavior, since the correctness of software is rather a boolean value. Thus, there is a need to define an appropriate theory of robustness for real-time systems; this was identified as an important challenge in [START_REF] Henzinger | Two challenges in embedded systems design: Predictability and robustness[END_REF][START_REF] Henzinger | The embedded systems design challenge[END_REF]. The scheduling of the tasks of a camera-recoder system. The period of the generation of the frames is the same as the encoding of the frames. The system can run for an arbitrarily long time.

Let us illustrate robustness on a simple real-time system. We consider a camera that captures a frame every τ time units, while an encoder treats a frame with the same period. We assume that the camera sends a frame to the encoder through a digital communication medium, and that the encoder has a bounded buffer which it uses to store incoming frames. The expected behavior of the system is illustrated in Fig. 1.2. We abstract away the computations and only concentrate on execution times. Thus, we are interested in the schedulability of these tasks. We would like the system to be able to treat an infinite number of tasks. This means that the encoder should not be too late treating the frames since it has only a finite buffer. Since both periods are the same, the present system is clearly capable of realizing this specification. Now that we assessed that the "exact" behavior of the system is correct, the next step should be to check for robustness. Does the system still satisfy the specification under small perturbations? Let us consider a simple perturbation which consists in increasing or decreasing by a small amount the execution times. For instance, assume that the camera works slightly faster than expected, e.g. it sends frames with a period of τǫ, while the encoder treats each frame in τ time units. The scheduling of the tasks is shown in Fig. 1.3. Since the encoder is now slower than the camera, it will eventually skip frames or have a buffer overflow. The system no longer satisfies the specification (being able to run indefinitely) however small ǫ > 0 may be. The system is, therefore, not robust. The scheduling of the tasks of a camera-recoder system of Fig. 1.2, where the execution times are slightly changed. The period of the generation of the frames, τǫ, is shorter than the period of encoding. For any value of ǫ > 0, the encoder will have an overflow or it will skip frames eventually.

The reason behind non-robustness phenomena is that the mathematical model is often an idealization of a physical system. For instance, in the above example, we have summarized the behavior of a complex system as a simple periodic event of duration τ . Clearly, no such physical system can be guaranteed to perform a complex task in exactly τ time units. Often, one can only compute or estimate lower and upper bounds on the execution times, and even that is a challenging problem [START_REF] Kopetz | Real-Time Systems: Design Principles for Distributed Embedded Applications[END_REF]. Nevertheless, modelling with logical execution times as in Fig. 1.2 is useful for a first check of whether the abstract design is correct, and has the advantage of being simple (see e.g. [START_REF] Henzinger | Giotto: A timetriggered language for embedded programming[END_REF]). When modelling at such a high level of abstraction, the system designer knows that she will have to make sure that timing errors are indeed negligible, before actually implementing the system. Similar ideas appear in synchronous programming paradigm [START_REF] Berry | The foundations of Esterel[END_REF], where communications between components are assumed to be instantaneous.

Timed automata are a generic tool that allows modelling systems at various levels of abstractions. They allow modelling scheduling systems as the one described above, but also systems where time has a different scale: one time unit can represent nanoseconds when analyzing stabilization times for asynchronous circuits; it can represent one second in a train-gate controller, where significant events are separated by delays of higher order of magnitude. Thus, timed automata are equipped with a general-purpose idealized mathematical semantics: Time delays can be arbitrarily small and precise, actions (location changes) are instantaneous, and when there are several clocks, these grow at the same rate. This semantics has the advantage of being formal, simple and easy to analyze.

Consequently, robustness problems as in Fig. 1.3 are an issue for timed automata models. This advocates for the development of formal techniques for ensuring the robustness of timed automata. The main objectives in the study of robustness in timed automata can be summarized as follows:

1. Robustness analysis, where one checks whether a given timed automaton satisfies its specification when it is subject to perturbations.

2.

Robust synthesis, where one synthesizes a controller given as a timed automaton, which can enforce a correct behavior under perturbations.

3.

Robust implementation, where one seeks to (automatically) transform a timed automaton into an equivalent one whose behavior respects the specification under perturbations.

4. Language theory, where the goal is to understand to what extent the idealistic semantics of timed automata correspond to that of real-time systems.

We will address all four questions in this thesis. Let us first summarize previous work on robustness in timed automata.

Previous Work on Robustness

We overview several perturbation models considered in the timed automata literature to study robustness. Because timed automata are a general-purpose formalism, several perturbation models have been considered. In fact, whether the idealistic assumptions behind the semantics are justified or not depends on a given application. For instance, if clocks model several time measures done by a single processor, then assuming they are synchronous is harmless. However, if the timed automaton represents the global behavior of a distributed system, say, with several processes each having an independent clock, then one should verify that the specification is satisfied when these clocks are subject to drift. Hence, the study of robustness calls for specific theories for each application area.

In [START_REF] Puri | Dynamical properties of timed automata[END_REF], Puri studies the semantics of closed timed automata where the clocks are subject to a drift bounded by some ǫ > 0. More precisely, the semantics is modified by allowing the clocks to grow with independent rates from [1ǫ, 1 + ǫ]. The robustness question asks whether for some ǫ > 0, the semantics is safe with respect to a given set of states. The timed automaton of Fig. 2.3 appears in [START_REF] Puri | Dynamical properties of timed automata[END_REF] as an example of non-robust timed automaton. It is shown that one can compute the set ǫ>0 Reach ǫ (A) for any timed automaton A, where Reach ǫ (A) denotes the set of states reachable under drifts bounded by ǫ > 0. Hence, one can decide whether safety can be ensured for some ǫ > 0. Robustness analysis against clock drifts was studied for more general timed automata in [START_REF] Dima | Dynamical properties of timed automata revisited[END_REF]. Clock drifts yield decidability in some cases: Timed language inclusion becomes decidable if the right-hand side system is a product of one-clock timed automata under clock drifts [START_REF] Alur | Perturbed timed automata[END_REF]. It was shown that under an external clock synchronization mechanism, closed timed automata are robust against clock drifts [START_REF] Swaminathan | The surprising robustness of (closed) timed automata against clock-drift[END_REF]. Clock drifts were considered in [START_REF] Krishnan | Distributed timed automata[END_REF] in the context of asynchronous distributed timed automata, where clocks evolve independently in each component. Components can read each other's clocks, but cannot reset them. See also [START_REF] Dima | Distributed time-asynchronous automata[END_REF] for a variant of the model. The resulting model is more expressive than timed automata; [START_REF] Ortiz | Distributed event clock automata[END_REF] suggests a model that has the same expressive power as event clock automata of [START_REF] Alur | Event-clock automata: a determinizable class of timed automata[END_REF]. In [ABG + 08], the authors concentrate on the untimed language of distributed timed automata. They distinguish the existential and the universal (untimed) languages recognized by distributed timed automata. The existential language consists in the possible behaviors of a DTA under some evolution of time, where the universal language is the set of behaviors that can arise under any evolution of time. The former is interesting for checking safety properties and has a decidable emptiness problem. The problem is similar to that of [START_REF] Puri | Dynamical properties of timed automata[END_REF] except that there is no upper bound on the magnitude of the drifts. The universal semantics is useful for checking positive specifications, but emptiness is undecidable.

Another perturbation model for timed automata that appears in [START_REF] Puri | Dynamical properties of timed automata[END_REF] is that of guard enlargement. Here, the timed automaton is syntactically modified by relaxing the guards. For some parameter δ > 0, enlargement consists in modifying a guard a ≤ x ≤ b, to aδ ≤ x ≤ b + δ. In this setting, the robustness question asks whether for some δ > 0, the timed automaton is safe with respect to a set of states. Puri states the decidability of this question. These ideas are revisited in [START_REF] De Wulf | Robust safety of timed automata[END_REF], both for clock drifts and guard enlargement, where detailed proofs are given. It turns out that the same algorithm decides the robustness against guard enlargement and clock drifts for safety objectives. Several model-checking algorithms for timed automata were re-visited in the setting of guard enlargement. More precisely, the parameterized robust modelchecking asks whether given a timed automaton A, there exists δ > 0 such that A δ , the timed automaton A whose all guards are enlarged by δ, satisfies a given property. For safety properties, [START_REF] De Wulf | Robust safety of timed automata[END_REF] shows PSPACE-completeness, which is the complexity of the problem in the exact setting. Richer specifications were also studied: Parameterized robust model-checking against co-Büchi properties (including LTL) is PSPACE-complete [START_REF] Bouyer | Robust model-checking of linear-time properties in timed automata[END_REF][START_REF] Bouyer | Robust model-checking of timed automata via pumping in channel machines[END_REF]. For a fragment of the metric temporal logic, called coFlat-MTL, the problem is EXPSPACE-complete [START_REF] Bouyer | Robust analysis of timed automata via channel machines[END_REF] (this logic was identified earlier in [START_REF] Bouyer | The cost of punctuality[END_REF] as a fragment of the logic MTL of [START_REF] Koymans | Specifying real-time properties with metric temporal logic[END_REF] for which model-checking is EXPSPACE-complete). Notice that the complexity of all parameterized robust model-checking algorithms is the same of the corresponding standard model-checking algorithm on timed automata. Symbolic algorithms were also studied for the subclass of timed automata without nested cycles in [START_REF] Daws | Symbolic robustness analysis of timed automata[END_REF][START_REF] Jaubert | Quantitative robustness analysis of flat timed automata[END_REF]. The guard enlargement approach was recently applied to time Petri nets [START_REF] Akshay | Robustness of time petri nets under guard enlargement[END_REF].

A different line of works considers the semantics of timed automata under a sampling of time with unknown (parameterized) sampling period. More precisely, the semantics is obtained by replacing the continuous time by the multiples of a sampling period. In this setting, the emphasis is on the loss of behavior, since restricting the time domain cannot add new behaviors. Examples of timed automata whose behaviors are disabled under any sampling period appear in [START_REF] Cassez | A comparison of control problems for timed and hybrid systems[END_REF]. The authors show the undecidability of the parameterized reachability problem, that is, deciding whether for some sampling period, some state is reachable, under the assumption that an action must be taken at each sampling point. Decidability is reported in [START_REF] Krčál | On sampled semantics of timed systems[END_REF] when this condition is relaxed, allowing time to elapse until any sampling point. Untimed language equivalence for some sampling period is also decidable [START_REF] Abdulla | Sampled semantics of timed automata[END_REF].

The above works concentrate on developing specific algorithms for the modified semantics of timed automata and games, in order to synthesize the parameters ǫ or δ. A different approach consists in incorporating these perturbations for some fixed values of ǫ or δ, by encoding as timed automata. This is easy to do for enlargement since, for a fixed parameter, it consists in syntactically modifying the timed automaton. One can also encode clock drifts, and synchronization delays as suggested in [START_REF] Altisen | Implementation of timed automata: An issue of semantics or modeling[END_REF]. The advantage is that one can rely on existing tools to verify the resulting system. On the other hand, such an encoding generally requires using several clocks, and increases the size of the state space.

In [START_REF] Abdellatif | Model-based implementation of real-time applications[END_REF], robustness against changes in task execution times was investigated in real-time applications. In fact, a known phenomenon in real-time systems is that reducing execution times, for instance, by replacing the hardware by a faster one, does not always preserve correctness since the behavior of the system may depend on expected execution times. The authors describe a methodology to check, using simulation, whether reducing task execution times yield any errors.

Similar notions of robustness were considered in timed games. In [START_REF] Chatterjee | Timed parity games: Complexity and robustness[END_REF], the authors consider two-player timed games, where Player 2 can perturb the delays chosen by Player 1 by a bounded amount δ. In order to win, Player 1 is required to have a strategy that is valid under any move of Player 2, ensures a parity condition while not blocking time. The problem is studied for a fixed δ, by encoding the semantics as a regular timed game. They also give algorithms to decide the winner in this model where Player 1 is only required to play positive delays, and is subject to perturbations. This encoding in timed games were applied to robustness in interface theories in [START_REF] Kim | Robust specification of real time components[END_REF].

Some attempts have been made to study the semantics of timed automata models when these are implemented on physical hardware. In [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF], a simple micro-processor model with a discrete clock, reaction times, and imprecisions was studied. The resulting semantics, called program semantics, is very detailed and is somewhat difficult to work with. The authors also give a simpler semantics, similar to the enlargement mentioned above, which over-approximates the program semantics. This gives precise motivation for the study of the enlargement in timed automata, since robustness against guard enlargement implies that the semantics of the implemented system is correct. Some case studies using this approach are reported in [START_REF] De Wulf | Systematic implementation of real-time models[END_REF]. In [START_REF] Bandur | Microcontroller assembly synthesis from timed automaton task specifications[END_REF], the implementation problem of timed automata specifications is studied for commercial microcontrollers, with application on PIC microchips. In [START_REF] Dierks | PLC-automata: a new class of implementable real-time automata[END_REF], the author defines a semantics based on timed automata for programmable logic controllers, but the resulting model is less expressive than timed automata. A related line of work is interested in code generation from timed automata models. The Times tool is capable of checking schedulability of real-time tasks and generating code [AFM + 02]. Code generation from a more powerful formalism using hybrid automata is considered in [AIK + 03].

Another reason for studying robustness is decidability. In fact, it is believed that the undecidability of some problems in formal verification (such as, timed language inclusion [START_REF] Alur | A theory of timed automata[END_REF]) is due to the excessive expressive power of the formalism, e.g. the ability of timed automata to express complex languages using too much precision. One hope is that by introducing fuzziness in the semantics, thus excluding such unrealistic behaviors, one might obtain decidability. Several researchers argue in this direction. In [START_REF] Asarin | Perturbed turing machines and hybrid systems[END_REF] Turing machines and other hybrid systems were studied under infinitesimal perturbations. The results indicate that the languages defined by these systems become decidable in the class of robust systems, that is, those systems whose languages are unchanged under infinitesimal perturbation. Similarly, reachability becomes decidable in hybrid automata where activities are subject to small drifts, and under some conditions on the target set [START_REF] Fränzle | Analysis of hybrid systems: An ounce of realism can save an infinity of states[END_REF]. In timed automata, an early attempt to define robustness with this idea is based on a topology defined on timed traces [START_REF] Gupta | Robust timed automata[END_REF]. A run is accepted in this semantics if, and only if it has a neighborhood in which the runs of the standard semantics are dense. This allows one to introduce continuity in the semantics: any accepted run is still accepting under any small modification of the delays. Language emptiness is PSPACE-complete, which is the complexity of the problem in the standard semantics. Unfortunately, timed automata can still not be determinized under this semantics, and timed language inclusion is still undecidable [START_REF] Henzinger | Robust undecidability of timed and hybrid systems[END_REF][START_REF] Ouaknine | Revisiting digitization, robustness, and decidability for timed automata[END_REF]. The authors of [START_REF] Ouaknine | Revisiting digitization, robustness, and decidability for timed automata[END_REF] conclude that this semantics is counterproductive for obtaining decidable verification problems.

The work on digitization, initiated in [START_REF] Henzinger | What good are digital clocks?[END_REF], seeks to simplify the verification procedure by means of restricting the domain to timed automata whose languages are stable under discretization. The paper defines a timed language to be closed under digitization if, roughly, all its runs executed under a periodic clock with any offset are still valid runs. Closure under inverse digitization requires that if all such executions yield valid runs, then the original run should be a valid one. The main result of [START_REF] Henzinger | What good are digital clocks?[END_REF] is that given two timed languages A and B, if A is closed under digitization, and B is closed under inverse digitization, then checking timed language inclusion is equivalent to checking timed language inclusion in discrete semantics, thus decidable. An important result derived from [START_REF] Henzinger | What good are digital clocks?[END_REF] is the decidability of the inclusion of the timed language of a closed timed automaton in that of an open timed automaton, in the weakly monotonic time (that is, 0 time delays are allowed) [START_REF] Ouaknine | Universality and language inclusion for open and closed timed automata[END_REF]. Some results of similar nature on discrete time were reported in [START_REF] Asarin | On discretization of delays in timed automata and digital circuits[END_REF]. Specialized model-checkers were developed for verifying timed automata in discrete time [START_REF] Bozga | Some progress in the symbolic verification of timed automata[END_REF][START_REF] Beyer | Rabbit: A tool for bdd-based verification of real-time systems[END_REF].

PSPACE-c

[AD94]

EXPSPACE-c

[BMOW07]

EXPSPACE-c

[BGS12] Robust PSPACE-c [Pur00, DDMR08] PSPACE-c [BMR06, BMS11]

EXPSPACE-c

[BMR08] EXPSPACE

Contributions of This Thesis

In this thesis, we present several results that extend the understanding of robustness in timed automata, and suggest new robustness notions. We summarize our results in four parts.

We consider the problem of robustness analysis, by studying the untimed language of timed automata under guard enlargement. Our result, presented in Chapter 4, is an EXPSPACEalgorithm for checking whether for some enlargement parameter, the enlarged timed automaton has the same untimed language as the original one. Table 1.1 summarizes the complexity of robustness analysis problems against guard enlargement. We then consider robustness analysis against guard shrinkings, which is the inverse of enlargement. In Chapter 5, we show how infinitesimal shrinkings can disable behaviors in timed automata. We give algorithms to synthesize possibly different shrinking values for each guard of a given timed automaton, so that the resulting timed automaton is non-blocking, and is able to time-abstract simulate the original one. Our algorithms are in PSPACEand EXPTIME. Chapter 6 reports on a software tool implementing these algorithms, and presents experimental results.

In the second part of this thesis, we consider the problem of robust synthesis. In this part, we are no more interested in verifying all behaviors of a given system, but we rather want to robustly control a given system, so that, even under perturbations, a desired property is ensured. We consider two perturbation game models, where a second player systematically perturbs the delays chosen by the controller. In the first one, studied in Chapter 8, the control strategy is obliged to satisfy the guards whatever perturbations are, and the goal is to synthesize strategies to ensure infinite runs satisfying a Büchi condition. This is the conservative perturbation game model. We prove PSPACE-completeness, and show that the problem is closely related to convergence phenomena in timed automata. In the second perturbation model, studied in Chapter 7, the control strategy only needs to suggest moves that satisfy the guards, but the perturbed moves may not satisfy these. This is the excess perturbation game model. The resulting semantics is different from the previous one. We prove EXPTIME-completeness for the reachability objectives on timed automata and turn-based timed games. In Chapter 9, we consider weighted timed games, for which the cost-optimal reachability problem is known to be undecidable [START_REF] Bouyer | Improved undecidability results on weighted timed automata[END_REF][START_REF] Brihaye | On optimal timed strategies[END_REF]. We prove that the undecidability "robustly" holds; in fact, the problem remains undecidable for weighted timed games in the conservative perturbation model, and it even becomes undecidable for weighted timed automata under the excess perturbation model. The latter is result is rather surprising, since it goes against the common belief that introducing perturbations can render problems more tractable. Thus, these semantics do not allow to obtain decidability for weighted timed games. On the positive side, we prove the PSPACE-completeness of the cost-optimal reachability in weighted timed automata under the conservative perturbation game semantics. Table 1.2 summarizes the results of this part.

In the third part, we study the robust implementability problem. The goal here is to transform given timed automata into ones that are robust by construction, yet behaviorally equivalent. We consider two approaches. In the first one, studied in Chapter 10, we show how to transform any timed automaton into one that is strongly bisimilar and whose behavior under enlargement (resp. sampling) is preserved in terms of approximate bisimilarity for any desired precision. This allows one to design using the exact semantics and then to automatically refine the system to ensure robustness with respect to guard enlargement or sampling. In a second approach, studied in Chapter 11, we use shrinking as a technique to implement timed automata on hardware. The main idea is that if all guards are shrunk, then no new behavior is present under small enough imprecisions (i.e. enlargement). We define a concrete implementation semantics for timed automata, similar to that of [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF], including a periodic clock and communication delays, and show that the shrinkability of timed automata, in the sense of Chapter 5, implies that the implementation semantics preserves time-abstract behavior, and is non-blocking.

A fourth kind of results are more of theoretical interest, and ask whether the perturbation models considered here simplify the complexity of the verification problems on timed automata. As mentioned above, Chapter 9 presents undecidability results for the cost-optimal reachability in weighted timed games under perturbations, showing that the perturbation game semantics do not yield decidability, and can even render the problems more difficult. A second result, given at the end of Chapter 10, is a powerful one: we show that all undecidable problems on timed automata remain undecidable when restricted to the class of timed automata that are robust to guard enlargements, for any precise definition studied in the literature. Hence, perhaps counterintuitively, perturbation models based on enlargement do not decrease the expressive power of timed automata. Consequently, they do not yield the decidability of the hard verification problems.

Most of the results of this thesis have been published, with the exception of Chapters 8 and 9, which are in submission. The publications partially containing the results are following.

[BLM + 11] Patricia Bouyer, Kim G. Larsen, Nicolas Markey, Ocan Sankur The following ones are under submission at the time of submission of this thesis.

[BMS13] Patricia Bouyer, Nicolas Markey, and Ocan Sankur. Robust weighted timed automata and games. In In submission, 2013.

[SBMR13] Ocan Sankur, Patricia Bouyer, Nicolas Markey, and Pierre-Alain Reynier. Robust controller synthesis in timed automata. In In submission, 2013.

The contents of the following publications are related to the results presented in this thesis. We do not include the details here in order to keep the presentation more coherent. Some of these results will however be briefly mentioned in subsequent chapters. [START_REF] Brenguier | A comparison of succinctly represented finite-state systems[END_REF]

Outline

Part I contains the preliminaries: In Chapter 2, we give formal definitions, examples, and present the perturbation models we consider in this thesis. Some important data structures used in following chapters are presented in Chapter 3. The main results are presented in three parts. Part II is on robustness analysis, and contains results on untimed language preservation under guard enlargement (Chapter 4), shrinkability (Chapter 5), and the software tool Shrinktech (Chapter 6). Part III is about robust synthesis. Chapters 7 and 8 present synthesis algorithms for, respectively, the excess perturbation game and the conservative perturbation game semantics. These semantics are applied to weighted timed games in Chapter 9. Part IV focuses on the robust implementation problem:

Chapter 10 considers approximately implementing timed automata under guard enlargement and sampling. Chapter 11 considers a more concrete model of an execution platform and studies implementation by shrinking.

Part I

Preliminaries

In this part, we give definitions and results that will be used in subsequent chapters. Chapter 2 contains formal definitions of timed automata, its variants, and their semantics. It also gives examples, and define different perturbatuion models studied in this thesis. Chapter 3 is devoted to different data structures used throughout this thesis; we also prove some technical results.

Chapter 2

Timed Automata and Their Semantics

Timed Transition Systems and Timed Game Structures

One convenient way of modelling systems is to define a state space whose elements describe all relevant information about the system at a given instant, and transitions between states, which model the evolution of the system. Formally, a system can be described by a transition system which is a tuple T = (S, s 0 , Σ, →) where S is an arbitrary set of states, s 0 ∈ S is a distinguished initial state, Σ an arbitrary set of labels, and → ⊆ S × Σ × S is the transition relation. We will write transitions as s σ -→ s ′ instead of (s, σ, s ′ ) ∈ →. Since we are interested in timed systems in this thesis, we will consider transition systems in which time is explicitly modelled. We use timed transition systems (TTS) as a low-level formalism to describe timed systems. Formally, a TTS is a tuple T = (S, s 0 , Σ, K, →) such that (S, s 0 , Σ ∪ K, →) is a transition system, where ∪ denotes disjoint union. We distinguish two types of transitions: A transition σ -→ with σ ∈ Σ is an action, while a transition d -→ with d ∈ K is a delay. We will write

s d,σ --→ s ′ if there exists s ′′ ∈ S such that s d -→ s ′′ σ -→ s ′ . Let us also denote s σ = ⇒ s ′ if there exists d ∈ K such that s d,σ --→ s ′ .
A run of T is a sequence ρ = q 1 e 1 q 2 e 2 . . . of states and transitions alternating between delays and actions: we have q i ∈ S, and q i ei -→ q i+1 for all i ≥ 1, with e i ∈ K for odd i, and e i ∈ Σ for even i. The run is initialized if q 1 = s 0 . Let us denote by Runs(T ) the set of initialized runs of T . We denote by state i (ρ) = q i the i-th state of the run ρ, by first(ρ) its first state, and, if ρ is finite, last(ρ) denotes the last state of ρ. We also write trans i (ρ) = e i . Let |ρ| denote the length of ρ, the number of states visited by ρ. For any 0 < i < j ≤ |ρ|, we denote by ρ i...j the subrun from state i (ρ) to state j (ρ). The timed trace of ρ, denoted ttrace(ρ), is the sequence (d i , σ i ) i of consecutive delay and actions of ρ. The untimed trace of ρ, denoted utrace(ρ), is the projection of its timed trace to the actions. We denote by L(T ) the set of untimed traces of the initialized runs of T , called the language of T . For any state s ∈ S, let L(T , s) denote the set of untimed traces starting at s.

A TTS T = (S, s 0 , Σ, K, →) is said to be non-blocking if for any action s σ -→ s ′ , there exists

σ ′ ∈ Σ such that s ′ σ ′ = ⇒ s ′′ .
In other terms, any action can be followed, possibly after a delay, by another action. The set of reachable states, denoted Reach(T ), is defined as those states that appear along initialized runs of T .

The notions of simulation and bisimulation can be defined naturally on timed transition systems [START_REF] Holmer | Deciding properties of regular real timed processes[END_REF], as follows.

Definition 2.1.1. Given a TTS (S, s 0 , Σ, K, →), a relation R ⊆ S × S is a timed simulation if for any (s, t) ∈ R, and any α ∈ Σ ∪ K, s α -→ s ′ implies that t α -→ t ′ for some t ′ ∈ S with (t, t ′ ) ∈ R. If

29

there is such a relation, we say that s is simulated by t. A timed bisimulation is a symmetric timed simulation.

Given two TTS T and T ′ , we say that T is timed-simulated by T ′ , denoted T ⊑ T ′ , if the initial state of T is simulated by the initial state of T ′ in the disjoint union of these.

The notion of time-abstract simulation has been defined [START_REF] Kim | Time abstracted bisimulation: Implicit specifications and decidability[END_REF], in order to compare the qualitative behavior of timed automata, without requiring that the delays be matched exactly.

Definition 2.1.2. Given a TTS (S, s 0 , Σ, K, →), a relation R ⊆ S × S is a time-abstract simulation if for any (s, t) ∈ R, and any σ ∈ Σ, s σ -→ s ′ implies that t σ -→ t ′ for some t ′ ∈ S with (t, t ′ ) ∈ R, and for any d ∈ K, s d -→ s ′ implies that t d ′ -→ t ′ for some d ′ ∈ K and t ′ ∈ S with (s ′ , t ′ ) ∈ R.
If there is such a relation, we say that s is time-abstract-simulated by t. A time-abstract bisimulation is a symmetric time-abstract simulation.

Given two TTSs T and T ′ , we say that T is time-abstract-simulated by T ′ , denoted T ⊑ t.a. T ′ , if the initial state of T is time-abstract-simulated by the initial state of T ′ in the disjoint union of these.

In Chapter 11, we will introduce finer notions of simulation and bisimulation, that quantify the differences between the delays of two systems.

Transition systems have generalizations to two-player games, where actions are jointly determined by both players. A game structure is a tuple T = (S, s 0 , Σ 1 , Σ 2 , T 1 , T 2 , jt), where S is a set of states, s 0 ∈ S is the initial state, Σ i the set of labels of Player i, T i ⊆ S × Σ i is the enabling condition for Player i, and jt : S × Σ 1 × Σ 2 → S the joint transition function. We assume that each Σ i contains a distinguished element ⊥ called the empty action, and that jt(s, ⊥, ⊥) = s for any s ∈ S. A game structure induces a transition system (S, s 0 , Σ 1 × Σ 2 , →) defined by s (σ1,σ2) ----→ s ′ if, and only if (s, σ i ) ∈ T i for each i ∈ {1, 2}, and s ′ = jt(s, σ 1 , σ 2 ). Runs of a game structure are the runs of this transition system. Let H T denote the set of finite runs of T . A strategy for Player i is a function f that maps each h ∈ H T to an action Σ i , such that (last(h), f (h)) ∈ T i . A run is maximal if it is infinite (notice that a finite run can always be extended by (⊥, ⊥)). A run ρ is compatible with strategies f and g of Players 1 and 2, if state i+1 (ρ) = jt(ρ 1...i , f (ρ 1...i ), g(ρ 1...i )) for all i ≥ 1. Given strategies f and g, respectively, for Players 1 and 2, the outcome of the pair (f, g) in T , denoted by Outcome T (f, g) is the unique maximal run that is compatible with both strategies. We denote by Outcome T (f, •) all maximal runs compatible with f and some g, and Outcome T (•, g) all maximal runs that are compatible with g and some f .

A game structure T = (S, s 0 , Σ 1 , Σ 2 , T 1 , T 2 , jt) is turn-based if S can be partitioned as S = S 1 ∪S 2 such that for any s ∈ S 1 , σ 1 ∈ Σ 1 , and σ 2 ∈ Σ 2 , jt(s, σ 1 , σ 2 ) = jt(s, σ 1 , ⊥), and symmetrically for any s ∈ S 2 , σ 1 ∈ Σ 1 , and σ 2 ∈ Σ 2 , we have jt(s, σ 1 , σ 2 ) = jt(s, ⊥, σ 2 ). Moreover, we require that for any s ∈ S i , (s, σ) ∈ T 3-i if and only if σ = ⊥. In other terms, in turn-based game structures, Player i determines alone the move at states S i . We will often define turn-based game structures directly as their transition systems (S 1 ∪S 2 , s 0 , Σ, →).

A reachability objective is a subset of states B ⊆ S. Player 1 has a winning strategy for a reachability objective B if he has a strategy f such that all runs of Outcome T (f, •) visit B. The definition is symmetric for Player 2. A Büchi objective is also defined as a subset B of states. Player 1 has a winning strategy for a Büchi objective B, if she has a strategy f such that all runs of Outcome T (f, •) visit B infinitely often.

Timed Automata and Games

Timed automata [AD90, AD92, AD94] are an extension of finite automata with analog clock variables, and are a convenient formalism to define timed transition systems. In this thesis, we adopt timed automata as the main formalism to model systems. We also consider their extensions two-player timed games [AMPS98, AMP95], which define games structures.

Given a finite set of clocks C, we call valuations the elements of R C ≥0 . For a subset R ⊆ C and a valuation ν, ν[R ← 0] is the valuation defined by ν

[R ← 0](x) = ν(x) for x ∈ C \ R and ν[R ← 0](x) = 0 for x ∈ R. Given d ∈ R ≥0 and a valuation v, the valuation ν + d is defined by (ν + d)(x) = ν(x) + d for all x ∈ C.
We write 0 for the valuation that assigns 0 to every clock.

An atomic guard is a formula of the form k x ′ l or k xy ′ l where x, y ∈ C, k, l ∈ Q ∪ {-∞, ∞} and , ′ ∈ {<, ≤}. A guard is a conjunction of atomic guards. A valuation ν satisfies a guard g, denoted ν |= g, if all constraints are satisfied when each x ∈ C is replaced with ν(x). We denote by φ the set of valuations satisfying φ. We write Φ C for the set of guards built on C. We also define Φ ≤,≥ C (resp. Φ <,>

C

) as the set of guards using only non-strict inequalities (resp. only strict equalities).

A timed automaton is a finite automaton whose edges contain guards and a clock-reset set:

Definition 2.2.1. A timed automaton A is a tuple (L, ℓ 0 , C, Σ, E), where
• L is a finite set of locations, and ℓ 0 ∈ L is the initial location,

• C is a finite set of clocks,

• Σ is a finite set of labels,

• E ⊆ L × Φ C × Σ × 2 C × L is a finite set of edges.
An edge e = (ℓ, g, σ, R, ℓ ′ ) is also written as ℓ g,σ,R ---→ ℓ ′ . We say that g is the guard of the edge e, σ its label, and R its reset set.

An open timed automaton is a timed automaton that only uses guards in Φ <,>

C

. A closed timed automatonis one that only uses guards in Φ ≤,≥ C . We do not include for now any accepting condition in the definition of timed automata, but these will be considered in following chapters. A timed automatin is integral if its guards only have integer constants.

We will first present the standard semantics of timed automata, which we call the exact semantics. Here, clock valuations and delays are arbitrary real numbers. We will later consider different semantics, for instance, by restricting the time domain. The exact semantics of a timed automaton A = (L, ℓ 0 , C, Σ, E) is given as a timed transition system, denoted by A , whose state space is L × R C ≥0 , i.e. pairs of locations and valuations. The initial state is (ℓ 0 , 0); the labels are Σ, and the time domain is R ≥0 . There is a transition (ℓ, ν)

d -→ (ℓ, ν + d), for any (ℓ, ν) ∈ L × R C ≥0
, and any d ≥ 0, and (ℓ, ν)

σ -→ (ℓ ′ , ν ′ ), for σ ∈ Σ, whenever A has an edge (ℓ, g, σ, R, ℓ ′ ) with ν |= g and ν ′ = ν[R ← 0].
Hence, a run in a timed automaton consists in choosing delays, and edges whose guards are satisfied at current valuation. The next state is then given by resetting the designated clocks and changing location.

As an example, consider the following run of the timed automaton of Fig. 1.1.

(double, x = 0) 20.5 --→ (simple, x = 20.5) click --→ (simple, x = 0) 117.8 ---→ (simple, x = 117.8) click --→ (simple, x = 0) 78 -→ (simple, x = 78) click --→ (double, 78)
Hence, the run starts at the initial state (double, 0), and is an alternation of delays and actions.

Definition 2.2.2. A timed game is a tuple (L, ℓ 0 , C, Σ, E 1 , E 2 ) such that (L, ℓ 0 , C, Σ, E 1 ∪E 2 ) is a timed automaton. A turn-based timed game is a timed game (L, ℓ 0 , C, Σ, E 1 , E 2 ) such that L is partitioned as L = L 1 ∪ L 2 with L 1 ∩ L 2 = ∅, and E i ⊆ {(ℓ, g, σ, R, ℓ ′ ) | ℓ ∈ L i } for each i ∈ {1, 2}.
The semantics of a timed game A is given as a game structure

(L × R C ≥0 , Σ ′ 1 , Σ ′ 2 , T 1 , T 2 , jt), also denoted by A . The labels are Σ ′ i = R ≥0 × E i ∪ {⊥}
, that is tuples of delays and edges. The enabling conditions are defined as T i = (s, (d, e i )) with s ∈ S and (d, e i ) ∈ Σ ′ i if and only if e i = (ℓ, g, σ, R, ℓ 1 ) ∈ E i such that s + d |= g. The joint transition function jt obeys to the shortest delay, breaking ties in favor of Player 1. Formally, for ((ℓ, ν), (d, e 1 )) ∈ T 1 and ((ℓ, ν), (d ′ , e 2 )) ∈ T 2 , with e 1 = (ℓ, g, σ 1 , R, ℓ 1 ), and e 2 = (ℓ, g ′ , σ 2 , R ′ , ℓ 2 ), we let

jt(s, (d, e 1 ), (d ′ , e 2 )) = (ℓ 1 , (ν + d)[R ← 0]) if d ≤ d ′ , (ℓ 2 , (ν + d ′ )[R ′ ← 0]) if d > d ′ . Furthermore, we define jt((ℓ, ν), ⊥, e 2 ) = (ℓ 2 , (ν + d ′ )[R ′ ← 0]) and jt((ℓ, ν), e 1 , ⊥) = (ℓ 1 , (ν + d)[R ← 0]). The initial state is (ℓ 0 , 0).
Notice that the semantics of a turn-based timed game is a turn-based game structure. A timed automaton can be seen as a timed game: in this case, Player 2 have no effect on the runs.

The models of timed automata and games were extended with a single cost variable, which can have different constant derivative in each location. The resulting model is called weighted timed game (or automaton) and was first studied in [ATP01, BFH + 01].

Definition 2.2.3. A weighted timed game A is a tuple (L, ℓ 0 , C, Σ, E 1 , E 2 , S) such that (L, ℓ 0 , C, Σ, E 1 , E 2
) is a timed game, and S : L → Z is a slope function.

The semantics of a weighted timed game is defined as that of a timed game, except that the state space also contains the value of the cost variable. We will denote the cost variable by c. Notice that this variable only "observes" the runs, and does not appear, for instance, in the guards. The slope function maps each location to an integer, which is the derivative of the cost variable when the run is at that location. Formally, the semantics of a weighted timed game A is given as a game structure

A = (L × R C ≥0 × R, Σ ′ 1 , Σ ′ 2 , T 1 , T 2 , jt)
, defined as for timed games. The only difference is that the states are now tuples (ℓ, ν, c), where (ℓ, ν) is a state of the underlying timed game, and c is the value of the cost variable. The joint transition function is defined as follows. For ((ℓ, ν), (d, e 1 )) ∈ T 1 and ((ℓ, ν), (d ′ , e 2 )) ∈ T 2 , with e 1 = (ℓ, g, σ 1 , R, ℓ 1 ), and e 2 = (ℓ, g ′ , σ 2 , R ′ , ℓ 2 ), we let

jt((ℓ, ν, c), (d, e 1 ), (d ′ , e 2 )) = (ℓ 1 , (ν + d)[R ← 0], c + S(ℓ) • d) if d ≤ d ′ , (ℓ 2 , (ν + d ′ )[R ′ ← 0], c + S(ℓ) • d) if d > d ′ . Furthermore, we define jt((ℓ, ν, c), ⊥, e 2 ) = (ℓ 2 , (ν + d ′ )[R ′ ← 0], c + S(ℓ) • d ′ ) and jt((ℓ, ν), e 1 , ⊥) = (ℓ 1 , (ν + d)[R ← 0], c + S(ℓ) • d).
Notice that a weighted timed automaton can be seen as a weighted timed game in which Player 2 has no effect on the runs.

For any state (ℓ, ν) (resp. (ℓ, ν, c)) of a (weighted) timed game, let us define the projection loc((ℓ, ν)) = ℓ (resp. loc((ℓ, ν, c)) = ℓ).

Examples

Producer-Consumer We define a simple producer-consumer system. The producer generates an event every 2 time units, and the consumer treats an event with the same period. The two components communicate through a bounded channel, modelled as an automaton. A high-level description of the system is shown in Fig. 2.1, where the buffer size is a parameter N . The system enters an error state (location err) in case of a buffer overflow.

The timed automaton A 1 of Fig. 2.2 is the instantiation of this system for N = 1, where in addition, the system starts at a state x = 1 ∧ y = 0, which means that the consumer has an offset of 1. We also consider the timed automaton A 2 of Fig. 2.3, where the requirements on the event periods are relaxed: at least one event is generated every 2 time units, and at most one event is consumed every 2 time units, while these two events must alternate. The timed automaton A 2 can be seen as a more abstract specification for a system like A 1 .

ℓ 1 ℓ 2 ℓ 3 err x = 2, gen, x := 0 y = 2, con, y := 0 i > 0, con, i-- i < N, gen, i++ i = N, gen Figure 2
.1: A timed automaton modelling a producer-consumer system, given as a network of timed automata with a bounded integer variable i which is initially 0. Here, each component is a separate timed automaton. Time progresses globally, and any action shared between two components is only possible if both components move simultaneously. Networks of timed automata, and finite variables allow a more compact representation. We did not formally define these, but they can be easily encoded in the underlying finite automaton. In our discussion, we concentrate on an instantiation for N = 1, given explicitly as a timed automaton in Fig. 2.2.

ℓ 0 ℓ 1 ℓ 2 err x = 1, y := 0 x = 2, gen, x := 0 y = 2, con, y := 0 x = 2 ∧ y ≤ 2, gen Figure 2.2:
The timed automaton A 1 modelling the producer-consumer system of Fig. 2.1 instantiated for N = 1. The transition from ℓ 0 to ℓ 1 models an offset of 1 time unit given for the consumer.

Scheduling An application of timed automata is the synthesis of schedulers in various contexts [START_REF] Adbeddaïm | Scheduling with timed automata[END_REF]. Let us give here an encoding of an instance of the job-shop scheduling problem.

Consider the scheduling problem instance described in Fig. 2.4, which is a variant of an example of [RWT + 06]. Assume that we look for a work-conserving scheduler, that will immediately start executing a task if a machine is free for execution and a task is available. What execution time can Here, the specification is more abstract: an allowed behavior consists in generating at least an event every 2 time units, and consuming at most one every 2 time units, while alternating between generation and consumption. This automaton coincides with the example given by Puri [START_REF] Puri | Dynamical properties of timed automata[END_REF]. a work-conserving scheduling policy guarantee on this instance? One can model this problem as a timed automaton, and prove, by reachability analysis, that these tasks can be scheduled using a work-conserving policy within six time units. In fact, the scheduling given in Fig. 2.4 is a feasible instance.

ℓ 0 ℓ 1 ℓ 2 err x = 1, y := 0 x ≤ 2, gen, x := 0 y ≥ 2, con, y := 0 x = 2 ∧ y ≤ 2, gen
The dependences, the work-conserving policy and other constraints can be encoded as a timed automaton, where clocks are used to count execution time. To check whether tasks can be scheduled in c time units, one can use an additional clock t that measures the time elapsed from the beginning, and require t ≤ c at every edge. Let us describe the timed automaton encoding this problem. For convenience, we define the system as a network of timed automata with synchronization on shared actions, and we use boolean variables. As previously, the corresponding timed automaton (conforming to Definition 2.2.1) can be deduced easily.

The system contains two processes: Process 1 executing A and B, and Process 2 executing C, D, and E. Both processes need the same resources (machines M 1 and M 2 ), which can only be used exclusively. This system can be modelled by a network of timed automata, as follows. We define a timed automaton P 1 corresponding to Process 1, and P 2 corresponding to Process 2. A third timed automaton M enforces the mutual exclusion for both machines: no more than one task is executed on a machine at any time. Moreover, we will also use M to impose a work-conserving scheduling: this automaton will block any action if some task is waiting for execution on a machine that is free (more details follow below). Each automaton P i makes sure that its tasks are executed respecting the dependences and timing constraints. All three components are given in Figures 2.5-2.7. For instance, in automaton P 1 , the task A can be executed on M 1 (first edge), only if lock 1 can be taken. The lock is released upon the termination of the task (second edge). Automaton M has two boolean variables b 1 , b 2 , where b i is set to true if machine M i is busy. The two self-loops are 0 1 2 3 4 5 6 7 8

M 2 M 1 A C B D E
q1 q2 q3 q4 q ′ 4 q5 q6 q ′ 6 q7 t≥2,lock2 x2:=0 x2=2,unlock2 l o c k 1 x 2 : = 0 l o c k 2 x 2 : = 0 u n l o c k 1 x 2 = 1 u n l o c k 2 x 2 = 1 l o c k 1 x 2 : = 0 l o c k 2 x 2 : = 0 u n l o c k 1 x 2 = 1 u n l o c k 2 x 2 = 1
= (∀i ∈ {1, 2}, ¬b i ∧ Waiting i ⇒ u = 0) ∧ t ≤ c.
Here t is a clock that is never reset. The constraint t ≤ c ensures that we only consider schedules that terminate in c time units. defined for i = 1, 2. For instance, the automaton M synchronizes with action lock i only if b i is not set to true. It has the guard ∀i ∈ {1, 2}, ¬b i ∧ Waiting i ⇒ u = 0 and t ≤ c (the universal quantifier and implication are only used here to obtain a compact representation; an equivalent guard can be obtained without difficulty). The first one ensures work-conserving scheduling, while the second one blocks any action after c time units. Here, c needs to be instantiated for the timed automaton to be defined; one could choose c = 6 for our purpose. Here, Waiting i is a formula stating that some task is ready for execution on machine i. We omit the definition of Waiting i here but it can be easily defined using the locations of components P 1 and P 2 . Automaton M blocks any action in the whole system if time has elapsed while some task was ready for execution on a machine that is free. Notice also that we marked some locations as final in each component. This means that we are only interested in runs that end in final locations in all components as these correspond to successful scheduling of all tasks.

Scheduling with Interruption Timed games can be used to model scheduling instances where scheduled tasks are cancelled by an external event. A simple example is given in Fig. 2.8. In this example, the location p 1 represents the scheduling of a task that takes 3 time units to execute, and the objective of Player 1 is to reach the location p 2 in at most 4 time units. However, before the guard x = 3 is enabled, Player 2 can "interrupt" the execution and move the system to p 3 . Here, the task needs to be scheduled once again, but the objective is only reached if there remains enough time (if t ≤ 4 ∧ x = 3 is reachable). Otherwise, the system is stuck at p 3 or p 4 .

Weighted Timed Games A cost variable can be added to timed automata and games to express varying amounts of resource. A scheduling problem similar to ones above is given in Fig. 2.9, where, moreover, several executions with different costs are possible. In this weighted timed game, the goal of Player 1 is to reach the location p 6 . Roughly, two kinds of strategies allow reaching p 6 : one can first go either to p 2 or to p 4 . In the former case, the cost grows with derivative 3 at location p 2 where at least one time unit must be spend. In the latter case, the cost grows with a smaller derivative (namely, 2) in location p 4 ; however the time spent there is determined by Player 2. In either case, the play must stay at p 5 where the cost grows with derivative 1, until t ≥ 3. Here, the least cost that Player 1 can guarantee while reaching p 6 is 4. In fact, she can go to p 2 and spend exactly one time unit, while the cost grows by 3, then, spend one time unit in p 3 , and one time unit in p 5 , where the grows by 1. The path through p 4 does not yield a better cost, since Player 2 can wait 3 time units in location p 4 , which yields a cost of at least 6.

Perturbation Models

In order to study robustness in timed automata, one first needs to define a perturbation model against which a given model is to be checked. We present and compare several perturbed semantics we study in this thesis, and illustrate these on the examples of the previous section. A common feature of all semantics is that we consider that the bound on the imprecisions (denoted by δ below), or the sampling period (denoted 1 k ) are seen as unknown parameters to be synthesized by robustness analysis. In fact, if an exact value for this parameter is known, one can often encode the resulting semantics by a timed automaton, although such an encoding often increases the size of the model. Here, we are rather interested in understanding the timed automata that are robust for all values of

1 1 2 2 ℓ 1 ℓ 2 x 0 0 y Reach( A ) 1 1 2 2 ℓ 1 ℓ 2 err x 0 0 y δ>0 Reach( A δ )
Figure 2.10: The set of reachable states of A 2 (on the left) and A 2 δ for an arbitrary δ > 0 (on the right). The location err is not reachable in A 2 but becomes reachable in A 2 δ .

the parameter under some bound, and in synthesizing this bound to ensure correctness. Note that some of the following semantics are only defined for timed automata, since we do not study all semantics in (weighted) timed games.

Enlargement

Given a parameter δ > 0, enlargement consists in replacing each guard of the form

x ∈ [a, b] by x ∈ [a -δ, b + δ].
Formally, given a clock set C, we define the enlargement of an atomic guard g by δ, denoted g δ , as follows.

k x -y ′ l δ = k -δ x -y ′ l + δ, and k x ′ l δ = k -δ x ′ l + δ.
for any x, y ∈ C, k, l ∈ Q and , ′ ∈ {<, ≤}. The enlargement of a guard is obtained by enlarging its atomic guards. Given a timed automaton A, let us denote by A δ the timed automaton obtained from A by enlarging by δ all its guards. It is easy to show that any behavior of A is still present in A δ for any δ > 0, in the sense that A ⊑ A δ , where the identity relation can be used to show that simulation holds. Hence, the enlargement consists in adding new behaviors by means of relaxing the guards by some parameterized amount. Robustness in this context means that a timed automaton should satisfy a specification even if the guards are enlarged by a small δ > 0. In other terms, a slight error in the timings should not lead the system to an error. It was shown in [START_REF] De Wulf | Robust safety of timed automata[END_REF] that the timed automaton A 2 of Fig. 2.2 is not robust to guard enlargements, for any value of δ > 0, in the following sense. While the location err is not reachable in the exact semantics, it becomes reachable in A 2 δ for all δ > 0. Hence, the slightest enlargement changes the qualitative behavior of the timed automaton. The sets of reachable states, for δ = 0 and δ > 0, are illustrated in Fig. 2.10. Note that the timed automaton A 1 also suffers from the same robustness problem: the location err becomes reachable under any positive enlargement.

Enlargement has also implications in implementability of timed automata, that is, whether one can make sure that the implemented system preserves the exact semantics of the model. In [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF], the authors define a program semantics, corresponding to the execution of timed automata by a simple model of microprocessor with an imprecise clock, a buffer and a positive reaction time. It was shown that when parameters are chosen appropriately, the enlargement yields an overapproximation of the program semantics. This motivates the study of enlargement in timed automata since one can prove the correctness of a system executed on a microprocessor, in this framework.

Chapter 4 treats the robustness analysis against guard enlargements, while Chapter 11 presents a variant of the program semantics. Enlargement is considered throughout this thesis as a general technique.

Shrinking

One might also be interested in the dual notion of enlargement, that is checking whether the semantics of a given timed automaton is vulnerable to guard shrinkings, which consists in transforming a guard

x ∈ [a, b] into x ∈ [a + δ, b -δ ′ ].
More precisely, we will be interested in checking whether the guards of a given timed automaton can be shrunk so that the resulting timed automaton time-abstract simulates the original timed automaton, and is non-blocking. So, we are asking whether the behavior of the timed automaton depends on the system's ability to take transitions at the borders of the guards (i.e. at the last moment, or immediately after enablement). We believe that the behavior of a good timed automaton design should not change when one forbids such "limit" behavior.

Formally, we define the shrinking of an atomic guard g as its enlargement by a negative amount. We will consider possibly different shrinking parameters for each atomic guard in a timed automaton. So for any timed automaton A, let I denote the set of its atomic guards. Given a vector δ of nonnegative rational numbers indexed by I, let us denote by A -δ the timed automaton obtained from A by shrinking each atomic guard i ∈ I by δ i . We will rather choose these parameters as kδ, where k is a set of natural numbers, and δ is a rational. Note that any finite vector of nonnegative rational numbers can be written in this form.

We will be interested in the synthesis of these parameters kδ so as to ensure time-abstract simulation and non-blockingness of the resulting timed automaton. Let us show that the timed automaton A 2 of Fig. 2.3 is not shrinkable, in the sense that any shrinking yields a timed automaton that cannot time-abstract simulate A 2 . The cycle (gen•con) ω is a possible behavior of A 2 . However, if one of the guards is shrunk, say, if we replace x ≤ 2 by x ≤ 2δ, then, such a cycle can only be taken at most 1 δ times. In fact, one can show that the value of x is increased by at least δ at each iteration, so any run will eventually reach a deadlock. This means that the behavior (gen • con) ω is only possible if the system takes each action "at the last moment", right before the guard is disabled. This behavior is therefore not "robustly realizable".

Shrinking is also a natural method for refining or implementing a timed automaton under imprecisions. In fact, if one "implements" a guard x ∈ [a, b] as x ∈ [a + δ, bδ], then, under imprecisions bounded by some ∆, the system guarantees that x ∈ [a + δ -∆, bδ + ∆]. Provided that 0 ≤ ∆ < δ, the resulting behavior conforms to the initial model since

[a + δ -∆, b -δ + ∆] ⊆ [a, b].
Thus, no new behavior is present in the implemented system under imprecisions. Formally, one can show that A -kδ+∆ ⊑ A for appropriately chosen k, δ and ∆.

Shrinkability analysis is studied in Chapter 5. We discuss the technique of implementation by shrinking in Chapter 11.

Sampling

Timed automata are a generic formalism that allows the design of various systems. It is sometimes convenient to use timed automata, and its continuous time semantics, to model a system that is intended to be implemented under sampled time. The sampled semantics of a timed automaton A consists in defining the TTS as in the exact semantics, except that the time domain is1 k N for some k ≥ 1. This semantics is denoted by A 1 k . It should be clear that any behavior of the sampled semantics is a behavior of the (continuoustime) exact semantics. The converse does not always hold, since some infinite runs may require delays with arbitrary precisions [START_REF] Cassez | A comparison of control problems for timed and hybrid systems[END_REF]. For instace, in timed automaton A 2 , if we replace the guards by strict counterparts, that is x ≤ 2 by x < 2, and y ≥ 2 by y > 2, then the cycle (gen • con) ω cannot be repeated infinitely often under any sampling. Robustness against sampling consists in checking whether the sampled semantics preserves some aspects of the exact semantics.

When the sampling period is seen as a parameter, the parameterized safety problem is undecidable [START_REF] Cassez | A comparison of control problems for timed and hybrid systems[END_REF], while the parameterized reachability problem is decidable [START_REF] Abdulla | Sampled universality of timed automata[END_REF]. Untimed language equivalence was shown decidable in [START_REF] Abdulla | Sampled semantics of timed automata[END_REF].

In Chapter 10, we give a construction to systematically implement a given timed automaton under the sampled semantics, while the behavior is approximately preserved.

Game Semantics: Excess-Perturbation Game

The semantics we defined above are interesting for worst-case analysis. For instance, when checking safety properties under guard enlargement, one seeks to make sure that a bad behavior is not possible under any scenario, given this perturbation. However, such an analysis does not take into account the fact that a real-time controller can observe the perturbations happened in the past, and try to adapt its behavior to reach a desired state or avoid a bad state. We define here a game semantics to model robustness while capturing the possible reaction of the system.

Given a timed game A = (L, ℓ 0 , C, Σ 1 , Σ 2 , E 1 , E 2 ) and a parameter δ > 0, we define the excessperturbation game of A w.r.t. δ as a game structure G exs δ (A) between players Controller and Perturbator. Intuitively the semantics is the following: At any location, Controller and Perturbator both suggest an action, which is either a delay and an edge, or the empty action ⊥. If Perturbator's delay is shorter, the suggested delay and action are taken. Otherwise, the play moves to an intermediate state where Perturbator chooses a perturbation among [-δ, δ]. Then, the delay and the edge suggested by Controller are taken after this perturbation. Formally, the state space of

G exs δ (A) is S = L × R C ≥0 ∪ L × R C ≥0 × R ≥0 × E, and the initial state is (ℓ 0 , 0). The labels are Σ ′ 1 = R ≥0 × E 1 ∪ {⊥} and Σ ′ 2 = R ≥0 × E 2 ∪ [-δ, δ] ∪ {⊥}.
The enabling condition T 1 for Controller is as follows. From any state (ℓ, ν) ∈ S, we have ((ℓ, ν), d, e 1 ) ∈ T 1 for any d ≥ δ and e 1 ∈ E 1 such that if we write e 1 = (ℓ, g, σ 1 , R, ℓ 1 ), then ν + d |= g. For states (ℓ, ν, d, e) ∈ S, we have ((ℓ, ν, d, e), ⊥) ∈ T 1 . For Perturbator, the enabling condition T 2 are as follows. From any state (ℓ, ν) ∈ S, we have ((ℓ, ν), d, e 2 ) ∈ T 2 for any d ≥ δ and e 2 ∈ E 2 such that if we write

e 2 = (ℓ, g ′ , σ 2 , R ′ , ℓ 2 ), then ν + d |= g 1 For states (ℓ, ν, d, e) ∈ S, we have ((ℓ, ν, d, e), ǫ) ∈ T 2 for any ǫ ∈ [-δ, δ].
The joint transition function δ respects the shorter delay, as in timed games. We let

jt((ℓ, ν), (d, e 1 ), (d ′ , e 2 )) = (ℓ, ν, d, e 1 ) if d ≤ d ′ , (ℓ 2 , (ν + d ′ )[R ′ ← 0]) if d > d ′ . 0 1 2 3 4 5 6 7 8 M 2 M 1 A B C D E
Figure 2.11: The scheduling instance of Fig. 2.4 where the duration of task A is reduced to 2δ.

Because of the work-conserving policy, the optimal scheduling is now as shown in this figure, and takes 8δ time units. This is a timing anomaly that is captured by the excess-perturbation semantics.

We define jt((ℓ, ν), (d, e 1 ), ⊥) = (ℓ, ν, d, e 1 ) and jt((ℓ, ν), ⊥,

(d ′ , e 2 )) = (ℓ 2 , (ν + d ′ )[R ′ ← 0]
), using the same notations as above. Last, we let jt((ℓ, ν, d, e 1 ),

⊥, ǫ) = (ℓ 1 , (ν + d + ǫ)[R ← 0]).
The semantics for a weighted timed game

A = (L, ℓ 0 , C, Σ 1 , Σ 2 , E 1 , E 2 , S
) is very similar. The state space now contains, in addition, a real value for the cost variable. We only need to define the change in the cost variable. At any state (ℓ, ν, c), given two actions

(d, e 1 ) ∈ Σ ′ 1 and (d ′ , e 2 ) ∈ Σ ′ 2 , with e 1 = (ℓ, g, σ 1 , R, ℓ 1 ) and e 2 = (ℓ, g ′ , σ 2 , R ′ , ℓ 2 ), we let jt((ℓ, ν, c), (d, e 1 ), (d ′ , e 2 )) = (ℓ 1 , ν, c, d, e 1 ) if d ≤ d ′ , (ℓ 2 , (ν + d ′ )[R ′ ← 0], c + d ′ • S(ℓ)) if d > d ′ .
Further, for any state (ℓ, ν, d, e 1 ), we have

jt((ℓ, ν, d, e 1 ), ⊥, ǫ) = (ν + d)[R ← 0], c + (d + ǫ) • S(ℓ)).
Hence the cost has derivative S(ℓ) at location ℓ during the perturbed delay.

In this definition, we restrict Controller to play delays that are at least δ. This models the fact that consecutive actions must be separated by a positive amount of time. We assume for simplicity that this lower bound and the magnitude of the perturbation are both δ. They could be chosen as different parameters; our results presented in Part III would hold. The name excess-perturbation comes from the fact that although Controller is required to suggest delays and edges that satisfy the guard, Perturbator's moves are not required to respect the guards. We also consider a conservative variant of this semantics where guards must be satisfied under any perturbation. See below for a comparison of the two semantics.

Let us consider the scheduling example of Figures 2.5-2.7. If we consider the excess-perturbation semantics, then, while Controller can only suggest a delay of 2 for the termination of task A (between locations p 2 and p 3 ), the actual delay could be shorter or longer by δ. Assume Perturbator chooses to delay 2δ. Then, Figure 2.11 shows the optimal scheduling (that is, with least completion time) after the termination of task A, which takes 8δ time units. Thus, any small decrease in the execution time of A increses the completion time by almost 2 time units. This is a timing anomaly, a well-known phenomenon in scheduling [RWT + 06].

The excess-perturbation semantics can capture such timing anomalies in scheduling applications, and ensure robust control in other applications. In fact, here, Controller doesn't have a strategy to reach the final location under the constraint t ≤ 6, for any δ > 0. But one can show that for any c > 8, it has a strategy under the constraint t ≤ c, for small enough δ > 0.

We consider the parameterized robust reachability problem in this semantics in Chapter 7.

Game Semantics: Conservative-Perturbation Game

Another possibility when defining a game semantics to capture robustness is to require that Controller should suggest moves that satisfy the guard of the chosen edge under any move of Perturbator. This means restricting Controller to play far from the borders of the guard. In particular, equality constraints are never enabled in such a semantics. This semantics is useful if one already accounts for imprecisions in the model, by providing time intervals for each action. Then, the designer is interested in staying strictly inside the guards, rather than analyzing additional runs. This corresponds to a different design approach (see below for a comparison with the previous semantics). Formally, we define the conservative perturbation game for a given weighted timed game A, denoted by G cons δ (A), similarly to G exs δ (A) with only the following difference. The enabling condition T 1 for Controller is modified as ((ℓ, ν), d, e 1 ) ∈ T 1 for any d ≥ δ and e 1 ∈ E 1 such that if we write e 1 = (ℓ, g, σ 1 , R, ℓ 1 ), then ν

+ d + ǫ |= g for all ǫ ∈ [-δ, δ].
When studying the behavior under this semantics, the emphasis is no more on the newly appeared behaviors, as this is the case in the excess-perturbation game semantics. In fact, it follows from the definition that any outcome of this game is a run of the exact semantics of the timed automaton. One is rather interested in the loss of behaviors. For instance, equality constraints or combination of other guards that imply such a constraint are never enabled. But what is more interesting is that some infinite runs may be disabled under this semantics. For instance, the cycle (gen • con) ω cannot be repeated an infinite number of times under some strategy of Perturbator. In chapter 8, we will be interested in deciding whether one can ensure infinite runs satisfying some Büchi conditions, for some value of δ.

This semantics with a known value for δ was studied in [START_REF] Chatterjee | Timed parity games: Complexity and robustness[END_REF] for timed games with parity conditions. In this case, using an appropriate encoding, the problem can be reduced to solving usual timed games. The results of this thesis also shows that this semantics is related to recent work on convergence phenomena on timed automata runs [START_REF] Cassez | A comparison of control problems for timed and hybrid systems[END_REF][START_REF] Basset | Thin and thick timed regular languages[END_REF][START_REF] Stainer | Frequencies in forgetful timed automata[END_REF].

Excess or Conservation?

We defined here two very similar game semantics. We believe both are meaningful and can appear naturally at different levels of abstraction. For instance, the excessperturbation game semantics is a natural choice when modelling a real-time system with fixed task execution times, if we also know that these execution times will be subject to perturbation whose magnitude is unknown in advance, which may depend on the implementation platform to be chosen later. Incorporating these perturbations in the model, for instance, by replacing equality constraints by non-punctual intervals, requires a choice of a suitable interval length which may not be known. Moreover this will increase the state space in general. Hence, as in the scheduling example of Section 2.3, the excess-perturbation game semantics allows one to keep the design abstract and still apply robustness analysis.

On the other hand, in some applications, specifying distinct lower and upper bounds in timings may be natural. For instance, if one is interested in modelling an embedded system that should send a signal to another component which accepts input signals in a time interval [l, u], then it is natural to look for a controller that strictly respects this interval. Such a model and its semantics would be closer to the actual program. In this case, the conservative-perturbation game semantics is the natural choice.

Chapter 3

Data Structures

In this chapter, we present several data structures and some technical results used throughout this thesis. We start by defining regions and region automata, which are well known notions in the timed automata literature [START_REF] Alur | A theory of timed automata[END_REF], upon which several results have been built. Among these, we define here orbit graphs, which are graphs that summarize the reachability relations between the vertices of regions [START_REF] Puri | Dynamical properties of timed automata[END_REF]. Then, we introduce an original data structure, called shrunk DBM, which is an extension of difference-bound matrices used to represent "shrunk zones". We give a parameterized and a non-parameterized version of this data structure.

Regions

The decidability of several verification problems in timed automata relies on the fact that a finiteindex quotient of the state space can be defined while preserving the important behaviors. Formally, given a timed automaton A = (L, ℓ 0 , C, Σ, E), let M denote the largest constant that appears in its guards in absolute value. We define an equivalence relation ≃ M on valuations as follows. For any ν, ν ′ ∈ R C ≥0 , we let ν ≃ M ν ′ if, and only if the following conditions are satisfied, for all pairs of clocks x, y ∈ C.

1. either ⌊ν(x)⌋ = ⌊ν ′ (x)⌋ or ν(x), ν ′ (x) > M , 2. if frac(ν(x)), frac(ν ′ (x)) ≤ M, then frac(ν(x)) = 0 ⇔ frac(ν(x) ′ ) = 0, 3. if frac(ν(x)), frac(ν(y)) ≤ M , then frac(ν(x)) ≤ frac(ν(y)) ⇔ frac(ν ′ (x)) ≤ frac(ν ′ (y)),
4. for any interval I among (-∞, -M ), [-M, M ], (-M, -M + 1), . . . , (-1, 0), [0, 0], (0, 1), . . . , [M, M ], (M, ∞), we have,

ν(x) -ν(y) ∈ I ⇔ ν ′ (x) -ν ′ (y) ∈ I.
where frac(•) denotes the fractional part. The equivalence class of a valuation ν for the relation

≃ is denoted by reg(ν) = {ν ′ | ν ≃ M ν ′ },
and called a M -region of A. When M is clear from context, these are simply called regions. It is known that ≃ M has finite index [START_REF] Alur | A theory of timed automata[END_REF], which can be exponential in the size of A.

Our definition differs from the first definition of regions of [START_REF] Alur | A theory of timed automata[END_REF]; the fourth condition appears later in [START_REF] Bouyer | Are timed automata updatable?[END_REF]. In most chapters, we will assume that clocks do not go above the maximum constant. Under this assumption, both definitions are equivalent. We only need the fourth condition in Chapter 10, where we also give a more refined definition of regions using arbitrary granularity for the constants of the guards.

Assuming that clocks do not go above some constant means that we discard all runs containing too long delays, or along which some clocks are not reset. This assumption appears in several works e.g. [START_REF] Puri | Dynamical properties of timed automata[END_REF][START_REF] De Wulf | Robust safety of timed automata[END_REF]. Let us call bounded regions, those regions where all clocks are below the constant M . Any bounded region r is defined by fixing the integer parts of the clocks, and giving a partition X 0 , X 1 , . . . , X m of the clocks, ordered according to their fractional values: for any ν ∈ r, 0 = frac(ν(x 0 )) < frac(ν(x 1 )) < . . . < frac(ν(x m )) for any x 0 ∈ X 0 , . . . , x m ∈ X m , and frac(ν(x)) = frac(ν(y)) for any x, y ∈ X i . Here, X i = ∅ for all 1 ≤ i ≤ m but X 0 can be empty. We will refer to this partition by the partition according to the fractional ordering. The region automaton of A is a finite automaton with alphabet Σ ∪ {delay}, denoted by R(A), defined as follows [START_REF] Alur | A theory of timed automata[END_REF]. The states are pairs (ℓ, r) where ℓ ∈ L and r is a region. There is a transition (ℓ, r) delay ---→ (ℓ, r ′ ) if, and only if, ν ′ = ν + d for some ν ∈ r, ν ′ ∈ r ′ and d ≥ 0. There is a transition (ℓ, r) σ -→ (ℓ ′ , r ′ ) if, and only if A has an edge (ℓ, g, σ, R, ℓ ′ ), and for some ν ∈ r, writing ν ′ = ν[R ← 0], we have r ′ = reg(ν ′ ). A region automaton is thus a finite transition system over alphabet E ∪ {delay}. We will call paths the runs of this transition system. Given a run ρ, its projection on regions is the path π in the region automaton s.t. state i (ρ) ∈ state i (π) for all 1 ≤ i ≤ n, and either trans i (ρ) = trans i (π) or trans i (π) = delay and trans i (ρ) ∈ R ≥0 . In this case, we write first(ρ) π -→ last(ρ) (and say that ρ is along π). A lasso is a path π 0 π 1 where π 1 is a cycle, i.e. first(π 1 ) = last(π 1 ). A cycle of R(A) is a progress cycle if it resets all clocks at least once [START_REF] Puri | Dynamical properties of timed automata[END_REF].

