Magali Sophie

Marie

Merce

Laurence

Ainsi Qu'

Abdul Léo

Suman Antoine Anirban

Aline, Victor, Grégory Nicolas W Bastien

Anne-Marie Lacroix

Peggy Cellier

César Viho

Cécile Bidan

pour que je puisse dormir la veille de ma soutenance

REMERCIEMENTS

En préambule des deux cents et quelques pages qui viennent, qui visent en partie à faire apprécier aux courageux lecteurs qui s'apprêtent à les lire les diverses facettes des polyèdres, j'aimerais en prendre quelques-unes pour remercier celles et ceux qui ont été présents durant cette thèse et qui l'ont rendue plus sereine. Un grand MERCI tout d'abord à Thierry Jéron, David Mentré et Nicolas Markey pour leur encadrement bienveillant et humain ainsi que leurs précieux conseils durant ces trois et quelques années. Merci d'avoir relu aussi consciencieusement ce manuscrit et de m'avoir prodigué tant de conseils pour l'améliorer. Merci à Pierre-Alain Reynier d'avoir accepté de présider mon jury, à Catalin Dima et Franck Cassez d'avoir accepté de rapporter cette thèse, et enfin, merci à Béatrice Bérard et Thomas Chatain d'avoir fait partie de mon jury. Merci également à Étienne André de s'être joint à Béatrice afin de me conseiller durant cette thèse au sein du comité de suivi doctoral. Leurs conseils m'ont été très précieux. Merci également aux enseignants, Thomas, Emmanuelle, Pierre-Alain et David P., qui m'ont fait confiance et proposé d'assurer des enseignements pour eux. Certains enseignants vous marquent plus que d'autres et vous donnent envie d'enseigner à votre tour. À ce titre, je remercie Stéphane Génouël pour son incroyable investissement.

Off On 0 ≤ x < 1 appuyer, x := 0 0 ≤ x < 1 appuyer x := 0 x ≥ 1 Ce système se représente à l'aide de l'automate temporisé de la Figure 2. De nombreuses propriétés peuvent être vérifiées sur des automates temporisés. Dans notre exemple d'éclairage automatique, la propriété que nous souhaitons vérifier est de savoir si nous pouvons atteindre l'état « Off » à partir de n'importe quelle situation. La réponse est : si on laisse passer le temps, sans appuyer infiniment souvent sur le bouton « appuyer », la seule possibilité est d'atteindre l'état « Off ». Dans notre exemple d'ordonnancement, la propriété que nous souhaitons vérifier est de savoir si nous pouvons atteindre la localisation f , à partir de la configuration initiale ( 0 , (0, 0)). Trouver une bonne exécution indiquerait si les tâches a, b et c peuvent être exécutées. On peut aussi se demander si, pour respecter les contraintes de temps, il faut donner un ordre entre les tâches a et b : peut-on trouver une exécution où la tâche a est exécutée avant b, mais aussi une où b est exécutée avant a ? D'autres exemples d'objets du quotidien peuvent être représentés par des automates temporisés afin d'être vérifiés formellement. Un exemple possible est un ascenseur, pour lequel nous pouvons vouloir vérifier qu'il descendra finalement à notre étage si nous l'appelons. Ces spécifications des localités sont appelées propriétés d'atteignabilité. Vérifier l'atteignabilité d'une localité (ou d'un ensemble de localités), étant donné une localité initiale et une valeur initiale des horloges, dans l'automate temporisé, consiste à trouver une exécution depuis la localité initiale et la valeur initiale des horloges, jusqu'à la localité souhaitée. Dans cette thèse, nous étudierons l'atteignabilité.

Cette introduction est organisée comme suit : dans un premier temps, nous décrivons comment les systèmes temps-réel, puis les propriétés temporelles, sont habituellement modélisés. Dans un deuxième temps, nous présentons le principe de la vérification formelle. Dans un troisième temps, nous décrivons comment nous modélisons les imperfections des modèles formels. En quatrième et dernier lieu, nous décrivons l'objectif de cette thèse et ses contributions.

Systèmes temporisés

Afin d'être formellement vérifiés, les systèmes temps-réel sont formellement modélisés. Les principaux modèles utilisés dans la vérification formelle des systèmes temps-réel sont le modèle des automates temporisés et certaines de ses variantes. Nous présentons dans cette section quatre de ces modèles : les automates temporisés, les automates hybrides temporisés, les automates temporisés pondérés et les jeux temporisés. entre 16 et 20 h. L'un des objectifs de ces modèles est d'atteindre le but en minimisant (ou en maximisant) la fonction de coût.

Rennes

Jeux temporisés

Les jeux temporisés généralisent les automates temporisés en ajoutant plusieurs joueurs dans l'automate temporisé, pouvant prendre des décisions différentes (comme le contrôle de certaines localités uniquement), avec des buts pouvant être différents : minimiser ou maximiser une fonction de coût, atteindre ou ne pas atteindre un but, etc. Lorsque leurs objectifs sont opposés, nous pouvons séparer ces joueurs en joueurs et opposants.

Il peut y avoir plusieurs sémantiques de jeux temporisés. Par exemple, les jeux où les joueurs peuvent contrôler différentes localités sont une forme de jeux par tours. Cette sémantique est détaillée dans la sous-section 5. 2.3.

Conclusion

D'autres modèles sont possibles. Par exemple, lorsqu'il s'agit de systèmes temporisés distribués, on peut utiliser des automates temporisés distribués. Lorsque certaines décisions (délais, actions...) ne sont pas prises par un joueur mais par une distribution aléatoire sur toutes les possibilités, on peut utiliser des automates temporisés probabilistes.

Propriétés temporelles

Ces modèles nous permettent de formaliser les propriétés que nous voulons vérifier. Il existe plusieurs types de propriétés temporisées, telles que la vivacité et la sûreté. Elles furent introduites par Alpern et Schneider dans [START_REF] Alpern | Defining liveness[END_REF] et par Alpern, Demers et Schneider dans [START_REF] Bowen Alpern | Safety without stuttering[END_REF].

Les propriétés de vivacité garantissent qu'un certain événement finira par se produire, quelle que soit l'execution. Elles s'opposent aux propriétés de sûreté qui garantissent qu'un certain événement ne se produira jamais, quelle que soient les exécutions. Les propriétés de sûreté peuvent être utilisées pour de nombreuses applications, par exemple pour éviter les obstacles pour les trains. Pour qu'une propriété de sûreté soit violée, il faut trouver une exécution finie où cet événement se produit. Alpern et Schneider on démontré dans [START_REF] Alpern | Recognizing safety and liveness[END_REF] le résultat suivant : nous pouvons exprimer toute propriété temporelle linéaire comme l'intersection de propriétés de vivacité et de sûreté.

La propriété que nous étudierons dans cette thèse est l'atteignabilité, qui correspond à la négation d'une propriété de sûreté. Les propriétés d'atteignabilité garantissent qu'une certaine localité est atteignable compte tenu d'une (ou plusieurs) configuration(s) initiale(s), i.e. qu'il existe une éxecution, depuis une configuration initiale, atteignant cette localité. Considérons par exemple l'exemple de la Figure 3. La propriété d'atteignabilité que nous pourrions vérifier est la suivante : « Peut-on atteindre Londres depuis Rennes si l'horloge initiale est x = 8?3 ».

Vérification de systèmes temporisés

Expliquons à présent comment nous vérifions les systèmes temps-réel. Le but de la vérification formelle est de considérer toutes les configurations possibles des systèmes et de prouver que la propriété temporelle que nous considérons est toujours vérifiée, ou à défaut de construire un contre-exemple où cette propriété n'est pas vérifiée. C'est le principe des algorithmes de model-checking, introduits par Clarke, Emerson, Queille, Sifakis au début des années 80. Leur travail fut récompensé par un prix Turing en 2007. Pour une introduction au model-checking, on pourra se référer au livre [START_REF] Baier | Principles of model checking[END_REF].

Le principe d'un algorithme de model-checking est illustré dans la Figure 4 : étant donné un modèle abstrait et une propriété temporelle, l'algorithme de model-checking apporte soit la garantie que la propriété temporelle (par exemple, « La lumière finira-telle par s'éteindre ? ») est vérifiée, soit un exemple d'exécution où elle n'est pas vérifiée. Le principe du model-checking est d'abord de modéliser le système et la propriété que l'on veut satisfaire, puis d'exécuter l'algorithme de model-checking. Si la propriété est vérifiée, le processus s'arrête, sinon le contre-exemple doit être analysé afin de modifier le modèle (ou la propriété), jusqu'à ce que la propriété soit vérifiée. La force du model-checking est

Modèle formel

Propriéte temporelle algorithm de modelchecking

Propriété satisfaie

Contre-exemple Figure 4 -Principe de la vérification formelle.

de vérifier formellement une propriété, pour un modèle général, individuellement (cela signifie que nous pouvons vérifier chaque propriété indépendamment et voir laquelle n'est pas vérifiée) et de fournir des contre-exemples pour expliquer pourquoi la propriété n'a pas été satisfaite. Sa faiblesse est son coût élevé pour les systèmes complexes, tels que les automates temporisés, en raison de l'explosion de l'espace d'états.

Plusieurs outils de model-checking, pour différents types de systèmes temporisés, ont été implémentés, parmi lesquels on peut citer : Kronos4 ([BDM + 98], [START_REF] Yovine | KRONOS: A verification tool for real-time systems[END_REF]), Uppaal5 ([BDL + 06]), TChecker6 , IMITATOR7 ([And09], [START_REF] André | IMITATOR II: A tool for solving the good parameters problem in timed automata[END_REF], [AFK + 12], [START_REF] André | IMITATOR 3: synthesis of timing parameters beyond decidability[END_REF]), Roméo8 ([GLM + 05], [LRS + 09]) at PAT9 ([SLD + 09]).

Robustesse : prendre en compte les possibles imprécisions

La robustesse d'un objet fait référence, en général, à sa capacité à résister à de (petites) perturbations. Lors de la modélisation de systèmes temporisés, on suppose qu'on peut atteindre une précision parfaite sur tous les aspects de la modélisation. Dans ces modèles, nous supposons que :

Les horloges croissent exactement à la même vitesse, elles sont synchronisées.

Les gardes des transitions seront exactement celles qui seront implémentées.

Les délais proposés pour passer une transition seront parfaitement appliqués, avec une précision infinie, sans latence.

Cependant, dans le monde réel, les horloges peuvent se désynchroniser et ainsi ne pas évoluer à la même vitesse. Le délai proposé peut aussi être appliqué avec une légère avance ou latence. Par exemple, dans le système d'éclairage automatique présenté dans la Figure 1, si nous appuyons sur le bouton à x = 0.8, le délai peut en fait être appliqué à 0.802, en raison d'une légère latence. Par conséquent, la vérification de la capacité à résister aux perturbations est une question importante. La robustesse peut également être appliquée à l'ordonnancement. L'ordonnancement est l'action d'ordonner des tâches pour les réaliser (voir l'exemple illustré dans la Figure 2). Ses objectifs sont nombreux, l'un d'eux est de minimiser le temps d'attente entre deux tâches. Il est facile de concevoir que les latences sont inévitables. Ainsi, dans le monde réel, les actions ne se succèdent pas sans imprécision quant au moment où elles ont été réalisées. La fiabilité du résultat final vis-à-vis de diverses perturbations de l'environnement et d'un matériel perfectible est donc une question cruciale si l'on veut exécuter cet ordonnancement dans le monde réel. Dans l'exemple de la Figure 2, si la latence est supérieure à 1 seconde, cela est problématique car le délai entre les deux tâches a et b doit être compris entre 2 et 3 secondes.

Il existe différentes façons de vérifier la robustesse. Nous en détaillons quatre dans cette section. Considérons un système temps-réel S, modélisé par un modèle M. On veut vérifier une propriété temporelle ϕ. Ce modèle M a été construit pour représenter S à l'aide de spécifications.

Analyse du langage Cette première approche, qui ne transforme pas le modèle, consiste à analyser dans quelle mesure la perturbation peut changer ce que le modèle Analyse de la robustesse Cette autre approche vérifie si le modèle peut résister aux perturbations, sans interférer. Supposons que le modèle M satisfasse ϕ , le but de l'analyse de la robustesse est de vérifier si la propriété ϕ est toujours satisfaite pour un modèle légèrement perturbé M.

Implémentation robuste Cette approche implémente le modèle robuste, en continuant à respecter les spécification du système temps-réel. Le modèle M peut ne pas satisfaire la propriété ϕ après certaines perturbations. L'implémentation robuste a pour objectif de transformer le modèle M en un modèle robuste aux perturbations , M, qui satisfait toujours les spécifications du système.

Synthèse robuste Enfin, la synthèse robuste consiste à construire un contrôleur qui forcera le modèle à avoir un bon comportement par rapport à la propriété désirée ϕ, malgré les perturbations. Cette approche utilise généralement la théorie des jeux pour modéliser et construire la stratégie du contrôleur et de l'environnement.

Les perturbations sur les automates temporisés peuvent se produire à différents niveaux. Pour énumérer les principales d'entre elles, il convient d'énumérer les composants qui peuvent être perturbés sur un automate temporisé : gardes, horloges, délais, transitions, etc. La plupart des travaux ont isolé chaque type de perturbation afin de définir différents modèles de robustesse. Après tout, un automate peut satisfaire de manière robuste une propriété temporelle malgré des imperfections d'horloges, mais ne pas être robuste face à une perturbation sur les gardes. Le premier modèle de robustesse a été proposé par [START_REF] Gupta | Robust timed automata[END_REF], où ils cherchent à vérifier la robustesse topologique d'un run. Les runs sont représentés comme des trajectoires et le but est de vérifier si les voisins de ces trajectoires sont acceptés par l'automate temporisé. Dans cette thèse, nous nous concentrons sur les perturbations sur les délais pour les automates temporisés et les jeux.

Plan de la thèse

Dans cette thèse, nous présentons des résultats sur la robustesse des automates temporisés en considérant les perturbations sur les délais et la permissivité maximale autorisée. La permissivité a été étudiée par [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF] en 2015, pour des automates temporisés à une horloge. Ils fournissent un algorithme en temps polynomial pour calculer la permissivité maximale autorisée. Les résultats de cette thèse visent à étendre les résultats de [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF] pour plusieurs horloges en utilisant une fonction légèrement modifiée pour calculer la perturbation d'un automate temporisé. En effet, dans [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF], l'imprécision d'une exécution est la somme de l'inverse de chaque imprécision appliquée tout au long d'une exécution. Dans notre cas, nous représentons l'imprécision d'une exécution comme la plus petite imprécision commise lors d'une exécution, afin de s'assurer que cette imprécision sera autorisée à chaque transition. Nous appelons cette imprécision autorisée la permissivité. Notre but est de calculer cette permissivité maximale pour les automates multi-horloges pour toute configuration. Cette thèse est organisée comme suit. Les Chapitres 1 à 3 définissent les notions de base et l'état de l'art : Chapitre 1: Nous présentons les définitions mathématiques que nous utiliserons dans cette thèse. Les deux principaux concepts mathématiques que nous utilisons sont les polyèdres et les fonctions affines par morceaux. Ces fonctions affines par morceaux sont considérées en dimensions supérieures à 1. Nous définissons leurs morceaux comme des polyèdres et définissons les fonctions affines par morceaux avec la notion de partition de polyèdres.

Chapitre 2: Nous donnons une introduction aux automates temporisés et à la vérification d'atteignabilité. Nous définissons également notre modèle de robustesse en définissant la sémantique permissive, la permissivité d'une exécution ainsi que la permissivité maximale permise par un automate, étant donné une configuration fixe.

Chapitre 3: Ce chapitre donne un état de l'art des différents types de robustesse proposés dans la littérature.

Cette thèse comporte quatre contributions principales, détaillées dans les Chapitres 4, 5, 6 et 7.

Chapitre 4: Nous définissons une suite de fonctions afin d'avoir une expression itérative de la fonction de permissivité. Nous appelons cette suite de fonctions la suite de fonctions permissives sous-optimales. En effet, l'expression de la fonction de permissivité fournie dans le Chapitre 2 n'est pas adaptée à un calcul effectif, car elle considère tous les intervalles proposés en même temps. Afin d'avoir une approche

INTRODUCTION

Motivations

Real-time systems are used in many areas and involve a large number of components.

That can be car engines, printers, pacemakers or assembly lines for instance. The need of formally checking these systems before implementing them comes from several reasons. First, they can be critical systems (such as planes, car engines, rockets or pacemakers), for which errors can cost life or a lot of time. Secondly, they can be manufactured in large numbers, such as telecommunications chips. Formally verifying these models requires considering a formal model, which takes time into account and on which one can formally state what one intends to verify.

Timed automata is a very useful and efficient mathematical model to provide an abstract model of real-time systems. It was introduced in 1994 by Alur and Dill in [START_REF] Alur | A theory of timed automata[END_REF]. They provide a very expressive representation of timing aspects and can be generalised to more complex models to express even more types of real-time systems. The principle is to consider an automaton and to add a finite number of clocks that constrain the passing of the different transitions.

Off On 0 ≤ x < 1 press, x := 0 0 ≤ x < 1 press x := 0 x ≥ 1 Figure 5 -A timed automaton that illustrates an automatic light system. that: a and b need to be executed before c.

The delay between tasks a and b should be between 2 and 3 seconds.

Task c must be performed no later than 5 seconds before the end of task a, and at least 3 seconds after task b.

This real-time system is represented by the timed automaton in Figure 2. The clock x (resp. y) represents the time elapsed since task a (resp. b) took place. Many properties can be checked on timed automata. For instance on our lamp example, the property we would like to verify is whether we can reach the 'Off' state from any situation. The answer is: if we let time pass, without pressing the button 'press' infinitely often, the only possibility is to reach the 'Off' state. In our scheduling example, the property we would like to verify is whether we can reach location f , from the initial location 0 . Finding a good execution would indicate whether the tasks a, b and c can be executed. One can also ask whether, in order to respect the time constraints, an order must be fixed between a and b: can one find an execution where a is executed before b, but also one where b is executed before a? Other examples of everyday objects can be represented by timed automata in order to be formally checked. An example is a lift, where we may want to check that it will eventually go down to our floor if we call it. These specification of the locations are called reachability properties. Verifying the reachability of a location (or a set of locations), given an initial location and value of clocks in the timed automaton, consists in finding an execution from the initial location and value of clocks, to the desired location. In this thesis, we focus on this particular timed property.

This introduction is organised as follows: first, we describe how real-time systems, and then the properties to verify, are usually modelled. Secondly, we present the principle of formal verification. Thirdly, we describe how we model the imperfections of the formal models. Fourthly and finally, we describe the aim of this thesis and its contributions.

Timed systems

In order to be verified, real-time systems are formally modelled. The main used model in formal verification of real-time systems is timed automata and some variants. We present in this section four of these models: timed automata, weighted timed automata, timed games and hybrid timed automata.

Timed and hybrid automata

A timed automaton, introduced by Alur and Dill in 1994 in [START_REF] Alur | A theory of timed automata[END_REF], represents a system where to pass a transition is constrained by the satisfaction of timing constraints of the clocks. Depending on the used semantics, the constraints can take several forms. Each clock can be bounded independently, as in Figure 5, or the difference of clocks can be bounded (as 0 ≤ x-y ≤ 1). More generally, constraints on clocks can be linear inequalities.

Each clock can be reset after passing a transition. The transition is represented with an edge between two locations, and the reset of the clock x is represented with the symbol 'x := 0'. The clocks evolve at the same speed and each transition is passed by proposing a delay and an action.

Hybrid automata are an infinite state systems whose difference with timed automata is that the values of the clocks are described by ordinary differential equations. They can be quite useful for applications related to cyber physical systems.

Weighted timed automata

Weighted timed automata were introduced by [START_REF] Alur | Optimal paths in weighted timed automata[END_REF] and [BFH + 01]. These models can be used used for applications such as traffic jam or choosing different types of transport (air-plane vs train vs car for instance). In these models, staying in a location, or taking a transition may have a cost. We sum the total cost during an execution, a run, and call it the cost-function.

Let us consider the example of choosing between air-plane and train to go to a city. In Figure 6 we represent two possible ways to reach London from Rennes. We model these possibilities with their associated costs (in euros) with a weighted timed automaton. In this timed automaton, the constraints represent imposed schedules of each mode of transport.

In this example, we can reach London with a direct plane, that costs 120 e, or with two trains, that cost a total of 89 e. The clocks represent the time of the current day (in hours) and are reset at midnight. In this example, the train travel is cheaper than the plane travel, but the schedules of the trains are more constrained in our example: the train from Lille to London should be taken between 4 and 8 pm. One of the aim of these models is to reach the goal while minimising (or maximising) the cost function.

Rennes

Timed games

Timed games extend timed automata by adding several players that can have different control (proposing delay or actions, proposing delay and action on only specific locations) with different purposes: minimising, maximising a cost function, reaching or not reaching a goal etc. When their purposes are opposite, we can separate the players into players and opponents.

There can be several semantics of timed games. For instance, games where players can control different locations is a form of turn-based games. This semantics is detailed in Subsection 5. 2.3.

Conclusion

Other models are possible. For instance, when tackling with distributed timed systems, we can use distributed timed automata. When some decisions (delays, action. ..) are not decided by a player but by a random distribution over all possibilities, we can use probabilistic timed automata.

Timed properties

These models enable us to formalise the properties we want to verify. There are several types of timed properties, such as liveness and safety, introduced by Alpern and Schneider in [START_REF] Alpern | Defining liveness[END_REF] and by Alpern, Demers and Schneider in [START_REF] Bowen Alpern | Safety without stuttering[END_REF]. Let us detail them.

Liveness properties ensure that some (good) event will eventually occur. They are opposed to safety properties that ensure that some (bad) event will never occur. Safety properties can be used for many application, for example to avoid obstacles for car engines or trains. For a safety property to be violated, a finite execution should be found where this bad event occurs. A useful and strong result was proved by Alpern and Schneider in [START_REF] Alpern | Recognizing safety and liveness[END_REF]: we can express every linear-time property as the intersection of liveness and safety properties.

The property we will study in this thesis is reachability, which corresponds to the negation of a safety property. Reachability properties ensure that a target location is reachable given an (or several) initial configurations, i.e. that there exists a run from an initial configuration to the target location. Let us consider for instance the example of Figure 6. The reachability property we could verify can be 'can we reach London from Rennes if the initial clock is x = 8? 11 '.

Principle of formal verification

Now that we have presented how real time systems are modelled, let us explain how to verify them. The aim of formal verification is, considering all possible configurations of our systems, and to either prove that the timed property we consider is verified, or construct a counter-example where this property is not verified. This is the principle of model-checking algorithms, introduced by Clarke, Emerson, Queille, Sifakis in the early 80s. Their work was rewarded by a Turing award in 2007. For an introduction to Model Checking, one can refer to the book [START_REF] Baier | Principles of model checking[END_REF].

The principle of model-checking algorithm is illustrated in Figure 7: given an abstract model and a timed property, the model-checking algorithm gives either the guarantee that the timed property (for instance, 'Will our system eventually finish ?') holds in every configuration, or an example of a execution where it was not verified. The principle a model-checking is first to model the system and the property we want to satisfy, then to run the model-checking algorithm. If the property is verified, the process stops, otherwise the counter-example should be analysed in order to change the model (or the property), until the property is verified.

The strength of model-checking is to formally verify a property, for a general model, individually (meaning that we can check each property independently and see which one is violated) and provide counter-examples to explain why the property was not satisfied. The weakness of model-checking is its high cost for complex systems, such as timed automata, because of state-space explosion.

Several model-checking tools, for different types of timed systems, have been designed such as Kronos 12 ([BDM + 98], [START_REF] Yovine | KRONOS: A verification tool for real-time systems[END_REF]), Uppaal 13 ([BDL + 06]), TChecker 14 , IMIT-ATOR 15 ([And09], [START_REF] André | IMITATOR II: A tool for solving the good parameters problem in timed automata[END_REF], [AFK + 12], [START_REF] André | IMITATOR 3: synthesis of timing parameters beyond decidability[END_REF]), Roméo 16 ([GLM + 05], [LRS + 09]) and PAT 17 ([SLD + 09]).

An abstract model

A timed property modelchecking algorithm

Satisfied

Counter-example

Robustness: Verifying timed systems despite perturbations

The robustness of an object refers, in general, to its ability to resist to (small) perturbations. When modelling timed systems, perfect precision is supposed in all aspects. In these abstract models, we assume that:

The clocks grow at exactly the same speed, they are synchronised.

The guards of the transitions will be exactly those that will be implemented.

The delays proposed to pass a transition will be exactly applied, with infinite precision.

are unavoidable, and that in the real world, actions will not follow each other without imprecision as to when they were performed. In the example of Figure 2, if the latency is greater than 1 second, it is an issue as the delay between tasks a and b should be between 2 and 3 seconds. The reliability of the final result with respect to various environmental disturbances and perfectible hardware is therefore a crucial issue if one wants to execute this scheduling in the real world.

There are different ways to check robustness. We detail four of them in this section. Let us consider a real-time system S, modelled by an abstract model M, to verify the timed property ϕ. This model M was built to represent S with the help of specifications.

of robustness was proposed by [START_REF] Gupta | Robust timed automata[END_REF]. Their goal is to verify the topological robustness of a run. Runs are represented as trajectories and the goal is to check if the neighbours of these trajectories are accepted by the timed automaton.

In this thesis, we focus on the perturbations on the delays for timed automata and games.

The goal of this thesis is to construct a robust synthesis: we construct a strategy, for any configuration, to satisfy the reachability on timed automata, despite the perturbations of delays. On top of that, we want to compute the maximal perturbation allowed.

In other terms, we want to compute how much permissive the timed automaton is to perturbations on the delays and build a controller that will maximise the permissiveness of a timed automaton. permissiveness of a run and the maximal permissiveness allowed by an automaton, given a fixed configuration.

Chapter 3: This chapter reviews the state of the art for the different kinds of robustness proposed in the literature.

There are four main contributions in this thesis, detailed in Chapters 4, 5, 6 and 7.

Chapter 4:

We define a sequence of functions to provide an iterative expression of the permissiveness function. We call this sequence the sequence of suboptimal permissive functions. Indeed, the expression of the permissiveness function provided in Chapter 2 is not adapted to effective computation as it considers all the intervals proposed at the same time. In order to obtain a more iterative approach, we approximate this function with a sequence of functions. In this chapter, we prove the links between this sequence of functions and the permissiveness: we show that the permissiveness function is the limit of this sequence of functions. We provide good properties of this sequence of functions and extend some of them to the permissiveness function.

The aim of these properties is to help computing these functions.

Chapter 5:

We give an algorithm to compute the sequence of suboptimal permissive functions and the permissiveness function in non-elementary time for acyclic timed automata and games.

Chapter 6:

We present two implementations. In Section 6.1, we provide another numerical approach with a forward algorithm that computes an approximate value of the permissiveness function for a fixed configuration. We provide an implementation of this algorithm. To give a proof-of-concept of our algorithm presented in Chapter 5, and to study its runtime, we present the symbolic implementation in Section 6.2 and compare it with the numeric implementation.

Chapter 7:

We study approximate problems to compute permissiveness more efficiently. The aim of this chapter is to compute a leveled permissiveness, i.e., a function that, given a list of thresholds, decides whether the value of the permissiveness function of a configuration lies between two thresholds.

In this chapter, we introduce an algorithm for linear timed automata, which, given a positive threshold, computes whether the permissiveness is greater than this threshold. This algorithm allows us to present a double exponential time algorithm for computing permissiveness by levels for linear timed automata.

LIST OF PUBLICATIONS

The results of Chapter 5 have been published in 2020 in the following article: The contributions of Chapters 6 and 7 will be submitted later.

NOTATIONS

Mathematical notations

We use standard Landau notations O, Ω, Θ, o, ω.

R

The set of real numbers

Q

The set of rational numbers

N

The set of positive integers

K + The set of positive elements of K, for K = R or Q E The topological closure of the set E E
The topological interior of the set E

|E|

The size of the set E

[x • • • y]
The interval of all integers between x and y [x, y]

The interval of all reals between x and y ]x, y] (resp. ]x, y] The interval of all reals between x and y, x (resp. y) excluded ]x, y[

The interval of all reals between x and y, x and y excluded

M k,n (R)
The set of k-by-n real matrices -→ x vector

x i i-

PRELIMINARIES

In this chapter, we develop the mathematical notions we need for this thesis. The main mathematical concepts we use are polyhedra and piecewise affine functions, in dimensions greater than one. Piecewise affine functions are a well-known type of functions in one dimension. Our aim in this chapter is to extend this notion to an arbitrary dimension. An example of this kind of functions in dimension 2 is shown in Figure 1. 1.

x y 0 0 1 1 2 1 2 1 -x 1-y 1+x-y 2 x-y 2-x 1-y x y 2 -x 1 -y Figure 1.1 -An example of a 2-dimension piecewise affine function from [0, 2] × [0, 1] to R.
We define piecewise affine functions in an arbitrary dimension. We first need to extend the notions of affine function and cells to higher dimensions. First, we extend affine functions to a higher dimension in Section 1. 1. Next, we need to extend the notion of cells. In dimension 1, they are represented as intervals. In dimension 2, they can be, for instance in Figure 1.1, triangles. This depends on the number of edges. In higher dimensions, we represent them with polyhedra. The partition of these cells is called partition of polyhedra. We introduced these two notions in Section 1. 2. Finally, we define what a multidimensional piecewise-affine function is in Section 1.3.

Multidimensional affine functions

Let us now formally define affine functions in higher dimension, which we call multidimensional affine functions, or n-dimensional affine functions when specifying the dimension used. We define these functions over R or Q. Therefore we denote K = R or Q for the rest of this section. We extend affine functions in higher dimensions and with the possibility to have infinite coefficients. More formally: Definition 1.1: n-dimensional affine functions Let n be an integer and E a subset of

K n . An n-dimensional affine function from E to K ∪ {-∞, +∞} is a mapping f : E → K ∪ {-∞, +∞} such that:
Either there exists a vector (a i ) 0≤i≤n ∈ K n such that:

∀x = (x i ) 1≤i≤n ∈ E, f (x) = n i=1 a i • x i + a 0 Or f (x) = -∞ (resp. +∞) for all x ∈ K n , in that case we can still write f (x) = n i=1 a i • x i + a 0 by setting a 0 = -∞ (resp. +∞) and a i = 0 for all 1 ≤ i ≤ n
Let us recall the terminology for these functions:

f is called a multidimensional affine function when n is not specified.

a 0 is called the inhomogeneous term of f . a 1 , • • • , a n are called the homogeneous terms of f .
If a 0 = 0, f is called an n-dimensional (or multidimensional) linear function.

In that case, f (0) = 0.

Example 1.1.1 Let us give a simple example in dimension 3:

f : (x, y, z) → x -y + z + 10 , g = f -10.
f and g are 3-dimensional affine functions. In particular, g is an 3-dimensional linear function, f is not. The inhomogeneous term of f is a 0 = 10, and the homogeneous terms of f are a 1 = 1, a 2 = -1 and a 3 = 1.

Our goal in the next Sections 1.2 and 1.3 is to define piecewise affine functions over K n . The Figure 1.1 represents the piecewise affine functions f : [0, 2] × [0, 1] → R such that:

f : (x, y) →                                          1/2 if x ∈ [0, 1/2], y ≤ x 1 + x -y 2 if x ∈ [0, 1/2], y ≥ x, y ≤ 1 -x 1 -y if x ≤ 1, y ≥ 1 -x, y ≥ x 1 -x if y ≤ x, x ≥ 1/2, y ≥ -1 + 2x x -y if y ≤ -1 + 2x, x ≤ 1 1 -y if y ≥ -1 + x, x ≥ 1, y ≤ 1, x ≤ 2 2 -x if y ≤ -1 + x, x ≤ 2, 1 ≤ x
In dimensions greater than 1, we represent the pieces of theses functions with polyhedra.

To do that, in the next section, we define polyhedra and the partition of polyhedra.

Polyhedra

General definitions

In this section, we define polyhedra and give some examples. First, let us recall what the convexity property is.

Definition 1.2: Convexity

A set S is convex if and only if, for all x, y in S, the segment [x, y] is included in S, i.e.:

∀x, y ∈ S, ∀t ∈ [0, 1] , t • x + (1 -t) • y ∈ S
Half-spaces represent sets that cut R n in half. They are specified by linear inequalities (as

a 1 x 1 + a 2 x 2 + • • • + a n x n > b).
In a one-dimension space, half-spaces define rays (ex:

x > 0). More formally:

Definition 1.3: Half-space

Let n ≥ 0 be an integer. A half-space of R n is a set of the form {X ∈ R n |f (X) ∼ 0} where ∼∈ {≤, ≥, <, >} and f is an affine, non-constant, function of R n . If ∼∈ {≤, ≥} (resp. {<, >}), the half-space is called a closed (resp. open) half-space.

We can remark that a half-space is convex. The Figure 1.2 represents examples of half-spaces of R and R 2 .

x 0

(a) Half-space {x | x ≤ 0} of R. (0, 0) (1, 0) (0, 1) x y (b) Half-space {(x, y) | y -x ≥ 0} of R 2 .
(0, 0) (1, 0) (0, 1)

x y (c) Half-space {(x, y) | 3 -x 2 -y > 0} of R 2 .
(0, 0) (1, 0) (0, 1)

x y (d) Half-space {(x, y) | x ≥ -1} of R 2 .
A polyhedron of R n is a finite intersection of half-spaces of R n . A polyhedron is closed if it is a finite intersection of closed half-space of R n .
An immediate property, as the intersection of several convex set is a convex set, is the convexity of polyhedron, stated in Proposition 1.5

Proposition 1.5

A polyhedron of R n is a convex set. In Figure 1.3a, the polyhedron is the set (0, 0) ( A closed polyhedron can be represented with a so called H-representation: Theorem 1.6: H-representation ([Sch86], p.87) P ⊆ R n is a closed polyhedron if and only if there exists some integer k, some matrix A ∈ M k,n (R) and some vector b ∈ R k such that P is defined as follows:

{(x, y) ∈ R 2 | y ≥ x, 3 -x 2 > y}. In Figure 1.3b, the polyhedron is the set {(x, y) ∈ R 2 | y ≥ x, 3 -x 2 > y, x ≥ -1}. Both are not closed because the half-space of Figure1.2c is open. (0, 0) (1, 0) (0, 1) x y
P = {x ∈ R n | A • x ≤ b}
This representation is called a H-representation.

Let us finally remark that the intersection of polyhedra preserves the properties of convexity, closeness, openness, while the union does not. More formally:

Partition and tiling of polyhedra

The goal of this section is to define what a partition of polyhedra and a tiling of polyhedra are. The intuition is to divide a space, as R n + or R n , with a collection of disjoint polyhedra. For instance let us take the four following polyhedra:

P 0 = (x, y) ∈ R 2 | | x ≥ 1, y ≥ 1 P 1 = (x, y) ∈ R 2 | | x < 1, y ≥ 1 P 2 = (x, y) ∈ R 2 | | x < 1, y < 1 P 3 = (x, y) ∈ R 2 | | x ≥ 1, y < 1
These polyhedra are all disjoints two by two and their union forms the space R 2 (see Figure 1.4). Let us define a partition of polyhedra in Definition 1.8

P 0 P 1 P 2 P 3 (0, 0) (1, 0) (0, 1) x y Figure 1.4 -Partition of R 2
with the four polyhedra P 0 , P 1 , P 2 and P 3 .

Definition 1.8: Partition of polyhedra

Let P be a polyhedron of R n . A partition of polyhedra T of the polyhedron P is a finite family of m + 1 polyhedra (P i ) 0≤i≤m of R n such that:

• For any i in [0 • • • m], P i = ∅.
• For any i, j in [0 • • • m], P i and P j are disjoints.

•

m i=0 P i = E.
The integer m + 1 is called the number of cells of the partition of E. We say that

T is a m + 1-cells partition of E. Each P i is a cell of the partition (P i ) 0≤i≤m .
A polyhedron can also be represented using a tiling. Tiling of polyhedra is less restrictive because it allows polyhedra to intersect at their frontiers. This definition will be used in the case of a continuous piecewise affine function because the values of the functions at the frontiers of the polyhedra will then be equal. Let us define the tiling formally in Definition 1.9

Definition 1.9: Tiling of polyhedra

Let P be a polyhedron of R n . A tiling of polyhedra of P is a finite family T of m + 1 polyhedra (P i ) 0≤i≤m of R n such that:

• For any i in [0 • • • m], P i = ∅. • For any i, j in [0 • • • m],
the interior of P i and the interior of P j are disjoints.

•

m i=0 P i = E.
The integer m + 1 is called the number of cells of the tiling of E. We say that T is a m + 1-cells tiling of E. Each P i is a cell of the tiling (P i ) 0≤i≤m

To represent R 2 as a tiling of polyhedra, we can for instance consider the following family of polyhedra:

P 0 = (x, y) ∈ R 2 | | x ≥ 1, y ≥ 1 P 1 = (x, y) ∈ R 2 | | x ≤ 1, y ≥ 1 P 2 = (x, y) ∈ R 2 | | x ≤ 1, y ≤ 1 P 3 = (x, y) ∈ R 2 | | x ≥ 1, y ≤ 1
These polyhedra P 0 , P 1 , P 2 , P 3 are respectively the closure of P 0 , P 1 , P 2 , P 3 .

Multidimensional piecewise-affine functions

In this subsection, we define the multidimensional piecewise affine functions in Definition 1. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF]. We also specify that, when the piecewise-affine function is continuous, we can use a tiling of polyhedra instead of a partition to define it.

Definition 1.10: n-dimensional piecewise affine functions

Let P be a polyhedron of R n . An n-dimensional affine function is a mapping f : P → R ∪ {-∞, +∞} for which there exists a partition into polyhedra T = (P i ) 0≤i≤m of P and a family (f i ) 0≤i≤m of n-dimensional affine functions such that for any X ∈ P , there is a unique index i in [0 • • • m] such that X ∈ P i and f (X) = f i (X). Let us define some useful terminology: f is called a multidimensional piecewise affine functions when the dimension n of f is not specified.

T is called the partition of polyhedra of f and (f i ) 1≤i≤m is called the list of affine functions of f . Each cell P i is called a cell of f and is associated with the affine function f i .

The entry domain such that f takes finite values, i.e. f -1 (R), is denoted D finite (f ) and called the finite domain of an n-dimensional affine function f .

C 1 = {(x, y) ∈ R 2 + | y ≤ 1, x -y ≤ 0}, C 2 = {(x, y) ∈ R 2 + | y ≤ 1, 0 < x -y ≤ 1}, C 3 = {(x, y) ∈ R 2 + | y ≤ 1, x -y > 1}, C 4 = {(x, y) ∈ R 2 + | y ≥ 1, x ≥ 0}
Let us then describe f : In the case of continuous n-dimensional piecewise affine functions, we do not need to split the polyhedron P into strictly disjoint cells: we can use tiling. The main advantage is to consider only closed polyhedra with the H-representation as defined in Theorem 1. 6. In that case, we can define f as a mapping P → R ∪ {-∞, +∞} associated with a tiling of polyhedra T := (P i ) 0≤i≤m of P and a family (f i ) 0≤i≤m of n-dimension affine functions s.t. for any X ∈ P , there is an index

f =                      f 1 : (x, y) → (x + y)/2 over C 1 f 2 : (x, y) → y over C 2 f 3 : (x, y) → x -1 over C 3 f 4 : (x, y) → -∞ over C 4 x → x C 1 x + y 2 x → -1 + x C 2 y x -1 C 3 -∞ C 4 x y 1 2 1 2 (a) An 2-dimensional affine function f . x → x C 1 x + y 2 x → -1 + x C 2 y x -1 C 3 x y 1 2 1 2 (b) Its (continuous) restriction over [0, 1] × R + .
i in [1 • • • m] such that X ∈ P i and f (X) = f i (X). If X ∈ Pi , the index i is unique.
The rest of the definition can be extended trivially from Definition 1. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF]. Indeed, as the function is continuous, if two cells P i and P j are not disjoints, the affine function f i and f j will be equals on their common frontier. We illustrate the representation with a tiling of polyhedra in Figure 1.5b: we consider the restriction of the function f described in Example 1.3. 1. Its restriction is continuous so we can use the tiling of polyhedra C 1 , C 2 , C 3 . Let us recall that for any set E, E represents its topological closure.

As most of our functions will be continuous piecewise affine functions (at least over their finite domain), we will mainly use tilings instead of partitions in this thesis.

Chapter 2

TIMED AUTOMATA AND ROBUSTNESS

In this chapter, we present the notions of the theory of timed automata that we will need in order to define, quantify and compute robustness of timed automata. In Section 2.1, we present timed automata, describe their syntax and semantics, from the constraints to the runs. Then, we present two fundamental problems in the theory of timed automata: reachability and robustness. The reachability problem asks whether a location of a timed automaton can be visited, knowing the starting configuration. The robustness problem asks whether properties will still be verified despite perturbations. As robustness is a very general problem, we need to specify our perturbation model. In Section 2.2, we present one model where perturbations affect delays. We call this model the permissiveness.

Timed automata

Timed automata are a very convenient way to model the behaviour of real-time systems.

Here we give the essential notions and results on timed automata. First, we introduce clock valuations and constraints. Clock valuations represent the values of several clocks and time constraints allow us to check whether the clock values are bounded by some expressions. In a second step, we express the syntax and classical semantics of timed automata. In a third step, we present the reachability problem and how it is solved. A classical construction on timed automata is the representation of valuations with clock regions. This abstraction provides a finite-state automaton which is time-abstract bisimilar to the original timed automaton. This allows to prove that the reachability problem is in PSPACE. Finally, we express the limitations of reachability. Indeed, when dealing with reachability properties, the clocks are assumed to be perfectly accurate, which is not the case in the real world.