We define the timed-action region automaton R ta (A), similarly to the region automaton, on the set of pairs (ℓ, r) of locations and regions, with the difference that there is a transition (ℓ, r) σ -→ (ℓ ′ , r ′ ) if, and only if for some ν ∈ r, and ν ′ ∈ r ′ , d ≥ 0 and an edge (ℓ, g, σ, R, ℓ ′ ),

ν ′ = (ν + d)[R ← 0].
Hence, delays are now hidden inside actions. We define the paths of R ta (A) similarly to R(A). Given a run ρ of A, its timed-action projection on regions is the path π in the timed-action region automaton s.t. state i (ρ) ∈ state i (π) for all odd 1 ≤ i ≤ n, and trans i (ρ) = trans i (π) for even 1 ≤ i ≤ n.

It is known that R(A) is time-abstract bisimilar to A, whereas R ta (A) is weakly time-abstract bisimilar (weak bisimulation simply does not observe delays). Hence, any time-abstract property on A can be checked on R(A) or R ta (A). These automata have exponential size. Some minimization algorithms have been studied in order to construct a minimized version of R(A) [START_REF] Tripakis | Analysis of timed systems using time-abstracting bisimulations[END_REF].

Orbit graphs

A vertex of a region r is any point of r ∩ N C , where r denotes the topological closure of r. For any region r, and any clock x, let us denote by r x,0 the upper bound (by -r 0,x the lower bound) on clock x inside region r. Consider the partition of the clocks X 0 , X 1 , . . . , X m according to their fractional parts in r. Any vertex v of r is defined by the choice of an index 1 ≤ i ≤ m such that for all x ∈ X 1 , . . . , X i , we have v(x) = -r 0,x and for all x ∈ X i+1 , . . . , X m , we have v(x) = r x,0 . Hence, any region has at most |C| + 1 vertices (See also [START_REF] De Wulf | Robust safety of timed automata[END_REF]). Let V(r) denote the set of vertices of r. We also extend this definiton to V((ℓ, r)) = V(r). It has been shown that all valuations in r are convex combinations of V(r) [START_REF] Puri | Dynamical properties of timed automata[END_REF].

To any path π of the region automaton, we associate a |π| + 1-partite graph γ(π) called the orbit graph of π [START_REF] Puri | Dynamical properties of timed automata[END_REF]. Intuitively, the orbit graph of a path gives the reachability relation between the vertices of the regions visited along the path. Formally, for a transition τ = q 1 e 1 q 2 , γ(τ

) = (V 1 ∪ V 2 , f G , E) is a bipartite graph where V 1 = {(1, v)} v∈V(q1) , and V 2 = {(2, v)} v∈V(q2) . For any (1, u), (2, v) ∈ V 1 × V 2 , we have an edge (u, v) ∈ E, if,

and only if u ē1

-→ v, where e 1 = delay if e 1 = delay, and otherwise e 1 is obtained by replacing the guard by its closed counterpart. Note that each vertex has at least one successor through e 1 since the guard is closed; this follows from the properties of regions [START_REF] Alur | A theory of timed automata[END_REF]. The labelling function f G maps each vertex of V i to q i . In order to extend γ(•) to paths, we use a composition operator ⊕ between orbit graphs, defined as follows.

If G = (V 1 ∪ . . . ∪ V n , f G , E) and G ′ = (V ′ 1 ∪ . . . ∪ V ′ m , f G ′ , E ′ ) denote two orbit graphs, then G ⊕ G ′ is defined if, and only if f G (V n ) = f G ′ (V ′ 1 )
. In this case, the graph

G ′′ = G⊕G ′ = (V ′′ 1 ∪. . . V ′′ n+m-1 , f G ′′ , E ′′
) is defined by taking the disjoint union of G and G ′ , merging each node (n, v) of V n with the node (1, v) of V ′ 1 , and renaming any node (i, v) ∈ V ′ i by (i + n -1, v), so that we get a (n + n ′ -1)-partite graph. Formally, we let V i = V ′′ i for all 1 ≤ i ≤ n, and the subgraph of G ′′ induced on these nodes is equal to G. For any n + 1

≤ i ≤ n + m -1, we have V ′′ i = {(i, v)} (i-n+1,v)∈V ′ i-n+1
, and there is an edge (i, v), (i + 1, w) ∈ E ′′ if, and only if (in + 1, v), (in, w) ∈ E ′ . Now, we extend γ(•) to paths by induction, as follows. Consider any π = q 1 e 1 . . . q n-1 e n-1 q n , and let

G = (V 1 ∪ . . . ∪ V n , f G , E)
be the n-partite graph γ(q 1 e 1 . . . q n-1 ), given by induction. Let

G ′ = (U ∪ U ′ , f G ′ , E ′ ) denote the bipartite graph of q n-1 e n-1 q n . Then, we let γ(π) = G ⊕ G ′ .
We define the folded orbit graph Γ(π) for any path π that is not a cycle, as a bipartite graph on node set {1} × V(first(π)) ∪ {2} × V(last(π)). There is an edge (1, v), (2, w) in Γ(π) if, and only if there is a path from (1, v) to (n, w) in γ(π), where n = |π| + 1. Nodes are labelled by the regions they belong to. For any cycle π, we define Γ(π) similarly on the node set V(first(π)). Thus Γ(π) may contain cycles. We extend the operator ⊕ to folded orbit graphs.

Difference-Bound Matrices

Although the region automaton defined previously suffices to obtain the decidability of verification problems, exploring all regions is impractical due to their large number. In fact, the region abstraction (that is, the region automaton) is often too refined, in the sense that it distinguishes too many states. A more clever way of exploring the state space of timed automata is to use zones, which are arbitrary subsets of the state space definable by guards. Zones can be represented using difference-bound matrices (DBM). These matrices were used in [START_REF] Berthomieu | An enumerative approach for analyzing time Petri nets[END_REF][START_REF] David | Timing assumptions and verification of finite-state concurrent systems[END_REF] in the context of state space exploration in timed systems.

Let M n (K) denote the set of square matrices of size n×n with elements in K. Given a clock set C, let C 0 denote the set C ∪ {0}. A difference-bound matrix (DBM) is an element of M |C0| (R × {<, ≤}). We adopt the following notation: for any DBM M , we write M = (M, ≺ M ), where M is the matrix made of the first components, with elements in R ∪ {∞}, while ≺ M is the matrix of the second components, with elements in {<, ≤}. A DBM M naturally represents a zone, denoted M (which we may also abusively write M ), defined as the set of valuations ν ∈ R C ≥0 such that, for all x, y ∈ C 0 , it holds ν(x)ν(y) ≺ M

x,y M x,y , where we set ν(0) = 0. We will sometimes use the notation [M ] i,j to write M i,j to ease reading.

We define a total order on (R × {<, ≤}) ∪ {(∞, <)} as follows. We let

(a, ≺) ≤ (b, ≺ ′ ) ⇔    a < b or a = b and either ≺ = ≺ ′ or ≺ ′ = ≤.
The addition is defined by (a, ≺) + (b, ≺ ′ ) = (a + b, ≺ ′′ ), where ≺ ′′ = ≤ if ≺ = ≺ ′ = ≤, and < otherwise. We also let (a, ≺) + b = (a + b, ≺).

For any DBM M , let G(M ) denote the constraint graph, defined over nodes C 0 , which has an edge (x, y) ∈ C 2 0 of weight M x,y if M x,y < (∞, <). The normalization of M corresponds to assigning to each edge (x, y) the weight of the shortest path in G(M ). This can be done in polynomial time using an all-pairs shortest path algorithm. We say that M is normalized when it is stable under normalization.

When exploring the state space of timed automata, several operations on DBMs are used. We recall here some of these that will be used in following chapters. Definition 3.3.1. Given normalized DBMs M and N , we let

• Pre time (M ) is a DBM defining the set {ν ∈ R C ≥0 | ∃d ≥ 0, ν + d ∈ M }, • Post time (M ) is a DBM defining the set {ν ∈ R C ≥0 | ∃d ≥ 0, ν -d ∈ M }, • M ∩ N is a DBM defining the set {ν ∈ R C ≥0 | ν ∈ M, ν ∈ N }, • Unreset R (M ) is a DBM defining the set {ν ∈ R C ≥0 | ν[R ← 0] ∈ M }.
These operations can be computed in polynomial time. The computations are summarized in the following lemma; we refer to [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF] for proofs. Lemma 3.3.2. Given normalized DBMs M and N ,

• Pre time (M ) is computed by setting the first row to (0, ≤) and applying normalization.

• Post time (M ) is computed by setting the first column to (∞, <).

• M ∩ N is computed by assigning min(M i,j , N i,j ) to each component (i, j), and applying normalization.

• Unreset R (M ) is computed by first intersecting M with the DBM defining x∈R (x = 0), then replacing each component (i, j) with i ∈ R or j ∈ R by (∞, <), and applying normalization.

We note the following folklore result, see e.g. [HKSW11, Lemma 1].

Lemma 3.3.3. For any normalized DBM M , and x, y ∈ C 0 , and α ∈ (-M y,x , M x,y ), there exists a valuation ν such that ν(x)ν(y) = α.

3.4 Shrunk Difference-Bound Matrices

Motivation

To adapt the computation of the state space timed automata to perturbed semantics, we introduce an extension of the DBM data structure, called shrunk difference-bound matrices (shrunk DBM in short). The developments of this section were published in [START_REF] Sankur | Shrinking timed automata[END_REF][START_REF] Bouyer | Robust reachability in timed automata: A game-based approach[END_REF].

Let us first explain the idea on an example. Consider the timed automaton of Fig. 3.2 under the excess-perturbation game semantics, with the objective of reaching ℓ 3 . If there is no perturbation or lower bound on the delays between transitions (i.e., δ = 0), then the states from which Controller can reach location ℓ 3 can be computed backwards. One can reach ℓ 3 from location ℓ 2 and any state in the zone X = (x ≤ 2) ∧ (y ≤ 1) ∧ (1 ≤ xy), shown by (the union of the light and dark) gray areas on Fig. 3.3 (left); this is the set of timepredecessors of the corresponding guard. The set of winning states from location ℓ 1 is the zone Y = (x ≤ 2), shown in Fig. 3.3 (right), which is simply the set of predecessors of X at ℓ 2 . When δ > 0 however, the set of winning states at ℓ 2 is a "shrinking" of X, shown by the dark gray area. If the value of the clock x is too close to 2 upon arrival in ℓ 2 , Controller will fail to satisfy the guard x = 2 due to the lower bound δ on the delays. Thus, the winning states from ℓ 2 are described by X ∧ (x ≤ 2δ). Then, this shrinking is backward propagated to ℓ 1 : the winning states are (x ≤ 2 -2δ), where we "shrink" Y by 2δ in order to compensate for a possible perturbation.

An important observation here is that when δ > 0 is small enough, so that both X ∧ (x ≤ 2δ) and (x ≤ 2 -2δ) are non-empty, these sets precisely describe the winning states. Thus, we have a uniform description of the winning states for "all small enough δ > 0".

Non-parameterized Shrunk DBMs

The idea behind shrunk DBMs is to represent zones whose facets are shrunk by infinitesimal amounts. Given a clock set C, we define a shrinking matrix (SM), as a nonnegative integer matrix of size |C 0 | × |C 0 |. A shrunk DBM is written in the form M -δP , where M is a DBM, P a SM and δ is a fresh parameter. Let us explain how "shrunk zones", as in the above example, can be expressed using shrunk DBMs. Let M be a DBM, P a shrinking matrix, and δ > 0. Suppose for example that for some i, M i,0 = α, M 0,i = β, P i,0 = k and P 0,i = l. Then, M defines the constraint "-β ≤ x ≤ α" for some clock x, whereas M -δP defines "-β + lδ ≤ x ≤ αkδ". Furthermore, if M represents a guard g, the shrunk guard g -δ (obtained by shrinking all atomic guards) can be represented by the shrunk DBM M -1δ, where matrix 1 has 0's on the diagonal and 1's everywhere else.

When manipulating shrunk DBMs, we will often be interested in the properties of shrunk DBMs M -δP for "small enough δ > 0", which means for all δ ∈ [0, δ 0 ), for some δ 0 > 0. We will use the notation (M, P ), which means that we consider M -δP for small enough δ > 0. For instance, when we write Pre time ((M, P )) = (N, Q), we mean that there exists δ 0 > 0 such that Pre time (M -δP ) = N -δQ holds for all δ ∈ [0, δ 0 ). In all the operations, an upper bound on δ 0 will be computable.

In order to define operations on shrunk DBMs, we need to define a suitable algebra on the set of elements of the form ((α, ≺), k) with α ∈ Q, ≺ ∈ {<, ≤} and k ∈ N. We define addition as,

((α, ≺), k) + ((β, ≺ ′ ), l) = ((α + β, ≺ ′′ ), k + l),
where ≺ ′′ = < if, and only if ≺ = < or ≺ ′ = <. We also define the following order.

((α, ≺), k) ((β, ≺ ′ ), l) ⇔    α < β or α = β and k > l, or α = β and k = l and ≺ ′ = < ⇒ ≺ = <. (3.1)
Minimum is then defined as follows.

min (((α, ≺), k), ((β, ≺ ′ ), l)) = ((α, ≺), k) if ((α, ≺), k) ((β, ≺ ′ ), l), ((β, ≺ ′ ), l) otherwise. ( 3.2)
Notice that these operations make sense when we see the elements ((α, ≺), k) as the right hand sides of inequalities of the form xy ≺ αkδ for small enough δ > 0. For instance, the addition corresponds to summing two inequalities, while the minimum corresponds to the conjunction of two inequalities. Thus, the order and the minimum make sense for small enough δ > 0. One can easily compute the maximum δ 0 > 0 such that the desired inequality holds for all δ ∈ [0, δ 0 ):

Lemma 3.4.1. If ((α, ≺), k) ((β, ≺ ′ ), l), then one can compute the greatest δ 0 > 0 such that ∀x ∈ R, x ≺ α -kδ ⇒ x ≺ ′ β -lδ, for all δ ∈ [0, δ 0 ).
Proof. If k = l, then the inequality holds for all δ > 0, so one can set δ 0 = ∞. Otherwise one sets δ 0 = α-β k-l .

Normal forms As DBMs, shrunk DBMs have normal forms, which can be computed considering the shortest paths of the graph G(M ) of a given DBM M . For a matrix A, we define the A-weight of a path x 1 , . . . , x n of G(M ) as

n-1 i=1 A xi,xi+1 . Definition 3.4.2.
Let M be a normalized DBM. For any x, y ∈ C 0 , we define Π x,y (G(M )) as the set of paths with least and finite M-weight from x to y in G(M ).

Notice that the shortest paths are defined with respect to weights in M and not M ; we ignore the type of the inequalities. The M -sign of a path π, written sign M (π) is < if ≺ M πi,πi+1 =< for some i, and ≤ otherwise. Now, normalization consists in computing shortest paths in this algebra: Given a shrunk DBM (M, P ) we define norm((M, P )) = (M ′ , P ′ ) as follows: for each (x, y) ∈ C 0 , let P ′

x,y be the largest P -weight of the paths in Π x,y (G(M )). We let M ′

x,y = (M x,y , ≺ M ′ x,y ) where ≺ M ′ x,y =< if some path of Π x,y (G(M )) of P -weight P ′

x,y has sign <, and ≤ otherwise.

Lemma 3.4.3. Let M be a normalized non-empty DBM and P be a shrinking matrix. Then, (M, P ) is non-empty if, and only if, for all x ∈ C 0 , there is no path in Π x,x (G(M )) with positive P -weight. Moreover, if (M, P ) is not empty, then, writing (M ′ , P ′ ) = norm((M, P )), there exists δ 0 > 0 such that M ′ -δP ′ is normalized and defines the same set as M -δP for all δ ∈ [0, δ 0 ). The greatest such δ 0 is computable.

Proof. First, note that norm((M, P )) defines the same set as (M, P ). In fact, we replace each component with the sum of other constraints of (M, P ), which is already implied in (M, P ). Now, (M ′ , P ′ ) satisfies the following, for all x, y, z ∈ C 0 ,

M ′ x,y = M ′ x,z + M ′ z,y ⇒ (M ′ x,y , P ′ x,y ) (M ′ x,z , P ′ x,z ) + (M ′ z,y , P ′ z,y ). (3.3)
In fact, the condition means (x, z, y) ∈ Π x,y (G(M )), so, by definition of P ′ , P ′ x,y ≥ P ′ x,z + P ′ z,y , where in case of equality, sign M ′ (x, z, y) =< implies ≺ M ′

x,y =< by construction. Now, let δ 0 > 0 be small enough so that (3.3) hold for all x, y, z ∈ C 0 . Then, for all δ ∈ [0, δ 0 ), (3.3) means M ′

x,y -δP ′

x,y M ′ x,z -δP ′ x,z + M ′ z,y -δP ′ z,y , which implies that the DBM M ′ -δP ′ is normalized. Now, a normalized DBM is non-empty if, and only if all its diagonal entries are (0, ≤). Therefore, (M, P ) is empty whenever Π x,x (G(M )) has a path with positive P -weight, for some x ∈ C 0 . If any such path has P -weight equal to 0, then ≺ M x,y =≤ since M is non-empty. To compute the greatest δ 0 > 0 for which the statement holds, it suffices to apply Lemma 3. x,y = <, then Π x,y (G(M )) has a path with sign <, so ≺ M

x,y = <. That P ≤ P ′ follows from the fact that for all x, y, P ′ x,y is the greatest P -weight of the shortest paths from x to y, so it is at least P x,y .

Here is an example where the signs of the inequalities change due to normalization: Consider (x ≤ 1) ∧ (1 ≤ y) ∧ (xy < 1), which is normalized (seen as a DBM over two clocks). However the shrinking

(x ≤ 1 -δ) ∧ (1 ≤ y) ∧ (x -y < 1), yields, after normalization (x ≤ 1 -δ) ∧ (1 ≤ y) ∧ (x -y ≤ 1 -δ)
, where the last inequality becomes large.

Operations For any interval [a, b], we define the shrinking operator as

shrink [a,b] (Z) = {v | v + [a, b] ⊆ Z},
for any set Z. For a zone Z represented as a DBM,

shrink [0,δ] (Z) is the DBM Z -δ • 1 C×{0} and shrink [-δ,δ] (Z) is the DBM Z -δ • 1 C×{0}∪{0}×C , for any δ > 0.
A crucical property of shrunk DBMs is that they are closed under standard operations used for exploring the state space of timed automata. The following lemma summarizes the computations. Lemma 3.4.5. Let M, M ′ , N be normalized non-empty DBMs.

1. If N = Pre time (M ), then for all SMs P , there exists a shrunk DBM (N ′ , Q) such that N = N ′ , N ⊆ N ′ and (N ′ , Q) = Pre time ((M, P )). Moreover, Q is obtained from P , by setting Q 0,x = 0 for all x ∈ C and applying normalization.

2. If N = M ∩ O, then for all SMs P and P ′ , there exists a shrunk DBM (N ′ , Q) such that

N ′ = N, N ⊆ N ′ and (N ′ , Q) = (M, P ) ∩ (O, P ′ ). Moreover, (N ′ , Q
) is given by setting

(N ′
x,y , Q x,y ) = min((M x,y , P x,y ), (O x,y , P ′ x,y )), and applying normalization.

3. If N = Unreset R (M ) for some R ⊆ C, then for all SMs P , there exists a shrunk

(N ′ , Q) such that N ′ = N, N ⊆ N ′ and (N ′ , Q) = Unreset R ((M, P )). To obtain (N ′ , Q), first compute (N ′′ , Q ′ ) such that (N ′′ , Q ′ ) = (M, P ) ∩ (R = 0) by previous case, then set all components (x, y) with x ∈ R or y ∈ R, to (N ′′ , Q ′ )
x,y = ((∞, <), 0) and apply normalization.

4. If N = Post time (M ), then for all SMs P , there exists a shrunk DBM (N, Q) such that (N, Q) = Post time ((M, P )). Q can be obtained from P by setting Q x,0 = 0 for all x ∈ C.

5. If (N, Q) = shrink [-δ,δ] ((M, P )), then N = M and Q is obtained from P by incrementing all P x,0 and P 0,x for x ∈ C. For shrink + , one only increments P x,0 .

One can compute the greatest δ 0 > 0 such that the given property holds for all δ ∈ [0, δ 0 ).

Proof. Let us assume that (M, P ) is normalized. All operations are defined following corresponding ones for usual DBMs. For instance, to compute Pre time ((M, P )), one sets the first row to ((0, ≤), 0). In fact, for any δ > 0, this is precisely the computation of Pre time on the DBM M -δP (see Lemma 3.3.2). We then apply Lemma 3.4.3 to obtain a normalized shrunk DBM. The rest of the statement follows from Remark 3.4.4.

If (M, P ) is not normalized, then we first normalization on (M, P ) before applying the operations. If N = f (M ) denotes one of the equations in this lemma, because all operations are non-decreasing, if (M ′ , P ′ ) = norm((M, P )), then N ′′ = f (M ′ ) satisfies N ⊆ N ′′ , and moreover N = N ′′ . The latter equality follows from N ⊆ N ′′ and the fact that any shortest path of N is also a shortest path of N ′′ , though possibly with a different sign. Thus, by Remark 3.4.4, the lemma yields a shrunk

DBM (N ′ , Q) = f ((M ′ , P ′ )) = f ((M, P )) with N ⊆ N ′ and N = N ′ , as desired. A function f : M |C0| (Q ∞ ) n → M |C0| (Q ∞ ) (for some n > 0)
, is said elementary if it combines its arguments using operators Pre time , Post time , Unreset R , ∩, shrink and shrink + .

Proposition 3.4.6. Let f : M |C0| (Q ∞ ) n → M |C0| (Q ∞ )
be an elementary function and M 0 , M 1 , . . . , M n DBMs satisfying M 0 = f (M 1 , . . . , M n ), and let P 1 , . . . , P n be SMs. Then, there exists a shrunk DBM (M ′ , Q) with M ′ = M, M ⊆ M ′ and (M ′ , Q) = f (N 1 , P 1 ), . . . , (N k , P k ) . The shrunk DBM (M ′ , Q) and the largest δ 0 > 0 can be computed in polynomial time. Proposition 3.4.6 shows that shrinking matrices are propagated when usual operations are applied on DBMs. Using this, one can also compute an upper bound on δ, under which a given equation between shrunk DBMs hold. Figure 3.4 illustrates some of these operations. Notice also that the lemma always gives normalized shrunk DBMs (M ′ , Q). Let us extend the computation of upper bounds on δ in Lemma 3.4.6 for an inclusion relation, which will be useful in Chapter 7. Lemma 3.4.7. Assume the equation (M, P ) ∩ N ⊆ (N, Q) between normalized shrunk DBMs (M, P ) and (N, Q). One can compute the greatest δ 0 > 0, in polynomial time, such that (M -δP ) ∩ N ⊆ N -δQ for all δ ∈ [0, δ 0 ).

= Pre time         (a) (M, Q) = Pre time ((N 1 , P )) = ∩ (b) (M, Q) = (N 1 , P 1 ) ∩ (N 2 , P 2 ) = shrink +         (c) (M, Q) = shrink + ((M, P )) = shrink         (d) (M, Q) = shrink [-δ,δ] ((M, P ))
Proof. Let N ′ = M ∩ N . Let Q ′ be the SM given by Lemma 3.4.5 such that (N ′ , Q ′ ) = (M, P ) ∩ N and δ ′ 0 > 0 the corresponding bound on δ. Then, the inclusion is equivalent to

(N ′ , Q ′ ) ⊆ (N, Q). Since both shrunk DBMs are normalized, holds if for all x, y ∈ C 0 , ((N ′ x,y , ≺ N ′ x,y ), Q ′ x,y ) ≺ ((N x,y , ≺ N x,y
), Q x,y ). Thus, if δ 1 > 0 denotes the minimum of the upper bounds given by Lemma 3.4.1 for each x, y, we choose δ 0 = min(δ ′ 0 , δ 1 ). Remark 3.4.8. Although the results above allow one to compute the greatest δ 0 > 0 satisfying all inequalities, one can obtain an easy upper bound, as follows. If the equation of Proposition 3.4.6 has a non-empty solution, then one can choose δ 0 = 1 3m , where m is the maximum of all components of the shrinking matrices that appear in the computations.

Proof. Assume that for some valuation ν, M i -δQ i satisfies the equation for small enough δ > 0. We show that the equation is satisfied for all δ ∈ [0, 1 3m ). To prove this, we need to show for all δ ∈ [0, δ 0 ) that all shrunk DBMs are non-empty and satisfy the equations they are involved in.

Since all shrunk DBMs are non-empty (for small enough δ > 0), all diagonals of the shrinking matrices are equal to 0. Thus, it suffices to show that all shrunk DBMs M -δQ are normalized. Normalization condition requires

∀i, j, k ∈ C 3 0 , M i,j -δQ i,j M i,k -δQ i,k + M k,j -δQ k,j , for all δ ∈ [0, δ 0 ). If M i,j = M i,k + M k,j , then we must have Q i,j ≥ Q i,k + Q k,j
. So, for these components, the condition holds for all δ > 0.

If M i,j < M i,k + M k,j , then the condition holds if δ 0 < | M i,k +M k,j -Mi,j Q i,k +Q k,j -Qi,j
|, but this is already the case since δ 0 ≤ 1 3m (the upper bound is infinity if the denominator is 0).

It remains to show that all equations that appear in the computations hold. For an equation of the form (M, Q) = (N 1 , R 1 )∩(N 2 , R 2 ), we have either (N 1 ) i,j = (N 2 ) i,j and Q i,j = max((R 1 ) i,j , (R 2 ) i,j ), or for example (N 1 ) i,j < (N 2 ) i,j and (M i,j , Q i,j ) = ((N 1 ) i,j , (Q 1 ) i,j ). In the former case, the equation holds for all δ > 0. In the latter case, it holds for all δ < | (N2)i,j -(N1)i,j (Q2)i,j -(Q1)i,j |. This is already the case since δ < 1 3m . For equations of the form (M, Q) = Pre time ((N, R)), it suffices to choose δ small enough to ensure that normalization holds. For (M, Q) = Unreset r ((N, R)), one only needs to ensure that the intersection with r = 0 and normalization holds. Both conditions were already shown to hold.

How much can m grow? A rough estimation shows that it is at most exponential in the size of the equation. We haven't observed such a growth in practice; See Chapter 6 for experimental results.

Parameterized Shrunk DBMs

We now extend the shrunk DBM data structure to parameters. More precisely, we will consider shrinking matrices whose components are expressions with parameters. When studying shrinkability in Chapter 5, this will allow us to explore the state space of timed automata in a parameterized manner.

We only develop this data structure for closed sets. Since all operations we consider preserve closed sets, all DBMs in this section are assumed to use only closed inequalities. To simplify the presentation, we will drop the inequality types when writing the DBMs; a DBM M will be simply a matrix of real numbers.

We fix a tuple of parameters k = (k i ) i∈I , which will take nonnegative integer values. The max-plus polynomials over k, denoted by G(k), are generated by the following grammar.

φ ::= l ∈ N | k i , i ∈ I | φ + φ | max(φ, φ).
A parameter valuation is a function that assigns a natural number to each parameter k i . By a slight abuse of notation, we denote parameter valuations as v : k -→ N. For any max-plus polynomial φ and parameter valuation v : k -→ N, we denote by φ[v] the value of formula φ replacing each parameter k by v(k). A parameterized shrinking matrix (PSM) is an element of M |C0| (G(k)). If P is a PSM and v is a parameter valuation, then P [v] is the shrinking matrix defined by replacing each parameter k i by v(k i ), and evaluating the resulting expression.

As for non-parameterized shrunk DBMs, we need to provide an algebra in order to define our operations. We define symbolic operations on expressions of the form αk • δ, where α ∈ Q, k is an expression in G(k) (bound to take values in N). As before, δ is seen as a positive parameter to be chosen small enough. More precisely, given two pairs (α, k) and (β, l) in Q × G(k), we define the addition (α, k) + (β, l) = (α + β, k + l), where

(k + l)[v] = k[v] + l[v]
for all v : k → N. We also define the following relation:

(α, k) (β, l) ⇔ α < β or (α = β and k[v] ≥ l[v] for all v : k → N).
An important (but quite straightforward) property of this definition is the following. Notice that we are again interested in comparing (α, k) and (β, l) for small positive values of δ. Since all constraints are closed, we can compute the upper bounds δ 0 such that a given property holds for all δ ∈ [0, δ 0 ]. Lemma 3.4.9. For all (α, k) and (β, l) in Q × G(k), the following two statements are equivalent:

• (α, k) (β, l) • for all v : k → N, there exists δ 0 > 0 s.t. for all 0 ≤ δ ≤ δ 0 , it holds α -k[v] • δ ≤ β -l[v] • δ.
Moreover, one can compute the greatest δ 0 > 0 with this property.

Proof. Assume that the second statement holds. In particular when δ = 0, we get α ≤ β. Hence either α < β, and we are done, or α = β. In the latter case, we get that for all v, it holds

k[v] • δ ≥ l[v] • δ for small positive values of δ. Hence for all v, k[v] ≥ l[v].
Conversely, we consider several cases:

• if α < β: then for all v : k → N, -either k[v] = l[v] and any non-negative δ satisfies α -k[v] • δ ≤ β -l[v]
• δ (so that δ 0 can be any positive real);

-or |k[v] -l[v]| ≥ 1, in which case we let δ 0 = β-α |k[v]-l[v]| . Then any nonnegative δ ≤ δ 0 satisfies |k[v] -l[v]| • δ ≤ β -α. In particular, (l[v] -k[v]) • δ ≤ β -α, as required. • if α = β and k[v] ≥ l[v] for all v: then for any non-negative δ, k[v] • δ ≥ l[v]
• δ, and the result follows.

Notice that is not an ordering relation: indeed, (α, k) (β, l) (α, k) implies α = β and k[v] = l[v] for all v, but the latter does not imply equality of k and l (syntactically). In the sequel, we (silently) consider the quotient of G(k) by this equivalence relation, so that is a partial order. To see that not all elements are comparable, consider (1, k 1 δ) and (1, (k 2 + k 3 )δ). For some parameter valuations, the former is smaller than the latter, and for some others the inverse is true.

We now define the minimum of two elements of Q × G(k):

min((α, k), (β, l)) =      (α, k) if α < β, (β, l) if β < α, (α, max(k, l)) otherwise.
This definition enjoys the following property: Lemma 3.4.10. For all (α, k) and (β, l) in Q × G(k), min((α, k), (β, l)) belongs to Q × G(k) and is the greatest lower bound of (α, k) and (β, l) in that set.

Proof. The first statement is obvious, since max(k, l) belongs to G(k) as soon as k and l do. That min((α, k), (β, l)) (α, k) is easily obtained by considering three cases:

• if α < β, then min((α, k), (β, l)) = (α, k), which implies our result;

• if β < α, then min((α, k), (β, l)) = (β, l), and (β, l) (α, k) since β < α;

• if α = β, then min((α, k), (β, l)) = (α, max(k, l)), and (α, max(k, l)) (α, k) since (max(k, l))[v] ≥ k[v]
for all v (by definition of max).

Symmetrically, min((α, k), (β, l)) (β, l). Now, consider any (γ, m) s.t. (γ, m) (α, k) and (γ, m) (β, l). We show that then either min((α, k), (β, l)) = (γ, m), or min((α, k), (β, l)) (γ, m).

• When α < β, assume min((α, k), (β, l)) (γ, m). This means (α, k) (γ, m) (α, k), which entails equality. The case where β < α is symmetric.

• When α = β, assume again that min((α, k), (β, l)) = (α, max(k, l)) (γ, m). This is easily seen to entail γ = α, as we must also have (γ, m)

(α, k). Moreover, for all v, it must hold (max(k, l))[v] ≥ m[v], as well as m[v] ≥ k[v] and m[v] ≥ l[v]. When k[v] ≥ l[v], we get m[v] = k[v] = (max(k, l))[v]; when l[v] > k[v], then we have m[v] = l[v] = (max(k, l))[v], so that finally m = max(k, l).
Normal forms We first show that shrunk DBMs also have a normal form in the following sense. Just like for DBMs, and non-parameterized shrunk DBMs, the normalization of a shrunk DBM (M, P ) is obtained simply by computing the shortest path between all indices i and j, by interpreting (M, P ) as the adjacency matrix of a directed graph. The algorithm for normalization is the Floyd-Warshall all-pairs shortest path algorithm applied to regular DBMs, but we apply it in our algebra over Q × G(k) where the sum, the order and min are defined as above. We explicitly give the algorithm this time, in Algorithm 1, since the computation of shortest paths are now less obvious; they consist in building max-plus polynomials that encode these.

Algorithm 1 Normalization procedure for shrunk DBMs.

Given a shrunk DBM (M, P ), for i = 0..n do for j = 0..n do for k = 0..n do (M i,j , P i,j ) ← min (M i,j , P i,j ), (M i,k , P i,k ) + (M k,j , P k,j ) . end for end for end for Operations The following set of lemmas explains how elementary operations can be computed on shrunk DBMs. In particular, it shows how shrinking parameters (i.e., the PSMs) can be propagated in a backward analysis while staying in the max-plus theory. In all the lemmas below, the resulting parameterized shrunk DBMs, and the greatest δ 0 with the stated property are computable in polynomial time (see also Proposition 3.4.15). Lemma 3.4.11. Let M be any DBM and P be a PSM. Then, there exists a PSM P ′ such that for all parameter valuations v : k -→ N, there exists δ 0 > 0 for which norm(Mδ

• P [v]) = M ′ -δ • P ′ [v] for all δ ∈ [0, δ 0 ], where M ′ = norm(M ).
Proof. We initialize the matrix (N, Q) as the matrix of M |C0| (Q × G(k)) whose element in cell (i, j) is (M i,j , P i,j ). We first prove that each step of the normalization algorithm applied to

R = (N, Q) in M |C0| (Q × G(k)) yields a matrix in M |C0| (Q × G(k)).
More precisely, given R = (N, Q) and integers i, j and k less than or equal to C, we prove that the matrix R ′ obtained from R by replacing R i,j with min(R i,j , R i,k + R k,j ) can be written as

(N ′ , Q ′ ) for some DBM N ′ and Q ′ ∈ M |C0| (G(k)). Assume that N i,j ≤ N i,k +N k,j . If the inequality is strict, then (N i,j , Q i,j ) equals min(R i,j , R i,k + R k,j ). Otherwise N i,j = N i,k + N k,j : then R ′ i,j is set to (N i,j , max(Q i,j , Q i,k + Q k,j )), which satisfies our requirement. Assume now that N i,k + N k,j < N i,j . In this case, R ′ i,j = R i,k + R k,j
, and the result follows from Lemma 3.4.10. The upper bound on δ, under which the inequalities hold can be computed using Lemma 3.4.10.

Let us write (M ′ , P ′ ) the shrunk DBM returned by the normalization algorithm. By the definition of the minimum on pairs (N i,j , Q i,j ), the algorithm applies normalization on the DBM N , so M ′ = norm(M ). Pick any parameter valuation v : k → N. We define a negative cycle of a shrunk DBM (M,

P [v]) as i 1 , i 2 , . . . , i k ∈ C 0 , where i 1 = i k , and (M i1,i2 , P i1,i2 ) + (M i2,i3 , P i2,i3 [v]) + . . . + (M i k-1 ,i k , P i k-1 ,i k [v]) ≺ (0, 0). if (M, P [v]) contains a negative cycle, then for any δ > 0, M -δP [v] is empty since this would imply the constraint x -x ≤ M ′ i1,i1 -δP ′ i1,i1 [v] < 0, for some clock x. Otherwise, we have norm(M -δ • P [v]) = M ′ -δ • P ′ [v]
for all small enough δ > 0. In fact the operations performed on the parameterized expressions during the normalization algorithm correspond to the normalization algorithm applied on the DBM M -δP , by Lemma 3.4.10. Last, by applying Lemmas 3.4.9 and 3.4.10 to the (finitely many) cells of the matrix (M ′ , P ′ ) we get δ 0 > 0 such that such that for all δ ∈ [0, δ 0 ] and for all indices i, j and k,

M i,j -P ′ i,j [v] • δ ≤ M i,k -P ′ i,k [v] • δ + M k,j -P ′ k,j [v] • δ, so that M -P ′ [v]
• δ is in normal form. Also, quite obviously, for any v and δ as above, the DBM obtained at each step of the normalization algorithm defines the same set of parameter valuations as the original DBM.

Note that even if a DBM M is not empty, a shrunk DBM (M, P ) can be empty. For instance, the shrunk DBM corresponding to constraints 1 + δ ≤ x ≤ 1δ is empty for all δ > 0, although the set 1 ≤ x ≤ 1 is not. The emptiness of a shrunk DBM (M, P ), i.e. whether M -δP is empty for all δ > 0, can be determined by first applying normalization, then checking whether all diagonal components are 0.

The intersection of two shrunk DBMs can also be written as a shrunk DBM:

Lemma 3.4.12. Let M, N 1 , N 2 be normalized DBMs such that M = N 1 ∩ N 2 .
Then, for all PSMs P 1 and P 2 , there exists a PSM P ′ such that for all parameter valuations v : k → N, there exists

δ 0 > 0 for which M -δ • P ′ [v] = (N 1 -δ • P 1 [v]) ∩ (N 2 -δ • P 2 [v]) for all δ ∈ [0, δ 0 ].
Proof. For all i, j, define (N i,j , P i,j ) = min((N 1 i,j , P 1 i,j ), (N 2 i,j , P 2 i,j )). Then by definition, N i,j = min(N 1 i,j , N 2 i,j ), so that N = M . Applying Lemma 3.4.9 (several times), for any parameter valuation v, there is a positive δ 0 for which

N i,j -P i,j [v]•δ = min(N 1 i,j -P 1 i,j [v]•δ, N 2 i,j -P 2 i,j [v]•δ), for all 0 ≤ δ < δ 0 , so that the DBM N -P [v] • δ corresponds to the intersection of N 1 -P 2 [v] • δ and N 2 -P 2 [v] • δ.
To conclude, it suffices to apply Prop. 3.4.11 to turn the resulting shrunk DBM in normal form.

We now describe how we compute the shrinking matrix for the unreset operation: given a DBM M and a set of clocks Z, Unreset Z (M ) is the (normal-form) DBM defining all clock parameter valuations v s.t. v[Z := 0] belongs to M . It is obtained by intersecting with the DBM representing the set Z = 0, and removing contraints involving clocks in Z.

Lemma 3.4.13. Let M and N be two normalized DBMs with M = Unreset Z (N ) for some Z ⊆ C. Then, for any PSM P , there exists a PSM P ′ such that for all parameter valuations v : k → N, there exists δ 0 > 0 for which

M -P ′ [v] • δ = Unreset Z (N -P [v] • δ) for all δ ∈ [0, δ 0 ].
Proof. We first consider the intersection of the shrunk DBM (N, P ) and the DBM representing the set Z = 0. From Prop. 3.4.12, this can be written as a shrunk DBM (N ′ , P ′ ), where N ′ is the normalized DBM obtained after intersecting N with the DBM for Z = 0. The second step consists in removing the constraints involving clocks of Z. This is achieved on DBMs by turning all the values in the corresponding columns to ∞; for shrunk DBMs, we change (M i,j , P i,j ) into (∞, 0) whenever i ∈ Z or j ∈ Z except when i = j, the value of P i,j being actually not relevant in that case. This results in a shrunk DBM (M, Q) with the required properties.

Note that if (N, P ) is empty, then so is (M, Q) since we did not change the diagonal, and that the components of the shrinking matrix can only increase during normalization. Finally, we compute the time-predecessor set of a DBM by dropping the lower-bound constraints on single clocks (i.e., the first row of the DBM), while preserving all other constraints. Lemma 3.4.14. Let M and N be two normalized DBMs with M = Pre time (N ). Then for any PSM P , there exists a PSM P ′ such that for all parameter valuations v : k → N, there exists δ 0 > 0 for which Mδ

• P ′ [v] = Pre time (N -δ • P [v]) for all δ ∈ [0, δ 0 ].
Proof. P ′ is obtained from P by also changing all the elements of the first row into 0 (except for the component (0, 0)), and applying normalization. Note that if (N, P ) is empty, so is (M, Q), as in the previous lemma, since the diagonal of the shrinking matrix can only increase.

By combining the previous lemmas, and Lemma 3.4.9, we immediately get the following proposition.

Proposition 3.4.15. Let f : M |C0| (Q ∞ ) n → M |C0| (Q ∞ ) be an elementary function and M 0 , M 1 , . . . , M n DBMs satisfying M 0 = f (M 1 , . . . , M n ).
For any PSMs P 1 , . . . , P n , one can compute a PSM P 0 s.t. for all v : k → N, there exists a greatest (computable) δ 0 > 0 such that

(M 0 , P 0 [v]) = f (M 1 , P 1 [v]), . . . , (M n , P n [v]) ,
for all δ ∈ [0, δ 0 ]. These computations can be carried out in polynomial time, and in particular P 0 has size polynomial in the size of P 1 , . . . , P n and f .

Observe that in the above equation, for any parameter valuation v, (M, P ′ [v]) is empty whenever some (M i , P i [v]) is empty.

Proposition 3.4.15 gives a polynomial-size PSM P ′ provided that we represent the max-plus polynomials by sharing subexpressions. For instance, we assume that if we have max-plus polynomials φ 1 and φ 2 in memory, then the expression max(φ 1 , φ 2 ) is represented by a new node max() that point to φ 1 and φ 2 . More precisely, these expressions can be given as max-plus graphs defined in Section 5.4.2. Then, each elementary operation adds a polynomial number of nodes (in the number of clocks), thus yielding a polynomial-size representation.

The bound δ 0 can be computed when successively applying Lemmas 3.4.11-3.4.14, using Lemma 3.4.9. In fact, such a choice of δ ensures that all shrunk DBMs encountered in the computations are non-empty and normalized or δ ∈ [0, δ 0 ]. By Remark 3.4.8, δ 0 can also be chosen as, roughly, the inverse of the maximal component of all SMs that appear in computations.

Our definition of PSM is different from parametric DBMs considered for instance in [START_REF] Hune | Linear parametric model checking of timed automata[END_REF], since we use max-plus polynomials instead of linear expressions and only consider natural number valuations. A related parameterized extension of DBMs was used in [START_REF] De Wulf | Robust safety of timed automata[END_REF] for the forward computation of the state space of enlarged timed automata. The emphasis in [START_REF] De Wulf | Robust safety of timed automata[END_REF] was, however, on computing over-approximations on reachables states; (fixpoint) equations between sets were not studied.

Part II

Robustness Analysis

This part is devoted to the contributions on robustness analysis algorithms. In robustness analysis, the goal is to check whether a given system satisfies its specification when its semantics is perturbed. If this is the case, one is interested in synthesizing an upper bound on the magnitude of perturbations under which the specification is satisfied. We consider, in this part, two perturbation models, namely, enlargement and shrinking. Chapter 4 shows the decidability of the untimed language preservation under parameterized guard enlargements; while Chapter 5 shows the decidability of behavior preservation in terms of time-abstract simulation and non-blockingness under parameterized guard shrinkings. A software tool that can check the shrinkability of a given timed automaton, and some experimental results are presented in Chapter 6.

59

Chapter 4

Untimed Language Preservation

Introduction

Parameterized robust model-checking for timed automata, that is, deciding the existence of δ > 0 for which a given property holds on the timed automaton enlarged by δ, has been shown to be decidable for several classes of properties. The problem has no complexity cost over the standard modelchecking for timed automata: it was shown to be PSPACE-complete for safety [START_REF] Puri | Dynamical properties of timed automata[END_REF][START_REF] De Wulf | Robust safety of timed automata[END_REF], and for ω-regular properties [BMR06, BMS11], and EXPSPACE-complete for a fragment of the metric temporal logic [START_REF] Bouyer | Robust analysis of timed automata via channel machines[END_REF]. In this chapter, we are interested in a stronger notion of robustness, asking for the preservation of the untimed language of the exact semantics in the enlarged timed automaton, for some value of the enlargement parameter δ > 0. We call such timed automata language robust. In particular, if a timed automaton is language robust, then any (untimed) language based property (such as linear-time properties) proven for A are preserved in A δ for small enough δ.

Remember that, given a timed automaton A, L(A) denote the set of the untimed traces of the runs of A. By definition of the enlargement, we have L(A δ ) ⊆ L(A δ ′ ) for any δ ≤ δ ′ , and in particular L(A) ⊆ L(A δ ) for any δ ≥ 0. We are interested in the inverse inclusion, which does not always hold. In fact, one can show that in the automaton A 1 of Figure 2.2, for all δ > 0, all long enough words in (gen • con) * • gen 2 belong to L(A 1 δ ) but not to L(A 1 ) (since location err is reachable in A 1 δ if, and only if δ > 0).

Definition 4.1.1 (Language-robustness). A timed automaton A is language-robust if there exists δ > 0 such that L(A) = L(A δ ).

Informally, A is language-robust if A δ has no extra behavior than A for some δ > 0, in terms of untimed language. Observe that whenever L(A δ ) ⊆ L(A), we also have L(A ′ δ ) ⊆ L(A) for any 0 < δ ′ < δ. This is a desirable property, called "faster is better" [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF][START_REF] Altisen | Implementation of timed automata: An issue of semantics or modeling[END_REF], which means that once we prove the correctness of the system for some δ, it remains correct on any faster platform.

The main result of this chapter is that language robustness is in EXPSPACE. We also note a class for which it can be decided in PSPACE. The high complexity of the algorithm in the general case is not surprising, since deciding untimed language inclusion for timed automata is already EXPSPACE-complete [START_REF] Brenguier | A comparison of succinctly represented finite-state systems[END_REF]. We do not have a lower bound result, but this algorithm conforms with other parameterized robust model-checking algorithms that have the same complexity as the corresponding exact cases.

In order to establish our algorithm, we revisit some results of [START_REF] Puri | Dynamical properties of timed automata[END_REF][START_REF] De Wulf | Robust safety of timed automata[END_REF] and extend these to take into account the untimed languages (Section 4.4). Then, we prove a Ramsey-like combinatorial theorem on directed paths, which has an independent interest (Section 4.5). The proof of the main result (Section 4.6) combines these results.

The results of this chapter were published in [START_REF] Sankur | Untimed language preservation in timed systems[END_REF].

Restrictions on Timed Automata

Following [DDMR08, Pur00], we only consider closed timed automata and rectangular guards (that is, we do not have diagonal constraints such as k ≤ xy ≤ l). We also assume that all clocks are bounded above by some constant M . Considering closed guards is natural in our setting, since we are interested in the behavior of the systems under positive enlargement. Assuming rectangular guards and bounded clocks is not restrictive in terms of expressiveness, but has an effect on the size of the models [START_REF] Bouyer | On conciseness of extensions of timed automata[END_REF]. As in [DDMR08, Pur00, AMPS98], the only real restriction is the following. We consider timed automata where all clocks are reset at least once along any cycle of the region automaton; these are called progress cycles. A sufficient condition for a timed automaton to have only progress cycles is that any cycle of the underlying finite automaton resets all clocks at least once [START_REF] Asarin | Controller synthesis for timed automata[END_REF].

Although we prove our results for general timed automata with progress cycles, we also note a subclass for which we improve the complexity of the problem we study. We call a timed automaton region-deterministic if its timed-action region automaton is deterministic (that is, from all states of the region automaton, there is at most one outgoing edge per label)1 .

Note that we will mostly use region automata in the proofs of this chapter. Timed-action region automata will be useful only in the proof of Theorem 4.3.1

Main Result

Theorem 4.3.1. Let A be any closed timed automaton with progress cycles, and W the size of its region automaton. Let K = W if A is region-deterministic, and K = 2 W otherwise, and fix any

N 0 ≥ 15 • W • |C| 2 • 2 (|C|+1) 2 • (K + 1) 2 . Then, there exists δ > 0 such that L(A δ ) = L(A) if and only if L(A 1 N 0 ) = L(A).
Our main result, that is, the decidability of language-robustness is a direct corollary of the previous theorem. In fact, A 1 N 0 can be transformed into a (language-)equivalent integral automaton by multiplying all constants by N 0 . We will denote by R(A 1 N 0

) the region automaton of the corresponding integral timed automaton. We can then check whether R(A 1 N 0

) and R(A) recognize the same untimed language. We obtain the following complexity results.

Corollary 4.3.2. For region-deterministic timed automata with progress cycles, language robustness can be decided in PSPACE. For general timed automata with progress cycles, language robustness can be decided in EXPSPACE.

Proof. Consider a region-deterministic timed automaton A, and let R(A) denote its region automaton. Let R(A) c denote the complement of R(A), which has thus the same size as R(A). One can decide whether

L(A 1 N 0 ) ∩ L(R(A) c ) = ∅ in polynomial space. In fact, the states of both R(A 1 N 0
) and R(A) c can be encoded in polynomial space (for 1 N0 given by the theorem for region-deterministic A). Then, the usual non-deterministic procedure (see [START_REF] Alur | A theory of timed automata[END_REF]) that guesses an accepting path in the product of these can be carried out in polynomial space.

For general timed automata, we describe a non-deterministic exponential space algorithm to decide L(R(A 1 N 0

)) ⊆ L(R(A)). Observe that R(A) can be complemented using the subset construction, and that each state in the complemented automaton has exponential size (since there are exponentially many regions). Let us call the deterministic complement automaton R(A) c . Thus, one can guess a path in R(A) c in exponential space. The algorithm consists in guessing a path in R(A 1 N 0

) while, in parallel, simulating the corresponding path in R(A) c . This can be done in exponential space since states of R(A 1 N 0

) and R(A) c can be represented and explored in exponential space, The algorithm accepts if the simulating set becomes empty, and otherwise rejects after a doubly exponential number of steps. In fact,

L(R(A 1 N 0 )) ⊆ L(R(A)) is equivalent to L(R(A 1 N 0 )) ∩ L(R(A) c ) = ∅,
and in this case, the intersection contains a word of size at most doubly exponential, since the product automaton has this size.

In the rest of this chapter, we present the proof of Theorem 4.3.1. We start with a study of the properties of enlarged timed automata (Section 4.4), and some combinatorial results (Section 4.5), then give the proof (Section 4.6).

Timed Automata Under Enlargement

Let us fix a timed automaton A with C > 0 clocks. We start with the following result, which is a direct corollary of [San10, Lemma 3.14]. It states that for any δ > 0, the trace of any run of A δ of length O(⌊ 1 δ ⌋) can be followed in R(A) too. An immediate implication is that if the length of the runs are fixed a priori, then a small enough enlargement has no effect on the behavior of timed automata (in terms of untimed language). Figure 4.1 illustrates the construction of the following lemma.

Lemma 4.4.1 ([San10]

). Fix any n ∈ N and δ > 0 such that δ ≤ 1 5nC 2 . Let ρ be any run of A δ . Then, for all 1 ≤ i 0 ≤ |ρ|, there exists a region, denoted by H(ρ, i 0 , n), included in reg(state i0 (ρ)), such that for all regions r ⊆ H(ρ, i 0 , n), there is a path π of R(A) over the trace utrace(ρ i0... min(i0+n,|ρ|) ), with state 1 (π) = r and state j (π)∩H(ρ, i 0 + j -1, n) = ∅ for all 1 ≤ j ≤ |π|.

We are now interested in "long" or infinite runs. We saw that for some timed automaton A 1 (e.g. Fig. 2.2) some regions that are not reachable in A 1 become entirely reachable in A 1 δ , for any δ > 0. An analysis of the behavior of A 1 δ shows that this is due to the accumulation of the "error" of δ along some cycles of the region automaton, as shown in Fig. 2.10. Puri gives a characterization of those cycles of R(A) which cause this behavior and obtain a decision procedure for safety properties [START_REF] Puri | Dynamical properties of timed automata[END_REF]; these proofs are revisited in [START_REF] De Wulf | Robust safety of timed automata[END_REF]. In this section, we revisit the analysis of the cycles of R(A) under enlargement, and extend these results to a slightly more general setting. Roughly, we show that, the states that are reachable in A δ by repeating a single cycle are also reachable by repeating particular sets of cycles in any order. Our proofs follow [START_REF] De Wulf | Robust safety of timed automata[END_REF].

We say that two cycles π 1 and

π 2 are equivalent if first(π 1 ) = first(π 2 ) and Γ(π 1 ) = Γ(π 2 ).
Let π be a cycle of R(A) starting at some state (ℓ, r). For any k > 0, we let

V π,k = {(ℓ, v) | v ∈ V(r), (v, v) ∈ Γ(π) k }.
This is the set of vertices q ∈ first(π) for which there are runs following π k that start and end at q. We define the convex hull of the union of these sets as Lim π = convex-hull( k>0 V π,k ). It is clear from the definition of Lim π that Lim π = Lim π ′ for any equivalent cycles π and π ′ .

H(ρ, 1, n) (ρ)1 H(ρ, j, n) (ρ)j ρ ′ π Figure 4.1: A run ρ of A δ .
The leftmost triangle represents reg(state 1 (ρ)), and the rightmost one reg(state j (ρ)) (their corners, edges and interiors are subregions). By Lemma 4.4.1, there is a region H(ρ, 1, n) such that starting from any region in H(ρ, 1, n), one can construct a path π of length n (the red dashed curve) such that (π) j intersects H(ρ, j, n) for all j.

The main result of this section is the following lemma, which generalizes Theorem 23 of [START_REF] De Wulf | Robust safety of timed automata[END_REF] (see also Lemma 7.10 in [START_REF] Puri | Dynamical properties of timed automata[END_REF]). We adopt the following notation: when we write q ∈ (ℓ, r), we mean that q = (ℓ, ν) for some ν ∈ r. We also write λ(ℓ, ν) = (ℓ, λν) where λ ∈ R ≥0 , ν is a valuation and ℓ a location. Lemma 4.4.2. Let π 1 , . . . , π p be equivalent cycles of R(A) that start in state (ℓ, r), and consider any δ > 0. Then, there exists k > 0 such that for any q, q ′ ∈ (ℓ, r), and any word w ∈ {π 1 , . . . , π p } k there is a run in A δ from q to q ′ on word w.

To prove this lemma, we first show that Lim π1 is backward and forward reachable in A , from any point of r, by iterating at least C times any of the equivalent cycles in any order (Lemma 4.4.5), and that any pair of points in L π1 can be connected by a run of A δ , again by iterating these cycles (Lemma 4.4.7).

A natural property of runs of timed automata is that convex combinations of two runs yield a run over the same word, as shown in the following lemma. Let π be a path in R(A), and let ρ and ρ ′ be runs in A that follow π. Then for all λ ∈ [0, 1], there exists a run ρ ′′ of A following π, such that state i (ρ

′′ ) = λstate i (ρ) + (1 -λ)state i (ρ ′ ) for all 1 ≤ i ≤ n.
The following proposition provides a bound on the number of vertices of regions. It also implies that from each region, there is a finite number of cycles with pairwise distinct vertex maps. Remember that all clocks are bounded above by some constant, so we only need to consider bounded regions. ≥0 is a convex combination of the vertices of reg(ν). The following lemma states that, Lim π is backward and forward reachable from any state of first(π), by repeating at least C times cycles equivalent to π. Lemma 4.4.5. Let π 1 , . . . , π p be equivalent cycles of R(A), that all start in state (ℓ, r), and fix any q ∈ (ℓ, r). Then, for any k ≥ C and any path w ∈ {π 1 , . . . , π p } k , there exists q 1 , q 2 ∈ Lim π1 and runs ρ 1 and ρ 2 of A that follow w, such that first(ρ 1 ) = q and last(ρ 1 ) = q 1 ; and first(ρ 2 ) = q 2 and last(ρ 2 ) = q.

Proof. We first prove the statement for q = (ℓ, v) with v a vertex. Remember that for all v ∈ V(r), there exists at least one v ′ ∈ V(r) such that (v, v ′ ) ∈ Γ(π 1 ), and the number of vertices is at most C + 1 by Lemma 4.4.4, so by repeating C times any cycles among π 1 , . . . , π p , we get a sequence of vertices v 1 , . . . , v C+1 such that (v i , v i+1 ) ∈ Γ(π 1 ). But then, v i = v j for some i < j, thus we have v i , v i+1 , . . . , v j ∈ Lim π1 . Now, we can extend the sequence v 1 . . . v j to the length k elements by repeating the cycle v i v i+1 . . . v j . Clearly, this run can be constructed following any path w since π i 's are equivalent.

Consider now an arbitrary point q in (ℓ, r). By Lemma 4.4.4, q can be written as a convex combination of the vertices of r. Let v 1 , . . . , v m denote the vertices of r, and λ 1 , . . . , λ m ≥ 0 be such that λ 1 + . . . + λ m = 1 and q = λ 1 (ℓ, v 1 ) + . . . + λ m (ℓ, v m ). As we showed above, for any v i , there is a run in A that follows w, from v i to some vertex v ′ i ∈ Lim π1 . Lemma 4.4.3 yields the desired run.

Lemma 4.4.6. Let π 1 , . . . , π p be equivalent cycles in R(A). Then there exists m > 0 such that for all paths w ∈ {π 1 , . . . , π p } m , and for all q ∈ Lim π1 , there is a run ρ in A from q to q, following w.

Proof. By definition of Lim π1 , any z ∈ Lim π1 is a convex combination of a set of vertices v i in Lim π1 . But, for any vertex v i ∈ Lim π1 , there exists

m i > 0 such that (v i , v i ) ∈ ν(π 1 ) mi . So, there exists m > 0 such that (v i , v i ) ∈ ν(π 1 ) m for all 1 ≤ i ≤ k (Consider
for instance the least commun multiple). Now, the convex combination of these runs yield the desired run from q to q, by Lemma 4.4.3.

The following lemma shows that any pair of states in L π can be connected by a run in A δ . Lemma 4.4.7 ([DDMR08, Lemma 29]). Let π be a cycle of R(A) that starts in (ℓ, r) and let q ∈ Lim π . Then for any δ > 0, and any q ′ ∈ (ℓ, r) such that d ∞ (q, q ′ ) ≤ δ 2 , there is a run, in A δ , from q to q ′ following π.

Proof of Lemma 4.4.2. By Lemma 4.4.5, repeating at least C times the cycles π 1 , . . . , π p suffices to reach some point q 1 ∈ Lim π1 . The same lemma provides a point q 2 ∈ Lim π1 which is backward reachable from q ′ by repeating C times any of these cycles. Because regions are convex, for any pair of points q 1 , q 2 that belong to a same region, one can find points q 1 = u 0 , u 1 , . . . , u N = q 2 in r where

N = ⌈ 1 δ ⌉ such that d ∞ (u i , u i+1 ) ≤ δ 2 for all 0 ≤ i ≤ N -1.
Let m > 0 be the bound provided by Lemma 4.4.6. Now, q 2 can be reached from q 1 , by a run over any word {π 1 , . . . , π p } mN by Lemma 4.4.7 (applied N times to pairs (u i , u i+1 )).

Some Combinatorial Tools

In this section, we prove a Ramsey-like theorem for colored directed paths, which gives a lower bound on the length of monochromatic subpaths contained in these (Subsection 4.5.1). This improves, by an exponential, the result provided by a direct application of Ramsey's theorem [START_REF] Ramsey | On a problem in formal logic[END_REF]. In Subsection 4.5.2, we give a simple property on untimed finite automata accepting ultimately universal languages.

A Ramsey-like Theorem for Directed Paths

A directed graph is a pair G = (V, E) where V is a finite set of nodes and E ⊆ V × V , is the set of edges. A graph G is complete if for all i, j ∈ V either (i, j) ∈ E or (j, i) ∈ E. A graph is a linearly-ordered complete graph, if for some (strict) linear order ≺ on V , (i, j) ∈ E iff i ≺ j. The degree of a node v is d(v) = |{u | (v, u) ∈ E or (u, v) ∈ E}|. Two nodes u and v are connected in the graph G if there exists a sequence u = s 0 , s 1 , . . . , s k = v of nodes such that (s i , s i+1 ) ∈ E or (s i+1 , s i ) ∈ E for all 0 ≤ i ≤ k -1. A graph is connected if all its nodes are connected. A subgraph of G = (V, E) is a graph (V ′ , E ′ ) such that V ′ ⊆ V and E ′ ⊆ E. A connected component is a maximal connected subgraph. A directed path of G is a sequence of nodes v 1 , . . . , v n such that (v i , v i+1 ) ∈ E for all 1 ≤ i ≤ n -1, and its length is n. A r-coloring of a graph G = (V, E) is a function E → {1, .
. . , r} that associates to each edge a color from {1, . . . , r}. A path is monochromatic if all its edges are assigned the same color.

Our result is based on the following theorem from [START_REF] Bermond | Longest paths in digraphs[END_REF].

Theorem 4.5.1 ([BGHS81]
). Let G be a connected directed graph over n nodes such that, for some h, every node v satisfies d(v) ≥ h. Then G contains a directed path of length min(n, h + 1).

The main result of this subsection is the following theorem.

Theorem 4.5.2. Let G = (V, E) be a linearly-ordered complete graph over n nodes given with an r-coloring of its edges. Then G contains a monochromatic directed path of length ⌊ n/r -2⌋ -1.

Proof. Fix h = ⌊ n/r -2⌋ -1.
For each 1 ≤ i ≤ r, define subgraph G i which contains exactly the edges colored by i. Then, for each G i , define G ′ i by removing any node v (and any edge containing v) whose degree in G i is less than h. In G ′ i , any node has either none or at least h edges of color i. Let G ′ be the union of all G ′ i 's. To define G ′ , we remove at most (h -1)rn edges (h -1 edges per color and node). Thus, G ′ has at least n 2 -(h -1)rn edges. Then, one of the

G ′ i 's has at least n 2 /r -(h -1)n edges, say G ′ i0 . We show that G ′ i0 has a connected component C with at least (n -1)/r -2(h -1) nodes.
In fact, consider a graph with N nodes and M edges. Let K denote the number of nodes of the largest connected component. Since there are at most N connected components, each of them containing at most K 2 edges, we get that

M ≤ N K 2 , which implies 2M/N ≤ K. Applying this to G ′ i0 , we get the desired connected component C. Now, by construction of G ′
i0 , all nodes of C have degree at least h in C (in fact, by maximality, all edges of G ′ i0 adjacent to the nodes of C are also included in C). Then, by Theorem 4.5.1, C contains a directed path of length at least min( (n -1)/r -2(h -1), h). But the first term of the min is greater than or equal to h by the choice of h. So, there is a directed path of length at least ⌊ n/r -2⌋ -1 in G ′ i0 , and this is a monochromatic path in G.

Ultimately Universal Languages

Let Σ denote a finite alphabet. We define a finite automaton as a timed automaton without clocks. We call a regular language L ⊆ Σ * ultimately universal if there exists k ≥ 0 such that l≥k Σ l ⊆ L.

Lemma 4.5.3. Let L be an ultimately universal language recognized by a deterministic finite automaton with n locations. Then l≥n-1 Σ l ⊆ L.

Proof. Let A be a deterministic automaton that recognizes L. Suppose there is a word w of length at least n not recognized by A. Let l be the location reached in A by reading w. Since at least n locations are visited when reading w, we get that w = tuv for some words t, u, v where u is non-empty, such that all words of tu * v leads to location l in A. Because A is deterministic, no word of this set is recognized by A, contradicting the fact that L is ultimately universal.

Proof of the theorem

Fix any timed automaton A with C ≥ 1 clocks. Let W denote the number of regions of A. Let D denote a deterministic finite automaton such that by minimization), and let K denote the size of D, which is at most

L(D) = L(R(A)) = L(R ta (A)) (say, obtained A δ0 : ρ 1 α i α i+1 D : γ α i 1 A δ : ρ ′ 1 β i π1 τ1 τ2 . . . τK-1 (ρ ′ ) β i+1 (γ)α i+1 π1 τ1 τ2 . . . τ K-1
2 W (K ≤ W if A is region- deterministic). We let M = 2 (C+1) 2 (K + 1) 2 + 2 , n ≥ W M and fix any δ 0 ≤ 1 5nC 2 . The theorem states that if L(A) = L(A δ ) for some δ > 0, then L(A) = L(A δ0 ).
The only interesting case is when δ < δ 0 since otherwise L(A) ⊆ L(A δ0 ) ⊆ L(A δ ) and the theorem follows. So let us suppose that L(A) = L(A δ ) for some δ < δ 0 . Let ρ be a run of A δ0 . We will show that utrace(ρ) ∈ L(D) = L(A), which will prove the theorem. Lemma 4.6.1. Any path π of R(A) of length at least n can be factorized as π = π 1 τ 1 τ 2 . . . τ K-1 π 2 where π 1 , π 2 are paths, and τ i 's are equivalent cycles.

Proof. Since n ≥ W • M , by the Pigeon-hole principle, π contains a factor t = t 1 . . . t M such that first(t 1 ) = first(t j ) for all j. We apply Theorem 4.5.2 to get a further factorization of t. Consider a directed graph of the usual linear order < over {1, . . . , M }. To each edge (j, k) of the graph, where j < k, we assign as color, the vertex map Γ(t j t j+1 . . . t k ). The number of colors is then bounded by 2 (C+1) 2 . Applying Theorem 4.5.2, we get that t contains a factor τ 1 . . . τ K-1 , where τ 1 = t j1 t j1+1 . . . t j2 , τ 2 = t j2 t j2+1 . . . t j3 , . . . , τ K-1 = t jK-1 . . . t jK , for some j 1 < j 2 < . . . < j K , such that Γ(τ 1 ) = Γ(τ j ) for all 1 ≤ j ≤ K. Lemma 4.6.2. Let π = π 1 τ 1 τ 2 . . . τ K-1 π 2 be a path of R(A) where π 1 and π 2 are paths and τ i 's are equivalent cycles. Then, there exists k 0 > 0 such that for all q ∈ first(π), q ′ ∈ last(τ K-1 ), k ≥ k 0 , and any word w ∈ utrace(π 1 ) • (utrace(τ 1 ) + . . . + utrace(τ K-1 )) k , there is a run ρ ′ of A δ over w with first(ρ) = q and last(ρ) = q ′ . Proof. There is a run in A , from q to some q 1 ∈ first(τ 1 ) following π 1 since π 1 is a path of the region automaton of A. This is also a run of A δ . The rest follows from Lemma 4.4.7 since first(τ 1 ) = last(τ K-1 ).

We are now ready to prove our main theorem. The reader may follow the proof in Figure 4.2.

Proof of Theorem 4.3.1. Consider ρ and the constants as defined above, and notice that δ 0 ≤ 1 N0 . Let H(ρ, i, n) be the regions given by Lemma 4.4.1 for all i ≥ 0. We will inductively construct the desired run γ of D with utrace(γ) = utrace(ρ). At step i of the induction, we will define γ αi...αi+1 for some increasing sequence (α i ) i≥0 with α 0 = 1. When constructing γ, we will also construct an auxiliary run ρ ′ of A δ in parallel, defining ρ ′ βi...βi+1 at each step i, for some increasing sequence (β i ) i≥0 with β 0 = 1, and ensuring that state βi (ρ ′ ) ∈ H(ρ, α i , n) and L( A δ , state βi (ρ ′ )) ⊆ L(D, state αi (γ)) for all i ≥ 0.

-For i = 0, since ρ is an initialized run, we have state 1 (ρ) = (l 0 , 0) so H(ρ, 1, n) = reg(l 0 , 0). We have α 0 = β 0 = 1, state 1 (ρ ′ ) = (l 0 , 0) and state 1 (γ) is the initial state of D. We have L( A δ , ρ ′ 1 ) ⊆ L(D, γ 1 ) by hypothesis. -For any i ≥ 1, suppose by induction that γ is defined between indices 1 and α i and that ρ ′ βi ∈ H(ρ, α i , n). We will choose α i+1 > α i and β i+1 > β i , and first define ρ ′ βi...βi+1 such that state βi+1 (ρ ′ ) ∈ H(ρ, α i+1 , n), then define γ αi...αi+1 . Let π be the path of R ta (A) which starts at reg(state βi (ρ ′ )), given by Lemma 4.4.1 for the run ρ αi...|ρ| . If ρ is finite and |ρ|α i ≤ n, then D has a run from γ αi on word utrace(π) (since

L( A δ , ρ ′ αi ) ⊆ L(D, γ αi ))
and we are done. Suppose now that ρ is either infinite, or |ρ|α i > n. Then |π| = n, and by Lemma 4.6.1, π can be decomposed into π = π 1 τ 1 . . . τ K-1 π 2 where τ i 's are equivalent cycles. We let

α i+1 > α i such that last(τ K-1 ) is the (α i+1 -α i )-th state of π. A δ has a run from state βi (ρ ′ ) to some z ∈ first(τ 1 ) following π 1 (in fact, state βi (ρ ′ ) ∈ first(π 1 )). By construction of π, there exists z ′ ∈ H(ρ, α i+1 , n) ∩ last(τ K-1 ) = ∅,
and by Lemma 4.6.2, for any k ≥ k 0 and any word w ∈ (utrace(τ 1 ) + . . . + utrace(τ K-1 )) k , there is a run, in A δ , from z to z ′ following trace w. Let ρ ′′ (w) denote the run thus constructed from state βi (ρ ′ ) to z ′ on utrace(π 1 ) • w. We let β i+1 s.t. ρ ′ βi...βi+1 (w) = ρ ′′ (w) for an arbitrary w. Now, D has a run from state αi (γ) to some state q 0 over trace utrace(π 1 ) because L( A δ , state βi (ρ ′ )) ⊆ L(D, state αi (γ)). Let D ′ denote the finite untimed automaton obtained from D by designating q 0 as the initial state, and all states q f such that L( A δ , z ′ ) ⊆ L(D, q f ) for some w ∈ (utrace(τ 1 )+. . .+utrace(τ K-1 )) k , k ≥ k 0 , as final states. There is at least one final state because L(D) = L(A δ ) and D is deterministic. Let there be an edge in D ′ with label utrace(τ i ) from state q to q ′ whenever there is a path in D from q to q ′ over word utrace(τ i ). Observe that D ′ is still deterministic. Since ρ ′′ (w) is defined for any w ∈ (utrace(τ 1 )+. . .+utrace(τ K-1 )) k , k ≥ k 0 , D ′ , defined over alphabet {utrace(τ 1 ), . . . , utrace(τ K-1 )}, is ultimately universal. But then, by Lemma 4.5.3, D ′ accepts any word in {utrace(τ 1 ), . . . , utrace(τ K-1 )} K-1 , and in particular utrace(τ 1 . . . τ K-1 ). Therefore, there is a run in D from state αi (γ) to some state state αi+1 (γ) following utrace(τ 1 . . . τ K-1 ), which satisfies

L( A δ , state βi+1 (ρ ′ )) ⊆ L( A , state αi+1 (γ)).

Another simple but expensive algorithm

In [START_REF] Bouyer | Robust model-checking of timed automata via pumping in channel machines[END_REF], we gave a PSPACE algorithm for parameterized robust model-checking of timed automata against Büchi properties. The algorithm consists in model-checking A δ0 for some fixed δ 0 depending on A. This can be used to deduce a 2EXPSPACE algorithm for language robustness.

The main result of [START_REF] Bouyer | Robust model-checking of timed automata via pumping in channel machines[END_REF] is the following.

Lemma 4.7.1 ([BMS11]

). For any a timed automaton A, and state-based Büchi property B, there exists δ > 0 such that A δ satisfies B, if, and only if A δ0 satisfies B, where

δ 0 = O(2 -|A| ).
We show how this lemma can be used to derive a 2EXPSPACE algorithm for deciding language robustness. Consider the deterministic finite automaton F, obtained from R ta (A) by the subset construction. Since all states of R ta (A) are accepting (the language L(A) is prefix-closed by definition), only the emptyset is accepting in F, which is the complement of the subset construction. Note that this accepting state is a sink state; let us denote it ⊥. We consider the timed automaton B = A × F. Let B denote the set of all states of B but those having ⊥ as the second component. Let δ 0 = O(2 -|B| ). Then, B δ satisfies B for some δ > 0 if, and only if B δ0 does so. But satisfying B means that all runs of B δ visit infinitely often states of B, hence do not visit ⊥. This is equivalent to saying that L(A δ ) ⊆ L(A), hence A is language robust. Now, F can have doubly exponential size, so according to the above lemma, 1/δ 0 is triply exponentially large. This suggests a triply exponential-time algorithm. But one can improve the complexity as follows. Instead of explicitly computing the product B, one can explore A δ0 and F on-the-fly, in doubly exponential space. In fact, regions of A δ0 can be represented and explored in doubly exponential space, while a state of F only requires exponential state (since it is a subset of states of R ta (A)). Then, it suffices to guess a lasso, of length at most triply exponential, visiting the states of B in these two automata in parallel.

Conclusion

We presented an EXPSPACE algorithm for deciding language robustness in timed automata, requiring the untimed language to be preserved under some enlargement. This is a strong notion, implying that for language-robust timed automata, all untimed trace-based properties proven for the exact semantics hold under enlargement. In particular, for such timed automata, one does not need to apply robust model-checking algorithms for untimed specifications.

A drawback of our algorithm is its high complexity. Although untimed language inclusion in timed automata is also EXPSPACE-complete [START_REF] Brenguier | A comparison of succinctly represented finite-state systems[END_REF], this does not imply a lower bound for language robustness. Whether the problem is EXPSPACE-hard remains open. One hope to reduce complexity would be to consider the problem of (bi)simulation robustness, that is, checking whether a given timed automaton is similar or bisimilar to its enlargement, for some enlargement parameter. The complexity might be lower, as it is already the case for timed automata and finite-state systems (see e.g. [START_REF] Brenguier | A comparison of succinctly represented finite-state systems[END_REF]).

Chapter 5

Shrinkability

Introduction

In this chapter, we study robustness in timed automata against guard shrinkings. The robustness notion we consider requires timed automata to preserve some time-abstract behaviors, and not to become blocking, when their guards are shrunk by a parameterized amount.

Shrinking the guards corresponds to disallowing time delays that are too close to the boundaries of the guards. Some timed automata are vulnerable to such restrictions, and do loose some time-abstract behaviors. We will see in the next section examples of timed automata that cannot repeat infinitely some of their cycles under shrinkings. Similar phenomena were reported in [START_REF] Cassez | A comparison of control problems for timed and hybrid systems[END_REF][START_REF] Abdellatif | Model-based implementation of real-time applications[END_REF].

Our goal is to develop algorithms to decide whether all guards can be shrunk -by possibly different amounts, so that the resulting timed automaton can still time-abstract simulate the original automaton, and is non-blocking. By this robustness check, one ensures that the behavior of the automaton does not depend on exact timings, more precisely, on its ability to take the transitions on the boundaries of the guards. A shrinkable timed automaton preserves all its behaviors when, for instance, task execution times are shorter than the worst-case, and waiting times are longer than the best-case. One can also detect unrealistic runs, including Zeno runs (Section 5.2.2). Shrinkability analysis complements the robustness approach based on guard enlargement considered in Chapter 4.

The results of this chapter were published in [START_REF] Sankur | Shrinking timed automata[END_REF].

Robustness and Shrinkability

Shrinkability

Formally, a shrinking of a timed automaton A is A -kδ , where k ∈ N I >0 and δ > 0, I denoting the set of all atomic clock constraints of A. We are interested in deciding the existence of shrinking parameters k and δ > 0, and in their computation, for which the shrunk timed automaton is non-blocking, or able to time-abstract simulate a given automaton, or both.

The formal definition of non-blocking-shrinkability is the following.

Definition 5.2.1. Let A be a timed automaton, and I the set of its atomic guards.

A is non- blocking-shrinkable if there exists k ∈ N I >0 and δ 0 ∈ Q >0 such that for all δ ∈ [0, δ 0 ], A -kδ is non-blocking.
We now define shrinkability. Ideally, we would like the shrunk timed automaton to be able to time-abstract simulate the original timed automaton, which would mean that all time-abstract behaviours present in the original timed automaton are preserved. But we give a more general definition, which allows us to define shrinkings that contain some part of the time-abstract behaviour of the original automaton. Given a timed automaton A, and some finite automaton F such that F ⊑ t.a. A , A is said to be simulation-shrinkable with respect to F, if some shrinking A -kδ simulates F. Notice that F can be chosen as the region automaton of A [AD94] or a smaller bisimulation quotient [START_REF] Tripakis | Analysis of timed systems using time-abstracting bisimulations[END_REF], in which case a shrinking is required to time-abstract simulate A entirely. Otherwise, simulation-shrinkability guarantees that the shrunk automaton contains some relevant behaviour, given as F, of the original timed automaton.

We need the following notation. Given TTSs S and T , and a state s of S, we denote by ta-sim T (s) the set of states of T that time-abstract simulates the state s of S. The formal definition of simulation-shrinkability is the following. Definition 5.2.2. Let A be a timed automaton, and I the set of its atomic guards. Consider any finite automaton

F such that F ⊑ t.a. A . A is simulation-shrinkable w.r.t. F if there exists k ∈ N I >0 and δ 0 ∈ Q >0 such that for all δ ∈ [0, δ 0 ], F ⊑ t.a. A -kδ
with the following additional requirement: for each state f of F, there exists a guard g and h ∈ N |C0| 2 such that for all δ ∈ [0, δ 0 ], ta-sim A -kδ (f ) equals g -hδ .

We say that a timed automaton is strongly shrinkable w.r.t. F if it has a shrinking witnessing both its non-blocking-shrinkability and its simulation-shrinkability w.r.t. F. The above k and δ 0 are called the shrinking parameters of A.

We now comment on the above definitions. We define shrinkability "for all δ ∈ [0, δ 0 ]", so if an automaton is shrinkable, we require it to remain correct when imprecisions are reduced, that is when δ is chosen smaller. In fact, the shrunk automaton can be seen as an underapproximation of the initial automaton, and we would like to be able to obtain arbitrarily close correct approximations by only adjusting δ. Notice also that when a timed automaton is simulation-shrinkable, then we require that for all small enough δ, each simulator set can be expressed as shrinkings g -hδ where h is the same for all δ (that is, parameters h are uniform). If this is the case, then when we change slightly the parameter δ > 0, the simulator sets also change slightly. Moreover, simulator sets have a uniform expression, where δ is only a parameter. When one uses the simulator sets to control the original system, this property yields a uniform representation for the constraints to add to the system. Thus, the controlled system can still be represented as a timed automaton, where the guards contain the parameter δ. Note however that we do not know whether there exist timed automata that are shrinkable but violate the technical requirement of Definition 5.2.2.

Example 5.2.3. We illustrate shrinkability on the timed automaton A of Fig. 5.1. This timed automaton is shrinkable both for non-blockingness and for simulation. One can check that A -kδ , shown in Fig. 5.2 is non-blocking, and can time-abstract simulate A for all δ ∈ [0, 1 6 ]. One can also see that the simulator sets are uniform. For instance, the set of states of

A -kδ that simulate the initial state of A is δ ≤ x ≤ 3 -δ ∧ y ≤ 3 -2δ ∧ δ ≤ x -y ≤ 2 -2δ for all δ ∈ [0, 1 6 ].
The computation of these parameters, and that of the simulator sets of this example are explained in Example 5.3.1.

Shrinking as a Remedy to Unrealistic Behaviour

Shrinkability also excludes unrealistic timing constraints, such as those requiring Zeno behaviours. In fact, for any timed automaton A, consider the automaton A ′ obtained from A by adding a new clock u, the constraint u ≥ 0 and the reset u := 0 at every edge. Clearly, A and A ′ are isomorphic. If automaton A ′ is, say, simulation-shrinkable, then A does not need Zeno strategies to satisfy the properties proven for the exact semantics and preserved by time-abstract similarity. In fact, each u ≥ 0 is shrunk to some u ≥ δ i with δ i > 0, so time diverges in any infinite run. But unrealistic timing constraints are not limited to Zeno behaviours. The automaton in Fig. 5.3 provides an example of a timed automaton which is non-blocking for δ 1 = δ 2 = δ 3 = 0, and lets the time diverge but it becomes blocking whenever δ 2 > 0 or δ 3 > 0, so it is not shrinkable. ) i increases at least by δ 2 + δ 3 at each step and is bounded above by 1, which is possible only when δ 2 = δ 3 = 0. Note that even if δ 2 = δ 3 = 0, non-blockingness requires consecutive delays to be equal, which is not realistic for digital systems.

A similar example appears in [START_REF] Cassez | A comparison of control problems for timed and hybrid systems[END_REF] with equality constraints. The above example shows that such phenomena can occur even without the use of equality.

Decidability of Shrinkability

The main result of this chapter is the decidability of the shrinkability problems. A timed automaton is non-blocking if its TTS is. A timed automaton with distinct labels is a timed automaton in which all edges have distinct labels.

Theorem 5.2.4. The following results hold:

• For closed non-blocking timed automata, non-blocking-shrinkability is in PSPACE, and in NP if the number of outgoing transitions from each location is bounded.

• For closed timed automata A with distinct labels, simulation-shrinkability w.r.t. any F is decidable in pseudo-polynomial time in the sizes of A and F.

• For closed non-blocking timed automata with distinct labels, strong shrinkability w.r.t. F is decidable in time exponential in A, and polynomial in F, more precisely, in time

O(2 |A| + p(|F|, |A|, M ))
, where M is the largest constant of A, and p some polynomial.

In each case, the largest δ 0 > 0 satisfying the property can be computed.

Moreover, we will show that when a given timed automaton is shrinkable, the least shrinking parameters can be computed (in a sense defined in Section 5.5). We assume distinct labels for simulation-shrinkability, mainly for technical reasons. Nevertheless, it is also meaningful for our purpose. In fact, we compare A with its shrinking and require these to have approximately the same behaviour. Checking simulation between these systems under this assumption not only requires "observational" equivalence but also a structural one. In fact, if a shrinking simulates F, it should do so by following exactly the same edges as A does when simulating F. Thus, we require the shrunk automaton and the initial automaton to have the same internal behaviour.

In the rest of this chapter, we present the proof of this result. We will use parameterized shrunk DBMs, presented in Chapter 3, give tools for solving fixpoint equations between parameterized shrunk DBMs by reduction to fixpoint equations in the max-plus algebra. We then explain how these results can be used to solve the shrinkability problems, by expressing them as fixpoint equations.

Equations on shrunk DBMs

Let us give an insight into the use of operations on shrunk DBMs to treat shrinkability problems. The following example explains the computation of the shrinking parameters on the timed automata of Fig. 5.1 and 5.2.

Example 5.3.1. We consider the timed automaton of Fig. 5.1, with g1 = 1 ≤ x, y ≤ 3 ∧ 0 ≤ x -y ≤ 3 the guard of the edge from ℓ1 to ℓ2, R1 = {y} its reset set, and g2 = 1 ≤ x ≤ 4 ∧ xy ≤ 3 the guard of the edge from ℓ2 to ℓ3. We shrink the guard g1 into

g ′ 1 = 1 + k1δ ≤ x ≤ 3 -k2δ ∧ 1 + k3δ ≤ y ≤ 3 -k4δ ∧ k5δ ≤ x -y ≤ 2 -k6δ,
and g2 into g ′ 2 = 1 + k7δ ≤ x ≤ 4 -k8δ ∧ k9δ ≤ y ∧ x -y ≤ 3 -k10δ.
Assume that we are looking for a valuation of k = (ki) 1≤i≤10 in N>0 for which the resulting shrunk automaton A -kδ witnesses the simulation-shrinkability, i.e. it can time-abstract simulate A for small enough δ > 0. According to our definition of shrinkability, the simulator sets of A -kδ must be shrinkings of the simulator sets of A. Let us concentrate on three interesting simulation classes: all states ℓ3 × R C ≥0 are simulation-equivalent and can be extended to an infinite run, the set of states X = x ≤ 4 ∧ 0 ≤ xy ≤ 3 at location ℓ2 are those that can go to ℓ3 by a b action, and the set of states Y = x, y ≤ 3 ∧ 0 ≤ xy ≤ 3 at location ℓ1 can go to X by an a action. One can see that X is precisely the time-predecessors of g2, that is

X = Pre time (g2) (5.1) Further, Y = Pre time (g1 ∩ Unresety(X)) (5.2)
expresses the fact that some point of ℓ2 × X can be reached in one step starting from ℓ1 × Y , and this defines Y . Now, we use these equations to compute the simulator sets when guards are shrunk. Let X ′ denote the shrunk DBM describing time-predecessors of g ′ 2 , as given by Lemma 3.4.14. We have

X ′ = x ≤ 4 -k8δ ∧ x -y ≤ 3 -k10δ ,
and ℓ2 × X ′ is indeed the set of states of A -kδ that can simulate the states ℓ2 × X of A, for any given valuation and small enough δ > 0. Let us now compute Y ′ , the simulator set in A -kδ of the states Y of A, applying .14 to the equation relating Y to X. In the figure below, the union of dark gray and light gray areas illustrate this equation for δ = 0, while the dark gray areas illustrate the equation between shrunk zones, i.e. between X ′ and Y ′ . We have:

Unresety(X ′ ) = x ≤ 3 -k10δ , g ′ 1 ∩ Unresety(X ′ ) = 1 + max(k1, k3 + k5)δ ≤ x ≤ 3 -max(k2, k10)δ ∧1 + k3δ ≤ y ≤ 3 -max(k4, k5 + max(k2, k10))δ ∧k5δ ≤ x -y ≤ 2 -max(k6, k3 + max(k2, k10))δ , Y ′ = Pre time ( g ′ 1 ∩ Unresety(X ′ )) = k5δ ≤ x ≤ 3 -max(k2, k10)δ ∧y ≤ 3 -max(k4, k5 + max(k2, k10))δ ∧k5δ ≤ x -y ≤ 2 -max(k6, k3 + max(k2, k10))δ .
The calculations are illustrated in Fig. 5.3.1. We now have at hand both parameterized expressions for the simulator sets X ′ and Y ′ , given parameterized shrunk guards g ′ 1 and g ′ 2 . It remains to choose a valuation, and check that X ′ and Y ′ are non-empty for small enough δ > 0. We choose the valuation that sets k1 = k4 = k6 = 2 and other parameters to 1. Note here that some parameters are set to 2 so that the shrunk guards are normalized. 1 We get that under this valuation,

X ′ = x ≤ 4 -δ ∧ x -y ≤ 3 -δ and Y ′ = δ ≤ x ≤ 3 -δ ∧ y ≤ 3 -2δ ∧ δ ≤ x -y ≤ 2 -2δ
. These sets and the guards are non-empty, and all equations above hold for all δ ∈ [0, 1 6 ]. This bound can be derived by looking at each application of .14 in our computations. Hence, we obtained a shrunk timed automaton A -kδ that can time-abstract simulate A, and expressions for the simulator sets parameterized by δ.

2 x y = Pre time       x y ∩ Unreset y       x y            
Y ′ = Pre time (g ′ 1 ∩ Unreset y (X ′ )).
In Example 5.3.1, we guessed a valuation k that witnessed the shrinkability of the considered timed automaton. The fact that the timed automaton did not contain cycles simplified the constraints on this valuation. The aim of the next section is to express systematically all constraints on parameters 1 We could instead apply normalization to g ′ 1 and g ′ 2 and set all parameters to 1. 2 Note that the initial state ℓ 1 × 0 is not included in X ′ unless we set k 5 = 0. This can be tested easily and we let the user decide whether simulation is considered to hold or not in this case.

k induced by the given equations, even in presence of cyclic dependencies, and provide an algorithm to compute a valuation satisfying these constraints.

We consider fixpoint equations on DBMs and study whether by "shrinking" a given solution, one can still satisfy the equation. Our goal is to generalize the arguments of Example 5.3.1 where we were able to compute a shrinking of the solutions to Equations (5.1) and (5.2). We consider fixpoint equations of the following form.

M i = f i (M 1 , . . . , M n , M n+1 , . . . , M n+n ′ ), ∀1 ≤ i ≤ n, (5.3)
where M 1 , . . . , M n+n ′ are unknown normalized DBMs and f i 's are elementary functions. Notice that M n+1 , . . . , M n+n ′ are unconstrained, i.e. they do not appear in the left hand side of the equation.

Let us write m = n + n ′ . We assume we are given a solution (M i ) 1≤i≤m to Equation (5.3), and we are interested in shrunk solutions defined as follows.

Definition 5.3.2. Consider a solution (M i ) 1≤i≤m of (5.3). A shrunk solution of (5.3) w.r.t.

(M i ) 1≤i≤m is a triple (M i ) 1≤i≤m , (Q i ) 1≤i≤m , δ 0 ,
where δ 0 > 0 and Q i 's are shrinking matrices such that for all δ ∈ [0, δ 0 ], (M i -δQ i ) 1≤i≤m is a solution of (5.3). A shrunk solution is called the greatest shrunk solution if (Q i ) 1≤i≤m are the least shrinking matrices that define a shrunk solution w.r.t.

(M i ) 1≤i≤m .
Notice that we define shrunk solutions with shrinking matrices, not with parameterized ones. Here, the "least shrinking matrices" refer to the order on N k defined by a ≤ b if, and only if a i ≤ b i for all 1 ≤ i ≤ k. Clearly, the sets X ′ and Y ′ we computed in Example 5.3.1 are a shrunk solution (and in fact the least one) with respect to the solution (X, Y ). A non-empty shrunk solution is a shrunk solution whose all shrunk DBMs are non-empty.

We now show how one can reduce the problem of finding shrunk solutions to that of solving simpler fixpoint equations in the max-plus algebra. For a non-empty solution (M i ) 1≤i≤m of (5.3), consider parameterized shrinking matrices P i , for all 1 ≤ i ≤ m, where each cell of each P i is a unique parameter in k. By Proposition 3.4.15, there exist matrices (φ i ) 1≤i≤n of max-plus polynomials such that

M i , φ i (P 1 , . . . , P m )[v] = f i (M 1 , P 1 [v]), . . . , (M m , P m [v])),
for all 1 ≤ i ≤ n, and any parameter valuation v. Here, φ i (P 1 , . . . , P m ) denotes a matrix whose components are max-plus polynomials that combine the components of matrices P j . The above equation suggests that we study the following fixpoint equation on PSMs P i 's:

P i = φ i (P 1 , . . . , P m ), ∀1 ≤ i ≤ n, [P i ] j,j = 0, ∀1 ≤ i ≤ m, 1 ≤ j ≤ |C 0 |. (5.4)
If some parameter valuation v satisfies (5.4), then if we denote by

Q i = P i [v] for all i, we get that (M i ) 1≤i≤m , (Q i ) 1≤i≤m
, δ 0 is a shrunk solution of (5.3), for some δ 0 > 0. In fact, the first line means that the fixpoint equation holds (by Prop. 3.4.15), and the second line means that this is a non-empty shrunk solution. Note that requiring the diagonals to be zero is sufficient since we assume all shrunk DBMs to be normalized. The converse also holds: the shrinking matrices of any shrunk solution of (5.3) satisfies (5.4). By Prop. 3.4.15, the size of the equation (5.4) is polynomial in the size of (5.3).

Note that we will be often interested in solutions of (5.4) where some parameters are positive. These parameters will, for instance, correspond to the shrinking of the guards. In order to enforce positive values to some parameters, one can augment Equation (5.4) with the following constraint, for any matrix cell [P i ] j,k that is to be positive:

[P i ] j,k = max(1, [P i ] j,k ).
(5.5)

The choice of the positive parameters depend on the application. For instance, in Section 5.5, we will shrink all the atomic constraints of given timed automata by positive amounts.

Let us define the positivity function as P(x) = 0 if x = 0 and P(x) = ∞ otherwise. We extend P(•) to matrices, by componentwise application. The correspondance between shrunk solutions and max-plus equations is formally stated in the following lemma.

Lemma 5.3.3. Consider any non-empty solution (M i ) 1≤i≤m of (5.3), and the max-plus polynomial matrices (φ i ) 1≤i≤n as defined above. Then,

• For all shrinking matrices (Q i ) 1≤i≤m , there exists δ 0 > 0 such that (M i ) 1≤i≤m , (Q i ) 1≤i≤m , δ 0 is a non-empty shrunk solution of (5.3) if, and only if, (Q i ) 1≤i≤m is a solution of (5.4) in N. Given (M i ) 1≤i≤m and (Q i ) 1≤i≤m , one can compute the maximum δ 0 > 0 to satisfy this property.

• (M i ) 1≤i≤m , (Q i ) 1≤i≤m , δ 0 ) is the greatest shrunk solution of (5.3) if, and only if (Q i ) 1≤i≤m
is the least solution of (5.4) in N.

• If (5.4) has a solution (Q i ) 1≤i≤m , then for any shrinking matrices R n+1 , . . . , R m such that P(R j ) ≥ P(Q j ) for n + 1 ≤ j ≤ m, there exist R 1 , . . . , R n such that (R i ) 1≤i≤m is the least shrunk solution of (5.4), computable in polynomial time.

The first two statements follow directly from the previous paragraph and Corollary 3.4.15. The computation of δ 0 > 0 is explained in Section 3.4. The third statement follows easily from Theorem 5.4.1 given in the next section, where we study the efficient computation of the solutions to fixpoint equations in the max-plus algebra, as in Equation (5.4).

Max-Plus Algebra

Max-plus equations

In PSMs, formal expressions using maximization and sum are manipulated. The set R ≥0 endowed with these operations is called the max-plus algebra. There is a well-established theory on solving equations in this algebra, with applications to discrete-event systems [START_REF] Baccelli | Synchronization and Linearity -An Algebra For Discrete Event Systems[END_REF]. The purpose of this section is to show how to solve polynomial fixpoint equations in the max-plus algebra.

Let k 1 , . . . , k n , k n+1 , . . . , k n+n ′ be parameters, and φ 1 , . . . , φ n be max-plus polynomials. We are interested in computing solutions of fixpoint equations of the following form:

k i = φ i (k 1 , . . . , k n , k n+1 , . . . , k n+n ′ ), ∀1 ≤ i ≤ n.
(5.6)

Notice that variables k n+1 , . . . , k n+n ′ only appear at the right hand side of the equation. Equation (5.6) defines a non-linear equation (polynomials φ i have arbitrary degrees). We call these equations max-plus polynomial fixpoint equations. The equations between parameters that we derived in the previous section fall into this category. Although Tarski's Theorem [START_REF] Tarski | A lattice-theoretical fixpoint theorem and its applications[END_REF] guarantees the existence of fixpoint solutions in N ∪ {∞}, we are interested in finite solutions, i.e., solutions in N which is not a complete lattice.

Theorem 5.4.1. The existence of a solution of a given max-plus polynomial fixpoint equation is decidable in polynomial time in the size of the equation. Moreover, if there is a solution v in N to a given equation E, then for any values

v ′ n+1 , . . . , v ′ n+n ′ ∈ N where v n+i > 0 ⇒ v ′ n+i > 0 for all 1 ≤ i ≤ n ′ , equation E with the additional constraints {k n+i = v n+i } 1≤i≤n ′ has a least solution, computable in polynomial time.
As in the previous section, we assume that expressions can be shared in equations given as input to the above theorem. Such a data structure is detailed in the next subsection. The second point of the theorem states that the existence of solutions does not depend on the exact values of the unconstrained variables, but only on their positiveness.

These results rely on an analysis of max-plus graphs, that we associate to max-plus equations. The rest of this section defines these graphs and gives an algorithm to solve these equations.

Max-Plus Graphs

Let k be a set of parameters. A max-plus graph G with parameters k is a directed graph (V, E), where V is the set of nodes, and

E ⊆ V × V the set of arcs. The node set V is partitioned into V = k ∪ N ∪ Max ∪ Plus.
There is one node for each parameter, and also some additional nodes labelled by natural numbers, and others labelled either by max or by plus. The arcs satisfy the constraints that each node labelled by max or plus has exactly two incoming arcs and one outgoing arc; each (directed) cycle contains at least one node in k; and the nodes N do not have incoming arcs. We identify nodes n ∈ N with the natural number they represent. We will have at most one node labelled by each natural number.

Intuitively, a max-plus graph encodes the relations between the parameters k, where a directed path from parameter k to k ′ means that k ′ is greater than or equal to k in any solution. An extended valuation v is the extension of a parameter valuation v to all nodes of G.

Definition 5.4.2. A valuation v : k → N is a solution of a max-plus graph G with parameters k if there exists some extended valuation v, that satisfies the following conditions.

• For all k ∈ k, v(k) = max(v(k ′ )) where the max is over all predecessors k ′ of k, • For all n ∈ N, v(n) = n.
• For all p ∈ Plus, v(p) = v(p ′ ) + v(p ′′ ), where p ′ and p ′′ are the (unique) predecessors of p,

• For all m ∈ Max, v(m) = max(v(m ′ ), v(m ′′ ))
where m ′ and m ′′ are the (unique) predecessors of m.

Note that if we are interested in a positive integer solution of a max-plus graph, we can simply add one edge from each parameter k to the node 1. We extend the order ≤ to vector of numbers as

(a i ) i∈I ≤ (b i ) i∈I iff a i ≤ b i for all i ∈ I. Given a graph G = (V, E), a path from node v 1 to node v k is a sequence v 1 v 2 . . . v k of nodes where (v i , v i+1 ) ∈ E for all 1 ≤ i ≤ k -1. A simple cycle is a path v 1 . . . v k such that v 1 = v k and nodes v 1 , . . . , v k-1 are pairwise distinct. A node v ′ is reachable from a node v if there is a path starting at v and ending at v ′ . For two nodes v, v ′ ∈ V , we write v + -→ v ′ , if there is a path v = v 1 . . . v k = v ′ such that k ≥ 2,
and v i ∈ Plus for some i ∈ {1, . . . , k}.

The following lemma gives a graph theoretical characterization of max-plus graphs that have solutions. A simple cycle of a max-plus graph is a bad cycle if it contains at least one Plus node, and at least one node that is reachable from a node n ∈ N with n ≥ 1. A contradicting path is a path from k to l, for some k, l ∈ N with k > l.

Lemma 5. [START_REF]granularities η and α such that η N >0 and η < ǫ/2, impl η (A) ≈ ǫ impl η (A)[END_REF] Consider a simple bad cycle c in G that contains a plus node p, and suppose there is an extended solution v. We know that p has one predecessor in p ′ in c, and another one outside, let us call it p ′′ . By hypothesis, all nodes of c are reachable from a node n ≥ 1, which implies v(p ′′ ) ≥ 1. We have

v(p) ≥ v(p ′ ) + v(p ′′ ) ≥ v(p ′ ) + 1. But since c is a cycle, combining inequalities satisfied by v along c, we get v(p ′ ) ≥ v(p), therefore v(p ′ ) ≥ v(p ′ ) + 1, which is a contradiction.
We now prove that if no such cycle exists, then G has a solution, which we will construct explicitly. Consider first all nodes W of G that are not reachable from any node n ∈ N with n ≥ 1. We can safely assign the value 0 to all the nodes of W (this doesn't contradict the max-plus graph since none of these nodes are reachable from a positive number). Then, we replace all nodes of W by the node 0 ∈ Nat. Let us call G ′ the graph obtained from G in this manner. Clearly, if G ′ has a solution, so does G, by extending the solution with W ∩ k → 0. Moreover, G ′ can be computed in polynomial time.

If k ⊆ W then we are done. Otherwise, let us assume w.l.o.g. that all the nodes of G are reachable from a positive number. We are now looking for a solution in N >0 . Then, by hypothesis, the relation + -→ is anti-symmetric. We partition the set of nodes of G into C 0 , C 1 , . . . , C m such that C 0 is the minimum for the relation + -→, and each C i is the set of nodes whose all + -→-predecessors are in C 0 ∪ . . . ∪ C i-1 and that has at least one + -→-predecessor in C i-1 . This partition can be seen as a topological sort for the relation

+ -→.
Observe that C 0 is not empty by hypothesis (in fact, there is at least one node that is reachable from a positive integer and there is no bad cycle) and that any plus node of C i have both its predecessors in C 0 ∪ . . .

∪ C i-1 . Also, there is no path in G from C i to C j for j < i by construction. Let G[C i ] denote the graph G restricted to nodes of C i . For all 1 ≤ i ≤ m, given a lower bound ι i : C i - → N >0 , there is a unique solution v i of G[C i ] such that ι i (v) ≤ v i (v) for all v ∈ C i .
In fact, the solutions of G[C i ] which respect ι i are exactly the solutions of the max-plus linear equation 3 Solutions to this linear fixpoint equations exist in N >0 , and A * b is one, and is in fact the least solution, where A * is defined as

x = Ax ⊕ b, defined by A k,l = 0 if there is an arc (l, k) in G[C i ] and A k,l = -∞ otherwise; and vector b is defined as b k = ι i (k) for all k.
A * k,l = 0 if there is path from l to k in G[C i ],
and -∞ otherwise. This can be computed in polynomial time (see Section 3 of [START_REF] Baccelli | Synchronization and Linearity -An Algebra For Discrete Event Systems[END_REF]).

We will define v iteratively for each C i , i ≥ 0. For i = 0, we let v 0 be the least solution of

G[C 0 ] for ι 0 defined by ι 0 (n) = n for n ∈ N ∩ C 0 and ι 0 (v) = 1 for all v ∈ C 0 \ N. At step i ≥ 0,
suppose we are given valuations v 0 , . . . , v i-1 and a lower bound ι i . We compute v i as the least solution of G[C i ] that respects ι i , and we define ι i+1 on C i+1 as follows. For all u ∈ C i+1 ∩ k, we let

ι i+1 (u) = max v:(v,u)∈E∧v∈C0∪...∪Ci v(v); for all u ∈ C i+1 ∩ Max, we let ι i+1 (u) = max(v(v 1 ), v(v 2 ))
where v 1 , v 2 ∈ C 0 ∪. . .∪C i by construction; and for all u ∈ C i+1 ∩Plus, we let

ι i+1 (u) = v(v 1 )+v(v 2 ) where v 1 , v 2 ∈ C 0 ∪ . . . ∪ C i . (Note that N ⊆ C 0 ).
Clearly, any solution of G that extends v| C0∪...∪Ci must satisfy this lower bound.

By construction, v defines a solution. Moreover, we show that this is the least solution. In fact, since this is a finite solution, the least solution v ′ given by Tarski's theorem is also finite. But we defined v 0 as the least solution in C 0 , so that there is no solution of G whose values in C 0 is less than v 0 . This means v ′ | C0 ≥ v 0 . We show by induction that the lower bound ι i is satisfied by v ′ | Ci , for all i, so that we get

v ′ | Ci ≥ v i by construction of v i . Hence, v ′ = v.
We now define max-plus graphs that encode the solutions of equations of the form (5.6). First, for a max-plus polynomial φ, let us define graph G(φ) associated to φ, as follows. Graph G(φ) is the syntactic binary tree of the expression φ, where the leaves are either constants or elements of k, and each internal node corresponds to either plus or max, and joins the subtrees of the corresponding subexpressions. The root corresponds to the whole expression φ. We direct the edges of the tree bottom up. Now, define the max-plus graph G associated to equation (5.6) as the union of graphs G(φ i ) associated to each φ i , where all nodes corresponding to same parameters are merged together. Moreover, an arc is added from the root node of each G(φ i ) to node k i , and from k i to the root. Notice that any cycle we create in this manner contains a parameter node. Observe that in our construction, each max-or plus-node of G corresponds to a unique subexpression in one of the φ i 's. The following lemma states that this graph encodes precisely the solutions of equation (5.6).

Lemma 5.4.4. Let G be the max-plus graph associated to Equation (5.6). A valuation v : k -→ N is a solution of G if, and only if it is a solution of (5.6). Therefore, v is the least solution of G if, and only if it is the least finite solution of (5.6).

Proof. As noted above, there is a correspondence between the nodes labelled max or plus with the subexpressions. We use this to show how a solution of G can be seen as a solution of (5.6) and vice versa. Suppose v is an extended solution that proves that v is a solution of G. Then, this defines a solution of (5.6) where v(k) is the values given to k, and v(V \ k) define the values of the subexpressions in φ i 's. In fact, by construction, these are the "intermediate" values calculated in the subexpressions when one evaluates each φ i . Using the same correspondence, one can see that a solution of (5.6) yields a solution of G whose extension correspond to these intermediate values.

Proof of Theorem 5.4.1. The first statement of Theorem 5.4.1 now follows directly from Lemmas 5.4.3 and 5.4.4. For the second statement, define equation (E) from equation (5.6) by adding equality constraints k n+i = v n+i for all 1 ≤ i ≤ n ′ , for any v n+1 , . . . , v n+n ′ ∈ N >0 . Assume that (5.6) has a solution where k n+1 , . . . , k n+n ′ are given positive values. We show that then, the max-plus graph G ′ associated with equation (E), does not have bad cycles or contradicting paths, which means that it has a solution by above lemmas. In fact, in the max-plus graph G of (5.6), no cycle that is reachable from a node k n+i contains a plus node, since this would contradict the existence of a solution with a positive value for k n+i . Therefore, when we add the additional constraint k n+i = v n+i we do not create any new bad cycles or contradicting paths. The result follows.

Deciding shrinkability

We now apply the results we developed in previous sections to shrinkability.

Simulation-Shrinkability

We fix a closed timed automaton A = (L, l 0 , C, Σ, E) with distinct labels, and a finite automaton F on the same alphabet Σ such that F ⊑ t.a. A . For any edge with label σ ∈ Σ and guard g σ , let G σ be the DBM that represents g σ , and R σ be the reset set.

Computation of the Simulator Sets Since all edge labels are distinct, the simulator set of each state f of F in A can be expressed as the greatest fixpoint of the following equation:

S f = σ∈Σ f σ -→f ′ Pre time (Unreset Rσ (S f ′ ) ∩ G σ ) , (5.7)
for all states f of F, where (S f ) f ∈F are unknown sets of states of A. The greatest fixpoint is well-defined since the operator on the right, denoted Ω, is non-decreasing. We will use properties of the region equivalence in a timed automaton without formalizing this well-known construction (for that, we refer to [START_REF] Alur | A theory of timed automata[END_REF]). Regions refine the largest timeabstract bisimulation in a timed automaton; therefore, if (S f ) f are finite unions of regions, then (S ′ f ) f = Ω((S f ) f ) are also finite unions of regions. In particular, the largest fixpoint of (5.7) can be computed by a finite number of iterations of operator Ω, after having initialized all sets with the full set of states of A. We also notice that if (S f ) f are convex sets, then so are (S ′ f ) f = Ω((S f ) f ). For every i, we write (S i f ) f for the sets of states obtained after i iterations of Ω in the abovementioned iterative computation. From the above discussion, the two following properties hold:

• for every state f of F, ta-sim A (f ) = lim i→∞ S i f = S i0 f for some i 0 ;

• for every i, for every f , S i f is a finite convex union of regions. We therefore deduce that the simulator set of each state f of F in A can be expressed as the greatest fixpoint of the following equation on DBMs:

M f = σ∈Σ f σ -→f ′ Pre time (Unreset Rσ ( M f ′ ) ∩ G σ ) , (5.8)
for all states f of F, where (M f ) f are unknown DBMs. We now argue that the simulator sets can be computed in time pseudo-polynomial in A and F. As argued above, one can compute this greatest fixpoint by initializing all M f to unconstrained DBMs, and then iteratively computing approximations applying (5.8) until a fixpoint is reached. If M i f is the i-th iterative DBM for state f , we obviously have that M i f = S i f . As each computed DBM represents a finite union of regions, it can be defined with constraints using integer constants between -C and C, and all the computed normalized DBMs only use integer constants in

[-C • |C 0 |, C • |C 0 |] ∪ {-∞, ∞}.
So, at each iteration, either the M f 's do not change, in which case the fixpoint has been reached, or some constant is decreased by at least one. Thus, fixpoint must be reached in at most Globally, the simulator sets for all f 's can therefore be computed in time

O((C • |C 0 |) • |F| • |C 0 | 2 ) iterations,
O(C • |F| 2 • |C 0 | 6 ), which is then pseudo-polynomial.
Computing Shrunk Simulator Sets When They Exist Consider the greatest solution (M f ) f of (5.8). Including the G σ 's in the unknown DBMs, Equation (5.8) can be seen as an instantiation of Equation (5.3) (page 76) over DBMs

(M f ) f ∪ (G σ ) σ .
Solving simulation-shrinkability w.r.t. F consists in deciding if for some shrinking of the guards G σ , there exist simulator sets that are shrinkings of the sets M f 's. So, solving simulationshrinkability w.r.t. F means deciding whether (5.8) has a shrunk solution with respect to (M f ) f ∪ (G σ ) σ where the shrinking matrices of G σ 's are positive. 4 This can be decided by Lemma 5.3.3.

Simulation-shrinkability does not depend on how much the guards are shrunk. In fact, since G σ 's are unconstrained in (5.7), if there is a shrunk solution to (5.7) with positive shrinking matrices for G σ 's, then for any shrinking matrices (K σ ) σ , Lemma 5.3.3 provides a (greatest) shrunk solution where the shrinking matrices for (G σ ) σ are fixed to (K σ ) σ . Therefore, either all positive integer vectors k, which yield normalized guards, witness the shrinkability of A (into A -kδ ), or A is not simulation-shrinkable w.r.t. F for any value of k.

Furthermore, one can also require initial simulation between F and a shrinking of A, i.e. the initial state of A -kδ should simulate the initial state f 0 of F. In this case, it suffices to compute the shrunk simulator sets as above (if these exist), and then check whether the shrinking of the set M f0 contains the valuation 0. This can be done efficiently, since it suffices to intersect the shrinking with this valuation and check for emptiness. Now, solving simulation-shrinkability w.r.t. F only takes time polynomial in the size of the equation. So the overall complexity is pseudo-polynomial in A and F. Note that, one can check simulation-shrinkability w.r.t. A, which requires the shrinking to time-abstract simulate A, by chosing F as a time-abstract bisimulation quotient of A. In this case, F has exponential size, so the procedure takes exponential time. Nevertheless, minimization can be used to compute the coarsest bisimulation quotient as in [START_REF] Tripakis | Analysis of timed systems using time-abstracting bisimulations[END_REF], which yields small equations in practice (See Chapter 6).

Non-blocking-Shrinkability

We fix a closed non-blocking timed automaton A = (L, l 0 , C, Σ, E). For any edge with label σ ∈ Σ and guard g σ , let G σ be the DBM that represents g σ , and R σ be the reset set. The following equation characterizes non-blockingness:

∀σ ∈ Σ, G σ ⊆ σ ′ :(σ,σ ′ )∈ΣE•E Unreset Rσ (Pre time ( G σ ′ )), (5.9)
where we let

Σ E•E = {(σ, σ ′ ) | ∃l, l ′ , l ′′ ∈ L, l gσ,σ,Rσ -----→ l ′ g σ ′ ,σ ′ ,R σ ′ -------→ l ′′ ∈ E},
that is the set of pairs of labels of consecutive transitions in A. We rewrite this equivalently as follows.

∀σ ∈ Σ, G σ = σ ′ :(σ,σ ′ )∈ΣE•E Unreset Rσ (Pre time ( G σ ′ )) ∩ G σ , ( 5
∀σ ∈ Σ, G σ = σ ′ :(σ,σ ′ )∈ΣE•E M σ,σ ′ ∀σ, σ ′ ∈ Σ, M σ,σ ′ = Unreset Rσ (Pre time ( G σ ′ )) ∩ G σ (5.11) Fix a solution (G σ ) σ ∪ (M σ,σ ′ ) σ,σ ′ ,
which exists again by the non-blockingness assumption. We will solve the max-plus equation corresponding to the second part of (5.11) by Lemma 5.3.3, but we first add to this equation some inequalities which "encode" the first part of (5.11). We use the following technical lemma to choose these inequalities.

Lemma 5.5.1.

D -δQ ′ = 1≤i≤b C i -δP ′ i ,
for all small enough δ > 0.

Proof. One can verify in polynomial time, whether for all i ∈ {1, . . . , b}, C i -δP i ⊆ D -δQ for all small enough δ ≥ 0: It suffices to check, for all x, y, whether (C i -δP i ) x,y ≤ (D -δQ) x,y for small enough δ ≥ 0, which holds if either (C i ) x,y < D x,y or (C i ) x,y = D x,y and (P i ) x,y ≥ Q x,y . In the former case, we need to choose δ 1 so that δ(Q x,y -(P i ) x,y ) ≤ D x,y -(C i ) x,y for all 0 ≤ δ ≤ δ 1 , whereas the latter always holds.

It remains to verify that D -δQ ⊆ 1≤i≤n C i -δP i . This holds if and only if

1≤i≤b C i -δP i c ∩ D -δQ = 1≤i≤b (x,y)∈(C∪{0}) 2 x -y > (C i -δP i ) x,y ∩ D -δQ = ∅.
which is true if and only if for all (x (1) , y (1) ), . . . , (x

(b) , y (b) ) ∈ (C ∪ {0}) 2 , 1≤i≤b ( x (i) -y (i) > (C i -δP i ) x (i) ,y (i) ∩ D -δQ ) = ∅.
But there are less than (|C 0 |) 2b such terms, which are conjunctions of b + 1 DBMs, so the emptiness of each term can be checked in polynomial time, as described above. The overall time complexity is then O((|C 0 |) 2b p(|A|)). But this verification can be carried out in polynomial space since each term can be checked independently. Note that each term gives an upper bound on δ 1 , so the equality holds choosing δ 1 as the minimum of these.

The last statement follows from the fact that the emptiness, for all small enough δ ≥ 0, of the disjuncts above only depends on the order between the parameters. Note that checking equality between a zone and a union of zones is a difficult problem in general; some heuristics were suggested in [START_REF] David | Model checking timed automata with priorities using DBM subtraction[END_REF].

The second point of the lemma says that the satisfaction of the first part of (5.11) by a shrunk solution only depends on the relative ordering of the components of the shrinking matrices. Therefore, we only need to guess the ordering between all parameters (there is at least one if there exists a shrunk solution), and solve the second part of (5.11) augmented with these guessed (in)equalities.

Formally, let Φ be the max-plus equation corresponding to the second part of (5.11), as defined in Section 5.3. Let k ′ denote the set of all parameters that appear in Φ (there is one parameter per element of each matrix G σ and M σ,σ ′ ). Notice that 2 , where b is the maximal number of outgoing edges in A, and that Φ has size polynomial in the size of A. Φ is a conjunction of equations k = φ k (k ′ ) for all k ∈ k ′ . For all pairs k, l ∈ k ′ , we guess a relation among {<, =, >}, and define equation Φ ′ by adding these relations to Φ. This can be done, for the case k = l, by replacing the constraints on k and l respectively by k = max(φ k (k ′ ), l) and l = max(φ k (k ′ ), k), and in the case k > l, by replacing the constraint on k by k = max(φ k (k ′ ), l + 1). Notice that Φ ′ is obtained from Φ in polynomial time and with a polynomial number of guesses. We then solve Φ ′ using Theorem 5.4.1. If we find a solution, say

k ′ has size O (|C 0 | • |L| • b)
(P σ ) σ ∪ (P σ,σ ′ ) σ,σ ′ , we verify that G σ -δP σ = σ ′ M σ,σ ′ -δP σ,σ ′ for small δ, for all pairs (σ, σ ′ ) ∈ Σ E•E , in time O(|C 0 | 2b p(|A|))
and in polynomial space by Lemma 5.5.1. We accept if all verifications succeed and reject otherwise. If accepted, any solution provides a shrunk solution of (5.11), by Lemma 5.3.3. Conversely, if there is a shrunk solution of (5.11), then, Φ ′ can be constructed for the guesses corresponding to this solution, and by Lemma 5.5.1, Φ ′ has a solution. If b is fixed, this procedure is in NP. Otherwise, instead of making guesses, we can deterministically try all possible guesses (the number of possible guesses is O(2 (|C|•|L|•b) 2 ) and verify in polynomial space, so the procedure is then in PSPACE.

Finally, to decide strong shrinkability, one can first compute the least parameters k and δ 0 for non-blocking-shrinking, then check simulation-shrinkability since the latter does not depend on exact values of k and δ 0 .

Conclusion

In this chapter, we proposed a new framework for robustness analysis against guard shrinkings, that can detect timed automata whose behaviours depend on the ability of the system to act at the boundaries of the guards. Such timed automata are vulnerable to loss of time-abstract behaviour when implemented. Theoretically, shrinkability analysis is formulated as a parameter synthesis problem. We showed how the fixpoint equations between DBMs that encode the desired properties are reduced to fixpoint equations in the max-plus algebra between the parameters. Despite the relative complexity of the proofs and algorithms, the simulation-shrinkability works well in practice; the next chapter presents a tool and experimental results.

An important future work is the study of arbitrary fixpoint equations between shrunk DBMs, such as those including arbitrary use of unions. If we are able to treat such equations, then simulation-shrinkability without the distinct edge labels hypothesis could be solved. This would allow one to write more abstract specifications, and ease the complexity. In fact, as our experimental results indicate, the bottleneck is the size of the finite automaton (denoted F) with respect to which simulation-shrinkability is checked. One could also check shrinkability w.r.t. a (timed) temporal logic formula.

We believe the shrunk DBMs we introduced can be useful in solving other problems in timed automata, involving small imprecisions. We indeed re-use this data structure to solve the robust controller synthesis problem in two differents settings; these are studied in Part III of this thesis.

Chapter 6

The Shrinktech tool

Introduction

Chapter 5 presented algorithms and theoretical results on shrinkability analysis on timed automata. This chapter presents the tool shrinktech, in which the simulation-shrinkability algorithm is implemented, and reports experimental results.

The contents of this chapter will appear in [START_REF] Sankur | Shrinktech: A tool for the robustness analysis of timed automata[END_REF].

Shrinktech

Given a timed automaton, the tool shrinktech either finds a counter-example to simulationshrinkability, such as a path or a cycle that cannot be executed by any shrinking of the automaton, whatever the value of δ's are, or outputs a shrinking of the timed automaton that witnesses the shrinkability.

The input to the tool is Kronos timed automata format1 . The format allows one to either specify a timed automaton directly (as in Definition 2.2.1), or to describe a network of timed automata, that is, several timed automata synchronizing on common actions. Figure 6.2 shows an overview of the tool. To check the shrinkability of a timed automaton, the user can either provide a finite automaton F, or let shrinktech compute the full finite bisimilarity graph using Kronos2 . Note that if the full bisimilarity graph is too big, one can also try to shrink with respect to a portion of it, or with respect to a randomly generated trace. This is to be compared with bounded model-checking, which is useful for detecting bugs, but also for "partially" proving the correctness of a system. The tool comes with scripts to compute the bisimilarity graph, extract some (random) portion of it, and generate random executions.

The tool shrinktech can be used for several kinds of systems modelled by timed automata. We believe it can be used mainly for two purposes:

1. Robustness analysis, to find out whether the behaviour of the system is preserved when the time bounds are disturbed (shrunk). 2. Deriving implementations from timed automata. In fact, the behaviour of a shrunk timed automaton is included in that of the initial model in presence of imprecisions. So lower and upper bounds on the delays can be "shrunk" in the implementation to guarantee that these will be respected despite imprecisions. This approach will be detailed in Chapter 11.

Implementation details and availability. The tool is implemented in C++ and the source code has about 5Klocs. It uses the Uppaal DBM library3 , and extends it to shrunk DBMs presented in

Experimental Results

We used shrinktech on several case studies found in the literature. The table 6.1 summarizes the results. The Lip Synchronization Protocol has been the subject of robustness analysis (by guard enlargement) before [START_REF] Kordy | Re-verification of a lip synchronization protocol using robust reachability[END_REF]. This is an algorithm that synchronizes video and sound streams that arrive in different frequencies. The model is not shrinkable neither for video frames arriving in exact frequency, nor for those arriving within a bounded interval. Observe that the model is shrinkable w.r.t. a small subgraph with 501 nodes, but it is not shrinkable w.r.t. the whole graph which has 4484 nodes. Shrinkable models include Philips Audio Retransmission protocol [START_REF] Daws | Two examples of verification of multirate timed automata with kronos[END_REF], and some asynchronous circuit models. We were able to analyze Fischer's Mutual Exclusion Protocol upto 4 agents; while for 5 agents we could only partially analyze w.r.t. a randomly generated trace. The non-shrinkability of most models is due to equality constraints. In fact, although we only shrink non-punctual guards, some behaviours may still disappear immediately, however small the shrinking parameter is. Note that some of these models were designed at a level of abstraction where imprecisions were not taken into account. So, our results do not necessarily imply that these systems are not robust, but rather that the present models are not good for direct implementation. This is best illustrated in the Latch Circuit models, where the exact model that extensively uses equalities is not shrinkable, but its relaxation to intervals is. Notice also how most of the circuit models, which define bounds on stabilization times are shrinkable.

Related Work

Existing verification tools for timed automata may be used for non-parameterized robustness checking by modeling explicitly the imprecisions, although this increases the size of the models [START_REF] Altisen | Implementation of timed automata: An issue of semantics or modeling[END_REF]. The semi-algorithm of HyTech was used to synthesize guard enlargement parameters in timed automata Table 6.1: The column sim-graph is the number of states and the number of transitions of the finite automaton F w.r.t. which the shrinkability is checked. L, E, and C denote, respectively, the number of locations, edges, and clocks. The last column is the shrinkability of the given model, as reported by the tool. An asterisk indicates bounded shrinkability, where only a subgraph of the time-abstract bisimulation graph (given by a BFS) or a random trace was used. The tests were performed on an Intel Xeon 2.67 GHz. All models are available on the tool's website. in [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF]. An extension of Uppaal for robustness against guard enlargement was used in [START_REF] Kordy | Re-verification of a lip synchronization protocol using robust reachability[END_REF]; this feature is no longer available in Uppaal. Note that shrinkability cannot be solved by existing model-checkers for timed automata since we are interested in parameter synthesis so as to ensure time-abstract simulation. Other similar work includes (the undecidable problem of) parameter synthesis in timed automata, where guards are written using parameters, and one tries to find the valuations for which the system satisfies some specification, e.g. [START_REF] André | IMITATOR 2.5: A tool for analyzing robustness in scheduling problems[END_REF]. This is difficult to realize due to the large number of parameters (upto millions) and the time-abstract simulation condition we consider. Robustness against large decreases in task execution times using simulation was considered in [START_REF] Abdellatif | Model-based implementation of real-time applications[END_REF].

Model

Example: Non-shrinkability

Non-shrinkability of timed automata can be due either to the disappearance of a finite behaviour, or that of an infinite behaviour. We illustrate the first kind of non-shrinkability here; the next section gives an example of the second one. We consider the timed automaton A 3 of Fig. 6.2. This timed automaton describes a system, which, upon arrival to location A, activates an external device, and then sends a message to the device (at location S). At location A, the device can be activated in two modes: a simple mode renders the device ready for execution immediately, but it requires a (slow) buffered communication. An advanced mode requires at least one time unit of activation, but has the advantage of supporting direct (and fast) communication. We assume that the device is activated by maintaining a signal long enough on some port: If the signal is maintained long enough (at least 1 time unit), the device switches to advanced mode; otherwise it falls back to the simple mode. Let us further assume that the buffer is active by default, but it is automatically deactivated when (strictly) more than 1 time unit has been spent at A.

The system sends either a direct or a buffered message at location S following the above constraints. Let us assume that the system needs to send the direct message while x ≤ 3, and that there is no such constraint for the buffered message.

One may not want to maintain signal that is too long at A; this may be costly, or may consume computation time. On the other hand, if one wants to make sure that the device is activated in the advanced mode, then the signal should be maintained for at least 1 + δ, for a suitable δ. Hence, shrinkability analysis makes sense here: e.g. the shrunk guard xy ≥ 1 + δ means exactly that 1 + δ time units have been spent at A. ...

A S

x,y:=0 x≤2,sig,y:=0

x -y ≥ 1, di re ct

xy ≤ 1, bu ff er ed The red area is the guard of the edge buffered, while the blue area is that of direct. The initial timed automaton has a branching: from point x = 1, y = 0 at location S, the automaton can realize either of the actions. However, this branching is no more possible in the shrunk timed automaton.

Figure 6.3 shows the state space of this timed automaton with and without shrinking. In the original timed automaton, one can see that there is a branching: for appropriately chosen delays, after the sig action, both direct and buffered actions are available. In fact, upon arrival to S with x = 1, the device is in the advanced mode, and the buffer has not been deactivated. On the other hand, the slightest shrinking of the guards disables such a branching. In any shrunk timed automaton, neither of the actions are enabled if the action sig is taken at x = 1. In fact, taking into consideration imprecise measure of time, one cannot be sure, in this case, that the device is in advance mode or the buffer is still active. The safest option would be to realize sig while x ≤ 1δ (the buffer is active for sure), or when x ≥ 1 + δ (the device is in advanced mode for sure). Consequently, there is no possible behavior that realizes sig first, and then "decides" whether to choose direct or buffered.

On the other hand, the behaviors sig • direct and sig • buffered are still available in the shrunk timed automaton. So, A 3 is shrinkable w.r.t. these separate paths.

Non-shrinkability is not always due to a finite path that is disabled because of shrinkings. In the next section, we give an example of a timed automaton whose shrinkings cannot simulate a cycle of the bisimilarity graph, but can simulate any finite unfolding of it.

Using shrinktech

Simple usage We explain here how to use the shrinktech tool on a simple example. We would like to check whether the timed automaton A 5 of Fig. 6.4 is shrinkable. This automaton can be described in Kronos timed automaton format as given in Fig. 6.5. Assuming Kronos is installed on the system, the simplest way to check shrinkability is the following:

> shrinktech automaton.tg [...]
Starting shrinkability analysis on files automaton.tg and automaton.aut Warning: Some edges have equality constraints and will not be shrunk (see log file)

With a custom finite automaton One can also give a custom finite automaton automaton1.aut as an input to the program. For instance, one can try to unfold the loop BC several times to check whether some shrinking of A 5 can at least simulate a finite number of iterations. Consider the finite automaton of Fig. 6.6. This automaton can be simulated by automaton.aut, thus also by A 5 (note that the timed automaton must be able to simulate the given finite automaton; an error will be generated otherwise). See also the -gentrace option in Section 6.6.1 to randomly generate such a trace. des(0,7,8) (0, "A",1) (1, "B",2) (2, "C",3) (3, "B",4) (4, "C",5) (5, "B",6) (6, "C",7)

Figure 6.6: Finite automaton automaton1.aut

One can run shrinktech providing both the timed automaton and the finite automaton:

> shrinktech automaton.tg automaton1.aut Starting shrinkability analysis on files automaton.tg and automaton1.aut Warning: Some edges have equality constraints and will not be shrunk (see log file) Timed automaton is SHRINKABLE.

Run again with --simulator_sets option to compute solution. See automaton.log for details.

This time the automaton is shrinkable with respect to the given finite automaton. By default, shrinktech does not compute the simulator sets of the shrunk automaton, i.e. the set of states of the shrunk timed automaton that can simulate each state of the finite automaton. But this can be done using the -simulator_sets option. In this case, the log file will contain the description of the simulator sets. The log file will also report an upper bound on δ below which the simulation holds. Furthermore, a shrinking of the given timed automaton is generated in a local folder named shrunk.

Here is an excerpt from the log file.

------------------PARAMETERIZED SHRUNK SIMULATOR SETS ------------------------Substituting delta = 0 gives the simulator sets of the original automaton -----------------------------------------------------------------------------Simulator set of the finite automaton node(0 These describe the set of (parameterized) states that can simulate the nodes 0 and 1 of the finite automaton. Here, p[i]'s are positive integers to be determined by shrinkability analysis. The log file also contains an instantiation of these simulator sets for the parameter values computed by shrinktech and for the largest possible δ:

) 0 +(p[0])delta <= X <= 1 -(p[ 2
- ------------------------DISCRETE SOLUTION ----------------------------Scaling factor: 100 --------------------------------------------------------------------- Note that we scale here the constants so that we only have to deal with integers, instead of floating point numbers.

See also Section 6.6.1 for additional tools and scripts that can be helpful to extract a finite automaton.

Using multiple files In Kronos timed automaton format, several components communicating by synchronization can be given to describe one large system. In this case, one can simply give shrinktech the list of all the components: > shrinktech component1.tg component2.tg .... componentK.tg

In this case, shrinktech will invoke Kronos to compute the product, and then to compute the bisimulation graph. By default, the product automaton will be written in ta.tg and shrinkability analysis will be run on this file. One can modify this target file using the option -out target.tg.

Command-line Options and Additional Tools

-aut When run with this option, shrinktech will only compute the product of the given timed automata (if more than one is given), and output the time-abstract bisimilarity graph. The output file can be specified using -out target.aut; the default is ta.aut. This feature uses Kronos.

-simulator_sets This option tells shrinktech to compute all simulator sets of the shrunk timed automaton, if the given timed automaton is shrinkable. The shrunk timed automata will also be written in a local directory 'shrunk' in case of shrinkability. This option is disabled by default since it is not always needed.

-shrink This option is used to syntactically shrink a given timed automaton. When called shrinktech -shrink automaton.tg 100, the program will multiply all constants by 100 and shrink the guards by 1. This is equivalent to shrinking by 1/100; but the time scale is changed so that all constants are integers. By default, the file is output as automaton-shrunk.tg, but another target file can be specified with -out automaton2.tg.

-gentrace Generates a trace, in form of a finite automaton, by a random simulation of the given timed automaton. When called with shrinktech -gentrace automaton.tg 1000, this option will output in standard output a random trace of length 1000. One can then either direct this to a file, or specify an output file by -out automaton.aut.

graph_extractor This is a Python script that can extract a subgraph of a given graph, using DFS or BFS, either deterministically or randomly. The options -dfs, -randdfs and -bfs can be used for this purpose. Run the program without arguments for usage.

Note that CADP can also be useful for instance to check bisimulation, minimize or visualize finite automata (http://www.inrialpes.fr/vasy/cadp/).

Conclusion

We presented shrinktech, a software tool compatible with the Kronos model-checker. The tool allows to check the simulation-shrinkability with respect to a given finite automaton. The experimental results show that the tool is capable of treating several case studies found from the literature. The bottleneck is the size of the finite automaton F: the full bisimilarity graph is often costly to compute, and too large graphs require long computation times for the shrinkability analysis. We were nevertheless capable of treating the shrinkability of timed automata with thousands of edges, with respect to graphs with more than sixty thousand transitions.

An important future work will be about computing smaller finite automata F. In fact, often, the full bisimilarity graph is not of interest for the verification purposes, but only a "significant" part of it is needed. The present tool either computes the full bisimilarity graph, or requires a finite automaton to be given manually. In order to simplify the finite automaton, the user often has to work on the full bisimilarity graph, which can be too large to process (and understand). Further tool support is needed to automatically generate some parts of the bisimilarity graph, and to simplify these graphs. This will help the user concentrate on important properties to be verified, but also reduce running time. Moreover, if the timed automaton is not shrinkable with respect to a given finite automaton, the tool could also inform the user about the possibilities of eliminating from the finite automaton those behaviors absent from the shrunk timed automaton. In fact, the counter-examples found by the tool needs to be interpreted by the user, who also decides whether they are important or not.

Part III

Robust Controller Synthesis

This part contains contributions on robust controller synthesis algorithms. In the controller synthesis approach, a given model is no longer seen as a final design; but the goal is to compute a strategy to resolve the non-determinism while satisfying a given objective. The subsequent chapters studies this problem under parameterized perturbation models. Hence, we are interested in synthesizing strategies that are correct even when the moves they prescribe are perturbed by a bounded amount. Chapter 7 considers the problem under the excess perturbation game semantics for reachability objectives on timed automata and turn-based timed games. Chapter 8 considers the conservative perturbation game semantics for Büchi objectives on timed automata. Both semantics are applied to weighted timed automata and games in Chapter 9 93 Chapter 7

Reachability in Excess Semantics

Introduction

In this chapter, we study the synthesis of robust controllers in timed automata and games under the excess-perturbation game semantics. The main result of this chapter is the following: We show that deciding the existence of δ > 0, and of a strategy for the controller so as to ensure reachability of a given location in a turn-based timed game (whatever the imprecision, up to δ), is EXPTIME-complete. Moreover, if there is a strategy, we can compute a uniform one, which is parameterized by δ, using shrunk difference bound matrices (shrunk DBMs) seen in Chapter 5. In this case, our algorithm provides a bound δ 0 > 0 such that the strategy is correct for all δ ∈ [0, δ 0 ]. Our strategies also give quantitative information on how perturbations accumulate or can compensate. Technically, the results require extending shrunk DBMs by constraints, and establishes new algebraic properties of this data structure (Chapter 3). The main result is then obtained by transforming the infinite-state game into a finite abstraction, which we prove can be used to symbolically compute a winning strategy, if any (Section 7.5).