To model the imperfection of the model in the real world, we introduce the robustness concept, which studies whether a property holds despite temporal imprecisions. The fact that a valuation v satisfies a classical guard g, denoted v |= g is defined inductively as:

Clock constraints

Clocks

1. (v |= x ∼ n) if and only if (v (x) ∼ n). 2. (v |= g 0 ∧ g 1 ) if and only if (v |= g 0 and v |= g 1 ).
If a valuation v does not satisfy a guard g, we denote it v |= g.

Another type of guards we will use in this thesis is polyhedral guards. We define it formally in Definition 2.2. These guards are defined with a polyhedron P of R n and a valuation v satisfies this polyhedral guards if its belongs to P . This is a generalisation of classical guards. For instance, the timing constraint x + 6y + 9 ≤ 0 ∧ x -y ≤ 0 is a polyhedral guard.

Definition 2.2: Polyhedral guards

A polyhedral guard is denoted g P , where P is a polyhedron (as defined in Definition 1.4)

  A 0 A 1   , such that A 0 and A 1 are diagonal matrices of M n,n (R).

Proposition 2.3: Guards are convex

Let g P be a polyhedral guard. Let v, v ∈ R |C| + and λ ∈ [0, 1] such that v, v |= g. Then λ • v + (1 -λ) • v |= g.
Proof of Proposition 2.3. This is a direct consequence of the convexity of P. Let P be the polyhedron associated with g P . As P is a convex set, λ

• v + (1 -λ) • v ∈ P.

Timed automata

In this subsection, we present the notion of timed automata. Timed automata were first introduced by [START_REF] Alur | A theory of timed automata[END_REF]. We first give their syntax in Definition 2.4 and some basic definitions, such as acyclic timed automata, in Definition 2.5.

Definition 2.4: Timed automata ([AD94])

A timed automaton is a tuple

A = (Σ, Q, Q 0 , Q f , C, E) where: Σ is a finite set of actions, Q is a finite set of locations, Q 0 ⊆ Q is the set of initial locations, Q f ⊆ Q is the set of goals, C is the finite set of clocks E ⊆ Q × G p (C) × Σ × 2 C × Q is a finite set of transitions. A transition is a tuple ( , g, a, C r , ) where ∈ Q, ∈ Q, g ∈ G p (C), C r ⊆ C and a ∈ Σ.
A closed timed automaton is an automaton that uses only closed constraints.

Example 2.1.1 Let us consider the timed automaton A 0 and A 1 of Figures 2.1 and 2.2:

The set of clocks is {x, y} and the set of locations is { 0 , 1 , 2 , f } in A 0 and A 1 . Likewise, the set of initial locations is { 0 } and the set of goal locations is { f }. In these examples there is only one initial location and only one goal location.

An initial location is represented with an arrow, left to the state: 0 . A goal location is double-circled:

f Guards are represented as labels above the edges:

0 ≤ x ≤ 1 0 ≤ y ≤ 2 for instance for g := 0 ≤ x ≤ 1 ∧ 0 ≤ y ≤ 2.
Actions are represented as labels below the edges (a 0 for instance).

The set of resets, if it is not empty, is represented by y := 0 for C r = {y}. In A 0 , the set of resets is empty in all transitions. In A 1 , the set of resets is empty for all transitions, except for the transition from 0 to 1 where C r = {y}.

For simplification purposes, we now assume in the rest of this document (unless otherwise stated) that a timed automaton is a closed timed automaton and that the set of goal locations is a singleton. A timed automaton can also contains cycles or a unique transition per location. We define these types of timed automata in the following definition.

0 1 2 f 0 ≤ x ≤ 1 0 ≤ y ≤ 2 a 0 1 ≤ x ≤ 3 2 ≤ y a 1 0 ≤ x ≤ 1 y ≥ 1 a 0 1 ≤ x ≤ 2 0 ≤ y ≤ 2 a 1 Figure 2.1 -A two-clock timed automaton A 0 with four transitions. 0 1 2 f 0 ≤ x ≤ 2 0 ≤ y ≤ 2 a 0 , y := 0 0 ≤ x ≤ 4 0 ≤ y ≤ 2 a 1 0 ≤ y ≤ 1 a 2

Definition 2.5: Single action, acyclic, linear timed automaton

Let A = (Σ, Q, Q 0 , Q f , C, E) be a timed automaton.
A is a single-action timed automaton if for any location ∈ Q and any action a ∈ Σ, there exists at most one transition from labelled with a. In other words, for any ∈ Q and a ∈ Σ, there exists at most one ∈ Q, g ∈ G p (C) and C r ⊆ C such that the transition ( , g, a, C r , ) ∈ E.

A is an acyclic timed automaton if its associated directed graph G (A) is acyclic.

A is a linear timed automaton if it is acyclic and if, from any location ∈ Q, there exists at most one transition from .

More formally, for any location ∈ Q, there exists a unique 4-tuple ( , a, C r , g)

such that ∈ Q, a ∈ Σ, C r ⊆ C, g ∈ G p (C) and ( , g, a, C r , ) ∈ E.
For the rest of this thesis, we will consider only single-action timed automata.

Example 2.1.3 Let us again consider the two timed automata from Figures 2.1 and 2.2.

A 0 and A 1 are both acyclic and single-action, but only A 1 is linear. Indeed, in A 0 , two transitions are available from 0 .

Definition 2.6: The largest constant

Let A = (Σ, Q, Q 0 , Q f , C, E) be a timed automaton. The largest constant of the automaton A, denoted M (A), is the value of the largest constant that appears in the guards of A.

Example 2. 1.4 In the timed automaton from Figures 2.1 and 2.2, the largest constant is 3 for A 0 and 4 for A 1 . Indeed the constraints that contain the greatest constant are respectively 1 ≤ x ≤ 3 ∧ 2 ≤ y and 0 ≤ x ≤ 4.

Classical semantics

A configuration of a timed automaton A is a pair ( , v) where ∈ Q is a location of the automaton and v is a clock valuation. The semantics of a timed automaton is an infinite-state labelled transition system T = (S, S 0 , S F , ∆) composed with a set of states S, a set of initial states S 0 , a set of final states S f and a set of transitions ∆.

The set of states is the set of configurations, the set of initial states,

S 0 = Q 0 × R |C| + is the set of configurations ( , v) such that ∈ Q 0 . Such configurations are called initial configurations. The set of final states, S f := Q f × R |C| + is the set of configurations ( , v) such that ∈ Q f . Such configurations are called goal configurations.
The transitions are of two kinds: delay transitions model time elapsing: no transition of the timed automaton is taken, but the values of all clocks are increased by the same value. For any configuration ( , v) and any delay δ ∈ R + , there exists a transition ( , v)

δ - → ( , v + δ).
action transitions represent the effect of taking a transition in the timed automaton. For any configuration ( , v) and any transition e = ( , g, a, C r , ), if v |= g, then there exists a transition ( , v)

a - → ( , v [C r ← 0]) .
Even if it means summing up the delays, we suppose that delay transitions and action transitions alternate. Finally, we write ( , v)

δ,a -→ ( , v ) when there exists a configuration ( , v ) such that ( , v) δ - → ( , v ) and ( , v ) a - → ( , v ).
In a timed automaton, we begin at an initial configuration ( 0 , v 0 ) and propose pairs of delays and actions to reach a successor of 0 , then a successor of this successors, etc. The trace obtained by proposing these pairs and reaching successive configurations is called a run. It stores informations about the configurations reached and the sequence of delays-actions proposed. More formally:

Definition 2.7: Run

Let n ∈ N ∪ {+∞} and A be a timed automaton. A run of length n can be defined as follows:

If n = 0, the run is empty and is denoted, by convention (s 0 ) where s 0 is the initial configuration of the run.

ρ := (s i , (δ i , a i ) , s i+1 ) 0≤i≤n-1 such that for any i ∈ [0 • • • n -1] , s i δ i ,a i --→ s i+1 .
Let us introduce some additional definitions:

The length of ρ is defined as follows: |ρ| = n.

For any run ρ, ρ ≤j is the finite prefix of ρ (s i , (δ i , a i ) , s i+1 ) 0≤i≤j-1 .

ρ is a finite run if n ∈ N, otherwise the run ρ is called infinite.

Let n = 0, a finite run ρ = (ρ i ) 1≤i≤n is accepting from a given con- figuration ( 0 , v 0 ) if it visits a goal f ∈ Q f , i.e. if, denoting ρ i = (( i , v i ) , (δ i , a i ) , ( i+1 , v i+1 )) 0≤i≤n-1 , there exists an integer j ∈ [1 • • • n] and a goal f ∈ Q f such that j = f . An empty run (( 0 , v 0 )) is accepting if 0 ∈ Q f .
For the sake of simplification, the run ρ can also be denoted as follows:

s 0 δ 0 ,a 0 ---→ s 1 δ 1 ,a 1 ---→ s 2 - → • • • - → s n-1 δ n-1 ,a n-1 ------→ s n .
Remark 2. 1.4 Even if it means adding a sink state and corresponding transitions, we assume that from any configuration, there always exists a transition δ,a -→ for some δ ∈ R + and some a ∈ Σ. This way, any finite run can be extended into an infinite run (in terms of its number of transitions). ( 0 , (0, 0))

1,a 0 --→ ( 1 , (1, 1)) 1,a 2 --→ ( f , (2, 2))
We can also propose a finite run of length 4 for the timed automaton A 1 ( 0 , (0, 0))

2,a 0 --→ ( 1 , (2, 0)) 0.5,a 2 ---→ ( 2 , (2.5, 0.5)) 0.5,a 2 ---→ ( f , (3, 1))
Let us remark that, because of the reset on the second clock in the first transition, the valuation of the second configuration is (2, 0).

Verification of timed properties

A fundamental problem in timed automata theory is the reachability of a location, i.e.

given a specific initial configuration, can we reach a goal location?

Definition 2.8: Reachability problem, [AD94]

Given a timed automaton A, an initial configuration ( 0 , v 0 ) ∈ Q × R |C| + , the reachability problem asks whether there exists an accepting run from ( 0 , v 0 ) in the infinitestate transition system defining the semantics of A.

Example 2.1.6 Let us consider again the examples of timed automata from Figures 2.1 and 2.2.

In A 0 , the goal can be reached from any initial configuration of the form ( 0 , (x 0 , y 0 )) such that 0 ≤ x 0 ≤ 1 and 0 ≤ y ≤ 2.

In A 1 , the configuration ( 0 , (2.1, 0)) is not an initial configuration from which the goal can be reached. A goal location can be reached from the initial configuration ( 0 , (0, 0)) or ( 0 , (0, 2)), or more generally from any configuration of the form ( 0 , (0, t)) where t ∈ [0, 2].

The reachability problem was proved decidable and in PSPACE in [START_REF] Alur | A theory of timed automata[END_REF], using an abstraction called clock region. This abstraction allows us to solve the reachability problem on a finite-state automaton by abstracting the notion of time. A clock region is an equivalence class over the set of configurations. In this equivalent class, if two valuations v and v are in the same region, then ( , v) and ( , v ) have the same successor region. Therefore these two configurations will be able to reach the same future locations. Then, when studying reachability, we only have to consider the classes of configurations that a set of configurations can reach. We formally define clock region in Definition 2.9.

Let us first recall the definition of a fractional function. For any t ∈ R, fract (t) := t-t where t is the integral part of t.

Definition 2.9: Clock region, [AD94]

Let A = (Σ, Q, Q 0 , Q f , C, E) be a timed automaton. The set of valuations of C has an equivalence relation that we denote ∼ R . v ∼ R v if the following conditions hold, for any clocks x, x ∈ C:

1. ( v (x) = v (x) ) ∨ ( v (x) ≥ M (A) ∧ v (x) ≥ M (A)). 2. If v (x) ≤ M (A) and v (x ) ≤ M (A), then fract (v (x)) ≤ fract (v (x )) ⇔ fract (v (x)) ≤ fract (v (x )). 3. If v (x) ≤ M (A), then fract (v (x)) = 0 ⇔ fract (v (x)) = 0.
The equivalence class of v is called a clock region and is denoted r v . The set of clock regions is denoted

R |C| + / ∼ R .
Let r and r be two clock regions. r is a time-successor of r if the following condition holds: 1.7 Let us consider a constraint 0 ≤ x, y ≤ 2. The largest constant is 2 and there are three types of clock regions:

∀v ∈ r, ∃t ∈ R + , v + t ∈ r Example 2.
Corner points: these are punctual regions. The corner point regions here are (0, 0) , (0, 1), (0, 2), (1, 0), (1, 1), (1, 2), (2, 0), (2, 1), (2, 2).

Open-line segments: these are region represented with segments.

For instance {(x, y) | x = 0, 0 < y < 1} and {(x, y) | x = 1, 0 < y < 1}.

Open regions: these are all the other regions described only with strict inequalities.

For instance {(x, y) | 0 < x < y < 1} and {(x, y) | 0 < y < x < 1}.
These clock regions from the first and the second constraints of the timed automaton A 3 are illustrated in Figure 2. 4. Region automata are finite-state automata. We use them to solve the problem of reachability of timed automata. The region automaton is a finite-state labelled transition system where configurations are clock regions. [START_REF] Alur | A theory of timed automata[END_REF] gives a bound on the number of clock regions for a timed automaton A:

R |C| + / ∼ R ≤ |C|! • 2 |C| • x∈C (2M (A) + 1)
We can now formally define region automata in Definition 2. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF].

Definition 2.10: Region automata, [AD94]

Let A = (Σ, Q, Q 0 , Q f , C, E) be a timed automaton. The region automaton R (A) is a finite automaton where:

The set of locations is ( , r) ,r) , ( , r ) , a) is a transition of R (A) if and only if there exists a transition ( , , a, C r , g) of A and a clock region r such that there exists r a time-successor of r such that r |= g and r = r [C r ← 0].

| r ∈ R |C| + / ∼ R The set of initial locations is ( 0 , r v 0 ) | 0 ∈ Q 0 , v 0 ∈ R |C| + , ∀x ∈ C, v 0 (x) = 0 e = ((
Example 2. 1.8 Let us build the region automaton associated to the timed automaton of Figure 2.5 from the initial configuration x = 0. The clocks regions to consider at location 1 are {0} , {1} and ]0, 1[. The one to consider at location f are (0) , (1) , ]0, 1[ , (2) and ]1, 2[. We build the region automaton from the initial configuration x = 0 only, for the sake of clarity, in Figure 2. 6. To prove that reachability is in PSPACE, [START_REF] Alur | A theory of timed automata[END_REF] proved a correspondance between the runs of a timed automaton A and the ones of the corresponding region automaton R (A). Checking reachability for a timed automaton A reduces to checking the reachability in the region automaton R (A).

0 1 f 0 ≤ x ≤ 1 a 0 ≤ x ≤ 2 b Figure 2.5 -A simple timed automaton A 3 . 0 x = 0 1 0 < x < 1 1 x = 1 1 x = 0 f x = 1 f 0 < x < 1 f x = 0 f 1 < x < 2 f x = 2
The limits of this abstraction are timing perturbations. Indeed, the semantics of timed automata and region automata assume that clocks are perfectly measured. In practice, clock measures are imperfect. The ability to verify a property despite perturbations is called robustness. This is a very general notion where we can consider several models. In Section 2.2, we present a model of robustness based on verifying reachability with perturbations on delays.

Robustness and permissiveness semantics

In this section, we present our approach to the robustness of timed automata. Our semantics, called permissiveness semantics, models timing perturbations by affecting delays of time-elapsing transitions. These perturbations can change the future delays and actions that will be available. Our goal is to check whether one can preserve the reachability of a goal location despite delay perturbations and to quantify the admissible perturbation. Other approaches, such as guards perturbations, are possible and will be presented in Chapter 3. In our model, we propose a game-based semantics to quantify how permissive we can be. In this semantics, the player proposes a pair of interval of delays [α, β] and an action. We call this pair a p-move. Then, the opponent chooses the delay in [α, β] that will be applied in the time-elapsing transition. We extend the notion of run in this semantics and call it p-run. To quantify how permissive the player has been in a p-run, we use a permissiveness function that depends on the sizes of the proposed intervals.

In Subsection 2.2.1, we present our semantics and the permissiveness function. To do so we explain how to compute the permissiveness of a p-move, of a p-run and finally of a strategy and a configuration. Then we explain the goal of the player and the opponent and present the permissiveness of timed automata. Then in Subsection 2. 2.2 we present examples of permissiveness function for some examples of timed automata. Finally, in Subsection 2. 2.3, we compare this notion of robustness to the one used in [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF] and extend these notions to more general operators.

Permissiveness semantics

Game

Let A be a timed automaton and Σ the alphabet of actions. Let us first explain how the game semantics works to check reachability with the example of Figure 2. 7. In the classical semantics, the goal is to reach the location f while proposing delays and verifying the guards. Let us consider the initial configuration ( 0 , (0)). The player can propose a delay1 to reach the location 1 , for instance δ = 0.5. Then the game has reached the configuration ( 1 , (0.5)). He can again propose the delay 0.5 and the clock equals 1 and the goal is reached. In the permissive semantics, we use p-runs to extend the notion of runs. A p-run proceeds as follows:

At the initial configuration ( 0 , (0)), the player must propose an interval2 , [α, β] such that all delays in the interval satisfy the guard. In this example, the interval must satisfy 0 ≤ α ≤ β ≤ 1. The player can propose [0, 0.6] for instance.

After the player's choice, the opponent chooses a delay in the interval [0, 0.6] which will be applied, for instance 0.6.

The game then has reached the configuration ( 1 , (0.6)). The player must then propose an interval, e.g. [0, 0.4], such that each delay of this interval satisfies the second guard.

The opponent chooses a delay in [0, 0.4]. As each delay in this interval allows to reach the goal, whatever delay he chooses, the run will finish and reach the goal.

0 1 f 0 ≤ x ≤ 1 a 0 0 ≤ x ≤ 1 a 1 Figure 2.7 -A one-clock timed automaton.
Let us present more formally the permissive semantics. A p-run consists, for each configuration ( , v), in the following steps:

The player proposes an interval I = [α, β] and an action a such that there exists a transition ( , g, a, C r , ) such that v + I |= g.

The opponent proposes a delay δ which belongs to the interval I.

The configuration ( , v + δ [C r ← 0]) is reached.

P-move

Each time the player proposes an interval instead of a delay, this represents the imprecision he will allow. For instance proposing [0, 1] instead of 0.5 means allowing the delay to be greater or lower than 0.5, with a precision of 0.5. We can quantify this imprecision and say that the player allows a delay of range 1. More formally, we say that proposing an action and an interval of delays is a p-move (see Definition 2.11). The size of the interval proposed is the permissiveness of this p-move (see Definition 2.13).

Definition 2.11: P-move and enabled p-move

Let ( , v) be an arbitrary configuration, a p-move of ( , v) is a pair (I, a), where Let us first remark that, given a location and two different valuations v and v , the p-moves of ( , v) can be mapped to those of ( , v ), with a shifted interval. Let us prove this result formally in Lemma 2.12.

I ⊆ R + is a closed interval,

Lemma 2.12

Let v and v be two clock valuations and suppose p-moves ( , v) = ∅. Then for any p-move ([α, β] , a) ∈ p-moves ( , v), for any sub-interval

I ⊆ [α + v -v ∞ , β -v -v ∞ ], if β -α ≥ 2 v -v ∞ , then (I , a) ∈ p-moves ( , v).
Proof of Lemma 2.12. As guards are convex, if

([α + v -v ∞ , β -v -v ∞ ] , a) ∈ p-moves ( , v), then for any subinterval I ⊆ [α + v -v ∞ , β -v -v ∞ ], (I , a) ∈ p-moves ( , v). Let us prove that ([α + v -v ∞ , β -v -v ∞ ] , a) ∈ p-moves ( , v). First, [α + v -v ∞ , β -v -v is an interval as α + v -v ∞ ≤ β -v -v ∞ .
As ([α, β] , a) ∈ p-moves ( , v), there exists a guard g of a transition from such that v + [α, β] |= g. On top of that, for any clock x:

v (x) + α ≤ v (x) + v -v ∞ + α v (x) + β ≥ v (x) -v -v ∞ + β
This concludes the proof.

Let us now define the permissiveness of a p-move in Definition 2.13.

P-run

As for the classical semantics in Section 2. 1.3, we define the notion of p-run in the permissiveness semantics. This definition naturally extends to our permissiveness semantics by adding information about the chosen interval. In the classical semantics, we store in a p-run the delay δ i , the action a i and the successor s i+1 . In the permissive semantics, we also take into account the chosen interval I i . The other classical definitions such as winning p-runs, length or prefix, naturally extend.

Definition 2.14: p-Run

Let n ∈ N ∪ {+∞}. A p-run of length n from an initial configuration s 0 is defined as follows:

If n = 0, the run is empty and is denoted, by convention, (s 0 ) where s 0 is the initial configuration of the run.

Otherwise, ρ (p) is an infinite sequence of 5-tuples

ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤n-1 such that for any i ∈ [0 • • • n -1], s i , s n ∈ Q × R |C| + , I i ∈ I, δ i ∈ I i , a i ∈ Σ, s i δ i ,a i --→ s i+1 and such that (I i , a i ) is an enabled p-move from s i .
As for a run in classical semantics, we can use the following notation:

s 0 I 0 ,a 0 ,δ 0 ----→ s 1 - → • • • - → s n-1 I n-1 ,a n-1 ,δ n-1 ---------→ s n
During a p-run, the player may have proposed several intervals of different lengths. Our permissiveness quantifies the robustness of a timed automaton. Let us remark that for each p-run ρ (p) , there exists a unique run ρ = s 0

δ 0 ,a 0 ---→ s 1 • • • s n-1 δ n-1 ,a n-1 ------→ s n .
ρ (p) 0 := ( 0 , (0)) [0,1],a 0 ,0.5 ------→ ( 1 , (0.5)) [0,0.5],a 1 ,0.5 -------→ ( f , (1)) and ρ (p) 1 := ( 0 , (0)) [0,1],a 0 ,1 -----→ ( 1 , (1)) {0},a 1 ,0 ----→ ( f , (1))
In this example, the second p-run ρ To encourage the player to be permissive at each step of the p-run, our permissiveness considers the smallest interval that the player has proposed. More formally:

Definition 2.15: Permissiveness of a p-run

Let ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤|ρ|-1 be a finite p-run, the permissiveness of the p-run ρ (p) is denoted Perm ρ (p) and is defined as follows:

Perm ρ (p) = min 0≤i≤|ρ (p) |-1 (Perm (I i , a i )) = min 0≤i≤|ρ (p) |-1 (|I i |) .

Strategy

The permissiveness of the p-run is not sufficient to express the permissiveness of a timed automaton, as the p-run depends on the choices of the player and the opponent. Maximising the proposed interval implies maximising it whatever the choice of the opponent is. To compute the optimal interval, we consider the worst-case where the opponent chooses the delay minimising the permissiveness. To model this behaviour, we first define what a permissive strategy is and express the permissiveness of the strategy of the player.

Definition 2.16: Permissive strategy

A permissive strategy is a (partial) function σ that maps finite p-runs ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤|ρ|-1 to p-moves in p-moves (s n ). We can say that: A p-run ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤|ρ|-1 is compatible with a permissive strategy σ if for all its prefix ρ (p) ≤j such that j ≤ n, σ ρ (p) ≤j = (I j , a j ). We say that ρ (p) is an outcome from the initial configuration s 0 . The set of outcomes from a configuration is denoted Out (s 0 , σ).

A permissive strategy σ is winning from a given configuration s 0 if any infinite p-run originating from s 0 , that is compatible with σ, is winning.

Example 2.2.4

If we consider again the timed automaton A 3 of Figure 2.7 and the strategy σ defined as follows: For any p-run ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤1 , where

s i = ( i , (x i )), σ ρ (p) ≤i = ([0, 1 -x] , a i ) if 0 ≤ x ≤ 1, i ∈ {1,
, v) such that v (x) ∈ [0, 1].
The permissiveness of a strategy considers the outcome that minimises the permissiveness function of all p-runs. It corresponds to the optimal choice of the opponent. For a non-winning strategy, the goal is not reachable and the permissiveness is -∞. When the goal f is already reached, there are no intervals to propose. By convention, the permissiveness is then +∞. More formally: Definition 2.17: Permissiveness of a strategy Let σ be a permissive strategy and ( , v) be a configuration. The permissiveness of σ in ( , v), denoted Perm σ ( , v), is defined as follows:

Perm σ ( , v) =              +∞ if ∈ Q f -∞ if σ is not winning from ( , v) inf ρ (p) ∈Out(( ,v),σ) Perm ρ (p
Perm σ ( , v) =            +∞ if ∈ Q f -∞ if σ is not winning from ( , v) 1 -x otherwise

Permissiveness of a configuration

Our goal is to compute the maximally-permissive strategies among all the possible strategies of the player. To do so, we first define the set of configurations where a winning strategy can be computed, called winning configurations in Definition 2.18. We compare it with the set of co-reachable configurations in Definition 2.19

Definition 2.18: Winning configuration

A configuration ( , v) is winning if there exists a winning permissive strategy from ( , v) (possibly proposing punctual intervals). Let be an arbitrary location, the set of winning configurations from is denoted Win and is defined as follows:

Win := v ∈ R |C| + | ( , v

Proposition 2.20

Let A be a timed automaton with a set of goals Q f , then the following equality holds:

Win = co-reach (Q f ) . Proof of
Win = i=0,1 {( i , x) | 0 ≤ x ≤ 1} ∪ {( f , x) | x ∈ R + }
We now can compute a maximally-permissive strategy by computing a strategy that maximises the permissiveness of the player's strategy. Such a value is called the permissiveness of a configuration and is denoted Perm. More formally: Definition 2.21: Permissiveness of a configuration Let ( , v) be a configuration. The permissiveness of ( , v) is denoted Perm ( , v) and is defined as follows:

Perm ( , v) =              +∞ if ∈ Q f -∞ if ( , v) is not a winning configuration sup σ Perm σ ( , v) otherwise
An example of computation of the permissiveness function of a configuration will be detailled in Subsection 2.2.2. To sum up, let us consider the configuration ( , v) in Win , where = f . Let us denote each p-run ρ (p)

as ρ (p) = s ρ (p) i I ρ (p) i , a ρ (p) i , δ ρ (p) i , s ρ (p) i+1 0≤i≤n-1
.

The permissiveness of ( , v) is defined as follows:

Perm ( , v) = sup σ inf ρ (p) ∈Out(( ,v),σ) min 0≤i≤n-1 I ρ (p) i
Our goal in this thesis is to answer the following problem: Definition 2.22: The maximal-permissiveness problem Given a timed automaton A, an initial configuration ( 0 , v 0 ) and a goal location f , the maximal-permissiveness problem asks to compute Perm ( 0 , v 0 ).

We answer this problem in Chapter 5 first with a backward algorithm, where we compute the function v → Perm ( , v) over Win for the successors of the location

Examples of computation of permissiveness functions

We first present an intuitive way to compute the permissiveness of timed automata. We compute step-by-step the permissiveness of the initial locations of the two following timed automata (see Figures 2.2,2.10).

A first timed automaton

Our first example is a simple timed automaton with two identical transitions (see Figure 2.8). The two transitions have the same constraints on the guards: the clocks must be between 0 and 1. Let us look at different possible p-runs starting from an initial configuration ( 0 , (0, 0)). For instance, if the player proposes the p-move ([0, 1] , a 0 ), the opponent may prevent the player from proposing a permissive interval by choosing the delay δ = 1. If the opponent chooses delay 1, the configuration ( 1 , (1, 1)) is reached and the player has no choice but to propose the p-move ({0} , a 1 ). The permissiveness of this p-move is 0. As a consequence, the player may have to propose a smaller interval. If he proposes an interval [0, β] such that β < 1 and if the opponent chooses a delay δ ∈ [0, β], the configuration ( 1 , δ, δ) is reached. The largest interval the player can then propose is [0, 1 -δ] and the permissiveness of this p-run is min (1 -δ, β). In this p-run, the player should propose 0, 1 2 to maximise the permissiveness, and the opponent should choose δ = 1 2 to minimise it. The intuition of the best strategy for a more general configuration and choice of interval is to split equally the intervals that the player proposes. Let us prove it formally. To compute the permissiveness at 0 , we first compute the future permissiveness for all the possible valuations at f and at 1 . We denote g := (0 ≤ x ≤ 1 ∧ 0 ≤ y ≤ 1) the guard of the transitions of the timed automaton.

0 1 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 a 0 0 ≤ x ≤ 1 0 ≤ y ≤ 1 a 1 Figure 2.
8 -A timed automaton with 2 identical transitions.

Permissiveness at f : for the goal location f , the permissiveness is +∞ for every valuation. As a result, the following equality holds:

∀v ∈ R 2 + , Perm ( f , v) = +∞
Permissiveness at 1 : we first compute the set of winning valuations at 1 , denoted Win 1 . As every possible successor in f is a winning configuration, the winning valuations at 1 are the ones that satisfy the guard 0 ≤ x, y ≤ 1:

Win 1 = {v 1 = (x 1 , y 1 ) ∈ R 2 + | 0 ≤ x 1 ≤ 1 ∧ 0 ≤ y 1 ≤ 1} Let v 1 = (x 1 , y 1
) be an arbitrary valuation in Win 1 and (I 1 , a 1 ) an enabled p-move proposed by the player at 1 . The permissiveness of the p-run is the minimum between |I 1 | and the permissiveness of the successor. As the successor is a goal configuration, its permissiveness is +∞. As a result the permissiveness of the p-run is

|I 1 |.
According to the constraints of the guard, the largest interval that can be proposed from

( 1 , v 1 ) is [0, min(1 -x 1 , 1 -y 1 )]. As a result: Perm ( 1 , •) : (x 1 , y 1 ) →      min(1 -x 1 , 1 -y 1 ) if (x 1 , y 1 ) ∈ Win 1 -∞ otherwise
The best strategy for the player at ( 1 , (x 1 , y 1 )), if (x 1 , y 1 ) ∈ Win 1 is thus to propose the p-move (I * 1 , a 1 ) where

I * 1 := [0, min(1 -x 1 , 1 -y 1 )] .
Permissiveness at 0 : we compute the set of winning valuations at 0 , Win 0 . The winning valuations are the ones such that there exists an enabled delay that satisfies the transition's guard and reaches a winning configuration at 1 . More formally:

Win 0 = {v 0 = (x 0 , y 0 ) ∈ R 2 + | ∃δ 0 ≥ 0, v + δ 0 |= g ∧ v + δ 0 ∈ Win 1 } = {v 0 = (x 0 , y 0 ) ∈ R 2 + | ∃δ 0 ≥ 0, 0 ≤ x + δ 0 , y + δ 0 ≤ 1}
We can easily eliminate δ 0 :

Win 0 = {v 0 = (x 0 , y 0 ) ∈ R 2 + | 0 ≤ x 0 ≤ 1 ∧ 0 ≤ y 0 ≤ 1}
Let v 0 = (x 0 , y 0 ) be an arbitrary valuation of Win 0 . The permissiveness at 0 is the minimum of all the intervals that have been proposed during the p-run where the player maximises the permissiveness and where the opponent minimises it. As v 0 ∈ Win 0 , we can consider a p-run where the proposed p-moves are (I 0 , a 0 ) and (I 1 , a 1 ) and the proposed delays are respectively δ 0 and δ 1 . The permissiveness of such run is min

(|I 0 | , |I 1 |).
Let us suppose that the interval I 1 and the delay δ 0 and δ 1 are optimally chosen, then:

min (|I 0 | , |I 1 |) = min |I 0 | , inf δ 0 ∈I 0 Perm ( 1 , v 0 + δ 0 ) = min |I 0 | , inf δ 0 ∈I 0 min (1 -x 0 -δ 0 , 1 -y 0 -δ 0 ) δ → min (1 -x 0 -δ, 1 -y 0 -δ)
is decreasing with respect to δ, so the opponent's best strategy is to choose the largest possible delay β 0 . As a result:

min (|I 0 | , |I 1 |) = min (β 0 -α 0 , 1 -x 0 -β 0 , 1 -y 0 -β 0 )
The player's best strategy is thus to choose the interval

I 0 = [α 0 , β 0 ] that maximises min (|I 0 | , |I 1 |). As min (|I 0 | , |I 1 |) is decreasing with respect to α 0 , the α 0 that max- imises min (|I 0 | , |I 1 |) is 0. On the other side, the β 0 that maximises min (|I 0 | , |I 1 |) is the β 0 that is the closest to the β where β 0 -α 0 = 1 -y 0 -β 0 , there two func- tion are equals when β = min 1 -x 0 2 , 1 -y 0 2 .
As the player can propose the p-move

0, min 1 -x 0 2 , 1 -y 0 2 , a 0 if (x 0 , y 0 ) ∈ Win 0 , the interval that maximises min (|I 0 | , |I 1 |) is 0, min 1 -x 0 2 , 1 -y 0 2 .
As a result, we found an optimal p-move that the player can propose at 0 To compute the optimal interval, we used the fact that we computed in the previous paragraph its optimal strategy for the location 1 , whatever the valuation was. As a result, we found the optimal intervals I 0 and I 1 and the permissiveness function for an arbitrary configuration ( 0 , v 0 ) values: .

Perm ( 0 , •) : (x 0 , y 0 ) →      min( 1 -x 0 2 , 1 -y 0 2 ) if (x 0 , y 0 ) ∈ Win 0 -∞ otherwise

A two-transition timed automaton with a reset

We now consider the timed automaton in Figure 2. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF]. This timed automaton has a reset and in this example, the opponent's best strategy is not necessarily to choose the largest possible delay. We denote

g 1 := (1 ≤ x ≤ 2 ∧ 0 ≤ y ≤ 1
) and g 0 := (0 ≤ x, y ≤ 1) the guards of this timed automaton.

0 1 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 y := 0 a 0 1 ≤ x ≤ 2 0 ≤ y ≤ 1 a 1 Figure 2.
10 -A timed automaton with a reset.

Permissiveness at f : As in the previous example:

∀v ∈ R 2 + , Perm ( f , v) = +∞
Permissiveness function in 1 : the set of winning valuations at 1 can easily be computed:

Win 1 = {(x 1 , y 1 ) ∈ R 2 + | ∃δ 1 ≥ 0, (x 1 , y 1 ) + δ 1 |= g 1 }
Let us eliminate the variable δ 1 :

∃δ 1 ≥ 0,      0 ≤ 1 -x 1 ≤ δ 1 ≤ 2 -x 1 0 ≤ δ 1 ≤ 1 -y 1 ⇔                    0 ≤ 1 -x 1 1 -x 1 ≤ 1 -y 1 1 -x 1 ≤ 2 -x 1 0 ≤ 1 -y 1 ⇔ (x 1 ≤ 2, y 1 ≤ x 1 , y 1 ≤ 1) Win 1 = {(x 1 , y 1 ) ∈ R 2 + | x 1 ≥ y 1 ∧ y 1 ≤ 1 ∧ x 1 ≤ 2} Let v 1 = (x 1 , y 1 ) be a valuation of Win 1 . The goal of the player at configuration ( 1 , v 1 ) is to propose an interval I 1 := [α 1 , β 1 ]
that maximises the permissiveness of the p-run, which is min (+∞, β 1 -α 1 ) = β 1 -α 1 , while satisfying the guard g 1 . As α 1 and Permissiveness function in 0 : with the same methods, we can easily compute the set of winning valuations at 0 :

β 1 must satisfy 1 ≤ x 1 + α 1 ≤ x 1 + β 1 ≤ 2 and 0 ≤ y 1 + α 1 ≤ y 1 + β 1 ≤ 1, the best strategy for the player is to propose α 1 = max(1 -x 1 , 0) = 1 -x 1 and β 1 = min(1 -y 1 , 2 -x 1 ). As a result: Perm ( 1 , •) : (x 1 , y 1 ) →                    x 1 -y 1 if 0 ≤ y 1 ≤ x 1 ≤ 1 1 -y 1 if 0 ≤ y 1 ≤ 1, y 1 ≥ -1 + x 1 2 -x 1 if 1 ≤ x 1 ≤ 2, y 1 ≤ -1 + x 1 -∞ otherwise
Win 0 = {(x 0 , y 0 ) ∈ R 2 + | ∃δ 0 , v 0 + δ 0 |= g 0 , v 0 + δ 0 [y ← 0] ∈ Win 1 } Win 0 = {(x 0 , y 0 ) ∈ R 2 + | x 0 , y 0 ∈ [0, 1]}
Let v 0 = (x 0 , y 0 ) be an arbitrary valuation of Win 0 . With the same arguments as in the previous example, we can compute an optimal p-move. Let us suppose that this p-move exists and denote it (I 0 , a 0 ) where

I 0 = [α 0 , β 0 ]. Then: Perm ( 0 , v 0 ) = min β 0 -α 0 , inf δ 0 ∈I 0 Perm ( 1 , v 0 + δ 0 [y ← 0])
After passing the first transition, clock y is reset. The next configuration (x 0 + δ 0 , 0) satifies 0 ≤ x 0 + δ 0 ≤ 1. According to the permissiveness function at location 1 , the permissiveness function of the successor is

x 0 + δ 0 . Perm ( 0 , v 0 ) = min β 0 -α 0 , inf δ 0 ∈I 0 x 0 + δ 0 As δ 0 → x 0 + δ 0 is an increasing function on [α 0 , β 0 ]
, the best strategy of the opponent is to propose the delay α 0 .

Perm ( 0 , v 0 ) = min (β 0 -α 0 , x 0 + α 0 )
To maximise Perm ( 0 , v 0 ), β 0 has to be as large as possible, i.e. These two examples gave us a first intuition of the computation of the permissiveness function. To compute the permissiveness function, one should consider the full p-run and optimise each interval in order to maximise the minimum of the sizes of all intervals proposed during the p-run. To compute the optimal interval at each step of the p-run, we can consider the minimum of all the sizes of the future intervals we will have to propose. The future intervals we can propose on a configuration ( , v) depend on the previous interval we had proposed, as v depends on the intervals and delays that have been proposed during the p-run. To avoid this dependence, we compute the permissiveness for all the possible valuations. Therefore, we can optimise step-by-step the future optimal intervals in order to finally compute the permissiveness function of the initial configuration. We will define in Chapter 4 a sequence of functions that tends to the permissiveness function, in order to compute it iteratively.

β 0 = min (1 -x 0 , 1 -y 0 ). α maximises Perm ( 0 , v 0 ) when α 0 = β 0 -x 0 2 if 0 ≤ β 0 -x 0 2 ≤ β 0 (if not, α 0 = 0). As a result: Perm ( 0 , •) : (x 0 , y 0 ) →                              1/2 if 0 ≤ x 0 ≤ 1 2 , y 0 ≤ x 0 1 -y 0 + x 0 2 if 0 ≤ x 0 ≤ y 0 , y 0 ≤ 1 -x 0 1 -y 0 if y 0 ≥ 1 -x 0 , x 0 ≤ y 0 ≤ 1 1 -x 0 if 1 2 ≤ x 0 , 0 ≤ y 0 ≤ x 0 ≤ 1 -∞ Otherwise
x y

1 2 1 2 2 -x 1 -y -∞ x -y (a)
The permissiveness function at 1 .

x y

1 2 1 2 -∞ 1/2 1 -x 1 -y + x 2 1 -y (b)
The permissiveness function at location 0 .

Possible extensions

Other approaches are possible to model and compute the robustness of timed automata.

In this subsection, we present the penalty, used in [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF] to quantify the robustness of timed automata. We finally present a more general model of permissiveness.

Penalty

Penalty semantics was introduced in 2015 by [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF], which presents a type of robustness with delay perturbations. In their model, they consider the sum of all inverses of the sizes of all proposed intervals. They call this quantity the penalty. They give an algorithm to compute the strategy of the player that minimises this quantity.

Definition 2.23: Penalty, [BFM15]

We can define the penalty of a:

• p-move: let (I, a) be a p-move, then its penalty is 1 |I| if |I| = 0, and +∞ when I is punctual.

• finite p-run: let ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤n-1 be a finite p-run, the pen-

alty of ρ (p) is defined as the sum of 1 |I i |
if all I i are non punctual, and +∞ otherwise.

• strategy: let σ be a permissive strategy and ( , v) a configuration, the penalty of σ in ( , v) is defined as 0 if the location is the goal, +∞ if σ is not a winning strategy and the supremum of the penalties of all the p-runs of the set Out (( , v), σ).

• configuration: let ( , v) be a configuration. Then the penalty is the infimum of the penalties, among all strategies, in ( , v).

To sum up, if we consider the configuration ( , v), and if we write every p-run ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤n-1 , the penalty of this configuration is defined as follows:

inf σ   sup ρ (p) ∈Out(( ,v),σ) 0≤i≤n-1 1 |I i |   Example 2.