The results presented in this chapter were published in [START_REF] Bouyer | Robust reachability in timed automata: A game-based approach[END_REF]. Formally, we are interested in the following problem, called parameterized robust reachability in the excess perturbation game semantics. Definition 7.1.1. The parameterized robust reachability in the excess perturbation game semantics asks, given a turn-based timed game A and a target location ℓ, whether there exists δ > 0 such that Controller has a winning strategy in G exs δ (A) for the reachability objective ℓ. Notice that we are interested in the parameterized problem: δ is not fixed in advance. When δ is fixed, the problem can be formulated and solved as a usual timed game (see [START_REF] Chatterjee | Timed parity games: Complexity and robustness[END_REF] for such an encoding). The parameterized version is important since one does not necessarily have a precise estimation for perturbations at the design phase. It is also interesting to directly synthesize δ and a uniform strategy, as described above, rather than finding one by trial-and-error.

Our main result is the EXPTIME-completeness of this problem:

Theorem 7.1.2. Parameterized robust reachability in the excess perturbation game semantics is EXPTIME-complete both for timed automata and turn-based timed games.

Checking parameterized robust reachability is different from usual reachability checking in the exact semantics mainly for two reasons. First, in order to reach a given location, Controller has to choose the delays along a run, in such a way that uncontrollable perturbations do not accumulate and block the run. In particular, it shouldn't play too close to the borders of the guards (see Fig. 3.3). Second, due to these uncontrollable perturbations, some regions that are not reachable in the absence of perturbation can become reachable (see Fig. 7.1). So, Controller must also be able to win from these newly reachable regions. The regions that become reachable in our semantics are those neighboring reachable regions. In all timed automata and games we consider, we assume that all clocks are bounded above by a constant. We do not lose generality with this hypothesis since reachability objectives are preserved by choosing a constant large enough, and requiring that all clocks stay below it at any transition.

The chapter is organized as follows. In Section 7.2, we introduce constraints on shrunk DBMs, and study neighborhoods of shrunk DBMs. For the sake of readability, we first present and prove the algorithm for timed automata, in Section 7.5, then explain how to extend the algorithm to turn-based timed games in Section 7.6. The EXPTIME-hardness result is given in Section 7.7 and holds already for timed automata.

Shrinking constraints

Consider a transition of a timed automaton, as depicted on Fig. 7.1. From region r 0 , the game can reach regions r 1 , r 2 , r 3 , depending on the move of Perturbator. Therefore, in order to win, Controller needs a winning strategy from all three regions. One can then inductively look for winning strategies from these regions; this will generally require shrinking, as exemplified in Fig. 3.3. However, not all shrinkings of these regions provide a winning strategy from r 0 . In fact, r 1 (resp. r 3 ) should not shrink from the right (resp. left) side: their union should include the shaded area, thus points that are arbitrarily close to r 2 . In order to define the shrinkings that are useful to us, we introduce shrinking constraints. Shrinking constraints specify which facets of a given zone one is (not) allowed to shrink (see Fig. 7.2).

We will focus our attention to well shrinking constraints defined below, show that shrinking constraints have a normal form (Subsection 7.2), and then show how shrinking constraints can be propagated in order to deduce new shrinking constraints as in the example of Fig. 7.1 (Subsection 7.2).

Normalization and Well-Shrinking Constraints.

A shrinking constraint S for a DBM M is said to be well if for any SM P ≤ S, (M, P ) is non-empty. A well constrained DBM is a constrained DBM given with a well shrinking constraint. We say that a shrinking constraint S for a DBM M is normalized if it is the minimum among all equivalent shrinking constraints: for any shrinking constraint S ′ if for all SMs P , P ≤ S ⇔ P ≤ S ′ , then S ≤ S ′ . Similarly to the normalization of DBMs or SMs, normalized shrinking constraints contain Let the shrinking constraint S be defined by S 0,y = 0, S x,y = 0, and S z,z ′ = ∞ for other components. The resulting M, S is depicted on the left, as a matrix (where, for convenience, we merged both matrices into a single one) and as a constrained zone (where a thick segment is drawn for any boundary that is not "shrinkable", i.e., with S z,z ′ = 0). On the right, the dark gray area represents a shrinking of M that satisfies S.

  0 x y 0 (0, ≤), 0 (0, <), ∞ (0, <), 0 x (3, <), ∞ (0, ≤), 0 (2, <), 0 y (3, <), ∞ (0, <), ∞ (0, ≤), 0   (a)
the tightest constraints implied by the original shrinking constraint. They can be normalized by a procedure that is slightly different from the one used for the normalization of DBMs. This is defined formally in the following lemma.

Lemma 7.2.2. Let M be a normalized DBM. For any shrinking constraint S for M , there exists a minimum shrinking constraint S ′ for M such that S ′ ≤ S, and for any normalized non-empty shrunk zone (M, P ), P ≤ S if, and only if, P ≤ S ′ . Moreover, S ′ can be obtained as follows. Start with S ′ = S. For every pair x, y ∈ C 0 , if S x,y = 0, then set S ′ z,z ′ to 0 for all edges (z, z ′ ) of all paths in Π x,y (G(M )). Also assign S ′ x,y = 0 whenever M x,y = ∞. If S = S ′ , then S is said to be normalized.

Proof. Consider S ′ obtained from S by the above procedure. Obviously, S ′ ≤ S, so that for any SM P ≤ S ′ , we have also P ≤ S. Conversely, consider any normalized non-empty shrunk DBM (M, P ) with P ≤ S ′ , for instance P x,y ≥ 1 for some x, y where S ′

x,y = 0. If S x,y = 0, then clearly, P x,y ≤ S x,y . Otherwise, S x,y = ∞ and S ′

x,y = 0 indicate that there exists z 1 , z 2 ∈ C 0 such that S z1,z2 = 0 and there is a path in Π z1,z2 (G(M )) that goes through edge (x, y). Let us denote this path with π. Then since P is normalized, P z1,z2 ≥ w(π), and since π contains the edge (x, y), we have P z1,z2 ≥ P x,y ≥ 1, therefore P ≤ S.

For any pair x, y ∈ C 0 with S ′ x,y = ∞ let P be the matrix with 0's on all components except for P x,y = 1. Let P ′ be the SM such that (M, P ′ ) = norm((M, P )). The normalization procedure can only increase the components so P ′

x,y ≥ 1. We have P ′ ≤ S ′ , since for any z 1 , z 2 such that S ′ z1,z2 = 0, (x, y) is not on a path of Π z1,z2 (G(M )). So, for any shrinking constraint S ′′ such that S ′′ x,y < S x,y for some x, y, there exists a SM P with P ≤ S ′ and P ≤ S ′′ . Therefore, S ′ is minimal.

Clearly, the normalization of a shrinking constraint depends on the DBM M , since Π x,y (G(M )) depends on G(M ); this is also the case for SMs (Lemma 3.4.3). In the sequel, unless otherwise stated, all shrinking constraints are assumed to be normalized.

The following property of normalized shrinking constraints is easy to prove, using the previous lemma. Given a shrinking constraint S and a SM P , it will allow us to consider that S is normalized, instead of requiring that P is. Lemma 7.2.3. Let M be a normalized DBM and S a normalized shrinking constraint. Let P be any SM such that (M, P ) is non-empty, and let (M ′ , P ′ ) = norm((M, P )). Then, P ≤ S if, and only if, P ′ ≤ S.

Proof. Since the normalization procedure for computing P ′ increases the components, the reverse implication holds. Conversely, assume that P ≤ S, and pick x, y ∈ C 0 such that S x,y = 0 (for the other entries, there is nothing to be checked on P ′ ). Then P x,y = 0. From Lemma 7.2.2, S z,z ′ = 0 for all edges of all paths in Π x,y (G(M )), so that also P z,z ′ = 0 for these edges. Applying the definition of P ′

x,y from Lemma 3.4.3, we get P ′ x,y = 0.

Propagating Shrinking Constraints.

Lemma 7.2.4 shows that shrinking constraints can be propagated along operations on DBMs. Each item is illustrated in Fig. 7.3; some comments are given after the proof. 3. Assume that M = Unreset R (N ). For any normalized well shrinking constraint S for M , there exists a normalized well shrinking constraint S ′ for N such that for any SM Q, the following holds: Q ≤ S ′ if, and only if the SM P s.t.

(M ′ , P ) = Unreset R ((N, Q)) satisfies P ≤ S.
All shrinking constraints S ′ can be computed in polynomial time.

Proof. ◮ Pretime. Observe that M is obtained from N by first setting the first row of N to (0, ≤) (write N ′ for this intermediary DBM) and then applying normalization. Since N is normalized, and we only consider valuations with non-negative values, we have N 0,y ≤ 0 for all y ∈ C. Consider (x, y) ∈ C × C 0 , and a path in Π x,y (N ). If that path does not visit the state 0, then it has the same weight in N ′ as in N . Otherwise, its weight in N ′ is larger than in N , thus it is larger than N ′ x,y . In both cases, N ′ x,y will not change during the normalization phase. So the normalization of N can only change the first row.

Let S ′ x,y = S x,y for (x, y) ∈ C × C 0 , S ′ 0,y = ∞ for y ∈ C, and S ′ 0,0 = 0. We show that S ′ satisfies the desired property. Consider a shrunk DBM (N ′ , Q) with Q ≤ S ′ and N = N ′ , and let P be the shrinking matrix such that (M ′ , P ) = Pre time ((N ′ , Q)). Let us write M ′′ = Pre time (N ′ ). The shrunk DBM (M ′ , P ) is obtained by normalizing the shrunk DBM (M ′′ , Q ′ ) where Q ′ is derived from Q by setting the first row to 0 (Lemma 3.4.5).

We show that P ≤ S. Observe that M = M ′ = M ′′ so the graphs these DBMs define are the same. First suppose that S x,y = 0 for some x, y ∈ C × C 0 . For such x, y, we have N x,y = M x,y , and since N ′ ⊆ M ′′ , we have Π x,y (G(M )) ⊆ Π x,y (G(N )). Now, we have P x,y > 0 if, and only if there is a path in the former set with positive weight in Q ′ (Lemma 3.4.3). But this would imply that the same path has positive weight in Q since Q ′ ≤ Q, and moreover this path belongs to Π x,y (G(N )). This would in turn imply that Q x,y > 0, but we have S x,y = S ′

x,y = 0, which contradicts Q ≤ S ′ . It follows that P x,y ≤ S x,y . Now suppose that S 0,y = 0 for some y ∈ C. Since S is assumed to be normalized, along all paths of Π 0,y (G(M )), all edges (z, z ′ ) satisfy S z,z ′ = 0 (Lemma 7.2.2). Since Q ′ 0,z = 0 for all z, and that

Q ′ z,z ′ = Q z,z ′ =
0 for all z, z ′ = 0, we get P 0,y = 0 (Lemma 3.4.3). Hence P ≤ S.

We now show that for any SMs P and Q s

.t. Q ≤ S ′ and (M ′ , P ) = Pre time ((N ′ , Q)), it holds P ≤ S. Consider any SM Q ≤ S ′ such that (w.l.o.g.) (N ′ , Q) is normalized. Then S ′
x,y = 0 and Q x,y ≥ 1 for some x, y. By construction of S ′ , we have x = 0, and S x,y = 0. Moreover, since x = 0, we have M x,y = N x,y , and N x,y < ∞ since Q x,y ≥ 1 and (N ′ , Q) is normalized. Let P denote the normalized SM such that (M ′ , P ) = Pre time ((N ′′ , Q)). P is obtained by letting the first row of Q to zero and applying normalization. We get P x,y ≥ Q x,y ≥ 1, therefore P ≤ S.

To show that S ′ is a well shrinking constraint, assume that for some Q ≤ S ′ , (N ′ , Q) is empty. By definition of S ′ , there exists P ≤ S such that (M ′ , P ) = Pre time ((N ′ , Q)), so (M ′ , P ) is also empty, which contradicts the fact that S is a well shrinking constraint for M . ◮ Intersection (a). For any SMs P, Q, we have

(M, P ) = (N, Q) ∩ O if, and only if (M ′ , P ) = (N, Q) ∩ M for some M ′ = M. So it suffices to consider the equation M = N ∩ M with M ⊆ N . Moreover, notice that ∅ = M = M ∩ N ′ for any N ⊆ N ′ .
We let S ′ x,y = S x,y for any x, y ∈ C 0 such that M x,y = N x,y and S ′ x,y = ∞ otherwise, and make S ′ normalized. Observe that the weight of any path is smaller or equal in G(M ) than in G(N ), since M ⊆ N and both DBMs are normalized. Consider any shrunk DBM (N ′ , Q) with N = N ′ , N ⊆ N ′ and Q ≤ S ′ and let P such that (M

′ , P ) = (N ′ , Q) ∩ M . Let us write M ′′ = N ′ ∩ M . Again, G(M ) = G(M ′ ) = G(M ′′ ).
Here, P is obtained from Q by first defining Q ′ as Q ′

x,y = 0 if M x,y < N x,y and Q ′

x,y = Q x,y otherwise. Then P is the normalization of Q ′ . We show, by induction on n ≥ 2, that for any pair x, y ∈ C 0 with S x,y = 0, any path of Π x,y (G(M )) visiting at most n states have weight 0 in Q ′ . This entails that P x,y = 0 whenever S x,y = 0.

• When n = 2, if M x,y = N x,y , then S ′
x,y = 0 by definition of S ′ , so Q x,y = 0, and Q ′ x,y = 0. If M x,y < N x,y , we have Q ′

x,y = 0 by the definition of Q ′ .

• Consider n ≥ 3. Let π = x 1 x 2 . . . x n be a path in Π x,y (G(M )). Since S x,y = S x1,xn = 0, we also have S x1,x2 = 0 and S x2,xn = 0 By induction, Q ′ x1,x2 = 0 and all paths of Π x2,xn (G(M )) of length at most n -1 have weight 0 in Q ′ . Hence, π has weight 0 in Q ′ . Assume now Q ≤ S ′ , i.e., Q x,y ≥ 1 and S ′

x,y = 0 for some x, y ∈ C 0 . Then we must have M x,y = N x,y and S x,y = 0. Let (M ′ , P ) = (N ′ , Q) ∩ M . We know that P is the normalization of Q ′ , and that Q ′

x,y = Q x,y ≥ 1. So P x,y ≥ Q ′ x,y ≥ 1. Hence P x,y ≤ S x,y . We have that S ′ is a well shrinking constraint for N , since otherwise this would imply that S is not a well shrinking constraint for M , as in the previous case. ◮ Intersection (b). Using the same argument as in the previous case, we can assume that O = M ⊆ N . Since M and N are normalized and non-empty, we have M x,y ≤ N x,y for all x, y ∈ C 0 . We define S ′ 1 by S ′ 1x,y = S x,y if M x,y = N x,y and S ′ 1x,y = 0 otherwise. Let S ′ be defined as S ′

x,y = max π∈Πx,y(G(M )) S ′ 1 (π).

Consider any shrunk DBM (M ′ , Q) with M ′ = M, (M ′ , Q) ⊆ M , and Q ≤ S ′ . Let us show that there is (N, P ) with P ≤ S with the desired property. Let us first define Q ′ as follows:

Q ′ x,y =    0 if M x,y < N x,y or S x,y = 0 max z,z ′ :(x,y)∈Π z,z ′ (G(M )) Q z,z ′ if M x,y = N x,y and S x,y = ∞.
Let us write (N ′ , P ) = norm((N, Q ′ )). If S x,y = 0 for some x, y ∈ C 0 , then along all edges (z, z ′ ) ∈ Π x,y (G(N )), we have S z,z ′ = 0, therefore Q ′ z,z ′ = 0. Thus, P x,y = 0 (from Lemma 3.4.3) and we get P ≤ S.

Let (M ′′ , Q ′′ ) denote the shrunk DBM defined by

(M ′′ , Q ′′ ) = (N ′ , P ) ∩ M with M ′′ = M (Lemma 3.4.5). Let us show that Q ≤ Q ′′ , which implies, together with M ′′ ⊆ M ⊆ M ′ that (M ′′ , Q ′′ ) ⊆ (M ′ , Q) as desired. Q ′′ is
the normalization of the SM P ′ defined as follows: P ′

x,y = P x,y if M x,y = N x,y and P ′

x,y = 0 otherwise. Let x, y ∈ C 0 . • Assume that M x,y = N x,y . If S ′

x,y = 0, then Q x,y = 0 so clearly Q ′′ x,y ≥ Q x,y . Otherwise, there exists a path π ∈ Π x,y (G(M )) such that for some edge

(z, z ′ ) ∈ π, M z,z ′ = N z,z ′ and S z,z ′ = ∞. By definition of Q ′ , we have Q ′ z,z ′ ≥ Q x,y . Moreover P ′ z,z ′ = P z,z ′ ≥ Q z,z ′ . The normalization of P ′ then yields Q ′′ x,y ≥ P ′ z,z ′ = P z,z ′ ≥ Q z,z ′ ≥ Q x,y . • Otherwise, M x,y < N x,y . If S ′
x,y = 0, the result is clear. If S ′ x,y = ∞, then there must be a path in Π x,y (G(M )) with an edge

(z, z ′ ) with M z,z ′ = N z,z ′ and S z,z ′ = ∞. Then, Q ′ z,z ′ ≥ Q x,y . So the normalization of P ′ yields Q ′′ x,y ≥ P ′ z,z ′ = P z,z ′ ≥ Q ′ z,z ′ ≥ Q x,y
. We now show the converse direction. Consider any x, y ∈ C 0 such that S ′

x,y = 0. Let us show that for any (N, P ) with P ≤ S, if (M ′ , Q ′′ ) denotes the shrunk DBM such that (M ′ , Q ′′ ) = M ∩ (N, P ), then Q ′′

x,y = 0. This proves that if Q x,y ≥ 1 for some SM Q, then there is no matching P ≤ S that satisfies the property.

We show, by induction on n ≥ 2, that if S ′ x,y = 0, then all paths of Π x,y (G(M )) of length at most n have weight zero in P ′ .

• Let n = 2. If M x,y = N x,y , then P ′

x,y = P x,y . But we have S x,y = 0, so P x,y = 0. If M x,y < N x,y , then P ′

x,y = 0 by definition.

• If n ≥ 3, consider any path π = x 1 x 2 . . . x n in Π x,y (G(M )). Suppose that M xj ,xj+1 = N xj ,xj+1
for all 1 ≤ j ≤ n -1. Then π is also a shortest path in G(N ), hence M x,y = N x,y , and S xj ,xj+1 = 0 for all 1 ≤ j ≤ n -1, as S is normalized. It follows that P xj ,xj+1 = 0, hence also We now show that S ′ is a well shrinking constraint for M , given the hypothesis that (N, P )∩M = ∅ for all SMs P ≤ S. But this immediately implies that S ′ is a well shrinking constraint, since for any Q ≤ S ′ there exists P ≤ S with ∅ (N, P ) ∩ M ⊆ (M, Q). ◮ Unreset. Let N R denote the DBM that defines the (largest) zone satisfying ∧ x∈R x = 0. Since we have M = Unreset R (N ∩ N R ), by the previous case, we may assume that N ⊆ N R . The DBM M is obtained from N by replacing each component (x, y) with x ∈ R by ∞. For any y ∈ C 0 , we define S ′′

P ′ xj ,xj+1 = 0. Suppose now that for some 1 ≤ j ≤ n -1, M xj ,xj+1 < N xj ,
x,y = S x,y if x ∈ C \ R, and S ′′ 0,y = 0, and S ′′ x,y = ∞ if x ∈ R. Then S ′ is obtained by normalizing S ′′ .

Let Q be any normalized SM with Q ≤ S ′ , and P be the (normalized) SM such that (M ′ , P ) = Unreset R ((N, Q)). Let Q ′ denote the SM obtained from Q by setting each component (x, y), with x ∈ R, to zero. Then, P is the normalization of Q ′ . Let us show that P ≤ S. Consider any x, y ∈ C 0 with S x,y = 0.

• If x ∈ C \ R then S ′
x,y = S x,y = 0 and Q x,y = 0. So, along all paths Π x,y (G(N )), S ′ is zero, and so are the weights in Q, and also the weights in Q ′ . Now, clearly, Π x,y (G(M )) ⊆ Π x,y (G(N )). So after normalization of Q ′ , we have P x,y = 0.

• If x = 0, then S ′

x,y = 0 and Q x,y = 0. The argument is then similar.

• If x ∈ R, then M x,y = ∞. Thus Π x,y (G(M )) = ∅, so the normalization of Q ′ yields P x,y = 0.
Consider a normalized SM Q with Q ≤ S ′ . We must have Q x,y ≥ 1 and S ′′

x,y = 0 for some x, y ∈ C 0 , by Lemma 7.2.2. The latter condition entails that x / ∈ R. Let Q ′ denote the DBM obtained from Q by replacing all components (x, y) where x ∈ R with 0. Then the normalization of Q ′ yields the SM P such that (M

′ , P ) = Unreset R ((N, Q)). Since x ∈ C 0 \ R, then S x,y = S ′
x,y = 0 and Q ′

x,y = Q x,y ≥ 1. The normalization of Q ′ can only increase its components, so P x,y ≥ 1, hence P ≤ S.

We show that S ′ is a well shrinking constraint for N as in the previous cases.

= Pre time         (a) (M ′ , P ) = Pre time ((N, Q)) = ∩ (b) (M ′ , P ) = (N, Q) ∩ N ′ ∩ ⊆ (c) (N, P ) ∩ N ′ ⊆ (M, Q) = Unreset R         (d) (M ′ , P ) = Unreset R ((N, Q))
Figure 7.3: Each of the figures illustrates one item in Lemma 7.2.4. In each case, DBMs M , N and N ′ are fixed and satisfy the "unshrunk" equation (that is, when P = Q = 0). The thick plain segments represent the fixed shrinking constraint S. The thick dashed segments represent the shrinking constraint S ′ that is constructed. In each case, if a SM Q is chosen, it holds that Q ≤ S ′ iff there is an SM P ≤ S that satisfies the equation. For instance, if Q x,0 ≥ 1 in (a), then the DBM describing the time predecessors of (N, Q) shrinks the diagonal component (x, y), which violates S.

We now extend the previous lemma to the operator shrink + . In this case, the existence of a shrinking constraint depends on the given constrained DBM. The lemma is illustrated in Fig. 7.4.

Lemma 7.2.5. Let M be a normalized non-empty DBM and S be a normalized shrinking constraint.

• If M x,0 < ∞ and S x,0 = 0 for some x ∈ C, then for all SMs Q, the shrunk DBM (M ′ , P ) = shrink + ((M, Q)) does not satisfy P ≤ S.

• Otherwise, for all SMs Q, the following holds: Q ≤ S if, and only if, the shrunk DBM (M ′ , P ) = shrink + ((M, Q)) satisfies P ≤ S.

Proof. If S x,0 = 0 and M x,0 < ∞ for some x ∈ C, since shrink + increases each (but one) component of the first column of the SM by one, and since the normalization can only increase components for which M x,0 < ∞, there is no P ≤ S such that (M ′ , P ) = shrink + ((M, Q)).

Assume that S x,0 = ∞ for all x ∈ C with M x,0 < ∞. Consider any Q ≤ S. The operator shrink + increments all components (x, 0) of the SM by one, and applies normalization. So if Q x,y > S x,y = 0 for some x, y ∈ C, we know that if P denotes the SM such that (M ′ , P ) = shrink + ((M, Q)), then P x,y ≥ Q x,y > 0, since shrink + only increases the components of the SM. Thus, for SMs Q ≤ S, there is no corresponding P ≤ S with the desired property. Consider now any Q ≤ S, and P such that (M ′ , P ) = shrink + ((M, Q)). Assume that P x,y ≥ 1 for some S x,y = 0. We have M x,y < ∞ since (M ′ , P ) is normalized. Since Q x,y = 0, there exists a path in Π x,y (G(M )) that contains an edge (z, 0) such that Q z,0 = 0, and P z,0 ≥ 1. But then S z,0 = 0, which contradicts our assumption. Assume there is an edge guarded by N (the whole gray area in the right) without resets. In the non-robust setting, this guard can be reached from any point of M (the whole gray area in the left). If we have a shrinking constraint S on M , and we want to synthesize a winning strategy from a shrinking of M satisfying S, then Lemma 7.2.4 gives the shrinking constraint S ′ for N , with the following property: given any shrinking (N, Q), we can find P ≤ S with (M, P ) = Pre time ((N, Q)) (hence, we can delay into (N, Q)), if, and only if Q satisfies Q ≤ S ′ . The problem is now "reduced" to finding a winning strategy from N, S ′ . However, forward-propagating these shrinking constraints is not always that easy. We also need to deal with resets, with the fact that Controller has to choose a delay greater than δ > 0, and also with the case where there are several edges leaving a location. This is the aim of the following developments.

= shrink +         (a) (M ′ , P ) = shrink + ((M, Q)) but P ≤ S = shrink +         (b) (M ′ , P ) = shrink + ((M, Q)) with P ≤ S.

Neighborhoods

We now consider constrained regions, which are constrained DBMs in which the DBM represents a region. Fig. 7.1 shows that if Controller plays to a region, then Perturbator can reach some of the surrounding regions, shown by the arrows. To characterize these, we define the set of neighboring regions of r, S as, N r,S = s s ⋖ * r or r ⋖ + s, and ∀Q ≤ S. s ∩ enlarge((r, Q)) = ∅ where enlarge((r, Q)) is the shrunk DBM (M, P ) such that v + [-δ, δ] ⊆ M -δP for every v ∈ r -δQ. This is the set of regions that have "distance" at most δ to any shrinking of the constrained region (r, S). We write neighbor r, S = s∈Nr,S s.

Lemma 7.3.1 (Neighborhood). Let r, S be a well constrained region. Then neighbor r, S is a zone. If N is the corresponding normalized DBM, there exists a well shrinking constraint S ′ such that for every SM Q, Q ≤ S ′ iff the SM P defined by (r ′ , P ) = r ∩ shrink [-δ,δ] ((N, Q)), satisfies P ≤ S. The pair N, S ′ is the constrained neighborhood of r, S , and it can be computed in polynomial time. Moreover, the constraint S ′ is such that S ′

x,y = S x,y for every x, y ∈ C, and S ′ x,0 = S ′ 0,x = ∞ for every x ∈ C.

Constrained neighborhoods are illustrated in Fig. 7.5.

neighbor         = neighbor         = Figure 7
.5: Constrained neighborhood of two constrained regions. Notice that inside any shrinking of the constrained region, there is always a valuation such that a perturbation of [-δ, δ] moves the valuation to any region of the neighborhood.

To prove Lemma 7.3.1 which states the properties of the neighborhoods of constrained regions, we first need to introduce some notations and simple facts about constrained regions.

Lemma 7.3.2. Let r, S be a constrained region and consider the partition X 1 , . . . , X n of clocks according to their fractional values. Then, for all x, y ∈ X i for any 1 ≤ i ≤ n, we have S x,y = 0, and for all x ∈ X 1 , we have S x,0 = S 0,x = 0. Moreover, • There exists 2 ≤ i 0 ≤ n + 1 such that for any x ∈ X i with i 0 ≤ i ≤ n, S x,0 = 0, for any y ∈ X i ′ with i ≤ i ′ ≤ n, S x,y = 0, and for any x ∈ X 1 ∪ . . . ∪ X i0-1 , S x,0 = ∞.

• There exists 1 ≤ j 0 ≤ n such that for any x ∈ X j with 1 ≤ j ≤ j 0 , S 0,x = 0, for any y ∈ X j ′ with 1 ≤ j ′ < j, S y,x = 0, and for any x ∈ X j with j 0 + 1 ≤ j ≤ n, S 0,x = ∞.

Proof. This follows from the normalization of S. In fact, suppose S x,0 = 0 for some x ∈ X i with i ≥ 2, and consider y ∈ X j for any i < j ≤ n. Then (x, y, 0) is a shortest path in G(r). Therefore, we must have S x,y = S y,0 = 0. One can then choose i 0 as minimal to satisfy this statement, and j 0 maximal.

Let us make some remarks about the graphs of regions and their shrinking constraints. Consider a region r. For any x ∈ X i , y ∈ X j and z ∈ X k with i < j < k, (x, y, z) and (z, x, y) are shortest paths in G(r). In fact, r x,z = r x,y + r y,z since r x,y = r x,0r y,0 , r y,z = r y,0r z,0 , and r x,z = r x,0r z,0 . Similarly, r z,x = r z,0r x,0 + 1 and r z,y = r z,0r y,0 + 1 yield r z,y = r z,x + r x,y . A shrinking constraint S with S x,y = 0 means that a shrinking of r satisfying S, contains valuations ν with frac(ν(y))frac(ν(x)) ≤ ǫ for any ǫ > 0. If S y,x = 0, this means that some valuations ν satisfy frac(ν(y))frac(ν(x)) ≥ 1ǫ.

Proof of Lemma 7.3.1. Let us prove that the neighborhood is a zone, and show how to compute it. We characterize the successor regions of r that belong to the neighborhood of r, S . The predecessor regions can be charaterized similarly. Consider the partition of clocks in r ordered according to their fractional parts:

0 = frac(X 1 ) < frac(X 2 ) < . . . < frac(X m ) < 1,
where X i 's are subsets of clocks having the same fractional part, and X 1 is possibly empty.

• First, assume that S x,0 = ∞ for x ∈ X m . Consider the case X 1 = ∅. Consider any SM Q ≤ S such that Q x,0 ≥ 2 for all clocks x ∈ X 2 ∪ . . . X m . Then for all ν ∈ (r -δQ), we have frac(ν(x)) ≤ 1 -2δ for all clocks x. We have, for any t ∈ [0, δ], frac(ν(x) + t) < 1. So no region s with r ⋖ s is included in the neighborhood. If S x,0 = ∞ for x ∈ X m but X 1 = ∅, then necessarily S x,0 = S 0,x = 0 for x ∈ X 1 since S is a well shrinking constraint. Then, the neighborhood contains the region s with r ⋖ s but no successor of s, which is shown as above.

• Assume that S x,0 = 0 for x ∈ X m . Let i ∈ {1, . . . , m} be minimum such that X i is non-empty and S x,0 = 0 for all x ∈ X j and i ≤ j ≤ m.1 Then, for any 1 ≤ j ≤ i -1 and x ∈ X j S x,0 = ∞ by Lemma 7.3.2. Let s be the unique region that satisfies r ⋖ + s, s x,0 = r x,0 + 1 and ≺ s x,0 =< for all x ∈ X i , and s x,0 = r x,0 for all x ∈ X i-1 . We show that the neighborhood of r, S contains all regions t such that r ⋖ * t ⋖ * s, but no region t such that s ⋖ + t. Let (r, Q, δ 0 ) be a well-shrinking and consider any δ ∈ [0, δ 0 ). For any x ∈ X j for max(2, i) ≤ j ≤ m, we have r x,0 -δQ x,0 = r x,0 , and -r 0,x + δQ 0,x < r x,0 (in fact ≺ r x,0 =< for these clocks). Let ǫ < min(δ/2, r x,0 -(-r 0,x + δQ 0,x )) for all x ∈ X j and max(2, i) ≤ j ≤ m, so that -r 0,x + δQ 0,x < r x,0ǫ < r x,0 . By Lemma 3.3.3, there exists a valuation ν ∈ (r -δQ) such that r x,0ǫ < ν(x) < r x,0 for x ∈ X max(2,i) . Define d j = 1frac(ν(x)) for x ∈ X j for all i ≤ j ≤ m. We know by the fractional ordering that 0

< d m < d m-1 < . . . < d i < δ/2. Define also d ′ j = dj +dj-1 2
for all i + 1 ≤ j ≤ m, and

d m+1 = dm 2 . If i = 1, then we have reg(ν) ⋖ reg(ν + d m+1 ) ⋖ reg(ν + d m ) ⋖ reg(ν + d ′ m ) ⋖ reg(ν + d m-1 ) ⋖ . . . ⋖ reg(ν + d i ),
and for ǫ ′ > 0 small enough, reg(ν

+ d i ) ⋖ reg(ν + d i + ǫ ′ ) = s. If i > 1, we remove reg(ν + d m+1 )
since this is equal to reg(ν). Let us show now that the time-successor of s is not included in the neighborhood. In fact, if i = 1, then, the immediate time successor of s is the unique region r ⋖ + t such that -t 0,x = t x,0 = r x,0 + 1 and ≺ t x,0 =≤ for x ∈ X 1 . But for all ν ∈ (r -δQ), we have ν(x) = r x,0 , so ν(x) + δ < t x,0 . If i = 2 and X 1 = ∅, then the immediate time successor t of s satisfies -t 0,x = t x,0 = r x,0 + 1 for x ∈ X m . But since for any ν ∈ r, ν(x) + δ < t x,0 , t is not in the neighborhood. If i ≥ 2 and X i-1 = ∅, then the proof is similar since the immediate time successor of s is the region where clocks in X i-1 become integer. The case of the time-predecessors of r is treated similarly.

From the proof above we can directly define the DBM N that represents the neighborhood of r, as follows. N has the same diagonal constraints as r, so N x,y = r x,y for all x, y ∈ C. For all x ∈ X 1 , we let N x,0 = r x,0 + 1 and ≺ N x,0 =<, and if r 0,x < 0, we let N 0,x = r 0,x + 1 and ≺ N 0,x =<, otherwise N 0,x = r 0,x = 0 and ≺ N 0,x =≤. If S x,0 = ∞ for all x ∈ X 2 ∪ . . . ∪ X m , then r x,0 = N x,0 for all x. Otherwise, let i ∈ {2, . . . , m} minimum such that S x,0 = 0 for all x ∈ X j for all i ≤ j ≤ m.

We let N x,0 = r x,0 + 1 and ≺ N x,0 =< for all x ∈ X i ∪ X i+1 ∪ . . . ∪ X m , and N x,0 = r x,0 , ≺ N x,0 =≺ r x,0 for all x ∈ X 2 ∪ . . . ∪ X i-1 . Symmetrically, if S 0,x = ∞ for all x ∈ X 2 ∪ . . . ∪ X m , we let N 0,x = r 0,x and ≺ r 0,x =≺ N 0,x . Otherwise, let i ′ ∈ {2 . . . , m} be maximum such that S 0,x = 0 for all x ∈ X j for all 2 ≤ j ≤ i ′ . For all x ∈ X j and 1 ≤ j ≤ i ′ , if r 0,x < 0, we let N 0,x = r 0,x + 1 and ≺ N 0,x =<, and otherwise N 0,x = 0 and ≺ N 0,x =≤. We let N 0,x = r 0,x , ≺ N 0,x =≺ r 0,x for all x ∈ X i ′ +1 ∪ . . . ∪ X m . Let S ′ be the shrinking constraint given by Lemma 7.2.4, for which for all SMs Q, Q ≤ S ′ if, and only if there exists P ≤ S with (r ′ , P ) = r ∩ (N, Q) with r ′ = r. From the proof of this lemma, S ′ is the normalization of the following shrinking constraint: we let S ′

x,y = S x,y for all x, y ∈ C, since r x,y = N x,y . For all x ∈ C, S ′

x,0 = S x,0 if r x,0 = N x,0 and S ′ x,0 = ∞ otherwise. But by construction of N , r x,0 = N x,0 only if S ′

x,0 = ∞ so we get S ′ x,0 = ∞ for all clocks. Similarly, we get S ′ 0,x = ∞ for all x ∈ C. We are going to show that S ′ is already normalized. Consider any x ∈ C. To get a contradiction, suppose that there exists z, z ′ ∈ C with S ′ z,z ′ = S z,z ′ = 0 and a path x 1 . . . x n in Π z,z ′ (G(N )) that contains the edge (x, 0) -which would imply that S ′

x,0 becomes 0. Since r z,z ′ = N z,z ′ , we have Π z,z ′ (G(N )) ⊆ Π z,z ′ (G(r)). Then, S x,0 = 0 since S is normalized. But this means N x,0 = r x,0 + 1 by definition of N , and this path cannot be a shortest path in

G(N ) (in fact, N z,z ′ = r z,z ′ = n-1 k=1 r xi,xi+1
). Consider now x, y ∈ C such that S x,y = ∞ and let us show that S ′

x,y = ∞ after normalization. Suppose there exists a path π ∈ Π z,z ′ (G(N )) where z, z ′ = 0, S z,z ′ = S ′ z,z ′ = 0 and the edge (x, y) belongs to π. If 0 does not appear in π, then this path also belongs to Π z,z ′ (G(r)), since r z,z ′ = N z,z ′ and all edges have the same weight in both graphs, so we would have S x,y = 0. So, assume that some edges (w, 0) and (0, w ′ ) belong to π. If S w,0 = S 0,w = ∞, then r w,0 = N w,0 and r 0,w = N 0,w by definition of N , so π is a shortest path in G(r), which contradicts S x,y = ∞. But, if S w,0 = 0 or S 0,w = 0 then N w,0 = r w,0 + 1 or N 0,w = r 0,w + 1, and in this case π is not a shortest path in G(N ) since N z,z ′ = r z,z ′ . Hence, there is no such path π, and we get S ′

x,y = ∞ after normalization. Now, let

Q ′ be such that (N ′ , Q ′ ) = shrink [-δ,δ] ((N, Q)). If Q ′′ denotes
the SM obtained from Q ′ by incrementing by one each component of the first row and the first column (but the (0, 0)), then (N ′ , Q ′ ) = norm((N, Q ′′ )). Moreover, because S ′

x,0 = S ′ 0,x = ∞ for all x ∈ C, we have Q ′ , Q ′′ ≤ S ′′ . Then, by definition of S ′ , there exists P ≤ S such that (r ′ , P ) = r ∩ (N, Q ′ ). Conversely, if Q ≤ S ′ , then Q ′ ≤ S ′ . So, if there exists P such that (r ′ , P ) = r ∩ (N, Q ′ ), then P ≤ S, by definition of S ′ .

The fact that S ′ is a well shrinking constraint for N follows from the fact that S is a well shrinking constraint for r. In fact, for any Q ≤ S ′ , there exists P ≤ S such that (r ′ , P ) = r∩shrink [-δ,δ] ((N, Q)) and (r ′ , P ) is non-empty by hypothesis, so (N, Q) cannot be empty.

Controllable Predecessors

The following lemma characterizes, given a constrained region r, S , the set of constrained regions s, S s such that any shrunk region satisying s, S s can be reached by delaying from some shrunk region satisfying r, S . These are the sets whose reachability can be ensured by Controller by a delay.

Lemma 7.4.1. Let r, S be a well constrained region, and s be a region such that r ⋖ * s. Then the following properties are equivalent:

1. there exists a well shrinking constraint S ′ (which can be computed in polynomial time) such that for every SM Q, Q ≤ S ′ iff the SM P such that (r ′ , P ) = r ∩ shrink + (Pre time ((s, Q))) for some r ′ = r satisfies P ≤ S;

2. neighbor r, S ⊆ Pre time (s);

3. define N = Pre time (s), and S N such that for all SM Q, Q ≤ S N iff the SM P defined by (r ′ , P ) = r ∩ (N, Q) with r ′ = r satisfies P ≤ S. Then (S N ) x,0 = ∞ for all x ∈ C.

Proof. ◮ 3 ⇒ 1. Let S ′ be such that for all SMs Q, Q ≤ S ′ if, and only if there is

Q ′ ≤ S N with (N ′ , Q ′ ) = Pre time ((s, Q))
and N ′ = N. We will show that S ′ satisfies the required condition. We first assume that Q ≤ S ′ . By Lemma 7.2.5, there exists

Q ′′ ≤ S N such that (N ′′ , Q ′′ ) = shrink + ((N ′ , Q ′ )) = shrink + (Pre time ((s, Q))) for N ′′ = N.
And by definition of S N , there exists P ≤ S such that (r

′ , P ) = r ∩ (N ′′ , Q ′′ ) for some r ′ = r. Conversely, if Q ≤ S ′ , then if Q ′ denotes the SM such that (N ′ , Q ′ ) = Pre time ((s, Q)), then Q ′ ≤ S N . By Lemma 7.2.5, if Q ′′ denotes the SM such that (N ′′ , Q ′′ ) = shrink + ((N ′ , Q ′ )), then Q ′′ ≤ S N .
Therefore, there is no SM P such that (r ′ , P ) = r ∩ shrink + (Pre time ((s, Q))). ◮ not 2 ⇒ not 1. Let V, S ′ = neighbor r, S . We assume that V ⊆ N . Then, if t denotes the region s ⋖ t, we have s, t ⊆ V . By definition of the neighborhood, for any SM P ≤ S r , when δ is small enough, there exists a valuation v ∈ r -δP such that v + d ′ ∈ t for some 0 ≤ d ′ ≤ δ. But since s ⋖ t, v + d ′ ∈ s for some d ′ ≥ 0 implies that 0 ≤ d ′ < δ (and there exists 0 ≤ d ′ < δ with v + d ′ ∈ r ′ ). Therefore, for any SM Q, if P denotes the SM such that (r ′ , P ) = r ∩ shrink + (Pre time ((s, Q))) with r ′ = r, then P ≤ S: indeed, if P ≤ S, then for small enough δ > 0, v + [0, δ] ⊆ Pre time (s -δQ) and in particular v+δ ∈ Pre time (s -δQ), which implies that there is d ′′ ≥ 0 such that v+δ+d ′′ ∈ s-δQ ⊆ s, contradicting the above remark. ◮ 2 ⇒ 3. Let (V, S ′ ) = neighbor r, S . We have r ⊆ V ⊆ N . Let (N ′ , Q) be a normalized shrunk DBM with N = N ′ , obtained by setting Q x,0 = 1 for all x ∈ C and 0 all other components. Let Q ′ be the SM such that

(V ′ , Q ′ ) = V ∩ (N ′ , Q), for some V ′ = V. • We show that Q ′ ≤ S ′ . Define (Q 1 ) x,y = Q x,y if V x,y = N x,y and (Q 1 ) x,y = 0 otherwise. Q ′ is the normalization of Q 1 . We have S ′ x,0 = S ′ 0,x = ∞ by Lemma 7.3.1, so Q ′ x,0 ≤ S ′
x,0 and Q ′ 0,x ≤ S ′ 0,x . For any x, y ∈ C, we assume S ′ x,y = 0. It implies (S) x,y = 0. To get a contradiction, assume that there is a path in Π x,y (G(V )) with an edge (z, z ′ ) such that V z,z ′ = N z,z ′ and Q z,z ′ ≥ 1. Since Q z,z ′ ≥ 1, there must be a path in Π z,z ′ (G(N )) that contains an edge (α, 0). But since Π z,z ′ (G(N )) ⊆ Π z,z ′ (G(V )), there is a path in Π x,y (G(V )) that contains the edge (α, 0). This contradicts S ′

x,y = 0 since we know, by Lemma 7.3.1 that S ′ α,0 = ∞.

• We now show that Q ≤ S N , which implies the desired result. By Lemma 7.3.1, there exists P ≤ S such that (r ′ , P ) = r ∩ shrink [-δ,δ] ((V ′ , Q ′ )), for some r ′ = r. But, if P ′ denotes the SM such that (r ′′ , P ′ ) = r ∩ (V ′ , Q ′ ), then P ′ ≤ P ≤ S because shrink can only increase the components of the SM. Therefore, (r ′′ , P ′ ) = r ∩ V ∩ (N, Q) = r ∩ (N, Q). Thus, by Lemma 7.2.4, we must have Q ≤ S N , which implies (S N ) x,0 = ∞ for all x ∈ C.

We now assume that the above conditions hold, and prove that S ′ (of item 1) has the same diagonal constraints as S. By Lemma 7.2.4, S N is computed as the normalization of S ′ , which is defined for every x, y ∈ C 0 as (S ′ ) x,y = (S) x,y if N x,y = r x,y and ∞ otherwise. Since N and r have the same diagonal constraints, (S) x,y = 0 for x, y ∈ C implies (S N ) x,y = 0. If (S) x,y = ∞, suppose that (S N ) x,y = 0. There exists z, z ′ such that (x, y) belongs to a path in Π z,z ′ (G(N )), and (S ′ ) z,z ′ = 0. But this implies that r z,z ′ = N z,z ′ and (S) z,z ′ = 0. We have then Π z,z ′ (G(N )) ⊆ Π z,z ′ (G(r)) since r ⊆ N , and this contradicts that (S) x,y = ∞. We now show that S ′ has the same diagonal components as S N . In fact, S ′ is the normalization of S ′ N defined by (S ′ N ) 0,x = ∞ for all x ∈ C and (S ′ N ) x,y = (S N ) x,y for other x, y ∈ C 0 . Clearly, (S N ) x,y = 0 for any x, y ∈ C implies (S ′ ) x,y = 0. Assume that (S ′ ) x,y = 0 with x, y ∈ C. Then (x, y) belongs to a path π ∈ Π z,z ′ (G(s)) with (S ′ N ) z,z ′ = 0, so necessarily z = 0 and s z,z ′ = N z,z ′ . If π does not contain the node 0, then π ∈ Π z,z ′ (G(N )) since all other weights are the same in G(s) and G(N ). If it contains node 0, then π still must be in Π z,z ′ (G(N )). In fact, (S ′ N ) z,z ′ = 0 means that N z,z ′ < ∞ and since all weights are the same in G(s) and G(N ) except for the edges (0, z) which can only decrease in s, π is a shortest path in both graphs. In both cases, we get (S N ) x,y = 0.

That S ′ is a well shrinking constraint for s follows from the hypothesis that S is a well shrinking constraint for r. In fact, if for some Q ≤ S ′ , (s, Q) is empty, then the corresponding (r, P ) (defined in item 1) is empty, which is a contradiction.

Note that this lemma may not hold for all s with r ⋖ s. Consider the constrained region r, S on the right of Fig. 7.5, and let s be the first triangle region above r: any valuation arbitrarily close to the thick segments will be in r -δP for any P ≤ S, but it can only reach s by delaying less than δ time units.

The following lemma describes sets of states from where Controller can ensure reaching a given set, through an action.

Lemma 7.4.2. Let r, S be a well constrained region, and let R ⊆ C. Let N = {s 1 , . . . , s m } be the set of neighboring regions of r, S , and define t i = s[R ← 0] for each 1 ≤ i ≤ m. Then, there exist well shrinking constraints S ti for all t i such that for any set of shrunk DBMs

(t ′ i , Q t ′ i ) 1≤i≤m with t i = t ′ i , we have that Q t ′ i ≤ S ti for all 1 ≤ i ≤ m if,
and only if there exists P ≤ S such that

(r ′ , P ) ⊆ r ∩ shrink [-δ,δ] ( 1≤i≤m (s ∩ Unreset R ((t ′ i , Q t ′ i )))).
for some r ′ = r. Moreover, all the t i , S ti can be computed in polynomial time.

Proof. It is useful to remember in this proof that t i = t ′ i implies t i ⊆ t ′ i since t i is a region. Let N, S ′ be the (well) constrained neighborhood of r, S , given by Lemma 7.3.1. For any region s ∈ N , let S s be the well shrinking constraint given by Lemma 7.2.4, such that for all shrunk DBMs (s ′ , Q) with s ′ = s and s ⊆ s ′ , Q ≤ S s if, and only if there exists P ≤ S ′ with s ∩ (N, P ) ⊆ (s ′ , Q). Here, S s is in fact a well shrinking constraint since s ∩ (N, P ) = ∅ for all P ≤ S ′ , by the construction of the neighborhood. Then, let us write t = s[R ← 0], and let S ′ s be the well shrinking constraint given by Lemma 7.2.4, such that for any shrunk DBM (t ′ , Q t ) with t = t ′ and t ⊆ t ′ , Q t ≤ S ′ s if, and only if there exists P s ≤ S s with (s ′ , P s ) = s ∩ Unreset R ((t ′ , Q t )) for some s ′ = s with s ⊆ s ′ . We let S t = min s∈N :t=s[R←0] S ′ s , where the minimum is taken componentwise. Then S t is still a well shrinking constraint. Now, S t satisfies the following property: for any shrunk DBM (t ′ , Q t ) with t ′ = t and t ⊆ t ′ , Q t ≤ S t if, and only if for all regions s ∈ N with t = s[R ← 0], there exists P s ≤ S s such that (s ′ , P s ) = s ∩ Unreset R ((t ′ , Q t )) for some s ′ with s ′ = s and s ⊆ s ′ . Combining this and S ′ defined above, we get that S t has the property that for any shrunk DBMs (t ′ , Q t ) with t ′ = t and t ⊆ t ′ , Q t ≤ S t if, and only if for all s ∈ N with t = s[R ← 0], there exists

P s ≤ S ′ such that s ∩ (N, P s ) ⊆ s ∩ Unreset R ((t ′ , Q t )).
For any family of shrunk DBMs

{(t ′ i , Q t ′ i )} 1≤i≤m with t i ⊆ t ′ i , t i = t ′ i and Q t ′ i ≤ S ti
, consider the set {P s } s∈N as defined above. Let P ′ = max s∈N (P s ), where the max is componentwise. We have P ′ ≤ S ′ since P s ≤ S ′ for all s ∈ N . We have s ∩ (N,

P ′ ) ⊆ s ∩ Unreset R ((t ′ i , Q t ′ i )) for all s ∈ N , since P s ≤ P ′ . So, (N, P ′ ) = s∈N s ∩ (N, P ′ ) ⊆ s∈N s ∩ Unreset R ((t ′ i , Q t ′ i )).
By Lemma 7.3.1, there exists P ≤ S such that

(r ′ , P ) = r ∩ shrink [-δ,δ] ((N, P ′ )) ⊆ s∈N s ∩ Unreset R ((t ′ i , Q t ′ i )).
This proves the first direction of the lemma. Consider any SMs {Q ti } 1≤i≤m such that (Q ti ) x,y ≥ 1 and (S t ) x,y = 0 for some i and x, y ∈ C 0 . Then there exists r 0 ∈ N with r 0

[R ← 0] = t, such that if Q r0 denotes the SM that satisfies (r ′ 0 , Q r0 ) = r 0 ∩ Unreset R ((t ′ i , Q ti )) with r ′ 0 = r 0 and r 0 ⊆ r ′ 0 , we have Q r0 ≤ S r0
. So, there is no SM P r0 such that r 0 ∩ (N, P r0 ) ⊆ (r ′ 0 , Q r0 ) and P r0 ≤ S ′ . It follows that there is no

P ′ ≤ S ′ satisfying (N, P ′ ) ⊆ s∈N (s ′ , Q s ) where (s ′ , Q s ) = s ∩ Unreset R ((t, Q t )).
In fact, if this would imply that (N, P ′ ) ∩ r 0 ⊆ (r ′ 0 , Q r0 ), since the regions in N are pairwise disjoint. Therefore, if (N, P ′ ) satisfies the above inclusion, then P ′ ≤ S ′ , so there is no P ≤ S such that (r ′ , P ) satisfies the statement of the lemma for some r ′ = r. This lemma gives for instance the shrinking constraints that should be satisfied in r 1 , r 2 and r 3 , in Fig. 7.1, once shrinking constraint in r ′ 0 is known. In this case, the constraint in r ′ 0 is 0 everywhere since it is a punctual region. The neighborhood N of r ′ 0 is composed of r ′ 0 and two extra regions (defined by (0 < x < 1) ∧ (x = y) and (1 < x < 2) ∧ (x = y)). If there are shrinkings of regions r 1 , r 2 , r 3 satisfying the corresponding shrinking constraints (given in the lemma), and from which Controller wins, then one can derive a shrinking of r ′ 0 , satisfying its constraint, and from which Controller wins.

Note that, in the proof of Lemma 7.4.2, the shrinking matrix P is chosen so as to guarantee the stated inclusion, but it is not always minimal. In some cases, one can still satisfy the inclusion while chosing some components smaller. Consequently, for a different choice of P , one could also obtain a smaller δ 0 . In general, there may be no minimum P : Consider a region r defined by 1 < x < 2, 1 < y < 2, and x < y. Given two shrinkings Q 0,x = 1, Q y,0 = 2, and Q ′ 0,x = 2, Q ′ y,0 = 1, the union (r -δQ) ∪ (r -δQ ′ ) is not convex. Then both Q and Q ′ are minimal choices for P such that (r, P ) ⊆ (r, Q) ∪ (r, Q ′ ).

In the next section, we define the game RG(A) following this idea, and explain how it captures the game semantics for robustness.

A Finite Game Abstraction

Let A = (L, ℓ 0 , C, Σ, E) be a timed automaton. We define a finite turn-based game RG(A) on a graph whose nodes are of two sorts: square nodes labelled by (ℓ, r, S r ), where ℓ is a location, r a region, S r is a well shrinking constraint for r; diamond nodes labelled similarly by (ℓ, r, S r , e) where moreover e is an edge leaving ℓ. Square nodes belong to Controller, while diamond nodes belong to Perturbator. Transitions are defined as follows:

(a) From each square node (ℓ, r, S r ), for any edge e = (ℓ, g, σ, R, ℓ ′ ) of A, there is a transition to the diamond node (ℓ, s, S s , e) if the following conditions hold:

(i) r ⋖ * s and s ⊆ g;

(ii) S s is such that for all SMs Q, Q ≤ S s iff there exists P ≤ S r with

(r ′ , P ) = r ∩ shrink + (Pre time ((s, Q))),
for some r ′ = r.

(b) From each diamond node (ℓ, r, S r , e), where e = (ℓ, g, σ, R, ℓ ′ ) is an edge of A, writing N for the set of regions in the neighborhood of (r, S r ) and

N ′ = {s[R ← 0] | s ∈ N },
(r ′ , P ) ⊆ r ∩ shrink [-δ,δ] ( s∈N (s ∩ Unreset R ((t ′ , Q t ))), where t = s[R ← 0],
for some r ′ = r.

Intuitively, the transitions from the square nodes are the decisions of Controller. In fact, it has to select a delay and a transition whose guard is satisfied. Then Perturbator can choose any region in the neighborhood of the current region, and, after reset, this determines the next state. Note that RG(A) can be computed, thanks to Lemmas 7.4.1 and 7.4.2, and has exponential-size. Observe also that RG(A) is constructed in a forward manner: we start by the initial constrained region (i.e. the region of valuation 0 with the zero matrix as shrinking constraint), and compute its successors in RG(A). Then, if Controller has a winning strategy in RG(A), we construct a winning strategy for G exs δ (A) by a backward traversal of RG(A), using Lemmas 7.4.1 and 7.4.2. Thus, we construct RG(A) by propagating shrinking constraints forward, but later do a backward traversal in it. The correctness of the construction is stated as follows.

Proposition 7.5.1. For any timed automaton A, Controller has a winning strategy in RG(A) if, and only if there exists δ 0 > 0 such that Controller wins G exs δ (A) for all δ ∈ [0, δ 0 ). Note that as we compute a winning strategy for Controller (if any) by Proposition 7.5.1, we can also compute a corresponding δ 0 . The upper bound of Theorem 7.1.2 is a consequence of the above proposition, since RG(A) has exponential size and finite reachability games can be solved in time polynomial in the size of the game.

Changing the perturbation parameters. Consider the semantics where Controller's delays are bounded below by kδ, and the perturbations belong to [lδ, mδ] with lδ + kδ ≥ 0, for some rational number δ > 0 and integers k, l, m (Observe that any choice of these rational parameters can be written in this manner). The abstract game construction can then be adapted to this case. In fact, it suffices to replace the operator shrink + by shrink [0,kδ] , and the operator shrink by shrink [lδ,mδ] in the construction.

Proof of Proposition 7.5.1

Controller wins RG(A) ⇒ Controller wins G exs

δ (A) for small enough δ > 0. Assume we are given a reachability objective defined by ℓ ⌣ ∈ L, and let f be a memoryless winning strategy for Controller in RG(A) for reaching ℓ ⌣. Consider the execution tree T f of RG(A), where Controller plays with f . T f is finite by Koenig's Lemma since all branches are winning, thus finite, and all branches end in the target state.

To any square node n of T f labelled by (ℓ, r, S r ), we will assign a shrunk DBM r ′ , P n and δ n > 0 with P n ≤ S r and r = r ′ , such that Controller wins the game G exs δ (A) from any state of {ℓ} × (r ′ -δP n ) for all δ ∈ [0, δ n ). Remember that r ′ = r implies r ⊆ r ′ since r is a region. We will define these by a bottom up traversal of T f . We start by assigning P n = 0 and δ n = ∞ to all nodes with loc(n) = ℓ ⌣ (which are leaves of T f ). These are trivially winning for Controller.

Consider now a square node n of T f labelled by (ℓ, r, S r ) whose all square successors have been treated. Then, n has only one successor which is given by f , we assume it is the diamond node n ′ labelled by (ℓ, s, S s , e). We write e = (ℓ, g, σ, R, ℓ ′ ). Let N be the set of neighboring regions of s, S s given by Lemma 7.

s ′ -δQ ⊆ s ∩ shrink [-δ,δ] ( 1≤i≤m s i ∩ Unreset R (t ′ i -δP n ′ i )),
for all 0 ≤ δ ≤ δ n ′ , where δ n ′ ≤ min i (δ ti ) is computed by Lemma 3.4.7. Then, by construction of the game, there exists P n ≤ S r and 0

< δ n ≤ δ n ′ such that r ′ -δP n = r ∩ shrink + (Pre time (s ′ -δQ))
for all 0 ≤ δ ≤ δ n , for some r ′ = r (Remember that Lemma 7.4.1 applies here on s ′ since s = s ′ and s ⊆ s ′ ). Here, δ n can be computed using Lemma 3.4.5. Controller wins from these states: in fact, it can delay into s ′ -δQ, where, after Perturbator's any move, and the clock resets, the next state belongs to one of the states t ′ i -δP n ′ i , which are all winning by induction. Notice that at each step of the computation, we get non-empty shrunk DBMs satisfying the corresponding shrinking constraints. By construction of RG(A), we have only well shrinking constraints in all nodes, so the computed shrunk DBMs (r ′ , P n ) are always non-empty. The procedure ends in the initial state (ℓ 0 , 0, 0), so Controller wins G exs δ (A) by projecting the play to RG(A) and always staying inside set r ′ -δP n at any node n, which is possible by construction.

Upper bound on δ 0 .

We now assume that Controller has a winning strategy and give an upper bound on δ 0 computed by the algorithm. Consider the set M of all shrunk DBMs that appear when we construct the winning strategy in the proof above, including the shrunk DBMs corresponding to intermediary results. For instance, in the computation above, given the edge (ℓ i , r i , S ri ) → (ℓ i , r ′ i , S r ′ i , e) and P r ′ i , we compute P ri such that (r i , P ri ) = r ∩ shrink + (Pre time (r ′ i , P r ′ i ) ). Then, M contains the shrunk DBMs (r i , P ri ) and (r ′ i , P r ′ i ), but also

(M 1 , Q 1 ) such that (M 1 , Q 1 ) = Pre time ((r i , P ri )), and (M 2 , Q 2 ) such that (M 2 , Q 2 ) = shrink + ((M 1 , Q 1 )
). Now, δ 0 is chosen by the algorithm small enough so that all shrunk DBMs of M are non-empty and normalized, and all such equations that appear in the construction of a winning strategy above hold, for all δ ∈ [0, δ 0 ). Using Proposition 3.4.6, one can compute the greatest δ 0 > 0 for which the symbolic strategies encoded by (r i , P ri ) hold. An upper bound can be also chosen by Remark 3.4.8. In this case, the upper bound could be doubly exponential since the size of the equation is exponential.

Controller loses RG(A) ⇒ Controller loses G exs

δ (A) for any δ > 0. To prove the theorem, we will assume the Controller loses in RG(A), and we will construct a winning strategy for the δ-Perturbator in G δ (A) by looking at the projection of the plays in RG(A), and by imitating the moves of a winning strategy for the Perturbator in RG(A). The core idea is to show that the Perturbator can always force the game to be close, by some chosen ǫ, to all boundaries of the current region for which the shrinking constraint is 0. This will ensure that from any state of the play, for any move of Controller, Perturbator can force the game to some state inside any successor in RG(A).

Let us first formalize what we mean by being close to boundaries.

Definition 7.5.2. Let M, S any constrained DBM. For any ǫ ≥ 0, we say that a valuation ν is ǫ-tight in M w.r.t. S if ν ∈ M , and,

∀x, y ∈ C 0 , S x,y = 0 ⇒ M x,y -ǫ ≤ ν(x) -ν(y). (7.1)
We say that M admits tight valuations w.r.t. S if it admits ǫ-tight valuations for any ǫ > 0.

We say that M, S admits tight valuations if for any P ≤ S, and for all small enough δ > 0, M -δP admits tight valuations w.r.t. S.

In the proofs, we will also say that

ν is ǫ-tight in M for a component (x, y) ∈ C 2 0 when M x,y -ǫ ≤ ν(x) -ν(y).
We show that for any move of Controller in G exs δ (A) from an ǫ-tight valuation, the corresponding edge exists in RG(A):

Lemma 7.5.3. Fix δ > 0 and 0 ≤ ǫ ≤ δ/2. Assume ν is ǫ-tight in r w.r.t. S, and let ν ′ = (ν + d) for some d ≥ δ, and some edge e = (ℓ, g, σ, R, ℓ ′ ) with ν ′ |= g. Then, RG(A) has an edge from (ℓ, r, S r ) to (ℓ, r ′ , S r ′ , e) for r ′ = reg(ν ′ ) and for some S r ′ .

Proof. Let N = Pre time (r ′ ), and consider, by Lemma 7.2.4, the shrinking constraint S N such that for any SM Q, Q ≤ S N if, and only if the SM P such that (r, P ) = r ∩ (N, Q) satisfies P ≤ S r . Thanks to Lemma 7.4.1, it is sufficient to show that (S N ) x,0 = ∞ for all x ∈ C. To get a contradiction, assume that (S N ) x,0 = 0 for some x ∈ C. By (the proof of) Lemma 7.2.4, S N is the normalization of S ′ r defined by (S ′ r ) x,y = (S r ) x,y if r x,y = N x,y and (S ′ r ) x,y = ∞ otherwise. So, (S N ) x,0 = 0 means that there exists (z, z ′ ) such that (x, 0) is on some path π of Π z,z ′ (G(N )), r z,z ′ = N z,z ′ and (S r ) z,z ′ = 0. But since r ⊆ N and r z,z ′ = N z,z ′ we have Π z,z ′ (G(N )) ⊆ Π z,z ′ (G(r)). Moreover, all weights along π are the same in r and N . We get (S r ) x,0 = 0. On the other hand, since r ′ ⊆ N and r ⋖ * r ′ , we have r x,0 ≤ r ′

x,0 ≤ N x,0 . So r x,0 = r ′ x,0 . By hypothesis, we have r x,0ǫ ≤ ν(x) ≤ r x,0 . But ǫ ≤ δ/2 and d ≥ δ, so ν(x) + d > r x,0 = r ′ x,0 , a contradiction.

The following lemma shows that ǫ-tightness is preserved by resets.

Lemma 7.5.4. Let r, r ′ be regions such that r ′ = r[R ← 0] for some R ⊆ C. Consider shrinking constraints S r and S r ′ given by Lemma 7.2.4, such that for any SM Q, Q ≤ S r ′ iff there the SM P such that (r, P ) = r ∩ Unreset R ((r ′ , Q)) satisfies P ≤ S r . Let δ > 0 small enough so that these equations hold for given P and Q. For any ǫ > 0, and any ν that is ǫ-tight in r -δP w.r.t. S r , we have that

ν ′ = ν[R ← 0] is ǫ-tight in r ′ -δQ w.r.t. S r ′ .
Proof. Let N = Unreset R (r ′ ) and S N be the shrinking constraints such that for any SM Q, Q ≤ S N if and only if the SM P such that r -δP = r ∩ (N -δQ) satisfies P ≤ S r . Then S r ′ is such that for any SM Q, Q ≤ S r ′ if and only if there the SM P such that N -δP = Unreset R (r ′ -δQ) satisfies P ≤ S N . By definition of the reset operation, we have r ′ x,y = r x,y for all x, y ∈ R, and r ′ x,y = 0 for all x, y ∈ R (we assume 0 ∈ R). For any x ∈ R and y ∈ R, r ′

x,y = r 0,y and r ′ y,x = r y,0 . It suffices to assume that ν is ǫ-tight in r, S r and show that ν ′ = ν[R ← 0] is ǫ-tight in r ′ , S r ′ . For all x, y ∈ R or x, y ∈ R, it is clear that ν ′ satisfies the ǫ-tightness for these components. Consider x ∈ R and y ∈ R such that (S r ′ ) x,y = 0. Then (S r ′ ) 0,y = 0, and it suffices to show that -ν ′ (y) ≥ r ′ 0,yǫ since ν ′ (x) = 0 and r 0,y = r ′ 0,y . We are going to show that (S r ) 0,y = 0. If S ′ N denotes the shrinking constraint defined by (S ′ N ) x,0 = (S ′ N ) 0,x = 0 for all x ∈ R, (S ′ N ) x,y = ∞ whenever x ∈ R and y ∈ C or inversely, and (S ′ N ) x,y = (S N ) x,y for x, y ∈ C 0 \ R. Then S r ′ is the normalization of S ′ N . Then, (S r ′ ) 0,y = 0, for y ∈ R, means that there is z, z ′ ∈ C 0 such that for some path π ∈ Π z,z ′ (G(r ′ )), (0, y) belongs to π and (S ′ N ) z,z ′ = 0. Then either z, z ′ ∈ R and (S N ) z,z ′ = 0, or z = 0 and z ′ ∈ R.

• Consider the first case. We have r ′ z,z ′ = N z,z ′ (by definition of unreset). We show that there is a path π ′ ∈ Π z,z ′ (G(N )) that contains (0, y) and whose all nodes are outside R. In fact, r ′ z,0 = N z,0 and r ′ y,z ′ = N y,z ′ since z, z ′ , y ∈ R, and these have finite weights (since π is a shortest path). But N is obtained from r ′ by setting to ∞ edges with an endpoint in R, and applying normalization. So there must be shortest paths from z to 0, and from y to z ′ in G(N ). Now, since (S N ) z,z ′ = 0, (z, z ′ ) belongs to some path π ′′ ∈ Π α,β (G(N )) where

r αβ = N α,β and (S r ) α,β = 0. Moreover, from r ⊆ N , r α,β = N α,β and r z,z ′ = N z,z ′ , it follows that π ′ , π ′′ ∈ Π z,z ′ (G(N )) ⊆ Π z,z ′ (G(r)).
Then, replacing the edge (z, z ′ ) in π ′′ by the path π ′ , we still get a shortest path in G(r), that contains (0, y). Therefore, we must have (S r ) 0,y = 0.