Let us consider the timed automaton of Figure 2.2. Let us compute the penalty over the set of winning configurations. As a result, the penalty at

( f , v) is 0 whatever the valuation v is. At ( 1 , v), the

penalty is the inverse of the size of the greatest interval the player can propose. As a result it is

1 1 -x if 1 > x > y > 0, 1 1 -y if 1 > y > x > 0,
and +∞ otherwise. Then, at location 0 , to compute the most-permissive strategy, we have to find an interval [α, β] that minimises the following quantities:

1 β -α + sup δ∈[α,β] 1 min (1 -x -δ, 1 -y -δ) As sup δ∈[α,β] 1 min (1 -x -δ, 1 -y -δ) = 1 min (1 -x -β, 1 -y -β)
, this quantity can be simplified as follows:

1 β -α + 1 min (1 -x -β, 1 -y -β)
If x < y, then α should be as small as possible (i.e. 0) and β has to minimise

1 β + 1 1 -y -β . It is equivalent to maximising (β) (1 -y -β). The optimal β is 1 -y 2 .
With the same reasoning, we can prove that, if x ≥ y, the optimal α is 0 and optimal

β is 1 -x 2 .
To sum up, the penalty at configuration ( 0 , x 0 , y 0 ) is defined as follows:

penalty ( 0 , (x 0 , y 0 )) =                4 1 -y 0 if 0 < x 0 < y 0 < 1 4 1 -x 0 if 0 < y 0 ≤ x 0 < 1 +∞ otherwise
Let us illustrate the difference between penalty and permissiveness in the following Example 2. 2.8, where the player should choose the shortest path if he considers the penalty, and the longest, but with larger guard, if he considers the permissiveness.

Example 2.2.8

Let us consider the timed automaton of Figure 2.12. The path with only one transition has smaller guard than the one with two transitions. By considering the permissiveness and the penalty computed on the timed automaton of Figure 2.2, we can easily compute the penalty and the permissiveness of ( 0 , (0, 0)). To compute the permissiveness (resp penalty), at location , we have to consider the path that maximises (resp minimises) the permissiveness (resp the penalty). As a result we compute the maximum between the permissiveness (resp penalty) of the two linear timed automata of Figure 2. [START_REF] Sankur | Robust controller synthesis in timed automata[END_REF]. At

( 0 , (x, y)), if x ≥ y, the permissiveness is 8 • max 1 -x 2 , 3 8 -x • 1 2
, and the penalty

is min 1 3 -8 • x , 1 2 -2x .
At configuration ( 0 , (0, 0)), the permissiveness is 4 and the player's optimal strategy is to choose the path with two transitions. On the contrary, the penalty is min 1 3 , 1 2 = 1 3 and the player's optimal strategy is to choose the shortest path, even if the guard is smaller.

0 1 f 0 ≤ x ≤ 8 a 0 0 ≤ x ≤ 8 a 1 0 ≤ x ≤ 3 a Figure 2.
12 -An acyclic timed automaton with a short and a long path.

0 f 0 ≤ x ≤ 3 a 0 1 f 0 ≤ x ≤ 8 a 0 0 ≤ x ≤ 8 a 1 Figure 2.
13 -Decomposition of the timed automaton of Figure 2.12 into two linear timed automata.

As for the permissiveness, we can formally define the problem of computing the penalty of a configuration in Definition 2.24.

Definition 2.24: Problem of computing the penalty function ([BFM15])

Given a timed automaton A, a configuration ( 0 , v 0 ), a goal location f , the problem of computing the penalty function asks to compute the penalty of the configuration ( 0 , v 0 ). The associated decision problem asks, given a threshold p, if the penalty is less than p. [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF] proved that this problem is in PTIME for one-clock timed automata.

General operator for permissiveness

To compute the optimal permissive strategy with multiple clocks, we chose the robustness model of Subsection 2.2. 1. In the present subsection, we present a more general permissiveness model. Penalty and permissiveness are particular cases of these functions. An interesting future work would be to consider a more general operator than the minimum of the sizes of the intervals. Let us define first a more general permissiveness function. Let Op be a continuous operator from R 2 + to R + , f be a monotonic continuous function from I to R + and k -and k + be two constants in R.

Definition 2.25: Permissiveness for general operator

Let n ≥ 1 and let ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤n-1 be a finite p-run and Op :

R n + → R + and f : I → R + where I = (I i ) 0≤i≤n-1 .
The general permissiveness of a p-run, denoted Perm Op,f ρ (p) is defined as follows:

Perm Op,f ρ (p) = Op (f (I i )) i∈[0•••n-1]
Let ( , v) be a configuration of a timed automaton A. The general permissiveness of a configuration ( , v), denoted Perm Op,f ( , v), is defined as follows:

If ( , v) is not a winning configuration, Perm Op,f ( , v) = k - If is a goal location, Perm Op,f ( , v) = k +
Otherwise, the general definition of the permissiveness function depends on the monotonicity of f :

Perm Op,f ( , v) =              sup σ inf ρ (p) ∈Out(( ,v),σ) Perm Op,f ρ (p) if f is non-decreasing inf σ   sup ρ (p) ∈Out(( ,v),σ) Perm Op,f ρ (p)   if f is decreasing
Let us give some specific examples of this general permissiveness function. First, if (Op = min, f (I) = |I| , k + = +∞, k -= -∞), then it corresponds to the permissiveness function, defined in Subsection 2.2.1. Another model we can consider is the weighted sum, with non-negative coefficients (b i ). In this model

f (I) = 1 |I| , Op (x i ) 0≤i≤n = n i=0 x i b i , k + = 0 and k -= +∞.
The case where all b i are 1 corresponds to the penalty function defined in [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF]. Finally, we can consider the average size of all intervals proposed with f

(I) = |I|, Op (x i ) 0≤i≤n = 0≤i≤n x i n , k -= -∞ and k + = +∞.
These models represent different computational challenges and the optimal strategies can differs.

Conclusion

In this chapter, we presented different semantics to compute a type of robustness based on delay perturbation. Other approaches are possible, such as guard perturbation. The next Chapter 3

STATE OF THE ART: ROBUSTNESS IN

REAL-TIME SYSTEMS

In everyday life, being robust means being resistant to perturbations in our environment.

For example, a tool is robust to water if it is waterproof, i.e. if it functions despite a significant exposure to water. The notion of robustness depends on the nature of the perturbation (for example we could look at the robustness against water or the robustness against fractures, called toughness). In the context of computer science, we have to specify the nature of the perturbations, and what it means to be functional against perturbations.

The systems we consider are real-time systems, which are modelled by timed automata.

In these systems, perturbations can occur either on clocks, or on constraints, or on both, and there are many models of them. In this chapter, we present a state of the art of the different definitions of robustness and the obtained results. To go further, two surveys, [START_REF] Markey | Robustness in real-time systems[END_REF] and [START_REF] Bouyer | Robustness in timed automata[END_REF], on the robustness of timed automata are published. This chapter is organised as follows:

In Section 3.1, we consider the first model that has been proposed for robustness: a topological viewpoint. It was proposed by [START_REF] Gupta | Robust timed automata[END_REF], where trajectories of runs are enlarged as tubes.

In Section 3.2, we present a model where the clocks are allowed to evolved with different speed was proposed. This approach was proposed by [START_REF] Puri | Dynamical properties of timed automata[END_REF].

In Section 3.3, we consider a model of robustness in the context of time sampling. This approach was first proposed by [START_REF] Cassez | A comparison of control problems for timed and hybrid systems[END_REF] for safety properties.

In Section 3.4, we present two models where guards are perturbed.

In Section 3.5, we consider models where delays are perturbed.

Topological approach

Tubes and metrics. [START_REF] Gupta | Robust timed automata[END_REF] proposed a topological model of the robustness for timed automata. This article studies the emptiness problem and the language inclusion problem. Intuitively, a timed automaton is robust if a neighbour of an accepted trajectory is accepted too. Let us present more formally their model.

Let us consider an alphabet Σ, a trajectory is a (possibly infinite) sequence (a i , t i ) i where a i ∈ Σ and t i ∈ R + represent respectively an event and a time gap, i.e. the duration of time between two events a i and a i+1 .

The metric between two trajectories can take different forms, but respect the common following rules: consider two trajectories (a i , t i ) i and (a i , t i ) i , then:

These two trajectories are at finite distance if and only if their sequence of events are identical (i.e. if for any integer i, a i = a i ).

If the previous conditions is verified, the metric between the two trajectories does not depends on the events (a i ) i and (a i ) i . It only depends on the time gaps (t i ) i and

(t i ) i .
The tube of a trajectory τ , for a metric d and a real ε, is then the set of trajectories at distance at most ε from τ for the distance d, denoted T d (τ, ε). This tube contains a neighbourhood of the trajectory τ .

Tube acceptance. This model considers timed automata as defined in [START_REF] Alur | A theory of timed automata[END_REF]. A trajectory τ = (a i , t i ) i is accepted if there exists a run such that the events a i correspond to the actions taken during the transitions, and the delays t i to the time between two transitions. The trace of an automaton is then said to be robust if there exists a tube of this trajectory that is accepted.

Results.

The paper focuses on checking emptiness and proved its decidability. [START_REF] Gupta | Robust timed automata[END_REF] reduces the tube acceptance problem for an automaton to this problem with specific automata (called interior automata). This paper gave hope to prove the decidability of the language inclusion problem, that was unfortunately proven undecidable by [START_REF] Henzinger | Robust undecidability of timed and hybrid systems[END_REF] three years later.

The interest of this model is to isolate the non-robust behaviour by traces, some may not be robust but may also not be relevant. The limitation of this representation is that it does not take into account the structure of the automaton.

Clock drifting

Clock drifts is a model proposed by [START_REF] Puri | Dynamical properties of timed automata[END_REF]. It models the imprecision in the synchronicity of the clocks. In an abstract model, each clock evolves at the same speed and can be reset independently. In the real world, imprecision can occur and clocks can get out of sync. The purpose of the model of clock drifting is to verify the properties even when the speeds of the clocks are not equal.

Model of clock drifts

Clock drifts is a model where the perturbations affects the clock speed. It consists of allowing the clock speed to be between 1 -∆ and 1 + ∆ for a ∆ > 0, instead of all being equal to 1. This model, called ∆-drifting semantics, was introduced by [START_REF] Puri | Dynamical properties of timed automata[END_REF] and [START_REF] Puri | Dynamical properties of timed automata[END_REF].

The ∆-drifting semantics slightly changes a timed automaton A into a timed automaton A ∆ where each clock x does not necessarily evolve with the same speed. For each clock x, its speed, denoted ẋ, is 1 in the classical semantics. In the ∆-drifting semantics, ẋ is between 1 -∆ and 1 + ∆.

Results [START_REF] Puri | Dynamical properties of timed automata[END_REF] and [START_REF] Puri | Dynamical properties of timed automata[END_REF] provide an algorithm that computes, given an automaton A and an initial state s 0 , the reachable state from s 0 of the drifted automaton A ε when ε tends to 0, using region graph, while [START_REF] Daws | Symbolic robustness analysis of timed automata[END_REF] proposes an algorithm using zone. The argument of [START_REF] Daws | Symbolic robustness analysis of timed automata[END_REF] is that, even if the worst-case complexity of their algorithm is the same, a symbolic algorithm might be more efficient. The limit of these two works is that they have to use the hypothesis for each cycle in the region graph, every clock must be reset at least once. In 2007, [START_REF] Dima | Dynamical properties of timed automata revisited[END_REF] extends [START_REF] Puri | Dynamical properties of timed automata[END_REF] and [START_REF] Puri | Dynamical properties of timed automata[END_REF]'s work by providing a symbolic algorithm for non-necessary closed constraints.

In 2017, [START_REF] Roohi | Robust model checking of timed automata under clock drifts[END_REF] provides results for a model that considers both guard enlargement (see Section 3.4) and clock drifting. On top of that, [START_REF] Roohi | Robust model checking of timed automata under clock drifts[END_REF] provides results for reachability properties, as in [START_REF] Puri | Dynamical properties of timed automata[END_REF] and [START_REF] Puri | Dynamical properties of timed automata[END_REF], but removed the hypothesis on the reset of clocks. [DDM + 08] studies perturbations model with guard enlargement mixed with clock drifting for safety properties. They enlarged guards by δ and drifted clocks by ∆.

[DDM + 08] provides an algorithm to decide whether there exists ∆ > 0 and δ > 0 such that the safety property is still verified despite clock drifts and guard enlargement.

Other work extended Puri's model and work. For instance, [SFK08] considers Puri's model and the robustness for safety property. They used the UPPAAL tool to test safety robustness for closed guards. The first result of [START_REF] Mani Swaminathan | The surprising robustness of (closed) timed automata against clock-drift[END_REF] does not bound the clock drifting, but supposes a finite number of iterations. Its second result does not suppose a finite number of iterations but imposes that 0 < ∆ < 1.

Finally, other works used the model of clock drifting for different models of timed automata. [START_REF] Jaubert | Quantitative robustness analysis of flat timed automata[END_REF] studied the computation of the largest possible ∆, while verifying safety properties. They prove the decidability of this problem for flat timed automata (each location belongs to at most one cycle). [START_REF] Alur | Perturbed timed automata[END_REF] considered timed systems that can be express as the product of single-clock automata, with clock drifting ∆ perturbations. Their contribution is to solve the inclusion problem. The space complexity of their algorithm is polynomial in the size of the timed automata. Other types of timed automata have been studied, as in [ABG + 08] and [ABG + 14] that studied clock drifting for distributed timed automata.

Time sampling

Time sampling models. A second approach to robustness is to sample time in the context of hybrid systems. In hybrid systems, continuous time and discrete time components coexist. In this context, the environment is represented in continuous time, and the controller in discrete time. This model is more realistic with respect to the implementation if we take into account the fact that controllers are digital systems.

Discrete-time control problem.

[CHR02] introduced time sampling models and then raised the following question for the safety properties: can the controller avoid bad states if it only looks at discrete times, at regular intervals, that we call sampling rate? They formulate the Discrete-time control problem with unknown sampling rate: is there a β ∈ Q + such that a property can be assured by a controller, if its sampling rate is β? Indeed, let us consider an example (with a single clock system) where bad behaviour occurs between x = 0.3 s and 0.4 s and is not detectable at another times. If the sampling rate is β > 0.1 s, the controller may not detect it, but if β ≤ 0.1 s, it may.

Results. [START_REF] Cassez | A comparison of control problems for timed and hybrid systems[END_REF] showed that this problem is undecidable for safety properties.

[AKY07] and [START_REF] Aziz Abdulla | Sampled semantics of timed automata[END_REF] proved the decidability of the existence of a sampling rate that makes sampled and continuous semantics recognise the same untimed languages. [START_REF] Krcál | On sampled semantics of timed systems[END_REF] used a slightly different semantics to prove two results: the decidability of this problem for reachability of timed automata, but the undecidability, for timed automata that allow clocks to stop at some locations. Finally, [BLM + 11] studied the implementability of timed automata while being robust to clock drifting and samplable, which means being able to construct an implementation that preserves the semantics even if time is sampled.

Perturbations on guards

Robustness can also be modelled as perturbations on guards. Two approaches have been considered. The first approach considers that the implementation might not behave as the idealized model. To model imprecisions, this approach uses guard enlargement on the timed automaton, and then checks whether properties are verified even on this enlarged timed automaton. The second approach, called shrinking, consists in respecting the initial constraints despite the perturbations of the model we design. To do this, this approach shrinks the guards of the timed automaton to give a more strict timed automaton. Then, the goal is to satisfy the desired property even with timing imprecisions.

Guard enlargement

Guard enlarged timed automata. Guard enlargement has been proposed by [START_REF] Bouyer | Robust modelchecking of linear-time properties in timed automata[END_REF]. It consists in designing and implementing directly the original timed automaton A, which models the idealised real-time system, but to verify the robustness of our desired property ϕ on an enlarged timed automaton A δ where δ > 0 is a fixed parameter. If this is verified, we then say that A is δ-robust. The verification of this robustness is called robust model-checking. Let us describe the enlarged timed automaton A δ .

Let δ > 0 be a strictly positive real and A be a timed automaton with guards of the form a ≤ x ≤ b. A δ is the same timed automaton as

A but each guard a ≤ x ≤ b of A is transformed into a guard a -δ ≤ x ≤ b + δ.

Robust model-checking problem.

The robust model-checking problem asks the following question: given a linear-time property ϕ and a timed automata A, the robust model-checking problem decides whether there exists a δ > 0 such that all runs of A δ satisfy ϕ, for δ ∈ [0, δ]. If such δ exists, the automaton A is then δ-robust.

Results

. This model was used in [START_REF] Bouyer | Robust modelchecking of linear-time properties in timed automata[END_REF], [DDM + 08], [START_REF] Bouyer | Robust analysis of timed automata via channel machines[END_REF] and [START_REF] Bouyer | Robust model-checking of timed automata via pumping in channel machines[END_REF] for timed automata where, for each cycles, each clock is reset at least once. The results were the following ones: [START_REF] Bouyer | Robust modelchecking of linear-time properties in timed automata[END_REF] proved the PSPACE-completeness of the robust model-checking problem for LTL and Büchi properties.

[DDM + 08] proved that the robust model-checking problem for safety properties is PSPACE-complete.

[BMR08] studied this problem for coFlatMTL and proved it is EXPSPACEcomplete.

[BMS11] studied this problem for ω-regular properties and proved it was PSPACEcomplete.

Shrinking timed automata

Shrinking timed automata. The shrinking approach was first proposed in [START_REF] Sankur | Shrinking timed automata[END_REF] and is opposed to guard enlargement. Instead of verifying if the property ϕ still holds when the model is enlarged, the goal of the shrinking approach is to verify the idealized model despite timing perturbations. To do so, every constraints

l x ≤ x ≤ u x is shrunk by δ. The resulting constraint is l x + δ ≤ x ≤ u x -δ.
Then, if the timing imprecision is ∆ on a valuation v, the goal is the following ones: Considering a timing perturbation ∆ and a valuation v, if any perturbed valuation v + t, where -∆ ≤ t ≤ ∆, satisfies a shrunk constraint l x + δ ≤ x ≤ u x -δ, then the non-perturbed valuation v satisfies the constraint l x ≤ x ≤ u x . To do so, it is sufficient to verify that [l

x + δ + ∆, u x -δ -∆] ⊆ [l x , u x ].
More formally, given a timed automaton A, its set of constraints I , a positive integer vector k = (k i ) i∈I and a parameter δ > 0, the shrunk timed automaton A -kδ is the resulting timed automaton where all its constraints correspond to the shrunk constraint

l x ≤ x ≤ u x , by k i δ, of the timed automaton A.
The goal is that the satisfaction of the shrunk constraints despite perturbation implies the satisfaction of the constraints in the abstract and idealised models. However, the shrinking can suppress some behaviours and even block the timed automaton, i.e. we find a location in the timed automaton where no transitions are enabled, even after time elapsing. Shrinkability problems. [START_REF] Sankur | Shrinking timed automata[END_REF] proposed two types of robustness problems for the shrinking model: shrinkability and non-blocking-shrinkability. The second problem is a relaxed version of the shrinkability problem, where the second condition is not required.

Definition 3.1: Shrinkability

Let A be a timed automaton. The shrinkability problem asks whether there exists a strictly positive δ > 0 and a positive integer vector k such that, for any δ ∈ [0, δ] the two following properties holds:

1. A -kδ is non-blocking 2. A -kδ time-abstract simulates A.

Results.

In [START_REF] Sankur | Shrinking timed automata[END_REF] and [START_REF] Sankur | Shrinking timed automata[END_REF], the non-blocking-shrinkability problem is proved to be in PSPACE and even in NP if, from each location, we can bound the number of outgoing locations. The shrinkability problem was proven to be in EXPTIME. A tool is also available in http://www.lsv.fr/Software/shrinktech and presented in [START_REF] Sankur | Shrinktech: A tool for the robustness analysis of timed automata[END_REF].

These two approaches model the robustness by modifying constraints, either by enlarging or shrinking them. Another approach consists in modelling the perturbations on the delays. The following section develops two approaches on delay perturbations.

Perturbations on delays

In timed automata, delays are proposed to pass a transition. The delay δ proposed must verify the guard g of the transition, such that, given the current valuation v, v + δ |= g. In the classic semantics, the applied delays are supposed to be infinitely precise and the controller is supposed to react instantly. In reality, there might be imprecision on the delays and the controller may have a delayed reaction time. We present in this section several models that perturb the delays:

The first one, called almost ASAP semantics models the time reaction of the controller with a delay ∆ > 0. ∆ correspond of the time reaction the controller has before proposing a delay to pass the transition.

The second one models a turn-based game with two players, a controller and the environment. The delay d proposed by the controller is perturbed by the environment.

The third one is also based on a turn-based game. In this semantics, called permissive semantics, the controller chooses the degree of perturbations by proposing an interval of delays, instead of a single delay.

Almost ASAP semantics

The Almost-ASAP semantics was proposed by [START_REF] De Wulf | Almost ASAP semantics: from timed models to timed implementations[END_REF] and [START_REF] De Wulf | Almost ASAP semantics: from timed models to timed implementations[END_REF] in order to make timed models implementable. In the abstract model, the controller is supposed to react and to change its strategy instantaneously. In reality, it has a reaction time which [START_REF] De Wulf | Almost ASAP semantics: from timed models to timed implementations[END_REF] models by a delay ∆.

They propose a semantics, called the almost-ASAP semantics. Given a parameter ∆, called a reaction delay, the controller reacts with an offset δ ∈ [0, ∆]. In [START_REF] De Wulf | Almost ASAP semantics: from timed models to timed implementations[END_REF] and [START_REF] De Wulf | Almost ASAP semantics: from timed models to timed implementations[END_REF], they propose an algorithm which computes the maximum possible delay ∆, such that it is possible to check the correction of the hybrid systems. [DDM + 04] extended this work by proving the decidability of the following problem: given an automaton and a property, does such a reaction delay ∆ exist, while verifying the automaton's correctness?

Fixed delay perturbations

Conservative game semantics and excess game semantics. The first model, proposed by [START_REF] Chatterjee | Timed parity games: complexity and robustness[END_REF], is a parametrized model. The delay imprecision is modelled by a turn-based game. In this model, the controller chooses a delay that is perturbed by the environment. Therefore the controller must choose a delay that satisfies the guard even if the delay is perturbed. To model it, the maximal perturbation is fixed by a parameter δ > 0. The controller chooses an edge and a delay d such that the guard of the selected edge is satisfied by any delay in [d -δ, d + δ]. The delay that is applied to pass the transition is chosen by the environment in the interval [d -δ, d + δ]. This semantics is called the conservative game semantics.

Another semantics was proposed by [START_REF] Bouyer | Robust reachability in timed automata: A game-based approach[END_REF], called excess game semantics. In this semantics, the controller does not have to ensure that any delay in [d -δ, d + δ] satisfy the guard. The controller only have to ensure that the chosen delay d does satisfy the guard.

Parametrized robust controller synthesis problem. The Parametrized robust controller synthesis problem can be defined for a property ϕ, and both of the semantics defined in the previous paragraph, in Definition 3. 2. We apply this definition for timed automata, but also for timed games.

Definition 3.2: Parametrized robust controller synthesis problem

Given a property ϕ, the parametrized robust controller synthesis problem asks whether there exists δ > 0 such that the controller has a winning strategy such that every outcome satisfies the property ϕ.

We can also define a robust controller synthesis problem for weighted timed automata. Weighted timed automata are an extension of timed automata defined in [START_REF] Alur | Optimal paths in weighted timed automata[END_REF] and [BFH + 01]. In this extension, each location is associated to a cost and the global cost function represents the sum of the time spent in each location, weighted by their associated cost function. The interest on these objects is the cost-optimal reachability (reaching the goal while minimising the global cost function). In the two semantics defined previously, the global cost function depends on the perturbation δ, [BMS13] defined optimal limit-cost decision problem and optimal limit-cost strong decision problem as follows:

Definition 3.

3: Optimal limit-cost (resp. strong) decision problem

Given p ≥ 0, the optimal limit-cost (resp. strong) decision problem asks whether there exists a winning strategy of the controller such that the limits when δ tends to 0 of the global cost function is greater than (resp. strictly greater than) p. For the excess timed semantics, this problem has proven to be EXPTIME-complete for turn-based timed games and reachability properties by [START_REF] Bouyer | Robust reachability in timed automata: A game-based approach[END_REF] and [START_REF] Bouyer | Robust reachability in timed automata and games: A game-based approach[END_REF].

Results.

The optimal limit-cost (resp. strong) decision problem has been studied for both semantics too for weighted timed automata. It is proved to be PSPACE-complete for the conservative game semantics, but undecidable for weighted timed games by [START_REF] Bouyer | Robustness in timed automata[END_REF]. It is also proved undecidable for weighted timed automata for the excess game semantics by [START_REF] Bouyer | Robustness in timed automata[END_REF],

Finally, [START_REF] Oualhadj | Probabilistic robust timed games[END_REF] provided results for a slightly changed semantics. In their model the controller chooses the action a (and not an edge) and a delay d. The delay applied to pass the transition is chosen by the environment in [d -δ, d + δ], but the environment also chooses the a-labelled edge that is taken. Their contribution is to prove that, given a timed automaton and a Büchi objective, deciding whether there exists such δ > 0 such that the controller has a winning strategy is an EXPTIME-complete problem. They provide a result for probabilistic timed automata, where the environment choices are randomised, that we detail in Subsection 3. 5.

Robustness in probabilistic timed automata

Stochastic game and Markov decision process semantics. Probabilistic timed automata were studied in [START_REF] Oualhadj | Probabilistic robust timed games[END_REF] on the same model detailed in Section 3. 5. [START_REF] Oualhadj | Probabilistic robust timed games[END_REF] proposed two probabilistic models. In the first one, the stochastic game semantics, the environment does not choose the applied delay anymore. Each delay is chosen randomly with the uniform distribution. In the second one, the Markov decision process semantics, the delays are chosen randomly with the uniform distribution too, but the edges are also chosen randomly with a uniform distribution. As a result, there is only one player, the controller.

Results

. With both semantics, [START_REF] Oualhadj | Probabilistic robust timed games[END_REF] proved that, for Büchi objective, deciding, almost-surely, whether there exists such δ > 0 such that the controller has a winning strategy is an EXPTIME problem.

Maximally-permissive strategy

Permissive semantics. Finally, delay perturbations can be modelled as a turn-based game where the controller chooses, for each location, the amount of allowed perturbation. This model was introduced by [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF] and is detailed in Section 2.2 and is called the permissive semantics. The model is a turn-based game where the first player, the controller, chooses an interval of delays I and an action a, such that there exists an transition t such that every delay δ ∈ I satisfies the guard of t. The environment then chooses a delay in the interval I.

An objective function, called the penalty function, sums the inverse of the size of all proposed intervals. The controller's objective is to minimise this function. The environment's objective is to maximise it.

Most-permissive strategy problem and results.

The most-permissive strategy problem, defined in [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF], asks, given a timed automaton A and a configuration s, to compute the penalty of the configuration s. This problem was proven to be in PTIME for single-clock timed automata. This approach is extended in this thesis for multiple-clock timed automata.

Conclusion

Several approaches have been studied to model the robustness of timed automata. The first reason is that the objective may be to make the implementation robust to perturbations, or to force the implementation to respect the original idealised model despite perturbations in the environment. The second reason is that perturbations do not occur in only one way. As with the smartphone robustness example, where robustness can refer to resistance to water, shock, deformation or heat, robustness can for instance refers to perturbations on the timing of clocks (clock drifting), guards (enlargement, shrinking), or proposed delays.

The approach we focus on is the perturbation on delays, as proposed in [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF]. In this thesis, we strive to propose models and algorithms to verify that the timed automaton is robust to delay perturbations. Our goal is to compute, symbolically, the largest perturbation that can occur while achieving reachability objectives. We slightly changed the model of [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF] and presented it in the previous chapter, in Section 2. 2.

The problem we study in this thesis can be seen as an optimisation problem on a turnbased game: finding the optimal strategy of two players, where one wants to minimise and the other one wants to maximise the permissive function of all possible runs. The permissiveness function has been defined in Definition 2.21. Nevertheless, it is not defined iteratively, which would be helpful in order to find the optimal strategies. To solve this problem, in the next Chapter 4 we define a sequence that approximates and tends to our permissiveness function, while being defined iteratively.

Chapter 4

THE SEQUENCE OF SUBOPTIMAL PERMISSIVE FUNCTIONS

The permissiveness function, as defined in Definition 2.21, considers all intervals proposed during a run at the same time. In the first examples of computation of permissiveness functions in Section 2.2.2, the permissiveness of successors is used to compute the permissiveness of a location. This gave us a first intuition of how to compute the permissiveness function. In order to formalise this intuition, we present in this chapter the sequence of suboptimal permissive functions. This sequence computes the minimum between the permissiveness of the current p-move and the permissiveness of the successor, considering that the opponent has an optimal strategy. It is built as a backward algorithm. This sequence of functions is related to the permissiveness function, and we show in this chapter that it converges to the permissiveness function and has interesting properties. This chapter is organised as follows:

First, we present the formal definition of the sequence of suboptimal permissive functions in Section 4.1 and its links with the game semantics presented in the permissiveness semantics of Section 2.2. 1.

Secondly, we present the properties of the sequence of suboptimal permissive functions in Section 4.2: its evolution, its link with the permissiveness function, its analytic properties and finally its optimisation properties.

Definition

The sequence of suboptimal permissive functions, denoted (P i ) i∈N , depends on the possible successors of the current configuration. To define this sequence formally, let us first introduce a notation for the successor of a configuration. Let ( , v) be an arbitrary configuration such that p-moves ( , v) = ∅. Let (I, a) ∈ p-moves ( , v) be an arbitrary p-move and δ ∈ I. There exists a configuration ( , v ) such that ( , v) δ,a -→ ( , v ). We denote this successor succ ( , v, δ, a) := ( , v ). Let us now define the sequence of suboptimal permissive functions in Definition 4.1.

Definition 4.1: The sequence of suboptimal permissive functions

Let A be an arbitrary timed automaton with n clocks and be an arbitrary location. The sequence of suboptimal permissive functions is the sequence of functions, denoted (P i ( , •)) i , defined as follows:

Initialisation: for any valuation v:

P 0 ( , v) =      +∞ if ∈ Q f -∞ otherwise Step i + 1: let v be an arbitrary valuation. If ∈ Q f , P i+1 ( , v) = +∞, otherwise: P i+1 ( , v) =                sup (I,a)∈p-moves( ,v) min |I| , inf δ∈I P i (succ ( , v, δ, a)) if p-moves ( , v) = ∅ -∞ otherwise
The sequence of suboptimal permissive functions considers the optimal strategy of the player and the opponent, from the game described in the permissive semantics. In this semantics, the player chooses a p-move (I, a) and the opponent chooses a delay δ ∈ I to pass the transition and reach a successor ( , v ):

inf δ∈I (P i (succ ( , v, δ, a))) is the permissiveness at ( , v + δ [C r ← 0]
) if the opponent chooses the delay δ ∈ I that minimises the permissiveness.

Considering this optimal delay for each interval the player can propose, the player chooses a p-move that maximises the minimum between the current interval the player proposes and the permissiveness of the successors that will be reached. If an optimal p-move (I * , a * ) exists, then:

P i+1 ( , v) = min |I * | , inf δ∈I * P i (succ ( , v, δ, a * ))
In Figure 4.1, we describe the possible choices of delays and intervals for the guard 0 ≤

x ≤ 1 of the timed automaton in Figure 2. 2. The player has an infinite number of choices of intervals, for instance [0, 0.1] or [0.9, 1]. Each choice will give an interval I such that the opponent can choose a delay δ ∈ I. For instance if I = [0, 0.1], the opponent can choose any delay between 0 and 0.1 (for instance 0 or 0.1). Each delay corresponds to a future configuration: for instance (

1 , v + 0 [C r ← 0]) or ( 1 , v + 0.1 [C r ← 0]).
Our goal is to reduce the number of possible delays and intervals to a finite set of possibilities, in which an infimum and a supremum can be found (they are in general not unique).

( 0 , v) [0, 0.1] [0.9, 1] ( 1 , v + 0 [C r ← 0]) ( 1 , v + 0.1 [C r ← 0]) ( 1 , v + 0.9 [C r ← 0])
P i ( 1 , v + 0 [C r ← 0]) P i ( 1 , v + 0.1 [C r ← 0]) P i ( 1 , v + 0.9 [C r ← 0])
Perm ( j , •) : (x, y) →              +∞ if j = f min( 1 -x 2 -j , 1 -y 2 -j ) if (x, y) ∈ Win j ∧ j ∈ {0, 1} -∞ otherwise
We describe the sequence of suboptimal permissive functions of this timed automaton for i = 0, 1 and 2 in Tables 4.1, 4.2 and 4.3 respectively.

Location sequence of suboptimal permissive functions

0 P 0 ( 0 ) = -∞ 1 P 0 ( 1 ) = -∞ f P 0 ( 1 ) = +∞ Table 4.1 -Computation of P 0 for the timed automaton of Figure 2.2.
Location sequence of suboptimal permissive functions Location sequence of suboptimal permissive function In Example 4.1.1, the sequence of suboptimal permissive functions is eventually constant from rank 2. Lemma 4.5, in Section 4.2, gives a sufficient rank from which the sequence is eventually constant, for acyclic timed automata. As we also prove that the sequence of suboptimal permissive functions converges to the permissiveness function, a direct consequence is that the sequence of suboptimal permissive functions converges in a finite number of steps to the permissiveness function, its fixed point, for acyclic timed automata. It allows us to reduce the maximal-permissiveness problem to (for a sufficiently high rank i) the sequence of suboptimal permissive functions problem, that we define in the following definition.

0 P 1 ( 0 , (x, y)) = -∞ 1 P 1 ( 1 , (x, y)) =    min(1 -x, 1 -y) if x, y ∈ [0, 1] -∞ otherwise f P 1 ( f , (x, y)) = +∞ Table 4.
0 P 2 ( 0 , (x, y)) =      min(1 -x, 1 -y) 2 if x, y ∈ [0, 1] -∞ otherwise 1 P 2 ( 1 , (x, y)) =    min(1 -x, 1 -y) if x, y ∈ [0, 1] -∞ otherwise f P 2 ( f , (x, y)) = +∞ Table 4.

Definition 4.2: Sequence of suboptimal permissive functions problem

Given a timed automaton A, an integer i ∈ N, an initial configuration ( 0 , v 0 ) and a goal location f , the sequence of suboptimal permissive functions problem asks to compute P i ( 0 , v 0 ).

Properties of the sequence of suboptimal permissive functions

In this section, we prove some basic properties of this sequence of functions, and in particular its links with the permissiveness function. In Subsection 4. 2.1, we study the evolution of the sequence of suboptimal permissive functions. In Subsection 4.2.2, we prove the link between the sequence of suboptimal permissive functions (P i ) i∈N and the permissiveness function Perm. For instance, we give sufficient conditions where the limits of the sequence equals the permissiveness function. In Subsection 4.2.3, we prove analytic results such as continuity. Finally, in Subsection 4. 2.4, we study optimisation results, such as concavity.

Evolution properties

The goal of this subsection is to study the evolution of the sequence of suboptimal permissive functions, with respect to either the rank i (in Lemma 4.3 and 4.5) or the valuation of the considered configuration in Lemma 4. 6. In the first lemma, we state that the sequence is non-decreasing. We prove this property by induction.

Lemma 4.3

For any configuration ( , v), the sequence (P i ( , v)) i≥0 is non-decreasing with respect to i.

( , v) = P 1 ( , v) = +∞ (if ∈ Q f ), or P 0 ( , v) = -∞. In both cases, P 0 ( , v) ≤ P 1 ( , v).
Then, let i ∈ N and let us assume that P i ( , v) ≤ P i+1 ( , v) for all ( , v). Let us prove that for all ( , v), P i+1 ( , v) ≤ P i+2 ( , v):

Suppose that p-moves( , v) = ∅. Then by definition, for any j ≥ 0 and any configuration ( , v),

P j ( , v) = -∞. As a result, P i+1 ( , v) ≤ P i+2 ( , v).
On the contrary, suppose that p-moves( , v) = ∅, then for all p-moves (I, a):

inf δ∈I (P i (succ ( , v, δ, a))) ≤ inf δ∈I (P i+1 (succ ( , v, δ, a)))
Then, the following inequality holds:

min |I| , inf δ∈I (P i (succ ( , v, δ, a))) ≤ min |I| , inf δ∈I (P i+1 (succ ( , v, δ, a)))
For all set of p-moves, in particular p-moves ( , v), the supremum operator preserves the inequality: The result follows by definition of P i ( , v) when p-moves ( , v) = ∅.

P i+1 ( , v) = sup

Example 4.2.1

Let us consider the timed automaton used in Example 4. 1.1 and the configuration ( 0 , v). The sequence (P i ( 0 , v)) i≥0 is a non-decreasing sequence for the first three indices, as it is -∞ for i = 0, 1.

If we consider 1 , the sequence

(P i ( 1 , v)) i≥0 is -∞ for i = 0, and then it is constant for i = 1, 2.
We now identify the conditions and ranks from which the sequence of functions (P i ( , v)) i≥0 is eventually constant. Let us first recall the definition of such sequence.

Definition 4.4: eventually constant sequence

A sequence (u n ) n≥0 is eventually constant if there exists a rank n 0 ≥ 0 such that for all n ≥ n 0 , u n = u n 0 .

The following Lemma 4.5 states that, for a fixed configuration ( , v), the sequence of suboptimal permissive functions P i ( , v) is eventually constant at a rank k that represents the length of the longest path to a goal of the timed automaton. More formally, let and be two arbitrary locations. We denote Π ( , ) the set of paths from to . For any path π ∈ Π ( , ), we denote |π| its number of transitions. We define the maximal distance of to goals, denoted d , as follows:

d := max f ∈Q f max π∈Π( , f ) (|π|) Lemma 4.5
Let be an arbitrary location. Then (P i ( , v)) i≥0 is constant from rank d (for any valuation v), i.e., for any valuation v:

∀j ≥ 0, P d +j ( , v) = P d ( , v)
Proof of Lemma 4. 5. We proceed with a simple induction on d .

For d = 0, only the locations that belong to Q f satisfy the condition, and the result holds by definition of P j for any f ∈ Q f . Now, let us assume that the result holds for some index i, and consider a location such that d ≤ i + 1 and a valuation v. If p-moves ( , v) = ∅, the sequence (P i ( , v)) i∈N is constant and is -∞, and the result follows immediately. Otherwise, let (I, a) ∈ p-moves ( , v) be an arbitrary p-move. For any δ ∈ I, let us denote ( δ , v δ ) := succ ( , v, δ, a). The location of this successor δ verifies d δ ≤ i. Hence P i (succ ( , v, δ, a)) = P i+1 (succ ( , v, δ, a)). As a result: remark that d 1 = 1 and that its unique successor location is f . Let i ≥ 1 be an index:

P i+1 ( , v) := sup (I,a)∈p-moves( ,v) min |I| , inf δ∈I P i (succ ( , v, δ, a)) = sup (I,a)∈p-moves( ,v) min |I| , inf δ∈I P i+1 (succ ( , v, δ, a)) = P i+2 ( , v) It immediately follows that P i+1 ( , v) = P i+2 ( , v
P i ( 1 , (x, y)) = sup (I,a)∈p-moves( 1 ,(x,y)) min (|I| , +∞) = P 1 ( 1 , (x, y))
As a result, the sequence

(P i ( 1 , (x, y))) i≥0 is constant from rank 1.
Proving that the sequence of suboptimal permissive functions is eventually constant gives us an important result to compute its limit. Indeed, the sequence then converges in a finite number of steps. Let us fix a configuration ( , v). In Lemma 4.5, we state that, if a rank k is greater than d , the sequence (P i ( , v)) i≥k is constant. As this number is finite for acyclic timed automata, the sequence (P i ( , v)) i≥0 converges in a finite number of steps for acyclic timed automaton. In Subsection 4.2.2, we prove that the permissiveness function corresponds to the limit of the sequence of suboptimal permissive functions. This result enables us to reduce the maximal-sequence of permissiveness function (Definition 2.22) to the maximal-sequence of suboptimal permissive function problem (Definition 4.2), for acyclic timed automata and for the rank d .

Our last result provides a constant above which the exact value of the clocks no longer affects the value of v → P i ( , v) . The intuition is that if the valuation v is greater than the greatest constant of the automaton A, then the same p-moves can be proposed and the valuation of the successor will be greater than v (except for the clocks that are reset). This lemma is used to prove the correctness of our algorithm that computes P i in Section 5. 1.

Lemma 4.6

Let A be a timed automaton, and let M (A) be its largest constant a . Let be a location, and i ∈ N. Take two valuations v and v such that, for any clock x, we have

either v(x) = v (x), or v(x) > M (A) and v (x) > M (A). Then P i ( , v) = P i ( , v ).
a see Definition 2.6

Proof of Lemma 4. 6. We proceed by induction on i: for i = 0, v → P i ( , v) is constant with respect to the valuation, so the result holds.

Let us assume that the result holds for some index i ∈ N. We now prove that it holds for i + 1.

Let be an arbitrary location and v, v be two valuations such that for any clock, either v (x) = v (x), or v (x) > M (A) and v (x) > M (A). With this hypothesis, the same p-moves can be proposed from ( , v) and ( , v ), as the guard constant are all lower than M (A), so p-moves ( , v) = p-moves ( , v ), then:

P i+1 ( , v) = sup (I,a)∈p-moves( ,v ) min |I| , inf δ∈I P i (succ ( , v, δ, a))
Let (I, a) ∈ p-moves ( , v), C r be the reset set of the corresponding transition and δ ∈ I. Let us prove that P i (succ ( , v, δ, a)) = P i (succ ( , v , δ, a)). Let be the successor of when choosing the p-move (I, a), then:

P i (succ ( , v, δ, a)) = P i ( , v + δ [C r ← 0]) and P i (succ ( , v , δ, a)) = P i ( , v + δ [C r ← 0])
Let x be an arbitrary clock. Then either

x ∈ C r and v + δ [C r ← 0] (x) = 0 = v + δ [C r ← 0] (x) or x ∈ C r and then (v + δ [C r ← 0]) (x) > v (x) > M (A) and (v + δ [C r ← 0]) (x) > v (x) > M (A)
. Since these two successors satisfy the induction hypothesis, for any delay δ ∈ I:

P i ( , v + δ [C r ← 0]) = P i ( , v + δ [C r ← 0])
As a result, P i+1 ( , v) = P i+1 ( , v ).

Link between (P i ) i≥0 and Perm

In this subsection, we state the links between the sequence of suboptimal permissive functions (P i ) i∈N and the permissiveness function, Perm. Intuitively, the sequence (P i ) i≥0 is sequence of functions that are always smaller than the permissiveness function, and its limit, if it exists, corresponds to the permissiveness of the timed automaton.

Proposition 4.7

For any i ∈ N and for any configuration ( , v), it holds: Proof of Proposition 4.7. We will prove both claims by induction on i.

1. P i ( , v) = -∞ if,
1. The result is trivial for i = 0: P i ( , v) = -∞ if and only if ∈ Q f . This is equivalent to having no runs of length 0 from to any goal location f ∈ Q f . Indeed, such locations are the ones that already belong to Q f Suppose now that the result holds for some index i ∈ N. The (equivalence) proof is carried by double implication:

(⇒) Suppose that P i+1 ( , v) = -∞, then either p-moves ( , v) is empty (and then the result immediately follows). or it is not empty and the following equality holds:

sup

(I,a)∈p-moves( ,v) min |I| , inf δ∈I P i (succ ( , v, δ, a)) = -∞ Let (I, a) ∈ p-moves ( , v).
As, for each δ ∈ I, ({δ} , a) is also a (punctual) enabled p-move, then:

{({δ} , a) | ({δ} , a) is an enabled p-move} ⊆ p-moves ( , v)
As a result: (min (0, P i (succ ( , v, δ, a))))

P i+1 ( , v) = sup
As P i+1 ( , v) = -∞: -∞ ≥ sup ({δ},a)∈p-moves( ,v)
(min (0, P i (succ ( , v, δ, a))))

Then: sup ({δ},a)∈p-moves( ,v)

P i (succ ( , v, δ, a)) = -∞ Then for each punctual p-move ({δ, } a) ∈ p-moves ( , v), the successor ( , v ) such that , v δ,a -→ , v is such that P i ( , v ) = -∞.
From the induction hypothesis, for any goal location f ∈ Q f , there can be no path from those ( , v ) to f within at most i steps. Hence, there are no paths from ( , v) to f within at most i + 1 steps.

(⇐) Conversely, suppose that for each goal location f ∈ Q f , there are no path having at most i+1 steps from ( , v) to f , then either this is because p-moves ( , v) = ∅, or this is because whatever enabled p-move (I, a) and δ ∈ I, there is no path of length at most i from succ ( , v, δ, a) to f . By induction hypothesis,

P i (succ ( , v, δ, a)) = -∞, hence: P i+1 ( , v) = sup
P i+1 ( , v) = -∞ 2. Let p ∈ R + .
The base case is again trivial. P 0 ( , v) ≥ p if and only if P 0 ( , v) = +∞. This is equivalent to ∈ Q f . As a result, the equivalence is immediate. The equivalence is also trivial if ∈ Q f . Suppose now that ∈ Q f and that the result holds to some index i. The (equivalence) proof is again carried by double implication:

(⇒) Suppose that P i+1 ( , v) ≥ p. Then p-moves ( , v) = ∅, there exists a enabled move (I, a) such that |I| ≥ p and P i (succ ( , v, δ, a)) ≥ p for any δ ∈ I.

Applying the induction hypothesis, there is an i-step winning strategy with permissiveness larger than, or equals to, p from each successor configuration succ ( , v, δ, a). By concatenating with the p-move (I, a), there exists an i + 1step winning strategy with permissiveness larger, or equals to, than p from ( , v).

(⇐) Let us pick an i + 1-step winning strategy σ p from ( , v) with permissiveness larger, or equals to, than p. Write σ p ( , v) = (I 0 , a 0 ). Then, for any δ ∈ I 0 and location ( , v ) such that ( , v)

δ,a 0 --→ ( , v ), strategy σ p is an i-step winning strategy with permissiveness larger than, or equals to, p, so that, following the induction hypothesis, the P i ( , v ) ≥ p. As |I 0 | > p, it immediately follows that:

P i+1 ( , v) ≥ p
We can use this result to prove that the pointwise limit of the sequence of suboptimal permissive functions tends to the permissiveness function.

Corollary 4.8

Let ∈ Q be a location. If lim i→+∞ v → P i ( , v) exists, then v → Perm ( , v) is the pointwise limit of (P i ( , •)) i≥0 .
Proof of Corollary 4.8. This is a basic result of Lemma 4.3 and Proposition 4. 7. Let ( , v) be an arbitrary configuration and suppose that its limit lim i→+∞ P i ( , v) exists. There are three cases:

The case where lim i→+∞ P i ( , v) = -∞ is trivial by the first claim of Proposition 4. 7.

The case where lim i→+∞ P i ( , v) = +∞ is trivial because by proposition 4.7, for any p ∈ R + , there exists a permissive strategy σ such that Perm σ ( , v) ≥ p. So Perm ( , v) = +∞.

Otherwise, suppose that there exists p ∈ R + such that lim i→+∞ P i ( , v) = p, then by proposition 4.7 there exists a permissive strategy σ such that Perm σ ( , v) ≥ p. Suppose that there exists another winning strategy σ such that Perm σ ( , v) ≥ p > p in i steps. Then by Corollary 4.7, P i ( , v) > p too. By Lemma 4.3, the sequence is non-decreasing so p = lim

i→+∞ P i ( , v) ≥ P i ( , v) > p, which is absurd. As a result, sup σ Perm σ ( , v) = p so Perm ( , v) = p.
It enables us to prove some analytic properties of Perm in the next section.

Corollary 4.9

Let A be an acyclic timed automaton, ∈ Q a location and i ≥ d . The two functions v → Perm ( , v) and v → P i ( , v) are equal.

Proof of Corollary 4. [START_REF]The definition set D when C, D, E and B are all distinct[END_REF]. Because of Lemma 4. 5. For each location ∈ Q, the sequence (P i ( , v)) i≥0 is eventually constant from rank d . As a result, its limits exists and is reaches from rank d . Let i ≥ d , by applying the Corollary 4.8, the functions v → Perm ( , v) and v → P i ( , v) are equal.

Analytic properties

The goal of this section is to state basic regularity properties of P i and Perm. The strongest property we were able to prove for P i and Perm is that they are 2-Lipschitz.

We recall some basic definitions: Definition 4.10: Lipschitz continuous functions Let k > 0 be a strictly positive constant and E ⊆ R n be a subset of (R n , • ). A function f : E → R is said to be k-Lipschitz (or k-Lipschitz continuous) if the following property holds:

∀x, y ∈ E, |f (x) -f (y)| ≤ k • x -y E
Let us recall that, if F = R + , the k-Lipschitz continuity is stable with the operator max. Indeed let us consider a strictly positive constant k > 0, an integer m ∈ N and a sequence of functions (f i ) 0≤i≤m defined from E to R + , such that for any i ∈ 0, m , f i is k-lipschitz. Let us consider x, y ∈ E and let us denote i and j the index of 0, m such that max

0≤l≤m f l (x) = f i (x) and max 0≤l≤m f l (y) = f j (y)
. By definition of the maximum:

f j (x) -f j (y) ≤ f i (x) -f j (y) ≤ f i (x) -f i (y)
Then, by the k-lipschitz property:

-k x -y E ≤ f i (x) -f j (y) ≤ k x -y E As a result, max 0≤i≤m (f i ) is k-Lipschitz from E to R + .
Our main result is the 2-Lipschitz continuity of the sequence of suboptimal permissiveness functions, that we prove in Proposition 4.11.

Proposition 4.11

For any integer i ∈ N and any location , the function τ :

Win → R + v → P i ( , v) is 2-Lipschitz.
A direct consequence on Perm is that Perm is 2-Lipschitz when the timed automaton is acyclic: Corollary 4.12

Let A be an acyclic timed automaton and ∈ Q a location, Perm :

Win → R + is 2-Lipschitz.
Proof of Corollary 4.12. This is a direct consequence of Corollary 4.9. Indeed as A is an acyclic timed automaton v → Perm ( , v) is equal to P d ( , v). Therefore, because of Proposition 4.11, Perm is 2-Lipschitz on Win .

To prove Proposition 4.11, we use the Lemmas 2.12 and 4.13. The first one, stated in Chapter 2, is an analytic result on the p-moves that enables us, for each p-move, to consider a corresponding one with a shifted interval, in order to formally express the continuity inequalities. The second one helps us when splitting the sequence into the two terms. The first term corresponds to the size of the current interval and the second term to the sequence of suboptimal permissiveness function of the successors. Lemma 4.13 gives the 2-Lipschitz continuity of the first term.

Lemma 4.13

For any location , the function ν : v → sup

(I,a)∈p-moves( ,v) |I| is 2-Lipschitz on the set v ∈ R |C| + | p-moves ( , v) = ∅ .
Proof of Lemma 4.13. As the number of possible actions is a finite set, we can write ν as follows: We can suppose that has a single transition ( , g, a, C r , ). Let v, v ∈ Win be two valuations. We prove that |ν

ν : v → max
(v ) -ν (v) | ≤ 2 v -v ∞ .
First, if p-moves ( , v) contains no p-move (I, a) whose interval size is at least 2 vv ∞ , then obviously:

ν ,a (v) -ν ,a (v ) ≤ 2 v -v ∞ .
Now, assume that there exists an enabled p-move ([α, β] , a) ∈ p-moves ( , v) such that

β -α ≥ 2 v -v ∞ .
By Lemma 2.12, for any such interval,

([α + v -v ∞ , β -v -v ∞ ], a) ∈ p-moves ( , v ) .
Fix ε > 0, as we can find an interval

I = [α, β] such that (I, a) ∈ p-moves ( , v), |I| ≥ ν (v) -ε and |I| ≥ 2 v -v ∞ . Since [α + v -v ∞ , β -v -v ∞ ] ∈ p-moves ( , v ), it follows: ν ,a (v ) ≥ β -v -v ∞ -α -v -v ∞ ν ,a (v ) ≥ β -α -2 v -v ∞ ν ,a (v ) ≥ ν ,a (v) -2 v -v ∞ -ε ν ,a (v ) -ν ,a (v) ≥ -2 v -v ∞ -ε.
By symmetry of the role of v and v , we also have:

ν ,a (v) -ν ,a (v ) ≥ -2 v -v ∞ -ε ν ,a (v ) -ν ,a (v) ≤ 2 v -v ∞ + ε
As a result:

-2 v -v ∞ -ε ≤ ν ,a (v ) -ν ,a (v) ≤ 2 v -v ∞ + ε
Since this holds for any ε > 0, we get the announced inequality and can conclude by the stability of the max operator.

We can now prove the Proposition 4.11:

Proof of Proposition 4.11. The proof is again by induction on i. The case of i = 0 is trivial, as v → P 0 ( , v) is constant from R |C| + to R + . Let i ∈ N be an integer, and suppose that the result holds for some index i. Let be a location and let us fix an outgoing transition ( , g, a, C r , ). As in the previous proof, the result for the general case directly follows by stability. Let us pick two valuations v, v ∈ Win . In particular, p-moves ( , v) and p-moves ( , v ) are non-empty. We follow the same approach as in the proof of Corollary 4.13, proving that |τ

(v) -τ (v ) | ≤ 2 v -v ∞ .
Again, in case p-moves ( , v) contains no move with an interval of size larger than or equal to v -v ∞ , the result is immediate. Otherwise, let us fix ε > 0, and take an interval I = [α, β] such that:

min |I| , inf δ∈I (P i-1 ( , v + δ [C r ← 0])) ≥ τ (v) -ε.
Then |I| ≥ τ (v) -ε and for any δ ∈ I:

P i-1 ( , v + δ [C r ← 0]) ≥ τ (v) -ε. Let I = [α + v -v ∞ , β -v -v ∞ ], then: |I | ≥ |I| -2 v -v ∞ ≥ τ (v) -ε -2 v -v ∞ .
Moreover, since I ⊆ I, when δ ∈ I we have:

P i-1 ( , v + δ [C r ← 0]) ≥ τ (v) -ε.
Additionally, for any

δ ∈ I , v + δ [C r ← 0] -v + δ [C r ← 0] ∞ ≤ v -v ∞ ,
so that:

P i-1 ( , v + δ [C r ← 0]) ≤ P i-1 ( , v + δ [C r ← 0]) + 2 v + δ [C r ← 0] -v + δ [C r ← 0] ∞ ≤ P i-1 ( , v + δ [C r ← 0]) + 2 v -v ∞ .
Thus for any δ ∈ I ,

P i-1 ( , v + δ [C r ← 0]) ≥ P i-1 ( , v + δ [C r ← 0]) -2 v -v ∞ ≥ τ (v) -ε -2 v -v ∞ Since |I | ≥ τ (v) -ε -2 v -v ∞ , and τ (v ) ≥ min |I | , inf δ∈I (P i-1 ( , v + δ [C r ← 0]))
we have:

τ (v ) -τ (v) ≥ -ε -2 v -v ∞ .
By symmetry of the role of v and v , τ

(v) -τ (v ) ≥ -ε -2 v -v ∞ , so: -ε -2 v -v ∞ ≤ τ (v ) -τ (v) ≤ ε + 2 v -v ∞ .
This prove that τ is 2-Lipschitz.

Optimisation properties

In this section, we prove properties about the optimisation of the opponent strategy.

The following lemma proves that P i ( , v + δ) ≤ P i ( , v). A direct consequence of this lemma is that for any non-resetting transition, the optimal choice of the opponent is the largest delay in the interval proposed by the player. As proved in [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF], this choice is also optimal for any one-clock timed automaton, even with resets. Indeed, in that case, the clock is reset and the new valuation does not depend on the delay chosen by the opponent. This corresponds to the intuition that by playing later, the opponent forces a faster reaction from the player at the next step. However this is not the optimal strategy in general for multiple-clock timed automata (see Counter-example 5.1.1 in the next section).

Lemma 4.14

Let ( , v) be a configuration, δ ∈ R + such that ( , v + δ) is a configuration of the automaton, and i ∈ N.

Then P i ( , v) -δ ≤ P i ( , v + δ) ≤ P i ( , v).
Proof of Lemma 4.14. First, let us prove that P i ( , v + δ) ≤ P i ( , v). For any enabled p-move (I, a) from ( , v + δ), the p-move (I + δ, a) is an enabled p-move from ( , v). Moreover, the set of valuations on which P i-1 is minimised is the same in both cases, namely

{(v + δ [C r ← 0]) | δ ∈ I}. It follows that P i ( , v + δ) ≤ P i ( , v).
Finally, let us prove that P i ( , v) -δ ≤ P i ( , v + δ). For any enabled p-move (I, a) from ( , v) with |I| ≥ δ (if any), the p-move ((I -δ) ∩ R + , a) is an enabled p-move from ( , v + δ). The set of valuation on which

P i-1 is minimised is {v + δ [C r ← 0] | δ ∈ I} too. As |(I -δ) ∩ R + | ≤ |I|, the second inequality follows.
In the following proposition, we state that the function v → P i ( , v) is a concave function from Win to R + for any linear timed automaton. The direct corollary of this property is that the opponent's best choice is either the earliest or the latest delay (see Corollary 5.1 in the next section) for linear timed automaton.

Proposition 4.15

Let i ∈ N. Let be a location of a linear timed automaton A, the function P i ( , •) :

v → P i ( , v
v λ = λ • v 1 + (1 -λ) • v 2
, the following inequality holds:

P i ( , v λ ) ≥ λ • P i ( , v 1 ) + (1 -λ) • P i ( , v 2 ) .
Proof of Proposition 4.15. We prove this proposition with an induction on i. For i = 0, it is trivial since P 0 ( , v) does not depend on v. Let i be an arbitrary positive integer and let us assume that the result holds for P i . Let us now prove that it still holds for P i+1 . Let be an arbitrary location of the automaton A, and ( , g, a, C r , ) be its unique outgoing transition (as A is linear). Let (I j , a) ∈ p-moves ( , v j ) for j ∈ {1, 2}. By definition of p-moves, for j ∈ {1, 2} we then have v j + δ j |= g for any δ j ∈ I j . We can then define the following set:

I λ = {λ • δ 1 + (1 -λ) • δ 2 | δ 1 ∈ I 1 , I 2 ∈ I 2 } .
I λ is an interval. Let us pick any δ λ ∈ I λ : then, by definition of I λ , there exists

δ 1 ∈ I 1 and δ 2 ∈ I 2 such that δ λ = λ • δ 1 + (1 -λ) • δ 2 . Then v λ + δ λ can be written as λ • (v 1 + δ 1 ) + (1 -λ) • (v 2 + δ 2 )
. Since both v 1 + δ 1 and v 2 + δ 2 satisfy the guard g and since, by Proposition 2.3, g is convex, we have that

v λ + δ λ |= g. This proves that (I λ , a) ∈ p-moves ( , v λ ). Moreover |I λ | = λ • |I 1 | + (1 -λ) • |I 2 |.
Let us fix ε > 0, and take two intervals I 1 and I 2 such that:

∀j ∈ {1, 2} , min |I j | , inf P i , v j | ∃δ ∈ I j . ( , v j ) δ,a -→ , v j ≥ P i ( , v j ) -ε.
We can define I λ as above. Then:

P i+1 ( , v λ ) = sup (I,a)∈p-moves( ,v λ ) min |I| , inf δ∈I P i (succ ( , v λ , δ, a))
As the supremum over all p-moves of this minimum is larger than (or equal) to the minimum for any particular p-move (I λ , a):

P i+1 ( , v λ ) ≥ min |I λ | , inf P i ( , v λ ) | ∃δ ∈ I λ . ( , v λ ) δ,a -→ ( , v λ ) = min |I λ | , inf δ λ ∈I λ (P i ( , v λ + δ λ [C r ← 0]))
As

I λ = λ • I 1 + (1 -λ) • I 2 : P i+1 ( , v λ ) ≥ min |I λ | , inf δ 1 ∈I 1 ,δ 2 ∈I 2 (P i ( , (λ • (v 1 + δ 1 ) + (1 -λ) • (v 2 + δ 2 )) [C r ← 0]))
By linearity of the projection over the valuations:

= min |I λ | , inf δ 1 ∈I 1 ,δ 2 ∈I 2 (P i ( , λ • v 1 + δ 1 [C r ← 0] + (1 -λ) • v 2 + δ 2 [C r ← 0]))
We apply the induction hypothesis:

P i+1 ( , v λ ) ≥ min |I λ | , inf δ 1 ∈I 1 ,δ 2 ∈I 2 (P i ( , λ • v 1 + δ 1 [C r ← 0]) + (1 -λ) • P i ( , v 2 + δ 2 [C r ← 0])) = min λ • |I 1 | + (1 -λ) |I 2 | , λ • inf δ 1 ∈I 1 (•P i ( , v 1 + δ 1 [C r ← 0]) + (1 -λ) • inf δ 2 ∈I 2 P i ( , v 2 + δ 2 [C r ← 0])
As min (a + b, a + b ) ≥ min (a, a ) + min (b, b ):

P i+1 ( , v λ ) ≥ λ • min |I 1 | , inf δ 1 ∈I 1 P i ( , v 1 + δ 1 [C r ← 0]) + (1 -λ) • min |I 2 | , inf δ 2 ∈I 2 P i ( , v 2 + δ 2 [C r ← 0])
As for all j ∈ {1, 2} , min

|I j | , inf P i , v j | ∃δ ∈ I j . ( , v j ) δ,a
-→ , v j ≥ P i ( , v j )ε, the following inequality holds:

P i+1 ( , v λ ) ≥ λ • P i+1 ( , v 1 ) + (1 -λ) • P i+1 ( , v 2 ) -2ε
As ε is arbitrary, we consider its limits to 0, then

P i+1 ( , v λ ) ≥ λ • P i+1 ( , v 1 ) + (1 -λ) • P i+1 ( , v 2 ) By induction, for all i ∈ N, P i ( , v λ ) ≥ λ • P i ( , v 1 ) + (1 -λ) • P i ( , v 2 )

Conclusion

In this section, we have exposed several properties of the sequence of suboptimal permissive function P i . Its useful analytic and evolution properties and its link with the permissiveness function give us a very useful tool to compute the permissiveness function. Indeed, we proved that this sequence is eventually constant from a specific rank, and converges to the permissiveness. We can then reduce the computation of the permissiveness to the computation of P i for the appropriate index i. This property holds if the timed automaton is acyclic. We did not manage to prove that it still holds when tackling cycles.

In the next chapter, we expose an algorithm that computes with a symbolic approach the sequence of suboptimal permissive functions, in order to solve the maximal-permissive problem (Definition 2.22) and the maximal-sequence of suboptimal permissive functions problem (Definition 4.2).

Chapter 5

MAXIMAL-PERMISSIVENESS PROBLEM: A SYMBOLIC BACKWARD ALGORITHM

The goal of this chapter is to provide a constructive proof of an upper bound of the complexity of the maximal-permissiveness problem defined in Definition 2.22. More precisely, we show that this problem can be computed in non-elementary time for acyclic timed automata and games. The algorithm we propose computes the strategy of the player for any location by computing the function v → Perm ( , v). This is a symbolic approach.

However, the permissiveness function of a configuration is expressed with p-runs. We defined in Chapter 4 a sequence of functions, called sequence of suboptimal permissive functions which depends on its possible direct successors1 and the current proposed interval. We studied its link with the permissiveness function in Section 4.2.

We also stated that the sequence of functions P i ( , v) is constant for acyclic timed automata from a rank d we computed. This sequence P i ( , v) converges to the permissive function of ( , v). As a result, we only have to compute P d ( , v) to compute the permissiveness function. Let us recall its form for a winning configuration ( , v) such that

∈ Q f : P i ( , v) = sup (I,a)∈p-moves( ,v) min |I| , inf δ∈I P i-1 (succ ( , v, δ, a))
For the purpose of simplification, we first develop this algorithm for linear timed automata with closed polyhedral guards and then present possible extensions: non-necessary closed p-moves, acyclic timed automata and acyclic timed games. Computing the permissiveness for linear timed automata is simpler, as P i+1 ( , v) is concave over Win . Therefore, the best choice of the opponent is to choose one of the bounds of the interval I. As a result the sequence of functions will be simplified as follows:

sup

([α,β],a)∈p-moves( ,v) min (|β -α| , P i-1 (succ ( , v, α, a)) , P i-1 (succ ( , v, β, a)))
This chapter is organised as follows:

First, we present the algorithm for linear timed automata in Section 5.1:

• In Subsection 5.1.1, we compute an optimal strategy for the opponent, which is to choose one of the bounds of the proposed interval.

• In Subsection 5. 1.2, we present an algorithm to compute the sequence P i and show that the maximal-permissiveness problem can be solved in nonelementary time.

• Finally, we present an example of an execution of this algorithm in Subsection 5. 1.3.

Secondly, we extend this algorithm to more general models in Section 5. 2. We extend it for:

• Non necessarily closed p-moves in Subsection 5.2.1.

• Acyclic timed automata in Subsection 5.2.2.

• Acyclic timed games in Subsection 5. 2

.3.

Thirdly and finally, this algorithm uses a powerful optimisation result that we present in the dedicated Section 5.3.

A symbolic backward algorithm for linear timed automata

The goal of this section is to compute, for any linear timed automaton, for any location and integer i, the function v → P i ( , v).

Remark 5.1.1 As only one action a will be possible for each location, we will sometimes simplify the notation of a p-move (I, a) using only the interval I.

Firstly, we prove formally the optimal strategy of the opponent for linear automata. It enables us to simplify a lot the expression of P i ( , v). Secondly, we design an algorithm that computes the function P i ( , v) for any integer i. Our main contribution in this section is to prove that the maximal-permissiveness problem presented in Definition 2.22 can be solved in non-elementary time for linear timed automata. To prove that, we show that, considering the successor location of and g the guard associated to the transition between and , assuming that v → P i ( , v) is a piecewise-affine function (with m cells, represented with at most c i linear inequalities), v → P i+1 ( , v) can be computed in time

O (c i + c g ) 4•m 2
, where c g is the number of linear inequalities that represent g

Optimal strategy for the opponent

Let us consider a configuration ( , v), a transition ( , g, C r , ), an enabled p-move (I, a) proposed by the player and a step i > 0. The goal of the opponent is to propose the delay

δ ∈ I that minimises P i-1 (( , v + δ [C r ← 0])).
In the model of [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF], the best choice of the opponent is to choose the greatest delay, but this model is restricted to one-clock timed automata. We extend this result to our model for non-resetting transitions (see Lemma 4.14) where the best option for the opponent is also to choose the greatest delay. Nevertheless, when a timed automaton contains resets, the greatest delay is not always the best opponent's choice. Let us develop a counter-example in Example 5.1.1.

Example 5.1.1 Let us consider the timed automaton in Figure 5.1a. Let us analyse an example of two different p-runs that both start in the configuration ( 0 , (0, 0)) and are illustrated in Figure 5.1b. In these p-runs the player proposes the interval [0, 1]. Then, let us show two responses by the opponent that illustrate that, in this case, choosing the greatest delay is not his best strategy.

In the first p-run, the opponent chooses the delay δ = 0.5. The future configuration after the transition is then ( 1 , (0.5, 0)). The greatest interval that can be proposed to pass the second transition is [0.5, 1]. The permissiveness of this p-run is then 0.5 (see the green p-run in Figure 5.1b) In the second p-run, the opponent chooses the delay δ = 0.75, and reaches the future configuration ( 1 , (0.75, 0)). In this configuration, a greater interval is enabled: [0.25, 1.75]. The permissiveness is then 0.75 (see the red p-run in Figure 5.1b).

Finally, if the opponent chooses the delay δ = 0, the future configuration reached is ( 1 , (0, 0)). In this configuration, the player have only one choice: propose a punctual interval {1}. The permissiveness is then 0.

In this example, the best strategy of the opponent is to propose the smallest possible delay,

δ = 0. 0 1 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 a 1 , y := 0 1 ≤ x ≤ 2 0 ≤ y ≤ 1 a 2
(a) A timed automaton with a reset. This counter-example proves that we cannot extend for every timed automaton, linear or not, the result of [START_REF] Bouyer | Permissive strategies in timed automata and games[END_REF]. Nevertheless, in the case of linear timed automata, we use the concavity result of Subsection 4. 2.4 to prove that an optimal strategy of the opponent is to choose between the bounds of the interval of a proposed p-move. We state this result in Corollary 5.

(P i (succ ( , v, δ, a))) = min (P i ( , v α ) , P i ( , v β ))
where

v α := v + α [C r ← 0] and v β := v + β [C r ← 0].
Proof of Corollary 5. 1. Let v and v be two clock valuations, λ ∈ [0, 1], and

v λ = λ • v + (1 -λ) • v .
Then for all i, because of Proposition 4.15:

P i ( , v λ ) ≥ min (P i ( , v) , P i ( , v ))
Additionally, we have:

inf δ∈[α,β] (P i (succ ( , v, δ, a))) = inf P i ( , v ) | ∃δ ∈ [α, β] . ( , v) δ,a -→ ( , v ) As (v + (λα + (1 -λ) β)) [C r → 0] = λ ((v + α) [C r → 0]) + (1 -λ) ((v + β) [C r → 0]): inf δ∈[α,β] (P i (succ ( , v, δ, a))) = inf P i ( , v ) | ∃λ ∈ [0, 1] . v = λ • v α + (1 -λ) • v β = min (P i ( , v α ) , P i ( , v β )) .
This corollary only applies for linear timed automata. For acyclic timed automata, we explain the best strategy of the opponent in the Subsection 5.2.2.

Description and proof of the algorithm

Now that we have a better understanding of the optimal strategy of the opponent, the expression of P i ( , •) is simplified and we only have to compute the supremum of the following expression for the set of valuations v such that p-moves

( , v) = ∅. P i ( , •) : v → sup ([α,β],a)∈p-moves( ,v) min (β -α, P i-1 ( , v + α [C r ← 0]) , P i-1 ( , v + β [C r ← 0]))
Our goal in this subsection is to compute the most-permissive strategy of the player for reaching a goal f ∈ Q f . We prove that for any integer i and any location , the function v → P i ( , v) is a continuous piecewise-affine function over Win .

We provide an algorithm to compute this function. First notice that, following Lemma 4.5, for any location of a linear timed automaton, the sequence of functions P i ( , •) i converges in at most d steps (to Perm).

We state this result in Theorem 5.2. To prove that, we compute the permissiveness function step by step with the sequence of suboptimal permissive function P i in Lemma 5.3 Theorem 5.2

Let A be a linear timed automaton with n clocks and with polyhedral guards, represented with at most c g linear inequalities. For any location , v → Perm ( , v) is a piecewise-affine function that can be computed in non-elementary time.

To compute the permissiveness function, we can apply the following Algorithm 1.

Data: A linear timed automaton A, a location 0 Result: v → Perm ( , v)

1 Compute v → P 0 ( f , v) ; 2 ← f ; 3 for i ← 1 to d do 4
Compute v → P i ( , v) with the algorithm presented in the proof of Lemma 5.3 and v → P i-1 ( , v) , where is the successor of ; 5 ← predecessor of ;

6 end 7 return v → P d 0 ( 0 , v) Algorithm 1: Computation of v → Perm ( , v).
Let us state the algorithm to compute the sequence of suboptimal permissive functions in the proof of Lemma 5.3.

Lemma 5.3

Let A be a linear timed automaton with polyhedral guards, represented with at most c g linear inequalities, with n clocks. Let ( , g, a, C r , ) be a transition of A. Assume that v → P i ( , v) is an n-dimensional piecewise-affine function over R n + , such that its restriction over Win is continuous and can be represented with an m-cells tiling of polyhedra, such that each polyhedron is represented with at most c i linear inequalities. Then v → P i+1 ( , v) is an n-dimensional piecewise-affine function, continuous over Win , represented with a tiling of polyhedra with at most O (c i + c g ) 4•m 2 -cells, such that each polyhedron can be represented with at most 3•m 2 ((c i + c g ) + 5) linear inequalities.

It can be computed in time O

(c i + c g ) 4•m 2 .

Proof of Lemma 5.3.

There are some basic cases that can be solved trivially.

1. If v → P i ( , v) is constantly -∞, then also is v → P i+1 ( , v).

Similarly, if p-moves ( , v) is empty for every valuation

v, then v → P i+1 ( , v) is constantly -∞.
Let us now suppose that these previous conditions do not hold. Then, v → P i ( , v) is not constantly -∞ and there is some v such that p-moves ( , v) = ∅. Since v → P i ( , v) is a continuous n-dimensional piecewise-affine function over Win , we can represent it with a tiling of polyhedra T = (h i ) 1≤i≤c i associated with a set of affine functions (f i ) 1≤i≤c i . Let us recall that for each polyhedron h j ∈ T , for any valuation v ∈ h j ,

P i ( , v) = f i (v).
Let us present the organisation of the proof in the following subsection.

Organisation of the proof Our procedure for computing P i+1 in first consists in listing all the possible pairs of cells (h α , h β ) of the tiling of polyhedra defining P i in .

For each pair (h α , h β ) of such cells, we perform the following three steps (illustrated in Figure 5.2):

Step 1 : We characterise the set S (hα,h β ) of all valuations from which those cells can be reached, by proposing an enabled p-move ([α, β] , a] in order to take the transition from to . We compute this polyhedron using quantifier elimination with the Fourier-Motzkin algorithm.

Step 2 : Then, we compute which p-moves can be proposed. For any valuation v of S (hα,h β ) , we compute the smallest and the greatest lower (resp. upper) bound that can be proposed as an interval [α, β]. We denote the set of possible lower (resp. upper) bounds I v α (resp. I v β ). These are intervals and their bounds are expressed as piecewise-affine functions in the coefficients of v. In order to apply the next step of the procedure, our aim is to express these bounds as affine functions. To do so, we may have to tile the polyhedron S (hα,h β ) such that in each cell of the tiling of polyhedra, I v α and I v β will be affine functions of v.

Step 3 : For each refined polyhedron, compute the optimal values for α and β: following Corollary 5.1, this amounts to find values for α ∈ I v α and β ∈ I v β that maximise the following function:

µ : (α, β) → min (β -α, P i ( , v + α [C r ← 0]) , P i ( , v + β [C r ← 0])) .
This is performed by applying an optimisation result that we will develop in Subsection 5.3, for the sake of clarity. It may again require another refinement of the sub-polyhedra. Over the resulting sub-polyhedron, the supremum of µ is an affine function with respect to v. For each pair (h α , h β ), we end up with a piecewise-affine function, defined on S (hα,h β ) , returning the optimal P i that can be obtained when proposing the p-move ([α, β] , a) such that taking the transition to after delay α (resp. β) leads to h α (resp. h β ).

h β h α S (hα,h β ) (a) Step 1. h β h α v I v α I v β (b) Step 2.
Our final step to compute P i+1 in consists in taking the maximum of all these functions; this may introduce one more refinement of our polyhedra.

Let us remark that we perform all these computations symbolically with respect to the valuation v. Indeed our goal is to compute P i+1 ( , v) for any valuation v. To do so, we manipulate affine functions of v, on specific sets of valuations. For instance for each pair of successor cells h α and h β , we compute the polyhedron S (hα,h β ) to determine the valuations v that can reach h α or h β . That gives us conditions on v, used to define I v α and I v β with respect to v.

Let us now detail the first three steps. For this we fix two cells h α and h β in T .

Step 1: Computing S (hα,h β ) . The set S (hα,h β ) of valuations that can reach h α and h β with delays α ≤ β (and after taking the transition to ) is defined as follows:

S (hα,h β ) :=    v ∈ R n + | ∃0 ≤ α ≤ β s.t.    v + α |= g, v + β |= g v + α [C r ← 0] ∈ h α , v + β [C r ← 0] ∈ h β    .
Let us first introduce some notations:

Guards: We denote the inequalities of g as follows:

cg j=1 ϕ (g) j (X) ≥ 0.
Cells h α , h β : These are polyhedra, each defined with at most c i inequalities. Let us denote these inequalities as follows:

h α : c i k=1 ϕ (α) k (X) ≥ 0, h β : c i k=1 ϕ (β) k (X) ≥ 0
With these notations, we can re-write S (hα,h β ) as the set of valuations v such that there exists 0 ≤ α ≤ β that satisfy the following enumerated inequalities:

α ≥ 0, α ≤ β (5.1) v + α |= g :∀0 ≤ j ≤ c g : ϕ (g) j (v + α) ≥ 0 (5.2) v + β |= g :∀0 ≤ j ≤ c g : ϕ (g) j (v + β) ≥ 0 (5.3) v + α [C r ← 0] ∈ h α :∀0 ≤ k ≤ c i : ϕ (α) k (v + α [C r ← 0]) ≥ 0 (5.4) v + β [C r ← 0] ∈ h β :∀0 ≤ k ≤ c i : ϕ (β) k (v + β [C r ← 0]) ≥ 0 (5.5)
Let us eliminate α and β from these inequalities. Let j

∈ [0 • • • c g ] and k ∈ [0 • • • c i ].
Let us express the n-dimensional affine function ϕ (g) j with its coefficients:

ϕ (g) j (v + α) := n i =0 ϕ (g) j,i (v i + α) and ϕ (g) j (v + β) := n i =0 ϕ (g) j,i (v i + β) Let us denote S (g) j = n i =0 ϕ (g) j,i , then: ϕ (g) j (v + α) = S (g) j • α + ϕ (g) j (v) and ϕ (g) j (v + β) = S (g) j • β + ϕ (g) j (v)
As previously:

ϕ (α) k (v + α [C r ← 0]) := n i =0,i ∈Cr ϕ (α) k,i (v i + α) Let us denote S (α) k = n i =0,i ∈Cr ϕ (α)
k,i , then:

ϕ (α) k (v + α [C r ← 0]) = S (α) k • α + ϕ (α) k (v [C r ← 0])
As previously, let us denote

S (β) k = n i =0,i ∈Cr ϕ (β)
k,i , then:

ϕ (β) k (v + β [C r ← 0]) = S (β) k • β + ϕ (β) k (v [C r ← 0])
In order to isolate α and β in these inequalities, we divide our inequalities by S

Pos g = j ∈ [1 • • • n] | S (g) j > 0 , Neg g = j ∈ [1 • • • n] | S (g) j < 0 , Zero g = j ∈ [1 • • • n] | S (g) j = 0 Pos α = k ∈ [1 • • • n] | S (α) k > 0 , Neg α = k ∈ [1 • • • n] | S (α) k < 0 , Zero α = k ∈ [1 • • • n] | S (α) k = 0 Pos β = k ∈ [1 • • • n] | S (β) k > 0 , Neg β = k ∈ [1 • • • n] | S (β) k < 0 , Zero β = k ∈ [1 • • • n] | S (β) k = 0
Let us denote, for γ ∈ {α, β, g}, the size of the previously defined sets as follows:

p γ := |Pos γ | , n γ := Neg γ , z γ := |Zero γ | .
As a result, we will obtain five forms of inequalities: A ≤ α, A ≥ α, B ≤ β, B ≥ β and C ≥ 0 that characterise S (hα,h β ) . The inequalities 5.2 and 5.3 are equivalent to:

∀j ∈ Pos g , -ϕ (g) j (v) S (g) j ≤ α (5.6) ∀j ∈ Pos g , -ϕ (g) j (v) S (g) j ≤ β (5.7) ∀j ∈ Neg g , -ϕ (g) j (v) S (g) j ≥ α (5.8) ∀j ∈ Neg g , -ϕ (g) j (v) S (g) j ≥ β (5.9) ∀j ∈ Zero g , ϕ (g) j (v) ≥ 0 (5.10)
The inequalities 5.1, 5.4 and 5.5 are equivalent to:

0 ≤ α, α ≤ β (5.11) ∀k ∈ Pos α , -ϕ (α) k (v [C r ← 0]) S (α) k ≤ α (5.12) ∀k ∈ Neg α , -ϕ (α) k (v [C r ← 0]) S (α) k ≥ α (5.13) ∀k ∈ Zero α , ϕ (α) k (v [C r ← 0]) ≥ 0 (5.14) ∀k ∈ Pos β , -ϕ (β) k (v [C r ← 0]) S (β) k ≤ β (5.15) ∀k ∈ Neg β , -ϕ (β) k (v [C r ← 0]) S (β) k ≥ β (5.16) ∀k ∈ Zero β , ϕ (β) k (v [C r ← 0]) ≥ 0 (5.17)
We can eliminate α and β by writing, for every type of inequalities previously mentioned,

A ≤ A , A ≤ B , B ≤ B and C ≥ 0.
By doing so, we obtain 2 (2c i + c g ) 2 linear inequalities. As a result, we can compute S (hα,h β ) as a polyhedron with at most 2 (2c i + c g ) 2 inequalities.

Step 2: Computing the range for the bounds α and β. In case S (hα,h β ) is nonempty, we compute, for an arbitrary v of S (hα,h β ) , all the possible values of α and β that indeed lead to h α and h β . The sets of such α and β are respectively denoted I v α and I v β and are defined as follows:

I v α := {α | α ≥ 0, v + α |= g, v + α [C r ← 0] ∈ h α }
and

I v β := {β | ∃α ∈ I v α , β ≥ α, v + β |= g, v + β [C r ← 0] ∈ h β } I v
I v α (low) = max      -ϕ (g) j (v) S (g) j | j ∈ Pos g    ∪    -ϕ (α) k (v [C r ← 0]) S (α) k | k ∈ Pos α    ∪ {0}   I v α (up) = min      -ϕ (g) j (v) S (g) j | j ∈ Neg g    ∪    -ϕ (α) k (v [C r ← 0]) S (α) k | k ∈ Neg α      I v β (low) = max   {I v α (low)} ∪    -ϕ (β) k (v [C r ← 0]) S (β) k | k ∈ Pos β    ∪    -ϕ (g) j (v) S (g) j | j ∈ Pos g      I v β (up) = min      -ϕ (g) j (v) S (g) j | j ∈ Neg g    ∪    -ϕ (β) k (v [C r ← 0]) S (β) k | k ∈ Neg β     
Let us explain how we compute I v α (low): α is lower-bounded by the inequalities of the form A ≤ α where A is an affine function, therefore we compute the maximum of all the affine functions A. We can apply the same reasoning for I v α (up) , I v β (low) and I v β (up). As a result, I v α (low), I v α (up) , I v β (low), I v β (up) are n-dimensional piecewise-affine functions, represented with a tiling of polyhedra with respectively at most p α + p g + 1, n α + n g , 1 + p α + p β + 2p g and n β + n g cells. For each of these tilings of polyhedra, we can bound the number of constraints of the polyhedra respectively by p α + p g , n α + n g -1, p α + p β + 2p g and n β + n g -1.

In order to get affine expressions for the bounds of I v α and I v β , we refine S (hα,h β ) into cells on which one of the affine functions in the expressions of I v α (low) (or I v α (up) , I v β (low) or I v β (up)) realises the maximum (resp. minimum). This refinement is obtained by expressing the fact that the selected affine function is indeed larger than (resp. smaller than) all other functions. This may refine S (hα,h β ) into a tiling of polyhedra with at most 2 • (c i + c g ) 4 cells, defined with the affine functions previously enumerated. Each polyhedron of this tiling of polyhedra is represented by at most 3 (c i + c g ) linear inequalities.