• Assume now that z = 0 and z ′ ∈ R. Assume that π does not contain nodes in R other than z ′ (if it does, we can shorten π and change z ′ ). Let us write π = z 1 z 2 . . . z m where z 1 = z and z m = z ′ . Since r ′ 0,zm = r ′ zm,0 = 0, π ′ = z 1 . . . z m-1 is a cycle with weight 0. But since all nodes in π ′ are outside R, this is also a path in G(r). Therefore (S r ) zi,zi+1 = 0 along all edges, and in particular (S r ) 0,y = 0.

By hypothesis, we have -ν(y) ≥ r 0,yǫ, and since r ′ 0,y = r 0,y , we get -ν ′ (y) ≥ r ′ 0,yǫ. The proof of the symmetric case x ∈ R and y ∈ R is similar.

The next lemma is the main lemma of the proof of the second direction of the theorem. It shows that, starting from an ǫ-tight valuation of r, S , and given a Controller's move, Perturbator can, not only choose any successor available in RG(A) but also make sure that the resulting valuation is (ǫ + ǫ ′ )-tight, for arbitrary ǫ ′ > 0.

Lemma 7.5.5. Consider a valuation ν that is ǫ-tight in r w.r.t. S. Let ν ′ = (ν + d) for some d ≥ δ, let e = (ℓ, g, R, ℓ ′ ) an edge of A with ν ′ |= g. Consider the edge of RG(A) from (ℓ, r, S r ) to (ℓ, r ′ , S r ′ , e) for r ′ = reg(ν ′ ) and for some S r ′ , from Lemma 7.5.3. Then, for any region s in the N, S N = neighbor r ′ , S r ′ , and any ǫ ′ > 0, there exists

d ′ ∈ [d -δ, d + δ] such that ν + d ′ is (ǫ + ǫ ′ )-tight in s w.r.t. S s
where S s is such that for all SMs Q, Q ≤ S s if, and only if there is

P ≤ S N with (N, P ) ∩ s ⊆ (s, Q).
Before proving Lemma 7.5.5, let us first prove the second direction of Proposition 7.5.1.

Proof of Proposition 7.5.1 (Second direction). We fix δ > 0, and consider an arbitrary strategy f for Controller in G exs δ (A). We are going to define an infinite play π, where Controller follows strategy f , and the target location is not reached. This proves that Perturbator wins G exs δ (A) against any strategy of Controller since f is chosen arbitrarily.

By hypothesis, Perturbator has a winning strategy γ in RG(A). We fix ǫ ∈ [0, δ/2], and we define the sequence ǫ i = 1≤j≤i ǫ 2 j for i ≥ 1, which is positive and bounded above by ǫ. We construct in parallel a play (ℓ i , r i , S ri ), (ℓ i , r ′ i , S r ′ i , e i ) i≥1 of RG(A) where Perturbator plays with strategy γ. The play π = (ℓ i , ν i ) i≥1 will satisfy the following invariant: For each state (ℓ i , ν i ), we have ν i ∈ r i and ν i is ǫ i -tight in r i w.r.t. S ri .

Initially, we have (ℓ 1 , ν 1 ) with ν 1 = 0, and the initial state (ℓ 1 , 0, 0) of RG(A) satisfies the invariant. For i ≥ 2, let us assume that state (ℓ i , ν i ) of the play satisfies the invariant for the state (ℓ i , r i , S ri ) of RG(A). Let d ≥ δ be the delay and e i = (ℓ i , g i , σ i , R i , ℓ i+1 ) the edge prescribed by f from state (ℓ i , ν i ) given the current history. Let ν ′ i = ν i + d and r ′ i be the region of ν ′ i . Lemma 7.5.3 shows that RG(A) has the corresponding edge. Let (ℓ i+1 , r i+1 , S ri+1 ) be the successor of (ℓ i , r ′ i , S r ′ i , e i ) in RG(A), given by γ. Let s be a region in N = neighbor r ′ i , S ′ such that s[R ← 0] = r i+1 . From Lemmas 7.5.5 and 7.5.4, it follows that first s, then r i+1 are reachable from ν ′ i by Perturbator's move, and that the resulting valuation is ǫ i+1 -tight in r i+1 w.r.t. S ri+1 by choosing ǫ ′ = ǫ/2 i+1 Proof of Prop. 7.5.5. Consider such valuations ν ∈ r and ν ′ ∈ r ′ . For any x, y ∈ C, (S r ′ ) x,y = 0 implies that r ′

x,yǫ ≤ ν ′ (x)ν ′ (y) ≤ r ′ x,y , since S r and S r ′ have the same diagonal components and time delays do not change the quantities ν(x)ν(y). Hence, ν ′ is ǫ-tight in r ′ w.r.t. S r ′ for all diagonal components. Assume that r ′ ⋖ * s. The other case is similar. Let S s be the shrinking constraint such that for all SMs Q, Q ≤ S s if and only if there is P ≤ S N with (N, P ) ∩ s ⊆ (s, Q). Let us write the clocks ordered according to their fractional values in r ′ :

0 = frac(X 1 ) < frac(X 2 ) < . . . < frac(X m ) < 1,
where each X i is a set of clocks having the same fractional value, and X 1 can be empty.

1. Assume that (S r ′ ) x,0 = ∞ for all x ∈ X 2 ∪ . . . ∪ X m . Then, by definition of the neighborhood, either r ′ = s or r ′ ⋖ s, where the latter case is possible if X 1 = ∅.

• If r ′ = s, then Perturbator perturbs by 0. Since (S s ) x,0 = ∞ and (S s ) x,y = (S r ′ ) x,y for all x, y ∈ C, by Lemma 7.5.6, the valuation ν ′ is ǫ-tight (s, S s ) for these components. If (S s ) 0,x = 0 for some x ∈ C, then N 0,x < r ′ 0,x by Lemma 7.5.6 since s 0,x = r 0,x , so we must have (S r ′ ) 0,x = 0, and ν ′ is also ǫ-tight for components (0, x). Note that the ǫ-tightness of diagonal components follow from the ǫ-tightness of ν in r ′ w.r.t. S r ′ .

• If r ′ ⋖s, we let Perturbator perturb by a positive amount 0 < d ′ < ǫ ′ , so that the valuation is in s. Since (S s ) x,0 = ∞ and (S s ) x,y = (S r ′ ) x,y for all x, y ∈ C, by Lemma 7.5.6, for these components, ν ′ + d ′ is ǫ-tight in (s, S s ). If (S s ) 0,x = 0 for some x ∈ C, then N 0,x < r ′ 0,x by Lemma 7.5.6, so we must have (S r ′ ) 0,x = 0. We have, by hypothesis,

-ν ′ (x) ≥ r ′ 0,x = s 0,x -ǫ, so -(ν ′ (x) + d ′ ) ≥ s 0,x -ǫ -ǫ ′ . ν ′ + d ′ is also ǫ-tight for diagonal components since ν ′ is. 2. Otherwise, consider the minimum k ∈ {2, . . . , m} such that (S r ′ ) x,0 = 0 for all x ∈ X k ∪. . .∪X m .
Since s is a successor region of r ′ , there exists k ′ ∈ {k, . . . , m} such that either clocks in X k ′ are integers, or all clocks X k ′ +1 ∪ . . . ∪ X m have changed their integer parts and only these. We treat each case separately:

(a) Assume s x,0 = r ′ x,0 , ≺ s x,0 =≤ for x ∈ X k ′ ; s x,0 = r ′ x,0 + 1 and ≺ s x,0 =< for all x ∈ X k ′ +1 ∪ . . . ∪ X m ; s x,0 = r ′ x,0 for all x ∈ X 1 ∪ . . . ∪ X k ′ -1 . We define Perturbator's move as d ′ = 1 -frac(ν ′ i (x)) for x ∈ X k ′ . It is clear that ν ′ + d ′ ∈ s, and that d ′ ≤ ǫ since ν ′ is ǫ-tight.
Let us show that the ν ′ + d ′ is ǫ-tight in s w.r.t. S s . By Lemma 7.5.6, all diagonal constraints in S s are the same as in S r ′ so the property is satisfied for these components. -Let us show ǫ-tightness for components (x, 0) (upper bounds). For all x ∈ X k ′ +1 ∪ . . . X m , we have (S s ) x,0 = ∞ by Lemma 7.5.6, since s x,0 = r ′

x,0 + 1 = N x,0 . We have

(ν ′ + d ′ )(x) = s x,0 = -s 0,x for x ∈ X k ′ , so ν ′ + d ′ is ǫ-tight for component (x, 0). For all x ∈ X k ∪ . . . ∪ X k ′ -1 , we have s x,0 = r ′
x,0 , and

ν ′ (x) ≥ r ′ x,0 -ǫ, which implies ν ′ (x) + d ′ ≥ s x,0 -ǫ as required. For all x ∈ X 1 ∪ . . . ∪ X k-1 , we have (S s ) x,0 = ∞.
In fact, (S s ) x,0 = 0 means, by Lemma 7.5.6 that s x,0 < N x,0 . But since r ′ ⋖ * s, we would have r ′ ≤ s x,0 < N x,0 , and this implies that (S r ′ ) x,0 = 0 by definition of N and Lemma 7.5.6. But by the choice of k, and by Proposition 7.3.2, this is a contradiction.

-We now show ǫ-tightness for components (0, x) (lower bounds). For all

x ∈ X k ′ +1 ∪ . . . ∪ X m , we have, -(ν ′ (x) + d) ≥ s 0,x -ǫ since d ′ ≤ ǫ. The property is again clearly satisfied by ν ′ (x) + d ′ for x ∈ X k ′ since ν ′ (x) + d ′ = s x,0 . Consider now x ∈ X 1 ∪ . . . ∪ X k ′ -1 such that (S s ) 0,x = 0.
We have (S s ) 0,y = 0 for y ∈ X k ′ , and (S s ) 0,x = 0, which implies that (S s ) y,x = 0 since paths 0, y, x and 0, x belong to G(s), and S s is normalized. Then, we also have

(S r ′ ) y,x = 0, so ν ′ (y) -ν ′ (x) ≥ s y,x -ǫ. means that frac(ν ′ (x)) + d ′ ≤ ǫ. The following figure illustrates this, assuming x ∈ X i . 0 < X 1 < . . . < X i frac(ν ′ (x)) < X i+1 < . . . < X k ′ ≥1-ǫ < . . . < 1 =d ′ Therefore ν ′ + d ′ satisfies ν ′ (x) + d ′ ≤ -s 0,x + ǫ, for all x ∈ C such that (S s ) 0,x = 0. (b) s x,0 = r ′
x,0 + 1 and ≺ s x,0 =< for all x ∈ X k ′ ∪ . . . ∪ X m ; s x,0 = r ′ x,0 and ≺ s x,0 =< for all x ∈ X 1 ∪ . . . ∪ X k ′ -1 . In this case, we first delay to the immediate time predecessor of s as in the previous case, then add a positive delay d ′ of at most ǫ ′ . Then, ν ′ + d ′ is (ǫ + ǫ ′ )-tight in s w.r.t. S s .

The following technical lemma is used in the proof of Lemma 7.5.5 above. Lemma 7.5.6. Let N, S N denote the constrained neighborhood of some constrained region. Let r be any region included in N . Let S r denote the shrinking constraint such that for all SMs Q, Q ≤ S r if, and only if there is P ≤ S N with (N, P ) ∩ r ⊆ (r, Q) for all small δ > 0. Then, for all x, y ∈ C, (S r ) x,y = 0 implies that (S N ) x,y = 0; for all x ∈ C, (S r ) x,0 = 0 implies r x,0 < N x,0 and (S r ) 0,x = 0 implies r 0,x < N 0,x .

Proof. By Lemma 7.2.4, S r is defined as follows. Let S 1 obtained by (S 1 ) x,y = S x,y if r x,y = N x,y and 0 otherwise. Then, S r is the normalization (in the sense of SMs) of S 1 , so S 1 ≤ S r . But all diagonal constraints are the same in r and N , and r x,0 = N x,0 implies (S 1 ) 0,x = S x,0 = ∞, and similarly r 0,x = N 0,x implies (S 1 ) 0,x = S 0,x = ∞. The result follows.

We also note the following corollary of Lemma 7.5.5 and Lemma 7.5.4, which will be used in Section 7.6.

Corollary 7.5.7. Let (ℓ, r, S r ) be a square node of RG(A). Then r, S r admits tight valuations.

Proof. We prove this for each node n = (ℓ, r, S r ) by induction on the shortest path from the initial node of RG(A) to n. It is true for the initial node (ℓ 0 , 0, 0). Assume it is the case for n = (ℓ, r, S r ), and pick any square node n ′′ = (ℓ ′ , t, S t ) reached via a diamond node n ′ = (ℓ, s, S s , e). For all successor (ℓ ′ , t ′ , S t ′ ) of n ′ , pick any SM Q t ′ ≤ S t ′ , and consider P ′ ≤ S s given by Lemma 7.4.2 such that (s,

P ′ ) ⊆ s ∩ shrink [-δ,δ] ( s ′ ∈N (s ′ ∩ Unreset R ((t ′ , Q t ′ )))),
where N is the neighborhood of s, S s , and we write t ′ = s ′ [R ← 0] for any s ′ ∈ N . Further, let P r ≤ S r such that (r ′ , P r ) = r ∩ shrink + (Pre time ((s, P ′ ))).

Choose δ > 0 small enough so that all equations hold. Let ν be any ǫ-tight valuation in r ′ -δP . By the above equations, by a joint move of Controller and Perturbator, the game can proceed to any of the set t ′ -δQ t ′ . In particular, by Lemmas 7.5.5 and 7.5.4, the resulting valuation can be chosen by Perturbator to be inside t -δQ t as (ǫ + ǫ ′ )-tight for any ǫ ′ > 0. Since Q t was chosen arbitrarily, t, S t admits tight valuations.

Extension to Turn-based Timed Games

In this section, we extend the reachability algorithm to turn-based timed games. We consider the excess perturbation game semantics, where Perturbator can suggest any delay, including 0.

The correctness of the abstract game for timed automata (Proposition 7.5.1) was based on 1) the ability of the controller to always delay inside shrinkings of regions it visits, 2) while not being able to avoid visiting tight valuations. While the former ensured Controller to win G exs δ (A) if a winning strategy of the abstract is given, the latter ensured the symmetric property for Perturbator.

The situation is different in a game setting since from locations L P , Perturbator has no reason to delay into particular shrinkings. In fact, consider Fig. 7.6 which shows the states that can be reached by a delay inside region r ′ , at a location L P , starting from a shrinking of r, with r ⋖ + r ′ . Perturbator can thus delay to valuations close to borders. In fact, if the play arrives to L P inside r -δP , then r ′ ∩ Post time (r -δP ) is the set of valuations that that can be reached inside r ′ after a delay. While this can still be expressed as a shrunk region (by Lemma 3.4.5), this set does not admit tight valuations. We will show however that this set is always included in the union of at most two shrunk regions that admit tight valuations (See Fig. 7.6(b)). This property will allow us to adapt the abstract game construction and prove its correctness following the same proof as for timed automata.

For the proofs, we first need the following characterization of constrained regions that admit tight valuations.

Lemma 7.6.1. Let r, S r be a constrained region. Then, r, S r admits tight valuations if, and only if the two following conditions hold: 1. For any x, y ∈ C 0 , if r x,y = -r y,x and (S r ) x,y = 0, then (S r ) y,x = ∞, 2. For any x, y ∈ C 0 , if there is Figure 7.6: At Perturbator's locations, the delays cannot be expected to end in shrinkings of a particular form. In this example, if Perturbator delays in region r ′ from r, the valuation can be closed to the borders of the region, and the shrinking expressing the reachable valuations do not admit tight valuations (on the left). We will rather decompose this shrunk region into two shrunk regions that do admit tight valuations (on the right).

x 1 x 2 . . . x n ∈ Π x,y (G(r)) with (S r ) xi,xi+1 = 0 for 1 ≤ i ≤ n -1, then (S r ) x,y = 0.
Proof. Assume that the first condition is not satisfied. If r x,y = -r x,y and (S r ) x,y = (S r ) y,x = 0, then for any ν ∈ r, ν(x)ν(y) > r x,yǫ implies ν(x)ν(y) > -r x,y + ǫ, for small enough ǫ > 0. So no valuation ν is tight in r. Assume now that the second condition is not satisfied. If (S r ) xi,xi+1 = 0 for all 1 ≤ i ≤ n -1 and (S r ) x1,xn = ∞, then consider any SM P with

P x1,xn = 1. If ν is ǫ-tight in r -δP , then we have r xi,xi+1 -ǫ ≤ ν(x i ) -ν(x i+1 ) for all 1 ≤ i ≤ n -1. Summing these yield n-1 i=1 r xi,xi+1 -nǫ ≤ ν(x 1 ) -ν(x n ). We have n-1 i=1 r xi,xi+1 = r x1,xn
by hypothesis, and also ν(x 1 )ν(x n ) ≤ rδ. Now, this means r x1,xnǫn ≤ r x1,xnδ, which is a contradiction for small enough ǫ > 0.

Consider the fractional ordering of the clocks in r: X 1 , . . . , X n and let 2 ≤ i 0 ≤ n + 1 and 1 ≤ j 0 ≤ n be the indices given by Lemma 7.3.2. By hypothesis, we must have j 0 < i 0 , since otherwise j 0 ≥ 2, and r x,0 = -r 0,x for x ∈ X j0 , but (S r ) x,0 = (S r ) 0,x = 0, contradicting the hypothesis.

Observe that if x ∈ X k and y ∈ X l with j 0 < k < l < i 0 , then (S r ) y,x = ∞, since (y, 0, x) ∈ Π y,x (G(r)) and (S r ) y,0 = ∞. Furthermore, unless i 0 = j 0 + 1, there exists

j 0 + 1 = α 1 ≤ α ′ 1 < α 2 ≤ α ′ 2 < . . . < α m ≤ α ′ m = i 0 -1,
such that for all x ∈ X k and y ∈ X l with α i ≤ k < l ≤ α ′ i , we have (S r ) x,y = 0, and if α i ≤ k ≤ α ′ i and l > α ′ i then (S r ) x,y = ∞. In fact, for any pair x ∈ X k and y ∈ X l with j 0 < k < l < i 0 , (S r ) x,y = 0 implies that (S r ) x ′ ,y ′ = 0 for all x ′ ∈ X k ′ and y ′ ∈ X l ′ with k ≤ k ′ < l ′ ≤ l, because S r is normalized. Moreover, for such a pair x, y, if for z ∈ X l+1 , we have (S r ) y,z = 0, then also (S r ) x,z = 0. This follows from the hypothesis since x, y, z ∈ Π x,z (G(r)) and has S r -weight equal to 0. Thus, the sequence

(α i , α ′ i ) i is well-defined. Consider x ∈ X k and y ∈ X l for k ∈ [α i , α ′ i ] and y ∈ [α j , α ′ j ] with i < j, then (S r ) x,y = ∞.
In fact, for any clock z ∈ X α ′ i and z ′ ∈ X αj , we have x, z, z ′ , y ∈ Π x,y (G(r)), and (S r ) z,z ′ = ∞ by definition of the sequence α, α ′ .

We now show that (r, S r ) has ǫ-tight valuations. Consider any normalized SM P ≤ S r and 1/δ > 2(|C| + 2) max x,y∈C0 (P x,y ).

Fix any 0 < ǫ < δ/2. We define a valuation ν as follows. We let ν(x) = r x,0 for x ∈ X 1 .

Proof. Recall that N is obtained from M by setting all components (x, 0) to (∞, <) and that the resulting DBM is already normalized. Define (S 1 ) x,0 = ∞ for all x ∈ C and (S 1 ) x,y = S x,y for all (x, y) ∈ C 0 × C. We define S ′ as the normalization of S 1 .

For any P ≤ S, let (N, Q) denote the shrunk DBM such that (N, Q) = Post time ((M, P )). Let us show that Q ≤ S ′ . Here, Q is the normalization of Q ′ defined by Q ′

x,y = P x,y if y = 0 and Q ′ x,y = 0 if y = 0. Since N x,0 = ∞ for all x ∈ C, we only need to verify that Q ′

x,y ≤ S ′ x,y when y = 0. For these components, we have N x,y = M x,y and M ⊆ N , therefore Π x,y (G(N )) ⊆ Π x,y (G(M )). So Q ′ is already normalized because P is, and Q = Q ′ . By definition of S 1 above, we have Q ≤ S 1 , which implies Q ≤ S ′ (since Q is normalized). This also shows that if Q ≤ S ′ , then for all P ≤ S, we have Post time (M -δP ) ⊆ N -δQ. In fact, for any such P , as we just showed, there exists

Q ′ ≤ S ′ such that Post time (M -δP ) = N -δQ ′ . But N -δQ ′ ⊆ N -δQ if, and only if Q ≤ Q ′ , and Q ′ ≤ S ′ implies Q ≤ S.
For any Q ≤ S ′ , let us define P such that (M,

P ) = M ∩ (N, Q). We have Post time ((M, P )) = (N, Q), since Post time (M ∩ (N, Q)) = (N, Q).
Let us show that P ≤ S. P is the normalization of P ′ defined by P ′

x,y = Q x,y if y = 0 and P ′ x,y = 0 otherwise. Consider (x, y) such that S x,y = 0. -If y = 0, then S ′

x,y = 0, by definition of S ′ . Consider any path x 1 . . . x n in Π x,y (G(M )). We have S xj ,xj+1 = 0 for all 1 ≤ j ≤ n -1. But, if x j+1 = 0, then P ′ xj ,xj+1 = 0 by definition, and otherwise P ′ xj ,xj+1 = 0 because S ′ xj ,xj+1 ≤ S xj ,xj+1 = 0. Therefore, P x,y ≤ S x,y . -For the case y = 0, one can notice that since N x,0 = ∞ for all x ∈ C, for all normalized SMs P , we have P x,0 = 0 by definition.

The following lemma gives the construction illustrated in Fig. 7.6.

Lemma 7.6.3. Let r, S r be any constrained region that admit tight valuations, and r ′ such that r ⋖ * r ′ . There exist, and one can compute, S 1 , . . . , S m with m ∈ {1, 2}, such that each r ′ , S i admits tight valuations and for any SMs (Q i ) 1≤i≤m , we have Q i ≤ S i for all 1 ≤ i ≤ m, if, and only if there exists an SM P ≤ S r with

Post time (r -δP ) ∩ r ′ ⊆ m i=1 (r ′ -δQ i ),
for all small δ > 0. Moreover, in this case, for any ǫ-tight valuation v ∈ (r, P ) and any i ∈ {1, 2} and ǫ ′ > 0, there exists

d ≥ 0 such that v + d is (ǫ + ǫ ′ )-tight in (r ′ , Q i ).
Proof. Consider the clock ordering of a constrained region with tight valuations as in the proof of Lemma 7.6.1. We assume the indices 1 ≤ i 0 , j 0 ≤ n and α i , α ′ i 's are defined (see figure below). We distinguish cases according to the last clock that crosses an integer value during the delay from r to r ′ : There exists 1 ≤ k 0 ≤ n and m ∈ N such that for all x ∈ X 1 ∪ . . . ∪ X k0 , -r ′ 0,x = -r 0,x + m, while for all x ∈ X k0+1 ∪ . . . ∪ X n , we have -r ′ 0,x = -r 0,x + m + 1. Notice that -r 0,x is the integer part of the clock x in region r. If all integer parts have grown by m, then we let k 0 = 1. In the following figure, we represent by a vertical gray line some possible values of the index k 0 .

We distinguish several cases according to the relative position of k 0 .

1. Assume that 1 ≤ k 0 ≤ j 0 -1. The clock ordering before the delay is illustrated in the following figure in black, whereas the ordering after the delay is given between the gray 0 and 1.

0 X2 ••• 0 1 Xj 0 ≤ǫ/2 Xα 1 X α ′ 1 ≤ǫ Xα 2 X α ′ 2 ≤ǫ ••• Xi 0••• Xn 1 X1 ... X k 0 ≤ǫ/2
Let us consider the shrinking constraint S r ′ given by Lemmas 7.2.4 and 7.6.2, so that for all SMs Q, we have Q ≤ S r ′ iff there is P ≤ S with Post time (r -δP ) ∩ r ′ ⊆ r ′ -δQ. The constraint S r ′ can be obtained from S r by only changing the following components: for all x ∈ X 1 ∪ . . . ∪ X k0 (S r ′ ) x,0 = 0, and either r ′ x,0 = -r ′ x,0 and (S r ′ ) 0,x = 0 or (S r ′ ) 0,x = ∞. In fact, since r ′ -δQ contains the successors of r -δP , the diagonal constraints are the same. Moreover, the partition of the clocks given by i 0 , j 0 and α i , α ′ i 's are preserved by delays; while time is only translated. So the clocks X 0 , . . . , X k0 will be mixed with X i0 , . . . , X n but the constraints on the rest of the clocks will remain. By Lemma 7.6.1, (r ′ , S r ′ ) has tight valuations.

Consider SMs Q and P such that Post time (r -δP ) ∩ r ′ ⊆ r ′ -δQ for all small enough δ > 0. Let ν ∈ r -δP be an ǫ-tight valuation in (r, S r ).

Define d = m + 1 -ν(x k0+1 ) if x k0+1 has integer value in r ′ and d = m + 1 - ν(x k 0 )+ν(x k 0 +1 ) 2
otherwise (if k 0 = n, then let us assume x n+1 = 1). Then, according to the definition of k 0 and m, ν + d belongs to r ′ . Therefore, also ν + d ∈ r -δQ. We show that ν + d is ǫ-tight in (r ′ , S r ′ ). Diagonal components stay unchanged both in shrinking constraints and in valuations, so we only need to verify the constraints (S r ′ ) x,0 and (S r ′ ) 0,x . Since the distances between the first j 0 clocks are at most ǫ in ν (i.e. ν(x j0 ) -

(-r 0,xj 0 ) ≤ ǫ), we have that r ′ x,0 -ǫ ≤ ν(x) + d ≤ r ′ x,0 for all x ∈ X 1 ∪ . . . ∪ X k0 , and -r ′ 0,x ≤ ν(x) + d ≤ -r ′ 0,x + ǫ for all x ∈ X k0+1 ∪ . . . ∪ X j0 . It remains to verify that r ′ y,0 -ǫ ≤ ν(y) + d ≤ r ′ y,0 for y ∈ X i0 ∪ . . . ∪ X n .
This follows from the fact that r y,xǫ ≤ ν(y)ν(x) ≤ r y,x (which holds by hypothesis on (r, S r )).

The case where k 0 ≥ i 0 + 1 is symmetric.

2. Assume that j 0 ≤ k 0 < α 1 . Note that we may have X j0 = ∅ or X i0 = ∅, or both. We define two shrinking constraints S 1 r ′ and S 2 r ′ , such that (r, S i r ′ ) admits tight valuations for both i = 1, 2. Both have the same diagonal components as S r , since these do not change along delays. The first one corresponds to delaying to points where clocks X k0 can be very close to their upper integer values (Fig. 7.7(a)), and the second one to points where clocks X α1 are very close to their integer parts (Fig. 7.7(b)). We will show that for any pair Q 1 ≤ S 1 r ′ and Q 2 ≤ S 2 r ′ , there is a corresponding P ≤ S r such that any valuation obtained by delaying from r -δP inside r ′ lies either in (r ′ -δQ 1 ) or (r ′ -δQ 2 ), and moreover ǫ-tight valuations are reached in these shrunk regions if one starts at an ǫ-tight valuation in (r, S r ).

To define (S i r ′ ), we modify S r as follows. We let (S 1 r ′ ) x,0 = 0 and (S 1 r ′ ) 0,x = ∞ for all x ∈ X 1 ∪ . . . ∪ X j0 . Then (S 1 r ′ ) admits ǫ-tight valuations by Lemma 7.6.1. We let (S 2 r ′ ) x,0 = (S 2 r ′ ) 0,x = ∞ for all x ∈ X 1 ∪. . .∪X j0 and x ∈ X i0 ∪. . .∪X n , and (S 2 r ′ ) 0,x = 0 and (S 2 r ′ ) x,0 = ∞ for all x ∈ X αi ∪ . . . ∪ X α ′ i . Then, similarly, (S 2 r ′ ) admits ǫ-tight valuations. The definitions are illustrated in Figure 7.7. Consider any pair of SMs Q i ≤ (S i r ′ ) for i ∈ {1, 2}. We define P satisfying S r as follows. We let P x,0 = 0 whenever (S r ) x,0 = 0 or (S r ′ ) x,0 = 0, and P 0,x = 0 whenever (S r ) 0,x = 0. We choose arbitrary values for other components satisfying S r and the following constraints: (a) P x,y ≥ max(Q 1

S 1 r ′ : 0 Xj 0 0 Xα 1 X α ′ 1 Xi 0Xn 1 Xj 0 1 (S 1 r ′ )x,0=0 (a) S 1 r ′ S 2 r ′ : 0 Xj 0 0 Xα 1 X α ′ 1 Xi 0Xn 1 Xj 0 1 (S 2 r ′ )0,x=0 (
x,y , Q 2 x,y ) for all x, y ∈ C. Notice here that Q 1 x,y = Q 2 x,y = 0 whenever (S r ) x,y = 0 by definition of S 1 r ′ and S

2 r ′ . (b) For all x ∈ X α1 ∪ . . . ∪ X i0-1 , P x,0 ≥ max(Q 1 x,0 , Q 2 x,0 ). Notice that (S r ) x,0 = ∞ for these components. (c) For all x ∈ C \ (X α1 ∪ . . . ∪ X α ′ 1 ), P α1,x ≥ Q 2 0,x . Notice that (S r ) x,α1 = ∞ for these components. (d) For all x ∈ C \ (X α1 ∪ . . . ∪ X α ′ 1 ), and y ∈ X α1 ∪ . . . ∪ X α ′ 1 , P x,α1 ≥ max(Q 1 0,x , Q 2 x,0 + Q 1 0,y ). We have again (S r ) x,α1 = ∞.
This shows that one can choose values for P while satisfying S r . Note also that normalization of P can only increase its components, so all lower bounds given above will still be satisfied.

Consider any ν ∈ r -δP . Let us show that for any d ≥ 0 with ν + d ∈ r ′ , we have

ν + d ∈ r ′ -δQ i for i = 1 or i = 2. For diagonal components (x, y) ∈ C 2 , we have -r ′ y,x + δ(Q i ) y,x ≺ r ′ y,x ν(x) + d -(ν(y) + d) ≺ r ′ x,y r ′ x,y -δ(Q i )
x,y for small enough δ > 0. In fact, either (S r ′ ) x,y = 0 and (Q i ) x,y = 0 for i = 1, 2, since S i r ′ has the same diagonal components as S r , or

P x,y ≥ max((Q 1 ) x,y , (Q 2 ) x,y ).
It remains to choose i ∈ {1, 2} such that the constraints on the components (x, 0) and (0, x) are satisfied. Let us write ν ′ = ν + d.

(a) Assume that for all x ∈ X 1 ∪. . . X n , -r ′ 0,x +δQ 1 0,x ≺ r ′ 0,x ν ′ (x). For all x ∈ X i0 ∪. . .∪X n and x ∈ X 1 ∪. . .∪X j0 , we have Q 1

x,0 = 0 so ν(x) ≺ r ′ x,0 r ′ x,0 -δQ 1 x,0 . For any x ∈ X α1 ∪. . . X i0-1 , we have P x,0 ≥ Q 1

x,0 , so ν ′ (x) ≺ r ′ x,0 r ′ x,0 -δQ 1 x,0 . (b) Assume that for some 1 ≤ i ≤ n, for clocks x ∈ X i , -r ′ 0,x + δQ 1 0,x ≺ r ′ 0,x ν ′ (x). We show that ν ′ ∈ r ′ -δQ 2 . Let us first show that we have i ∈ {α 1 , . . . , α ′ 1 }. This follows from the fact that P x,α1 ≥ Q 1 0,x for all clocks x ∈ C \ (X α1 ∪ . . . ∪ X α ′ 1 ). In fact, this ensures that the constraint -r ′ 0,x + δQ 1 0,x ≺ r ′ 0,x ν ′ (x) is always satisfied for these clocks, hence i ∈ {α 1 , . . . , α ′ 1 }. We first show that the upper bounds hold. Let y ∈ X α1 and y ′ ∈ X i . We have ν ′ (y) ≤ -r ′ 0,y +δQ 1 0,y ′ since ν ′ (y ′ ) ≤ -r ′ 0,y ′ +δQ 1 0,y ′ by definition of i, and frac(ν(y)) ≤ frac(ν(y ′ )).

For any x ∈ X i0 ∪ . . . ∪ X n ∪ X 1 ∪ . . . ∪ X j0 , we also have ν ′ (x) -ν ′ (y) ≺ r ′
x,y r ′ x,y -δP x,y , which together yields ν ′ (x) ≺ r ′

x,0 r ′ x,0δ(P x,y -Q 1 0,y ′ ). This implies the desired bound since

P x,y ≥ Q 2 x,0 + Q 1 0,y ′ . For any clock x ∈ X α1 ∪ . . . ∪ X i0-1 , we have P x,0 ≥ Q 2 x,0 , which yields ν ′ (x) ≺ r ′
x,0 -δQ 2 x,0 . It remains to show the lower bounds. We have

Q 2 0,x = 0 for all x ∈ X α1 ∪ . . . ∪ X α ′ 1 so -r ′ 0,x + δQ 2 0,x ≺ r ′ 0,x ν ′ (x). For all x ∈ C \ (X α1 ∪ . . . ∪ X α ′ 1 ), we have by definition P α1,x ≥ Q 2 0,x . Then, -r ′ α1,x + δP α1,x ≺ r ′ α1,x ν ′ (x) -ν ′ (α 1 ).
Combining with the fact that ν ′ (α 1 ) ≥ -r ′ 0,α1 we get -r ′ 0,x + δQ 2 0,x ≺ r ′ 0,x ν ′ (x). It is now easy to see that from ǫ-tight valuations in (r, S r ), one can reach (ǫ + ǫ ′ )-tight valuations in both (r ′ , S 1 r ′ ) and (r, S 2 r ′ ). In fact, for any ǫ ′ > 0, the delay d ≥ 0 can be chosen such that r ′ x,0ν ′ (x) ≤ ǫ ′ , for x ∈ X j0 , but also such that ν ′ (x) + r ′ 0,x ≤ ǫ ′ for x ∈ X α1 . In the former case, ν ′ is (ǫ + ǫ ′ )-tight in (r ′ , S 1 r ′ ), and in the latter case, ν ′ is (ǫ + ǫ ′ )-tight in (r ′ , S 2 r ′ ).

3. The cases where α ′ i ≤ k 0 < α i+1 for i > 1 or α ′ m ≤ k 0 < i 0 are treated similarly to the previous case: Here α ′ i has the role of j 0 , and α i+1 has the role of α 1 .

Assume that

α i ≤ k 0 < α ′ i .
Then S r ′ has the same diagonal components as S r , and for any x ∈ X αi ∪ . . . ∪ X k0 , (S r ′ ) x,0 = 0 and (S r ′ ) 0,x = ∞, while for any x ∈ X k0+1 ∪ . . . ∪ X α ′ i , (S r ′ ) x,0 = ∞ and (S r ′ ) 0,x = 0. Furthermore, for any other clock x ∈ C, (S r ′ ) x,0 = (S r ′ ) 0,x = ∞.

If we fix SMs P and Q such that Post time (r -δP ) ∩ r ′ ⊆ r ′ -δQ, then for any ǫ-tight valuation ν ∈ r -δP , any delay d with ν + d ∈ r ′ is ǫ-tight in (r ′ , S r ′ ). In fact, the diagonal components stay unchanged during delays, and the fractional values of clocks X αi ∪ . . . ∪ X α ′ i differ by at most ǫ in ν.

5. Assume that j 0 + 1 = i 0 (there is no α i , α ′ i ). Consider the case k 0 = j 0 . The proof follows again the same ideas as before, but is simpler. We give the details. We define (S 1 r ′ ) x,y = (S 2 r ′ ) x,y = (S r ) x,y for all x, y ∈ C. We let (S 1 r ′ ) x,0 = 0 and (S r ′ ) 0,x = ∞ for all x ∈ C, and (S 2 r ′ ) 0,x = ∞ and (S r ′ ) 0,x = 0 for all x ∈ C. S 1 r ′ is represented in Figure 7.7(a) (with the difference that there is no α i 's).

Let Q i ≤ S i r ′ for i = 1, 2. Let j ′ 0 = min{j | 1 ≤ j ≤ j 0 , X j = ∅}. Define P , where P x,y ≥ Q 1 0,x for all x ∈ X i0 ∪ . . . ∪ X n and y ∈ X j ′ 0 . Let P x,i0 ≥ Q 1 0,y + Q 2 x,0 for all x ∈ C \ X i0 and y ∈ C. Consider ν ∈ r -δP . Let ν ′ = ν + d such that ν ′ ∈ r ′ . If -r ′ 0,x + δ ≺ r ′ 0,x ν ′ (x) for all x ∈ C, then ν ′ ∈ r ′ -δQ 1 since (Q 1 ) x,0 = 0 and P x,y ≥ Q 1
x,y for all x, y ∈ C. Otherwise, we have ν ′ (y ′ ) ≤ -r ′ 0,y ′ + δQ 1 0,y ′ for some y ′ ∈ C, so ν ′ (i 0 ) ≤ -r ′ 0,i0 + δQ 1 0,y ′ since frac(ν ′ (i 0 )) ≤ frac(ν ′ (y ′ )). This means that ν ′ (i 0 ) ≺ r ′ i0,0 r ′ i0,0 -δQ 2 x,0 for small enough δ > 0. For all x ∈ C \ X i0 , we have ν ′ (x)ν ′ (i 0 ) ≺ r ′

x,i0 r ′ x,i0 -δP x,i0 . This implies, by the above constraint on ν ′ (i 0 ) that ν ′ (x) ≺ r ′

x,0 r ′ x,0δ(P x,i0 + Q 1 0,y ′ ). This implies ν ′ (x) ≺ r ′ x,0 r ′ x,0 -δQ 2

x,0 since P x,i0 ≥ Q 1 0,y ′ + Q 2 x,0 . We are done since Q 2 0,x = 0 for all x ∈ C. It is clear that from ǫ-tight valuations in r -δP , one can delay to (ǫ + ǫ ′ )-tight valuations both in r ′ -δQ 1 and r ′ -δQ 2 , for any ǫ ′ > 0.

We can now generalize the abstract game to turn-based timed games, and prove the main theorem for these games.

Let us fix a timed game A = (L C ∪ L P , ℓ 0 , C, Σ, E C , E P ). We define RG(A) as follows. The states of RG(A) is again given as a set of square nodes (ℓ, r, S r ), where ℓ ∈ L C and r, S r is a well constrained region. The diamond nodes are now either of the form (ℓ, r, S r , e) with ℓ ∈ L C and e is an edge leaving ℓ, or (ℓ, r, S r ) with ℓ ∈ L P . As before, square nodes belong to Controller, and diamond nodes belong to Perturbator. The edges leaving square nodes and the diamond nodes of the form (ℓ, r, S r , e) are defined as for timed automata. There is an edge from a diamond node (ℓ, r, S r ) to (ℓ ′ , t, S t ), if there is an edge e = (ℓ, g, σ, R, ℓ ′ ) in A, and the following conditions hold: i) There is a region s with r ⋖ * s and t = s[R ← 0],

ii) Let m ∈ {1, 2} and (s, S i ) for i = {1, m} be the constrained region(s) given by Lemma 7.6.3 applied to r, S r . There exists i ∈ {1, 2} such that for all SMs P , P ≤ S t iff there exists an SM Q ≤ S i with (s ′ , Q) = Unreset R ((t, P )), for some s ′ = s.

Notice that (t, S t ) can be computed in polynomial time thanks to Lemmas 7.6.3 and 7.2.4. Also, all constrained regions of the square nodes admit tight valuations by Lemma 7.6.3 and Corollary 7.5.7.

Theorem 7.1.2, for turn-based timed games, follows from the following proposition.

Proposition 7.6.4. For any turn-based timed game A, Controller has a winning strategy in RG(A) if, and only if there exists δ 0 > 0 such that Controller wins G exs δ (A) for all δ ∈ [0, δ 0 ).

Proof. Assume that Controller wins RG(A).

As in the proof of Proposition 7.5.1, we assign to nodes n = (ℓ, r, S r ) in RG(A), shrunk DBMs (r ′ , P n ) with r ′ = r, describing the set of winning states from the corresponding locations in G exs δ (A). The construction and the proof are the same for square nodes. If n is a diamond node of the form (ℓ, r, S r ), then fix any s with r ⋖ * s and an edge e = (ℓ, g, R, ℓ ′ ) from n with s ⊆ g. Assume, by induction hypothesis, that we have shrunk DBMs (t, P n1 ) and (t, P n2 ) describing winning states from the successors n 1 = (ℓ ′ , t, S 1 t ) and n 2 = (ℓ ′ , t, S 2 t ) of n through the edge e, where t = s[R ← 0] (Assume n 1 = n 2 if there is only one such successor). Consider (s, S 1 ) and (s, S 2 ) given by Lemma 7.6.3 applied to r, S r (assume again that S 1 = S 2 if there is only one such constrained region). By construction, for each i ∈ {1, 2}, t, S i t is defined by Lemma 7.2.4, such that for all SMs P ni , P ni ≤ S i t iff there exists SM Q i ≤ S i with (s i , Q i ) = Unreset R ((t, P ni )), for some s i = s and s ⊆ s i . Then, by Lemma 7.6.

(s i , Q i ),
for some r s e = r with r ⊆ r s e . Here, (r s e , P s e ) describes a set of winning states from location ℓ assuming Perturbator chooses the edge e and delays anywhere in the region s. We define (r e , P e ) as the intersection of all (r s e , P s e ) with r ⋖ * s, and define (r ′ , P n ) as the intersection of all (r e , P e ) for all edges e leaving n. This concludes one direction of the proof. Now, assume that Perturbator wins RG(A). The proof of Proposition 7.5.1 is based on the construction of a strategy for G exs δ (A), that ensured that the valuation is always ǫ-tight inside any visited constrained region. When one projects the play in RG(A), this property allows Perturbator to choose valuations in G exs δ (A) belonging to any successor it would choose in RG(A) in order to win. Thus, Perturbator's strategy simply consists in following in G exs δ (A) its winning strategy in RG(A). The same proof carries over to timed games since Lemma 7.6.3 shows that given a ǫ-tight valuation of r, S r , there exist delays that lead to (ǫ + ǫ ′ )-tight valuations inside s, S 1 and s, S 2 for any ǫ ′ > 0.

Hardness Result

Proposition 7.7.1. The parameterized robust reachability problem is EXPTIME-hard on timed automata.

Proof. We use a reduction from the halting problem in linear-bounded alternating Turing machines over a two-letter alphabet Σ = {a, b}. Let M be such a Turing machine, and write n for the bound on the tape length. We assume w.l.o.g. that n ≥ 3 and that instructions are of the form:

• (disjunction) δ(q) = q ′ ∨ q ′′ • (conjunction) δ(q) = q ′ ∧ q ′′
• (instruction) δ(q) = (γ, γ ′ , dir, q ′ ) where γ, γ ′ ∈ {a, b} and dir ∈ {←, →}. Such a transition reads a γ in the current cell, write a γ ′ and follows direction given by dir.

Our encoding of M uses the set of n + 2 clocks X = {x i | i = 1 . . . n} ∪ {y, z}. The content of cell i is encoded by clock x i : it is an a if the value of clock x i is ni, and a b if the value of clock x i is bounded below by 2ni. Due to robustness concerns, these guards will be relaxed a bit in the construction.

We assume the content of the tape is represented by a word w over alphabet Σ of length n. Let k ∈ N and ǫ ≥ 0. We say that a valuation v over X is a k-shift encoding of w with precision ǫ whenever v(y) = v(z) = 0, and for every 1 ≤ i ≤ n:

• w i = a iff -ǫ ≤ v(x i ) -(n -i) -k ≤ ǫ • w i = b iff -ǫ ≤ v(x i ) -(2n -i) -k
We encode the instructions as follows.

◮ Regular instruction. A transition δ(q) = (γ, γ ′ , dir, q ′ ) is mimicked thanks to modules instr i,k δ(q)=(γ,γ ′ ,dir,q ′ ) for every 1 ≤ i ≤ n and 0 ≤ k < n. Such a module is depicted on Fig. 7.9: it is a sequence of n modules, the ith one being of a special shape. The initial state is (q, i, k, 1). We write I for the interval [n -1, n + 1] and I ′ for the interval [2n -1, +∞), and adopt the notation

S + k = {b + k | b ∈ S} for any set S.
The correctness of this module is given by the following lemma:

Lemma 7.7.2. Let 0 ≤ ǫ ≤ 1 and 0 ≤ δ ≤ 1. Let w ∈ Σ n such that w i = γ.
Assume module instr i,k δ(q)=(γ,γ ′ ,dir,q ′ ) is entered with valuation v which is a k-shift encoding of w with precision ǫ. The Controller has a unique strategy in this module, and for every response of the δ-perturbator, the valuation v ′ when leaving the module is a 0-shift encoding of w[w i ← γ ′ ] (the word obtained from w by replacing w i with γ ′ ) with precision 2δ.

Proof. There is a unique strategy for Controller, which is to play from state (q, i, k, j) when z reaches j with the unique possible transition: if initially |v(x j ) -(nj) -k| ≤ ǫ, then he will choose the top-most transition, and if initially v(x j ) ≥ 2nj + kǫ, then it will choose the bottom-most transition. Indeed note that in the first case, since ǫ ≤ 1, the value of clock x j when z reaches j lies within I + k. When clock x j is reset clock z is almost j (more precisely it lies between jδ and j + δ), whereas clock z is almost n when leaving the module (more precisely it lies between nδ and n + δ). In the second case, the value of x j is increased by almost n. This straightforwardly implies the mentioned property.

Remark 7.7.3. Note that if the module above is entered while w i = γ, then it reaches a deadlock. This could be avoided using extra transitions to a sink state. ◮ Conjunction. δ(q) = q ′ ∧ q ′′ is mimicked thanks to modules conj i,k δ(q)=q ′ ∧q ′′ (for every 1 ≤ i ≤ n and 0 ≤ k < n) on Figure 7.10. As in the previous module, the Controller has no other choice that selecting the next transition when the constraint is satisfied. For the first transition, the δ-Perturbator can choose to do it a bit earlier, or a bit later, and depending on this, the controller will next to choose either y

= 1 ∧ z ≤ 2 or y = 1 ∧ z > 2. q,i,k,p q,i,k,p+1 xp∈I+k ∧ z=p xp:=0 xp∈I ′ +k ∧ z=p module ab p q,i,k,p q,i,k,p+1 xp∈I+k ∧ z=p xp:=0 module (a → a) p q,i,k,p q,i,k,p+1 xp∈I ′ +k ∧ z=p module (b → b) p q,i,k,p q,i,k,p+1 xp∈I+k ∧ z=p module (a → b) p q,i,k,p q,i,k,p+1 xp∈I ′ +k ∧ z=p xp:=0 module (b → a) p Figure 7
.8: Intermediary modules: when traversing module ab p , either clock x p belongs to I + k while z = p, corresponding to an a at position p. Clock x p is then reset, so that position p still contains an a; or clock x p is in I ′ + k when z = p, encoding a b at position p. In that case, clock x p is not reset, and the content of cell p is preserved. Using similar ideas, modules (γ → γ ′ ) p , with γ, γ ′ ∈ {a, b}, check that cell p initially contains γ, and replace it with γ ′ .

module instr i,k δ(q)=(γ,γ ′ ,dir,q ′ ) ab 1 ab 2 (γ → γ ′ ) i ab n q,i, k,1 q,i,k,2 q,i,k,3 q,i,k,i q,i,k,i+1 q,i,k,n q,i,k,n+1 q ′
,dir(i),0,1 z=n y,z:=0 Figure 7.9: Module instr i,k δ(q)=(γ,γ ′ ,dir,q ′ ) for the simulation of the regular instruction δ(q) = (γ, γ ′ , dir, q ′ ), and its constituent submodules. If dir = →, dir(i) = i + 1 if 1 ≤ i < n, and undefined otherwise. If dir = ←, dir(i) = i -1 if 1 < i ≤ n, and undefined otherwise.

q,i,k,1 q ′ ,i,k+3,1 q ′′ ,i,k+3,1 y=1, y:=0 y = 1 ∧ z ≤ 2 y = 1 ∧ z > 2 z=3, y,z:=0 z=3, y,z:=0 y,z:=0 Figure 7.10: Module conj i,k δ(q)=q ′ ∧q ′′ for conjunctive transition Lemma 7.7.4. Let 0 ≤ ǫ ≤ 1 and 0 ≤ δ ≤ 1. Let w ∈ Σ n .
Assume module conj i,k δ(q)=q ′ ∧q ′′ is entered with valuation v which is a k-shift encoding of w with precision ǫ. The Controller has a unique strategy in this module, and the δ-Perturbator can choose to reach either (q ′ , i, k + 3, 1) or (q ′′ , i, k + 3, 1). In both cases, the valuation v ′ when leaving the module is a (k + 3)-shift encoding of w with precision ǫ + δ.

Proof. The Controller has no other choice than satisfying the next constraint of the next transition. On the other hand, the δ-Perturbator can either choose to postpone the first transition, or to fire it earlier. In the first case, the Controller has then to choose the bottom-most transition, and in the second case, the Controller has to choose the top-most transition. Globally the values of the clocks are increased by 3 (plus or minus δ), which yields the expected property. ◮ Disjunction. δ(q) = q ′ ∨ q ′′ is mimicked thanks to modules disj i,k δ(q)=q ′ ∨q ′′ (for every 1 ≤ i ≤ n and 0 ≤ k < n) on Figure 7.11.

q,i,k,1 q ′ ,i,k+1,1 q ′′ ,i,k+1,1 y,z:=0 y = 1 , y ,z := 0 y = 1 , y ,z := 0 Figure 7.11: Module disj i,k δ(q)=q ′ ∧q ′′ for disjunctive transition
Lemma 7.7.5. Let ǫ ≥ 0 and δ ≥ 0. Let w ∈ Σ n . Assume module disj i,k δ(q)=q ′ ∨q ′′ is entered with valuation v which is a k-shift encoding of w with precision ǫ. The Controller can choose to reach either (q ′ , i, k + 1, 1) or (q ′′ , i, k + 1, 1). In both cases, the valuation v ′ when leaving the module is a (k + 1)-shift encoding of w with precision ǫ + δ.

Proof. Similar to the previous proof.

◮ Reset module. We fix an integer 0 ≤ k < n. Shifts encodings accumulate when stacking disjunctive and conjunctive instructions. We present a module reset i,k q which resets the shift from state q, position i.

module reset i,k q ab 1 ab 2 ab n q,i,k,1 q,i,k,2
q,i,k,3 q,i,k,n q,i,k,n+1 q,i,0,1 z=n y,z:=0 Figure 7.12: Module reset i,k q which resets the shift in the encoding.

Lemma 7.7.6. Let 0 ≤ ǫ ≤ 1 and 0 ≤ δ ≤ 1. Let w ∈ Σ n . Assume module reset q,i,k is entered with valuation v which is a k-shift encoding of w with precision ǫ. The Controller has a unique strategy in this module, and for every response of the δ-Perturbator, the valuation v ′ when leaving the module is a 0-shift encoding of w with precision 2δ.

Proof. This proof is similar to the proof of Lemma 7.7.2.

◮ Global reduction. It remains to glue all the modules together. An easy solution is to apply the reset module after each conjunctive or disjunctive instruction (though there are some more thrifty solutions). The reset module allows both to reset the shift and to reinitialize the imprecision. We write A for the resulting timed automaton. The halting location of the Turing machine is called final in A.

One can easily check that in A, letting 0 ≤ δ < 1 2 , the Controller has a winning strategy against the δ-Perturbator to reach location final if, and only if, the Turing machine M halts.

Conclusion

We considered a game-based approach to robust reachability in timed automata, by modelling the semantics as a game between a controller and its environment. We proved that a bound on the imprecisions, and a corresponding robust strategy for reachability objectives in turn-based timed games can be synthesized, and that the existence of such a bound and a strategy is EXPTIMEcomplete. The problem is thus harder than classical reachability [START_REF] Alur | A theory of timed automata[END_REF]. We believe that the high complexity is due to the ability of Controller to detect whether any perturbation has been observed in a given transition, as in Fig. 7.10, which allows one to use alternation when encoding (bounded) Turing machines. In the conservative perturbation game semantics studied in Chapter 8, Controller will not be able to detect perturbations -at least, not immediately. The parameterized robust reachability, and in fact, Büchi objectives then become PSPACE-complete.

A natural continuation of this work would be to look at zone-based on-the-fly algorithms, as for usual timed games in [CDF + 05]. In fact, solving usual timed games is also an EXPTIME-complete problem and on-the-fly algorithms allowed efficient implementations.

Developing algorithms for safety objectives, that is, ensuring infinite executions that avoid some given state would require the use of different techniques and seems to be a challenging problem. In fact, in that setting, one has to deal with the accumulation of the imprecisions over infinite runs, which cannot be avoided by adjusting δ.

Chapter 8

Büchi Objectives in Conservative Semantics

Introduction

The previous chapter established the EXPTIME-completeness of the parameterized robust reachability problem on timed automata under the excess perturbation game semantics. The hardness proof relies on the ability of Controller to detect perturbations after a transition (this allows the encoding of alternating linearly bounded Turing machines). A natural question is whether this complexity blow-up, from PSPACE for the exact semantics to EXPTIME, is due to the ability of Controller to detect perturbations. The conservative perturbation game semantics disallows such an ability, since guards with equalities are never enabled. Under this semantics, parameterized robust reachability, and in fact, Büchi objectives, become PSPACE-complete.

More precisely, we show that deciding the existence of δ > 0, and of a strategy for Controller in the conservative perturbation game so as to ensure infinite runs satisfying a given Büchi condition is PSPACE-complete. Thus, this is the complexity of the problem in the exact setting. We characterize "robustly controllable" timed automata, i.e., those in which Controller has a winning strategy, by showing that Controller can win precisely when the timed automaton has an accepting aperiodic lasso. Aperiodicity [START_REF] Stainer | Frequencies in forgetful timed automata[END_REF] is a variant of forgetfulness introduced in [BA11] in a different context, to study the entropy of timed languages. Our characterisation confirms the suggestion of [START_REF] Basset | Thin and thick timed regular languages[END_REF] that this notion could be significant in the study of robustness. Our results rely on the combination of various techniques used for studying timed automata: Forgetful and aperiodic cycles as considered in [START_REF] Basset | Thin and thick timed regular languages[END_REF][START_REF] Stainer | Frequencies in forgetful timed automata[END_REF], topological semantics of [START_REF] Gupta | Robust timed automata[END_REF], shrinking from Chapters 5 and 7, and reachability relations of [START_REF] Puri | Dynamical properties of timed automata[END_REF].

The results presented in this chapter are under submission for publication [START_REF] Sankur | Robust controller synthesis in timed automata[END_REF].

Robust Büchi Objectives

In this chapter, we consider general timed automata with distinct labels and assume that the clocks are bounded above by a constant. Note that assuming distinct labels is for convenience only and it is no loss of generality since we are not interested in languages, but rather in location-based Büchi objectives.

The problem we are addressing in this chapter is the following. Figure 8.1: On the left, a copy of the timed automaton A 2 of Chapter 2 that is not robustly controllable for the Büchi objective {ℓ 2 }. In fact, Perturbator can enforce that the value of x be increased by δ at each arrival at ℓ 1 , thus blocking the run eventually. On the right, the timed automaton (from [START_REF] Basset | Thin and thick timed regular languages[END_REF]) is robustly controllable for the Büchi objective {ℓ 2 }. In fact, perturbations at a given transition do not affect the rest of the run; they are forgotten.

Figure 8.1 shows examples of controllable and uncontrollable timed automata in this sense. The main result of this paper is the following. Theorem 8.2.2. Parameterized robust controller synthesis in the conservative perturbation game semantics is PSPACE-complete for timed automata with Büchi objectives.

The next section introduces several notions we need to state our main lemma (Lemma 8.4.1), which characterizes timed automata that are robustly controllable, based on the nature of the lassos of the region automata.

Regions, Orbit Graphs, Algebra, Topology

We defined regions, region automata, and orbit graphs in Chapter 3. In this section, we give some additional definitions and properties.

Regions and Orbit Graphs

We introduce the following definitions on regions. A region r is said non-punctual if it contains some ν ∈ r such that ν + [-ǫ, ǫ] ⊆ r for some ǫ > 0. It is said punctual otherwise. A path π = q 1 e 1 q 2 e 2 . . . q n is non-punctual if whenever e i = delay, q i+1 is a non-punctual region.

We will use extensively the orbit graphs defined in Chapter 4. We need the following additional definitions and properties. Any region r has at most one vertex v ∈ V(r) such that both v and v + 1 belong to V(r). If these exist, then v = inf(r) and v + 1 = sup(r). Moreover, sup(r) = inf(r) + 1 if, and only if r is non-punctual.

Given any path π, for any node (i, v) of γ(π), let Succ((i, v)) denote the set of nodes (i + 1, w) with (i, v), (i + 1, w) is an edge. We also extend Succ(•) to sets of nodes. A strongly connected component (SCC) of a graph is initial if it is not reachable from any other SCC. We distinguish the following folded orbit graphs.

Definition 8.3.1. A forgetful cycle of R(A) is a cycle whose folded orbit graph is strongly connected. A cycle π is aperiodic if for all k ≥ 1, π k is forgetful. A lasso is said to be aperiodic if its cycle is.
Forgetfulness was recently introduced in [START_REF] Basset | Thin and thick timed regular languages[END_REF] for studying the entropy of timed languages (note however that their notion requires the graphs to be complete; this is not an important difference, see Lemma 8.6.3). This was further studied in [START_REF] Stainer | Frequencies in forgetful timed automata[END_REF] in the context of frequencies in timed automata, where aperiodicity was defined. Already in these works, forgetful cycles are used to discard convergent runs. As we show in this work, these notions can be used to characterize robust safety along infinite executions in the game semantics.

An example of a non-forgetful cycle was given in Fig. 3.1 in Chapter 4. The timed automaton of Fig. 8.1(b) contains a forgetful cycle, shown in Fig. 8.2.

v 0 v 1 v 2
Some Linear Algebra For any set of vectors, we denote by Span(B) the linear span of B, i.e. the set of linear combinations of B. In the proofs, we will often use the vertices of a region to define a basis of a vector space that contains the region.

Lemma 8.3.2. Let r be any region, and let v 0 = inf(r). The set of vectors B v0 = {vinf(r)} v∈V(r)\{v0} is linearly independent. Moreover, the affine space v 0 + Span(B v0 ) contains r.

Proof. Recall the definition of vertices of r using the partition X 0 , X 1 , . . . , X m of the clocks according to their fractional parts. The vertex v 0 = inf(r) corresponds to the case where all the clocks are equal to their lower bounds. Region r has one vertex v i for each 1 ≤ i ≤ m, in which all clocks X 1 , . . . , X i are equal to their lower bounds, and the rest of them are equal to their upper bounds. Hence, one can write v iv 0 as a column vector of |X 0 | + . . . + |X i | zeros, followed by |X i+1 | + . . . + |X m | ones, in the orthogonal basis of R C . This set is clearly independent.

To see that the affine space v 0 + Span(B inf(r) ) contains the entire region, write any ν ∈ r as the convex combination of the vertices of r: ν

= v∈V(r) λ v v. We get that ν -inf(r) = v∈V(r) λ v (v -inf(r)), since v∈V(r) λ v v -v 0 = v∈V(r) λ v (v -v 0 ) = v =v0 λ v (v -v 0 ), using v λ v = 1.
Let the dimension of a subset r ⊆ R C be the least d such that a affine subspace of R C of dimension d contains r.

Lemma 8.3.3. Let r be a region, and X 0 , X 1 , . . . , X m the partition of the clocks according to their fractional values in r. Then, r has dimension m.

Proof. Follows immediately from Lemma 8.3.2 since r has m + 1 vertices.

Metric on Timed Traces Since all edge labels are distinct, we will write timed traces as sequences (t i , e i ) 1≤i≤n where t i ≥ 0 and each e i is an edge. Given a path π of R(A), a valuation ν ∈ first(π), we say that a timed trace (t i , e i ) 1≤i≤n is feasible for π and ν if there is a run starting at ν, along π, whose timed trace is (t i , e i ) 1≤i≤n .

We define a variant of the metric of [START_REF] Gupta | Robust timed automata[END_REF] on timed traces, which defines the same topology. Given two timed traces u = (t i , e i ) 1≤i≤n and u

′ = (t ′ i , e ′ i ) 1≤i≤n , we let d(u, u ′ ) = ∞ if untime(u) = untime(u ′ ), d(u, u ′ ) = max{|t i -t ′ i |, 1 ≤ i ≤ n} otherwise. We define Ball d (u, ǫ)
as the open ball of radius ǫ around u in this metric. Note that the original metric was defined using timestamps rather than delays, but both metrics define the same topology [START_REF] Gupta | Robust timed automata[END_REF].

For a path π, let ttrace(π) denote the set of timed traces that are feasible for π and some valuation in first(π).

Proposition 8.3.4 ([GHJ97]

). If π is a non-punctual path, then ttrace(π) is an open set (for the topology induced by d).

We will also use the usual d ∞ metric on R C , defined as

d ∞ (ν, ν ′ ) = max x∈C |ν(x) -ν ′ (x)|.
We denote open balls in this metric by Ball d∞ (ν, ǫ).

Main Lemma

Our main result is based on the following lemma, which gives a characterization of robust timed automata using aperiodic lassos of region automata.

Lemma 8.4.1 (Main Lemma). For any timed automaton A and Büchi objective B, Controller has a winning strategy for some δ > 0, if, and only if R(A) has a reachable aperiodic non-punctual B-winning lasso.

The algorithm deciding robust safety consists in looking for such lassos. These cycles need not be simple, but Section 8.7 shows how this can be done in polynomial space. We also describe how winning strategies parameterized by δ can be computed. The two directions of the main lemma are proved using different techniques; they are presented respectively in Sections 8.5 and 8.6.

No Aperiodic Lassos Implies No Robustness

In this section, we prove that Controller loses if there is no aperiodic winning lassos. The idea is that if no accepting lasso of R(A) is aperiodic, then, as we show, the projection of any play to R(A) eventually enters and stays in a non-forgetful cycle. Then, we choose an appropriate Lyapunov function L I (•) defined on valuations and taking nonnegative values, and describe a strategy for Perturbator such that the value of L I (•) is decreased by at least ǫ at each iteration of the cycle. Hence, Controller cannot cycle infinitely on such cycles: either it reaches a deadlock, or it cycles on non-accepting lassos. In the rest of this section, we describe Perturbator's strategy, prove some properties on its outcomes, choose a function L I (•), and finally prove the first direction of the main lemma.

Reachability Relations

We already noted that any valuation ν can be written as the convex combination of the vertices of its region, i.e. ν = v∈V(reg(ν)) λ v v for some unique coefficients λ v ≥ 0 with v λ v = 1. When the region is clear from context, we will simply write ν = λv. Given a path π and a vertex v of first(π), let us denote by R Γ(π) (v) the set of nodes w ∈ V(last(π)) such that (v, w) ∈ E(Γ(π)). Thus, this is the "image" of v by the path π. Puri showed in [START_REF] Puri | Dynamical properties of timed automata[END_REF] that the reachability along paths can be characterized using orbit graphs.

Lemma 8.5.1 ([Pur00]). Let π be a path from region r to s. Consider any ν ∈ r with ν = v∈V(r) λ v v for some coefficients λ v ≥ 0 and

λ v = 1. If ν π -→ ν ′ , then for each v ∈ V(r), there exists a probability distribution {p ν,ν ′ v,w } w∈R Γ(π) (v) over R Γ(π) (v) such that ν ′ = v∈V(r) λ v w∈R Γ(π) (v) p ν,ν ′ v,w w. (8.1)
The converse holds for π: If there exist probability distributions p ν,ν ′ v,w satisfying (8.1), then ν π -→ ν ′ .

This lemma shows that any successor of a point ν = i λ i v i can be obtained by distributing each weight λ i of any vertex v i to its successors following a probability distribution.

Example 8.5.2. The automaton of Fig. 8.1(a) contains a cycle on the region r = 1 < x, y < 2 ∧ 0 < xy < 1 . The vertices of r are v 1 = (1, 0), v 2 = (2, 0), v 3 = (2, 1). Figure 8.3 shows the folded orbit graph given with a probability distribution on the outgoing edges of each node. Consider

a point ν = 1 3 v 1 + 1 3 v 2 + 1 3 v 3 .
Then, Lemma 8.5.1 says that ν ′ = 1≤i≤3 λ i v i is reachable from ν along the cycle, where λ 1 = 1 3 0.5 + 1 3 0.4 = 9 30 , λ 2 = 1 3 1 + 1 3 0.3 = 13 30 , and λ 3 = 1 3 0.6 + 1 3 0.2 = 4 15 . Fig. 8.3 also shows in gray the strongly connected components of the graph. The component I is an initial one. Notice that L I is indeed decreasing in this example: 1 3 + 1 3 ≥ 9 30 + 4 15 . The following lemma is a re-statement of Lemma 8.5.1 as suggested in [START_REF] Basset | Thin and thick timed regular languages[END_REF]. For a folded orbit graph Γ(π), M (Γ(π)) denotes the adjacency matrix, of size n × n, if the graph has n nodes, defined as follows. (M (Γ(π))) u,v = 1 if, and only if there is an edge from v to u, and (M (Γ(π))) u,v = 0 otherwise. A stochastic matrix is a matrix in which the sum of each column equals 1. We see λ as a column vector.

Lemma 8.5. 3 ([BA11]). Let π be a path from region r to s. Let ν = v∈V(r) λ v v and ν ′ = u∈V(s) λ ′ u u. Then, ν π -→ ν ′ if, and only if there is a stochastic matrix P ≤ M (Γ(π)) such that λ ′ = P λ.