Step 3: Computing the optimal values for α and β. Let us fix v in one of the resulting refined polyhedra of S (hα,h β ) , that we denote h, such that the bounds of I v α and I v β are affine functions with respect to v. We let

D = (α, β) | α ∈ I v α , β ∈ I v β , α ≤ β .
It remains to find the optimal choices for α and β, i.e., the values that maximise the following function µ over D :

µ : (α, β) → min (β -α, P i ( , v + α [C r ← 0]) , P i ( , v + β [C r ← 0]))
over the set D. Let us express the last two terms of this expression in terms of α and β. We denote these terms f hα and f h β :

f hα : α → P i ( , v + α [C r ← 0]) ; f h β : β → P i ( , v + β [C r ← 0])
f hα is constant with respect to β, and f h β is constant with respect to α. As v → P i ( , v) and v → P i ( , v) are multi-dimensional affine functions over h. Therefore f hα and f h β are affine functions respectively with respect to α and β. We can express them with inhomogeneous and homogeneous terms as follows:

f hα (v + α [C r ← 0]) = F Cr hα • α + f hα (v [C r ← 0]) f h β (v + β [C r ← 0]) = F Cr h β • β + f h β (v [C r ← 0])
F Cr hα is the sum of the coefficients corresponding to clocks that are not reset in C r :

F Cr hα = f hα (1) -f hα (1 Cr )
Similarly for F Cr h β . We then have the following equality.

µ (α, β) = min β -α, F Cr hα • α + f hα (v [C r ← 0]) , F Cr h β • β + f h β (v [C r ← 0])
Our goal is to find the couple (α, β) in D that maximises µ (α, β). Let us recall that v is fixed.

To find these values, we will use a result that we will state in the Theorem 5.9, presented in page 141, and prove in Subsection 5.3, for pedagogical purposes. The result will not tackle the cases where I v α and I v β are unbounded. Let us solve this optimisation problem here for this particular case using a constructive proof similar to, but simpler than, the proof of Theorem 5.9. To simplify the notations, let us denote for this special case a

= F Cr hα , b = f hα (v [C r ← 0]) , c = F Cr h β and d = f h β (v [C r ← 0]). Let us suppose that I v α or I v β are infinite.
As their lower bounds are positive, that means the only bound that can be infinite is the upper bound. Let us write the intervals with their lower and upper bounds:

I v α = [m α , M α ] , I v β = [m β , M β ]
We will describe the optimal α and β for the three possibles cases:

If both M α and M β are infinite, due to Lemma 4.6, f hα and f h β are constant and

µ = β -α, the optimal choice is α = m α , β = M β .
Otherwise, if M α = +∞, then M β = +∞ too as α ≤ β for any (α, β) ∈ I v α × I v β . Due to Lemma 4.6, we can conclude that f hα and f h β are constant. Thus:

µ (α, β) = min (β -α, a • m α + b, c • M β + d) .
The optimal choices for α and β are respectively α = m α and β = M β .

Otherwise, if M β = +∞, due to Lemma 4.6, we can conclude that f h β is constant and that we can choose β = M β = +∞. Then:

µ (α, M β ) = min (M β -α, a • α + b, c • M β + d) = a • α + b
The optimal choice of α is the smallest, i.e. α = m α .

Let us go back to the general cases where I v

α and I v β have no infinite bounds. We apply Theorem 5.9 with the following parameters:

[m α , M α ] = I v α and [m β , M β ] = I v β , a = F Cr hα and b = f hα (v [C r ← 0]), c = F Cr h β and d = f h β (v [C r ← 0]).
This may again require refining the polyhedra being considered into at most 15 subpolyhedra, since there may be up to 13 different cases for maximising µ(α, β) (see the summary of the technical Theorem 5.9, in Subsection 5.3.5, page 166). Each of these polyhedra are represented with at most 3 (c g + c i ) + 5 linear inequalities. We then get the optimal values for α and β, as well as the value of µ at that maximal point, depending on the signs of F Cr hα and F Cr h β . We can check that both the optimal choices for α and β, as well as the resulting permissiveness function, are affine functions of v. Indeed, in our instance of the problem of Theorem 5.9, a and b are constants, while c and d, and m α , M α , m β and M β are affine functions of v. The latter may only be multiplied by constants, and/or added with one another.

The coefficients of those affine functions can be computed from those of f hα and f h β , and from those of functions ϕ

(g) i , ϕ (α) j , ϕ (β) j
defining the guard g and the tiling of polyhedra of the piecewise-affine function v → P i+1 ( , v). In the worst case, the numerators are multiplied by the sum of all coefficients, and the denominators may be multiplied by the product of two sums of coefficients. In any case, the space needed to store one such function (assuming binary encoding) is at most affine in the space needed to store v → P i ( , v). This concludes the third step of our computation.

Conclusion:

Finalising the computation of v → P i+1 ( , v). Now, we have a collection of m 2 piecewise affine functions, associated with a couple of polyhedra in which the valuation may end up. Each function is a candidate expression for v → P i+1 ( , v). We thus have to refine one last time the partition we obtained, by considering sub-polyhedra where one of the m 2 candidate functions is the maximal one. Our resulting function is v → P i+1 ( , v). This proves that we can compute it as an n-dimensional piecewise affine function, represented with a tiling of polyhedra of at most O (c i + c g ) 4•m 2 cells, such that each polyhedron can be represented with at most 3 • m 2 ((c i + c g ) + 5) linear inequalities. In the end, this proves that the function v → P i+1 ( , v) can be computed from

v → P i ( , v) in time O (c i + c g ) 4•m 2 .
The coefficients of the affine functions defining P i+1 ( , •) are polynomial in the coefficients of the affine functions defining P i ( , •).

For any location , P 0 ( , •) can be computed in constant time. As a result, the function v → P i+1 ( , v) can be computed in non-elementary time.

Conclusion: Computation of the permissiveness function.

As stated in Algorithm 1, it follows that, we obtain the permissiveness function in location as a piecewise-affine function in non-elementary time which proves Theorem 5.2.

This complexity is quite high, but it is a rough approximation. To illustrate our algorithm and have an example of the number of cells we can have, we develop in the next subsection a complete computation of the sequence of suboptimal permissiveness function P i on the linear timed automaton of Figure 5.3 (which only differs from the example Figure 2.10 in the guard of the first transition). In this computation, we have many intermediary cases to handle, but the final function P 2 in 0 , depicted in Figure 5.4, has a tiling of polyhedra with only four cells (in the winning zone).

An example

In this section, we develop step-by-step the algorithm of Subsection 5.1.2 in order to compute v → P 2 ( 0 , v) of the timed automaton from Figure 5.3. This function corresponds to the permissiveness function for this automaton on location 0 . As explained in Subsection 4.2.2, the following functions are equal:

Perm ( f , •) = P 0 ( f , •) , Perm ( 1 , •) = P 1 ( 1 , •) , Perm ( 0 , •) = P 2 ( 0 , •)
Let us remember that P 1 ( 1 , •) and P 0 ( 0 , •) have already been computed in the example of Subsection 2.2.2. See Figure 2.11a for the permissiveness function at 1 . Here we detail the computation of P 2 ( 0 , •). Following the proof of Lemma 5.3, we list the pairs of possible cells where the automaton may enter 1 after delays α and β when the player proposes the interval [α, β]: since the transition to 1 resets y, we have the two following possible cells2 :

h 0 = {(x, 0) | 0 ≤ x ≤ 1} and h 1 = {(x, 0) | 1 ≤ x ≤ 2} .
Hence, the successors ( 1 , v + α [y ← 0]) and ( 1 , v + β [y ← 0]) can be in four possible cases:

1. Both v + α [y ← 0] and v + β [y ← 0] in h 0 ; 2. Both v + α [y ← 0] and v + β [y ← 0] in h 1 ; 3. v + α [y ← 0] ∈ h 0 and v + β [y ← 0] ∈ h 1 ; Indeed, v +α [y ← 0] ∈ h 1 and v +β [y ← 0] ∈ h 0 cannot happen since α should be smaller than β.
Step 1: Computing the entry sets S (hα,h β ) .

For each pair, we begin by computing the set of valuations v for which there are values 0 ≤ α ≤ β satisfying the conditions. We call the following set of valuations for h α , h β ∈ {h 0 , h 1 }:

S (hα,h β ) = {v | ∃α, β, 0 ≤ α ≤ β, v + α, v + β |= g, v + α [y ← 0] ∈ h α , v + β [y ← 0] ∈ h β } 1. Having v + α [y ← 0] and v + β [y ← 0]
in h 0 can be written as: there exist α ≤ β such that :

     0 ≤ v (y) + α ≤ 1, 0 ≤ v (y) + β ≤ 1 0 ≤ v (x) + α ≤ 1, 0 ≤ v (x) + β ≤ 1
The constraints on y come from the guard of the transition, while those on x correspond to having the target valuations in h 0 . In this simple case, the quantifier elimination returns:

S (h 0 ,h 0 ) = {(x, y) | 0 ≤ x ≤ 1 and 0 ≤ y ≤ 1} .
2. Having v + α [y ← 0] and v + β [y ← 0] in h 1 translates to: there exist α and β such that α ≤ β and:

     0 ≤ v (y) + α ≤ 1, 0 ≤ v (y) + β ≤ 1 1 ≤ v (x) + α ≤ 2, 1 ≤ v (x) + β ≤ 2
This results in:

S (h 1 ,h 1 ) = {(x, y) | 0 ≤ x ≤ 2
     0 ≤ v (y) + α ≤ 1, 0 ≤ v (y) + β ≤ 1 0 ≤ v (x) + α ≤ 1, 1 ≤ v (x) + β ≤ 2
This results in:

S (h 0 ,h 1 ) = {(x, y) | 0 ≤ x ≤ 1 and 0 ≤ y ≤ 1

and y ≤ x}

The next step of the algorithm consists in computing the set of possible α and β corresponding to the cases where v belongs to either S (h 0 ,h 0 ) , S (h 1 ,h 1 ) or S (h 0 ,h 1 ) . For any valuation v, this set of possible α (resp. β) is denoted

I v α (resp. I v β ).
Step 2: Computing the range for the bounds α and β.

We now compute the intervals of possible values for α and β: this just amounts to writing the conditions to have v + α satisfying the guard and v + α [y ← 0] belonging to the target cell (the computation is identical for β):

Having v + α [y ← 0] ending up in h 0 requires α ∈ [0, 1 -v (x)] ∩ [0, 1 -v (y)]; Having v+α [y ← 0] ending up in h 1 requires α ∈ [1 -v (x) , 2 -v (x)]∩[0, 1 -v (y)].
We end up with the following situations:

Having both v + α [y ← 0] and v + β [y ← 0] in h 0 can be performed from S (h 0 ,h 0 ) . From that zone:

1. If x ≤ y, we have I v α = I v β = [0, 1 -y] (case 1), 2. If x ≥ y, we have I v α = I v β = [0, 1 -x] (case 2).
Having both v + α [y ← 0] and v + β [y ← 0] in h 1 can be performed from V 1,1 . From that zone:

1. If x ≤ 1 and y ≤ x, we have

I v α = I v β = [1 -x, 1 -y] (case 3), 2. If 1 ≤ x ≤ 1 + y, we have I v α = I v β = [0, 1 -y] (case 4), 3. If 1 + y ≤ x ≤ 2, we have I v α = I v β = [0, 2 -x] (case 5). Having v + α [y ← 0] ∈ h 0 and v + β [y ← 0] ∈ h 1 can be performed from S (h 0 ,h 1 ) .
We then have

I v α = [0, 1 -x] and I v β = [1 -x, 1 -y] (case 6).
Step 3: Computing the optimal values of α and β.

In the last subsection, we have enumerated six different cases. In this section, we will compute the optimal interval to propose for each case. To do so, we will use the result of Section 5.3. In this section, we compute the optimal α and β that maximise the quantity min (β -α, a • α + b, c • β + d) when a, b, c, d do not depend on α and β. 1. In case 1, we have to maximise (α, β) → min (β -α, x + α, x + β) over {(α, β) | α, β ∈ [0, 1 -y] , α ≤ β}. This corresponds to the case 'a ≥ 0 and c ≥ 0' of Theorem 5.9. We get:

If 1 -y -x 2 ≤ 0, the optimal interval for the player is [0, 1 -y], yielding permissiveness 1 -y.

If 0 ≤ 1 -y -x 2 , the optimal interval is 1 -y -x 2 , 1 -y , with permissiveness 1 -y + x 2 .
2. In case 2, we maximise the same function over

{(α, β) | α, β ∈ [0, 1 -x] , α ≤ β}.
The situation is the same as above, and we get:

If 1 2
-x ≤ 0, the optimal interval for the player is [0, 1 -x], yielding permissiveness 1 -x.

If 0 ≤ 1 2 -x, the optimal interval is 1 2 -x, 1 -x , with permissiveness 1 2 .
3. In case 3, we maximise (α,

β) → min (β -α, 2 -(x + α) , 2 -(x + β)) over {(α, β) | α, β ∈ [1 -x, 1 -y] , α ≤ β}.
We apply Theorem 5.9, with a ≤ 0 and c ≤ 0:

The first condition corresponds to x ≤ 1 2 + y; then the maximal point is min (x -y, 1), i.e. x -y, and is reached at (1 -x, 1 -y).

The second condition is x ≥ 1 2 + y, for which the maximal value is 1 2 is reached at 1 -x, 3 2 -x . 4. In case 4, we maximise the same function over

{(α, β) | α, β ∈ [0, 1 -y] , α ≤ β} over the zone (1 ≤ x ≤ 1 + y ≤ 2):
The first condition is y ≥ x 2 : in that zone, the maximal point is 1 -y, reached for (0, 1 -y);

The second condition is y ≤ x 2 , and the maximal value 1 -x 2 is reached at 0, 1 -x 2 .

5.

In case 5 we maximise the same function over

{(α, β) | α, β ∈ [0, 2 -x] , α ≤ β}.
Again, the second condition holds, and the maximal value is 1 -x 2 , reached at 0, 1 -x 2 .

6. Finally, in case 6, we have to maximise (α,

β) → min (β -α, x + α, 2 -x -β) over {(α, β) | α ∈ [0, 1 -x] , β ∈ [1 -x, 1 -y] , α ≤ β}.
Hence we are in the case a > 0 and c < 0 of Theorem 5.9. This case is divided into 11 cases (see Table 5.5 in page 169). Among them, the only cases whose conditions can hold are cases 1, 4 and 5. Then:

When y ≥ 1-x and y ≥ x 2 , then the condition of case 1 holds, and the maximal value 1 -y is reached at (0, 1 -y).

The conditions of case 4 rewrites as y ≥ x -1 3 and y ≤ 1 -x. For those points,

the maximal value is 1 + x -y 2 , reached at 1 -x -y 2 , 1 -y .
The conditions of case 5 are x ≥ 2 3 and y ≤ x 2 . Thus the maximal point 1 -x 2 is reached for 0, 1 -x 2 .

The permissiveness function at 0

By superimposing those results and taking the maxima on cells where several solutions have been computed, we get the global permissiveness function depicted on Figure 5. 4.

x y 0 0 1 1 2 2 2 3 1 - x 2 1 -y 1 + x -y 2 -∞ -∞ Figure 5
.4 -A linear timed automaton and its permissiveness at 0 .

Extensions

In this section, we explain how to extend our algorithm to more general timed automata.

Non-necessarily closed p-moves or guards

Non-necessary closed intervals

As the size of the closed or open intervals is the same, the only step where a non-necessary closed interval changes the algorithm is for the computation of the strategy of the opponent. If the player proposes the interval ]α, β[, the opponent cannot choose the delay α or β, and this might be its optimal choice.

To tackle this issue, let us recall that by Definition 2.21, the permissiveness corresponds to the size of one of the proposed intervals during a run.

If the permissiveness of a fixed configuration is equal to 0, then no open interval could have been proposed and the optimal choice of the player is to propose a closed one.

Otherwise, if the optimal delay of the opponent is α or β, for a closed interval, and if an open interval ]α, β[ is proposed, we can approach the optimal delay with α + ε or β -ε for a sufficiently small ε, as the permissiveness is continuous. The resulting (approached) permissiveness is equal to |I| -2ε, if the optimal interval was open. We then can obtain the permissiveness by tending ε to 0.

Let us remark that, if the guards are closed, the player can propose a closed or an open interval without changing the permissiveness. It is then useless to propose a closed interval for the player, unless the guards are not closed guards.

Non-necessary closed guards

For any timed automaton A that contains open guards, we denote C (A) its associated timed automaton where all guards become closed (i.e. all < are replaced by ≤ and all > are replace by ≥).

If non-necessary closed guards are allowed, guards can admit constraints of the form

l x < v (x) ≤ u x , or l x ≤ v (x) < u x , or l x < v (x) < u x
for classical guards, or non necessarily closed polyhedra for polyhedral guards. These are still polyhedra (but nonnecessary closed ones). This can constrain the player to propose an open interval instead of a closed interval. The steps of the algorithm will not be affected, as explained in the previous subsection.

Nevertheless, for any configuration ( , v) such that the permissiveness of ( , v) is 0, a punctual interval had to be proposed. Therefore there might be issues on the corresponding guard of this punctual interval.

Therefore, accepting non-necessary closed guards might be an issue on these points, that we consider as future work for this algorithm.

Acyclic timed automata

We extend the previous study to the case of acyclic timed automata (with branching). In that case, we can still apply our inductive approach, with a few changes: at each step, we would compute the optimal p-move of the player for each single action, and then select the optimal action by 'superimposing' the resulting permissiveness functions and selecting the action that maximises permissiveness. This however breaks the result of Proposition 4.15: the maximum of two concave functions need not be concave. Example 5.2.1 displays an example where the permissiveness function is not concave.

Example 5.2.1 Consider the automaton of Figure 5. 5. The transition from 0 to f has the same constraints as that from 1 to f . Hence the permissiveness offered by that action is the same as the one from 1 , which we already computed. Hence the global permissiveness from 0 is the (pointwise) maximal of the two piecewise-linear functions displayed on Figure 5. 6. On this diagram, the blue area corresponds to points from where it is better (or only possible) to go via 1 , while the red area corresponds to valuations from where it is better (or only possible) to take the bottom transition. We prove by induction that the permissiveness functions still are piecewise-linear in that setting. Hence all four steps of our proof of Lemma 5.3 still apply, with some adaptations:

For the first step, we again consider two cells h α and h β , together with a set H of cells that may be visited between h α and h β . Again applying Fourier-Motzkin, we get a polyhedron S (hα,h β ,H) of valuations from which those cells can indeed be visited.

The computation of the intervals I v α and I v β is unchanged.

For

µ : (α, β) → min({β -α, P i ( , v + α [C r ← 0]) , P i ( , v + β [C r ← 0]) ∪ P i , v + d in h [C r ← 0] , P i , v + d out h [C r ← 0] , | h ∈ H}).
Now, we notice that all values in the second set are constant, not depending on α and β. We can thus still apply Theorem 5.9 in order to maximise µ(α, β), and then take the above constants into account (which may again refine the polyhedra).

The above three steps have to be performed for all outgoing transitions from the location being considered. The last step still consists in selecting the maximum of all the resulting functions. This step may refine again the polyhedra.

The complexity of our procedure is much higher than that of linear automata: because we consider sets of cells already at the first step, we may end up with P i+1 having more than 2 m cells, where m is the number of cells of P i . Hence our procedure is non-elementary in the worst case. In the end: Theorem 5. 4 The permissiveness function for acyclic timed automata is piecewise-linear. It can be computed in non-elementary time.

Acyclic timed games

Timed games

Timed games extend the notion of timed automata with a player, denoted C, and an opponent, denoted U. We present the definition of two-player turn-based timed games. In this model, some locations are controlled by a player, denoted C, and the others by an opponent, denoted U. We define timed games and their semantics in this subsection.

Definition 5.5: Timed games E) where:

A timed game is a tuple G C,U = (Σ, Q, Q 0 , Q f , Q C , Q U , C,
A = (Σ, Q, Q 0 , Q f , C, E) is a timed automaton.
The set of locations Q is partitioned into Q C and Q U where:

• Q C is the subset of player-controlled locations. • Q U is the subset of opponent-controlled locations.
For each location controlled by the opponent, a guard, called invariant is added a .

The definitions of transitions and closed timed games naturally extend from the ones in Definition 2. 4.

a that prevents the opponent to stay in a location forever.

As in timed automata, a configuration of a timed game G C,U is also a pair ( , v) where ∈ Q is a location and v is a clock valuation. The permissive semantics of turn-based timed games is defined as follows, for each configuration ( , v): If ∈ Q U , the player cannot propose any interval, delay or action and it is the opponent's turn to propose a pair (δ, a) under the same conditions. In that case, we reach the configuration (

if ∈ Q C ,
, v + δ [C r ← 0]) too.
As in timed automata semantics, we can define a transition ( , v) δ,a -→ ( , v ) with a delayelapsing transition and an action transition. The definition of p-run does not change, as we can write p-run as

ρ (p) = (( i , v i ) , (I i , a i ) , δ i , ( i+1 , v i+1 )) 0≤i≤n-1 by writing I i = {δ i } when i ∈ Q U .
The permissiveness of a run is then only considering p-moves proposed by the player.

The definition of the strategy of the player slightly change. Let us formally define it in Definition 5. 6.

Definition 5.6: Strategy, winning strategy

A permissive strategy is a (partial) function σ that maps finite p-runs

ρ (p) = (( i , v i ) , (I i , a i ) , δ i , ( i+1 , v i+1 )) 0≤i≤n-1 such that n ∈ Q C to p-moves in p-moves ( n , v n ).
We can say that:

A p-run ρ (p) = (( i , v i ) , (I i , a i ) , δ i , ( i+1 , v i+1 )) 0≤i≤n-1
is compatible with a permissive strategy σ if for all its prefixes ρ (p) ≤j such that j ≤ n and j ∈ Q C , σ ρ (p) ≤j = (I j , a j ). We say that ρ (p) is an outcome from the initial configuration s 0 . The set of outcomes from a configuration is denoted Out (s 0 , σ).

A permissive strategy σ is winning from a given configuration s 0 if any infinite p-run originating from s 0 , that is compatible with σ, is winning.

Example 5.2.2

Let us consider the timed game of Figure 5. 7. The state controlled by the player are represented with a circle state and the states controlled by the opponent with squares. In this example, the locations controlled by the player are { 0 , 1 , f } and the one controlled by the opponent is { 2 }.

If we consider the next example, in Figure 5.8, the set of locations controlled by the opponent is { 1 }. In this example, the player can propose, from the configuration ( 0 , (0, 0)), the following winning strategy: proposing (a 0 , [ 1.5, 2]). In that case, whatever the opponent chooses, the player reaches a configuration ( 1 , (δ, 0)), where δ ∈ [ 1.5, 2]. The opponent has to choose a delay between 0 and 0.5, because of the constraints on x. Then, the reached configuration is ( 2 , (δ + δ , δ )) where δ ∈ [0, 0.5], and the player can propose the p-move (a 2 , [0, 0.5]).

Extension of our algorithm

We finally extend our approach to (acyclic) two-player turn-based timed games as defined in Subsection 5. 2.3.1. This setting is easily seen to preserve piecewise-affine character of the permissiveness function. Indeed, in order to compute P i+1 in a location belonging to the opponent, it suffices to first compute the functions P → i for all outgoing transitions from to some . This follows the same procedure as above, and results in a piecewiselinear function, assuming (inductively) that P i is piecewise-linear. We then compute the (still piecewise-linear) minimum M i+1 ( , v) of all those functions, and finally:

0 1 2 f 0 ≤ x ≤ 1 0 ≤ y ≤ 2 a 0 1 ≤ x ≤ 3 2 ≤ y a 1 0 ≤ x ≤ 1 y ≥ 1 a 0 1 ≤ x ≤ 2 0 ≤ y ≤ 2 a 1 Figure 5.7 -A two-clock acyclic timed games. 0 1 2 f 0 ≤ x ≤ 2 0 ≤ y ≤ 2 a 0 , y := 0 0 ≤ x ≤ 4 0 ≤ y ≤ 2 a 1 0 ≤ y ≤ 1 a 2
P i+1 ( , v) = min d s.t. v+d|=Inv( ) M i+1 ( , v + d)
which is easily computed and remains piecewise-linear. It follows:

Theorem 5.7

The permissiveness function for acyclic turn-based timed games is piecewise-linear, and can be computed in non-elementary time.

Optimisation of the minimum of affine functions

In Subsection 5. 1.2, we presented an algorithm that computes the permissiveness function and the sequence of suboptimal permissive functions. This algorithm uses in step 3 an optimisation result that we will develop in this section. The optimisation problem asks to maximise the minimum of three 2-dimensional affine functions

D = (α, β) | α ∈ I v α , β ∈ I v β , α ≤ β . Let us assume that v → P i ( , v [C r ← 0]) (resp. v, → P i ( , v [C r ← 0]) ) is an affine function when v ∈ h α (resp. v ∈ h β ).
The optimisation problem asks to find the values of α and β in D that maximise the following function:

(α, β) → min (β -α, P i ( , v + α [C r ← 0]) , P i ( , v + β [C r ← 0])) .
We can consider in this section that I v α and I v β are bounded closed intervals. Indeed, the unbounded case was treated in our algorithm in Subsection 5. 1.2. To solve this optimisation problem, we consider here a more general optimisation problem. Instead of considering the minimum of an interval and future sequence of suboptimal permissive functions, we consider here the minimum, denoted µ, of β -α and two arbitrary affine functions (in one dimension), one with the variable α and one with the variable β. The minimum of these three functions is a 2-dimensional piecewise-affine functions. The domain D of this function µ will keep as a condition that α ≤ β.

The section is organised as follows:

In Subsection 5.3.1, we present the general optimisation problem and its resolution. We then split the proof of this resolution on three subsections. There can be three cases: either one of the function has infinite coefficients, or µ is, or is not, monotonic with at least one variables.

In Subsection 5.3.2, we detail the proof when µ is monotonic with respect to at least one variable.

In Subsection 5.3.3, we detail the proof when one of the two generic affine functions has infinite coefficients.

In Subsection 5.3.4, we detail the proof when µ is not monotonic in any variable.

Optimisation problem and results

Let us consider four reals a, c, b, d and three 2-dimensional linear functions: f,g) is the pointwise minimum between these three functions over R 2 . The goal is to compute a couple (α, β) that maximises µ, under linear constraints over α and β.

f : (α, β) → a • α + b ; g : (α, β) → c • β + d ; h : (α, β) → β -α µ = min(h,

Definition 5.8: Optimisation problem

Given four reals m α , M α , m β , M β from R such that m α ≤ m β , m α ≤ M α , m β ≤ M β ,
M α ≤ M β , the optimisation problem asks to compute an argsup of µ over the domain is a monotonic function. µ is non-decreasing with respect to β and decreasing with respect to α. As a result µ is maximised at (0, 6).

D = (α, β) ∈ R 2 |α ≤ β, m α ≤ α ≤ M α , m β ≤ β ≤ M β
In the following Theorem 5.9, we give the general result for this optimisation problem: the maximum of µ can take four different forms. The proof we provide in the next subsection is a constructive proof and the value of the maximum and the coordinate of a maximal point are given in Subsection 5.3. 5.

Theorem 5.9 Let m α ≤ M α , m β ≤ M β , M α ≤ M β and m α ≤ m β be reals from R. Let D = (α, β) ∈ R 2 |α ≤ β, m α ≤ α ≤ M α , m β ≤ β ≤ M β
be the domain of the variables α and β. The maximum of µ over D exists and may take one of the four following forms:

M β -m α , λ • f (ν), λ • g(ν) and b • c -d • a c -a where λ ∈ 1, 1 1 -c , 1 1 + a and ν ∈ {m α , M α , m β , M β }.

Description of the domain D

The domain D can be drawn as a 2-dimensional polyhedron in Figure 5.9 where

A = (m α , M β ), B = (M α , M β ), C = (m α , m β ), D = (min(M α , m β ), m β ), E = (M α , max(M α , m β )).
Let us remark that B, C, D and E are not necessarily all distinct. For instance if

M α ≤ m β , then D = E. β ≥ α β = α α β 0 m α M α 0 m β M β A B E D C • • • • • β < α

Applications for the computation of the permissiveness function

This theorem and the results of its constructive proof in Subsection 5.

P i ( , v + α [C r ← 0]) and P i ( , v + β [C r ← 0]).

Existence of the maximum

First, let us prove that D is not empty and that the arg sup of µ over D exists. As Let us recall that the notation µ |D denotes the restriction of the function µ on D, while µ is defined on R 2 .

m α ≤ M α ≤ M β ,

Organisation of the proof

There are two possible cases for f and g. Either f or g has infinite coefficients and we must then consider that f = ±∞ (resp. g = ±∞). Or f and g are both finite affine functions and they can then be expressed using real coefficients b, a, d, c ∈ R. Depending on the sign of their homogeneous terms a and c, µ can be monotonic in at least one variable, in which case its optimisation can be reduced to the optimisation of a one-variable affine function. Therefore, we treat the case where µ is monotonic separately from the case where µ is a non-monotonic function. We thus divide the proof into three cases:

1. In Subsection 5.3.2, we detail the proof when µ is monotonic with respect to at least one variable and when f and g are finite affine functions. This is the case when a ≤ 0 ∧ c ≥ 0 or a ≥ 0 ∧ c ≥ 0, or a ≤ 0 ∧ c ≤ 0.

2. In Subsection 5.3.3, we detail the proof when f or g has infinite coefficients. These cases can be solved using the results of Subsection 5.3.2 3. Finally, in Subsection 5.3.4, we detail the proof when f and g are finite affine function and when µ is not monotonic in any variable. This is the case when a ≥ 0 ∧ c ≤ 0.

Proof for the monotonic case with finite multidimensional affine functions

Let us consider that f and g have only finite coefficients. µ is the minimum of three functions, h, f and g. h is non-decreasing with respect to β and decreasing with respect to α. Let us recall that f is decreasing if and only if a ≤ 0 and g is non-decreasing is and only if c ≥ 0. If one of these two conditions is satisfied, µ is monotonic with respect to at least one variable. Let us detail each of these cases.

Case a ≤ 0 and c ≥ 0

In that case, f and h are decreasing with respect to α and g and h are non-decreasing with respect to β, as h. The variations of f, g and h are illustrated on Figure 5. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF]. As a result, µ is non-decreasing with respect to β and decreasing with respect to α. Then, µ is maximised when:

β ≥ α β = α α β 0 m α M α 0 m β M β A B E D C • • • • • • β < α g h f
α = m α and β = M β . It follows that (α * , β * ) = (m α , M β ) is an argsup of µ |D .
Case a ≥ 0 and c ≥ 0

In that case, f is non-decreasing and h is decreasing with respect to α, while g and h are non-decreasing with respect to β. As a result, µ is monotonic, and non decreasing, with respect to β. Hence µ is maximised over D at a point where

β = M β . It remains to maximise α → µ (α, M β ) over {α ∈ R | (α, M β ) ∈ D}. As µ (α, M β ) = min (M β -α, a • α + b, c • M β + d), this function is maximised over R when α satisfies M β -α = a • α + b, i.e. for α = M β -b a + 1 . If M β -b a + 1 , M β ∈ D,
If M β -b a + 1 ≤ m α , then (α * , β * ) = (m α , M β ) is an argsup of µ |D . If m α ≤ M β -b a + 1 ≤ M α , then (α * , β * ) = M β -b a + 1 , M β is an argsup of µ |D . If M α ≤ M β -b a + 1 , then (α * , β * ) = (M α , M β ) is an argsup of µ |D . α m α M α M β 0 b M β h f • (a) Case M β -b a + 1 ≤ m α . α m α M α M β 0 b M β h f • (b) Case m α ≤ M β -b a + 1 ≤ M α . α m α M α M β 0 b M β h f • (c) Case M α ≤ M β -b a + 1 .

Description of µ

The function µ is no longer monotonic with respect to α or β, but each of the functions f, g and h is monotonic. We then split R 2 into three convex polyhedra, depending on which of h, f, g is minimal, and look at the position of D with respect to these polyhedra. The domain of µ, D, was described previously in Subsection 5.3.1.

R 2 is split into the three sets of (α, β), depending whether min (f, g, h) equals f , g or h. Let us consider

P(f ) = {P ∈ R 2 | µ(P ) = f (P )}, P(g) = {P ∈ R 2 | µ(P ) = g(P )}, P(h) = {P ∈ R 2 | µ(P ) = h(P )} the sets of points of R 2 such that f (resp. g or h) is minimal.
Theses sets are polyhedra of R 2 + and P(f ) ∪ P(g) ∪ P(h) = R 2 . We represent these sets in the Figure 5.12. We can determine the three sets as follows:

µ (f, g, h) = f ⇔ a • α + b ≤ β -α ∧ a • α + b ≤ c • β + d ⇔ β ≥ (a + 1)α + b ∧ β ≤ a c α + b -d c µ (f, g, h) = g ⇔ c • β + d ≤ β -α ∧ c • β + d ≤ a • α + b ⇔ β ≥ 1 1 -c (α + d) ∧ β ≥ a c α + b -d c µ (f, g, h) = h ⇔ β -α ≤ a • α + b ∧ β -α ≤ c • β + d ⇔ β ≤ (a + 1)α + b ∧ β ≤ 1 1 -c (α + d)
The point where f = g = h is denoted T = (T α , T β ) and is defined as follows:

T = d -b(1 -c) ac + c -a , -b + d(1 + a) ac + c -a
T is well defined as a > 0 and c < 0. As a, c = 0, the half-lines d 1 , d 2 , d 3 are defined by the equations:

d 1 : β = (a + 1)α + b ∧ β ≤ T β d 2 : β = 1 1 -c (α + d) ∧ β ≥ T β d 3 : β = a c α + b -d c ∧ β ≥ T β On d 1 , f is equal to h, on d 2 ,
g is equal to h and on d 3 , f is equal to g. Therefore, T is the intersection point of d 1 , d 2 and d 3 .

On top of that, the slopes of d 1 and d 2 are strictly positive (as a + 1 > 0, 1/(1 -c) > 0) and the slope of d 3 is strictly negative as a/c < 0. The slope of d 1 is higher than the slope of d 2 , as a + 1 > 1 > 1/(1 -c) > 0. The only possibility for the relative positions of the half-lines is then the one described in Figure 5.12.

Moreover, f is an increasing function with respect to α, g is a non-increasing function with respect to β and h is an increasing function with respect to β -α. µ reaches its maximal value over R 2 at T . We need to compute (one of) the argsup of µ over D. The argsup depends on the position of D, as T is, in general, not necessarily in D (see the examples in Figure 5.14 and 5.16).

g P(g) h P(h) f P(f ) T d 3 d 1 d 2 β α m α T α 0 b T β Figure 5
.12 -Values of µ in R 2 . The double arrows of f, g and h indicate the directions of variation of each function.

Coverage theorem

In the previous subsection, we show that the argsup of µ |D depends on the position of D.

There are several cases but the signs of the homogeneous terms of f and g restrict the possibilities. In this subsection, we enumerate 11 cases and in this next paragraph we will provide an argsup for each of these cases.

Intuition. The intuition is the following one: D can either intersect none, one, two or three of the half-lines d 1 , d 2 , d 3 . A first attempt to find the argsup of µ |D was to consider the case where µ |D intersects none, one, two or three of these half-lines, and enumerate which one it intersects precisely. The goal, in the algorithm of Section 5.1, is to characterise the set of valuations v such that we can find an argsup of µ |D . As the coefficients that depend on the valuation are b and d, an ideal solution would be to characterise these sets using linear conditions in b and d. The issue is that the set of valuations such that 'D intersects d 1 ' cannot be directly characterised by linear conditions. We characterise these conditions with expressions of the form X ∈ P where X is a point with constant coordinates and P is a polyhedron. Indeed, as P(f ), P(g), P(h) are polyhedra, the membership of a vertex of D (or T ) to P(f ), P(g), P(h) or D is translated by linear inequalities. We also allow linear inequalities.

Basic notations of geometry. First, let us introduce some geometric notions. To denote the number of edges of D that a half-line d ∈ {d 1 , d 2 , d 3 } intersects, we use the following notation defined in Definition 5. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF].

Definition 5.10: Number of intersections

Let n be an integer and E be a set edges. Let d be a line, half-line or ray of R n . We denote N (d, E) the number of elements of E that d intersects.

Example 5.3.2 For instance, if a half-line d intersects [AB] but not [AC] then d intersects only one element in the set {[AB] ,

[AC]} and the following equality holds:

N (d, {[AB] , [AC]}) = 1
We also use in the next proofs vocabulary to describe the relative position of a edges. Let us consider two edges s 1 , s 2 in R 2 We say that: s 1 is a top left edge of s 2 if for any point p 1 = (x 1 , y 1 ) of s 1 and for any point

p 2 = (x 2 , y 2 ) of s 2 : x 1 ≤ x 2 and y 1 ≥ y 2 .
s 1 is a top right edge of s 2 if for any point p 1 = (x 1 , y 1 ) of s 1 and for any point p 2 = (x 2 , y 2 ) of s 2 : x 1 ≥ x 2 and y 1 ≥ y 2 s 1 is a bottom left edge of s 2 if for any point p 1 = (x 1 , y 1 ) of s 1 and for any point p 2 = (x 2 , y 2 ) of s 2 : x 1 ≤ x 2 and y 1 ≤ y 2 s 1 is a bottom right edge of s 2 if for any point p 1 = (x 1 , y 1 ) of s 1 and for any point p 2 = (x 2 , y 2 ) of s 2 : x 1 ≥ x 2 and y 1 ≤ y 2

Examples in Figure 5.13 describe these four configurations. If a > 0 and c < 0, then are 11 different relative positions of D with respect to the polyhedra P(f ), P(g) and P(h). These relative positions can be characterised by the 11 following configurations:

1. A ∈ P(h) (see Figure 5.14a).

2. B ∈ P(f ) (see Figure 5.14b).

3. C ∈ P(g) (see Figure 5.14c). 4. M β ≤ T β , A ∈ P(f ) and B ∈ P(h) (see Figure 5.14d). 5. m α ≥ T α , A ∈ P(g) and C ∈ P(h) (see Figure 5.15a). 6. C ∈ P(f ) and D ∈ P(g) (see Figure 5.15b).

7. B ∈ P(g) and E ∈ P(f ) (see Figure 5.15c).

D ∈ P(f

) and E ∈ P(g) (see Figure 5.15d). [START_REF]The definition set D when C, D, E and B are all distinct[END_REF]. M α ≤ T α , B ∈ P(g) and E ∈ P(h) (see Figure 5.16a). [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF]. m β ≥ T β , C ∈ P(f ) and D ∈ P(h) (see Figure 5.16b).

11. T ∈ D (see Figure 5.16c).

These cases are described in Figures 5.14, 5.15 and 5.16.

Organisation of the proof of Theorem 5.11. The proof of this theorem uses several lemmas (Lemma 5.12, 5.14, 5.18, 5.19 and 5.20) that we will state and prove in this subsection. Lemma 5.12 enumerates which half-lines D can intersect at the same time.

Then, we detail in Lemmas 5.14, 5.18, 5.19, 5.20 the cases when D intersects respectively no half-lines, one half-lines, d 1 and d 3 , d 2 and d 3 . Finally, we will detail the case when D intersects the three half-lines d 1 , d 2 and d 3 .

The next lemmas are organised as follows:

We consider the three half-lines d 1 , d 2 and d 3 and we enumerate how many of these half-lines can intersect the domain set D (see Lemma 5.12). We are then able to study cases with respect to the number of half-lines that can intersect D.

N (d 1 , {[AB] , [BE]}) = 1
and

N (d 1 , {[CD] , [AC] , [DE]}) = 1
Proof. We exclude the cases here d 1 intersects the edges on B, C or D. For instance, if d 1 intersects [CD] exactly on C, the half-line trivially intersects [AC].

As d 1 's slope is strictly greater than 1: Cases where D intersects only one half-line. Now that we study which edge was crossed when each half-line among d 1 , d 2 and d 3 intersects D, we can use this result to translate the fact that only one half-line intersects D into a membership of a vertex to a polyhedron. To do so, we will use lemmas 5.15, 5.16 and 5.17 for each half-line. For instance, for half-line d 1 , if it intersects D, then it necessarily intersects either [AB] or [BE], but not both. As d 1 is a separation between P(f ) and P(h), we can deduce the position of A, B or E. Let us state formally these results in Lemma 5.

d 1 cannot intersect both [CD]
C ∈ P(h)).
Theses cases are illustrated respectively in Figures 5.14c Theses cases are illustrated respectively in Figures 5.15b, 5.15c and 5.15d.

Proof. Let us detail the edges that are crossed for each half-lines.

If d 1 intersects D then, thanks to Lemma 5.15:

• Either d 1 intersects [AB], then A ∈ P(f ) and B ∈ P(h). In that case, as D

does not intersect other half-lines, M β ≤ T β .

• Or d 1 intersects [BE], then B ∈ P(f ) and E ∈ P(h).

As a result (A ∈ P(f ) and B ∈ P(h)) or (B ∈ P(f ) and E ∈ P(h)).

If d 2 intersects D and then, thanks to Lemma 5.16:

• Either d 2 intersects [CD], then C ∈ P(g). • Or d 2 intersects [AC].
In that case, as D does not intersect other half-lines, m α ≤ T α , on top of that A ∈ P(g) and C ∈ P(h).

As a result, either C ∈ P(g) or (m α ≤ T α , A ∈ P(g) and C ∈ P(h))

If d 3 intersects D and then, thanks to Lemma 5.17:

• Either d 3 intersects [CD]
, then C ∈ P(f ) and D ∈ P(g).

• Or d 3 intersects [BE], then B ∈ P(g) and E ∈ P(f ).

• Or d 3 intersects [DE], then D ∈ P(f ) and E ∈ P(g).

As a result, either ( C ∈ P(f ) and D ∈ P(g)) or ( B ∈ P(g) and E ∈ P(f ) ) or (D ∈ P(f ) and E ∈ P(g)).

Cases where D intersects exactly two half-lines. Now, let us study the cases where D intersects exactly two half-lines. Thanks to Lemma 5.12, we know that if D intersects exactly two half-lines, it is d This case is illustrated in Figure 5.16a.

Proof. Considering Lemmas 5.15 and 5.17, we know that:

N (d 1 , {[AB] , [BE]}) = 1 N (d 1 , {[CD] , [AC] , [DE]}) = 1 N (d 3 , {[AB] , [AC]}) = 1 N (d 3 , {[CD] , [BE] , [DE]}) = 1
In addition: This case is illustrated in Figure 5.16b.

Proof. If d 3 and d 2 intersect D, then by Lemmas 5.16 and 5.17:

N (d 2 , {[CD] , [AC]}) = 1 N (d 2 , {[AB] , [BE] , [DE]}) = 1 N (d 3 , {[AB] , [AC]}) = 1 N (d 3 , {[CD] , [BE] , [DE]}) = 1
The goal of this proof is to prove that necessarily, d Secondly, we prove that necessarily d 3 intersects [CD]:

d 3 cannot intersect [DE]: if d 3 intersects [DE], T is below right of the edge [DE]. d 2 ,
which slope is between 0 and 1 cannot intersect D. This leads to a contradiction. µ reaches its minimal value over the half-line d 3 , but over this half-line, g ≡ h, so the maximum is reached on C = (m α , m β ).

d 3 cannot intersect [BE]: indeed if d 3 intersects [BE], T α ≥ M α

As a result, if

C ∈ P(g), then (α * , β * ) = C is an argsup of µ |D .
Case 4: M β ≤ T β , A ∈ P(f ) and B ∈ P(h). As T β ≥ M β , D is below T and does not intersect P(g)\{T }, µ |D = min(f, h). µ |D is then increasing with respect to β.

As [AB] intersects d 1 , (d -1
1 (M β ), M β ) ∈ D and µ |D reaches its maximal over d 1 on this point. The condition A ∈ P(f ) and B ∈ P(h) can be characterised with

f (A) ≤ h (A) and h (B) ≤ f (B) because µ |D = min(f, h).

As a result, if

T β ≥ M β , f (A) ≤ h (A) and h (B) ≤ f (B), then (α * , β * ) = M β -b a + 1 , M β is an argsup of µ |D .
Case 5: m α ≥ T α , A ∈ P(g) and

C ∈ P(h). If T α ≤ m α , A ∈ P(g), C ∈ P(h).
As D is on the right-hand side of the intersection point, it does not intersect P(f )\d 1 , so µ |D ≡ min (g, h). As µ is non-increasing with respect to α, µ reaches its maximal value when α is minimum (i.e where α = m α ). Then if

g (A) ≤ h (A) ∧ h (C) ≤ g (C), µ reaches its maximal value when β = m α + d 1 -c . As a result, if T α ≤ m α , g (A) ≤ h (A)
(B) ≤ f (B) , g (B) ≤ h (B) , f (E) ≤ g (E) , f (E) ≤ h (E), then (α * , β * ) = (M α , max(M α , m β )) is an argsup of µ |D .
T β ≥ T α , T β ≤ m β , T α ≤ M α and T α ≥ m α .
If these conditions hold, then µ reaches its maximal at T .

Appendix: Figures

In this subsection that the double-arrows represent the variation of µ in P(f ), P(g) and P(h). The gray zones represent zones, among P(f ), P(g) and P(h), that D does not intersect.

g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (a) Case 1: A ∈ P(h). g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (b) Case 2: B ∈ P(f ). g P(g) h P(h) f P(f ) T = (T α , T β ) d 3 d 1 d 2 • A • B • E • D • C β α T α b T β (c) Case 3: C ∈ P(g). g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (d) Case 4: A ∈ P(f ), B ∈ P(h) and T β ≥ M β .
g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (a) Case 5: A ∈ P(g), C ∈ P(h) and T α ≤ m α . g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (b) Case 6: C ∈ P(f ) and D ∈ P(g). g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (c) Case 7: B ∈ P(g) and E ∈ P(f ). g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (d)
P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (a) Case 9: M α ≤ T α , B ∈ P(g) and E ∈ P(h). g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (b) Case 10: m β ≥ T β , C ∈ P(f ) and D ∈ P(h). g P(g) h P(h) f P(f ) d 3 d 1 d 2 • A • B • E • D • C T β α T α b T β (c) Case 11: T ∈ D.

Conclusion and result in general cases

In this section, we sum up every found argsup of µ |D depending whether f or g has infinite coefficients, or depending on the signs of a and c. Tables 5.1,5

M β ≤ m α + d 1 -c (m α , M β ) min{M β -m α , c • M β + d} m β ≤ m α + d 1 -c ≤ M β (m α , m α + d 1 -c ) min{ c • m α + d 1 -c , c • m α + d 1 -c + d} m α + d 1 -c ≤ m β (m α , m β ) min{m β -m α , c • m β + d}
Table 5.1 -All solutions where f = +∞.

• when g = +∞ and a ≤ 0:

Coordinates of a maximal point value of a maximal point

(m α , M β ) min{M β -m α , a • m α + b}
• when g = +∞ and a ≥ 0:

Conditions coordinates of a maximal point value of a maximal point M β -b a + 1 ≤ m α (m α , M β ) min{M β -m α , a • m α + b} m α ≤ M β -b a + 1 ≤ M α ( M β -b a + 1 , M β ) min{ a • M β + b a + 1 , a • M β -b a + 1 + b} M α ≤ M β -b a + 1 (M α , M β ) min{a • M α + b, M β -M α }
Table 5.2 -All other solutions where g = +∞.

When f and g are non-infinite functions

• When a ≥ 0 and c ≥ 0:

Conditions coordinates of a maximal point value of a maximal point M β -b a + 1 ≤ m α (m α , M β ) min{M β -m α , cM β + d} m α ≤ M β -b a + 1 ≤ M α ( M β -b a + 1 , M β ) min{ a • M β + b a + 1 , c • M β + d} M α ≤ M β -b a + 1 (M α , M β ) min{a • M α + b, c • M β + d} Table 5.
3 -All solutions when f and g are non-infinite functions and when a ≥ 0 and c ≥ 0.

• when a ≤ 0 and c ≥ 0:

Coordinates of a maximal point value of a maximal point

(m α , M β ) min{M β -m α , a • m α + b, c • M β + d}
• when a ≤ 0 and c ≤ 0:

Conditions coordinates of a maximal point value of a maximal point

M β ≤ m α + d 1 -c (m α , M β ) min{M β -m α , a • m α + b} m β ≤ m α + d 1 -c ≤ M β (m α , m α + d 1 -c ) min{ c • m α + d 1 -c , a • m α + b} m α + d 1 -c ≤ m β (m α , m β ) min{a • m α + b, c • m β + d}
Table 5.4 -All solutions when f and g are non-infinite functions and when a ≤ 0.

• when a > 0 and c < 0:

Case conditions coordinates of a maximal point its evaluation on µ

1 h ≤ f, g at A (m α , M β ) M β -m α 2 f ≤ g, h at B (M α , M β ) a • M α + b 3 g ≤ f, h at C (m α , m β ) c • m β + d 4 T β ≥ M β f ≤ g, h at A h ≤ f, g at (B) M β -b a + 1 , M β a • M β + b a + 1 5 m α ≥ T α g ≤ f, h at A h ≤ f, g at C m α , m α + d 1 -c c • m α + d 1 -c 6 f ≤ g, h at C g ≤ f, h at D ((1 -c) • m β -d, m β ) c • m β + d 7 g ≤ h, f at B f ≤ h, g at E (M α , max(M α , m β )) a • M α + b 8 f ≤ g, h at D g ≤ f, h at E b -d c -a , b -d c -a b • c -d • a c -a 9 M α ≤ T α g ≤ f, h at B h ≤ f, g at E (M α , (a + 1) • M α + b) a • M α + b 10 m β ≥ T β f ≤ g, h at C h ≤ f, g at D c • m β + d -b a , m β c • m β + d 11 T β ≥ T α , T β ≤ m α T α ≤ M α , T α ≥ m α T T β -T α
Table 5.5 -All solutions when f and g are non-infinite functions and when a > 0 and c < 0.

Conclusion

In this chapter, we provided an algorithm that computes the permissiveness function in time at most non-elementary for acyclic timed automata. We are facing a high worstcase complexity that depends on the number of cells used to represent the permissiveness function of the successors when computing the optimal strategy of the player. Despite this, we implement our algorithm, to observe its runtime on small examples. We also want to find other approaches where fewer cells are used to represent the permissiveness function. Therefore in the following chapters, we will present an implementation of the algorithm of this chapter for linear timed automata and two different approaches that compute approximate values of the permissiveness function.

https://gitlab.inria.fr/emclemen/formats-symbolic-tools for the symbolic implementation.

In this chapter, we present these implementations, their results and then compare their differences. In Section 6.1, we present our forward algorithm and its implementation in Python. In Section 6.2, we present the symbolic implementation of the algorithm proposed in Chapter 5, for linear automata, and compare it with our forward approach.

Numerical forward approach

In our first implementation, we want to compute an approximate value of the permissiveness of a fixed configuration. To do so, we want to explore all the p-runs. Nevertheless, there are an infinite number of possible p-runs so we sample all the possibles p-moves and delays that the player and the opponent can propose respectively.

For the sampling, we fix two strictly positive integers p and q and use a sampling step s I = 1/p for the p-moves sampling and a sampling step s δ = 1/(p • q) for the delay sampling. In order to optimise which p-run is the optimal one, we use a backtracking algorithm. Let us present the main steps of this algorithm, illustrated in Figure 6.1:

1. We explore the timed automaton with a simple first trace (see Figure 6.1a), with simple (non-necessary optimal) choices and it will be our 'best current trace' where we choose the greatest intervals and the first possible delays.

2. We sample the set of possible intervals and possible delays. As we have a forward approach our main issue is that we do not know the future permissiveness of our successors when proposing a p-move. Therefore we do not have the optimal strategy of the player and the opponent. To tackle this problem, we would like to consider all the possible intervals and delays. As we cannot explore infinite sets, we sample them with a fixed precision s.

For example, if we consider a step s I = 1/2 and we sample all the possible subintervals of [0, 1], we propose the intervals [0, 1/2], [0, 1] and [1/2, 1]. If we sample the delays, with a sampling step s δ = 1/2, all the elements on [0, 1], we consider the delays 0, 1/2 and 1.

In general, we proceed to a delay sampling because for general timed automata, the bound of the interval may not be the optimal choices for the opponent. In the case ( 0 , (0, 0)) initial configuration

I 0,1 I 0,0 I 0,2 interval sampling ( 1 , v 0,1 ) ( 1 , v 0,0 ) ( 1 , v 0,2 )
delay sampling δ 0,0 δ 0,1 δ 0,2

I 1,1 I 1,0 I 1,m • • • ( f , v 1,0 ) δ 1,0 ( f , v 1,1 ) ( f , v 1,m ) δ 1,1 • • • δ 1,m
Goal successors (a) First step: a first trace exploration choosing I 0,0 , δ 0,0 , I 1,0 and δ 1,0 .

( 0 , (0, 0))

I 0,1 I 0,0 I 0,2 ( 1 , v 0,1 ) ( 1 , v 0,0 ) ( 1 , v 0,2 ) δ 0,0 δ 0,1 δ 0,2 I 1,1 I 1,0 I 1,m • • • ( f , v 1,0 ) δ 1,0 ( f , v 1,1 ) ( f , v 1,m ) δ 1,1 • • • δ 1,m 2nd

Algorithm

In this subsection, we describe our algorithm. We build a function that takes as input a timed automaton A, a fixed start configuration ( , v), an interval sampling step s I = 1/p and a delay sampling step s δ = 1/(p • q) and returns a trace of a run, such that its permissiveness is an approximate value of permissiveness function (for A) from ( , v). We decompose our algorithm into five functions: Two functions, named moves_sampling and delay_sampling, generate the set of possibles p-moves and delays.

One function, named compare_trace, compares two traces by their permissiveness.

Two mutually recursive functions, named backtrack_interval and backtrack_delay, explore the possible intervals and delays.

Sampling the set of possible intervals

For each available action a, let us denote I a the set of all possible intervals. We cannot explore all the intervals of I a3 . Indeed, this set contains, in general, an infinite number of possible intervals. In practice, we look at a finite subset S f,a ⊆ I a .

To do so, we consider the greatest possible interval the player can propose, defined as follows:

I max (a) := [α, β] .
Let us consider a sampling step s I . The set of sub-intervals we then use is denoted S f,a and is defined as follows:

S f,a = [α, β] ∪ {[α , β ] | ∃k α , k β ∈ N, α = α + k α • s I , β = α + k β • s I , α ≤ β ≤ β}
The pseudo-code of the sampling of such p-moves is described in Algorithm 2.

Backtracking on the delays

The role of the function backtrack_delay is to consider all the delays in a sampled set of delays. It explores those delays to find one delay that minimises the permissiveness among the selected choices of delays. We present the backtrack_delay in Algorithm 4

Main algorithm

Our final algorithm computes an optimal p-run and its approximate permissiveness. It simply applies the function backtrack_interval for the automaton A, the initial configuration ( , v), the interval sampling step s I , the delay sampling step s δ and the trace

T c = [ ].
It makes our first backtrack over the intervals begin, then it calls the backtrack of the delays ... until it founds the approximate optimal trace.

The choice to initialise the trace to [ ] can be explained easily: if the initial location is in the set of goal locations, the returned trace is an empty list, which permissiveness values +∞ by convention.

Let us now discuss the concrete implementation of our algorithm. Our algorithm has been implemented as an Object-Oriented program in Python 3.8. It is decomposed into four main modules that we detail in the following subsections, using simplified UML class diagrams:

A TimedAutomaton class for the implementation of timed automata.

A data structure for p-moves, proposed by the player, and the delays that the opponent chooses.

A Trace class that stores the trace informations.

A Backtracking class that implements the backtracking algorithm.

More detailed UML graphs for the methods are presented in the Appendix A.1.

Timed automata, guards and intervals

Timed automata

The class TimedAutomaton, Guard and Intervals are illustrated in the UML graph on Figure 6.2.

Timed automata are modelled by the class TimedAutomaton, sub-classed from directed graphs of 'networkx' library. It also uses the Edge class. The TimedAutomaton class handles the logic of timed automata, such as initial and goal locations, transitions and associated guards and the dimension of the clocks space. This class can be exported and imported as a JSON file for easier tests and use. This implementation allows more general timed automata than single action timed automata, but requires them to be deterministic.

Guards

The guards used in this algorithm are classical guards. The implementation of timed automata relies on the Guard class to deal with the guard constraints of its transitions. In particular, the Guard class provides a method that computes, for each action, the maximal enabled interval, required in the backtracking algorithm when sampling the intervals. It also provides a method that verifies, for a given valuation v and delay δ, if v + δ satisfies the guard.

Intervals

These intervals are built by giving the lower and upper bounds as rational or infinite numbers, to avoid floating point imprecision. The type of interval is indicating if the interval is open, closed or half-open (at right or left). For the same reason of avoiding imprecision, the values of the clocks can only be integers, rationals or the infinite.

P-moves and opponent strategy P-move

The P-Move class, illustrated in the UML graph in Figure 6.3a, represents the proposed intervals and actions. The P-Move class can decompose the interval into sub-intervals to associate each sub-interval to a unique next location in the case of non single action timed automata.

The role of the P-Move class is to provide methods to compute the next configuration, given a p-move, an opponent strategy and an initial configuration.

Opponent strategies

We implemented several opponent strategies as functions that given a p-move and possibly a step sampling returns a list of enabled moves 4 . Indeed we provided two main methods. The first one, used for linear timed automata, chooses the bound of the intervals as the best delays and therefore returns two moves. In other cases, the best strategy of the opponent is not known so we provide a sampling of all possible delays and the strategy of the opponent returns a finite list of moves to test. Again, to avoid floating point imprecision, the step sampling should be rational.

Backtracking

The Backtracking class, illustrated in the UML class diagram in Figure 6.4, is used to implement our main algorithm of backtracking. An object of the class Backtracking stores the timed automaton, the starting configuration and the samplings steps to apply to the player and the opponent strategies. The attribute strategy_opponent is a function that takes as input a p-move proposed by the player and a sampling delay step, step and returns a list of moves.

The Backtracking class provides the methods that implement backtrack_delay and backtrack_interval, the backtrack on delays and the backtrack on the intervals, and the main method that can apply the main algorithm of backtracking on any object of the class Backtracking.

Cycles handling

In the symbolic algorithms we have no proof that the sequence of suboptimal permissive functions tends to the permissiveness function in a finite number of steps. In our numeric approach, we have no guarantee either that our algorithm will finish in a finite number of step if our timed automaton contains cycles. What we do in our implementation, to have approximates results, is to bound the number of time loops that can be taken. To do that, we can bound the number of loops taken and the maximal length of the trace in the parameters of the backtracking methods.

Our aim is to propose different increasing bounds and observe if the result seems to stabilise or not when the number of rounds grows. The goal could be to find a property, as a pattern where the number of needed rounds to stabilise seems to be linked on the values of constraints, or a counter-example where the timed automaton seems to have a sequence of suboptimal permissive functions that does not reach its limit. Then if a counter-example is found, it could be formally studied.

Optimisations on the sampling of intervals

When sampling all possible p-moves, the result is ordered with respect to the decreasing size of the intervals. Therefore we begin by proposing the largest possible interval. Then, when we choose one of the intervals, we check if its size is smaller than the permissiveness of our current best trace. If it is, it is useless to explore this trace because it will not lead to a better permissiveness. We then stop the exploration. Having sorted the intervals by size allows us to save computation time by avoiding unnecessary explorations.

Optimisations on the sampling of delays

We implement an optimisation when sampling the delays. If we found a delay that leads to a trace that has a negative permissiveness value, we choose this delay. Indeed, that means that if the opponent chooses this delay, we reach a successor from which a target location cannot be reached. Therefore there is no reason to explore more delays for the opponent.

Worst-case complexity

Let us compute an upper bound of the complexity of our algorithm that computes an trace that, approximately, optimises the permissiveness.

Let us consider a timed automaton A and the largest interval I max that can be proposed in A. We count the number of intervals and delays explored at each step of the algorithm. Let us suppose that we use the sampling interval step s I and the sampling delay step s δ .

Computing the greatest interval

Before sampling the set of all possible intervals, we have to compute the greatest interval that can be proposed. Let us consider a classical guard, computing the greatest interval can be computed in O (n) where n is the number of clocks.

Exploring the intervals

For each transition, we explore at most

|I max | s I 2 intervals.

Exploring the delays

For each interval I that is proposed, we explore at most |I| s δ delays. We can bound this quantity as follows:

|I| s δ ≤ |I max | s δ .
Let us remark that for linear timed automata, we do not sample the delays with a sampling step but we just consider the bounds of the proposed interval.

Final worst-case complexity of the algorithm

To bound the size of the largest interval with a parameter of the timed automaton A, we can consider the largest constant, defined in Definition 2.6, denoted M (A).

Experimental results

In this subsection, we provide the runtime results we had by executing our algorithm on examples of timed automata given in this thesis and with a linear timed automaton with n transitions. All the experiments were run in a computer with the following specifications: Intel i7-9700 CPU at 3.00 GHz, 8Go of RAM, under Ubuntu 20.04. For the sake of simplification, we chose the same interval sampling step 1/p and delay sampling step 1/p, that we denote here s.

When possible, we compute the error ε = Perm ε -Perm of our algorithm, where Perm is the exact permissiveness and Perm ε is the approximate permissiveness computed by our numerical algorithm.

We run our algorithm on three examples, two are linear timed automata and one is an acyclic timed automaton. The first one is a simple linear timed automaton where we can vary the number of transition, in order to observe the runtime for a large number of transitions. An example for two transitions is illustrated in Figure 2.8. The second one is a linear timed automaton studied in this thesis, represented in Figure 2. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF]. We wanted to study the precision of our algorithm and its runtime with a timed automaton with reset. The third and last one is an acyclic timed automaton, represented in Figure 5. 5, where we computed the permissiveness in Figure 5. 6. We chose to study an acyclic timed automaton to provide some precision results when both strategies (player and opponent) were not necessarily optimal.

A first timed automaton with identical guards

The first timed automaton we use is a generalisation of the following timed automaton, studied in Chapter 2, illustrated in Figure 2.8 that we show again below for convenience.

We generalise this timed automaton with m transitions, by taking a timed automaton with a starting location 0 , a target location f , and m transitions, that contain the guard Configuration used: ( 0 , (0, 0)) , exact permissiveness: 1 m Figure 6.5 -Experimental results (Numeric approach) for the generalisation of the timed automaton of Figure 2.8 with m transitions.

0 1 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 a 0 0 ≤ x ≤ 1 0 ≤ y ≤ 1 a 1
the larger the number of transitions, the faster the algorithm grows exponentially with p, the inverse of the sampling step.

In terms of precision, we observe that on our examples, for all six timed automata tested, the algorithm returns an exact value of the permissiveness when the sampling step is a divisor of the permissiveness value. The error is always negative, so it means the algorithm made an under-approximation of the permissiveness. For example, for the two-transition timed automaton (m = 2), the permissiveness in ( 0 , (0, 0)) is 1/2. It can be seen that the algorithm returns an exact value for 1/2, 1/4 and 1/6 (and only for these values). We can also note that the error decreases on these examples when the sampling step decreases.

We will observe whether we find these same observations for the other following examples: an exponential runtime with respect to the precision, and an exact precision when calculated with a sampling step that divides the permissiveness.

Two timed automata with resets

The timed automaton we use in our next runtime examples was studied in Chapter 2. We represent it in Figure 2.10 that we re-show below for convenience. We run this example for the configuration ( 0 , (0, 0)), on which the permissiveness function values 1/2. We run this examples for the sampling step that ranges from 1 to 1/200 and present the runtime and the error results in graphs in Figures 6.6a and 6.6b. The same results as in the previous example can be observed: the runtime grows when the sampling step decreases and the error, always negative, decreases with respect to the sampling step. The error is cancelled out for the sampling steps 1 2 • q where 1 ≤ q ≤ 100. The sign of the error can be explained by the fact that the opponent strategy is optimal for linear timed automata. The only non-optimal strategy is the one of the player, whose goal is to maximise permissiveness. It encourages us to study conditions to find a sampling step that give an accurate result, when the sampling step is not accurate. In the next example, we run a non-linear timed automaton. Thus the strategies of the opponent and the player are not optimal.

0 1 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 y := 0 a 0 1 ≤ x ≤ 2 0 ≤ y ≤ 1 a 1

An acyclic example

Our last example is an acyclic timed automaton, represented in Figure 5. 5. We computed its permissiveness and represented it in Figure 5. 6. Configuration used: ( 0 , (0, 0)) , exact permissiveness: 1 2 The delays proposed by the opponent are sampled in acyclic timed automata. The error in our example is still negative here and seems to tend to 0. The runtime is higher than in linear cases. This is expected as there are more possible paths and therefore more intervals and delays to sample, and therefore more p-runs to explore and compare. As in previous example, when the step sampling is a divisor of the exact permissiveness, here 1/40, the computation of the approximate permissiveness is accurate.

To conclude these examples among all the examples we run, we can observe common behaviours:

The runtime results are represented with scatter plots. The line that could be deduced forms exponential function, which corresponds to the theoretical complexity we computed.

The precision results are represented with scatter plots too. The resulting curves have the same shape, with oscillations, around a value which seems to converge towards 0, whose amplitude decreases. In our examples and among the sampling steps tested, the exact permissiveness is reached for the sampling steps that divide the exact value of the permissiveness.

Let us now look at what can be concluded from the accuracy results and compare them with the theoretical aspects of the algorithm.

Precision of our algorithm

The computed permissiveness in our algorithm is approximated because we do not necessarily compute the optimal strategy. Indeed, we do not explore all the possible intervals and all the possible delays, but only a finite number of them.

An important issue is whether we compute an over-approximation (an approximation which is higher than the exact permissiveness) or an under-approximation (an approximation which is smaller than the exact permissiveness). In the case of linear timed automata, we have an optimal strategy for the choice of the delays and this approximation only affects the choice of the intervals. The permissiveness of the p-run we compute is therefore smaller than the permissiveness and our algorithm then provides an under-approximation of the permissiveness function.

In the general case, the permissiveness of the p-run we compute can be smaller or greater, because the strategy of the player and of the opponent may not be optimal. Indeed, giving a non-optimal strategy of the player (and an optimal one for the opponent) provide an under-approximation, and giving a non-optimal strategy of the opponent (and an optimal one for the player) provides an over-approximation. If both are nonoptimal, we do not know if the computed permissiveness is under or over-approximated. At present, all experimental results give an under-approximation of the permissiveness, but more benchmarks could give us examples where the permissiveness is over-approximated.

We have not yet been able to study the stability of our algorithm in order to control its precision. Nevertheless, the experimental results give us some possibilities to explore. 1. The value where the error curve is cancelled out in our examples suggests that the sampling step to provide an accurate result could be a divisor of the exact value of the permissiveness (with a possible shift). Indeed, we sample the interval with a sampling step s I . Let us recall the set of the sampled intervals.

S f,a = [α, β] ∪ {[α , β ] | ∃k α , k β ∈ N, α = α + k α • s I , β = α + k β • s I , α ≤ β ≤ β}
The size of these intervals are either β -α, where [α, β] is the greatest possible interval, or a multiple of the sampling step s I . If the interval [α, β] is not the optimal interval, in order to provide an interval of the size of the permissiveness, the sampling step has to divide the permissiveness.

2. In the experimental results of the previous paragraph, the error graph oscillates around 0, and the amplitude of these oscillations decreases. For linear timed automata, as it is an under-approximation, a good practice could be to compute the approximate permissiveness for several decreasing sampling step and take the upperbound, in order to get a more accurate permissiveness. It can be explained for linear timed automata. If the sampling step s is a divisor of s, we explore more intervals than with s, but we explore all the intervals we explore when choosing s. It is also observed in one of our examples of acyclic timed automata (see 6.7b). Nevertheless we are not able to explain it yet, as the choice of the delay is approximated too.

To conclude, our experimental results suggest, in order to decrease the error ε, to fix an strictly positive integer p and run the examples for a finite list of sampling steps of the form 1 q • p where q is a strictly positive integer.

In order to provide formal results, we could adapt some theoretical results of the permissiveness function to the permissiveness function of p-runs and strategies. In Chapter 4, we proved that the permissiveness function is 2-Lipschitz on Win . We cannot apply them directly as we do not compute the permissiveness, but an approximation of it, but we could try to extend this result to the permissiveness of p-runs. Another idea we could explore is to bound the error knowing that the coefficients of the affine functions of the permissiveness function, a piecewise-affine function, are constant.

Studying the precision of our algorithm is an important future work, as it could bound the error made by computing the approximation of the permissiveness.

Logging interface

Finally, in order to provide a graphical view of the trace, a logging interface has been implemented. It aims to visualise exploration and ease the understanding of the choices of the players and opponent. We present the logger interface when running the backtracking algorithm for the timed automaton presented in Figure 2.10 for the initial configuration ( 0 , (0, 0)) and the sampling step s = 1 2 . The aim of the logger is to show the traces of the paths that have been explored by the backtracking algorithms. The logger interface allows to reveal traces that interested us.

The logger is presented as a table, containing sub-tables in each lines. The button 'Hide filtered out' hides or reveals the non-taken paths that were avoided thanks to the optimisations on intervals and delays.

The main table, presented in Figure 6.8a, represents the logger when we do not reveal any sub-tables. It represents the first terms of all traces, with additional informations. The first lines indicates, from left to right, the current location (0) 5 , valuations ((0, 0)) and the permissiveness of the current best trace (+∞). It also indicates all the possibles p-moves ("a", [0, 1]) , "a", 0, 1 2 and "a", 1 2 , 1 and the final permissiveness we will obtain if we choose this interval: here respectively 0, 0 and 1 2 .

In the Figure 6.8b, we reveal the first sub-tables when choosing the first proposed p-move, ("a", [0, 1]). The first sub-table revealed is a sub-table that lists the proposed delays in the first row (0 and 1) and the future permissivenesses if we choose each delays in the second rows: respectively 0 and 1. 'min delay = 0' indicates that the trace that minimises the permissiveness for the delays has a permissiveness that values 0.

In the Figure 6.8c, we reveal the sub-table that is contained in the first line (0, | 0). It reveal a table that gives the informations, from left to right, of the current location (1), valuation ( 0 1 , 0 ), and the permissiveness of our current best trace (here 1, as we have chosen the interval [0, 1]). The only line of this sub-table contains again the possible p-move, here ("b", [1,1]) and the value of the permissiveness when choosing such interval (here 0). The 'max interval = 0' indicates the permissiveness of the trace that maximises the permissiveness among all the possible p-moves.

We can continue in this logger to reveal sub-tables to go further in the trace, until the goal location is reached (which is indicated). Non-taken p-moves are not shown, unless we click on 'Hide filtered out '. implementations, provided in the github page merce-fra/ECL-Symbolic-Implementation, in Python 3.8, using the pplpy Python Binding to the C++ Parma Polyhedra Library. This implementation currently covers the cases of linear timed automata with polyhedral guards.

In this section, we explain our choices of implementation, the results we obtain and the future works that could be done to improve our implementation. We organised this section as follows:

1. First, we present Parma Polyhedra Library in Subsection 6.2.1.

2. Secondly, we recall the main steps of the algorithm in Subsection 6.2.2.

3. Thirdly, we discuss in Subsection 6.2.3 the technical aspects and the problems we had to solve to complete this implementation. 4. Fourthly and finally, we present in Subsection 6.2.4 some results and compare them to the forward approach presented in Section 6.1.

Parma Polyhedra Library

Parma Polyhedra Library6 is a C++ library enabling the manipulation of polyhedra and linear expressions with coefficients in Z. We use this library to represent the piecewise affine functions and the affine functions in our implementation. Indeed this library enables us to manipulate and represent affine functions and polyhedra with the respective pplpy classes Linear Expression and Polyhedron. Polyhedron class enables to represent a polyhedron with generators or linear constraints, themselves represented with the class Linear Expression. We use the representation with linear constraints. It also provides many operations with polyhedra. The main operations we use are checking membership to a polyhedron, the emptyness of a polyhedron and whether a polyhedron is included in another polyhedron, adding constraints to a polyhedron and computing intersections (with other polyhedra). The comparison of piecewise affine functions.

h β h α S (hα,h β ) (a) Step 1. h β h α v I v α I v β (b) Step 2.
As for the numerical implementation, all UML graphs are simplified and more detailed UML graphs are presented in the Appendix A. 2. Let us detail these aspects in the following subsections. A final subsection will explain how to merge more than two polyhedra. This method is not yet implemented.

The representation of timed automata

Timed automata objects are used in our implementation to store the information about the timed automaton we will explore when applying our algorithm. The representation of the TimedAutomaton class does not differ from the one of the numeric implementation presented in Subsection 6. 1.2, except the guards are polyhedral guards. Thanks to the pplpy library, the data structure of timed automata is simplified as we can see in the UML graph of TimedAutomaton class in Figure 6.9. Indeed, instead of implementing intervals and constraints, a guard is just defined as a polyhedron. As in the numeric implementation, we provide a JSON format to write the timed automaton in a more readable and convenient way.

The representation of piecewise affine functions

Piecewise affine functions are used in almost every step of our algorithm: the permissiveness function and every function of the sequence of suboptimal permissive functions are piecewise affine functions over R |C| + , the bounds to the intervals of enabled delays I v α and I v β are piecewise affine functions, etc. We represent piecewise affine functions with the class Spline. Piecewise affine functions used here are continuous so we can use tiling of polyhedra to represent them. We represent them as a list of pairs of affine functions and cells of the form (f, P). The affine function f is defined over the polyhedron P and is built with the class SubSpline. We represent these classes in the UML graph in Figure 6. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF]. In our model, affine function can have infinite coefficients, therefore these functions can have two forms:

Either some coefficients of the affine function are infinite, then the affine function is implemented with the class InfiniteExpression. This class represents functions that are either -∞ or +∞. The sign of the function is decided with the boolean is_positive.

Or the coefficients are rational and finite. We implement these functions with the class RationalLinearExpression by associating a pplpy linear expression l with a divisor d. Indeed, the Linear_Expression class of pplpy only covers integer coefficients. Our implementation simplifies the coefficients of l and the divisor used d such that d is the least common multiple of all denominators of the rational coefficients of the affine function. This simplification is done in order to have a unique representation, and therefore compare easily two rational linear expressions.

These two classes are linked through an abstract class that we will not detail in Figure 6.10, for the sake of simplification. We implemented an optimisation to decrease the number of polyhedra used to representing the tiling of polyhedra of piecewise affine functions. Indeed, the complexity of our algorithm depends on this number of cells of the tiling of polyhedra of the permissiveness functions. The optimisation consists in choosing a fixed value of affine functions that we will not represent. Our choice was to not represent affine functions that are -∞. Indeed, the set of valuations such that the permissiveness is -∞ is not necessarily convex (see Figure 6.11). To represent this set as polyhedra, we need as least three polyhedra (see Figure 6.12a). The piecewise affine function of Figure 6.11 is therefore implemented as the one in Figure 6.12b. This optimisation has to be taken into account, for instance, when computing the maximum or the minimum of several piecewise affine functions, as explained in the next subsection. x y

1 2 1 2 -∞ -∞ -∞ f 0 f 1 f 2 (a)

Minimising and maximising several piecewise affine functions

For the sake of simplification, we will explain here how we compute the maximum of two piecewise affine functions. Considering more than two functions, or the minimum of them can be extended trivially through pairwise comparison. Let us consider two piecewise affine functions F and G, defined over R |C| + . Indeed in our context the piecewise affine functions are defined over that set. Our goal is to compute max (F, G) over R |C| + . Minimisation and maximisation of piecewise affine functions are used in several steps of our implementation:

1. When computing the bounds of the intervals of enabled delays I v α and I v β , these bounds are maximum and minimum of piecewise affine functions. 2. When implementing the optimisation results of Tables ??, 5.1, 5.2, 5.3, 5.4 and 5.5 presented in Section 5.3.

3.

After computing an optimal interval to propose for each couple of cells (h α , h β ), we compute the minimum of three affine functions, that are the size of the interval, and the future permissiveness of the successors, when choosing for the delay the bounds of the interval. The result is then a piecewise affine function. In order to compute the permissiveness function, we have to compute the maximum of these piecewise affine functions for all cells (h α , h β ). 4. When considering acyclic timed automata, several successors may have to be considered. We should compute the permissiveness functions of the successors and compute the maximum of all these permissiveness functions to choose the transition to choose. This application is an ongoing work.

Let us explain the issues of implementing these two methods. First, let us pick an example of two piecewise affine functions f and g described in Figure 6.13a and 6.13b. Let us denote respectively the couple of cell-affine functions of the piecewise affine functions f and g by ((P 0 , f 0 ) , (P 1 , f 1 ) , (P 2 , f 2 )) and ((P 3 , g 0 ) , (P 4 , g 1 )). We recall that the cells where the affine function is -∞ are not represented.

At first sight, one might want to look at the intersection of each cells, and split each cells whether the first affine function is greater then the second one. More formally: 1. For each piece P i among P := [P 0 , • • • , P 5 ], we look if there exists another polyhedron P j ∈ P\ {P i } such that P i ∩ P j = ∅.

x y 2. If the intersection of two polyhedra P i and P j is not empty, consider the associate affine functions f and g and split the intersection of P i ∩ P j with the linear constraint f ≥ g and f ≤ g .

1 2 1 2 f 1 f 2 f 3 (a) Function f where f 0 (x, y) = 2 -x, f 1 (x, y) = 1 -y and f 2 (x, y) = x -y. x y 1 2 1 2 g 0 g 1 (b) Function g where g 0 (x, y) = 1 -x 2 , g 1 (x, y) = 1 -y.
If we applied this procedure, we would end up with a wrong result. Indeed, if the first function intersects zones where the other function is -∞, their intersection will not be taken into account. For instance, we represented in Figure 6.15a the result if not taking these cells into account.

We have a wrong result for two reasons. First, we did not take into account the cells where the affine function is -∞. That can be solved by considering that if a cell does not intersect another cell, it is because it intersects a cell where the affine function is -∞. Secondly, the tiling of polyhedra is not the same therefore, the cell associated to g 0 will intersect another cell, the one associated with f 3 and we will only compare it over P 3 ∩ P 0 .

To tackle this issue, we combine the two tiling of polyhedra of each piecewise affine function, in order to have the same tiling of polyhedra in both piecewise affine functions. For instance the functions of Figure 6.13 will be represented by the functions described in Figure 6.14a and 6.14b.

Then, when considering the same tiling of polyhedra, we can proceed as follows:

If two cells intersect, we consider their associated affine functions, for example f 3 and g 0 and we split the intersections of the cells into two cells by adding a linear constraint. For the first one we add the constraint f 3 ≥ g 0 and associate this cell to the affine function f 3 . For the second one we add the constraint g 0 ≥ f 3 and associate this cell to the affine function g 0 .

If a cell does not intersect any cell, we directly add it with its associated affine function. Indeed it means that this cell intersects a cell associated with an affine function that is -∞. This solution over-tiles the cells of each piecewise affine function. Thus it may increase the number of cells. Let us consider the previous examples of Figure 6.13. The maximum max (f, g) is a piecewise-affine function described in Figure 6.15b. We can see that the polyhedron associated if g 0 could be merged. Merging as much polyhedra as possible could be a great optimisation to speed up our implementation.

Comparing several piecewise affine functions

As we have seen in the previous subsection, the representation in terms of list of tuples of polyhedra and affine functions is not unique in general. The piecewise affine functions in Figure 6.13b and 6.14b are the same, but their tiling of polyhedra are not the same.

Having a unique representation would be useful to easily check in unit tests if the obtained piecewise affine function is the one we expected. On top of that, having a unique representation would help extending the implementation for acyclic timed automata by checking is the sequence of suboptimal permissive functions has reached its fix point, by checking equalities between two piecewise affine functions. (a) Wrong result when applying the naive procedure.

x y

1 2 1 2 g 1 g 0 g 0 f 0 f 1 f 2 (b)
Correct result with over-tiling.

Figure 6.15 -Maximisation of the two piecewise affine functions f and g of Figure 6.13: wrong method (Figure 6.15a) and correct method with over-tiling (Figure 6.15b).

Let us remark that the current method that checks equalities between two piecewise affine functions is sensible to the tiling: for two piecewise affine functions to be checked as equal, they need to have the same tiling of polyhedra. At first sight, to check the equality between two piecewise affine functions, one would be tempted to look at the pairs whose affine functions are equal, and compute the union of the associated polyhedra together. However, the union of several polyhedra is not necessarily a polyhedron.

[BFT01] provides an algorithm for computing the convex hull of polyhedra and for checking that the union of two polyhedra is indeed convex and therefore corresponds to their convex hull. However, it does not provide an algorithm for more than two polyhedra. This problem is not trivial and one cannot apply the algorithm of [BFT01] pairwise. Consider a simple example in Figure 6.16, where we divide the space into 4 square polyhedra, and associate them with the same affine functions. Depending on which polyhedra we start with, their union will not correspond to their convex hull. If we begin with the two left polyhedra, when these are merged, if we then check if the union with any right polyhedra is a polyhedron, the answer is no. We did not tackle the problem of checking if the union of n ≥ 3 polyhedra is a polyhedron.

Checking efficiently the equalities between two piecewise affine functions is an ongoing future work. A first possibility given two piecewise affine functions (P i , f i ) and (Q i , g i ) would be: 1. To compute a representation taking into account the two tilings as in Figure 6.14 such that the two functions have the same polyhedra partition.

2.

Then, to check if the two resulting over-cut piecewise affine functions are equal.

We could also try other methods, such as comparing the values of the permissiveness function on edges of each polyhedra.

Merging (some) polyhedra

As explained earlier, one way to speed up our computation is to reduce the number of cells. Indeed, the complexity of the algorithm grows with the number of polyhedra used to represent our piecewise affine functions.

The first optimisation described above consisted of removing the polyhedra associated with the -∞ function. The second improvement would be to merge polyhedra associated with the same affine functions and whose union is a polyhedron. As stated in the previous subsection, if there are only two polyhedra, the algorithm is presented in [START_REF] Bemporad | Convexity recognition of the union of polyhedra[END_REF] and can be performed in polynomial time. If there are more than two polyhedra, we could not provide an algorithm. However, we can propose a heuristic to solve this issue, but does not guarantee to systematically succeed in merging our polyhedra. This heuristic would first list all the polyhedra that are assigned with the same affine function and then compute, for each list of polyhedra, the convex hull of these polyhedra. Then, the resulting piecewise affine function is the function that associates the convex hull to the associated affine functions. We compare this function to the original one with the procedure described previously. If the two functions are equals, it means that for each affine function the union of their associated polyhedra formed a polyhedron. If not, there exists a set of polyhedra whose union was not a polyhedra and we keep the overcut representation of the function.

We can compute the convex hull and compare immediately the result for each associated function. We should evaluate the respective performance of the two procedures because comparing piecewise affine functions can be costly.

In the next section, we present our experimental results. First we present the results of our graphical tool, written in Python, that provides a graphical representation of the results of our algorithm. It encourages us to use the previous procedure to merge polyhedra as for each affine function the union of their associated polyhedra forms a polyhedron. Secondly, we present our runtime results.