In the above lemma, the inequality between matrices is to be interpreted componentwise. Thus, the matrix P is simply (the transpose of) the matrix of the probabilities p ν,ν ′ v,w of Lemma 8.5.1. For any region r, and any subset I ⊆ V(r), we define the function L I : r → R ≥0 as,

L I (ν) = v∈I λ v , where ν = λv.
It is shown in [START_REF] Basset | Thin and thick timed regular languages[END_REF] that given any cycle π, if I is chosen as the initial strongly connected component of Γ(π), then for any run ν π -→ ν ′ , L I (ν ′ ) ≤ L I (ν). We will abusively use L I (•) for a subset I of nodes of γ(π) or Γ(π), that correspond to a same region. Notice that 0 ≤ L I (•) ≤ 1.

′ = λ ′ v ′ with ν ′ = ν[R ← 0] for some R ⊆ C, min(λ ′ ) ≥ min(λ).
Proof. The orbit graph of a clock reset has the property that all vertices of reg(ν) has outdegree 1 (since the reset defines a function). By Lemma 8.5.1, each λ v ′ i is equal to the sum of a subset of the components of v, namely those vertices that have an edge to vertex v ′ i . The inequality follows.

λ 1 λ 2 λ 3 λ 1 λ 2 + λ 3
Proving Proposition 8.5.4 for delays is more difficult and is dealt with in the following lemma. We write λ ≥ ǫ to mean that all components of the vector satisfy the inequality. Lemma 8.5.8. Let ν = λv and ν ′ = λ ′ v ′ where ν ′ = ν + d for some d ≥ 0 and ν ′ is ǫ-far. If reg(ν) is a punctual region, and λ ≥ ǫ, then λ ′ ≥ ǫ.

Proof. We denote r = reg(ν) and s = reg(ν ′ ). Let γ denote the orbit graph of the delay r → s. Because we have an ǫ-far delay, s must have vertices inf(s) = sup(s).

We first show that λ ′ inf(s) , λ ′ sup(s) ≥ ǫ. There exists a clock x such that sup(s)(x) = v(x) + 1 for any other vertex v of region s (x is one of the first clocks that appear in the fractional ordering of the clocks inside s). Let us denote by l = inf(s)(x) and u = sup(s)(x). By Lemma 8.5.6, we must have

l + ǫ ≤ λ ′ sup(s) • u + v =sup(s) λ ′ v • v(x).
Using the fact that u = l + 1, and v(x) = l for all v = sup(s), we get

l + ǫ ≤ λ ′ sup(s) • u + v =sup(s) λ ′ v • l, l + ǫ ≤ λ ′ sup(s) + l v λ ′ v , ǫ ≤ λ ′ sup(s) .
A symmetric argument can be used to prove λ ′ inf(s) ≥ ǫ. Consider now a vertex v i0 / ∈ {sup(s), inf(s)}. We define the vector space E generated by the basis {vinf(s)} v =inf(s) . We consider the linear function f i0 : E → R which extracts from a point its coefficient of the vector

(v i0 -inf(s)). Write E ′ = f -1 i0 (0), a hyperplane in E. Then, H 1 = inf(s) + E ′ is an affine hyperplane in inf(s) + E.
Observe that for points in s, the coefficients under this basis corresponds precisely to the coefficients of the convex combination of the vertices. Thus, the set H 1 ∩ s contains precisely those valuations of s whose convex combination assigns 0 to vertex v i0 . In particular, E ′ contains the line of unit direction

1 since it contains [inf(s), sup(s)]. Thus, H 1 w u i0 r ν D inf(s) v i0 sup(s) s ν ′ D ′ w ′ H 1 H 2 H 3
contains all time-predecessors of all points of H 1 ∩ s, and in particular for all vertices v = v i0 of s, the predecessors of v in γ belong to H 1 . Consider the unique predecessor u i0 of v i0 in γ (it is unique because reg(ν) is punctual). We know that u i0 ∈ H 1 since otherwise v i0 ∈ H 1 . There exist affine hyperplanes H 2 and H 3 parallel to H 1 , containing respectively the segments [ν, ν ′ ] and [u i0 , v i0 ]. In fact, both segments have direction 1, so one can simply define H 2 and H 3 as translations of H 1 . Let D denote the line containing ν and u i0 , and D ′ the line containing ν ′ and v i0 . These lines are not parallel to H 1 . In fact, both ν and ν ′ are in the interior of their regions, so we have 0 < λ < 1 and 0

< λ ′ < 1. Now, if D ′ is parallel to H 3 , because v i0 ∈ H 3 ∩ D ′ , we would have ν ′ ∈ H 3 . But f i0 (ν ′ -v i0 ) = 0 since 0 < λ ′ < 1, which is a contradiction. Similarly, if D were parallel to H 3 , then ν ∈ H 3 .
In this case, for some delay d > 0, ν + d could be in the interior of s, which would lead to a contradiction as above.

Let w = H 1 ∩ D and w ′ = H 1 ∩ D ′ , which are therefore points. By the Intercept Theorem (below), we have

|u i0 -ν| |u i0 -w| = |v i0 -ν ′ | |v i0 -w ′ | . (8.2)
On the other hand, we have ν =

u =ui 0 λ u w 1 + λ ui 0 u i0 ,
where w 1 is defined as the convex combination of all vertices but u i0 using coefficients λu u =u i 0 λu (which is well-defined as λ ≥ ǫ). Let w 2 be a time successor of w 1 in the closure of reg(s). It can be defined as a barycenter of all vertices of reg(s) except v i0 . It therefore holds that f i0 (w 2 ) = 0, and hence that both w 1 and w 2 are in H 1 . Also w 1 ∈ D by the above equation. Therefore w 1 = w. We have similarly that

ν ′ = v =vi 0 λ v w ′ 1 + λ vi 0 v i0 , with w ′ 1 = w ′ . By (8.2) and the fact that 1 -λ vi 0 = v =vi 0 λ v , we have λ vi 0 = λ ui 0 , therefore λ vi 0 ≥ ǫ.
The Intercept Theorem is the generalization to arbitrary finite dimension of a simple theorem we learned in school.

Theorem 8.5.9 (Intercept Theorem). Let d and d ′ be lines in an affine space. If there are three parallel hyperplanes intersecting d and d ′ respectively at points A, A ′ , B, B ′ , C, C ′ , Then,

|AB| |AC| = |A ′ B ′ | |A ′ C ′ | .
Proof of Proposition 8.5.4. By induction on the length of a run under strategy σ P δ . Initially, we are in a singleton region with one vertex, so the only convex coefficient is 1. In the induction step, resets follow from Lemma 8.5.7. Delays follow from Lemma 8.5.8 since all delays are ǫ-far, and by the fact that the valuation after the latest reset lies in a punctual region.

We prove a similar proposition for the edge probabilities of Lemma 8.5.3. Proposition 8.5.10 says that all edges of the folded orbit graph receive a probability of at least Ω > 0 along ǫ-far delays, according to the interpretation of Lemma 8.5.3.

Proposition 8.5.10. Let ν = λv and ν ′ = λ ′ v ′ denote two valuations satisfying λ, λ ′ ≥ ǫ, and such that ν π -→ ν ′ is an ǫ-far delay of duration at least ǫ. Then, there exists a stochastic matrix P such that ΩM (Γ(π))

≤ P ≤ M (Γ(π)),
such that λ ′ = P λ, where Ω = min( 1 2 , ǫ 2 ). Proof. Let r and s denote the source and target regions.

Assume that both inf(s) and sup(s) have indegree 1, and let u be a predecessor. We have,

λ ′ inf(s) = λ u • p u,inf(s) , λ ′ sup(s) = λ u • p u,sup(s) .
If u is the only vertex of r, then λ u = 1, and we get that p u,inf(s) , p u,sup(s

) ≥ ǫ since λ ′ inf(s) , λ ′ sup(s) ≥ ǫ. Otherwise, we must have λ u ≤ 1 -ǫ. Again, because λ ′ inf(s) , λ ′ sup(s) ≥ ǫ, we get that p u,inf(s) , p u,sup(s) ≥ ǫ 1-ǫ ≥ Ω.
All other edges have outdegree 1 so the probabilities are equal to 1.

Assume now that sup(s) has indegree 2, but inf(s) has indegree 1. We show that in this case r = s. Observe that inf(s) cannot have indegree higher than that of sup(s) since any predecessor of inf(s) is a predecessor of sup(s). Now, sup(s) cannot have both its predecessors outside V(s) since otherwise these would be predecessors of inf(s). Thus, inf(s) ∈ V(r), and is a predecessor of sup(s). In this case, inf(s) is a predecessor of itself since this is a delay transition. Furthermore, if sup(s) has its other predecessor outside s, this would again be a predecesor of inf(s), and inf(s) would have indegree 2. Therefore, the predecessors of sup(s) must be sup(s) and inf(s), and the predecessor of inf(s) is itself. This is only possible when s = r.

We have,

λ ′ inf(s) = λ inf(s) • p inf(s),inf(s) , λ ′ sup(s) = λ inf(s) • p inf(s),sup(s) + λ sup(s) • p sup(s),sup (s)
. We get that p inf(s),inf(s) ≥ Ω. Here, p sup(s),sup(s) = 1 since sup(s) has outdegree 1 by assumption. Let x denote the clock with the least fractional value in s. Notice that the clock x has the same value in all vertices apart from sup(s). We have ν

(x) = inf(s)(x) • (1 -λ sup(s) ) + sup(s)(x) • λ sup(s) , which gives ν(x) -inf(s)(x) = λ sup(s) . Similarly, we have ν ′ (x) -inf(s)(x) = λ ′ sup(s)
. Since the delay is at least ǫ, we have

(ν ′ (x) -inf(s)(x)) -(ν(x) -inf(s)(x)) = ν ′ (x) -ν(x) ≥ ǫ.
which is equivalent to λ ′ sup(s)λ sup(s) ≥ ǫ. By writing λ ′ sup(s) as above, this is equivalent to

λ inf(s) • p inf(s),sup(s) + λ sup(s) • (p sup(s),sup(s) -1) ≥ ǫ.
Thus, we must have λ inf(s) • p inf(s),sup(s) ≥ ǫ, which means that p inf(s),sup(s) ≥ ǫ 1-ǫ ≥ ǫ, as required. Let us now consider the case where two vertices of r have outdegree 2. This means that inf(r) and sup(r) are different, and that they have an edge leading to both inf(s) and sup(s). To simplify notations, let us write r 1 = inf(r), r 2 = sup(r) and similarly s 1 and s 2 for s. We have the following relation.

λ

′ s1 = p 11 λ r1 + p 21 λ r2 , λ ′ s2 = p 12 λ r1 + p 22 λ r2 , (8.3)
where p 11 , p 12 , p 21 , p 22 ≥ 0 are given by Lemma 8.5.3 and satisfy p 11 + p 12 = 1, p 21 + p 22 = 1. Now, all p ij may not be greater than Ω here. But we will show that one can then modify these to obtain components greater than Ω. In other terms, some stochastic matrix P satisfyin P ≥ ΩM (Γ(π)) will also satisfy Lemma 8.5.3. Without loss of generality, let us assume that p 11 < Ω. We would like to increase p 11 by some α ≥ 0 and still satisfy the above equation, the stochasticity, and obtain a new matrix of p ij whose all components are in [Ω, 1 -Ω]. Then, the new equation is the following:

λ ′ s1 = (p 11 + α)λ r1 + (p 21 - αλr 1 λr 2 )λ r2 , λ ′ s2 = (p 12 -α)λ r1 + (p 22 + αλr 1 λr 2 )λ r2 . (8.4)
This equation is satisfied for any α, assuming (8.3) is satisfied. In order to obtain the matrix we are looking for, it suffices to find α such that the following constraints are satisfied (since stochasticity is already satisfied).

Ω ≤ p 11 + α ≤ 1 -Ω, Ω ≤ p 21 - αλr 1 λr 2 ≤ 1 -Ω. (8.5)
We now use Fourier-Motzkin elimination to show that there is always such a choice for α. Let us rewrite the above constraints on α by separating lower bounds and upper bounds.

Ω -p 11 ≤ α, (8.6

Decreasing Lyapunov function

In the previous paragraph, we established lower bounds on the convex coefficients of the visited valuations. We use this property to find a Lyapunov function that strictly decreases at each cycle.

Let us first note the following property of the functions L I (•).

Lemma 8.5.11. Let π be a cycle, and write γ(π)

= (V 1 ∪ . . . ∪ V n , f G , E)
for its orbit graph, and

Γ(π) = (V, f ′ G , E ′ ) for its folded orbit graph. Let I 1 ⊆ V be any subset for which (u, v) ∈ E ′ with v ∈ I 1 implies u ∈ I 1 . Define I i = Succ γ(π) (I i-1 ) for all 2 ≤ i ≤ n. Then, for any run ρ along π, we have L Ii (state i (ρ)) = L I1 (state 1 (ρ)) for all 1 ≤ i ≤ n.
Proof. By induction, using Lemma 8.5.1.

The following lemma shows that runs along non-punctual progress cycles can be modified so as to reach any valuation in a ball around the target state. This gives the dimension of the set of valuations reachable along a progress cycle starting from a given valuation. The result and its proof are similar to [DDMR08, Lemma 29].

Lemma 8.5.12. Let π be a non-punctual progress cycle, and (ℓ, ν) π -→ (ℓ, ν ′ ) a run along π. Then, there exists ǫ > 0 such that there exists a run from (ℓ, ν), along π, to any point in {ℓ}×(Ball d∞ (ν ′ , ǫ)∩ reg(ν ′ )).

Proof. Consider the partition of the clocks inside first(π), according to their fractional ordering. One can factor π as π = π ′ π n π n-1 . . . π 1 , where each π i starts with the latest reset of some clocks Y i ⊆ C, with Y i = X j for some j, and π 1 ends with a reset of the clocks X 0 if this set is non-empty. To see that for any i, there exists j such that Y i = X j , suppose the latest resets of some clocks x and y are at different transitions, say, state i (π) and state j (π) respectively, with i < j. Then, they belong to the same set X k if, and only if the total delay of any run along π i...j is an integer. But this is only possible if equality constraints are used, which is not the case since π is non-punctual. Moreover, we have n = m, since all clocks are reset at least once as π is a progress cycle.

Let us factorize the run ρ as ρ = ρ ′ ρ m ρ m-1 . . . ρ 1 where each ρ i is along π i and ρ ′ along π ′ . Then, for each clock x ∈ X i , ν ′ (x) = delay(ρ i ρ i-1 . . . ρ 1 ), where delay(•) denotes the sum of the delays of a given run. Consider the timed trace (d i , e i ) i of ρ. We have d i > 0 for all i by definition. By Proposition 8.3.4, any timed trace (d ′ i , e i ) i , with |d id ′ i | ≤ ǫ for all i ≥ 1, defines a run starting at (ℓ, ν) along π, if ǫ is chosen small enough. It remains to show that any point ν ′′ ∈ Ball d∞ (ν ′ , ǫ)∩reg(ν ′ ) is reachable from (ℓ, ν) following such a "close" timed trace.

Consider such an ǫ, and any

ν ′′ ∈ reg(ν ′ ) such that d ∞ (ν ′ , ν ′′ ) ≤ ǫ 2 .
Notice that we have frac(ν ′′ (x)) = frac(ν ′′ (y)), and frac(ν

′ (x)) = frac(ν ′ (y)) for any x, y ∈ Y i , which implies ν ′′ (x) - ν ′ (x) = ν ′′ (y) -ν ′ (y). Thus, we define (η 1 , . . . , η m ) ∈ [-ǫ 2 , ǫ 2 ] m such that ν ′ (x) + η i = ν ′′ (x) for all x ∈ Y i . A run ending in (ℓ, ν ′′ ) can be defined as o = o ′ o m . . . o 1 ,
by modifying the trace (d i , e i ) i so as to satisfy the following properties:

delay(o 1 ) = delay(ρ 1 ) + η 1 , delay(o 2 ) = delay(ρ 2 ) + η 2 -η 1 , . . . delay(o m ) = delay(ρ m ) + η m -η m-1 , delay(o ′ ) = delay(ρ ′ ).

It is possible to obtain o by modifying an arbitrary delay in each ρ

i since |η i -η i+1 | ≤ ǫ.
We now prove that the folded orbit graphs of non-punctual progress cycles are always connected. If the cycle is non-forgetful, there are at least two connected SCCs (Corollary 8.5.14).

Lemma 8.5.13. The folded orbit graph of any non-punctual progress cycle is connected.

Proof. Consider a non-punctual progress cycle and let us denote r = first(π). Consider the basis B v0 , with v 0 = inf(r), defined in Lemma 8.3.2. Assume that the orbit graph has at least two disjoint connected components G 1 and G 2 . Note that we do not require G i 's to be strongly connected components. These are simply two disjoint maximal subgraphs.

Let v 0 + u be a point in r, with u ∈ Span(B v0 ) and write u = v λ v v. Let f denote the linear function that associates to each element of Span(B v0 ) the sum of the coefficients of the vertices of G 1 . Then f (u) = v∈G1 λ v . For any run

(v 0 + u) π -→ (v 0 + u ′ ), where u ′ = v λ ′ v v,
we have, by Lemma 8.5.11, f (u) = f (u ′ ). Thus, the set U ⊆ r of valuations reachable from v 0 + u along π lies in the set v 0 + f -1 (f (u)), which is an affine hyperplane of v 0 + Span(B v0 ). So it has smaller dimension than r. On the other hand, by Lemma 8.5.12, the set U includes the intersection of a d-open ball intersected with r, hence have the same dimension as r. Contradiction. Corollary 8.5.14. The folded orbit graph of a non-punctual non-forgetful progress cycle π contains at least two strongly connected components that are connected. We associate with each π an initial SCC of Γ(π), which we denote by I(π).

Hence, for any non-punctual non-forgetful cycle π, we consider the function L I(π) . The following lemma shows that L I(π) decreases by at least a fixed amount at each iteration of such a cycle under Perturbator's strategy σ P δ .

Lemma 8.5.15. Let ω ∈ Outcome δ A (•, σ P δ ), and ρ be a finite prefix of ω such that π, the projection of ρ to regions, is a cycle. If π is a non-forgetful progress cycle, then, writing first(ρ) = λv and last(ρ) = λ ′ v ′ , we have,

i∈I(π) λ ′ i ≤ i∈I(π) λ i -ǫ 2 /2.
Proof. We know that π is non-punctual by definition of σ P δ . Let us write γ(π)

= (V 1 ∪ . . . ∪ V n , f G , E).
For each 1 ≤ i ≤ n, let I i denote the set of nodes of V i that are reachable from the nodes {1}×I(π) ⊆ V 1 . Observe that I 1 = {1} × I(π), and {n} × I(π) ⊆ I n since I(π) is a strongly connected component. However, I n = {n} × I(π) because of Corollary 8.5.14. Let J i denote the set of nodes of V i from which the set {n} × I(π) is reachable. We have J n = {n} × I(π) by definition. Because I(π) is an initial component, we have J i ⊆ I i for all i. Indeed, assume v ∈ J i \ I i for some i. Then some node of {n} × I(π) is reachable from v. Since each node has at least one predecessor in γ(π), v is reachable from some node u of V 1 . We have that u ∈ I 1 , since otherwise v ∈ I i . Thus, in Γ(π), there is an edge from the SCC of u to I(π), contradicting the fact that I(π) is an initial SCC. Moreover, we have I 1 = J 1 . In fact, J n is reachable from any node of I 1 since this is a strongly connected component.

Let i 0 be the least index such that I i = J i . Notice that we have L Ii (state i (ρ)) = L I1 (state 1 (ρ)) for any 1 ≤ i ≤ i 0 -1, by Lemma 8.5.1 (in fact, all predecessors of I i are in I i-1 , and all nodes of I i-1 have at least one successor in I i ). Moreover, for any 1 ≤ i ≤ n, we have L Ji (state i (ρ)) ≥ L Jn (state n (ρ)), since all predecessors of J i are in J i-1 by definition. We will show that L Ji 0 (state i0 (ρ)) ≤ L Ji 0 -1 (state i0-1 (ρ))ǫ 2 /2, which thus implies the desired inequality.

There exists a ∈ J i0-1 and b ∈ I i0 \ J i0 with (a, b) ∈ E. Let us write λv = state i0-1 (ρ). By Proposition 8.5.4, we have λ a ≥ ǫ. Moreover, the transition from step i 0 -1 to i 0 must be a delay since vertex a has two successors; a must have a successor in J i0 , thus different than b, since a ∈ J i0-1 . By Proposition 8.5.10, the edge (a, b) receives a probability of at least ǫ/2 (in Lemma 8.5.1). The inequality follows. The previous proposition already gives an insight into the proof, since it follows that no nonforgetful cycle can be repeated infinitely often under strategy σ P δ . However, one also needs to show that switching between different cycles cannot lead to Controller's winning. Thus, the last tool we need before the proof is the following theorem, which will allow us to factor any paths into cycles with the same folded orbit graphs.

We will use Theorem 4.5.2 as in Chapter 4 as follows. Given a cycle π factorized as π = π 1 π 2 . . . π n , in which all π i are cycles from the same region-states, we consider a linearly ordered complete graph G = (V, E) with V = {1, . . . , n} and E is defined by the usual order on integers. The coloring function f is given as follows. For all i < j, we define f ((i, j)) = Γ(π i π i+1 . . . π j ). Thus, a monochromatic path given by the theorem corresponds to a factorization into π = π 0 •(π α1 . . . π α2-1 )• (π α2 . . . π α3-1 ) • . . . such that all Γ(π αj . . . π αj+1-1 ) define the same graph.

Note that Ramsey's theorem would actually suffice for our proof but it would give an exponentially larger bound than Theorem 4.5.2. Consequently, the proof below will bound by a simple exponential the number of steps to the "failure" under any strategy in non-robust systems.

Proof: No winning aperiodic lassos implies no robust safety. To get a contradiction, fix any winning strategy σ for Controller and let ρ be the infinite run Outcome δ A (σ, σ P δ ). Let π be the projection of ρ into regions. By definition of σ P δ , π is a non-punctual path. Let us write π = π 0 π 1 . . . π n . . . such that all π i are accepting cycles from a same state. Now, Γ(•) associates each cycle π to its folded orbit graph. Since any such graph has |C| + 1 nodes, and all its nodes are labelled with the same region, the codomain of Γ has size r = 2 (|C|+1) 2 × |R(A)|. Let n = ⌈2/ǫ 2 ⌉ + 1 and N large enough so that ⌈ N/r -2⌉ -1 ≥ n2 (|C|+1) 2 . We extract π ′ the prefix of π with N factors, and apply Theorem 4.5.2 on π ′ where Γ is the coloring function. This gives a factorization

π ′ = π ′ 0 π ′ 1 . . . π ′ n ′ π ′ n ′ +1 , with n ′ = n2 (|C|+1) 2
, where Γ(π ′ 1 ) = . . . = Γ(π ′ n ′ ), and π ′ i are obtained by concatenating one or several consecutive π i . By hypothesis, some power k of π ′ i is non-forgetful, with k ≤ 2 (|C|+1) 2 since this is the number of folded orbit graphs for a fixed labelling function. But since the folded orbit graphs are the same for all π ′ i , this power is the same for all factors. Moreover, for the same reason, Γ(π

′ i k ) = Γ(π ′ i π ′ i+1 . . . π ′ i+k-1
). Hence, we can factorize π ′ again into

π ′ = π ′ 0 π ′′ 1 π ′′ 2 . . . π ′′ n π ′′ n+1
, where Γ(π ′′ 1 ) = . . . = Γ(π ′′ n ) and all are non-forgetful; while π ′ 0 and π ′′ n+1 are arbitrary non-punctual paths. Moreover, π ′′ i , for 1 ≤ i ≤ n, must be progress cycles too. In fact, otherwise there is some clock x ∈ C that is never reset along π ′ . But because σ P δ ensures a timed trace of ρ. Assume that d i > 0 for all 1 ≤ i ≤ n. Choose 0 < ǫ ′ < ǫ so that d i ≥ ǫ ′ for all i, and all timed traces in Ball d (u, ǫ ′ ) are lead to some point in B. This is possible since all delays are positive, by Prop. 8.3.4 (π is non-punctual), and by the fact that the value of each clock at the last state of a run is continuously determined by the delays in the timed trace. Let δ ≤ ǫ ′ . Now, starting at ν, if Controller plays according to u, then the timed trace of any outcome belongs to Ball d (u, ǫ ′ ), thus is feasible and ends in B. More precisely, Controller's strategy that ensures reaching B consists simply in playing u from ν. Therefore, ν ∈ CPre δ π (s ′ ). If not all delays are positive, then one can choose another run ρ ′ with this property, and such that d(u, ttrace(ρ ′ )) ≤ ǫ ′ since ttrace(π) is open, and use ρ ′ in the above proof.

Winning Under Perturbations

Let π 0 π denote a non-punctual aperiodic lasso, where π is the cycle. By definition, for any n ≥ 1, Γ(π n ) is strongly connected. We first show that there exists n ≥ 1 such that Γ(π n ) is a complete graph.

Lemma 8.6.3. Let π be an aperiodic cycle. Then, there exists n

≤ |C 0 | • |C 0 |! such that Γ(π n ) is a complete graph.
Proof. For any vertex v, there exists

n v ≤ |V | such that (v, v) ∈ Γ(π nv ) since Γ(π) is strongly connected. Let m = lcm v∈V (n v ). Then, (v, v) ∈ Γ(π m ) for any vertex v ∈ V . Note that m ≤ |V |!.
Let us write π ′ = π m . Consider the length n v,w of the shortest path from v to w in Γ(π ′ ) for any v, w ∈ V , and let m ′ = max v,w∈V n v,w , which is finite since π ′ is strongly connected. We have, By the previous lemma, let us assume, in the rest of this section, that Γ(π) is a complete graph (one can simply consider the lasso π 0 π n for n large enough). Let s be a region with smaller granularity inside r, obtained so that the Hausdorff distance between r and s is positive. The choice of s is illustrated in Fig. 8.6. Note that s can be chosen so that it can be expressed by a DBM (with rational components). The construction is defined in the following lemma. Lemma 8.6.4. For any non-empty DBM M , there exists a non-empty DBM N such that Ball d∞ (ν, ǫ)∩ M ⊆ N for some ν ∈ M , and for any shrinking matrix P with (M, P ) = ∅, N ⊆ (M, P ).

(v, w) ∈ Γ(π ′ m ′ ). In fact, (v, v) ∈ Γ(π ′ m ′ -nv,w ) since (v, v) ∈ Γ(π ′ ) and (v, w) ∈ Γ(π ′ nv,w ). We have, m ′ ≤ |V |, so n can be chosen as |V | • |V |!.
Proof. We define Q as follows. For any x, y ∈ C 0 , if M x,y = -M y,x , then Q x,y = Q y,x = 0. Otherwise, we have M x,y ≥ -M x,y + 1, and in this case, we let Q x,y = Q y,x = 1. Let us show that M -ǫQ = ∅, for small enough ǫ > 0. To show non-emptiness, it suffices to show that the constraints of the DBM M -ǫQ do not imply a negative upper bound on zero [START_REF] Bengtsson | Timed automata: Semantics, algorithms and tools[END_REF] Figure 8.7: Simulation transition (q, α, q ′ , β, dir) where α, β ∈ {a, b}. Index i is such that 1 ≤ i ≤ N and 1 ≤ i + dir ≤ N . Guards and resets are defined as follows: g a,j is (x j < 4 ∧ u < 3) and g b,j is (x j > 4 ∧ u < 3), while Y a,j is {x j } and Y b,j is empty. some valuation v 0 that properly encodes some content of the tape of M: if cell C j contains an a, then v 0 (x j ) < 1, and if cell C j contains a b, then v 0 (x j ) > 2. We describe a strategy for Controller, and then pick a corresponding outcome (with perturbations). The candidate strategy is as follows: leave (q, i) when u = 2.5, and in each of the p j 's, wait for δ time units, and then takes the next feasible transition. Under that strategy, and assuming that Perturbator perturbs by -δ ≤ ǫ 0 ≤ δ on transition leaving (q, i), and by -δ ≤ ǫ j ≤ δ on transition leaving p j , the valuation when arriving in p j is v j (resp. in (q ′ , i + dir) is v ′ 0 ) such that:

• if i = j and cell C j contains a b, or if i = j and β = b, then for every

1 ≤ k ≤ N + 1, v k (x j ) = v 0 (x j ) + 2.5 + (k -1)δ + k-1 h=0 ǫ h ; • if i = j
and cell C j contains an a, or if i = j and β = a, then for every 1 ≤ k ≤ j, v k (x j ) = v 0 (x j ) + 2.5 + (k -1)δ + k-1 h=0 ǫ h , v j+1 (x j ) = 0, and for every j

+ 2 ≤ k ≤ N + 1, v k (x j ) = (k -j -1)δ + k-1 h=j+1 ǫ h .
Note that in all cases, since δ < 1 4N , if cell C j contains an a, then v j + δ + ǫ j |= g a,j , and if cell C j contains a b, then v j + δ + ǫ j |= g b,j . Note also that if either i = j and cell C j contains an a, or if i = j and β = a, then v ′ 0 (x j ) < 1, and if either i = j and cell C j contains a b, or if i = j and β = b, then v ′ 0 (x j ) > 2. This means that whatever the perturbation, at the end of the module the clocks properly encode the new content of the tape of M after the mentioned transition has been taken.

We can apply this strategy in every module simulating a transition of the Turing machine. Since M halts on w 0 , the halt state can be reached by following this strategy.

Conversely, if M does not halt on w 0 , then when playing without perturbations, Controller cannot reach the halting state. In particular, Controller has no robust strategy. Now we should realize that if the Turing machine halts on w 0 , then every non-blocking (standard) execution in A leads to halt. So in particular, there is no robust strategy for avoiding halt. If the Turing machine does not halt, then the same strategy as above is robust and avoids halt. This implies the equivalence with the third property.

In the above construction some clocks may not be bounded. However we can modify the construction to ensure that all clocks are always bounded. We assume that an a in cell C j is encoded with clock constraint x j < 1, and a b with clock constraint 2 < x j < 4 when entering the module.

Assuming this, the previous module ensures that, when leaving the module, either x j < 1 (in case cell C j now contains an a), or either 2 < x j < 4 or 4 < x j < 7 (the two possible cases for cell C j to contain a b). It is easy to plug at the end of the module another module, which ensures that 2 < x j < 4 when cell C j contains an a, and x j < 1 when cell C j contains a b. Then we can plug at the end of this second module another one which ensures that x j < 1 when cell C j contains an a, and 2 < x j < 4 when cell C j contains a b, which is the initial encoding. Using this trick, the constructed timed automata has only bounded clocks.

Conclusion

We presented an algorithm for synthesizing robust strategies for Büchi objectives under the conservative perturbation game semantics, for an unknown perturbation parameter. Our results make a link between controller synthesis problems and recent work on convergence phenomena and entropy. In fact, if all locations are accepting, then a timed automaton is robustly controllable in our sense if, and only if it is thick, or equivalently, it has finite entropy, as defined in [START_REF] Basset | Thin and thick timed regular languages[END_REF]. Technically, the distinction between forgetful and non-forgetful cycles was made, and their relation to characterization was already established in [START_REF] Basset | Thin and thick timed regular languages[END_REF]. Our results show that under our perturbation game semantics, the "convergent runs" actually become blocking. This problem has lower complexity than the same problem for the excess perturbation game semantics, since even reachability is EXPTIME-complete (Chapter 7).

In order to fully treat the robust controller synthesis problem, one needs to consider timed games. We intend to investigate possible extensions of this work to timed games, starting from turn-based timed games, where Perturbator entirely determines the move in some locations. This could require generalizing the notion of aperiodicity from paths to trees since Controller can no more ensure to follow a given path.

Chapter 9

Weighted Timed Games

Introduction

Weighted timed automata are an extension of timed automata, introduced in [ATP01, BFH + 01], which allow to express and solve optimization problems on timed systems. In this model, timed automata are enriched with a special cost variable whose value grows with a given constant derivative at each location. This variable can model, for instance, resource consumption, and one can find the cheapest run that allows to reach a given location. In fact, it was established in [START_REF] Bouyer | On the optimal reachability problem on weighted timed automata[END_REF] that the optimal reachability problem for weighted timed automata is PSPACE-complete.

The model naturally extends to games. Some partial decidability results for weighted timed games have been proposed in [START_REF] Alur | Optimal reachability for weighted timed games[END_REF][START_REF] Bouyer | Optimal strategies in priced timed game automata[END_REF]. However, the problem is undecidable in the general case [START_REF] Brihaye | On optimal timed strategies[END_REF][START_REF] Bouyer | Improved undecidability results on weighted timed automata[END_REF] even for a fixed number of clocks.

Both undecidability results are based on encodings of the configurations of Minsky machines. In these works, simulating the computations of these machines require distinguishing clock valuations with arbitrary precision, and the ability of checking for equalities. This suggests that the problem might become decidable when one introduces perturbations in the semantics, so as to disallow too precise encodings.

The goal of this chapter is to investigate the possibility of obtaining decidability results on weighted timed games when these are subject to perturbations. Our results are unfortunately mainly negative: in both excess and conservative perturbation game semantics, cost optimal reachability remains undecidable on weighted timed games. On weighted timed automata, we show that the problem is PSPACE-complete in the conservative perturbation game semantics, and that it is undecidable in the excess perturbation game semantics.

Cost-Optimal Reachability

Let us first present the cost-optimal reachability problems in the exact setting.

Recall that we write (ℓ, ν, c)| c = c and (ℓ, ν, c, d, e)| c = c for any state (ℓ, ν, c) or (ℓ, ν, c, d, e) of a weighted timed game in the exact or perturbed semantics. All related definitions can be found in Chapter 2. Given a target location ℓ, we define the cost of a run in any semantics as follows.

cost ℓ (ρ) = inf{state i (ρ)| c | 1 ≤ i ≤ |ρ|, loc(state i (ρ)) = ℓ}.
Hence, if ℓ is never reached, then the cost is ∞. Otherwise it is the infimum of the costs observed at location ℓ.

We will use the terminology of the perturbation game semantics in weighted timed games: Player 1 is called Controller, and Player 2 is called Perturbator. Given a weighted timed game A, and a target location ℓ, we denote by S C ( A ) the set of Controller's strategies, and by S P ( A ) the 147 set of Perturbator's strategies in A . For any pair of strategies (σ, σ ′ ) ∈ S C ( A ) × S P ( A ), we define the cost of the outcome of (σ, σ ′ ) as

cost ℓ σ,σ ′ ( A ) = cost ℓ (Outcome A (σ, σ ′ )).
We are interested in the least cost that Controller can ensure against any strategy of Perturbator. We define, for any weighted timed game A and target location ℓ,

value(A, ℓ) = inf σ∈SC ( A ) sup σ ′ ∈SP ( A ) cost ℓ σ,σ ′ ( A ).
When A is a weighted timed automaton, we define value(A, ℓ) by interpreting it as a weighted timed game where Perturbator has no edges. Equivalently,

value(A, ℓ) = inf ρ∈Runs( A ) cost ℓ (ρ).
We are interested in the following decision problems.

Definition 9.2.1. The OptReach strategy upper bound problem asks, given a weighted timed game A, a target location ℓ, and a rational λ, whether there exists a strategy σ ∈ S C ( A ) such that

sup σ ′ ∈SP ( A ) cost ℓ σ,σ ′ ( A ) ≤ λ.
Thus the above problem asks whether one can find a strategy that guarantees an upper bound on the cost. In the following problem, we are interested in deciding an upper bound on the infimum of the cost that can be guaranteed by Controller. Definition 9.2.2. The OptReach value upper bound problem asks, given a weighted timed game A, a target location ℓ, and a rational λ, whether value(A, ℓ) ≤ λ.

Clearly, a bound on the cost of some strategy implies the same bound on the value; the converse is not true.

This problem was also considered on weighted timed automata, that is, when Player 2 has no edges. In this case, the above problems simplify: The value upper bound problem consists in deciding an upper bound on inf ρ (cost ℓ (ρ)), where ρ ranges over all runs of the given weighted timed automaton; while the strategy upper bound asks whether the bound is satisfied for some run. Definition 9.3.2. The Lim-OptReach value upper bound problem for the excess (resp. conservative) perturbation game semantics asks, given a weighted timed automaton A, a target location ℓ, and a rational λ, whether lim-value exs (A, ℓ) ≤ λ (resp. lim-value cons (A, ℓ) ≤ λ).

We will also consider the restriction of these problems to weighted timed automata. Notice that the strategy strict upper bound problem is equivalent to deciding whether the strict upper bound holds for the value, that is the infimum of the limit cost over all possible strategies.

We show that neither the excess perturbation nor the conservative perturbation game semantics renders the Lim-OptReach problems decidable on timed games. Moreover, the problem even becomes undecidable in weighted timed automata under the excess perturbation game semantics.

Theorem 9.3.3. The Lim-OptReach strategy upper bound problem is undecidable for weighted timed automata under the excess perturbation game semantics, for a fixed number of clocks.

Theorem 9.3.3 is a rather surprising result. It reveals that adding perturbations can render problems intractable, which is the opposite of a common belief [START_REF] Asarin | Perturbed turing machines and hybrid systems[END_REF][START_REF] Fränzle | Analysis of hybrid systems: An ounce of realism can save an infinity of states[END_REF]. In this case, optimal reachability is PSPACE-complete for weighted timed automata under the exact semantics, but becomes undecidable under the excess perturbation game semantics.

The conservative robust semantics is more restrictive; we have already seen that reachability in timed automata is less costly than in the excess perturbation game semantics. In fact, we show that the Lim-OptReach value upper bound is PSPACE-complete: Theorem 9.3.4. The Lim-OptReach value upper bound problem is PSPACE-complete on weighted timed automata under the conservative perturbation game semantics.

However the Lim-OptReach strategy upper bound problem is also undecidable in the conservative semantics on weighted timed games.

Theorem 9.3.5. The Lim-OptReach strategy strict upper bound problem is undecidable for weighted timed games under the conservative perturbation game semantics, for a fixed number of clocks.

The undecidability also holds in both semantics when we consider the problem for a fixed δ: Theorem 9.3.6. The following problem is undecidable: For any fixed 0 ≤ δ ≤ 1 3 , given a weighted timed game A, a target location ℓ, and rational λ, decide whether

inf σ∈SC (G) sup σ ′ ∈SP (G) cost ℓ σ,σ ′ (G) < λ,
where G denotes either G exs δ (A) or G cons δ (A).

In the rest of this chapter, we present the proofs of the above theorems. The decidability result is obtained by adapting the corner-point abstraction [START_REF] Bouyer | On the optimal reachability problem on weighted timed automata[END_REF], while the undecidability results are based on reductions from the halting problem for Minsky machines [START_REF] Minsky | Computation: finite and infinite machines[END_REF], and on the encoding of [START_REF] Bouyer | Improved undecidability results on weighted timed automata[END_REF]. The instruction I n is the ending instruction, that is, the final state. The halting problem asks whether the instruction I n is reachable, starting from the configuration c 1 = 0, c 2 = 0, at instruction I 1 .

Encoding Minsky Machines

The proofs are based on the simulation of Minsky machines and the encoding of the instructions are based on that of [START_REF] Bouyer | Improved undecidability results on weighted timed automata[END_REF]. However all constructions must be modified in order to deal with perturbations. Our reduction uses 10 clocks x, x ′ , y, y ′ , u, u ′ , t, t ′ , z, z ′ . A counter of a Minsky machine with value n will be encoded by a pair of clocks x, x ′ with values k x + 1 2 n and k x ′ + 1 2 n for some integers k x , k x ′ . Here, k x is called the shift of x. If α denotes the clock x ′ , we let α ′ = x, and α ′′ = x ′ , and similarly for other clocks. A configuration of a Minsky machine with counter values n, m ≥ 0, is entirely encoded by four clocks:

x = k x + 1 2 n , x ′ = k x ′ + 1 2 n , y = k y + 1 2 m , y ′ = k y ′ + 1 2 m , (9.1)
for some shifts k x , k x ′ , k y , k y ′ . The redundancy in this encoding is necessary to cope with perturbations; this will be clear in the next section. We denote by k the vector of shifts, for all clocks, and by code k (n, m) the set of valuations satisfying (9.1). We also define code ǫ k (n, m) the set of valuations ν such that ν + η ∈ code k (n, m), where |η(α)| ≤ ǫ, η(α) = η(α ′ ) for all clocks α, and moreover η(x) = η(x ′ ) = 0 whenever n = 0, and η(y) = η(y ′ ) = 0 whenever m = 0. In other terms, code ǫ k (n, m) is the set of valuations that encode a configuration with an error bounded by ǫ, except that the encoding of the counter value 0 is exact. Given shifts k and a valuation ν ∈ code ǫ k (n, m), we denote frac(ν) = νk. This gives the fractional part of the clocks, except when n = 0, in which case the components x and x ′ are equal to 1. We say that a valuation ν encodes a configuration (n, m) of the machine if it satisfies (9.1) for some shift vector k.

Lim-OptReach Under Excess Perturbation

In this section, we reduce the halting problem on Minsky machines to the OptReach strategy upper bound problem on a weighted timed automaton we construct, which proves Theorem 9.3.3.

We define modules for incrementation and decrementation with zero-test instructions, which will, once combined, yield the reduction. The modules will be defined on a given list of clocks. For instance, if we describe a module M (x, y, z, u, t) which uses the clocks x, y, z, u, t in its definition, then M (z, y, x, t, u) is obtained simply by exchanging x and z, and u and t.

In this section, strategies and outcomes refer to the excess perturbation game semantics.

Unperturbed edges. Let us first present a construction that prevents Perturbator from perturbing the delays along an edge. The construction only applies to deterministic transitions (with equality constraints) and requires resetting one of the two clocks used in the encoding of a counter. Consider the timed automaton in Fig. 9.1(a). At ℓ 2 , Controller can go to the accepting state where the cost decreases to -∞ if, and only if Perturbator has perturbed by a nonzero amount the transition from ℓ 1 to ℓ 2 . Thus, Perturbator does not have interest in perturbing since its objective is to maximize the cost. If there has been no perturbation, the clock values are only increased or decreased by some integers. More precisely, the shifts of all clocks but x ′ increase by 2, and the shift of x ′ becomes 0. In the rest, we will use this trick extensively to construct our modules. For better readability, we will represent such unperturbed edges by dashed arrows; when clear from context, we may omit the edges leading to accepting sink states (see Fig. 9.1(b)).

Ask-Perturbator module. In weighted timed automata, unlike in weighted timed games, Perturbator cannot suggest moves since it has no edges. However, a special construction allows letting Perturbator decide the successor location. We describe in Fig. 9.2(a) such a construction, which also ensures that the configuration is preserved, upto shifts. The first edge is deterministic, and Perturbator can add any perturbation. Controller then distinguishes between positive and negative perturbations, and only has one possible move accordingly. We disallow perturbations (using unperturbed edges) at the edges leading to ℓ 2 or ℓ 3 , so that the configuration is preserved upto shifts. More precisely, the shifts of all clocks x, x ′ , y, y ′ increase by 3. To simplify the presentation of more complex modules, we will represent this module more compactly as in Fig. 9.2(b).

ℓ1 ℓ2 ℓ3 t,u,u ′ :=0 t=1 t:=0 t = 1 ∧ u ≤ 2 t = 1 ∧ u > 2 u=3 u ′ :=0 u=3 u ′ :=0 (
Reduction module. In the above modules, we have seen that configurations are preserved upto shifts, but the shifts could grow. We present now a module that reduces the shifts of all clocks. The module Reduce k (x, y, u, t) is constructed for each shift vector k (there will be a finite number of these), is deterministic, and contructed using unperturbed edges. Figure 9.3 defines one half of the module (named PReduce k (x, y, u, t)). Any run from ℓ 1 to ℓ 2 leaves the encoded configuration unchanged, but only modifies the shifts. This automaton reduces the shift of the clocks x, y (to 3 and 2, respectively) but the shifts of x ′ , y ′ increase by 5. The whole module Reduce k (x, y, u, t) is defined by concatenating PReduce k (x, y, u, t) and PReduce k (x ′ , y ′ , t, u), by merging the location ℓ 2 of the former with the location ℓ 1 of the latter. Note that u and t switch roles at the end of each PReduce k (•); in fact, u, u ′ are still needed at location ℓ 2 to verify that there has been no perturbation, so they cannot both be reset. Module PReduce k satisfies the following property, which implies Lemma 9.5.2.

Lemma 9.5.1. Let δ < 1 2 . Assume PReduce k (x, y, u, t) is entered with valuation ν ∈ code ǫ k (n, m) for some ǫ < 1 2 . Controller has a strategy to either go to the target location with cost -∞ or to reach location ℓ 2 with valuation ν ′ satisfying ν ′ = frac(ν) + k ′ where k ′ is defined as follows:

k ′ x = 2, k ′ x ′ = k x ′ + 2, k ′ y = 1, k ′ y = k y ′ + 5.
In the above lemma, the bound on δ and ǫ ensure that valuations in code ǫ k (n, m), when perturbed by δ differ by less than an integer from the exact valuation code k (n, m).

Lemma 9.5.2. Let δ < 1 2 . Assume Reduce k (x, y, u, t) is entered with valuation ν ∈ code ǫ k (n, m) for some ǫ < 1 2 . Controller has a strategy to either go to the target location with cost -∞ or to reach location ℓ 2 with valuation ν ′ satisfying ν ′ = frac(ν) + k ′ where k ′ is defined as follows: Test Module. In order to verify the incrementation and decrementation, we will use the cost variable. We first show how one can add 1 + frac(x) and 2frac(x) to the cost variable, without changing the configuration. The construction is similar to [START_REF] Bouyer | Improved undecidability results on weighted timed automata[END_REF]; we adapt it using unperturbed edges.

k ′ x = 6, k ′ x ′ = 2, k ′ y = 5, k ′ y ′ = 1. ℓ1 ċ=-1 ℓ2 u,u ′ :=0 x=kx+2, x:=0 y=ky+3, y:=0 u=4, u:=0 t,t ′ :=0 x=1∧x ′ =k x ′ +3 y = 1 ∧ y ′ = k y ′ + 4 u= 1∧ u ′ = 5
The module Add 1+x k (x, u, t) depicted in Fig. 9.4 adds 1 + frac(x) to the cost, leaving the configuration unchanged (upto shifts).

ℓ1 ċ=1 ċ=-1 ℓ2 u,u ′ :=0 x=kx+2, x:=0 u=3, u,t,t ′ :=0 (u=1∧u ′ =4) ∨(x=3∧x ′ =k x ′ +5) Figure 9.4: Module Add 1+x k (x, u, t).
Lemma 9.5.3. Let δ < 1 2 . Assume module Add 1+x k (x, u, t) is entered with valuation ν ∈ code ǫ k (n, m) for some ǫ < 1 2 . Controller has a strategy that ensures either reaching a target location with cost -∞ or location ℓ 2 with valuation ν ′ satisfying ν ′ = frac(ν) + k ′ where k ′ x = 1, and k ′ α = k α + 3 for all α ∈ {x ′ , y, y ′ , z, z ′ }, while the cost increases by 1 + frac(x).

We define similarly a module Add 2-x k (x, u, t) that adds 2frac(x) to the cost variable. The module is defined as in Fig. 9.4 except that c only increases (with slope 1) at location ℓ 1 . Lemma 9.5.4. Let δ < 1 2 . Assume module Add 2-x k (x, u, t) is entered with valuation ν ∈ code ǫ k (n, m) for some ǫ < 1 2 . Controller has a strategy that ensures either reaching a target location with cost -∞ or location ℓ 2 with valuation ν ′ satisfying ν ′ = frac(ν) + k ′ where k ′ x = 1, and k ′ α = k α + 3 for all α ∈ {x ′ , y, y ′ , z, z ′ }, while the cost increases by 2frac(x).

Now, concatenating modules

Add 1+x k (x, u, t), Add 2-x k ′ (z, t, u), and Add 2-x k ′′ (z, u, t), we obtain the module Add 5+x-2z k (x, z, u, t) that adds 5 + frac(x) -2frac(z) to the cost and yields to a target location (we make the last location accepting). Similarly, by concatenation, we define Add 4+2z-x k (x, z, u, t) that adds 4 + 2frac(z)frac(x) to the cost. One can append at the end of the module Add 4+2z-x k (x, z, u, t) an edge that increments the cost by 1, to define Add 5+2z-x k (x, z, u, t) (see Fig. 9.5). Finally, the module Test 2z=x (x, z, u, t) is defined by letting Perturbator choose whether to go to Add 5+2z-x k ′ (x, z, t, u) or to Add 5+x-2z k ′ (x, z, t, u) (here the new shift vector k ′ is due to the shift added by the ask-Perturbator module). Note that in both cases, the run ends in a target location. We have the following property. (x, z, u, t). The latter module is defined by appending one unperturbed transition with forcing the game to spend exactly one time unit at the last location of Add 4+2z-x k ′ (x, z, u, t).

Incrementation Module Aut k c1,+ . We now define a module Aut k c1,+ , given in Fig. 9.6, that simulates the incrementation of counter c 1 . For the sake of discussion, let us assume first that there is no perturbation. When the module is entered with a valuation in code k (n, m), we expect Controller to choose the delays so that z = 1 + frac(x) 2 at location D. From this point on, the clocks z, z ′ will switch roles with x, x ′ . Thus, this corresponds to incrementing the counter c 1 by 1. At location D, Perturbator can either decide to "test" the incrementation has been correctly performed by going to the test module, or to continue the simulation by first passing through the reduction module. Here, Instr k j refers to a module among Aut k c b ,+ , Aut k c b ,-for b ∈ {1, 2} (to be defined (n -1, m) for some k ′ , or the target location is reached with cost at most 5 + ǫ + 2δ. Moreover, if n = 1, then Controller can ensure that ν ′ (x) = k ′

x + 1.

Proof. If n = 0, then ν(x) = k x + 1. In this case, Controller can choose to move, after a delay of 1, to Instr k j . Controller wins by moving to a target location if Perturbator perturbs, otherwise the play continues in Instr k j . If n ≥ 1 and ǫ < 1 2 , then x ∈ k x + 1 2 n ± 1 2 , which means x < k x + 1. Therefore the guards of the edge leading to Aut k j is never enabled. Controller can go to B, where it delays 1 + 2frac(ν(x)). Due to perturbations, it will delay 1 + 2frac(ν(x)) ± δ at C. Thus, upon arrival to location D, the valuation satisfies frac(z) ∈ 1 2 n-1 ± 2ǫ ± δ. By Lemma 9.5.5, the cost increases by at most 5 + 2δ from here if the play goes into the test module. If n = 1, then Controller can go through C ′ and end in D with frac(z) = 2. Here, the the test module can increase the cost by at most 5 + ǫ + 2δ.

Complete reduction. To construct the complete reduction, we define for each instruction I j of the Minsky machine, a module Instr k j as one of the incrementation or decrementation modules according to the type of I i . We mark the first location of Instr k 1 as the initial location. The halting state Instr k n of the machine is an accepting location of the timed automaton. For machine M , let A M denote the weighted timed automaton constructed in this manner, and let ℓ denote the target location obtained by merging all target locations presented in the above construction.

Theorem 9.3.3 follows from the following proposition.

Proposition 9.5.8. Minsky machine M halts if, and only if there is a strategy σ ∈ S C (G exs (A M )) such that lim-cost exs σ (A M , ℓ) ≤ 5.

Proof. Assume that M halts, say after N steps. Since we are interested in the limit, fix any ǫ > 0 and assume that 0 < 3 N δ < ǫ. We let Controller play respecting the encoding: In modules Aut k ci,+ , it applies the strategy of Lemma 9.5.6 to increment the counter c i . In modules Aut k ci,-, it applies the strategy of Lemma 9.5.7 to decrement the counter c i . Note that this strategy does not depend on δ. At most N modules Aut k ci,• are visited since the target location is reached afterwards. Thus, by Lemma 9.5.9, along this play the configuration always belongs to code ǫ ′ k (n, m) for some k with ǫ ′ ≤ ǫ. By these lemmas, either the play simulates the whole path of M and ends in a target location, or it reaches a target sink location (with ċ = -1) earlier. This can be due either to a perturbation by Perturbator along unperturbed edges, or to Perturbator's choice to go to a test module. In both cases the cost is at most 5 + ǫ + 5δ ≤ 5 + 2ǫ, hence the limit is 5.

Assume now that M does not halt. Fix any strategy σ of Controller. If σ respects the encoding, i.e. always chooses z as frac(x) 2 or 2frac(x) in Aut kc i ,+ or Aut kc i ,-respectively, then the cost is ∞ if Perturbator never perturbs. Suppose now that σ "cheats" during the simulation at least once. We describe a strategy for Perturbator that leads to a limit cost greater than 5. Perturbator does not perturb the run, and waits until the first instant where Controller does not respect the encoding. This happens inside Aut k ci,+ or Aut k ci,-along a perturbed edge since all other edges are deterministic. Assume for instance the run under strategy σ arrives to location D of Aut kc i ,+ with z = 1 + frac(x) 2 + η for some η depending on σ. Then, Perturbator chooses to go to the test module, which accepts with cost at least 5 + η, by Lemma 9.5.5. Here, η only depends on the strategy σ, so the limit lim-cost exs σ (A M ) is at least 5 + η > 5.

The following is used in the above proof, to bound the accumulation of the error in the encoding.

Lemma 9.5.9. Consider the two functions f : x → 2x + 1 and g : x → x/2 + 1. For any n ≥ 1, x > 0, and any f 1 , . . . ,

f n ∈ {f, g}, f 1 • f 2 • . . . • f n (x) ≤ 3 n x.

Lim-OptReach Under Conservative Perturbation

One can argue that the undecidability in the excess perturbation game semantics is due to the ability of Controller to test clock values with precision using equality constraints, and in particular in detecting perturbations. This allows for instance letting Perturbator make a discrete choice, as in the above reduction. Hence, this ability and the possibility of disallowing perturbations on some edges make the semantics of weighted timed automata somehow close to that of two-player weighted timed games in the exact semantics for which the optimal-cost reachability is undecidable. The conservative perturbation game semantics disallows both abilities. In fact, in this semantics, Controller is required to suggest delays whose perturbations satisfy the guard of the chosen edge. This automatically excludes the use of equality constraints in the guards. Therefore, one cannot encode unperturbed edges as we did with the excess perturbation game semantics. Moreover, the ask-Perturbator module cannot be defined, at least not as previously.

Our result confirms these intuitions: we prove that limit-optimal reachability is PSPACE-complete for weighted timed automata. The algorithm is based on an adaptation of the corner-point abstraction restricted to punctual regions. On the other hand, we show that on weighted timed games, Lim-OptReach remains undecidable under the conservative perturbation game semantics. More precisely, we show the undecidability of the Lim-OptReach value strict upper bound problem. Our reduction uses the same encoding and similar constructions, but the players will switch roles in ensuring and checking the encoding.

We first present the algorithm for weighted timed automata, and then the undecidability result on weighted timed games.

Algorithm for Weighted Timed Automata

In this section, following [START_REF] Bouyer | On the optimal reachability problem on weighted timed automata[END_REF], we assume that the clock valuations never go above a given constant, so that all regions are bounded. This is not a loss of generality since we are interested in reachability in weighted timed automata; see [START_REF] Bouyer | On the optimal reachability problem on weighted timed automata[END_REF].

We recall the corner-point abstraction from [START_REF] Bouyer | On the optimal reachability problem on weighted timed automata[END_REF], a variant of the region automaton, on which optimal reachability problems can be solved on weighted timed automata. Definition 9.6.1. A finite weighted automaton is a tuple (S, s 0 , Σ, E, W ), where (S, s 0 , Σ, E) is a transition system, with S, Σ and E finite sets, and W : E → Z is the weight function.

We will call paths the runs of finite weighted automata, to distinguish these from timed automata runs. A path of a finite weighted automaton is defined as a run of the underlying transition system. Intuitively, a finite weighted automaton associates to any path the sum of the weights of the edges it visits. Given any path π = q 1 e 1 q 2 . . . q n , the weight of π is defined as W (π) = 1≤i<n W (e i ).

Let us consider a weighted timed automaton A = (L, ℓ 0 , C, Σ, E 1 , ∅, S). Notice that we use the notation for weighted timed games; the empty set here is the set of edges for Player 2. The corner-point abstraction of A is a finite weighted automaton, denoted R cp (A). The states of R cp (A) are triples (ℓ, r, v), where ℓ is a location, r a region, and v ∈ V(r) a vertex of r. Edges are defined as follows: we have (ℓ, r, v)

delay ---→ (ℓ, r ′ , v ′ ) if (ℓ, r) delay ---→ (ℓ, r ′ )
in the region automaton, and v ′ = v + k for some natural number k. In other terms, v ′ is a time-successor of v, and is a vertex of region r ′ . The weight associated to this transition is k × S(ℓ). Further, we have an edge (ℓ, r, v)

σ -→ (ℓ ′ , r ′ , v ′ ) if there is an edge (ℓ, g, σ, R, ℓ ′ ) in A such that r |= g, and v ′ = v[R ← 0], r ′ = r[R ← 0]. Such an edge has weight 0.
Let the non-punctual corner-point abstraction, denoted R np cp (A), be the finite weighted automaton obtained from the corner-point abstraction by removing any transition of the form (ℓ, r, v) delay ---→ (ℓ, r ′ , v ′ ), where r ′ is punctual. Thus, any path in the non-punctual corner-point abstraction corresponds to a non-punctual path in the region automaton.

We define the value of a finite weighted automaton as the cost of the shortest path to a given state. Formally, for any finite weighted automaton F = (S, s 0 , Σ, E, W ), and state s, let us write

value(F, s) = inf π∈Runs(F ) last(π)=s W (π).
For corner-point abstractions, we extend this notation to locations:

value(R cp (A), ℓ) = inf π∈Runs(Rcp(A)) loc(last(π))=ℓ W (π).
For any path π of the region automaton R(A) of A, we denote by Runs(π), the set of runs of A that follow π. If π is a path of the corner-point abstraction R cp (A), then we say that a run follows π if it follows the path projected to R(A) (that is, obtained by removing vertices in each state). We extend the notation Runs(π) to paths π of the corner-point abstraction.

For any path π of R(A) or R cp (A), let us define π obtained by replacing all regions by their topological closures. We say that a run follows π if all its states belong to the closure of the corresponding region in π, and the transitions match those of π.

We recall the following result on optimal cost reachability in the exact semantics.

Lemma 9.6.2 ([BBBR07]). Let A be a weighted timed automaton, and π a path in R(A). There exists a run ρ 0 that follows π, such that for all 1 ≤ i ≤ |ρ|, state i (ρ) ∈ V(state i (π)), and

last(ρ 0 )| c = inf ρ∈Runs(π) (last(ρ)| c ).
The previous lemma states that the infimum of the cost of the runs that follow a path of the region automaton is reached, in the limit, by a run that only visits the vertices of the regions. Such outcome ρ is a valid run that follows π. Moreover, since each delay can be perturbed at most by δ, we have last(ρ)| c ≤ last(ρ ǫ )| c + δ|π|S ≤ W (π) + ǫ + δ|π|S, where S is the maximal slope of the cost at locations visited by π. The lemma follows.

If not all delays of ρ ǫ are positive, then we choose another run ρ ′ ǫ with this property, such that d(ttrace(ρ ǫ ), ttrace(ρ ′ ǫ )) ≤ ǫ. This is possible since ttrace(π) is open. In this case, the above proof yields a run ρ with last(ρ)| c ≤ W (π) + 2ǫ + δ|π|S.

If value(R np cp (A), ℓ) = ∞, then ℓ is not reachable by any run, so lim-value cons (A, ℓ) = ∞. If value(R np cp (A), ℓ) = -∞, then one can construct the above strategy for any M < 0, considering a path π with W (π) < M , which yields lim-value cons (A, ℓ) = -∞.

Undecidability on Weighted Timed Games

We prove Theorems 9.3.5 and 9.3.6 using a reduction similar to the one in Section 9.5. In this section, strategies and outcomes refer to the conservative perturbation game semantics.

Test Module. We define the new module Add ′ 1+x k (x, u, t) depicted in Fig. 9.8. We do not have any guards on the edges; Controller checks at the last step whether all delays were chosen as expected. Recall that the dotted edges are uncontrollable edges, so they are taken by Perturbator. Here, there is no upper bound on the delays that can be suggested by Perturbator, so the cost can increase arbitrarily. However, the target sink state has a negative slope on variable c, so the cost is -∞ whenever Perturbator "cheats".

ℓ1 ċ=1 ċ=-1 ℓ2 u,u ′ :=0 x:=0 u,t,t ′ :=0 u ′ -u =3) ∨(x ′ -x =k x ′ +2) Figure 9.8: Module Add ′ 1+x k (x, u, t).
We define similarly modules Add ′ 2-x k (x, u, t). As previously, these modules can be combined to define Add ′ 5+x-2z k (x, z, u, t). Since it is now Perturbator's duty to respect the encoding, Controller will test the chosen values using the Test ′ x=2z k (x, z, u, t) module, in Fig. 9.9. Lemma 9.6.7. Assume that module Test ′ x=2z k (x, z, u, t) is entered at ℓ 1 with valuation ν ∈ code ǫ k for some 0 < ǫ < 1 2 . Then, Controller has a strategy to reach a target location with cost at most 5 -|frac(ν(x)) -2frac(ν(z))|.

ℓ1 ℓ2 ℓ ′ 2 ℓ3 ℓ ′ 3 ċ=-1 Add ′ 2z-x+5 k (x,z,u,t) Add ′ x-2z+5 k (x,z,u,t) t,u,u ′ :=0 t < 1 t < 1 t:=0 t:=0 u -t = 2 u -t = 2
Incrementation Module Aut ′ k ci,+ . Now, the module Aut ′ k c1,+ (x, y, z, u, t) that increments counter c 1 , given in Fig. 9.6, is defined similarly to the excess-perturbation case, by exchanging the roles of the players. Along this module, if Perturbator does not get the right value for z (which is z = 1 + frac(x)/2), then Controller can go to the test module and reach the target location with cost 5 -|2frac(z)frac(x)|; it can also continue to Instr ′ j k . We omit the definition of Reduce k ′ but it can be adapted from Reduce k without difficulty, similarly to Add ′ k modules: Perturbator determines the run, and Controller checks it afterwards. The module Aut ′ k c2,+ (x, y, z, u, t) is defined similarly by exchanging the roles of x and y.

We state the properties of module Aut ′ k c1,+ (x, y, z, u, t) more generally since we would like Controller to tolerate a bounded error in Perturbator's move:

A B C D ċ=-1 Test ′ 2z=x k ′ (x,z,t,u) Reduce ′ k Instr ′ j k ′′ u,u ′ :=0 x:=0 1<x<2,z,z ′ :=0 u,t,t ′ :=0 t < 1 t < 1 x ′ -x =k x ′ +2∨u ′ -u =4 Figure
sup σ ′ ∈SP (G exs δ (A)) cost ℓ σ,σ ′ (A ′ M ) < 5,
Proof. Assume that the machine halts, say in N steps. For any 0 < ǫ < 1 4 , we fix 0 < η < ǫ × 3 -N , and assume that 0 ≤ δ ≤ η. Controller follows the strategy given by Lemmas 9.6.8 and 9.6.9, respectively, in modules Aut ′ k ci,+ and Aut ′ k ci,-. Thus, Controller goes to the test module if and only if the error in the incrementation or decrementation is more than η, otherwise it continues the simulation. Then by Lemma 9.5.9, along any play, upon arrival to these modules the valuation belongs to code ǫ k (n, m) for some n, m. Thus, Controller reaches the target location with cost at most 5η. Note that δ has no effect here as long as it is less than 1 2 . In fact, the only edges that belong to Controller either yield to target locations, or the amounts of delays are irrelevant since exact timing is ensured by Perturbator in subsequent transitions.

Assume now that the machine does not halt. In this case, for any strategy of Controller, we let Perturbator respect the encoding exactly. The play is then either never reaches a target location, or it goes inside a test module and ends in a target location with cost 5.

Conclusion

In this chapter, we considered perturbation game semantics in weighted timed automata and games. The only decidable variant of the problem is the cost optimal reachability in weighted timed automata under the conservative perturbation game semantics, where PSPACE-completeness is established by adapting the corner-point abstraction. We also showed "robust undecidability" results for weighted timed games: optimal reachability problems remain undecidable under perturbation game semantics. Moreover, the problem even becomes undecidable for weighted timed automata in the excess perturbation game semantics.

The latter result is particularly surprising. In fact, in weighted timed automata, the decidability of the cost-optimal reachability without perturbations can be proved using the corner-point abstraction. Lemma 9.6.5 shows that runs with (approximately) optimal costs follow the paths in this construction by staying close, by some ǫ, to the vertices of a given path. In Chapter 7, we used similar ideas to obtain the decidability of the parameterized robust reachability in the excess perturbation game semantics. Our construction extends region automata by shrinking constraints, which mark subsets of facets of each region (rather than marking vertices, as in the corner-point abstraction). Our proof shows that Controller cannot avoid being close to these marked facets. Thus, although both techniques are similar, our undecidability result shows, perhaps counterintuitively, that the two techniques cannot be combined to construct an algorithm.

The encodings yielding undecidability are due, in both cases, to the ability of either of the players to play precisely, and the other one to check previous delays with precision. We conclude that game semantics do not introduce enough "fuzziness" in the semantics to avoid encoding undecidable languages.

The problems we have studied have several variants, and we did not study all here: the strategy upper bound problem for the conservative perturbation game semantics, and the strategy strict upper bound for the excess perturbation game semantics remain open. Furthermore, the decidability of the upper bounds on the value is also open for weighted timed games. We conjecture that these problems should be undecidable on weighted timed games. On the other hand, restricting to closed guards might yield to decidability, since then players would not be able to check the nonequality of the clock values.

Part IV

Robust Implementation

In this part, we present results on the robust implementation problem. Here, the goal is to transform a given timed automaton into one that is equivalent to the original one, in a precise sense, but also robust. Hence, in the robust implementation approach, a timed automaton model can be designed and checked using the exact semantics, and then (automatically) robustly implemented. We present two kinds of results. In Chapter 10, we give procedures to transform any timed automaton into one whose enlargement is approximately bisimilar to the original automaton. The same result holds for the sampling semantics. In Chapter 11, we study a concrete semantics for timed automata with a discrete clock, communication and synchronization delays. We prove that shrinkable timed automata preserve their behaviors, in the sense of time-abstract simulation equivalence and non-blockingness, under this semantics.