Experimental results

In this section, we present our results. All the experiments were run in a computer with the following specifications: Intel i7-9700 CPU at 3.00 GHz, 8Go of RAM, under Ubuntu 20.04.

First we present in Subsection 6.2.4.1 the permissiveness function that our implementation computes and compare the over-tiling to the theoretical and optimized computation. Secondly, we present in Subsection 6.2.4.2 the runtime results and compare some to the one obtained in the numeric implementation.

Qualitative results

We implemented a Python tool to provide a graphical view (in .tex format) of our obtained permissiveness function for two-clocks timed automata with only bounded cells. We restricted to two-clocks timed automata to stay in 2D-representation and we can only managed bounded polyhedra yet because we use the coordinate of the edge of polyhedra to represent them, therefore unbounded polyhedra cannot be tackled yet, as they are represented with point and rays in pplpy.

The examples we present in this section are the permissiveness of the timed automata of Figure 2.8, 2.10, 5.3, that we re-show below for convenience.

Our graphical tool provides a picture and a table for each permissiveness function. The picture represents the cells of the piecewise affine function and the bottom table links the cells to an affine function. Let us remark that, as before in the implementation, we do not represent the cells associated with a function -∞. For instance, in Figure 6.17a, the

0 1 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 a 0 0 ≤ x ≤ 1 0 ≤ y ≤ 1 a 1 Figure 2.
8 -A timed automaton with two identical transitions presented in Subsection 2.2.2.

0 1 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 y := 0 a 0 1 ≤ x ≤ 2 0 ≤ y ≤ 1 a 1 Figure 2.
10 -A timed automaton with a reset presented in Subsection 2.2.2. permissiveness function is defined as follows:

0 1 f 0 ≤ y ≤ 1 y := 0 1 ≤ x ≤ 2 0 ≤ y ≤ 1
[0, 1] × [0, 1] → R + (x, y) → min (1 -x, 1 -y)
This permissiveness function is represented with 2 cells. We represent in the following Figures 6.17, 6.18 We can compare these results in Figure 6.17a, 6.18 and 6.19 with the theoretical permissiveness. The obtained permissiveness functions are accurate and we can observe an over-tiling in Figure 6.18b and 6.19b. For each associated affine function, we can observe that the union of the cells corresponds to the convex hull of these cells. These results encourage us to study ways to reduce the over-tiling of our algorithm and of our implementation.

Runtime results for timed automaton studied in this thesis

Here we present in Table 6.1 the runtime results of the computation of the permissiveness function for several examples. We restricted in the previous section to simple examples, in order to keep the graphic representation readable. In this section, we will provide the runtime for the examples of the previous section and for additional timed automata (more transitions, three-clocks...). First, let us present the runtime for the examples of the previous section and for the additional timed automata presented in Figure 6.20a, 6.20b and 6.20c. Let us compare

(-x + 2) /2 0, • • • , 5 (-y + 1) /1 6, • • • , 15 (x -y + 1) /2 20, • • • , 24 (2) /3 16, • • • , 19 (
0 1 2 f 0 ≤ x ≤ 1 a 0 0 ≤ y ≤ 1 a 1 , y := 0 1 ≤ x ≤ 2 0 ≤ y ≤ 1 a 2
(a) A three transitions timed automaton. the runtime of the symbolic implementation with the one of the numeric implementation, for two interval sampling steps: 1 2 and 1 15 in Tables 6.1 and 6.2. We can observe that the runtime grows with respect to the number of cells. The symbolic runtime is higher than the numeric ones, except for our examples with three clocks and four transitions, for a step sampling equal to 1 15 . As for the numerical implementation, we tested our implementation on an example which allows us to vary the number of transitions. As a reminder, this is an m transition automaton, linear, with two clocks, whose guards are identical: no reset and the constraints are always 0 ≤ x ≤ 1 ∧ 0 ≤ y ≤ 1. The result is presented in Figure 6.21a. This example has the particularity to be always represented with two cells, as in Figure 6.17. When considering m transitions, the result is a slightly modified result where the tiling of polyhedra stays the same and the associated function becomes (x, y) → 1 -x m and (x, y) → 1 -y m . In the obtained results in Figure 6.21a, we represented the runtime in seconds on the y axis and the number of transition on the x axis. should be multiplied by 10 5 as indicated in bottom left. The scatter plot almost forms a straight line. Its slope has an order of magnitude of 10 -6 , which is an encouraging result compared to the worst case complexity we computed in Section 5.1 and to the numeric implementation runtime result, that we recall in Figure 6.21b. Nevertheless, this is a very specific case where the number of cells and the number of inequalities defining the polyhedra remain constant as the number of transitions increases. This result encourages us to control the number of cells when computing the permissiveness function with a symbolic algorithm.

0 1 2 3 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 0 ≤ z ≤ 1 a 0 0 ≤ x ≤ 1 0 ≤ y ≤ 1 0 ≤ z ≤ 1 a 1 , y := 0 0 ≤ x ≤ 1 0 ≤ y ≤ 1 0 ≤ z ≤ 1 a 2 0 ≤ x ≤ 1 0 ≤ y ≤ 1 0 ≤ z ≤ 1 a 3 , z := 0 (b) A three clock timed automaton. 0 1 2 3 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 0 ≤ z ≤ 1 a 0 , z := 0 0 ≤ x ≤ 1 0 ≤ y ≤ 1 0 ≤ z ≤ 1 a 1 , y := 0 0 ≤ x ≤ 1 0 ≤ y ≤ 1 0 ≤ z ≤ 1 a 2 0 ≤ x ≤ 1 0 ≤ y ≤ 1 0 ≤ z ≤ 1 a 3 (

Conclusion and future work

We have presented the symbolic implementation, in the framework of linear timed automata, of the algorithm proposed in Chapter 5. The runtime results are high, compared to the numeric implementation, because of the over-tiling. We saw in an example that when the number of cells is controlled, the runtime of our symbolic implementation are very encouraging, despite the theoretical upper bound of our complexity computed in Section 5.

Furthermore, this implementation highlights the direction to take in order to reduce the complexity of our algorithms: reduce the number of polyhedra used to represent a piecewise affine function. Therefore, in the next chapter, Chapter 7, we will discuss a second approach to compute an approximate symbolic version of the permissiveness function, which controls both the number of cells and the precision obtained. However, the complexity will then be on the number of constraints used to represent polyhedra.

Regarding the feasible improvements on our implementation, the results that we provided confirm the presence of an over-tiling of the polyhedron partition. We propose several directions for future work to address this issue. First, we should extend this implementation to more general timed automata, as acyclic timed automata. We could also extend to timed automata with cycles, but we would have no guarantee that our algorithm terminates. Nevertheless it could be a direction to explore some examples to find heuristic about this class of timed automata we could not study formally in Chapter 5. Second, we could improve the efficiency of our implementation. We propose several ways to do it. Among these tracks, we propose an algorithm that allows to check the equality between two piecewise affine functions and an algorithm that allows to compute the union of polyhedra if we know that the result is a polyhedron. We also propose a heuristic, that is not guaranteed to always reduce the number of cells, but which computes the convex hull of polyhedra for a piecewise affine functions, considering only the polyhedra associated to the same affine functions. The goal of this heuristic is to reduce the number of cells by merging the one that could be merged and still be a polyhedron. To ensure we did compute exactly the union of polyhedra, this algorithm checks for equality with the original piecewise affine function.

The idea of our approach in this chapter is to compute permissiveness by thresholds: we compute a function that indicates, given a finite ordered number of thresholds, whether the permissiveness function lies between two thresholds, see Figure 7.2 for an example. We call this function the levelled permissiveness function. Our method to compute whether permissiveness is between two thresholds is to compute whether it is greater than a threshold. We call the function that computes whether a permissiveness function is greater than a threshold the binary permissiveness function. In this chapter, we present an algorithm to compute the binary and levelled permissiveness functions for linear timed automata.

This chapter is organised as follows:

First, we present the binary permissiveness and we propose an algorithm to compute this function in Section 7. 1.

Secondly, we present the levelled permissiveness and formally show how to compute it by computing the binary permissiveness in Section 7.2.

Binary permissiveness

In this section, we present the binary permissiveness function, which returns whether the permissiveness is greater than a fixed threshold. We first give a formal definition and examples in Subsection 7.1.1, then provide a sequence that computes iteratively this function in Subsection 7.1.2 and a Fourier-Motzkin-based algorithm that computes the binary permissiveness function in Subsection 7.1.3.

Definitions and examples

Let us start by defining the binary permissiveness function in Definition 7.1. Given a timed automaton A, this function returns 1 if the permissiveness of the configuration ( , v) is greater than a fixed threshold and 0 otherwise.

Definition 7.1: Binary permissiveness function

Let us consider a timed automaton A and a threshold p and ∈ {>, ≥}. The binary permissiveness function is denoted Bin p, and is defined as follows:

Bin p, : ( , v) →      1 if Perm ( , v) p 0 otherwise 216
Binary permissiveness function can only take two values, 0 or 1. An advantage is the ability to express this function in terms of sets instead of a function. We can reduce its representation to the set of valuations where the function is equal to 1, that we denote S (p, ) and define as follows:

S (p, ) := Bin -1 p, (1) .

Indeed, the set Bin -1 p, (0) can be deduced using only Bin -1 p, (1). This representation will be preferred in order to give a geometric point of view.

Remark 7.1.1 In the general case, we suppose that is ≥, as our algorithm and proof will not change using >. Unless otherwise stated, throughout the rest of the chapter we will always suppose that is ≥. The binary permissiveness Bin p,≥ will be denoted, by abuse, Bin p .

The goal of this section is to provide an algorithm to solve the following problem defined in Definition 7.2.

Definition 7.2: Binary-permissiveness problem

Given a timed automaton A, a threshold p ≥ 0 and an initial configuration ( 0 , v 0 ), the binary-permissiveness problem asks to compute Bin p ( 0 , v 0 ).

Let us represent in Figure 7.1 an example of binary permissiveness functions for several thresholds. We consider the timed automaton of Figure 2.10, studied in Chapter 2, that we show again below for the sake of convenience. Let us compare the permissiveness function and the binary permissiveness represented in Figure 7.1a. To represent the permissiveness function, we had to use three polyhedra, whereas only one is sufficient for the binary permissiveness function.

0 1 f 0 ≤ x ≤ 1 0 ≤ y ≤ 1 y := 0 a 0 1 ≤ x ≤ 2 0 ≤ y ≤ 1 a 1

Sequence of binary suboptimal permissive functions

As with the permissiveness function, the binary permissiveness function is not directly iterative. This is why we define a sequence of functions, called a sequence of binary func- tions, in definition 7.3, which will approximate this binary permissiveness function and tends to it.

Definition 7.3: Sequence of binary suboptimal permissive functions

Let A be an arbitrary timed automaton, p be a positive threshold, and an arbitrary location. The sequence of p-binary suboptimal permissive functions, denoted (Bin i,p ( , •)) i≥0 , is a sequence of functions that only take values 0 or 1 and is defined as follows:

For i = 0, For i > 0, if p-moves ( , v) = ∅, Bin i,p ( , v) = 0.

Bin i,p ( , v) =      1 if ∈ Q f 0 otherwise . For i > 0, if p-moves ( , v) = ∅,
As for the binary permissiveness function, we denote S i (p, ) := Bin i,p ( , •) -1 (1).

The Proposition 7.4 gives the link between the sequence of suboptimal permissive functions and the sequence of suboptimal binary permissive functions. It will be a very useful tool to extend some properties already proven in Section 4.2.

Proposition 7.4

Let A be an acyclic timed automaton, p be a threshold, ( , v) an arbitrary configuration and i ∈ N an integer. Bin i,p ( , v) = 1 if and only if P i ( , v) ≥ p.

Proof of Proposition 7. 4. Let us prove this proposition by a simple induction.

If i = 0, this case is trivial by definition. Let us now consider an integer i ∈ N and let us suppose that Bin i,p ( , v) = 1 if and only if P i ( , v) ≥ p. ⇒ Let us suppose that P i+1 ( , v) ≥ p, then there exits a p-move (I 0 , a 0 ) ∈ p-moves ( , v) such that |I 0 | ≥ p and for any delay δ ∈ I 0 :

P i (succ ( , v, δ, a 0 )) ≥ p. Bin i,p ( , v) = 1 if and only if there exists a permissive strategy with permissiveness larger than (or equal to) p that is winning from ( , v) within i steps.

The main consequences that can be deduced are: 1. lim i→+∞ Bin i,p ( , v), if it exists, has for limits Bin p ( , v).

2. This limits exists and is reached within d steps for acyclic timed automata.

The properties that cannot be adapted or extended are, of course, the continuity properties. Nevertheless, the Proposition 4.15 will help us proving a major property for linear timed automata. Indeed, as the permissiveness function and the sequence of suboptimal permissive functions are continuous and concave over Win for any location , we can easily prove in Proposition 7.5 that S i (p, ) forms a unique polyhedron when A is a linear timed automaton.

Proposition 7.5

Let A be a timed automaton, be an arbitrary location and p be a positive threshold. As P i ( , •) is a concave function, thanks to Proposition 4.15, if P i ( , v 1 ) ≥ p and P i ( , v 2 ) ≥ p, then:

P i ( , λv 1 + (1 -λ) v 2 ) ≥ p.
As a result v λ ∈ S i (p, ). Therefore, S i (p, ) is a convex polyhedron of R |C| + . As this sequence tends in a finite number of steps to the binary permissiveness, this result also holds for S (p, ).

Binary permissiveness algorithm

Let us now present an algorithm that computes the binary function sequence for linear automata. We will use the geometric point of view in order to compute this sequence of function. Indeed it will be sufficient to compute S i (p, ) for i = d .

Our algorithm, given a linear timed automaton A with n clocks, a location and its successor , a threshold p and S i-1 (p, ) (if i > 0), computes the set S i (p, ).

Computation for i = 0

The computation of S i (p, ) is trivial for i = 0 as it is sufficient to check whether belongs to the set of target locations.

Computation for i > 0

For i > 0, we will prove the following lemma that simplifies the expression of S i (p, ): convex polyhedron. Therefore, the smallest β that satisfies such conditions is α + p. We can then simplify S i (p, ) as follows: Thanks to Lemma 7.6, if ∈ Q f (if so, computing Bin i,p is trivial), it is sufficient to find an enabled p-move (α, α + p) such that v + α [C r ← 0] and v + α + p [C r ← 0] belong to S i-1 (p, ). To compute the valuations that satisfies these conditions, we use the Fourier-Motzkin algorithm in order to eliminate the variable α.

S i (p, ) =    v ∈ R n + | ∃α ≥ 0 s.t.
Let us first denote some notations:

Guards: Let g be the polyhedral guard between the location and defined by the following inequalities: With these notations, we can re-write S i (p, ) as the set of valuations v such that there exists α ≥ 0 that satisfies the following inequalities, enumerated in 1., 2., 3. and 4.:

ϕ k (v + α [C r ← 0]) = S k • α + ϕ k (v [C r ← 0]) ϕ k (v + α + p [C r ← 0]) = S k • α + ϕ k (v + p [C r ← 0])
In order to isolate α in these inequalities, we divide our inequalities by S (g) j or S k . Therefore we have to distinguish the cases where S We can eliminate α by writing for every j , k : A k ≤ B j and C ≥ 0. We obtain 2 (z g + z i ) + 4 (p g + p i ) (n g + n i ) inequalities. As a result, we can compute S i (p, ) with at most 2 (z g + z i ) + 4 (p g + p i ) (n g + n i ) inequalities.

Then, the binary permissiveness function can be computed by the Algorithm 5. As a result, the binary permissiveness can be computed in double-exponential time. We state the exact complexity in Theorem 7.7 Theorem 7.7

Let A be a linear timed automaton with n clocks, be a location and p be a threshold.

Let us denote c g the maximal number of inequalities defining any guard of A. In order to have a exact control of the precision, and to compute the set of winning configurations, we usually set p 0 to 0. An obvious intuition is that we can compute the levelled permissiveness by checking if the binary permissiveness of all the thresholds are equal to 0 or 1. We can directly link the binary and permissiveness function.

As with the binary permissiveness function, let us formally state the problem of computing the levelled permissiveness function in Definition 7.9.

Definition 7.9: Maximal-levelled-permissiveness problem Given a timed automaton A, a set of thresholds P and an initial configuration ( 0 , v 0 ), the maximal-levelled-permissiveness problem asks to compute Perm lvl,P ( 0 , v 0 ).

Thanks to the Algorithm 5 presented in Section 7. 1.3, we can conclude on the complexity of the problem stated in Definition 7.9 for linear timed automata: Theorem 7.10

Let A be a linear timed automaton with n clocks, be a location and P = (p i ) 0≤i≤m be a set of m + 1 thresholds. The maximal-levelled-permissiveness problem of Definition 7.9 can be solved in O (m + 1) • (4c g ) 2 d time where c g is the maximal number of inequalities defining any guards of A Proof of Theorem 7. [START_REF]1 An example of a 2-dimension piecewise affine function from[END_REF]. By definition, the three following statements hold: That gives us an immediate algorithm to compute the levelled permissiveness function thanks to the Algorithm 5 that computes the binary permissiveness functions. Indeed, for every threshold p, in a increasing order, we compute S (p, ) in order to compute the levelled permissiveness function.

Conclusion

In this chapter, we presented a new approach where we compute an approximate value of the permissiveness function with a more efficient algorithm than the symbolic one proposed in Chapter 5. We presented two algorithms, both symbolic (i.e. they compute the to study its runtime on several examples, we implemented this algorithm in Python for linear timed automata. The results we obtain were that our implementation suffers from over-tilling and the runtime can grow exponentially when dealing with more than two clocks.

To tackle these issues, we proposed two other approaches.

A forward approximate approach: numerical algorithm

Our second approach is a numeric approach, that numerically computes an approximate value of the permissiveness by sampling the intervals and delays. Our algorithm computes an approximate value of the permissiveness function of a timed automaton A in at This approach was implemented in Python and provided quite accurate results, where the error seems to decrease as the sampling step decreases. Nevertheless, its stability is not proven and we did not manage to bound the error made by computing the approximate value of the permissiveness.

Despite the error made by the algorithm, the strength of this forward numerical approach is that no a priori knowledge of the strategy of the player and the opponent is needed to run this algorithm. Therefore it can be an interesting tool to study robustness for other models of timed automata.

A symbolic approximate approach: levelled algorithm

Our third approach is a symbolic one. Our goal was to reduce the number of cells used to represent our functions, as the complexity of the symbolic computation depends on the number of cells that represent the permissiveness functions.

We presented two functions that give an approximate value of the permissiveness function. The first one, the binary permissiveness function, checks if the permissiveness function is greater than a fixed threshold. The levelled permissiveness is a step function that partitions R + into a partition of m + 1 left-closed right-open intervals ([s i , s i+1 [) 0≤i≤m

with s m+1 = +∞, and takes the value s i when the permissiveness function takes values in the interval [s i , s i+1 [. The main advantage of levelled permissiveness is to provide an approximate symbolic value of the permissiveness with a controlled precision.

We give an algorithm to compute the binary and the levelled permissiveness functions for linear timed automata and show that it can be computed in time respectively at most O (4c g ) 2 d and O (m + 1) • (4c g ) 2 d where c g is the maximal number of inequalities used to describe any guard of the timed automaton and d is the maximal distance of .

The complexity of these problems depends on many parameters. The main advantage of this algorithm is that, for linear timed automata, the binary permissiveness function can be represented by a unique polyhedron and that the computation of the levelled permissiveness function is linear with respect to the number of thresholds used. Nevertheless, theses algorithms currently only cover the case of linear timed automata. Indeed, the ability to represent the binary permissiveness with only one polyhedron does not holds in general for acyclic timed automata and our algorithm relies on this property.

Permissiveness algorithm

Regarding our algorithm presented in Chapter 5, it covers the cases of acyclic timed automata and games, but our implementation only covers the case of linear timed automata. Our first ongoing work is to extend its implementation to acyclic timed automata. To do that, we need to implement a way to check the equality between two piecewise affine functions, independently of the tiling of polyhedra of each piecewise affine functions. Our second ongoing work is to optimise the representation of piecewise affine functions by merging the cells that are associated with the same affine functions. Indeed, our algorithm provides a representation with an over-tiling of the cells of the permissiveness function.

To tackle this issue, our goal is to gather all the cells associated with the same affine function and to state whether the union of their polyhedra is a polyhedron. This is a non-trivial question as the union of several polyhedra is not convex in general. We plan to compute, for each group of cells, the convex hull of these polyhedra and associate this set to the affine function. Then, we want to compare the obtained piecewise affine function to the original computed permissiveness function, to check whether they are equal. If they do, the number of cells can be reduced. These steps are illustrated in Figure 7.3. If not, we keep the over-tiling representation. For instance in Figure 7.4, the computation of the convex hull for the affine function (x, y) → -x + 1 2 is not the union of the cell 0, 1, 2, 3, 4, 5 and 13.

An important future work is also to refine the complexity of our algorithm. We proved that it runs in non-elementary time but we may have not exploited all the properties of our constraints for instance. These following possibilities should be considered for future works.

Look for an example where the computation time is non-elementary.

Improve our algorithm when computing the maximum of piecewise affine functions, when iterating of the couple of cells or refining the tiling of polyhedra.

Other future works for this algorithm would be to tackle the case of cycles. We were not able to prove that the sequence of suboptimal functions converges in a finite number of step to the permissiveness function when the timed automaton contains cycles. Our goal would be to find a counter-example timed automaton where this sequence does not converge and to find conditions where it converges in a finite number of steps. To study these conditions, we want to run our implementation by tackling cycles as in the numerical implementation, to observe the behaviour of the sequence of suboptimal permissive functions when we increase the number of allowed cycles.

Numerical algorithm

Regarding our numerical approach, our major future work is to bound the obtained error when computing our permissiveness function, since it is an approximation. Our experimental result on the precision were encouraging and for each example (for both linear and acyclic timed automata) the value of the error curve was cancelled periodically. In all our examples, the error curves have the same shape, with decreasing oscillations. We would study the shape of the oscillations in order to find how to bound the value of the obtained error when computing our permissiveness function.

Another future work would be to extend this implementation to more general models. For instance the guards used were classical guards. Extending it to polyhedral guards would enable us to provide the same JSON formats to run all our implements on the same timed automaton, for the sake of uniformity.

Levelled algorithm

Finally, regarding the binary and levelled permissiveness, our main future work are the following ones. First, we would like to extend our algorithm to acyclic timed automata, and possibly timed automata containing cycles. Secondly, we aim to implement our algorithm with the pplpy library. Implementing our current binary and levelled algorithms will be easy for linear timed automata, as these algorithms use the same procedures as the implementation of the permissiveness algorithm, presented in Section 6. 2. The main issue of these future works is to extend it to acyclic timed automata. Indeed, a very useful property does not hold in the general case and we were unable to tackle this issue yet.

Other approaches

Our future work also consists in proposing new approaches to compute the permissiveness of timed automata.

First, we could study other ways to approximate and reduce the number of cells that represent the permissiveness function. An interesting approach would be to avoid computing cells when they could be neglected: we aim to quantify the size of each cells, fix a step ε and neglect the cells whose size is smaller than ε (by merging them with another cell). Indeed, given a location , as the permissiveness function is 2-Lipschitz, if the distance between two valuations v and v is smaller than ε, the difference between the permissiveness of ( , v) and ( , v ) is smaller than 2ε. This approach would enable us to bound the number of used cells and maybe control the approximation made when computing the permissiveness. A main issue would be to decide how to quantify the size of a cell, how to neglect a cell, and how to bound the approximation made at each step.

We illustrate in Figure 7.5 how we would neglect a cell in a simple example. Let us consider the function in Figure 7.5a is 2-Lipschitz and suppose that the size of the cell associated to f is smaller than ε, in our example merging the cell associated to x -y and to f gives us an approximation of the piecewise affine function where the error made is smaller than 2ε. Nevertheless the general case might be complicated in order to keep polyhedra sets to represent cells.

Indeed, if we bound the error made by computing the 'ε-approximation' of a piecewiseaffine function, an important issue is to compute the error made by considering an approximation of the permissiveness function for the possible successors of a configuration when computing the strategies of the player and of the opponent. Secondly, we could study different ways to compute the permissiveness functions by considering the functions presented in Section 2. 2.3: associate a weight to each transition for instance could give more importance to specific transitions. Le but de cette thèse est de modéliser un type de perturbations, sur des délais, pour les automates temporisés et de calculer les stratégies les plus permissives afin de régler ce problème d'imprécision. Ces stratégies élargiront les délais uniques habituellement proposés en des intervalles de délais et chercheront à atteindre un des états finaux de l'automate quel que soit le délai dans l'intervalle proposé qui a eu lieu.

Title: Robustness of timed automata: computing the maximally-permissive strategies Keywords: Model verification, optimisation, robustness, timed automaton

Abstract:

Real-time systems sometimes need to be formally proven, especially realtime systems containing critical component, as planes, cars etc. Timed automata provide a convenient mathematical model for this. However, although they provide a representation of the temporal aspects of these systems, timed automata assume arbitrary precision and zero-delays actions. Therefore, even if a state is declared reachable in a timed automaton, it is sometimes impossible to reach it in the physical system it models. The aim of this thesis is to model a type of perturbation, on delays, for timed automata and to compute the most permissive strategies to solve this imprecision problem. These strategies propose intervals of delays instead of the usually proposed single delays. These strategies seek to reach one of the final states of the automaton regardless of the delay, in the proposed interval, that has occurred.

Figure 1 -

 1 Figure 1 -Automate temporisé représentant un éclairage automatique.

Figure 2 -

 2 Figure 2 -Automate temporisé représentant un ordonnancement de trois tâches.

Figure 3 -

 3 Figure 3 -Un automate temporisé pondéré pour représenter deux moyens de transport possibles pour rejoindre Londres depuis Rennes.

exprime .

 . Considérons le modèle M et le langage L que M exprime. Considérons le modèle M légèrement perturbé M. Le but d'une analyse du langage sera d'exprimer le langage L exprimé par le modèle M.

Figure 2 -

 2 Figure 2 -A timed automaton that illustrates a scheduling example.

Figure 6 -

 6 Figure 6 -A weighted timed automaton representing the possible ways to reach London from Rennes.

Figure 7 -

 7 Figure 7 -Principle of formal verification.

th coordinate of a family/vector x x floor function of x fract (x) fractional function of x x The norm of an element |I| The length of an interval 1 E

 1 The indicator function over the set E The logical conjunction

Figure 1 . 2 - 2 . 1 . 4 :

 12214 Figure 1.2 -Examples of half-spaces of R and R 2 .

Example 1 . 2 . 1

 121 We represent the intersection of the three half-spaces of R 2 of Figure 1.2 in Figure 1.3a and the first two half-spaces of R 2 of Figure 1.2 in Figure 1.3b.

( a )

 a Intersection of half-spaces of Figure1.2b and1.2c.

( b )

 b Intersection of half-spaces of Figure 1.2b, 1.2c and 1.2d.

Figure 1 . 3 -

 13 Figure 1.3 -Two examples of polyhedra in R 2 .

Proposition 1 . 7 :

 17 Intersection of polyhedraThe finite intersection of: polyhedra is a polyhedron. closed polyhedra is a closed polyhedron. open polyhedra is an open polyhedron.

Example 1 . 3 . 1

 131 Let us construct the example of the 2-dimensional affine function represented in Figure1.5a.

Figure 1 . 5 -

 15 Figure 1.5 -Two 2-dimensional affine functions, represented with partition of polyhedra (Figure 1.5a) or tiling of polyhedra (Figure 1.5b).

  are objects that represent time with real values. Their values progress at the same speed but can be reset independently. We denote the set of all clocks by C. A clock valuation, is a function from C to R + . It can be represented as a point in R |C| + . Given a valuation v and a non-negative real δ, we denote by v + δ the valuation w such that for any clock variable x ∈ C, w (x) = v (x) + δ. Let I ⊆ R + be an interval, we write v + I for the set of valuations {v + δ | δ ∈ I}. To denote the reset of clocks, given a valuation v and a subset C r ⊆ C, we denote by v [C r ← 0] the valuation w such that w (x) = 0 if x ∈ C r and w (x) = v (x) if x ∈ C r . To verify temporal properties, we first define how a valuation satisfies a timing constraint. There are several types of clock constraints. In this thesis, we use classical guards and polyhedral guards. Classical guards are a simple way to constrain clocks: all clocks are bounded with constant values. For example, if we consider the set of clocks {x, y}, the timing constraint 0 ≤ x ≤ 5 ∧ 5 ≤ y ≤ 10 is a guard. More formally: Definition 2.1: Classical guards The set of classical guards over C, denoted G (C), is defined as G (C) g := x ∼ n | g ∧ g where x ranges over C, n ranges over N and ∼∈ {<, ≤, =, ≥, >}. A constraint x ∼ n is closed if ∼∈ {=, ≤, ≥}. A classical guard is closed if each of its constraints is closed.

Figure 2 . 2 -Remark 2 . 1 . 3 Example 2 . 1 . 2 2 Figure 2 . 3 -

 22213212223 Figure 2.2 -A two-clock timed automaton A 1 with three transitions.

Example 2 . 1 . 5

 215 Let us consider again the examples of timed automata from Figures 2.1

and 2 . 2 .

 22 We can propose a finite run of length 2 for the timed automaton A 0 defined as follows:

Figure 2 . 4 -

 24 Figure 2.4 -Clock regions of Example 2.1.7.

Figure 2 . 6 -

 26 Figure 2.6 -The region automaton of the timed automaton of Figure 2.5.

Definition 2 .Example 2 . 2 . 1

 2221 13: Permissiveness of a p-move Let (I, a) be a p-move. The permissiveness of a p-move (I, a), denoted Perm (I, a), is defined as follows: Perm (I, a) = |I| . Let us consider the timed automaton of Figure 2.7. Let g : 0 ≤ x ≤ 1 be the guard of this timed automaton. Let ( 0 , (0.5)) be a configuration. ([0, 0.5] , a 0 ) and ([0.3, 0.5] , a 0 ) are two enabled p-moves. ([0.5, 1] , a 0 ) is not because (1.5) |= g. The permissiveness of the p-move ([0.3, 0.5] , a) is 0.5 -0.3 = 0.2, and the permissiveness of the p-move ([0.5, 1] , a) is 0.5.

Example 2 . 2 . 2

 222 For example, let us consider the timed automaton of Figure2.7. We can propose two p-runs ρ

Example 2 . 2 . 3

 223 Let us consider again the Example 2.2.2 of p-runs ρ automaton of Figure 2.7. The permissiveness of the first p-run is Perm ρ (p) 0 = min (1, 0.5) = 0.5 and the permissiveness of the second p-run is Perm ρ (p) 1 = min (1, 0) = 0. The most permissive p-run is the first one.

Figure 2 . 9 Figure 2 . 9 -

 2929 Figure 2.9 represents the permissiveness function Perm ( 0 , •).

Figure 2 .

 2 Figure 2.11a represents the permissiveness function Perm ( 1 , •).

Figure 2 .

 2 Figure 2.11b represents the permissiveness function Perm ( 0 , •).

Figure 2 .

 2 Figure 2.11 -The permissiveness function in 0 and 1 for the timed automaton of Fig 2.10.

Figure 4 . 1 -

 41 Figure 4.1 -The possible choices of intervals and delays with the guard 0 ≤ x ≤ 1 when v = (0, 0).

2 -

 2 Computation of P 1 for the timed automaton of Figure 2.2.

  3 -Computation of P 2 for the timed automaton of Figure 2.2.

  Proof of Lemma 4.3. For any configuration ( , v), by Definition 4.1 either P 0

(

  I,a)∈p-moves( ,v) min |I| , inf δ∈I P i (succ ( , v, δ, a)) ≤ sup (I,a)∈p-moves( ,v) min |I| , inf δ∈I P i+1 (succ ( , v, δ, a))

Example 4 . 2 . 3

 423 Let us go back to the same example, with the timed automaton of Figure2.2 and let us consider an arbitrary location such that = f . The maximal constant of this timed automaton is 1. As computed in Example 4.1.1, if any valuation v is greater than 1 on x or y, then the sequence of suboptimal permissive functions on a configuration ( , v) is always equal to -∞.

(

  I,a)∈p-moves( ,v) min |I| , inf δ∈I P i (succ ( , v, δ, a)) ≥ sup ({δ},a)∈p-moves( ,v) min |{δ}| , inf δ∈{δ} P i (succ ( , v, δ, a)) = sup ({δ},a)∈p-moves( ,v)

(

  I,a)∈p-moves( ,v) min |I| , inf δ∈I P i (succ ( , v, δ, a)) P i+1 ( , v) = sup (I,a)∈p-moves( ,v) min (|I| , -∞)

  a)∈p-moves( ,v) |I| Let us denote ν a, : v → sup (I,a)∈p-moves( ,v)|I| . If each ν a, is 2-Lipschitz, so is ν . Let us prove, for a fixed a ∈ Σ, that ν a, is 2-Lipschitz.

  Two possible p-runs when proposing ([0, 1] , a 1 ) in configuration ( 0 , (0, 0)).

Figure 5 . 1 -

 51 Figure 5.1 -An automaton with a reset and two of its possible p-runs.

1 . 5 . 1

 151 CorollaryLet be a location of a linear timed automaton. For any valuation v, and bounded interval [α, β], and any transition ( , g, a, C r , ): inf δ∈[α,β]

Figure 5 . 2 -

 52 Figure 5.2 -The three steps of our algorithm. Step 1: compute S (hα,h β ) . Step 2: compute expressions for I v α and I v β for any v. Notice that we consider a sub-polyhedron (hatched zone) of S (hα,h β ) because we had to refine it. Indeed the expression of I v β would be different for the lower part of S (hα,h β ) , since it ends on a different facet of h β . Step 3: select best values for α and β.

  k ). Therefore we have to distinguish the cases where S positive, negative, or equals to zero. Let us denote the following sets.

≤ 1 Figure 5 . 3 -

 153 Figure 5.3 -Automaton of Figure 2.10 where the guard on the first transition has been slightly extended.

  and 0 ≤ y ≤ 1 and y ≤ x} 3. The case where v + α [y ← 0] ∈ h 0 and v + β [y ← 0] ∈ h 1 translates to: there exist α and β such that α ≤ β and:

Figure 5 . 5 -Figure 5 . 6 -

 5556 Figure 5.5 -An acyclic timed automaton.

  then the player must propose a pair (I, a) such that there exists a transition e = ( , g, a, C r , ) such that for any delay δ in I, v + δ |= g. Then, the opponent proposes a delay δ in I and we reach the configuration ( , v + δ [C r ← 0]).

Figure 5 .

 5 Figure 5.8 -A two-clock linear timed games.

Example 5 . 3 . 1

 531 and the value of µ on this point. Let f : (α, β) → -α + 1 and g : (α, β) → β + 1 2 and D = [0, 5] × [4, 6]. Then µ (α, β) = min β -α, -α + 1, β + 1 2

Figure 5 . 9 -

 59 Figure 5.9 -The definition set D when C, D, E and B are all distinct.

3. 5

 5 are used in the algorithm presented in Subsection 5.1. In this algorithm, the constraints m α , M α and m β , M β correspond to the lower and upper bounds of the possible values of α and β when the player proposes an interval [α, β]. f and g correspond respectively to

  D is non-empty and compact. µ is a continuous piecewise affine function over a compact, so arg sup (α,β)∈D µ (α, β) exists.

Figure 5 . 10 -

 510 Figure 5.10 -Variations of f, g and h in the definition set D. The double arrows of f, g and h indicate the directions of variation of each function. For example the double arrow of f goes from left to right, because f is increasing with respect to α. It is perpendicular to β because it is constant with respect to β. A maximises µ over D.

  this is the maximum of µ over D, otherwise the maximum is reached on the border of {α ∈ R | (α, M β ) ∈ D}, i.e. for α = m α or α = min (M β , M α ) = M α . Examples are illustrated in Figure 5.11. As a result:

Figure 5 .

 5 Figure 5.11 -Variations of f and α → h (α, M β ) when a ≥ 0 and c ≥ 0.

  All edges in the dashed zone Z are top left edges of s.

  All edges in the dashed zone Z are top right edges of s. All edges in the dashed zone Z are bottom left edges of s. All edges in the dashed zone Z are bottom right edges of s.

Figure 5 .

 5 Figure 5.13 -Relative positions of edges.

case where d 1

 1 intersects D in Lemma 5.15 (case illustrated in Figures 5.14b5.14d), where d 2 intersects D in Lemma 5.16 (case illustrated in Figures 5.14c and 5.15a) and where d 3 intersects D in Lemma 5.17 (case illustrated in Figures 5.15b, 5.15c and 5.15d). Lemma 5.15 If d 1 intersects D, if T ∈ D and if B, C, D ∈ d 3 then:

  and [DE] (or [AC]). Let us suppose that d 1 intersects [CD]. As [DE] is an edge that starts from [CD] at D, and has a slope of exactly 1, d 1 cannot intersect both edges without crossing D. As [AC] is an edge that starts from [CD] at C and has a infinite slope, it cannot cross d 1 , which has a finite slope. With the same arguments, d 1 cannot intersect both [AC] and [DE]. Let us suppose that d 1 intersects [AC] and let us prove that it cannot intersect [DE]. Indeed, vertex D is on the right, at the same height as vertex C. As the slope of d 1 is strictly greater than 1 and the slope of [DE] is exactly 1, these half-line and edge cannot cross. As a result, if d 1 intersects [CD] (resp. [AC], or [DE]), d 1 intersects either [AB] or [BE]

  If the domain D intersects only one half-line, then: If only d 1 intersects D, then either (B ∈ P(f ) and E ∈ P(h)) or (M β ≤ T β , A ∈ P(f ) and B ∈ P(h)).These cases are illustrated respectively in Figures5.14b and 5.14d. If only d 2 intersects D, then either C ∈ P(g) or (m α ≥ T α , A ∈ P(g) and

  and 5.15a. If only d 3 intersects D, then either (C ∈ P(f ) and D ∈ P(g)) or ( B ∈ P(g) and E ∈ P(f ) ) or (D ∈ P(f ) and E ∈ P(g)).

1

 1 and d 3 , or d 2 and d 3 (otherwise it intersects more than two half-lines). Lemmas 5.19 studies the case where d 1 and d 3 intersect D, and Lemma 5.20 studies the case where d 2 and d 3 . Lemma 5.19 If the domain D intersects d 1 and d 3 , then T α ≥ M α , B ∈ P(g) and E ∈ P(h).

d 1

 1 and d 3 cannot intersect both [CD] and [DE], otherwise we would have T ∈ D. Suppose that d 1 and d 3 intersect D and d 1 intersects [AB] then T β ≥ M β . d 3 does not intersect D or T ∈ D (which is a contradiction). As a result, d 1 cannot intersect [AB]. Therefore, d 1 intersects [BE], then d 3 cannot intersect [CD] and [DE] (its initial (and lowest) point is above all points of d 1 ). d 3 then intersects [BE] too. To conclude, if only d 1 and d 3 intersect D, then they intersect [BE] and N (d 3 , {[AC] , [DE]}) = 1. In conclusion, B ∈ P(g), E ∈ P(h) and T β ≥ M β . Lemma 5.20 If the domain D intersects exactly d 3 and d 2 , then m β ≥ T β , C ∈ P(f ) and D ∈ P(h).

2

 2 and d 3 intersect [CD]. First, we prove that d 2 intersects [CD]. d 2 must intersect either [CD] or [AC]. If d 2 intersects [AC] then T α ≤ m α and d 3 cannot intersect D, which is absurd. As a result d 2 intersects [CD].

and d 2

 2 then cannot intersect D. This leads to a contradiction. Necessarily d 3 and d 2 intersect [CD], then C ∈ P(f ) and D ∈ P(h). Finally, if D intersects d 3 and d 2 but not d 1 , then m β ≥ T β . Cases where D intersects the three half-lines. Finally, the domain D can intersect the three half-lines d 1 , d 2 and d 3 at the same time. If these three half-lines intersects the domain D, then their intersection point T belongs to D. As this point is the argsup of µ in R 2 , it is a sufficient condition to characterise an optimal point over D. This case is illustrated in Figure 5.16c.

  and h (C) ≤ g (C), then (α * , β * ) = m α , m α + d 1 -c is an argsup of µ |D . Case 6: C ∈ P(f ) and D ∈ P(g). If C ∈ P(f ) and D ∈ P(g), then D only intersects the half-line d 3 and µ |D = min (f, g). As a result, µ |D reaches it maximal point over d 3 , when α is minimum, so at the intersection with the edge [CD]. As a result, if C ∈ P(f ) and D ∈ P(g), then (α * , β * ) = (((1 -c) • m β -d, m β ) is an argsup of µ |D . Case 7: B ∈ P(g) and E ∈ P(f ). With the same argument, the edge [BD] crosses d 3 , then either D is a rectangle and µ |D = min (f, g), or D is a convex pentagon and a triangle and the slope of [BE] is 1, which is strictly smaller than a+1. So D does not intersect P(h)\d 1 , and µ |D = min (f, g) too. In any case, µ |D reaches its maximal value over d 3 and [BE]. As a result, if g

Case 8 :Case 9 :

 89 D ∈ P(f ) and E ∈ P(g). In this case, µ |D = (f, g) and D intersects only the half-line d 3 , in particular with [DE].The maximal value of µ |D is then reached over d 3 and [DE], i.e. when α = β and β = a c α + b -d c . As a result, if D ∈ P(f ) and E ∈ P(g), then b -d c -a , b -d c -a is an argsup of µ |D . M α ≤ T α , B ∈ P(g) and E ∈ P(h). As M α ≤ T α , D is left to T and does not intersects d 2 . As B ∈ P(g) and E ∈ P(h), D necessarily intersects d 1 and d 3 . The maximal value of µ |D is reached on its intersection with d 1 or d 3 . As on these two half-line, µ |D is equals to f , the [BE] ∩ d 1 and [BE] ∩ d 3 have the same value with respect to α, µ |D has the same value on these two points. As a result, if M α ≤ T α , B ∈ P(g) and E ∈ P(h), then (M α , (a + 1) • M α + b) is an argsup of µ |D . Case 10: m β ≥ T β , C ∈ P(f ) and D ∈ P(h). As m β ≥ T β , D crosses only d 2 and d 3 , and not d 1 . D is then split in the three polyhedra P(f ), P(g) and P(h). Over P(f ), µ |D is maximised on the point where α is the greater, so on the intersection with d 3 and [CD], where µ |D is also equal to g. Over P(h), µ |D is maximised on the intersection with d 2 , where β -α is maximal, i.e. on [CD] ∩ d 2 . Both [CD] ∩ d 3 and [CD] ∩ d 3 are in P(g) so µ |D have the same value on both of these points, as µ |D does not depend on α over P(g). As a result, if C ∈ P(f ) and D ∈ P(h), c a m β + d -b c , m β is an argsup of µ |D Case 11: T ∈ D. finally, we can characterise the fact that T belongs to D by:

  , we describe with Figures the different cases that were enumerated in Subsections 5.3.4.2 and 5.3.4.3. Theses cases are represented in Figures 5.14

  , 5.15 and 5.16. Each cases of Theorem 5.11 is represented in these Figures. Let us

  recall

Figure 5 .