Chapter 10

Approximate Implementation

Introduction

We saw in Chapter 2 how new behaviours appear in timed automata under enlargement, while behaviours disappear under sampling. In this chapter, we investigate the possibility of modifying a given timed automaton so as to avoid robustness problems; we would like their enlarged and sampled semantics to preserve their exact semantics. Given any timed automaton A, we build another timed automaton B whose semantics under enlargement and under sampling is approximately bisimilar to A. Approximate bisimilarity is formalized by a quantitative variant of bisimulation from [START_REF] Fahrenberg | A quantitative characterization of weighted Kripke structures in temporal logic[END_REF] where the differences between the timings in two systems are bounded above by a parameter ǫ. Our construction is parameterized and provides a bisimilar implementation for any desired precision ǫ > 0.

Our results mean that all timed automata can be approximately implemented under guard enlargement or sampling. This provides a robust refinement / implementation procedure: one can design timed automata under the exact semantics, and then automatically obtain a correct-byconstruction implementation. Our results have also a theoretical implication: In Section 10.5, we show that several undecidable problems on timed automata remain undecidable for the class of robust timed automata.

The results of this chapter were published in [BLM + 11].

Preliminaries

Behaviourial Relations

We consider a quantitative extension of timed bisimilarity considered in [START_REF] Thrane | Quantitative analysis of weighted transition systems[END_REF]. This spans the gap between timed and time-abstract bisimulations: while the former requires time delays to be matched exactly, the latter ignores timing information altogether. Intuitively, we define two states to be ǫ-bisimilar, for a given parameter ǫ ≥ 0, if there is a (time-abstract) bisimulation which relates these states in such a way that, at each step, the difference between the time delays of corresponding delay transitions is at most ǫ. Thus, this parameter allows one to quantify the "timing error" made during the bisimulation. A strong and a weak variant of this notion is given in the following definition.

Definition 10.2.1. Given a TTS (S, s 0 , Σ, K, →), and ǫ ≥ 0, a symmetric relation R ǫ ⊆ S × S is a

• strong timed ǫ-bisimulation, if for any (s, t) ∈ R ǫ and σ ∈ Σ, d ∈ K, -s σ -→ s ′ implies t σ -→ t ′ for some t ′ ∈ S with (s ′ , t ′ ) ∈ R ǫ , -s d -→ s ′ implies t d ′ -→ t ′ for some t ′ ∈ S and d ′ ∈ K with |d -d ′ | ≤ ǫ and (s ′ , t ′ ) ∈ R ǫ .
• timed-action ǫ-bisimulation, if for any (s, t) ∈ R ǫ , and σ

∈ Σ, d ∈ K, -s d,σ --→ s ′ implies t d ′ ,σ --→ t ′ for some t ′ ∈ S and d ′ ∈ K with |d -d ′ | ≤ ǫ and (s ′ , t ′ ) ∈ R ǫ .
If there exists a strong timed ǫ-bisimulation (resp. timed-action ǫ-bisimulation) R ǫ such that (s, t) ∈ R ǫ , then we write s ∼ ǫ t (resp. s ≈ ǫ t). Furthermore we write s ∼ ǫ + t (resp. s ≈ ǫ + t) whenever for every ǫ ′ > ǫ, s ∼ ǫ ′ t (resp. s ≈ ǫ ′ t).

Observe that s ∼ ǫ t implies s ∼ ǫ ′ t for every ǫ ′ > ǫ. Also, s ∼ ǫ + t does not imply s ∼ ǫ t in general (see Fig. 10.1), and if s ∼ ǫ + t but s ∼ ǫ t, then ǫ = inf{ǫ ′ > 0 | s ∼ ǫ ′ t}. These observations hold true in the timed-action bisimulation setting as well. Note also that s ∼ ǫ t implies s ≈ ǫ t. Finally, for ǫ > 0, strong timed or timed-action ǫ-bisimilarity relations are not equivalence relations in general, but they are when ǫ = 0.

s s ′ t t ′ σ, x ≤ 1 σ, x < 1 Figure 10
.1: An automaton in which (s, 0) ∼ 0 + (t, 0) but (s, 0) ∼ 0 (t, 0).

Last, we define a variant of ready-simulation [START_REF] Kim | Bisimulation through probabilistic testing[END_REF] for timed transition systems. For Bad ⊆ Σ, we will write I ⊑ Bad S when I is simulated by S (and time delays are matched exactly) in such a way that at any time during the simulation, any failure (i.e., any action in Bad) enabled in S is also enabled in I. So, if I ⊑ Bad S and S is safe w.r.t. Bad (i.e., Bad actions are never enabled), then any run of I can be executed in S (with exact timings) without enabling any of the Bad-actions. Fig. 10.2 shows an automaton illustrating the importance of this notion. More formally: Definition 10.2.2. Given a TTS (S, s 0 , Σ, K, →), and a set Bad ⊆ Σ, a relation R ⊆ S × S is a ready-simulation w.r.t. Bad if, whenever (s, t) ∈ R:

• for all σ ∈ Σ and d ∈ K, s d,σ --→ s ′ implies t d,σ --→ t ′ for some t ′ ∈ S with (s ′ , t ′ ) ∈ R, • for all σ ∈ Bad, t σ = ⇒ t ′ implies s σ = ⇒ s ′ for some s ′ ∈ S.
We write s ⊑ Bad t if (s, t) ∈ R for some ready-simulation R w.r.t. Bad.

We write A ∼ ǫ B , A ≈ ǫ B and A ⊑ Bad B when the initial states of timed automata A and B are related accordingly in the disjoint union of the transition systems.

Refined Regions

Let Q ∞ = Q ∪ {-∞, ∞}. For M, η ∈ Q >0 such that 1 η ∈ N, we denote by Φ C (η, M
) the set of guards on the clock set C, whose constants are either ±∞ or less than or equal to M in absolute value and are integer multiples of η. Remember that Φ C denotes the set of all guards on clock set C. We call the inverses of positive integers granularities. The granularity of a timed automaton is the inverse of the least common denominator of the finite constants in its guards.

We will define a a more general version of the regions defined in Chapter 2. Observe that region equivalence could also be defined by relating valuations that cannot be distinguished by (some subset of) guards. In fact, all conditions defining regions, such as fractional ordering, equality of integer parts can be encoded using guards. Here, we will use this approach rather than explicitly defining the (refined) region equivalence.

Let M be the maximum (rational) constant that appears in the guards of A, let η be the granularity of A. Multiplying any constant in A by 1 η , we obtain an integral timed automaton. Given valuations u, v ∈ R C ≥0 and rationals M, η, define v ≃ M η u to hold if, and only if, for all formulas φ ∈ Φ C (η, M ), u |= φ if and only if v |= φ. The equivalence class of a valuation u for the relation ≃ M η is denoted by reg(u) M η = {v | u ≃ M η v}. Each such class is called an (η, M )-region. In the rest, when constant M is (resp. M and η are) clear from context, we simply write reg(u) η (resp. reg(u)) and call these η-regions (resp. regions). We denote by reg(u) M η the topological closure of reg(u) M η , for the usual topology on R C . The number of (η, M )-regions is bounded by

O(2 |C| |C|!(M/η) |C| ) [AD94].
In our definition of regions, we thus treat 1 M as the unit value. Notice that if all constants are integers, then we have M = 1 and our definition gives the usual notion of region equivalence. To understand the effect of M , consider valuations u = (0.5, 0.5) and v = (0.4, 0.4). Let K ≥ 1. We have reg(u) 1 = reg(v) 1 , since this is the usual notion of region equivalence. However, reg(u) 2 = reg(v) 2 since the formula x < 0.5 distinguishes these valuations. It is clear that 1-regions are unions of M -regions for any M ≥ 1.

We define tsucc * (r) as the set of time-successor regions of r, that is, the set of η-regions r ′ such that u + d ∈ r ′ for some u ∈ r and d ∈ R ≥0 .

We now associate with each (η, M )-region r a guard φ r in Φ(M, η) that defines r. We assume φ r to be normalized, that is, the DBM corresponding to φ r is normalized (see Section 3.3).

Implementability

In this chapter, we use the term robustness to refer to behaviour preservation under guard enlargement, while samplability refers to behaviour preservation under sampling of time. We give several definitions which distinguish timed automata whose enlargement (resp. whose sampled semantics) is ǫ-bisimilar to the original automaton, for some ǫ.

Robustness

The approach taken in Chapter 4 and earlier work [Pur00, DDMR08] concentrated on comparing timed automata A and some enlargement A ∆ with respect to untimed language equivalence, or the satisfaction of a given logic formula. Here, we consider a stronger notion of robustness which requires two systems to be ǫ-bisimilar for some ǫ.

Definition 10.3.1. A timed automaton A is ǫ-bisimulation-robust (or simply ǫ-robust), where ǫ ≥ 0, if there exists ∆ > 0 such that A ≈ ǫ A ∆ .

Clearly, not all timed automata are robust in this sense, since the timed automaton A 2 of Fig. 2.2 is not robust even for location reachability.

We do not know whether a timed automaton that is robust for some ∆ is still robust for any

∆ ′ < ∆, that is, whether A ≈ ǫ A ∆ implies A ≈ ǫ A ∆ ′ for ∆ ′ < ∆,
in general. This is the so-called "faster-is-better" property [START_REF] Altisen | Implementation of timed automata: An issue of semantics or modeling[END_REF][START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF], which means that if a property holds in some platform, it also holds in a faster or more precise platform. This is known to be satisfied for simpler notions of robustness mentioned above. Bisimulation is not always sufficient for refining systems when one wants to preserve state-based safety properties proven for A. For instance, removing edges leading to unsafe states in A may provide us with a trivially safe automaton under any enlargement. However, edges leading to such states are used to detect failures, so removing these will not necessarily remove the failure itself (since the states that immediately trigger a failure may still be reachable). Fig. 10.3 gives such an "incorrect" construction. To cope with this problem, we rely on ready-simulation and require A ′ to satisfy A ′ ∆ ⊑ Bad A ∆ , where Bad are distinguished actions leading to unsafe states in A. This means that any run of A ′ ∆ can be realized in A ∆ , and that no Bad-action is enabled in that run in the latter (and hence no unsafe state is reached). Thus, intuitively, no state reached in A ′ ∆ corresponds to an unsafe state in A ∆ , and in particular, if A ∆ has unsafe runs (leading to unsafe states), then these cannot be realized in A ′ ∆ . Clearly, the automaton in Fig. 10.3 does not satisfy this. We formalize this idea here.

Definition 10.3.2. A timed automaton A is safe w.r.t. a set of actions Bad ⊆ Σ, if d ∞ Reach( A ), Pre(Bad) > 0
, where d ∞ is the standard infinity metric, and Pre(Bad) = σ∈Bad,(ℓ,g,σ,R,ℓ ′ )∈E {ℓ} × g is the precondition of Bad-actions Here, Pre(Bad) is the set of states from which a Bad action can be done. Note that d ∞ (Reach( A ), Pre(Bad)) = 0 does not imply that a state of Pre(Bad) is reachable in A. But we still consider such an automaton as unsafe, since, intuitively, any enlargement of the guards may lead to a state of Pre(Bad). It can be seen that automaton of Fig. 10.2 is safe w.r.t. action Bad. Note that a closed timed automaton is safe w.r.t. Bad if, and only if Bad is not reachable, since the state space is topologically closed [START_REF] Gupta | Robust timed automata[END_REF].

We also define a robustness notion requiring only safety properties, as in [Pur00, DDMR08].

Definition 10.3.3. A timed automaton A is safety-robust (w.r.t. Bad) if there exists ∆ > 0 such that A ∆ is safe w.r.t. Bad.

In the rest, Bad will refer to a set of actions given with the timed automaton we consider. When we say that a timed automaton is safe, or safety-robust, these actions will sometimes be implicit.

We introduce the notion of safety-robust implementation (parameterized by a bisimilarity relation ≡, which will range over {∼ 0 , ∼ 0 + , ≈ 0 , ≈ 0 + }), where we only require the alternative automaton to preserve a given safety specification.

Definition 10.3.4 (Safety-Robust Implementation). Let A be a timed automaton which is safe w.r.t. actions Bad, and ≡ denote any bisimilarity relation. A safety-robust implementation of A w.r.t ≡ is a timed automaton A ′ such that: (i) A ′ is safety-robust;

(ii) A ′ ≡ A ;

(iii) there exists ∆ 0 > 0 s.t. for all 0 < ∆ ′ < ∆ < ∆ 0 , A ′ ∆ ′ ⊑ Bad A ∆ . Now we define the notion of robust implementation. We require such an implementation to be robust and equivalent to the original automaton, and to preserve safety specifications.

Definition 10.3.5 (Robust Implementation). Let A be a timed automaton which is safe w.r.t. actions Bad, and ≡ denote any bisimilarity. An ǫ-robust implementation of A w.r.t. ≡ is a timed automaton A ′ such that:

(i) A ′ is ǫ-robust; (ii) A ′ ≡ A ; (iii) there exists ∆ 0 > 0 s.t. for all 0 < ∆ ′ < ∆ < ∆ 0 , A ′ ∆ ′ ⊑ Bad A ∆ .

Samplability

We now consider the sampled semantics, and define samplability. Similarly to the robustness definitions, we are interested in approximate bisimulation between the exact semantics and the sampled one.

Definition 10.3.6. A timed automaton is said to be ǫ-bisimulation-samplable (or simply ǫsamplable) if there exists a granularity η such that A ≈ ǫ A η .

Note that not all timed automata are bisimulation-samplable: [KP05] describes timed automata A which are not (time-abstract) bisimilar to their sampled semantics for any granularity η. We define a sampled implementation as follows.

Definition 10.3.7 (Sampled Implementation). Let A be a timed automaton, and ≡ denote any bisimilarity relation. A ǫ-sampled implementation w.r.t. ≡ is a timed automaton A ′ such that (i) A ′ is ǫ-samplable;

(ii) A ′ ≡ A .

Note that a similar phenomenon as in Fig. 10.2 does not occur in sampled semantics since sampling does not add extra behaviour, but may only remove some; so we do not need the ready simulation condition.

Constructions

We will present two constructions which yield an implementation for any timed automaton. In our first construction, for any timed automaton given with a safety specification, we construct a safety robust implementation. Our second construction is stronger: Given any timed automaton A and any desired ǫ > 0, we construct a timed automaton A ′ which is both an ǫ-robust implementation and an ǫ-sampled implementation of A w.r.t. ≈ 0 + (we also give a variant w.r.t. ∼ 0 for robustness).

Since, A and A ′ ∆ are timed-action ǫ-bisimilar, all standard untimed linear-and branching-time properties (e.g. expressible in LTL, resp. CTL) proven for the original automaton are preserved in the implementation. An example of such a property is deadlock-freedom, which is an important property of programs. Moreover, respective delays are close by ǫ. This also implies that in a quantitative extension of the computation tree logic studied in [START_REF] Fahrenberg | A quantitative characterization of weighted Kripke structures in temporal logic[END_REF], formulas approximately preserve their satisfaction values between two ǫ-bisimilar systems (see [BLM + 11]).

Theorem 10.3.8. Let A = (L, ℓ 0 , C, Σ, E) be an integral timed automaton which is safe w.r.t. some set Bad ⊆ Σ. Let W denote the number of regions of A. Then, 1. There exists a safety robust implementation of A w.r.t ∼ 0 , with |L| locations, the same number of clocks and at most |E| • W edges.

2. For all ǫ > 0, there exists a timed automaton A ′ which is a ǫ-robust implementation w.r.t. ∼ 0 ; and a timed automaton A ′′ which is both a ǫ-sampled and ǫ-robust implementation w.r.t. ≈ 0 + . Both timed automata have the same number of clocks as A, and the number of their locations and edges is bounded by

O(|L| • W • ( 1 ǫ ) |C|
). We will now detail the construtions stated in Theorem 10.3.8. The proofs are given in subsequent sections.

For any timed automaton A and any location ℓ of A, let Reach( A )| ℓ denote the projection of the set of reachable states at location ℓ to R C ≥0 . For any ℓ, there exists guards φ ℓ 1 , . . . , φ ℓ n l such that i φ ℓ i = Reach( A )| ℓ (in fact, the set of reachable states at a given location is a union of regions but not necessarily convex). We use these formulas to construct a new automaton where we restrict all transitions to be activated only at reachable states.

Definition 10.3.9. Let A = (L, ℓ 0 , C, Σ, E) be any integral timed automaton. Define timed automaton safe(A) from A by replacing each edge ℓ

φ,σ,R ---→ ℓ ′ , by edges ℓ φ∧φ ℓ i ,σ,R ------→ ℓ ′ for all i ∈ {1, . . . , n ℓ }.
As stated in Theorem 10.3.8 the worst-case complexity of this construction is exponential. However, in practice, Reach( A )| ℓ may have a simple shape, which can be captured by few formulas φ ℓ i .

Although the above construction will be enough to obtain a safety-robust timed automaton w.r.t. a given set Bad, it may not be bisimulation-robust. The following construction provides bisimulation-robustness.

Definition 10.3.10. Let A = (L, ℓ 0 , C, Σ, E) be an integral timed automaton. Let M be the largest constant that appears in A, and let η be any granularity. We define impl η (A) as a timed automaton over the set of locations ℓ r where ℓ is a location of A and r is an (η, M )-region, and over the same set of clocks. Edges are defined as follows. Whenever there is an edge ℓ

φ,σ,R ---→ ℓ ′ in A, we let ℓ r φ∧φs,σ,R ------→ ℓ ′ s[R←0]
, for all (η, M )-regions r and s ∈ tsucc * (r) such that φ s ⊆ φ . We define impl η (A) as the closed timed automaton obtained from impl η (A) where each guard is replaced by its closed counterpart1 .

In this chapter, we always consider integral timed automata as input, and the only non-integer constants are those added by our construction. Observe that the size of impl η (A) depends on η, since a smaller granularity yields a greater number of (η, M )-regions.

The main theorem is a direct corollary of the following lemma, where we state our results in detail. The bounds on the size of the constructed implementations follow by construction.

Proposition 10.4.2. Let s denote a region, and φ a guard. If φ s ⊆ φ , then φ s ∆ ⊆ φ ∆ .

Proposition 10.4.3. Let u ∈ R C ≥0 such that u ∈ φ s ∆ for some region s. Then for all s ′ ∈ tsucc * (s), there exists d ≥ 0 such that u + d ∈ φ s ′ ∆ .

Proof. We only need to prove the case where s ′ is the immediate time-successor of s. Let A denote the DBM that defines s, and A ′ the DBM that defines s ′ .

Let u ∈ φ s ∆ . All time-successor regions of s contain the exact same diagonal constraints as s (since (x + d) -(y + d) = xy.) Then all we need to show is that constraints of the form

-A ′ 0,x -∆ ≺ A ′ 0,x x ≺ A ′
x,0 A ′ x,0 + ∆ is satisfied by a time-successor of u. First, assume that some clocks have integer values in s, say -A 0,x = A x,0 for x ∈ I for some non-empty I ⊆ C, and that A x,0 < M (the case where A x,0 = M is similar). Then A ′ is obtained by replacing these constraints by A x,0 < x < A x,0 + 1 for all x ∈ I. We have A x,0 -∆ ≤ u(x) ≤ A x,0 + ∆ for all x ∈ I, so the enlargement of the above constraint is satisfied by u unless u(x) = A x,0 -∆ for some x ∈ I. In this case, we only need to delay d > 0 so that A x,0 -∆ < u(x) + d < A x,0 . Since any constraint of A which is not an equality is a strict inequality, this delay can be chosen small enough so that all other constraints are still satisfied. Now, suppose no clock has an integer value in s. Let x denote a clock that has the largest fractional part in s (there may be several clocks x). Then s satisfies A x,0 -1 < x < A x,0 . But then A ′ , which describes the immediate time-successor of s, is obtained from A by replacing the above constraint by x = A x,0 . We know that A

x,0 -1 -∆ < u(x) < A x,0 + ∆ by hypothesis. If u(x) ≥ A x,0 -∆ then u ∈ φ s ′ ∆ . Otherwise, we show that u + d ∈ φ s ′ ∆ , where d = A x,0 -u(x).
For all clocks y, we have to verify that A y,0 -1 -∆ < u(y) + d < A y,0 + ∆ for all x = y (these define A ′ , along with the diagonal constraints which are the same as in A). We have,

A y,0 -1 -∆ < u(y) + (A x,0 -u(x)) < A y,0 + ∆ ⇐⇒ A y,0 -1 -A x,0 -∆ < u(y) -u(x) < A y,0 -A x,0 + ∆ ⇐⇒ A x,0 -A y,0 -∆ < u(x) -u(y) < A x,0 + 1 -A y,0 + ∆,
which is true by the fact that φ s is normalized. and that x has the greatest fractional part in s.

The previous proposition is no longer valid if φ s is not normalized. As an example, take the region defined by x = 1 ∧ y = 0, whose immediate successor is 1 < x < 2 ∧ 0 < y < 1 ∧ xy = 1. The enlargement of the former formula is satisfied by valuation (x = 1 -∆, y = ∆) but this has no time-successor that satisfies the enlargement of the latter.

Last, we need the following proposition which provides a bound on the delay that it takes to go from a region to another. Proposition 10.4.4. Let r be a region, and s a time-successor region of r, and ∆ ≥ 0. Suppose that u ∈ φ r and u + d ∈ φ s for some d ≥ 0. Then for any v ∈ φ r ∆ , there exists

d ′ ≥ 0 such that v + d ′ ∈ φ s ∆ and |d ′ -d| ≤ 2η + 2∆.
Proof. First, observe that d ′ such that v + d ′ ∈ φ ∆ exists by Proposition 10.4.3. We distinguish the following cases.

If all clocks are above the maximal constant M in r, then the statement is true for d ′ = d. If all clocks are above the maximal constants only in s, then let x be the clock with the smallest value in r. Suppose that r satisfies A x,0η < x < A x,0 . Then d must be greater than M -A x,0 -∆, Proof. We fix any η and ∆, and define relation R ⊆

(L × R C ) × (L × R C ) between impl η (A) and impl η (A) ∆ by (ℓ r , u)R(ℓ ′ r ′ , u ′ ) whenever ℓ r = ℓ ′ r ′ and ∀s ∈ tsucc * (r), ∃d ≥ 0, u + d ∈ φ s ⇐⇒ ∃d ′ ≥ 0, u ′ + d ′ ∈ φ s ∆ .
(10.2)

The difference with the previous lemma is that we now use the closures of formulas φ r . Initial states satisfy (ℓ 0 , 0)R(ℓ 0 , 0). In fact all closures of time-successor regions of 0 are reachable by a delay in both systems. Let (ℓ r , u) and (ℓ r , u ′ ) be two states of impl η (A) and impl η (A) ∆ respectively, such that (ℓ r , u)R(ℓ r , u ′ ). Suppose (ℓ r , u) delays d and takes the edge

ℓ r φ∧φs,a,R ------→ ℓ ′ s[R←0]
. By construction, s is a time-successor of r and s ⊆ φ . By (10.2), there exists

d ′ ≥ 0 such that u ′ + d ′ ∈ φ s ∆ . Then we also have u ′ + d ′ ∈ φ ∆ = φ ∆ since φ s ⊆ φ and by Proposition 10.4.2. It remains to show that (ℓ ′ s[R←0] , (u + d)[R ← 0])R(ℓ ′ s[R←0] , (u ′ + d ′ )[R ← 0]). We have (u + d)[R ← 0] ∈ φ s[R←0] and (u ′ + d ′ )[R ← 0] ∈ φ s[R←0] ∆ .
The former follows from the properties of regions, and the latter from Proposition 10.4.1. Then the set of time successor regions that are reachable by a delay are exactly all time successor regions of s[R ← 0] in both systems: in impl η (A) this is obvious from the region automaton construction, and in impl η (A) ∆ from Proposition 10.4.3.

We now prove the symmetric case although it is similar. Suppose (ℓ r , u ′ ) delays d ′ and takes

the edge ℓ r φ∧φs,a,R ------→ ℓ ′ s[R←0]
. By construction, s is a time-successor of r and s ⊆ φ . By (10.2), there exists d ≥ 0 such that u + d ∈ φ s . Since φ s ⊆ φ by construction, (ℓ r , u + d) satisfies the guard φ ∧ φ s . Now, one can show that (ℓ

′ s[R←0] , (u + d)[R ← 0])R(ℓ ′ s[R←0] , (u ′ + d ′ )[R ← 0]
) as in the previous case.

The index 2(η + ∆) of the bisimulation relation follows from Proposition 10.4.4.

The parameter which we provide for the timed-action bisimilarity is (almost) tight. In fact, consider the automaton in Figure 10.2, where the guard of the edge entering ℓ 1 is changed to x ≤ 1. Fix any η and ∆ and consider the following cycle in impl η (A):

(ℓ 1,r1 ) - → (ℓ 2,r2 ) - → (ℓ 1,r1 ),
where r 1 is the region 1 -η < x < 1 ∧ y = 0, and r 2 is the region x = 0 ∧ 1 < y < 1 + η. Suppose impl η (A) ∆ first goes to location (ℓ 1,r1 ) with x = 1 + ∆, y = 0, and that this is matched in impl η (A) by (ℓ 1,r ′ 1 , (x = 1 -α, y = 0)) where necessarily α ≥ 0. It is shown in [START_REF] De Wulf | Robust safety of timed automata[END_REF] that in any such cycle, the enlarged automaton can reach (by iterating the cycle) all states of the region r 1 at location ℓ 1 (See also Chapter 4). In particular, impl η (A) ∆ can go to state (ℓ 1,r1 , (x = 1 -η, y = 0)). However, without enlargement, all states (ℓ 1 , r ′ 1 , (v ′ x , v ′ y )) reached from a state (ℓ 1,r1 , (v x , v y )) with v y = 0 satisfy v ′

x ≥ v x , that is, the value of the clock x at location ℓ 1 cannot decrease along any run. Thus, the state (ℓ 1,r1 ,

(x = 1 -η, y = 0)) of impl η (A) ∆ is matched in impl η (A) by some state (ℓ 1,r ′′ 1 , (v ′ x , 0
)) where v ′ x ≥ 1 -α. Now, from there, impl η (A) ∆ can delay 1 + ∆ + η and go to ℓ 2 , whereas impl η (A) can delay at most 1 + α to take the same transition. The difference between the delays at the first and the last step is then at least max ∆ + α,

1 + ∆ + η -(1 + α) ≥ ∆ + η/2.
Next, we show that safe(A) and impl η (A) are strongly 0-bisimilar to A.

Lemma 10.4.7. For any timed automaton A, we have safe(A) ∼ 0 A , and A ∼ 0 impl η (A) for any granularity η.

Proof. Fix any η. All regions in this proof will refer to (η, M )-regions where M is the maximal constant of A. Let A = (S, s 0 , Σ, T ) and impl η

(A) = (S ′ , s ′ 0 , Σ, T ′ ), consider relation R ⊆ S × S ′ defined by, R = {(ℓ, v), (ℓ r , v) | reg(v) ∈ tsucc * (r), (ℓ, v) ∈ S and (ℓ r , v) ∈ S ′ }.
Consider any (ℓ, v) R (ℓ r , v) and suppose (ℓ, v) a -→ (ℓ ′ , v ′ ) in A . Then there must be an edge

ℓ φ,a,R ---→ ℓ ′ in A such that v ∈ φ and v ′ = v[R ← 0]
. By construction there exists an edge

ℓ r φ∧φ reg(v) ,a,R ---------→ ℓ reg(v)[R←0] in impl η (A)
. This is because reg(v) ∈ tsucc * (r) and reg(v) ⊆ φ (since v ∈ φ and clock formulae cannot distinguish points in the same region). Valuation v obviously satisfies φ ∧ φ reg(v) . We have

v ′ = v[R ← 0] so reg(v ′ ) = reg(v)[R ← 0], thus reg(v ′ ) ∈ tsucc * (reg(v)[R ← 0]). Therefore (ℓ ′ , v ′ )R(ℓ ′ reg(v)[R←0] , v ′
). The symmetric case, and the timed transitions are equally simple to see. The proof of A ∼ 0 safe(A) follows from the fact that strengthening the guards by the description of reachable states does not change the semantics (it only does so for the enlarged automaton).

The proof of A ≈ 0 + impl η (A) is trickier. In fact, since all guards are closed in impl η (A), but not necessarily in A, all time delays may not be matched exactly. The first part of the proof follows the lines of Proposition 16 of [START_REF] Ouaknine | Revisiting digitization, robustness, and decidability for timed automata[END_REF], who, by a similar construction, prove that the finite timed traces of A are dense in those of impl η (A) , for an appropriate topology. Their result has a similar flavor, but we consider 0 + -bisimulation which cannot be interpreted in terms of density in an obvious way.

Lemma 10.4.8. For any timed automaton A and granularity η, A ≈ 0 + impl η (A) .

Proof. We fix any η and δ ∈ (0, 1). We define

(ℓ, v)R(ℓ r , v ′ ) iff r = reg(v), v ′ ∈ reg(v) and ∃v ′′ ∈ reg(v), v = δv ′′ + (1 -δ)v ′ . (10.3)
We show that R is a timed-action 0 + -bisimulation. Initial states clearly satisfy (10.3) by letting v ′′ be equal to both valuations. Consider now states

(ℓ, v) R (ℓ r , v ′ ). Let v ′′ ∈ reg(v) such that v = δv ′′ + (1 -δ)v ′ . We prove the two directions. • Suppose (ℓ r , v ′ ) d ′ ,σ --→ (ℓ ′ r ′ , v ′ + d ′ [R ← 0]) in impl η (A) , using the edge ℓ r φ∧φs,σ,R
------→ ℓ ′ r . Since s (the region described by φ s ) is a time-successor of reg(v) by construction, there exists some

d ′′ ≥ 0 such that v ′′ + d ′′ ∈ s. Then (ℓ, v) d,σ --→ (ℓ ′ , (v + d)[R ← 0]) as (ℓ, v) d -→ (ℓ, v + d) σ -→ (ℓ ′ , (v + d)[R ← 0]), using the edge l φ,σ,R ---→ ℓ ′ in A and d = δd ′′ + (1 -δ)d ′ . Now v + d ∈ φ because v ′′ + d ′′ ∈ s, v ′ + d ′ ∈ s and v + d = δ(v ′′ + d ′′ ) + (1 -δ)(v ′ + d ′ ) with 0 < δ < 1 (in fact, v + d must
be in reg(s) and not only in reg(s)).

Also (v + d)[R ← 0] = δ(v ′′ + d ′′ )[R ← 0] + (1 -δ)(v ′ + d ′ )[R ← 0], and (v ′′ + d ′′ )[R ← 0] ∈ s[R ← 0] = reg(v + d)[R ← 0], thus (ℓ ′ , (v + d)[R ← 0]) R (ℓ ′ s[R←0] , (v ′ + d ′ )[R ← 0]).
• Symmetrically, suppose that (ℓ, v) We now prove that relation R has parameter at most 2δ. In fact, whenever we have (ℓ, v) R (ℓ r , v ′ ), valuation v ′ and the corresponding valuation v ′′ reside in the (closure of the) same region, and at each transition, these delay into the (closure of the) same region. Then the difference between these delays is at most 2 (in fact, 2η) by Proposition 10. The result follows since δ was chosen arbitrarily.

Note that it may be the case that impl η (A) ∼ k A for all k ≥ 0. In fact, consider a location with outgoing edges respectively guarded by x < 1, x = 1, x > 1. Then impl η (A) is able to delay to x = 1 (say, starting from x = 0) where it satisfies all the guards but A cannot delay to such a point.

Lemma 10.4.9. Let v, v ′ , v ′′ ∈ R ≥0 such that v ′′ ∈ reg(v) and v ′ ∈ reg(v), and v = ǫv ′′ + (1 -ǫ)v ′ for some ǫ ∈ (0, 1). Then for all d ≥ 0, there exists d ′ , d ′′ ≥ 0 s.

t. v + d = ǫ(v ′′ + d ′′ ) + (1 -ǫ)(v ′ + d ′ ), v ′′ + d ′′ ∈ reg(v + d) and v ′ + d ′ ∈ reg(v + d).
Proof. Write R 1 for region reg(v) and R 2 for its immediate successor. We will prove the property when v + d ∈ R 2 . The general case is then a consequence. Second case: assume D ∩ R 2 is not a singleton. In that case D ∩ R 1 is the singleton {v}, and one of the constraints which define R 1 is of the form x = c. And D ′ ∩ R 1 and D ′′ ∩ R 1 are also singletons, {v ′ } and {v ′′ } respectively. If R 2 has no immediate successor, then this is easy, for any d ′ > 0 we can find d ′′ > 0 that satisfies the desired property. Assume that R 2 has an immediate successor R 3 , one of the constraints that defines R 3 being y = e. Also, by definition of the immediate successor, for any 0 < d ′ such that v ′ (y) + d ′ < e, it is the case that v ′ + d ′ ∈ R 2 . Similarly for any 0 < d ′′ such that v ′′ (y) + d ′′ < e, it is the case that v ′′ + d ′′ ∈ R 2 . Define λ = d e-v(y) , and set d ′ = λ(ev ′ (y)) and d ′′ = λ(ev ′′ (y)). We have that v ′ + d ′ ∈ R 2 and v ′′ + d ′′ ∈ R 2 . A simple computation yields that ǫ(v

′′ + d ′′ ) + (1 -ǫ)(v ′ + d ′ ) = v + d.
This concludes the proof. that from this state, an action of Bad is enabled in A ∆ , after a possible delay. There exists d ≥ 0 such that u + d ∈ φ ∆ , where φ denotes the guard of the edge with a label in Bad. State (ℓ, u) cannot be the initial state since this would contradict the safety of A . In fact, we would have d ∞ (reg(d), φ ) ≤ ∆ which implies φ ∩ reg(d) = ∅. Therefore, (ℓ, u) must have a reachable predecessor in safe(A) ∆ , say (ℓ ′ , u ′ ) d ′ ,σ ′ ---→ (ℓ, u), following some edge ℓ ′ σ ′ ,g∧φ ℓ j ,R ------→ ℓ. By definition, all points of φ ℓ j are reachable in A at location ℓ. We have u ′ + d ′ ∈ φ ℓ j ∆ . So there exists a state (ℓ, v) which is reachable in A such that d ∞ (u, v) ≤ ∆. But, we assumed that u + d ∈ φ ∆ , so d ∞ (v + d, u + d) ≤ ∆ implies d ∞ (v + d, φ ) ≤ 2∆. So d ∞ (reg(v + d), φ ) = 0 by Proposition 10.4.13, where reg(v + d) is reachable in A . We get d ∞ (Reach( A ), {ℓ} × φ ) = 0, which is a contradiction.

Application to Robust Undecidability

The constructions we gave in this chapter are also important theoretical results, since they show that the class of robust timed automata contain timed automata that are equivalent, in the sense of strong 0-bisimulation, to arbitrary timed automata. Hence, considering only robust timed automata in the domain of any problem is not restrictive at all, when it comes to decidability and expressiveness. Although there is a blow-up in the size of the equivalent models we define, this is irrelevant if we are only interested in the decidability of verification problems.

Here, we apply the implementation constructions given previously to show that all undecidable problems on timed automata remain undecidable on the class of robust timed automata. We state explicitly the undecidability of the timed language universality, which is one of the important problems in verification.

The timed language of a timed automaton is the set of its timed traces of its initialized runs. The timed language universality problem asks whether the timed language of a given timed automaton contains all timed traces. The problem is undecidable for general timed automata [START_REF] Alur | A theory of timed automata[END_REF].

Theorem 10.5.1. The timed language universality problem is undecidable for the class of safetyrobust (resp. bisimulation-robust) timed automata.

Proof. The proof given in [START_REF] Alur | A theory of timed automata[END_REF] consists in defining a language L undec encoding the computations of a Minsky machine. Then a timed automaton A that encodes exactly the complement of L undec is given. Hence, the universality of the timed language of A is equivalent to the non-emptiness of the computations of the Minsky machine. In this proof, we can replace A by safe(A) which has the same timed language since A ∼ 0 safe(A). Furthermore, safe(A) is safety-robust by construction. The same holds for impl η (A). Thus, the problem remains undecidable in both classes of robust timed automata.

The proof above shows that any encoding of an undecidable language by a regular timed language, can be realized by a robust timed automaton. One can thus formulate the following meta-theorem:

All problems whose undecidability is proven by encoding an undecidable problem as a timed automaton remain undecidable for the class of robust timed automata.

Conclusion

We have presented a way to transform any timed automaton into robust and samplable ones, while preserving the original semantics with any desired precision. Such a transformation is interesting if the timed automaton under study is not robust (or not samplable), or cannot be certified as such. In this case, one can simply model-check the original automaton in the exact semantics for desired properties, then apply our constructions. This allows one to design timed automata at a high abstraction level, without taking into account imprecisions, and then automatically refine to an equivalent but robust design.

Our results also show that robust timed automata are not less expressive than the class of arbitrary timed automata, since one can always transform a timed automaton into a robust one and preserve its semantics exactly. On one hand, this is good news since one can implement all timed automata (satisfying the safety assumption of Definition 10.3.2). On the other hand, this means that our notion of robustness does not rule out very complex timed automata, such as those encoding undecidable problems: as we showed in Section 10.5, undecidable problems remain undecidable for the class of robust timed automata.

Several important questions remain open. First of all, for now, our construction is applied to timed automata seen as a whole. Thus, if the input is a network of timed automata, the construction requires each component to have (read-only) access to all other clocks. If all clocks cannot be publicly read, then our constructions may not be actually realizable in some platforms. Another problem is that we can only treat "one-player timed automata", that is, we assume that the evolution of the system is entirely controlled by the controller. In reality, there may be uncontrollable actions, whose guards cannot be constrained. Taking into account uncontrollable transitions would require formalizing the system as a game. Another interesting future work would be to investigate the size complexity of robust timed automata: given a timed automaton A, can we always find a robust equivalent timed automaton of size polynomial in A? This would not only extend our understanding of the class of robust timed automata by providing information on their succinctness, but it would also have practical implications since one would avoid the exponential blow-up of our constructions.

Chapter 11

Implementation by Shrinking

Introduction

The perturbation models and the corresponding robustness problems considered in this thesis are related to implementability, i.e., whether a given model can be implemented on physical hardware, preserving (the properties of) its exact semantics. In this chapter, we first present a target implementation semantics for timed automata, which takes into account nonzero reaction times, synchronization delays and clock imprecisions. Our semantics is similar to the one studied in [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF] with minor differences (corresponding to different abstraction choices), and we prove additional properties besides the one given there. We then show how shrinkability (of Chapter 5) can be used to ensure that the behavior is preserved in implementation.

We will "implement" timed automata simply by shrinking their guards. We explain the intuition in a simple case, where the only imprecisions are modelled as guard enlargement. When an edge with the guard x ∈ [a, b] is implemented as x ∈ [a + δ, bδ], under imprecisions bounded by some ∆, the system still guarantees that x ∈ [a + δ -∆, bδ + ∆]. Provided that 0 ≤ ∆ < δ, the resulting behavior then conforms to the initial model since

[a + δ -∆, b -δ + ∆] ⊆ [a, b].
Thus, no new behavior is present in the implemented system under imprecisions. We will follow this idea to show that shrunk timed automata have no additional behavior in the implementation semantics than in the exact semantics. Furthermore, we are interested in ensuring that the implementation semantics also do not lose behaviors: We will show that if a timed automaton is shrinkable, then its implementation semantics is non-blocking and time-abstract simulates its exact semantics. Thus, the main result of this chapter is that shrinkable timed automata are implementable in our implementation semantics.

Implementability is in general a difficult problem, and an exact answer needs to take into account a detailed model of the platform, such as the worst and best case execution times for each instruction in a given microprocessor (e.g. [START_REF] Bandur | Microcontroller assembly synthesis from timed automaton task specifications[END_REF]). Such a modeling is out of the scope of this thesis. It is nonetheless useful to carry the formal verification as far as possible in the design of a system, so as to gain confidence in the design at hand. Our goal here is to show that some properties of the system (simulation and non-blockingness) are preserved in a semantics that is closer to a real implementation than the idealized abstract semantics of timed automata.

We first define our semantics and state its properties, then compare it with [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF].

Implementation Semantics

In this chapter, we will adopt a different definition for timed transition systems, by making explicit the global time at any state. This will allow us to compare different measures of time between different semantics. The time domain is the nonnegative reals. Given a TTS (S, s 0 , Σ, R ≥0 , →), we do not separate delays and actions, but rather only define actions with timestamps. Hence, delays are now implicit. Transitions are labelled by σ(T ), with T ∈ R ≥0 the timestamp of action σ ∈ Σ. In all TTSs we consider, the timestamps of consecutive actions are assumed to be nondecreasing. The definition of simulation can be adapted as follows. A relation R ⊆ S × S is a simulation if for any (s, t) ∈ R, whenever s σ(T )

---→ s ′ , there exists t ′ such that t σ(T )

---→ t ′ , for any σ ∈ Σ and T ∈ R ≥0 . A timed automaton A is a timed refinement of A ′ if the initial state of A ′ simulates the initial state of A. As in Chapter 5, we only consider closed timed automata. We describe a system which interacts, via sending and receiving signals, with a physical environment (e.g. via sensors). We distinguish input and output actions, and define the transitions of the system taking into account the imprecisions of the clock, the transmission delay of signals and the reaction time of the system. When an event is generated at time T by the environment, it is treated by the system at time T + ǫ, for some ǫ > 0 which will be bounded but unpredictable. Similarly, when the environment receives a signal at time T , it must have been sent at some time Tǫ. We assume that the system ignores any signal that is received during the treatment of the previous signal; this reaction time will be also bounded but unpredictable. Thus, in our semantics, the system does not have a buffer to store incoming signals; it either responds immediately to a signal or ignores it. We define the timestamps of both input and output actions as the reaction times of the environment, since we are interested in the behavior of the environment controlled by a digital timed system.

The implementation semantics has three parameters: a) ∆ c is the clock period, b) ∆ r is the maximum reaction time, following each action, c) ∆ t is the maximum transmission delay of signals between the system and the environment (ǫ above).

We suppose the system has a ∆ c -periodic clock, whose value, at any real time T , is ⌊T ⌋ ∆c = max k∈N {k∆ c | k∆ c ≤ T }.

Definition 11.2.1. Let A = (L, ℓ 0 , C, Σ, E) be a timed automaton with Σ = Σ in ∪ Σ out , and ∆ r , ∆ c , ∆ t > 0. The implementation semantics A Impl is the TTS (S A , s 0 , Σ, E) in which states are tuples (ℓ, T, v, u 0 ): ℓ is a location, T ∈ R ≥0 the current global time1 , v ∈ R C ≥0 the timestamp of the latest reset for each clock, and u 0 ∈ [0, ∆ r ] the reaction time following the latest location change.

From any state (ℓ, T, v, u 0 ), for any edge ℓ σ,g,R ---→ ℓ ′ and T ′ ≥ T , we let,

• if σ ∈ Σ in , (ℓ, T, v, u 0 ) σ(T ′ ) ---→ (ℓ ′ , T ′ + ǫ, v[R ← T ′ + ǫ], u ′ 0 )
, whenever ⌊T ′ + ǫ⌋ ∆c -⌊v⌋ ∆c |= g and T ′ + ǫ ≥ T + u 0 , where (ǫ, u ′ 0 ) ∈ [0, ∆ t ] × [0, ∆ r ] is chosen non-deterministically,

• if σ ∈ Σ out , (ℓ, T, v, u 0 ) σ(T ′ ) ---→ (ℓ ′ , T ′ , v[R ← T ′ -ǫ], u ′ 0 )
, whenever ⌊T ′ -ǫ⌋ ∆c -⌊v⌋ ∆c |= g, ǫ < (T ′ -T ), and T ′ -ǫ ≥ T + u 0 , where (ǫ, u ′ 0 ) ∈ [0, ∆ t ] × [0, ∆ r ] is chosen non-deterministically.

are also satisfied for at least ∆ time units. Since v ∈ lb( M ′ ), there exists x ∈ C, such that -M 0,x -∆ = v(x) (otherwise valuation v can be decremented by some positive amount). For this clock, obviously -M 0,x -∆ ≤ v(x) + τ ≤ M x,0 + ∆ for τ ∈ [0, ∆], since -M 0,x ≤ M x,0 (in fact, the set is not empty). Now, consider any y ∈ C. DBM M ′ implies the following diagonal constraint (and possibly a tighter one).

-∆ -M 0,x -M y,0 ≤ v(x)v(y) ≤ M x,0 + M 0,y + ∆.

But, combining the above inequality with v(x) = -M 0,x -∆, we get that v(y) ≤ M y,0 , so v(y) + τ ≤ M ′ y,0 = M y,0 + ∆ for τ ∈ [0, ∆]. The following lemma shows that if the exact semantics is non-blocking, then the implementation semantics is also non-blocking.

Lemma 11.3.5. Let A be a closed timed automaton, ∆ r , ∆ c , ∆ t > 0 be parameters and assume that A is non-blocking. Then for any ∆ ≥ ∆ r + 2∆ c + ∆ t , A ∆ Impl is non-blocking.

Proof. First, observe that if A is non-blocking, then so is A ∆ for any ∆ > 0. In fact, consider an edge ℓ g,σ,R ---→ ℓ ′ and any corresponding transition (ℓ, v 1 , T ) σ(T +τ )

-----→ (ℓ ′ , v ′ 1 , T + τ ) in A ∆ . Since v 1 + τ |= ∆ g, there exists v 2 such that d ∞ (v 2 , v 1 ) ≤ ∆ and v 2 + τ |= g. Let v ′ 2 be such that (ℓ, v 2 , T ) σ(T +τ ) -----→ (ℓ ′ , v ′ 2 , T + τ ). Since A is non-blocking, for some τ ≥ 0, there exists an edge with guard g ′ such that v

′ 2 + τ |= g ′ . But d ∞ (v ′ 1 , v ′ 2 )
≤ ∆, so we also have v ′ 1 + τ |= ∆ g ′ , and the edge is enabled from (ℓ ′ , v ′ 1 , T + τ ) as well. Hence A ∆ is non-blocking. Let (ℓ, T, v, u 0 ) σ(T +τ ) -----→ (ℓ ′ , T +τ +ǫ, v ′ , u ′ 0 ) denote a transition in A ∆ Impl with v ′ = v[R ← T +τ + ǫ] for some σ ∈ Σ in , and ℓ σ,g,R ---→ ℓ ′ the corresponding edge in A. We have ⌊T +τ +ǫ⌋ ∆c -⌊v⌋ ∆c |= ∆ g, so for ν = ⌊T + τ + ǫ⌋ ∆c -⌊v⌋ ∆c , we have (ℓ, ν,

---→ (ℓ ′ , ν ′ , 0) in A ∆ , where ν ′ = ν[R ← 0]. Notice that ν ′ = ⌊T + τ + ǫ⌋ ∆c -⌊v ′ ⌋ ∆c . Since A ∆ is non-blocking, there exists τ ≥ 0 such that ν ′ + τ |= ∆ g ′ , where g ′ is the guard of some edge with label σ ′ outgoing from ℓ ′ .

Consider Z = g ′ ∆ , whose width is at least ∆ by Lemma 11.3.4. Then, there exists α, β ∈ R ≥0 such that α + ∆ ≤ β and ν ′ + τ ′ ∈ g ′ ∆ for all τ ′ ∈ [α, β]. We show that (ℓ ′ , T + τ + ǫ, v ′ , u ′ 0 ) can delay some amount τ ′ and take this transition. For any max(α, ∆ r ) + ∆ c ≤ τ ′ ≤ β -∆ c -∆ t , we have ⌊T + τ + ǫ⌋ ∆c + (max(α, ∆ r ) + ∆ c ) -∆ c ≤ ⌊T + τ + ǫ + τ ′ ⌋ ∆c ≤ ⌊T + τ + ǫ⌋ ∆c + β -∆ c -∆ t + ∆ c .

Thus, ν ′ + max(α, ∆ r ) ≤ ⌊T + τ + ǫ + τ ′ ⌋ ∆c -⌊v ′ ⌋ ∆c ≤ ν ′ + β -∆ t .

(11.1)

Notice that such a τ ′ exists since ∆ r + 2∆ c + ∆ t ≤ ∆. Hence, if σ ′ ∈ Σ out , then, for any ǫ ′ ∈ [0, ∆ t ] given by ρ, the transition

(ℓ ′ , T + τ + ǫ, v ′ , u ′ 0 ) σ ′ (T +τ +ǫ+τ ′ +ǫ ′ ) ------------→ (ℓ ′′ , T + τ + ǫ + τ ′ + ǫ ′ , •, •), is valid. If σ ′ ∈ Σ in , then (ℓ ′ , T + τ + ǫ, v ′ , u ′ 0 ) σ ′ (T +τ +ǫ+τ ′ ) ---------→ (ℓ ′′ , T + τ + ǫ + τ ′ + ǫ ′ , •, •)
is valid thanks to the right hand side term in (11.1) (since ǫ ′ ∈ [0, ∆ t ].

The proof is similar when σ ∈ Σ out .

Comparison with [DDR05a]

A similar semantics, called the program semantics, was defined in [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF] and was proven to be simulated by the enlarged semantics (as in the rightmost simulation in Proposition 11.2.2). Our definition follows their ideas, but we define a somewhat more abstract semantics by concentrating on different aspects. Our goal here in this chapter is not defining the semantics of a microprocessor model but rather introducing various kinds of imprecisions. One difference with [START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF] is that we do not insist on the semantics to produce events almost as soon as possible (almost ASAP). Thus, transitions are not urgent in our semantics; only the reactions to input events are. Our semantics is not input-enabled, that is, it can ignore signals during the treatment of another signal, since it has no buffer. Both assumptions are applicable to different platforms (see [START_REF] Asarin | On discretization of delays in timed automata and digital circuits[END_REF][START_REF] Dierks | PLC-automata: a new class of implementable real-time automata[END_REF] for examples of systems that ignore any signal unless it is maintained long enough). Moreover, instead of giving a detailed model of the treatment of the signals in several steps, we rather define action transitions taking a positive unpredictable amount of time, during which computations take place. This allows us to model the unpredictability using schedulers and state our properties for any scheduler. Due to these differences, both semantics are uncomparable: the program semantics is not simulated, in general, by our implementation semantics, and vice versa. Note that two results in Proposition 11.

Conclusion and Perspectives

We summarize here the results presented in this thesis. Conclusions and possible future work were given specifically at the end of each chapter. We mention here more general perspectives for future research directions.

Robustness analysis One of the important perturbation models considered in the literature is that of guard enlargement. We studied the untimed languages of timed automata under parameterized guard enlargement. We gave an algorithm to decide whether the untimed language of a given timed automaton is preserved under some enlargement parameter. This extends the possibility of robustness analysis: while previous work allowed to do model-checking for a given property, under a parameterized enlargement parameter, our algorithm allows to check for complete behavior preservation. The algorithm runs in exponential space, which matches the complexity of checking untimed language equivalence between timed automata. The semantics of timed automata under parameterized guard enlargement have thus been studied for several properties. Although this is a parameter synthesis problem, one can notice that these robustness problems have no complexity cost over the corresponding standard verification problems. We believe efforts in this field should now concentrate on developing efficient algorithms, so that robust model-checking becomes a standard feature in timed automata model-checkers. Some symbolic algorithms have been developed for this aim, but they only apply to a restricted class of timed automata, namely timed automata without nested loops [START_REF] Daws | Symbolic robustness analysis of timed automata[END_REF][START_REF] Jaubert | Quantitative robustness analysis of flat timed automata[END_REF]. Extending these techniques to general timed automata remains an open problem. A timed automata designer interested in robustness analysis should note that in case the parameterized robustness problems are too inefficient, it is always possible to syntactically enlarge the guards for a fixed (guessed) enlargement parameter, and model-check the resulting timed automaton. Although there is no guarantee on termination, one could stop trying when enlargement parameter becomes too small. This would work on models that are not too large, and has the advantage of being simple. But for large models with large constants, this procedure could easily become impractical. An important question here is whether, and to what extent parameterized robustness analysis algorithms (against guard enlargements) overperform a simple binary search on enlargement parameters.

An interesting future direction is understanding whether the similarity between the semantics under clock drifts and guard enlargements can be extended beyond safety (these were shown to be equivalent for safety in [START_REF] Puri | Dynamical properties of timed automata[END_REF][START_REF] De Wulf | Robust safety of timed automata[END_REF]). For instance, could parameterized robust model-checking algorithms for ω-regular objectives, or untimed language preservation be adapted to clock drifts? Does correctness under guard enlargement imply correctness under clock drifts? Such results would have practical significance since one can model-check under a fixed guard enlargement with existing tools for timed automata whereas clock drifts require hybrid automata model-checkers.

In this thesis, we also introduced a new notion of robustness, namely shrinkability, based on syntactic perturbations of the guards. Shrinking is the inverse operation of the enlargement, that is, tightening the guards so as to disallow behaviors that are in the limit of satisfying the guards. We were interested in synthesizing possibly different shrinking parameters for all guards, under which the resulting timed automaton is non-blocking and time-abstract similar to a given finite automaton. Thus, while analysis under guard enlargements was concerned with the newly appeared behaviors, here the emphasis is on the preservation of time-abstract behavior under removal of limit (timed) behavior. The resulting problems are decidable, with reasonable theoretical complexity (these vary from NP to EXPTIME). Shrinkability has also implications in implementability of timed automata models. In fact, to overcome th effect of imprecise time measures (that is, guard enlargements), one can shrink a timed automaton, then check whether any important time-abstract behavior is lost. We presented a software tool in which a shrinkability algorithm is implemented. We were able to treat several case studies from the literature, where timed automata models had, e.g. upto 11 clocks and hundreds of transitions (the train gate model), or 4 clocks with thousands of transitions (Fischer's protocol).

We plan to extend the theory of fixpoint equations between shrunk DBMs by studying the arbitrary use of the union. This would allow expressing much richer properties, such as reachability, simulation (without the hypothesis of distinct edges), and one could even treat temporal logic formulae. This would give the system designer much freedom when applying shrinkability analysis, compared to the actual algorithms which require specifying a finite automaton with respect to which simulation is checked. In order to make shrinkability analysis appealing, further tool support is also needed to interpret and refine the finite automaton specification.

Note that for shrinkability analysis, manually trying different shrinking parameters is not an option, in contrast with the robustness analysis against enlargements. In fact, the shrinking parameters have dependencies between them (which we expressed as max-plus graphs) and these are difficult to solve by hand even for small models. Thus, automatic synthesis of these parameters are an essential feature in shrinkability algorithms.

Robust synthesis Robustness analysis algorithms are used to check whether a timed automaton design preserves its behavior, or satisfies its specification, under perturbations. Thus, when applying these algorithms, one assumes that the given timed automaton is designed to do exactly what one expects it to do. Another approach in formal verification is that of controller synthesis. Here, the given model is often under-specified, that is, it contains too much non-determinism, or several ways of performing similar behaviors. Given such a model, and a specification, the goal is then to find a strategy to guide the system so as to satisfy the specification. The model controlled by the strategy is often deterministic, so it can be seen as an implementation.

In this thesis, we investigated the controller synthesis problems on timed automata and games under robustness concerns. We modelled the perturbations as a game between a controller and an environment (these were called Controller, and Perturbator). In this semantics, both players suggest valid delays and actions. Moreover, if Controller's move is taken, Perturbator perturbs the delay by a parameterized amount. We considered two variants. In the excess perturbation game, Controller only needs to suggest moves that satisfy the guards; while in the conservative perturbation game, the moves should satisfy the guards under any perturbation. The conservative perturbation game, where the magnitude of the perturbations is seen as a parameter, yields to a PSPACE-complete problem for Büchi objectives in timed automata. The proofs establish a strong relation between controllability in our sense and the absence of convergence phenomena. The excess perturbation game is more complex: reachability is EXPTIME-complete already on timed automata; we also extend this algorithm to turn-based timed games. We apply these game semantics to weighted timed games, on which the optimal-cost reachability problem is known to be undecidable. We proved that, unfortunately, the problem remains undecidable under both semantics.

We believe that both semantics are interesting under different modelling assumptions. We have seen that while the excess perturbation game allow to keep the model simple, but introduce additional behaviors, the conservative perturbation game semantics requires the system designer to define strict constraints on the behaviors, and then concentrate on satisfying these. In both semantics, we formulate the control problems from a worst-case analysis point of view. In fact, the semantics are based on the assumption that the perturbations are controlled by an adversary with an opposite objective. A robust system, in the sense of these semantics, is then capable of supporting any source of perturbations.

An important direction is the treatment of general timed games. Although both semantics seem plausible for modelling purposes, we will privilege the conservative game semantics, since it yields problems with lower complexity. Technically, both algorithms use shrunk DBMs, which we also used to solve shrinkability problems. We believe this is a good data structure to explore the parameterized state space of timed automata, and we expect it to be used in other problems related to robustness in timed systems.

Once the theory of parameterized perturbation game semantics has been fully understood, the following research goal will be finding symbolic algorithms efficient enough to allow treating real case studies. One could hope to extend the on-the-fly algorithm of [CDF + 05] to one of our perturbation game semantics. The long term goal should be to integrate robust controller synthesis algorithms in timed game solvers, such as Uppaal-TIGA [BDL + 06] and Synthia [START_REF] Peter | Synthia: Verification and synthesis for timed automata[END_REF]. As in the case of robustness analysis, the relevance of computing the perturbation parameter should be evaluated compared to manually testing different values in terms of performance.

We studied perturbation game semantics in weighted timed automata and games, and gave a PSPACE algorithm for cost-optimal reachability in weighted timed automata under the conservative perturbation game semantics. On the other hand, these semantics unfortunately do not render costoptimal reachability problems decidable on weighted timed games. In order to obtain decidability, one could restrict to closed weighted timed games. In fact, closed guards make it difficult for players to check whether the complement of an expected behavior has been performed. Similarly, another idea is to look at different semantics which eliminate "isolated" behaviors, such as probabilistic or topological semantics.

Robust implementation A third set of results we considered here is on implementation, that is, automatically transforming a given timed automaton so that it can be implemented. We gave constructions to transform any given timed automaton into an equivalent one, in the sense of strong bisimulation, whose behavior under enlargement is approximately bisimilar to its exact behavior. It follows that the enlargement of the transformed timed automaton is approximately bisimilar to the original timed automaton. We also gave a variant which only preserves safety properties, but may not be time-abstract bisimilar with the original timed automaton. These results enable a design methodology that clearly separates design and problems related to robustness. In fact, one can design a system in the exact semantics, apply model-checking, and then automatically "compile" to an equivalent and robust model. Hence, in this development procedure, there is no need for the robustness analysis, since it is ensured by construction.

We also considered a more concrete target implementation semantics for the implementation problem. We described a semantics with a discrete clock, positive communication and reaction times, and proved that the behaviors of shrinkable timed automata are preserved under this semantics. In this approach, the resulting semantics is (exactly) simulated by the original timed automaton, in contrast with the approximate bisimulation with the former results. So this method ensures strict behavior preservation. However not all timed automata are shrinkable, so one cannot implement all timed automata in this framework.

In future, we plan to extend these "robust-by-construction" design techniques. For instance, similar results need to be adapted to networks of timed automata, where the transformed components do not need to access other components' clocks. For these to be applicable in general, the theory also needs to be extended to timed games, so that one distinguishes between controllable and uncontrollable transitions.

General Remarks In this thesis, we considered several perturbation models, each reflecting a different point of view on the nature of the perturbations. One could wonder which one is the "best" notion of robustness, and deserves more attention for future research. Similar questions could be asked by a timed automaton practitioner who wants to check the robustness of their timed automaton design.

We believe that the theory of robustness in timed automata naturally needs this diversity in perturbation models. In fact, timed automata are a general-purpose formalism: Its applications range from low-level circuits to high-level schedulings of multimedia tasks, intended to be implemented as a monolithic system or a distributed one. Thus, the system designer needs to determine which kind of robustness analysis makes sense given the application, say, among time measurement errors (guard enlargement), clock synchronization errors (clock drifts), or sampling. A rich theory of robustness will allow the system designer to pick the solution that is the most adapted to the application at hand.

A common practice in engineering is decomposing a complex task into several simpler pieces that are easier to solve, then obtaining a global solution by combining the small solutions. This approach can also be found in formal verification, where smaller components are verified under some assumptions, then recombined to prove the correctness of the global system. Such a decomposition allows the treatment of large systems.

Concerning robustness, an important step would be to find decidable criteria on timed automata and their synchronization which ensure that their combination (network of timed automata) is robust by construction. This does not seem easy, since even very simple and robust timed automata may define non-robust timed automata once combined by synchronization (This is the case of Fig. 2.1). Thus, non-trivial criteria might be needed, including the restriction of synchronization between components in order to define a "robust composition operator". Possible applications would be analyzing the robustness of each component separately, and deducing the robustness of the global system, or applying a robust implementation construction on each component such that their composition is robust by construction.

Index

Figure 1 . 2 :

 12 Figure1.2: The scheduling of the tasks of a camera-recoder system. The period of the generation of the frames is the same as the encoding of the frames. The system can run for an arbitrarily long time.

Figure 1 . 3 :

 13 Figure1.3: The scheduling of the tasks of a camera-recoder system of Fig.1.2, where the execution times are slightly changed. The period of the generation of the frames, τǫ, is shorter than the period of encoding. For any value of ǫ > 0, the encoder will have an overflow or it will skip frames eventually.

Figure 2 . 3 :

 23 Figure 2.3: A timed automaton A 2 specifying the behavior of the producer-consumer system of Fig. 2.2.Here, the specification is more abstract: an allowed behavior consists in generating at least an event every 2 time units, and consuming at most one every 2 time units, while alternating between generation and consumption. This automaton coincides with the example given by Puri[START_REF] Puri | Dynamical properties of timed automata[END_REF].

Figure 2 . 4 :Figure 2 . 5 :

 2425 Figure 2.4: Consider tasks A, B, C of duration 2 and D, E of duration 1. Dependences between tasks are as follows: A → B and C → D,E, meaning e.g. that A must be completed before B can start. Task A must be executed on machine M 1 and tasks B, C on machine M 2 . Moreover, task C cannot be scheduled before 2 time units (which could be modelled using an extra task). The figure shows an optimal work-conserving schedule for these tasks under these constraints.

Figure 2 . 6 :Figure 2 . 7 :

 2627 Figure 2.6: Timed automaton P 2 modeling Process 2.

Figure 2 .Figure 2

 22 Figure 2.8: A timed game. Player 1's edges are represented as straight edges, while Player 2's edges are dashed.

Figure 3

 3 .1 contains examples of regions with two clocks.

Figure 3 . 1 :

 31 Figure 3.1: The orbit graph (at the middle) and folded orbit graph (at the bottom) of a cycle (on top) in the region automaton of A 2 of Fig. 2.3.

Figure 3 . 3 :

 33 Figure 3.2: A Timed automaton.

  4.1 to (3.3) for all x, y, z ∈ C 0 . Remark 3.4.4. Consider a normalized DBM M and any SM P . If (M ′ , P ′ ) = norm((M, P )), then M ′ = M, M ⊆ M ′ and P ≤ P ′ . This follows from the definition of normalization. In fact, normalization does not change the values M, and if ≺ M ′

Figure 3 . 4 :

 34 Figure 3.4: On the right of Fig. 3.4(a), the whole gray area represents a zone N 1 , while the dark gray area is some shrinking (N 1 , P ). On the left, the dark area is the shrunk zone (M ′ , Q) where M = Pre time (N 1 ), M = M ′ , and M ⊆ M ′ . Similarly, Fig. 3.4(b) to 3.4(d) illustrate the intersection of two shrunk zones and the shrinking of zones. We define Pre ≥δ (M ) = shrink [0,δ] (Pre time (M )). It is easily observed that this is the set of states that can reach M after a delay of length at least δ: shrink [0,δ] (Pre time (M )) = {v | ∃d ≥ δ, v + d ∈ M }. We also define Pre >δ (M ) = {v | ∃d > δ, v + d ∈ M }. The latter can be obtained from Pre ≥δ (M ) by changing all upper bounds to strict inequalities.Let us extend the computation of upper bounds on δ in Lemma 3.4.6 for an inclusion relation, which will be useful in Chapter 7.

Lemma 4 .

 4 4.3 ([DDMR08, Lemma 24], and [Pur00, Lemma 7.1]).

Lemma 4 .

 4 4.4 ([DDMR08, Lemma 14]). Any bounded region has at most C + 1 vertices. Any point ν ∈ R C

Figure 4 . 2 :

 42 Figure 4.2: An induction step in the proof of Theorem 4.3.1. First, ρ ′ is extended following path π 1 τ 1 τ 2 . . . (shown in red dashed line), and for any long enough repetition of cycles τ 1 , . . . , τ K , H(ρ, α i+1 , n) (shown in pink filled circle) can be reached. Then, γ is extended to (γ) αi+1 (shown in green loosely dotted line).

  Figure 5.1: Timed automaton A. Atomic clock constraints of the form y < ∞, 0 ≤ y or -∞ < xy are omitted.

Figure 5 . 2 :

 52 Figure 5.2: A shrunk timed automaton A -kδ of timed automaton A defined in Fig. 5.1.

Figure 5 . 3 :

 53 Figure5.3: A shrunk timed automaton that is blocking whenever δ 2 > 0 or δ 3 > 0. To see this, consider any infinite execution and let d 1 , d 3 , . . . denote the delays at location l 1 , and d 2 , d 4 , . . . those at l 2 . One can show that 1 ≤ d 2i-1 + d 2i for all i ≥ 1, which means that time diverges, but also δ 2 + δ 3 ≤ d 2i+2d 2i and d 2i ≤ 1. The latter means that the sequence (d 2i ) i increases at least by δ 2 + δ 3 at each step and is bounded above by 1, which is possible only when δ 2 = δ 3 = 0. Note that even if δ 2 = δ 3 = 0, non-blockingness requires consecutive delays to be equal, which is not realistic for digital systems.

Figure 5 . 4 :

 54 Figure 5.4: The calculations of Example 5.3.1. The light and dark gray areas combined describe the equation Y = Pre time (g 1 ∩ Unreset y (X)), while the dark areas describe the shrunk version:Y ′ = Pre time (g ′ 1 ∩ Unreset y (X ′ )).

  and each computation takes time O(|F| • |C 0 | 3 ), since the expression inside the intersection in (5.8) is computed, and all DBMs need be normalized for each edge of F.

  Figure 6.1: Overview of shrinktech.

Figure 6 . 2 :Figure 6 . 3 :

 6263 Figure 6.2: Timed automaton A 3 .

Figure 6 . 4 :Figure 6

 646 Figure 6.4: Timed automaton A 5 .

  ])delta and 0 +(p[1])delta <= Y and X -Y <= 1 -(p[3])delta Simulator set of the finite automaton node(1) 0 +(p[4])delta <= X <= 2 -(p[6])delta and 0 +(p[5])delta <= Y and X -Y <= 2 -(p[7])delta [...]

  -Discrete simulator set of the finite automaton node(0) X <= 100 and X -Y <= 99 Discrete simulator set of the finite automaton node(1) X <= 199 and X -Y <= 194 [...]

2 Figure 7

 27 Figure 7.1: Perturbing one transition.

  Definition 7.2.1. Let M be a DBM. A shrinking constraint for M is a |C 0 | × |C 0 | matrix over {0, ∞}. A shrinking matrix P is said to respect a shrinking constraint S if P ≤ S, where the comparison is component-wise. A pair M, S of a DBM and a shrinking constraint is called a constrained DBM.

Figure 7 . 2 :

 72 Figure7.2: Consider a zone defined by 0 < x < 3, 0 < y < 3, and 0 < xy < 2. Let the shrinking constraint S be defined by S 0,y = 0, S x,y = 0, and S z,z ′ = ∞ for other components. The resulting M, S is depicted on the left, as a matrix (where, for convenience, we merged both matrices into a single one) and as a constrained zone (where a thick segment is drawn for any boundary that is not "shrinkable", i.e., with S z,z ′ = 0). On the right, the dark gray area represents a shrinking of M that satisfies S.

Lemma 7. 2 . 4 .

 24 Let M, N, O be normalized non-empty DBMs.1. Assume that M = Pre time (N ). For any normalized well shrinking constraint S for M , there exists a normalized well shrinking constraint S ′ for N such that for any shrunk DBM (N ′ , Q) with N ′ = N, the following holds: Q ≤ S ′ if, and only if, the SM P s.t.(M ′ , P ) = Pre time ((N ′ , Q)) satisfies P ≤ S.2. Assume thatM = N ∩ O = ∅.(a) For any normalized well shrinking constraint S for M , there exists a normalized well shrinking constraint S ′ for N such that for any shrunk DBM (N ′ , Q) with N ′ = N and N ′ ∩O = ∅, the following holds: Q ≤ S ′ if, and only if the SM P s.t. (M ′ , P ) = (N ′ , Q)∩O satisfies P ≤ S.(b) For any normalized well shrinking constraint S for N , there exists a normalized well shrinking constraint S ′ for M such that for any shrunk DBM (M ′ , Q) with M = M ′ and M ⊆ M ′ , the following holds: Q ≤ S ′ if, and only if there exists an SM P ≤ S such that (N, P ) ∩ O ⊆ (M ′ , Q). Moreover, if (N, P ) ∩ O = ∅ for all SMs P ≤ S, then S ′ is a well shrinking constraint.

  xj+1 . We have P ′ xj ,xj+1 = 0. On the other hand, S ′ x1,xj = S ′ xj+1,xn = 0 since otherwise we would get S ′ x,y = ∞. By induction, all paths of length at most n -1 in Π x1,xj (G(M )) and Π xj+1,xn (G(M )) have weight 0 in P ′ . So π has weight 0 in P ′ .

Figure 7 . 4 :

 74 Figure 7.4: Examples for both cases of Lemma 7.2.5 Let us comment on Fig. 7.3, the figure about Pre time (), and how it can be used for our purpose.Assume there is an edge guarded by N (the whole gray area in the right) without resets. In the non-robust setting, this guard can be reached from any point of M (the whole gray area in the left). If we have a shrinking constraint S on M , and we want to synthesize a winning strategy from a shrinking of M satisfying S, then Lemma 7.2.4 gives the shrinking constraint S ′ for N , with the following property: given any shrinking (N, Q), we can find P ≤ S with (M, P ) = Pre time ((N, Q)) (hence, we can delay into (N, Q)), if, and only if Q satisfies Q ≤ S ′ . The problem is now "reduced" to finding a winning strategy from N, S ′ . However, forward-propagating these shrinking constraints is not always that easy. We also need to deal with resets, with the fact that Controller has to choose a delay greater than δ > 0, and also with the case where there are several edges leaving a location. This is the aim of the following developments.

  A region r and its time successors inside r ′ . ⊆ (b) The shrinking of r ′ on the left can be decomposed as two shrinkings that admit tight valuations. Any actual delay of Perturbator will belong to one of these two shrinkings.

b) S 2 rFigure 7 . 7 :

 277 Figure 7.7: The ordering of the clock partition X 1 , . . . , X n in region r is shown in black in both figures. The new ordering inside r ′ is shown in gray.

Definition 8. 2 . 1 .

 21 The parameterized robust controller synthesis in the conservative perturbation game semantics asks, given a timed automaton A and a Büchi objective B, whether there exists δ > 0 such that Controller has a winning strategy in G cons δ (A) for the objective B.

Figure 8 . 2 :

 82 Figure 8.2: The (forgetful) folded orbit graph of the region automaton of the timed automaton of Fig. 8.1(b).

Figure 8 . 4 :

 84 Figure 8.4: Illustration of both cases of Lemma 8.5.5

Figure 8

 8 Figure 8.5: Sets I i and J i for the cycle of Fig. 3.1 Let a ∈ J i0-1 such that there exists b ∈ I i0 \J i0 with (a, b) ∈ E(γ(π)). Let us write λv = state i0 (ρ). Then, L Ji 0 (state i0 (ρ)) ≤ L Ji 0 ∪{b} (state i0 (ρ))ǫ since λ b ≥ ǫ by Proposition 8.5.4.The previous proposition already gives an insight into the proof, since it follows that no nonforgetful cycle can be repeated infinitely often under strategy σ P δ . However, one also needs to show that switching between different cycles cannot lead to Controller's winning. Thus, the last tool we need before the proof is the following theorem, which will allow us to factor any paths into cycles with the same folded orbit graphs.We will use Theorem 4.5.2 as in Chapter 4 as follows. Given a cycle π factorized as π = π 1 π 2 . . . π n , in which all π i are cycles from the same region-states, we consider a linearly ordered complete graph G = (V, E) with V = {1, . . . , n} and E is defined by the usual order on integers. The coloring function f is given as follows. For all i < j, we define f ((i, j)) = Γ(π i π i+1 . . . π j ). Thus, a monochromatic path given by the theorem corresponds to a factorization into π = π 0 •(π α1 . . . π α2-1 )• (π α2 . . . π α3-1 ) • . . . such that all Γ(π αj . . . π αj+1-1 ) define the same graph.Note that Ramsey's theorem would actually suffice for our proof but it would give an exponentially larger bound than Theorem 4.5.2. Consequently, the proof below will bound by a simple exponential the number of steps to the "failure" under any strategy in non-robust systems.

Figure 8

 8 Figure 8.6: A subregion s ′ of s with smaller granularity

  Theorem 9.2.3 ([ATP01, BFH + 01, BBBR07]). The OptReach value and strategy upper bound problems are PSPACE-complete for weighted timed automata.Unfortunately, the OptReach strategy upper bound problem becomes undecidable on weighted timed games, even for a fixed number of clocks. Theorem 9.2.4 ([BBR05b, BBM06]). The OptReach strategy upper bound problem is undecidable for weighted timed games. The decidability of the OptReach value upper bound problem for weighted timed games is open.

  Consider a Minsky machine with counters c 1 and c 2 , and a list of instructions I 1 , . . . , I n . Here, each instruction I i , for 1 ≤ i ≤ n -1, is an incrementation for c b as, c b = c b + 1; goto I j , for b = 1 or 2, or a decrementation with zero-test for c b as, if (c b = 0) goto I j else c i = c i -1; goto I j ′ .

Figure 9 . 1 :

 91 Figure 9.1: Unperturbed edges. Perturbator has interest in not perturbing these transitions, since, in presence of any perturbation, Controller immediately can go to the target location and win with cost -∞.

  a) Letting Perturbator decide.

  Simpler representation of the automaton on the left.

Figure 9 . 2 :

 92 Figure 9.2: Module that lets Perturbator decide a successor among ℓ 2 and ℓ 3 .

Figure 9 . 3 :

 93 Figure 9.3: Module PReduce k (x, y, u, t), reducing the shifts of x and y.

Figure 9

 9 Figure 9.5: Module Test 2z=x (x, z, u, t) obtained by letting Perturbator choose between Add 5+x-2z k ′

Figure 9 . 9 :

 99 Figure 9.9: Module Test ′ x=2z k (x, z, u, t).

Figure 10 . 2 :Figure 10 . 3 :

 102103 Figure 10.2: A copy of the non-robust timed automaton A 2 seen earlier in Fig. 2.2

  (ℓ ′ , (v + d)[R ← 0]) in A , using the edge ℓ φ,σ,R ---→ ℓ ′ . Let s = reg(v + d), then (by Lemma 10.4.9 below) there existsd ′ , d ′′ ≥ 0 such that v ′ + d ′ ∈ s and v ′′ + d ′′ ∈ s. Hence v + d = δ(v ′′ + d ′′ ) + (1 -δ)(v ′ + d ′ ).By construction implη (A) contains ℓ r φ∧φs,σ,R ------→ ℓ ′ s[R←0] since φ s ⊆ φ . Then we have (ℓ r , v ′ ) d ′ ,σ --→ (ℓ ′ s[R←0] , (v ′ + d ′ )[R ← 0]). Observing (v + d)[R ← 0] = δ(v ′′ + d ′′ )[R ← 0] + (1 -δ)(v ′ + d ′ )[R ← 0], and (v ′′ + d ′′ )[R ← 0] ∈ s[R ← 0] = reg(v + d)[R ← 0], we have (ℓ ′ , (v + d)[R ← 0]) R (ℓ ′ s[R←0] , (v ′ + d ′ )[R ← 0]).

4 . 4 .

 44 With the notations of the first case, we get|d ′′ -d ′ | ≤ 2. But since d = δd ′′ + (1 -δ)d ′ , we have |d -d ′ | = |δd ′′ -δd ′ | = δ|d ′′ -d ′ | ≤ 2δ.

  [The case where R 1 has no immediate successor is trivial.]Let D = {v + d | d ∈ R ≥0 }, D ′ = {v ′ + d ′ | d ′ ∈ R ≥0 } and D ′′ = {v ′′ + d ′′ | d ′′ ∈ R ≥0 }.We distinguish between two cases.

First

  case: assume D ∩ R 2 is the singleton {v + d}. One of the constraints which define R 2 is of the form x = c. In particular, D ′ ∩ R 2 and D ′′ ∩ R 2 are also singletons {v ′ + d ′ } and {v ′′ + d ′′ } respectively. We then have c = v(x)+ d = v ′ (x) + d ′ = v ′′ (x) + d ′′ , from which we deduce d ′ = ǫ(v ′′ (x)v ′ (x)) + d and d ′′ = (1ǫ)(v ′ (x)v ′′ (x)) + d. This is then a simple computation to get the desired property that ǫ(v ′′ + d ′′ ) + (1ǫ)(v ′ + d ′ ) = v + d.

  2.2 are new compared to[START_REF] De Wulf | Almost ASAP semantics: From timed models to timed implementations[END_REF]: the leftmost simulation and the preservation of non-blockingness.

Table 1 .

 1 1: Results on robustness analysis. Contributions are shown in shaded area.

	Objective	Safety	Büchi	coFlat-MTL	Lang. Equiv.
	Standard	PSPACE-c [AD94]

Table 1 .

 1 2: Results on robust synthesis. TA stands for timed automata, TTG for turn-based timed games, WTA for weighted timed automata, and WTG for weighted timed games. Empty boxes indicate open problems.

	Problem	Reach TA	Büchi TA Reach TTG	OptReach WTA	OptReach WTG
	Conserv.	PSPACE-c	PSPACE-c	PSPACE-c	undec.
	Excess	EXPTIME-c	EXPTIME-c	undec.	undec.

  , and Claus Thrane. Timed automata can always be made implementable. In Joost-Pieter Katoen and Barbara König, editors, Proceedings of the 22nd International Conference on Concurrency Theory (CONCUR'11), volume 6901 of Lecture Notes in Computer Science, pages 76-91, Aachen, Germany, September 2011. Springer. [BMS12] Patricia Bouyer, Nicolas Markey, and Ocan Sankur. Robust reachability in timed automata: A game-based approach. In Artur Czumaj, Kurt Mehlhorn, Andrew Pitts, and Roger Wattenhofer, editors, Proceedings of the 39th International Colloquium on Automata, Languages and Programming (ICALP'12) -Part II, volume 7392 of Lecture Notes in Computer Science, pages 128-140, Warwick, UK, July 2012. Springer. Untimed language preservation in timed systems. In Filip Murlak and Piotr Sankowski, editors, Proceedings of the 36th International Symposium on Mathematical Foundations of Computer Science (MFCS'11), volume 6907 of Lecture Notes in Computer Science, pages 556-567, Warsaw, Poland, August 2011. Springer. Ocan Sankur, Patricia Bouyer, and Nicolas Markey. Shrinking timed automata. In Supratik Chakraborty and Amit Kumar, editors, Proceedings of the 31st Conference on Foundations of Software Technology and Theoretical Computer Science (FSTTCS'11), Leibniz International Proceedings in Informatics, pages 90-102, Mumbai, India, December 2011. Leibniz-Zentrum für Informatik.

	[San11] Ocan Sankur. [San13] Ocan Sankur. Shrinktech: A tool for the robustness analysis of timed automata.
	In Proceedings of the 25th International Conference on Computer Aided Verification
	(CAV'13). To appear, 2013.
	[SBM11]

  Romain Brenguier, Stefan Göller, and Ocan Sankur. A comparison of succinctly represented finite-state systems. In Maciej Koutny and Irek Ulidowski, editors, Proceedings of the 23rd International Conference on Concurrency Theory (CONCUR'12), volume 7454 of Lecture Notes in Computer Science, pages 147-161, Newcastle, UK, September 2012. Springer.

[BMS11] Patricia Bouyer, Nicolas Markey, and Ocan Sankur. Robust model-checking of timed automata via pumping in channel machines. In Uli Fahrenberg and Stavros Tripakis, editors, Proceedings of the 9th International Conference on Formal Modelling and Analysis of Timed Systems (FORMATS'11), volume 6919 of Lecture Notes in Computer Science, pages 97-112, Aalborg, Denmark, September 2011. Springer.

  .3. A max-plus graph G with parameters k has a solution if and only if it has no bad cycle or contradicting path. Moreover, if G has a solution, then it has a least solution which can be computed in polynomial time in the size of G. Proof. Clearly, if G has contradicting paths, it has no solution. Let us show that if G has a bad cycle, then it does not have any solution.

  .10) Now, A is shrinkable w.r.t. non-blockingness if, and only if, this equation has a shrunk solution w.r.t. (G σ ) σ . We can unfortunately not directly use our general results on shrunk solutions since our equation contains a union. We instead apply transformations to this equation in order to remove the union. We start by rewriting the above equation as follows:

  Let C 1 , . . . , C b and D be normalized DBMs satisfying D = 1≤i≤b C i and P 1 , . . . , P b and Q shrinking matrices s.t. for some δ 0 > 0, D -δQ and C

i -δP i are normalized for all δ ∈ [0, δ 0 ]. Then, one can decide the existence of (and compute the maximum)

δ 1 > 0 s.t. D -δQ = 1≤i≤b C i -δP i for all 0 < δ ≤ min(δ 0 , δ 1 ),

in polynomial space and in time O(|C 0 | 2b p(|A|)), where p(•) is a polynomial. Moreover, in this case, for all shrinking matrices Q ′ , P ′ 1 , . . . , P ′ b s.t. Q x,y ⊲⊳ (P i ) x,y ⇔ Q ′ x,y ⊲⊳ (P ′ i ) x,y and (P i ) x,y ⊲⊳ (P j ) x,y ⇔ (P ′ i ) x,y ⊲⊳ (P ′ j ) x,y for all i, j ∈ {1, . . . , b}, x, y ∈ C 0 and ⊲⊳ ∈ {<, =}, it holds

  there are transitions to all square nodes (ℓ ′ , t, S t ) with t ∈ N ′ , and (S t ) t∈N ′ are such that for all shrunk DBMs ((t ′ , Q t )) t∈N ′ with t ′ = t, it holds Q t ≤ S t for every t ∈ N ′ iff there exists P ≤ S r such that

  3.1. Let s 1 , . . . , s m be the regions composing N , and let n ′ 1 , . . . , n ′ m denote the successors of n ′ in T f , where n ′ i is labelled by (ℓ ′ , t i , S ti ), and such that t i = s i [R ← 0]. By construction, shrinking constraints S ti are given by Lemma 7.4.2 applied to s, S s . By induction, for each 1 ≤ i ≤ m there is a shrunk DBM (t ′ i , P n ′ i ) and δ n ′ i > 0 with t ′ i = t i and P n ′ i ≤ S ti , such that Controller wins the game G exs δ (A) from {ℓ ′ } × (t ′ i -δP n ′ i ) for all δ ≤ δ n ′ i . Now, by Lemma 7.4.2, there exists a shrunk DBM (s ′ , Q) with s ′ = s and Q ≤ S s such that

  11 . But ǫ ≤ λ r2 p 21 + λ r1 p 1 1 since this is equal to λ ′ s1 . Since λ r1 + λ r2 ≤ 1 and Ω ≤ ǫ, the constraint holds.since p 11 < Ω and p 21 ≤ 1. So, it suffices to show that Ω ≤ 1 -. But this holds since ǫ ≤ λ r1 and 2λ r1 + λ r2 ≤ 2ǫ. In fact, we have Ω ≤ ǫ

							)
	λ r2 λ r1	p 21 +	λ r2 λ r1	(1 + Ω) ≤ α,	(8.7)
			α ≤ 1 -Ω -p 11 ,	(8.8)
		α ≤ p 21	λ r2 λ r1	-Ω	λ r2 λ r1	.	(8.9)
	It suffices to show that each pair of lower and upper bounds is satisfied by some α.
	(8.6)-(8.8): holds since Ω < 1 2 . (8.6)-(8.9): This can be written as Ω ≤	λr 2 λr 1 +λr 2	p 21 +	λr 1 λr 1 +λr 2
	(8.7)-(8.8): This is equivalent to
	Ω ≤ = 1 -λr 1 λr 1 +λr 2 λr 1 +λr 2 (1 -p 11 ) + λr 1 p 11 +	λr 2 λr 1 +λr 2 λr 2 λr 1 +λr 2	(1 -p 21 ) p 21 .
	We have (8.7)-(8.9): This is equivalent to 2 λr 1 λr 1 +λr 2 p 11 + λr 2 λr 1 +λr 2 p 21 ≤ λr 1 +λr 2 λr 1 λr 1 λr 1 +λr 2 Ω -λr 1 λr 1 +λr 2 , i.e. Ω ≤ λr 2 Ω + λr 1 +λr 2 2λr 1 +λr 2 λr 1 2-ǫ . λr 2 λr 1 Ω ≤ λr 2 λr 1 and holds since Ω ≤ 1 2 .

p

  Figure 9.7: Module Aut k ci,-(x, y, z, u, t) with zero test. The module Reduce k ′ refers to Reduce k ′ (z, y, u, t).• If n ≥ 1, Controller has a strategy that ensures that either module Instr k j ′ is reached with a valuation ν ′ ∈ code δ+2ǫ

				C ′	u = 4 , u := 0	Test x=2z k ′	(x,z,u,t)
	u=1∧x =kx +2 z,z ′ :=0	u=2	B	1≤u≤2 z,z ′ :=0	C	u=4, u:=0	D
	u,u ′ :=0	A	t,t ′ :=0 x=kx+2∧u=1 x =kx +3	Instr j k+1 (x,y,z,t,u)	Reduce k ′	k ′ (z,y,x,u,t) Instr j ′
			k ′

  Controller has a strategy to either reach a target location with cost at most 5η, or reach Instr ′ j k with a valuation ν ′ ∈ code

	if, and only if for all δ ∈ [0, 1 3 ],
		inf σ∈SC (G exs δ (A))
				ǫ/2+η k ′	(n + 1, m).
	Decrementation Module Aut ′ k	c1,-. The module Aut ′ k	c1,-(x, y, z, u, t), given in Fig. 9.11, is also
	an adaptation of Aut ′ k	c1,-(x, y, z, u, t) of the excess-perturbation case.
	Lemma 9.6.9. Assume module Aut ′ k	c1,-is entered with valuation ν ∈ code ǫ k (n, m) and cost 0,
	with ǫ < 1 4 . Then,
	• If n = 0, then Controller has a strategy to ensure reaching either Instr ′ j k with the same
	configuration and cost, or an accepting location with cost -∞. In this case, Controller cannot reach Instr ′ j ′ k ′′ .

9.10: Module Aut ′ k c1,+ (x, y, z, u, t). Here Reduce k ′ refers to Reduce k ′ (z, y, u, t) and Instr ′ j k ′′ to Instr ′ j k ′′ (z, y, x, u, t). Lemma 9.6.8. Assume that module Aut ′ k c1,+ (x, y, z, u, t) is entered at A with valuation v ∈ code ǫ k (n, m) with ǫ < 1 4 . For any η > 0, Proof. Fix η > 0. The strategy is the following. If upon arrival to D, the valuation ν ′ satisfies |2frac(ν ′ (z))frac(ν(x))| > η, then Controller goes to the test module. Otherwise, it proceeds to Instr ′ j k after going through the Reduce ′ k .

http://www.reuters.com/article/2010/02/09/toyota-recall-announcement-idAFTKG00664220100209

http://research.microsoft.com/en-us/um/people/mbj/Mars_Pathfinder/Authoritative_Account.html

In Chapter 7, we will consider a variant which does not impose a lower bound on Perturbator's delays. This choice corresponds to different assumptions on the environment.

One could extend the definition of region-determinism by requiring that all states that satisfy the guards of edges with the same label to be untimed language-equivalent (that the same untimed language is recognized from those states). In fact, in this case, the region automaton can be made deterministic by leaving one (arbitrary) edge per label at each state.

In max-plus algebra, max is the addition and is denoted by ⊕, whereas the sum is the multiplication and is denoted by ⊗. The product of a matrix and a vector is defined as usual, where multiplication is ⊗ and addition is ⊕.

Let us call a shrinking matrix positive, if all its off-diagonal components are positive.

Kronos is a model-checker for timed automata [BDM + 98].

Kronos can minimize the region graph of a timed automaton, as described in[START_REF] Tripakis | Analysis of timed systems using time-abstracting bisimulations[END_REF].

http://people.cs.aau.dk/~adavid/UDBM/

This is a graph description format of the CADP tool suite, also used by Kronos. See http://www.inrialpes.fr/vasy/cadp/

Here, the non-emptiness hypothesis in only significant for i = 1.

that is, all < are replaced by ≤, and > by ≥.

Although we define the semantics with respect to an exact global time, the behavior of this TTS will only depend on an approximate measure of this time.

Acknowledgement

We choose the values ν(x) for x ∈ X 2 ∪ . . . ∪ X j0 as -r 0,x < ν(x) < -r 0,x + ǫ/2, such that they respect the fractional ordering. Similarly, we choose r x,0ǫ/2 < ν(x) < r x,0 for x ∈ X i0 ∪ . . . ∪ X n , respecting the fractional ordering. Define A i = i |C|+2 for 1 ≤ i ≤ m. Define X i,j = X i ∪ X i+1 ∪ . . . X j . For each set X αi,α ′ i for 1 ≤ i ≤ m, we choose values in the interval [A iǫ/2, A i + ǫ/2] respecting the fractional orderings. The valuation is illustrated in the following figure.

We show that ν is ǫ-tight in r -δP . We verify at the same time that ν belongs to r -δP , and that it is ǫ-tight. We first consider the constraints between clocks X 2 ∪ . . . X j0 and X i0 ∪ . . . ∪ X n , then between clocks in x j0+1 ∪ . . . ∪ X i0-1 , and finally for pairs between the two sets.

1. For all x ∈ X 2 ∪ . . . ∪ X j0 , we have, by definition (S r ) 0,x = 0 and -r 0,x < ν(x) < -r 0,x + ǫ/2, and (S r ) x,0 = ∞. By the choice of δ, ν(x) < -r 0,x + ǫ/2 < r x,0 -δQ x,0 . For any pair x ∈ X k and y ∈ X l with 1 ≤ k < l ≤ j 0 , we have (S r ) x,y = 0 by normalization since 0, x, y is in Π 0,y (G(r)), but the previous inequality implies that r x,yǫ/2 < ν(x)ν(y) < r x,y . We have, therefore, (S r ) y,x = ∞, and ν(y)ν(x) < -r x,y + ǫ/2 < r y,x -δP x,y by the choice of δ.

2. Similarly, for all x ∈ X i0 ∪ . . . ∪ X n , we have (S r ) 0,x = ∞, (S r ) x,0 = 0 and r x,0ǫ/2 < ν(x) < r x,0 . For any pair x ∈ X k and y ∈ X l with i 0 ≤ k < l ≤ n, we have (S r ) x,y = 0 as before, and r x,yǫ/2 < ν(x)ν(y) < r x,y . We have (S r ) y,x = ∞, and ν(y)ν(x) < -r x,y + ǫ/2 < r y,x -δP y,x by the choice of δ and ǫ.

3. For any pair x ∈ X 2 ∪ . . . ∪ X j0 and y ∈ X i0 ∪ . . . ∪ X n , we have (S r ) y,x = 0 by hypothesis, since y, 0, x is in Π y,x (G(r)) and all edges have S r -weight 0. Thus, ν(y)ν(x) < r y,x -δP y,x , and we have r y,xǫ < ν(y)ν(x) since ν(x) > r x,0ǫ/2 and ν(y) < -r 0,y + ǫ/2. Furthermore, -r x,y + δP x,y < ν(y)ν(x) since -r x,y + δP x,y < r y,xǫ by the choice of δ and ǫ.

4.

Let us now consider constraints between clocks in X j0+1 ∪. . . X i0-1 . For any x ∈ X k and y ∈ X l with j 0 < k < l < i 0 , we have (S r ) y,x = ∞ since (y, 0, x) belongs to Π y,x (G(r)) and (S r ) y,0 = ∞.

We have ν(y)ν(x) < r y,x -δP y,x since frac(frac(ν(y))frac(ν(x))) ≤ m-1 |C|+2 + ǫ ≤ 1 -δP y,x . Assume that α i ≤ k < l ≤ α ′ i , for some i. We have (S r ) x,y = 0 and r x,y -ǫ < ν(x)-ν(y) < r x,y by definition of ν. If k ∈ [α i , α ′ i ] and l ∈ [α j , α ′ j ] for i < j, then (S r ) x,y = ∞. Since 1 |C|+2 + ǫ > δP x,y , we have ν(x)ν(y) < r x,y -δP x,y .

5. Consider now clock x ∈ X 2 ∪ . . . ∪ X j0 and y ∈ X j0+1 ∪ . . . ∪ X i0-1 . We have (S r ) x,y = ∞ by hypothesis. In fact, (0, x, y) ∈ Π 0,y (G(r)) and (S r ) x,y = 0 would imply (S r ) 0,y = 0. Also, (S r ) y,x = ∞ because (S r ) y,0 = ∞. We have -r y,x + δP y,x < ν(x)ν(y) < r x,y -δP x,y by 1 |C|+2 + ǫ > δ max x,y P x,y .

We extend Lemma 7.2.4 to the Post time () operation.

A global strategy for Perturbator

Let us call a valuation v ǫ-far if v + [-ǫ, ǫ] ⊆ reg(v). A run is ǫ-far if all delays end in ǫ-far valuations.

We define a global strategy σ P δ for Perturbator that ensures ǫ-far runs, as follows. After any delay ν d -→ ν ′ , chosen by Controller, consider the regions spanned by the set ν ′ + [0, δ]. It is easy to see that this set intersects at most |C| + 1 different regions, all of which must satisfy the guard by definition of the game. So some region r satisfies ν ′ + [α, β] ⊆ r, for some 0 ≤ α < β ≤ δ with βα ≥ δ |C|+1 . The strategy σ P δ consists in choosing the perturbation as 1 2 (βα). This guarantees time progress (of at least δ 2(|C|+1) ). Moreover, the resulting valuation is always ǫ-far in its region, where ǫ = δ 2(|C|+1) . We study the properties of the runs Outcome δ A (•, σ P δ ). The following proposition is a key element of the proof. Using the ǫ-far property of the runs, this proposition derives a bound on the convex combination coefficients of all visited valuations. Proposition 8.5.4. Let ρ ∈ Outcome A (•, σ P δ ). For any i ≥ 1, if we write state i (ρ) = λv, then λ v ≥ ǫ for all vertices v ∈ V(reg(state i (ρ))).

We begin with simple properties of non-punctual regions.

Lemma 8.5.5. If π is a non-punctual delay from region r 1 to r 2 , then exactly one of the following cases must hold for the graph γ(π):

1. Exactly one vertex of r 1 has outdegree 2. The successors of this vertex are inf(r 2 ) and sup(r 2 ).

All other vertices of r 1 have outdegree 1. 2. Exactly two vertices of r 1 have outdegree 2. These vertices are inf(r 1 ) and sup(r 1 ) and both lead to inf(r 2 ) and sup(r 2 ). All other vertices of r 1 have outdegree 1.

Moreover all vertices of r 2 have indegree at most 2, and the predecessors of any vertex of indegree 2 are inf(r 1 ) and sup(r 1 ).

We note the following lemma on ǫ-far valuations.

Lemma 8.5.6. If ν is an ǫ-far valuation, then for all clock x, if l x and u x denote respectively the lower and upper bounds on x in region reg(ν), then

We show the proposition first for discrete transitions, then for ǫ-far delays. The following lemma treats the clock resets, thus discrete transitions. We denote by min(λ) the minimum among the components of the vector λ. time progress of ǫ at each delay, this means that π ′ contains delays of at least nǫ 2 /2 > 1, so we cannot have first(π ′ 1 ) = last(π ′ n ) since the integer part of the clock x changes, and so does the region since all clocks are assumed to be bounded. Now, we have I(π ′′ i ) = I(π ′′ j ) for any 1 ≤ i, j ≤ n, so the functions L I(π ′′ i ) are the same for all 1 ≤ i ≤ n. If we write ρ i the state reached in ρ following π ′ 0 π ′′ 1 . . . π ′′ i , then we get, by Lemma 8.5.15,

. This is a contradiction since 0 ≤ L I(π ′ 1 ) ≤ 1 and nǫ 2 /2 > 1.

Aperiodic Lassos Implies Robustness

We now prove that if R(A) contains an aperiodic non-punctual forgetful B-winning lasso, then there is a strategy for Controller in G cons δ (A) ensuring robust safety. In the proof, we use shrinking techniques from Chapters 5 and 7, and the topological semantics of [START_REF] Gupta | Robust timed automata[END_REF]. The basic idea is the following. We prove that Controller can always ensure following one iteration of a (finite) non-punctual cycle. This ensures that the the cycle of an accepting lasso is reachable. Then, if the cycle is aperiodic, we show that Controller can also ensure to repeatedly move inside a set at the "middle" of the target region. This provides a winning strategy for Controller.

Controllable Predecessors

We will express "controllable predecessors" using shrunk DBMs without parameters from Chapter 3.

Consider an edge e = (ℓ, g, σ, R, ℓ ′ ). For any set Z ⊆ R C ≥0 , we define the controllable predecessors of Z as follows:

CPre

Intuitively, CPre δ e (Z) is the set of valuations from which Controller can ensure reaching Z in one step, following the edge e. In fact, it can delay in shrink [-δ,δ] (g ∩ Unreset R (Z)) with a delay of at least than δ, where under any perturbation in [-δ, δ], the valuation satisfies the guard, and it ends, after reset, in Z. We extend this operator to paths as expected. Note that CPre 0 e is the usual predecessor operator without perturbation: If N = CPre 0 π (M ) for some sets N, M and path π, then, N is the set of all valuations that can reach some valuation in M following π.

It immediately follows from Lemma 3.4.5 that the controllable predecessors of shrunk DBMs are shrunk DBMs, which are computable. Lemma 8.6.1. Let e = (ℓ, g, σ, R, ℓ ′ ) be an edge. Let M and N be non-empty DBMs such that N = CPre 0 e (M ). Then, for any SM P , there exists an SM Q such that (N ′ , Q) = CPre δ e ((M, P )) for some N ⊆ N ′ and N = N ′ . Notice that, the set (N ′ , Q) given by the previous lemma could be empty. We show in the following lemma, that the controllable predecessors of open sets along non-punctual paths are non-empty for small enough δ > 0.

Lemma 8.6.2. Let π be a non-punctual path from region r to s. Let s ′ ⊆ s such that there exists ν ′ ∈ s ′ and ǫ > 0 with Ball d∞ (ν ′ , ǫ) ∩ s ⊆ s ′ . Then, CPre δ π (s ′ ) is non-empty for small enough δ > 0.

Proof. Note that the requirement on s ′ says that s ′ should have non-empty interior in the d ∞ -topology induced on the set s. Consider such a set s ′ and a valuation ν ′ ∈ s ′ with B = Ball d∞ (ν ′ , ǫ) ∩ s ⊆ s ′ for some ǫ > 0. Let ρ be any run along π from some ν ∈ r to ν ′ , and let u = (d i , e i ) 1≤i≤n denote the contradiction, assume there is a sequence of indices x 1 , x 2 , . . . , x n ∈ C 0 , with

for some i, then by Lemma 3.3.3, for any α ∈ (0, 1), there exists a valuation ν in M , and satisfying ν(

Now, we choose ǫ as above, and small enough so that M x,y = -M y,x implies that M x,y -ǫQ x,y > -M y,x + ǫQ y,x . We let N = M -ǫQ. Then, given any shrunk DBM (M, P ), we have M x,y -ǫQ x,y < M x,y -δP x,y , for small enough δ > 0 as required. Since ǫ can be chosen arbitrarily small, N also has non-empty interior in the topology induced on M .

Note that N defined here could be given by scaling r, i.e. applying a homothety as in Figure 8.6.

The following lemma states that along a cycle whose orbit graph is complete, the reachability relation between valuations is complete.

Lemma 8.6.5 ( [START_REF] Basset | Thin and thick timed regular languages[END_REF]). Let π be a cycle of R(A) such that Γ(π) is a complete graph. Then, for any pair ν, ν ′ ∈ first(π), there exists a run ν π -→ ν ′ .

Proof: Winning aperiodic lassos implies robust safety. We write r = first(π). Let s ⊆ r given by Lemma 8.6.4 applied to r. Because Γ(π) is complete, we have, by Lemma 8.6.5, r = CPre 0 π (s). By Lemma 8.6.1, there exists a SM Q such that (r, Q) = CPre δ π (s). By Lemma 8.6.2, (r, Q) is non-empty. By definition of s, for small enough δ > 0, s ⊆ (r, Q), so Controller has a strategy to always move inside s, at each iteration of π. Similarly, CPre δ π ′ ((r, Q)) is also non-empty and therefore contains the initial state. Hence, Controller has a winning strategy. The strategy and a corresponding δ can be computed using Proposition 3.4.6, given an aperiodic lasso.

Algorithm

The algorithm for deciding robust Büchi acceptance follows from Lemma 8.4.1. It consists in looking for aperiodic non-punctual B-winning lassos in R(A). These lassos need not be simple, but we will bound their lengths, and give a polynomial space algorithm. Lemma 8.7.1. Let B be a Büchi objective in a timed automaton A, and π be an aperiodic nonpunctual B-winning cycle of R(A). Then, there exists a cycle π ′ with the same properties, with length at most

Proof. We label all prefixes π 1...i with (Γ(π 1...i ), b i ), where b i = ⊤ if π 1...i visits a location in B, and ⊥ otherwise. The number of labels is at most N = 2 (|C|+1) 2 +1 × |R(A)|. We argue that a cycle π ′ of length less than N can be extracted from π, if |π| ≥ N . In fact, in this case, we must have i < j such that Γ(π 1...i ) = Γ(π 1...j ) and b i = b j . But then, removing the infix π i+1...j yields a shorter cycle, which visits B if π 1...j does so, and with the same folded orbit graph. By repeating this procedure, we obtain a path π ′ of length less than N , which is non-punctual aperiodic B-winning.

The algorithm starts by guessing, using polynomial space, a state q 1 reachable by a non-punctual path in R(A). From q 1 , one can guess an aperiodic non-punctual B-winning cycle in polynomial space as follows. We visit a path q 1 e 1 q 2 e 2 . . . q i nondeterministically, and only keeping in memory the graph G i = Γ(q 1 e 1 q 2 e 2 . . . q i ) and a boolean indicating whether a winning state has been visited. Thanks to the operator ⊕, for any transition q i e i q i+1 , one can compute G i+1 using only G i and this transition. Whenever the state q 1 is visited again, the algorithm checks whether the current graph G i is aperiodic, by Lemma 8.7.2. If so, it stops and accepts. Otherwise, it stops and rejects after N steps.

Lemma 8.7.2 [START_REF] Stainer | Frequencies in forgetful timed automata[END_REF]). Given a cycle π, one can decide in polynomial space whether Γ(π) is aperiodic.

To actually compute a winning strategy, one can find a lasso as described above, while keeping the whole path q 1 e 1 q 2 . . . q n in memory. Then, one can extract a subset as in Lemma 8.6.4, and apply Corollary 3.4.5 to the cycle and to the prefix. This computation only takes polynomial time in the size of the path, but since the lasso can have exponential size, the computation takes worst-case exponential time.

PSPACE-hardness of robust synthesis

We show PSPACE-hardness of the parametrised robust controller synthesis problem, both for reachability and safety objectives.

We reduce the halting problem for linearly-bounded deterministic Turing machines to our synthesis problem. Let M be a linearly-bounded deterministic Turing machine, and w 0 be an input to M. Let N be the bound on the tape of M when simulating on input word w 0 (N is linear in |w 0 |). We assume the alphabet is {a, b}, and we encode the content of the i-th cell C i of M using a clock x i with the following convention: when the module is entered, cell C i contains an a whenever x i < 1, and it contains a b whenever x i > 2. To simulate a transition (q, α, q ′ , β, dir) of M, where α, β ∈ {a, b} and dir ∈ {-1, 1}, we build a module as in Fig. 8.7 for every index i such that both i and i + dir lie between 1 and N . Along this module, after any initial delay of duration u 0 ∈ (2, 3), cell C j contains a iff x j < 4, and it contains b iff x j > 4. Transitions between p j and p j+1 , for j = i, ensure preservation of this encoding. Between p i and p i+1 , the module checks that C i = α (through guard g α,i ), and replace this content with β (through reset Y β,i ). This way, one run through the module updates the content of the tape and the position of the tape head according to the selected transition of M.

We complete the construction with an initialization module (encoding input w 0 on the tape). We write A for this timed automaton and write halt for the halting location (which is made a sink).

We show the following lemma:

Robust Cost-Optimal Reachability

We define variants of the OptReach problems under perturbations. We are again interested in small values of the perturbation parameters. In fact, we will consider the limit of the cost when the magnitude of the perturbations goes to 0. Given a weighted timed game A, and δ > 0, let us denote by

) as the set of Controller's strategies in these semantics. Notice that S C (G exs δ (A)) does not depend on δ, since Controller only has to suggest moves that satisfy the guards (a winning strategy will depend on δ though). In contrast, S C (G cons δ (A)) does depend on δ since Controller is required to satisfy the guards even after perturbations. It is easy to see that

, and location ℓ, we define

, for the conservative perturbation game semantics. Given a strategy σ ∈ S C (G exs δ (A)), we define the limit cost of σ as follows.

The limit is well defined since strategy σ is valid for any δ > 0. Similarly, for σ ∈ G cons δ0 , we let

Here, we take the limit for 0 < δ < δ 0 , such that σ ∈ S P (G cons δ0 (A)) so that the strategy is valid. Thus, the limit-cost of a Controller's strategy σ is the cost it guarantees in the limit, against any strategy of Perturbator, when δ goes to 0.

We are interested in deciding whether Controller has a strategy that guarantees an upper bound on the limit-cost for a reachability objective. Definition 9.3.1 (Lim-OptReach). The Lim-OptReach strategy upper bound problem for the excess perturbation game semantics asks, given a weighted timed game A, a target location ℓ, and a rational λ, whether there exists a strategy σ ∈ S C (G exs δ (A)) such that lim-cost exs σ (A, ℓ) ≤ λ. The Lim-OptReach strategy strict upper bound problem for the excess perturbation game semantics asks, given the same input, whether there exists a strategy σ ∈ S C (G exs δ (A)) such that lim-cost exs σ (A, ℓ) < λ. We define similarly the Lim-OptReach strategy (strict) upper bound problem for the conservative perturbation game semantics.

We define the limit value as the infimum of the limit cost that can be guaranteed by Controller:

lim-cost exs σ (A, ℓ),

We also consider deciding upper bounds on values: (n + 1, m) for some k ′ , or the target location is reached with cost at most 5 + 2δ.

Proof. We let Controller go to the target location after unperturbed edges, whenever there has been a nonzero perturbation. So, to describe Controller's strategy, it suffices to define its delay in location B since the other edges are deterministic. We let Controller delay 2 -frac(ν(x)) 2 in B. This delay can be perturbed by δ. Then, the delay at location C must be 1 + frac((ν(x)) 2 ± δ. Upon arrival to D, Perturbator either chooses to go to the module Reduce k ′ and the play continues at Instr j k ′′ , or it chooses to the test module. By Lemma 9.5.5, the outcome is then at most 5 + 2δ . Now, if the game proceeds to Instr k j , then the encoding for counter m has not changed thanks to the unperturbed edges. For counter n, we have initially frac(x) = 1 2 n + η with η ∈ [-ǫ, ǫ]. We get that upon arrival to D, we must have frac(z)

, where ν ′ denotes the valuation upon arrival to D.

Decrementation Module Aut k c1,-. We now define a module that simulates the decrementation with zero-test instruction. We explain the expected behaviour of the module. The zero-test is done at the first location A: the counter c 1 equals 0 if exactly one time unit after the arrival at A, we have x = k x + 2. Recall that the encoding is exact for counters having the value 0. Otherwise, the run moves to either B or C ′ . In the former, Controller is to wait for 1 -2frac(x) time units, so that z = 1 + 2frac(x) upon arrival to D. This simulates a decrementation of c 1 , upto an error of δ, since the edge from B to C can be perturbed. If the decremented value of the counter c 1 is 0, then the new value for z can be chosen as exactly 2 by Controller along the path through C ′ .

Lemma 9.5.7. Assume module Aut k c1,-is entered with valuation ν ∈ code ǫ k (n, m) and cost 0. Then,

• If n = 0, Controller has a strategy to ensure reaching either Instr k j with the same configuration upto shifts and cost, or an accepting location with cost 0.

• If n ≥ 1, and ǫ < 1 2 , the play cannot reach Instr k j .

a run corresponds to a path of the corner-point abstraction. In fact, the infimum of the cost of the runs is the cost of the shortest path of the corner-point abstraction, as stated in the following lemma.

Lemma 9.6.3 ([BBBR07]). For any weighted timed automaton A and target location ℓ, value(A, ℓ) = value(R cp (A), ℓ).

In the perturbed case, we prove that the same algorithm can be applied, once we discard punctual paths.

Lemma 9.6.4. Given any weighted timed automaton A and target location ℓ,

Hence to compute the optimal cost on A, it suffices to consider the finite weighted automaton R np cp (A), and find the shortest path to location ℓ. To decide whether the limit value is less than some given constant λ, one can guess a path in R np cp (A) in polynomial-space, and check whether its weight is less or equal to than λ. Note that the problem is PSPACE-hard since it is already in the unweighted case. Theorem 9.3.4 follows.

The following lemma says that paths of the corner-point abstraction can be approximated by valid runs; this is used in the proof of Lemma 9.6.4, Lemma 9.6.5 ([BBBR07]). Let π be a path of R cp (A). For any ǫ > 0, there exists a run ρ ǫ that follows π such that last(ρ ǫ )| c ≤ W (π) + ǫ.

The following simple lemma states that an infinitesimal perturbation suffices to go from a punctual region to a non-punctual one.

Lemma 9.6.6. Given any δ > 0, and ν ∈ r in a punctual region r, there exists ǫ ∈ [-δ, δ] such that reg(ν + ǫ) is non-punctual.

We now prove Lemma 9.6.4.

Proof of Lemma 9.6.4. We will prove the two inequalities. First, it is easy to show that lim-value cons (A, ℓ) ≥ value(R np cp (A), ℓ). In fact, let σ ∈ S C (G cons δ (A)) be any strategy for Controller. We consider some strategy σ ′ for Perturbator, that perturbs so as to render the run non-punctual. More precisely, if the delay suggested by Controller is inside a non-punctual region, Perturbator plays 0, and otherwise it plays some small non-zero amount, by Lemma 9.6.6 below. Then the projection of the outcome of (σ, σ ′ ) to regions is a non-punctual initialized path π of R(A). But by Lemma 9.6.2, the cost of this run cannot be smaller than some run along π visiting vertices, and for any such run, there is a path in R np cp (A) with the same cost. To prove the other direction, for any ǫ > 0, we will construct a strategy for Controller in A that achieves cost value(R np cp (A), ℓ) + O(ǫ + δ), so this will be equal to value(R np cp (A), ℓ) + O(ǫ) in the limit, hence the infimum is value(R np cp (A), ℓ) as required. Assume that value(R np cp (A), ℓ) is finite. Let π denote a non-punctual path of R np cp (A) with W (π) = value(R np cp (A), ℓ). By Lemma 9.6.5, there exists a run ρ ǫ in A that follows π, with last(ρ ǫ )| c ≤ W (π) + ǫ. If all delays in ρ ǫ are positive, then let ǫ 0 > 0 smaller than any delay and such that all timed traces Ball d (ttrace(ρ ǫ ), ǫ 0 ) induce valid runs that follow π. Here, such an ǫ 0 > 0 exists since ttrace(π) is an open set (Proposition 8.3.4). Let δ ≤ ǫ 0 . Then, in G cons δ (A), if Controller suggests the delays and actions of ttrace(π), any • If n ≥ 1, then Controller cannot reach Instr ′ j k .

• If n ≥ 1, for any η > 0, Controller has a strategy that ensures that either

(n -1, m) for some k ′ , or the target location is reached with cost at most 5η.

Proof. Recall that, by definition, for any ν ∈ code ǫ k (0, m), ν(x) = k x . The module Instr ′ j k is reachable if, and only if n = 0 since Perturbator can lead to the non-accepting sink state (⊥) whenever Controller moves to A 1 while ν(x) = k x ; otherwise Instr ′ j k is reached. The guard of the other edges from A are not satisfied since xu = k x + 1.

If n = 1, Controller can go to C 1 . In fact, since ǫ < 1 4 , the guard xu > k x + 3 8 is satisfied. Then, the path from C 1 to D forces Perturbator to ensure zu = 1. If Controller goes to Instr ′ j ′ k ′′ , this condition yields a valuation in code ǫ k ′′ (0, m). If n = 1, then the guard of the edge from A to C 1 is not satisfied by the assumption on ǫ.

When n ≥ 1, Controller goes to B 1 , from where Perturbator is expected to lead to D with some valuation ν ′ satisfying ν ′ (z) = 2frac(ν(x)) ± α, for some α. Now, if |α| ≥ η, we let Controller go to the test module, therefore, end in an accepting location with cost at most 5η (by Lemma 9.6.7).

Otherwise, it proceeds to Instr ′ j ′ k ′′ .

Complete Reduction. Let A ′ M denote the weighted timed game constructed in this manner for a machine M . Let ℓ denote the target location obtained by merging all target location of the above modules. Theorems 9.3.5 and 9.3.6 follow from the following proposition.

Proposition 9.6.10. Minsky machine M halts if, and only if

if, and only if for all

Note that both impl η (A) and impl η (A) provide the relation ≈ ǫ + between the specification (that is, A ) and the implementation (that is, A ′ ∆ ). However, the latter has a stronger relation with A , so we also study it separately.

Trading precision against complexity. The choice of the granularity in impl η (A) and impl η (A) allows one to obtain an implementation of A with any desired precision. However, this comes with a cost since the size of impl η (A) is exponential in the granularity η. But it is also possible to give up on precision in order to reduce the size of the implementation. In fact, one could define impl ≡ (A) where the regions are replaced by the equivalence classes of any finite time-abstract bisimulation ≡. Then, we get A ≈ 0 impl ≡ (A) and impl ≡ (A) is time-abstract bisimilar to impl ≡ (A) ∆ for any ∆ > 0. In order to obtain, say impl ≡ (A) ≈ K impl ≡ (A) ∆ , for some desired K ≥ 1, one could, roughly, split these bisimulation classes to sets of delay-width at most O(K), that is the maximal delay within a bounded bisimulation class (there is a subtlety with unbounded classes, where, moreover, all states must have arbitrarily large time-successors within the class). Note however that safety specifications are only guaranteed to be preserved for small enough K (see Lemma 10.3.11).

Proof of Correctness

This section is devoted to the proof of Lemma 10.3.11. We start with general properties of regions, in subsection 10.4.1. In subsection 10.4.2, we prove the robustness of impl η (A) and impl η (A), as stated in points 2 and 3 of Lemma 10.3.11. In subsection 10.4.3, we prove that impl η (A) is bisimulation-samplable (point 4). Last, safety preservation of all the above systems, including safe(A), is proved in subsection 10.4.4.

Properties of regions

We give several properties of the enlargement of regions. Fixing constants η and M , we refer to any (η, M )-region simply as a region.

The following proposition shows, intuitively, that enlarged guards cannot distinguish the points of an "enlarged region". The proof is straightforward using difference bound matrices in normal form. Note that the property does not hold if φ s is not in normal form. whereas any d ′ ≥ M -A x,0 + η + ∆ suffices to have v + d ′ ∈ s for any v ∈ r. Hence d ′ can be chosen so that |d ′ -d| ≤ η + 2∆. The situation is similar if r satisfies x = A x,0 .

Suppose now that some clock x is below the maximal constant both in r and s. Suppose A x,0η < x < A x,0 in r and A ′

x,0η < x < A ′ x,0 in s, where A ′ x,0 > A x,0 . Then, for all v ∈ r and v

And this also holds for u and u + d. Therefore we get |d ′ -d| ≤ 2η. The remaining cases where x satisfies an equality in r or s are similar.

Proof of Robustness

We first prove that impl η (A) and impl η (A) are bisimulation-robust, for an appropriate ǫ, that is

∆ where A ′ denotes any of these (Lemma 10.4.5). Then we show "faithfulness" results: Lemma 10.4.7 shows that A ∼ 0 impl η (A) and safe(A) ∼ 0 A , and Lemma 10.4.8 shows that A ≈ 0 + impl η (A) .

Lemma 10.4.5. For any timed automaton A, any granularity η, and any ∆ > 0, we have

Proof. We fix any η and ∆. We define relation R ⊆

(10.1)

Intuitively, relation R relates states which can reach, by a delay, the same set of regions: we require the first system to reach φ s , while it is sufficient that the second one reaches φ s ∆ , since its guards are enlarged by ∆. Initial states satisfy (ℓ 0 , 0)R(ℓ 0 , 0). In fact all time-successor regions of 0 are reachable by a delay in both systems. Let (ℓ r , u) and (ℓ r , u ′ ) be two states of impl η (A) and impl η (A) ∆ respectively, such that (ℓ r , u)R(ℓ r , u ′ ). Suppose (ℓ r , u) delays d and takes the edge ℓ r φ∧φs,σ,R

. By construction, s is a time-successor of r and s ⊆ φ . By (10.1), there exists d ′ ≥ 0 such that u ′ + d ′ ∈ φ s ∆ . Then we also have u ′ + d ′ ∈ φ ∆ since φ s ⊆ φ by construction and by Proposition 10.4.2. It remains to show that

The former follows from the properties of regions, and the latter from Proposition 10.4.1. Then the set of time successor regions that are reachable by a delay are exactly all time successor regions of s[R ← 0] in both systems: in impl η (A) this is obvious from the region automaton construction, and in impl η (A) ∆ from Proposition 10.4.3.

We now prove the symmetric case. Suppose (ℓ r , u ′ ) delays d ′ and takes the edge ℓ r φ∧φs,σ,R

. By construction, s is a time-successor of r and s ⊆ φ . By (10.1), there exists

) as in the previous case. The index 2(η + ∆) of the bisimulation relation follows from Proposition 10.4.4.

Lemma 10.4.6. For any timed automaton A, any granularity η, and any ∆ > 0, we have

Proof of Samplability

We now show that impl η (A) is a sampled implementation for any timed automaton A. This result follows from the following lemma and Lemma 10.4.8.

Lemma 10.4.10. Let A be any integral timed automaton. For any granularities η and α such that η = kα for some k ∈ N >0 , we have impl η (A)

The proof is given below and is similar to Lemma 10.4.5. But we first need the following lemma.

Let us fix some granularity η. In what follows, all regions refer to η-regions. We fix another granularity α such that η = kα for some k ∈ N >0 .

Lemma 10.4.11. Let r, s be regions such that s ∈ tsucc * (r). For all v ∈ r ∩ N C , there exists

Proof. The case where r = s is trivial with d = 0. It is also easy if all clocks are above the maximal constant in s. Otherwise, we prove the lemma for the case where s is the immediate time successor of r.

In this proof only, an η-integer value means an element of ηN. Suppose that no clock has an η-integer value in r and let x denote the clock that has the greatest fractional part in r. Let A x,0η < x < A x,0 denote the constraint on x in r. Then s is obtained from r by replacing this constraint by x = A x,0 and without changing other constraints. We have

Suppose now that some subset of clocks X ⊆ C have η-integer values in r, say x = A x,0 for each x ∈ X. Then the immediate time successor of r is obtained by replacing these equalities either by A x,0 < x < A x,0 + η if A x,0 < M , or by A x,0 > M , without changing other contraints. We choose d = 0 and we have v ∈ s.

Proof of Lemma 10.4.10. We define the relation R ⊆

Initial states satisfy (ℓ 0 , 0) R (ℓ 0 , 0). In fact (the closures of) all time-successor regions of 0 are reachable by a delay in both systems (Lemma 10.4.11). Let (ℓ r , u) and (ℓ r , u ′ ) be two states of impl η (A) and impl η (A) α respectively, such that (ℓ r , u) R (ℓ r , u ′ ). Suppose (ℓ r , u) delays d and takes the edge ℓ r φ∧φs,a,R

. By construction, s is a time-successor of r (or itself) and s ⊆ φ . By (10.4), there exists d ′ ∈ αN such that u ′ + d ′ ∈ φ s . Then we also have

. Then both states can reach the closures of all time successors of s[R ← 0]: In impl η (A) this is clear from the properties of regions and in impl η (A) α from Lemma 10.4.11.

The symmetric case is similar. The index 2η follows from Proposition 10.4.4.

Proof of Safety Preservation (Ready Simulation)

To complete the proof of Lemma 10.3.11, it remains to prove the ready simulation relations. The following proves the statement on impl η (A) and impl η (A) of Lemma 10.4.12. The ready-simulation involving safe(A) is restated and proved afterwards.

Lemma 10.4.12. We have impl η (A)

Proof. We prove the lemma for impl η (A) ∆ . The case of impl η (A) ∆ is similar (choosing ∆ ′ = ∆).

We fix any η. Let A ∆ = (S, s 0 , Σ, T and impl η (A) ∆ ′ = (S ′ , s ′ 0 , Σ, T ′ ) respective TTSs. Let R ⊆ S × S ′ defined by, (ℓ r , u) R (ℓ, u) iff (ℓ r , u) is reachable and u ∈ φ r ∆ ′ . We first show that R is a simulation with parameter 0, then prove that it is a ready simulation w.r.t. Bad.

Initial states are obviously related by R. Now, consider any (ℓ r , u)R(ℓ, u) and suppose that

where s ∈ tsucc * (r). Then, A has the edge ℓ --→ (ℓ ′ , u ′ ) in A ∆ . Clearly, (ℓ ′ r ′ , u ′ ) R (ℓ ′ , u ′ ). We now show that actions Bad are not enabled in A ∆ at any point in this simulation, which suffices to show ready simulation. First, observe that if any location ℓ r is reachable in impl η (A) ∆ ′ , then all points of region r at location ℓ are reachable in A . This follows from the fact that impl η (A) encodes the region automaton in its locations, so any run of impl η (A) ∆ ′ follows the run of the region automaton of A, made of the sequence of regions annotating each location. Now, suppose that (ℓ r , u)R(ℓ, u) and (ℓ, u) d,σ --→ (ℓ ′ , u ′ ) in A ∆ for some d ≥ 0 and σ ∈ Bad. Let φ be the guard of this edge labelled by σ, and let s = reg(u + d). Since u + d ∈ φ ∆ , it must be the case that d ∞ (s, φ ) ≤ ∆. But since ∆ < η |C| by assumption, we have s ∩ φ = ∅ by Proposition 10.4.13, hence d ∞ (s, φ ) = 0. This implies that s (thus, r) is not reachable in impl η (A) since otherwise, A would not be safe w.r.t. Bad. This shows that actions in Bad are not enabled in this simulation starting from the initial states.

Proposition 10.4.13

Lemma 10.4.14. We have safe(A) ∆ ⊑ Bad A ∆ for any ∆ < 1 2|C| .

Proof. The identity relation, restricted to the set of reachable states, is clearly a simulation. To see that it is also a ready simulation, consider any reachable state (ℓ, u) of safe(A) ∆ , and suppose

The transitions should be interpreted as follows. If the environment generates an event at time T ′ , then the system responds to it at time T ′ + ǫ, provided that the reaction time from the previous event is over (T ′ + ǫ ≥ T + u 0 ), and the guard is approximately satisfied. If the system generates an event at time T ′ǫ, similar constraints apply but the timestamp is registered as T ′ , which is the time the environment receives the event. Notice that ǫ and u 0 are bounded by known values but are unpredictable, so they cannot be chosen by the system. We will consider scheduler functions ρ, which, depending on the history of a given run, chooses (ǫ, u 0 ) at each transition. For any scheduler ρ, we denote by A Impl ρ the implementation semantics, where (ǫ, u 0 ) is given by ρ at each transition. We will not formally define ρ here, but it can be done without difficulty.

The following proposition states the relation between the exact semantics and the implementation semantics of timed automata. All properties hold under any scheduler ρ. For any TTS T , let us write T ≥α , the TTS obtained from T where consecutive transitions are separated by at least α time units.

Proposition 11.2.2. Let A be a closed non-blocking timed automaton, and ∆ r , ∆ c , ∆ t > 0. Then, for any ∆ ≥ 2∆ c + 4∆ t + ∆ r and scheduler ρ, A ∆ Impl ρ is non-blocking and,

Before proving this proposition, let us give our main result on implementability. We assume that all timed automata contain an additional clock u that is reset at each edge, and that all edges are guarded by u ≥ 0. Clearly, this does not change the semantics of timed automata, but we will require these guards to be shrunk. We have the following result.

Theorem 11.2.3. Let A be a closed timed automaton that is strongly shrinkable w.r.t. A and let A -kδ be its witnessing shrinking for δ ∈

is a non-blocking timed refinement of A and time-abstract simulates A.

Proof. By Proposition 11.2.2 applied to A -kδ , we have

and A -kδ+∆ Impl ρ is non-blocking whenever ∆ ≥ 2∆ c + 4∆ t + ∆ r , ∆ ′ = ∆ + 2∆ c + 4∆ t and δ ≥ max(2∆ r + ∆ t , ∆ ′ ). In fact, A -kδ ≥2∆r+∆t is equal to A -kδ whenever δ ≥ 2∆ r + ∆ t due to the shrinking of the additional clock constraints in A. The rightmost simulation is due to the fact that -kδ + ∆ ′ ≤ 0.

Thus, given δ 0 , the parameters ∆ c , ∆ t , ∆ r and ∆ can be chosen so that the implementation semantics of the automaton A -kδ+∆ is a timed refinement of the exact semantics of the original automaton. Moreover, when A is shrinkable (say, with parameters kδ), then A -kδ+∆ Impl ρ is also non-blocking and A ⊑ t.a. A -kδ+∆ Impl ρ . Thus, shrinkable timed automata can be implemented so as to preserve non-blockingness and the behavior upto time-abstract simulation.

Proof of Proposition 11.2.2

We prove Proposition 11.2.2 through Lemmas 11.3.1 -11.3.5. In the proofs we use the standard supremum distance on R n defined by d

, where ν, ν ′ ∈ R n . For any vector ν and real α, we denote by ν + α the vector obtained by adding α to all components of ν.

Lemma 11.3.1. Let A be a closed timed automaton, ∆ r , ∆ c , ∆ t > 0 denote the parameters. Then, for any ∆ ≥ 2∆ c + 4∆ t , and any scheduler ρ,

Proof. We show that the relation R defined by (ℓ, T, v, u 0 )R(ℓ, ν, T ′ ) such that T ′ ∈ [T -∆ t , T ], and d ∞ (ν + T -T ′ , Tv) ≤ ∆ t is a timed simulation. Notice that we do not require these two states to be at the same time instant, but the difference between these instants must be bounded and the clock valuations must be close when the second system delays to time T . Consider such a pair of states.

Consider the following transition.

(ℓ, T, v, u 0 )

is given by ρ, and ⌊T + τ + ǫ⌋ ∆c -⌊v⌋ ∆c |= g. We show that the following transitions are realizable in A ∆ .

Now, consider the following transition.

(ℓ, T, v, u 0 )

is given by ρ and ⌊T + τ -ǫ⌋ ∆c -⌊v⌋ ∆c |= g. We show that the following transition is realizable in A ∆ .

We show that ν + T + τ -T ′ |= g 2∆c+4∆t . As in the previous case, we have, T + τ -ǫ -v |= g 2∆c and using the fact that d

In fact, for any clock x ∈ R, this follows from d ∞ (ν + T -T ′ , T -v) ≤ ∆ t , and for all x ∈ R, we have ν ′ (x) = 0 and (T + τ -v ′ )(x) = ǫ ≤ ∆ t .

For any timed automaton A and ∆ ′ ≥ 0, we define A ≥∆ ′ as a TTS whose states are (ℓ, ν, u), where l is a location, ν a clock valuation and u the time elapsed since the latest action (and it is 0 initially).

Lemma 11.3.2. Let A be a closed timed automaton, and ∆ r , ∆ c , ∆ t > 0 parameters. Then, for any ∆ ≥ 2∆ c + 4∆ t , and any scheduler ρ,

Proof. We show that the relation R defined by (ℓ, ν, T )R(ℓ, T ′ , v, u 0 ) such that T ′ ∈ [T, T + ∆ t ] and d ∞ (ν + (T ′ -T ), T ′v) ≤ ∆ t is a timed simulation. Consider such a pair of states.

Suppose that (ℓ, ν, T ) σ(T +τ ) -----→ (ℓ ′ , ν ′ , T + τ ) for some σ ∈ Σ in , where ν ′ = (ν + τ )[R ← 0]. For any (u 0 , ǫ) ∈ [0, ∆ r ] × [0, ∆ t ] given by ρ, this is simulated by the following transition. It remans to show that d ∞ (ν ′ + ǫ, T + τ + ǫ -v ′ ) ≤ ∆ t . In fact, for all x ∈ R this follows from hypothesis since the difference between the values of a clock in two systems is unchanged when both systems delay to time instant T + τ + ǫ. For all x ∈ R, we have (ν ′ + ǫ)(x) = ǫ ≤ ∆ t and (T + τ + ǫ -v ′ )(x) = 0. Hence, (ℓ ′ , ν ′ , T + τ )R(ℓ ′ , T + τ + ǫ, v ′ , u ′ 0 ). Suppose now that (ℓ, ν, T ) σ(T +τ ) -----→ (ℓ ′ , ν ′ , T + τ ) for some σ ∈ Σ out , where ν ′ = (ν + τ )[R ← 0]. For any (u ′ 0 , ǫ) ∈ [0, ∆ r ] × [0, ∆ t ] given by ρ, this is simulated by the following.

(ℓ, T ′ , v, u 0 )

In fact, by hypothesis, τ ≥ 2∆ r + ∆ t , so T + τ -ǫ -T ′ ≥ ∆ r . Let us show that the guard is satisfied.

We have ν + τ |= g. Since d ∞ (ν + (T ′ -T ), T ′ -v) ≤ ∆ t , we have d ∞ (ν + τ, T + τ -v) ≤ ∆ t as in the previous case, hence T + τ -ǫ -v |= g 4∆t . Then, ⌊T + τ -ǫ⌋ ∆c -⌊v⌋ ∆c |= g 4∆t+2∆c . It remans to show that d ∞ (ν ′ , T + τ -v ′ ) ≤ ∆ t . This follows from hypothesis for clocks x ∈ R since both systems delay to time instant T + τ . For all x ∈ R, we have (ν ′ )(x) = 0 and (T + τ -v ′ )(x) = ǫ ≤ ∆ t . Hence, (ℓ ′ , ν ′ , T + τ )R(ℓ ′ , T + τ, v ′ , u ′ 0 ).

We are now interested in the preservation of non-blockingness in the implementation semantics. Note that this is not a consequence of the simulation relations. We first prove a property on the enlarged zones. In other terms, the width of Z is the least delay necessary to go out of Z starting inside the lower boundary.

A guard is said to be normalized if the corresponding DBM is normalized. Recall that all guards we consider are closed, thus so are DBMs.

Lemma 11.3.4. Let g be a normalized guard such that g = ∅. Then for any ∆ > 0, g ∆ has width greater than or equal to ∆.

Proof. Let M be a DBM that describes g . Then M ′ = M + ∆1 describes g ∆ , where 1 is the matrix with same dimension as M in which all coefficients are 1's. Let v ∈ lb( M ′ ). We will show that v + τ ∈ M ′ for all τ ∈ [0, ∆]. First, observe that clock differences are constant during delay transitions. So, whenever -M y,x -∆ ≤ v(x)v(y) ≤ M x,y + ∆, we have -M y,x -∆ ≤ (v(x) + τ ) -(v(y) + τ ) ≤ M x,y + ∆ for all τ . We now show that rectangular constraints