 5 Figure 5.14 -Summary of the first fourth cases.

  Case 8: D ∈ P(f ), and E ∈ P(g).

Figure 5 .

 5 Figure 5.15 -Summary of cases 5, 6, 7 and 8.

  g

Figure 5 .

 5 Figure 5.16 -Summary of cases 9, 10 and 11.

  .2, 5.3, 5.4 and 5.5 are composed of three columns. The first one gives the conditions of the relative position of D, the second one gives the value of a maximal point of µ |D and the third one gives the value of µ |D on these points. When f or g have infinite coefficients • when f = +∞ and c ≥ 0 (or g = +∞): coordinates of a maximal point value of a maximal point (m α , M β ) min{M β -m α , c • M β + d} • when f = +∞ and c ≤ 0: Conditions coordinates of a maximal point value of a maximal point

  Second step: backtrack on delays δ 1,1 • • • , δ 1,m . Third step: backtrack on intervals: I 1,1 , • • • , I 1,m .

Figure 6 . 1 -

 61 Figure 6.1 -Steps of our algorithm.

Data: 4 T 5 new_trace 6 if

 456 A configuration ( , v), a timed automaton A, a p-move (I, a), an interval sampling step s I , a delay sampling step s δ and a trace T c Result: The trace that minimises the permissiveness among the selected choices of delays for the p-move (I, a) 1 minimal_trace ← Empty trace; 2 for δ in delay_sampling((I, a) , , s δ ) do 3 next_config ← succ( , a, δ, v); c ← T c + (next_config, I, δ) ; ← backtrack_interval (next_config, A, s I , s δ , T c ); new_trace.compare_trace(minimal_trace)

6. 1 . 4

 14 Backtracking and Trace Trace The aim of the classes Trace and TraceList is to represent traces, which contain the informations of a p-run. The trace is modelled as an object of the class TraceList, as a list of objects of the class Trace. Each object of the class Trace is represented by a triplet (configuration, p-move, delay). As a result, the class TraceList depends on the class Trace, as illustrated in the UML class diagram in Figure 6.3b. UML graph of the trace objects.

Figure 6 .

 6 Figure 6.3 -UML graphs of P-moves and trace objects.

Figure 6 . 4 -

 64 Figure 6.4 -UML graph of Backtracking.



  Let us denote T the maximal number of transitions in the timed automaton, n the number of clocks, and s := min (s δ , s I ) and B := max represents the complexity of computing the greatest interval and then sampling intervals.Our algorithm can be executed in O for acyclic timed automata and O (2 • B) T for linear timed automata.

Figure 2 .

 2 Figure 2.8 -A timed automaton with 2 identical transitions presented in Subsection 2.2.2.

Figure 2 .

 2 Figure 2.10 -A timed automaton with a reset presented in Subsection 2.2.2.

2

 2 Inverse of sampling step sError ε (b) Precision results.

Figure 6 . 6 - 2 Figure 5 . 5 -Figure 5 . 6 -

 6625556 Figure 6.6 -Experimental results (Numeric approach) for the timed automaton of Figure 2.10.

Figure 6 . 7 -

 67 Figure 6.7 -Experimental results (Numeric approach) for the timed automaton of Figure 5.5.

Figure 5 . 2 -

 52 Figure 5.2 -The three steps of our algorithm. Step 1: compute S (hα,h β ) . Step 2: compute expressions for I v α and I v β for any v. Notice that we consider a subpolyhedron (hatched zone) of S (hα,h β ) because we had to refine it. Indeed the expression of I v β would be different for the lower part of S (hα,h β ) , since it ends up in a different facet of h β . Step 3: select best values for α and β.

Figure 6 . 9 -

 69 Figure 6.9 -UML class graph of TimedAutomaton.

Figure 6 . 10 -

 610 Figure 6.10 -UML class graph of Piecewise affine functions.

2 Figure 6 .

 26 Figure 6.11 -An example of piecewise affine function.

2 (

 2 Its representation if we represent the affine functions that values -∞. b) Its representation without -∞ functions.

Figure 6 .

 6 Figure 6.12 -Two representations of the piecewise affine function of Figure 6.11.

Figure 6 .

 6 Figure 6.13 -Example of two piecewise affine functions.

1 (

 1 b) New overtiling of g.

Figure 6 .

 6 Figure6.14 -Over-tiling of f and g in order to apply our maximisation algorithm.

Figure 6 .

 6 Figure 6.16 -A piecewise function where all polyhedra could be merged.

Figure 5 .

 5 Figure 5.3 -A timed automaton similar as the one of Figure 2.10 where the guard on the first transition has been slightly extended.

1 (

 1 Permissiveness at location 1 of the timed automaton of Figure 2.8. b) Permissiveness at location 0 of the timed automaton of Figure 2.8.

Figure 6 .

 6 Figure 6.17 -Permissiveness functions of the timed automaton of Figure 2.8.

1 (

 1 a) Permissiveness at location 1 of the timed automaton of Figure 2.10. Permissiveness at location 0 of the timed automaton of Figure 2.10.

Figure 6 .

 6 Figure 6.18 -Permissiveness functions of the timed automaton of Figure 2.10.

  b) Permissiveness at location 0 of the timed automaton of Figure 5.3.

Figure 6 .

 6 Figure 6.19 -Permissiveness function of the timed automaton of Figure 5.3.

  c) Another three clock timed automaton.

Figure 6 .

 6 Figure 6.20 -Three timed automata studied in the symbolic implementation.

  Runtime result for symbolic approach for the location 0 .

  Runtime result for numeric approach,for the configuration ( 0 , (0, 0)).

Figure 6 .

 6 Figure 6.21 -Comparison of numeric and symbolic approaches for a two-clocks-automaton with m transitions, with the same guards 0 ≤ x ≤ 1 ∧ 0 ≤ y ≤ 1 on each transitions (and no reset).

Figure 2 . 10 -

 210 Figure 2.10 -An example of timed automaton.

2 ( 1 ,

 21 Representation of Bin0 ( 1 , •): Bin 0 ( 1 , v 1 ) is 1 if and only if Perm ( 1 , v 1 ) ≥ 0. •): Bin 1/2 ( 1 , v 1 ) is 1 if and only if Perm ( 1 , v 1 ) ≥ 1/2.

  Representation of Bin 1 ( 1 , •): Bin 1 ( 1 , v 1 ) is 1 if and only if Perm ( 1 , v 1 ) ≥ 1.

Figure 7 . 1 -

 71 Figure 7.1 -An example of binary permissiveness functions Bin 1 ( 1 , •) of the timed automaton of Figure 2.10 for different thresholds 0, 1 2 , 1.

  Bin i,p ( , v) = sup (I,a)∈p-moves( ,v) min 1 {|I|≥p} (I) , inf δ∈I Bin i-1,p (succ ( , v, δ, a))

⇐

  As a result, by the induction hypothesis, Bin i,p succ ( , v, δ, a 0 ) = 1 and then:min 1 {|I 0 |≥p} (I 0 ) , inf δ∈I 0 Bin i,p (succ ( , v, δ, a 0 )) = 1 ≤ Bin i+1,p ( , v) .As Bin i+1,p ( , •) can only be equal to 0 or 1:Bin i+1,p ( , v) = 1. Suppose that Bin i,p ( , v) = 1,then there exists a p-move (I 0 , a 0 ) ∈ p-moves ( , v) such that |I 0 | ≥ p and for any delay δ ∈ I 0 , inf δ∈I 0 Bin i,p succ ( , v, δ, a 0 ) = 1. Then, with the same arguments as previously, P i+1 ( , v) ≥ p. Thanks to Proposition 7.4, several properties of P i , presented in Section 4.2, can be extended or adapted to Bin i,p , by simple inductions: Lemma 4.3: for a fixed configuration ( , v), the sequence (Bin i p ( , v)) i≥0 is nondecreasing. Lemma 4.5: the sequence (Bin i,p ( , v)) i≥0 is eventually constant from rank d for acyclic timed automata. Proposition 4.7 and its Corollaries 4.8 and 4.9:

S

  i (p, ) and S (p, ) can be represented as finite union of closed polyhedra of R |C| + . In particular, if A is a linear timed automaton, S i (p, ) and S (p, ) are closed polyhedra of R |C| + .Proof of Proposition 7.5. By definition, S i (p, ) = P i ( , •) -1 ([p, +∞]). As P i ( , •) is a piecewise affine function over Win , S i (p, ) is a finite set of polyhedra.Let us now suppose that A is linear and let us prove that S i (p, ) is a convex set.Let v 1 , v 2 ∈ S i (p, ) and λ ∈ [0, 1]. Let us prove that v λ := λ•v 1 +(1 -λ)•v 2 ∈ S i (p, ).

  , α + p] , a) is an enabled p-move v + α [C r ← 0] , v + α + p [C r ← 0] ∈ S i-1 (p, )

S i- 1

 1 (p, ): This set is a polyhedron, let us define its inequalities:c i k=1 ϕ k (X) ≥ 0.

1 .

 1 v + α |= g: ∀0 ≤ j ≤ c g : ϕ (g) j (v + α) ≥ 0 2. v + α + p |= g: ∀0 ≤ j ≤ c g : ϕ (g) j (v + α + p) ≥ 0 3. v + α [C r ← 0] ∈ S i-1 (p, ): ∀0 ≤ k ≤ c i : ϕ k (v + α [C r ← 0]) ≥ 0 4. v + α + p [C r ← 0] ∈ S i-1 (p, ): ∀0 ≤ k ≤ c i : ϕ k (v + α + p [C r ← 0]) ≥ 0Let us eliminate α in these inequalities: ϕ (g) j (v + α) :=

j

  j,i (v i + α) Let us denote S (v + α + p) = S (g) j • α + ϕ (g) j (v + p)As previously:ϕ k (v + α [C r ← 0]) := n i =0,i ∈Cr ϕ k,i (v i + α) Let us denote S k = n i =0,i ∈Cr ϕ k,i , then:

  and S k are positive, negative, or equal to zero. Let us denote the following sets:Pos g = j ∈ 1, n | S (g) j > 0 , Neg g = j ∈ 1, n | S (g) j < 0 , Zero g = j ∈ 1, n | S (g) j = 0 and Pos i = {k ∈ 1, n | S k > 0} , Neg i = {k ∈ 1, n | S k < 0} , Zero i = {k ∈ 1, n | S k = 0}Let us denote, for γ ∈ {i, g}, the size of the previously defined sets as follows:p γ := |Pos γ | , n γ := Neg γ , z γ := |Zero γ | .As a result, we will obtain three forms of inequalities: A k ≤ α, B j ≥ α and C ≥ 0 that characterise the valuations of S i (p, v):∀j ∈ Pos g , -ϕ Zero g , ϕ (g) j (v) ≥ 0 and ϕ (g) j (v + p) ≥ 0 ∀k ∈ Pos i , -ϕ k (v [C r ← 0]) S k ≤ α and -ϕ k (v + p [C r ← 0]) S k ≤ α ∀k ∈ Neg i , -ϕ k (v [C r ← 0]) S k ≥ α and -ϕ k (v + p [C r ← 0]) S k ≥ α ∀k ∈ Zero i , ϕ k (v [C r ← 0]) ≥ 0 and ϕ k (v + p [C r ← 0]) ≥ 0

Data: 2 ← predecessor of f ; 3 for i ← 1 to d 0 do 4 Compute 5 ← 5 :

 2455 A timed automaton A, a location 0 , a target location f and a threshold p Result: S (p, 0 ) 1 Compute S 0 (p, f ) ; S i (p, ) with the algorithm presented in subsection 7.1.3.2 ; predecessor of ; 6 end 7 return S d 0 (p, ) Algorithm Computation of S (p, 0 ).

7. 2 2 , 1 .Figure 7 . 2 - 2

 221722 Figure 7.2 -The levelled permissiveness of the timed automaton of Figure 2.10, with the thresholds 0, 1 2 and 1.

1 . 2 .

 12 Perm lvl,P ( , v) = -∞ if and only if Bin p 0 ( , v) = 0. For i ∈ 0, m-1 , Perm lvl,P ( , v) = p i if and only if Bin p i ( , v) = 1 and Bin p i+1 ( , v) = 0. 3. Perm lvl,P ( , v) = p m if and only if Bin pm ( , v) = 1.



  for acyclic timed automata and O (2 • B) d for linear timed automata, where B := max and n is the number of clocks, M (A) is the maximal constraint of the timed automaton, s is the minimum between the sampling step of the delays and the sampling step of the intervals and d is the maximal distance to .

  (-x + 2) /2 0, • • • , 5 (-y + 1) /1 6, • • • , 15 (x -y + 1) /2 20, • • • , 24 (2) /3 16, • • • , 19(a)Permissiveness function computed by our algorithm in Section 6.2.4.1. Obtained piecewise affine function if computing the convex hull for each affine functions.

Figure 7 . 3 -

 73 Figure 7.3 -Convex hull computation results.

Figure 7 . 4 -

 74 Figure 7.4 -Example where the computation of convex hull will not work.

  Supressing the cell associated to f .

Figure 7 . 5 -

 75 Figure 7.5 -An intuition of the 'ε-approximation'.

Titre:

  Robustesse des automates temporisés : calculer les stratégies les plus permissives Mot clés : Vérification de modèle, Optimisation, robustesse, automates temporisés Résumé : Les systèmes temps-réels nécessitent parfois d'être prouvés formellement, en particulier les systèmes temps-réels contenant des parties critiques, comme les avions, les voitures... Les automates temporisés constituent un modèle mathématique commode pour cela. Cependant, même s'ils fournissent une représentation des aspects temporels de ces systèmes, les automates temporisés supposent une précision arbitraire et des actions immédiates. C'est pourquoi même si un état est déclaré atteignable dans un automate temporisé, il est parfois impos-sible de l'atteindre dans le système physique qu'il modélise.

  Emily Clement, Thierry Jéron, Nicolas Markey and David Mentré. Computing maximally-permissive strategies in acyclic timed automata, in Nathalie Bertrand and Nils Jansen, editors, Formal Modeling and Analysis of Timed Systems

[CJM + 20]: -18th International Conference (FORMATS 2020), Vienna, Austria. Volume 12288 of Lecture Notes in Computer Science, pages 111-126, Springer, September 2020, doi: 10.1007/978-3-030-57628-8\_7, url: https://doi.org/10.1007/978-3-030-57628-8%5C_7.

  in R C . A clock valuation v satisfies a polyhedral guard g P , denoted v |= g P if v ∈ P. The set of polyhedral guards is denoted G p (C). A polyhedral guard is a closed polyhedral constraint if its associated polyhedron is closed. Let g be a polyhedral (or classical) guard over C. Let v be a valuation in R

	Remark 2.1.1

|C|

+ and I ⊆ R + be an interal. We say that v + I |= g if for any δ ∈ I, v + δ |= g.

Remark 2.1.2 Classical guards are a particular case of polyhedron constraints, where its associated matrix A of its H-representation is of the form

Remark 2.2.1 P-moves can be defined with open or half-open intervals too. Neverthe- less, we will consider only closed intervals for the purpose of simplification. We denote I the set of closed intervals of R + and detail the extention to non-closed interval in

	possibly right-unbounded, and a ∈ Σ.
	We say that a p-move (I, a) is an enabled p-move if there is a transition
	( , g, a, C r , ) such that v + I |= g. The set of enabled p-moves of ( , v) is denoted
	p-moves ( , v).
	Section
	5.2.1.

) otherwise Example 2.2.5 Let us go back to the Example 2.2.4, the permissiveness of σ from ( , v) is:

Definition 2.19: Co-reachable configurations A configuration s is co-reachable from

  a configuration s if there exists a p-run from s to s , i.e. if there exists a p-run ρ (p) = (s i , (I i , a i ) , δ i , s i+1 ) 0≤i≤n-1 where s 0 = s and s n = s . A configuration s is co-reachable from a location if there exists a valuation v such that s is co-reachable from ( , v).

	) is a winning configuration
	We also define the set of all winning configurations, denoted Win as follows:
	Win :=
	A configuration s is co-reachable from a set of configurations S ⊆ S (resp locations
	L ⊆ L) if there exists a configuration s ∈ S (resp. location ∈ L ) such that s is
	co-reachable from s (resp. ).
	The set of co-reachable configurations from a set of configurations S (resp. locations
	L ) is denoted co-reach (S ) (resp. co-reach (L )).

∈Q

Win

  and only if, there is no run of length at most i from ( , v) to any location f ∈ Q f ; 2. for any p ∈ R + , and any i ∈ N, it holds that P i ( , v) ≥ p if, and only if, there is a permissive strategy with permissiveness larger than (or equal to) p that is winning from ( , v) within i steps.

  ) is a concave function over Win . for any v 1 , v 2 ∈ Win , for any λ ∈ [0; 1], and

	Let us recall briefly what a concave function is.	Win → v → P i ( , v) R +	is concave if and
	only if,

  Our algorithm currently only applies to closed guards (classical or polyhedral) and closed p-moves, as defined in Definitions 2.11 and 2.1 end 2.2, where non-necessary closed guards and p-moves have also been defined in the definition or in remarks (see Remark 2.2.1). For the purpose of simplification, we have restricted our permissive semantics and algorithm to closed guard and p-moves. Nevertheless the permissiveness can be defined for nonnecessary closed guards and p-moves, since the size of the intervals ]α, β[,[α, β[ and [α, β] are equal. We detail here whether non-necessary closed p-moves and guards can be considered in our algorithm and what changes it requires.

  each cell h ∈ H, we can compute the values d in h and d out h for which v+d in h [C r ← 0] enters h and v + d out h [C r ← 0] leaves h (notice that this may require further refinement of the polyhedron being considered). Since P i is linear on cell h, it reaches its maximum on this cell either at v + d in h [C r ← 0] or at v + d out h [C r ← 0]. The function we need to maximise now looks like:

  . Let us recall this problem more formally. Let us fix a valuation v. Let us consider two intervals, I v α and I v β , with positive lower bounds, a location and a set of resets C r . Let us consider a domain

  This library has been developped since 2001 by the University of Parma and BugSeng. The main current contributors are Roberto Bagnara, Patricia M. Hill, Enea Zaffanella and Abramo Bagnara. Numerous bindings are available in other languages, as Ocaml or Python. We use the Python binding named pplpy 7 (0.8.6 version) provided by Vincent Delecroix.

  and6.19 the graphical results obtained when computing the permissiveness of the timed automaton of Figures2.8, 2.10, 5.3.

Table 6 .

 6 The number of transitions Runtime for 1 Runtime for 2 Runtime for 3 1 -Runtime results (in sec.) of our symbolic implementation when computing the permissiveness function on 0 , 1 and 2 and 3 .

	Timed automaton	Runtime for 0
	Figure 2.8	0.82 (2 cells)	0.059 (2 cells)	-	-
	Figure 2.10	0.071 (6 cells)	0.062 (3 cells)	-	-
	Figure 5.3	0.73 (24 cells)	0.034 (3 cells)	-	-
	Figure 6.20a	38.16 (582 cells)	1.01 (25 cells)	0.09 (3 cells)	-
	Figure 6.20b	19.95 (234 cells)	0.41 (12 cells)	0.56 (6 cells)	0.14 (6 cells)
	Figure 6.20c	143.48 (1825 cells) 0.39 (12 cells)	0.59 (6 cells)	0.14 (6 cells)
	Timed automaton Runtime (numeric) for s = Figure 2.8 0.0016	1 2	Runtime (numeric) for s = 0.15	1 15
	Figure 2.10	0.021				0.22
	Figure 5.3	0.021				0.022
	Figure 6.20a	0, 0078				7, 98
	Figure 6.20b	0.026				330.87
	Figure 6.20c	0.025				329.69

Table 6 .

 6

2 -Runtime results (in sec.) of our numeric implementation for two different interval sampling steps for configuration ( 0 , (0, 0)).

  The polyhedron S d 0 (p, ) can be computed in time O (4c g ) 2 d time and be represented with at most O (4c g ) 2 d linear inequalities.

Prenons l'exemple d'un système d'éclairage automatique pour illustrer la modélisation d'un système temps-réel en un automate temporisé. Ce système d'éclairage s'éteint automatiquement après un certain temps afin d'économiser de l'électricité. Cet exemple est modélisé par un automate temporisé, représenté en Figure1, avec les deux états possibles (appelés localités) de la lampe : allumé (« On ») et éteint (« Off »), et les actions possibles. On considère que la seule interaction avec la lampe est d'appuyer sur le bouton (action « appuyer »), ce qui allume la lampe. Nous pouvons passer de « Off » à « On » en effectuant l'action « appuyer ». Pour s'éteindre automatiquement, la lampe possède un compteur, une horloge, qu'on appellera x, qui est remise à zéro à chaque fois que l'on appuie sur le bouton (« appuyer »). La lampe s'éteint alors automatiquement au bout d'une minute, c'est-à-dire lorsque x ≥ 1. Pour l'empêcher de s'éteindre, il faut appuyer sur le bouton (« appuyer ») avant x = 1, cette action remettant les horloges à zéro.

i.e., si l'on quitte Rennes au plus tôt à 8 heures du matin.

https://www-verimag.imag.fr/DIST-TOOLS/TEMPO/kronos/

https://uppaal.org/

https://www.labri.fr/perso/herbrete/tchecker/

https://www.imitator.fr/index.html

http://romeo.rts-software.org/

https://pat.comp.nus.edu.sg/

As only one action is available here for each location, we will only detail the proposed delay and not the action.

Possibly a singleton.

. This function is called the permissiveness function. We present an algorithm that computes this function in non-elementary time for acyclic timed automata and games in Chapter 5. In the next section, we give two examples of computation of the permissiveness function on timed automata.

that means the configurations that can be reached when taking only one transition.

For convenience in this 2-clock example, we may write valuations either as v or as pairs (x, y), depending on the situation.

full link: https://github.com/merce-fra/ECL-pyrobustness

full link: https://github.com/merce-fra/ECL-Symbolic-Implementation

Except when I a contains only a punctual interval.

these moves are implemented as p-move with punctual intervals

For the sake of simplification, i is denoted as i, a 0 is denoted as a and a 1 is denoted as b in the logger.

https://www.bugseng.com/parma-polyhedra-library

https://gitlab.com/videlec/pplpy

Merci, au risque

//www-verimag.imag

Chapter presents a state of the art of the different kinds of robustness and applications of this problem in model-checking and formal methods.

over the set D defined as follows:

Now -c ≥ 0 and -a ≥ 0, and we have reduced this case to the case where a ≥ 0 and c ≥ 0.

Proof for infinite multidimensional affine functions

In this case, we suppose that f or g have infinite coefficient, i.e when f (α, β) = ±∞ or g (α, β) = ±∞ for every (α, β) ∈ D.

Proof when f = -∞ or g = -∞

As µ = min(f, g, h) equals -∞ over D, µ is constant over D and any point of D reaches the maximum of µ.

Proof when f = +∞ or g = +∞ If g = +∞ over D, then for any (α, β) ∈ D, µ (α, β) = min (a • α + b, β -α). µ is then non-decreasing with respect to β and is maximised when β = M β . Maximising µ for the variable α now amounts to maximise α → µ (α, M β ) . We can apply the same methods and results of the case where f and g are non-infinite functions and where a ≥ 0. These cases are summed up in Table 5.2 in Subsection 5.3. 5.

If f = +∞, then for any (α, β) ∈ D, µ (α, β) = min (c • β + d, β -α). µ is maximised when α = m α . It now remains to maximise β → µ (m α , β) . We can apply the results of the cases when a ≤ 0 and f and g are non-infinite functions. Theses cases are summed up in Table 5.1 in Subsection 5.3.5.

Proof for the non-monotonic case with finite multidimensional affine functions

This case corresponds to the case a > 0, c < 0. Let us describe first the variation of µ with respect to α and β in Subsection 5.3. 4. 1. Then we enumerate all the possible cases in Subsection 5.3. 4.2 with a coverage lemma. Finally, we describe an argsup for each of We first study the case where no half-line intersects D (see Lemma 5.14).

Secondly, we consider the set of edges of D, {[AB] , [AC] , [BE] , [CD] , [DE]}. We state for each half-line d 1 , d 2 and d 3 which edges of D is crossed when one of these half-lines intersects D (see Lemmas 5.15, 5.16 and 5.17).

Thirdly, we study the case where exactly one of the half-lines intersects D (see Lemma 5.18).

Fourthly, we study the cases where exactly two of the half-lines intersect D. It can be either d 1 and d 3 (see Lemma 5.19) or d 2 and d 3 (see Lemma 5.20).

Fifthly and finally, we study the unique case where the three half-lines intersect D.

Which half-lines can D intersects?

As each half-line has a fixed sign of slope, D cannot intersect some half-lines at the same time. For instance, it is impossible that D intersects d 1 and d 2 without intersecting d 3 . We detail which half-lines D can intersect at the same time in Lemma 5.12.

Lemma 5.12

The domain D can intersect:

1. Either one of the half-lines d 1 , d 2 , d 3 .

2. Or none of them.

On top of that, as (α 0 , β 0 ) belongs to d 1 , its second coordinate satisfies the following equalities:

As a result, α 0 = T α and T ∈ D. D then intersects d 3 too. In all cases, it has been shown that D intersects the three half-lines if it intersects d 1 and d 2 . Therefore if it intersects only two half-lines, it can only intersect d 1 and d 3 , or d 2 and d 3 .

The following Lemma 5.13 states an important geometric result for the next lemmas of this subsection: it shows that the exact number of edges a half-line intersects when intersecting D. It will be very useful when detailing each half-line, because it will reduce the number of edge combinations to be enumerated. In the next paragraphs, we will study the intersection of D for each possible combination and translate the intersection of D with half-lines into the membership of vertices to P(f ), P(g) or P(h).

Cases where D intersects none of the half-lines. Let us first consider in Lemma 5.14 the case where D intersects none of the half-lines.

Lemma 5.14

If the domain D intersects no half-lines, then either B ∈ P(f ), or C ∈ P(g), or

The cases when B ∈ P(f ) and C ∈ P(g) are illustrated in Figures 5.14b and 5.14c.

This directly proves that if µ |D = f then D ⊆ P(f ) and then B ∈ P(f ). For the other cases we can respectively prove that

Cases where D intersects at least one half-line. In this paragraph, we detail for each half-line the combination of vertices that a half-line cannot intersect. We can prove the contradiction of some combination because of the informations on the slope of the half-lines, and the relative position of the edges on D. Examples of intersections of halflines with D are given in Figure 5.14, 5.15

and

and

Proof. By definition, T ∈ D if and only if D intersects all the half-lines. These cases are covered by the case 11, enumerated in the Theorem.

Optimisation for every cases

Now that we have described the different configurations in Theorem 5.11 in the previous Subsection 5. 3. 4.2, we now find the different possible argsup of µ |D , depending on the position of D.

Let us recall the different possible configurations when a > 0 and c < 0:

ROBUSTNESS TOOLS: FORWARD AND BACKWARD IMPLEMENTATIONS.

In this chapter, two implementations are presented, whose common goal is to compute permissiveness.

The algorithm of the first implementation consists in exploring forward the timed automaton with a depth-search with no a priori knowledge of the strategy of the player and the opponent. Its goal is to compute an approximate value of the permissiveness of a fixed configuration. The motivation for this implementation is to provide a tool that computes, even approximately, a permissiveness of a configuration, for more general timed automata. This tool, implemented in Python, under GPL Licence, is available in the following github page: merce-fra/ECL-pyrobustness 1 . This forward algorithm explores the possibilities of choices for the player and the opponent, and then compares the different p-runs in order to deduce which one is the optimal one (for the player as well as for the opponent). The strategies of the player and the opponent are not known a priori and their choices are explored with brute-force methods.

The second implementation computes the exact value of the permissiveness function for all locations of the timed automaton with a backward exploration. This approach is the symbolic algorithm that we presented in Chapter 5 where we use the knowledge of the permissiveness function of each successor to compute the best current strategy. We have provided prototypes for this approach in Python, under the GPL Licence, available in the following github page: merce-fra/ECL-Symbolic-Implementation 2 .

These two tools are now maintained on the respective following gitlab pages: https://gitlab.inria.fr/emclemen/numpyrobustness for the numerical implementation.

of linear timed automata, we optimise our algorithm by choosing the bounds of the proposed interval instead of doing a sampling of all possible delays.

3. We backtrack on delays and intervals (see Figure 6.1b), with a different objective in each case. In the case of intervals, we will try to select the one that maximises its permissiveness compared to our 'best current trace'. In the case of delays, we will try to find a trace whose permissiveness is lower. 4. We compute, for each exploration, a trace. If during the backtrack, we find a better trace, i.e. a choice of delays that minimise its permissiveness, or a choice of intervals that maximises it, then we will consider that trace as our new 'best current trace'.

In this section, we will present our algorithm more formally and the tool we provide in the github page merce-fra/ECL-pyrobustness in Python 3.8, as an object-oriented program.

We proceed as follows:

In Subsection 6.1.1 we present more formally our backtracking algorithm. We first explain how to sample the set of possible intervals and delays, then how to backtrack on the intervals and on the delays, and then our main function to compute the optimal trace.

Then, we focus on our concrete implementation in Python. We explain our choices of data structures and the optimisations we could apply so far.

In Subsection 6.1.2, we present the classes implementing the following objects: timed automata, guards, and intervals.

In Subsection 6. 1.3, we present the classes allowing to apply the player and the opponent choices: p-moves and opponent strategies.

In Subsection 6. 1.4, we will present the core of our implementation: the Backtracking module. It contains the Trace class, which is used to model the trace in our algorithm, and the Backtracking class, which is used for backtracking.

In Subsection 6. 1.5, we compute an upper bound of the worst-case complexity of this algorithm

In Subsection 6. 1.6, we present our experimental results.

In Subsection 6. 1.7 we present a graphical interface designed to visualise the exploration and ease its understanding. Therefore, the set of intervals that have been considered in this function is not exactly the set of all possible intervals, but a sampling of intervals. However, we know the size of the proposed intervals. Therefore the imprecision of the size of the proposed intervals is s I for each sampling.

Sampling the delays

The same problem arises when we want to explore the whole range of possible delays. If we consider a proposed interval I, all the elements δ ∈ I are possible. Our sampling method, called delay_sampling consists in sampling the interval I with a sampling step s δ in order to obtain a finite set of delays to consider, again with imprecision.

Order relation between traces

The information from the different p-runs explored, which allows the permissiveness to be compared, is stored in traces. A trace is either:

A sequence of tuples of the form (s, I, δ), where s is a configuration, I an interval, and δ a delay. The permissiveness of such trace is the size of the smallest intervals of this sequence. The permissiveness of a trace where this sequence is empty is infinite.

An object called Empty trace, which corresponds to an initial trace.

The comparison function, called compare_trace applies to a current trace, denoted current_trace, and compares it with another trace, denoted another_trace and returns:

A positive value if another_trace is the empty trace. This establishes a simple way to compare traces. We will say that current_trace if greater (resp. smaller) than another_trace if this function returns a positive (resp. negative) value. Intuitively, the role of the empty trace is a placeholder to be replaced as soon as it is compared.

Backtracking on the intervals

Our main function is the interval backtrack, called backtrack_interval, which explores the sampled intervals and then calls the delay backtrack function, called backtrack_delay, on each interval. Here we present the pseudo code of the backtrack_interval in Algorithm 3.

Conclusion and future work

In this subsection, we presented a forward algorithm that, given a fixed configuration, computes a trace whose permissiveness is an approximative value of the permissiveness of the configuration. It optimises the strategies of the player and the opponent, up to a precision. This algorithm runs in time

where T is the maximal number of transitions in the timed automaton, n the number of clocks, s := min (s δ , s I ) the minimum of the two sampling steps used for respectively intervals and delays and B := max

We then presented its Python implementation, explained our choices and our runtime and precision results for some examples. The main difference with our symbolic algorithm presented in Chapter 5 is that we do not have an a priori knowledge of the strategy of the player and the opponent, except for the strategy of the opponent for linear timed automata. We also compute the permissiveness for a fixed configuration, whereas the symbolic algorithm presented in Chapter 5 computes it for an arbitrary configuration. As our forward algorithm can be run with no a priori knowledge on the strategy of the players or of the opponent, it can be extended to timed automata where we have no knowledge on the player or the opponent optimal strategies. The disadvantages of this approach is that only an approximate value is obtained. A major future work is studying the precision of our algorithm.

Other future works on this implementation could first focus to extend the models of timed automata supported by our tool. For example, we can extend the guards implementation, currently implemented as classical guards, to polyhedral guards, using a polyhedral library as Parma Polyhedral Library. Second future work could be to study the behaviour of cycles.

In the next section, we will present our implementation of the symbolic approach and compare the runtime results with the one of the forward numerical approach, for linear timed automata.

Symbolic backward approach

We now present the implementation of the backward approach to compute permissiveness. The algorithm of this approach was presented in Chapter 5 and here we describe its

Principle of the algorithm

The goal of the algorithm, presented in Chapter 5, is to compute the exact value of the permissiveness function for any location in an acyclic timed automaton. We recall in this subsection the main steps of this algorithm, the full version being presented in Section 5.1. Our implementation only supports linear timed automata with polyhedral guards, but one of the main future works is to extend it to acyclic timed automata, as the algorithm in Chapter 5 can tackle them.

The main steps of the algorithm are summarised in Figure 5. 2. The algorithm computes the permissiveness function with a backward explorer: the permissiveness of the goal locations is first computed by computing P 0 , then the permissiveness of its successors by computing P 1 , ...

When computing P i of location , v → P i-1 ( , v) is a continuous piecewise affine function, where is the successor of . Let us consider the tiling of polyhedra (h i ) i of v → P i-1 ( , v). Let h α , h β be two arbitrary polyhedra of (h i ) i . Then, we compute:

1. The set of valuations v such that there exists an enabled p-move ([α, β] , a) where 5.2a). We denote it S (hα,h β ) .

The set of enabled delays I v

α and I v β as function of v (see Figure 5.2b).

3. Finally, the optimal bounds of the intervals to choose in these sets of enabled delays (see Figure 5.2c).

After having computed the optimal α and β for each couple (h α , h β ), we compute the resulting permissiveness for each couple (h α , h β ) and compute the maximum of all these permissiveness among all the possible couples. The resulting function is the permissiveness function.

Issues and implementation choices

In this subsection, we develop the implementation choices we did. In terms of technical aspects, the implementation uses:

A representation of timed automata with polyhedral guards.

A representation of piecewise affine functions with coefficients in Q ∪ {+∞}.

The minimisation, maximisation of piecewise affine functions.

Chapter 7

LEVELLED AND BINARY PERMISSIVENESS: COMPUTING THE PERMISSIVENESS WITH THRESHOLD(S)

The algorithm we presented in Chapter 5 gives an exact computation of the permissiveness function. It enables us to compute the strategy of the player for any location and for any valuation. However, we proved that this algorithm can be executed in at most in non-elementary time for acyclic timed automata. This might be an very pessimistic upper-bound but we implemented this algorithm for linear timed automata and the experimental results presented in Chapter 6 show a fairly long runtime. The complexity of our algorithm depends in the number of cells of the computed permissiveness functions. Therefore, our goal to improve our approach is to reduce the number of cells that have to be considered.

Let us first remark that our implementation, presented in Chapter 6, suffers from over-tiling, which significantly increases the runtime. However, our methods for reducing this over-tiling are costly, as they require the computation of the convex hull of the union of several polyhedra. Our best way to reduce the complexity of our algorithm is to reduce this number of cells.

To reduce the number of cells, our first attempt was to consider a numerical approach, that computes an approximate value of the permissiveness function of a fixed configuration. We presented its algorithm and implementation in Section 6. 1. The issue of this algorithm is the lack of proof of its precision. We did not manage to compute a bound of the error we make by approximating the permissiveness function.

Therefore, in this chapter, we propose an approximate approach that controls, by definition, the precision of our permissiveness computation. It will also have the advantage, unlike the numerical approach, of computing the approximate permissiveness value for any configuration, as did the symbolic approach in Chapter 5.

Lemma 7.6

Let A be a linear timed automaton with n clocks, i > 0, ∈ Q f be a location, its successors and p be a threshold. Then:

Proof of Lemma 7. 6. Suppose now that i > 0. p-moves ( , v) = ∅ if there exists an enabled move (δ, a) to reach the configuration ( , v + δ [C r ← 0]). If such move exists, then:

, we have to compute the set of configurations ( , v) such that there exists a p-move ([α, β] , a) such that:

The second proposition is equivalent to: for any δ ∈ [α, β], δ ∈ S i-1 (p, ). As a result we can simplify the expression of S i (p, ) as follows:

As S i-1 (p, ) is a polyhedron, it is a convex set so we only have to check the membership

Let g be the polyhedral guard of the transition between and . A valuation satisfies g if it belong to its associated polyhedron, which is a convex set. Similarly S i-1 (p, ) is a function for any arbitrary valuation). The first one computes the binary permissiveness function, that values 1 with the permissiveness function is greater than a threshold. The algorithm we proposed can be executed in double exponential time (in O (4c g ) 2 d time).

The second one computes the levelled permissiveness function: this function is a step function with m + 1 thresholds and it computes between which couple of thresholds the permissiveness function is. The main advantage of this approach is its control of the precision and the complexity of its algorithm. Indeed, when stating that the permissiveness is between two threshold p i and p i+1 , the approximation we make is at most p i+1 -p i .

In addition, our algorithm to compute the levelled function is linear with respect to the number of thresholds so adding precision is not the most costly part of the algorithm.

The algorithm to compute the levelled function can be executed in double exponential time too (in

Nevertheless, we could only propose an algorithm for linear timed automata. Interesting future works would be to extend our approach to acyclic and more general timed automata, and to implement our work in Python with pplpy.

CONCLUSION

In this thesis, we studied the robustness of reachability of timed automata under perturbations of delays. The timed automata we studied take two forms: one with classical guards and one with polyhedral guards, a more general case. The aim of this thesis is to compute the permissiveness of a timed automaton for arbitrary or fixed configuration. The permissiveness computes the maximal imprecision on delays that can be admitted while reaching a goal location of the timed automaton. We define our semantics with a turn-based game with a player that aims to maximise the enabled imprecision and an opponent that aims to minimise it.

We had several approaches in this thesis, that we will detail further in the following paragraphs. We first symbolically compute the exact permissiveness of any location and valuation of a timed automaton. Faced with fairly high time complexity results, we looked at ways to simplify our problem and the algorithms used. We proposed two approaches. The first one was to compute an approximate value of the permissiveness function, for a fixed configuration. The second one was to simplify the computed function, in order to minimise the size of the parameters which make our complexity grow. This conclusion chapter is organised as follows: we first summarise the contributions we have made and then expose the current and future works that can improve our current work.

Contributions A first exact algorithm: permissiveness algorithm

The first algorithm we propose is a backward symbolic algorithm that computes the permissiveness function. The principle is to compute optimal strategies for the player and the opponent. The algorithm we proposed covers the cases of linear and acyclic timed automata and games. Nevertheless, the worst-case complexity we provided was non-elementary time for acyclic timed automata. The complexity depends on the maximal number of inequalities of guards and grows with the number of cells used to represent our permissiveness as piecewise affine functions. In order to give a proof-of-concept and

Conclusion and comparison

These three approaches cover different types of timed automata. The implementations provided only cover linear timed automata. They are summed up in the Table 7. 1. The second column specifies if our algorithm computes the permissiveness for a fixed configuration ('Numeric') or for all possible configurations ('Symbolic'). The third column specifies if the result is an exact result or an approximation. The fourth and sixth columns specify respectively if the algorithm covers the case of linear or acyclic timed automaton, and the fifth and seventh columns indicate if these cases were implemented.

Algorithm

Type Exact Linear Impl

Ongoing and future work

Our current work can be extended in several ways. We will explain in this section what are our ongoing and future works for each contribution.

UML GRAPHS

In this appendix, we represent the UML graphs of the methods of each classes used in the implementations presented in Chapter 6. In section A.1 and A.2 we respectively present the methods of the classes used in the numerical implementation, presented in Section 6.1, and the symbolic implementation, presented in Section 6.2.

A.1 UML graphs of the numerical implementation