Playing Games with Timed Games,

Transcription

1 Plying Gmes with Timed Gmes, Thoms Chtin Alexndre Dvid Kim G. Lrsen LSV, ENS Cchn, CNRS, Frnce (emil: Deprtment of Computer Science, Alborg University, Denmrk (emil: Abstrct: In this pper we focus on property-preserving preorders between timed gme utomt nd their ppliction to control of prtilly observble systems. Following the exmple of timed simultion between timed utomt, we define timed lternting simultion s preorder between timed gme utomt, which preserves controllbility. We define method to reduce the timed lternting simultion problem to sfety gme. We show how timed lternting simultion cn be used to control efficiently prtilly observble system. This method is illustrted by generic cse study. Keywords: Timed utomt, timed gmes, simultion, Uppl, forml verifiction tool. 1. INTRODUCTION Since the introduction of timed utomt the technology nd tool support (Lrsen et l., 1997; Bozg et l., 1998) for model-checking nd nlysis of timed utomt bsed formlisms hve reched level mture enough for industril pplictions s witnessed by lrge number of cse studies. Most recently, efficient on-the-fly lgorithms for solving rechbility nd sfety gmes bsed on timed gme utomt hve been put forwrd (Cssez et l., 2005) nd mde vilble within the tool Uppl-Tig. The tool hs been recently used in n industril cse study (Jessen et l., 2007) with the compny Skov A/S for synthesizing climte control progrms for modern pig stbles. Despite this success, the stte-spce explosion problem is relity preventing the tools to scle up to rbitrrily lrge nd complex systems. Wht is needed re complementry techniques llowing for the verifiction nd nlysis efforts to be crried out on suitble bstrctions. Assume tht S is timed (gme) utomton, nd ssume tht φ is property to be estblished (solved) for S. Now S my be timed utomton too complex for our verifiction tool to settle the property φ, or S my be timed gme utomton with number of unobservble fetures tht cn not be exploited in ny relizble strtegy for solving the gme. The gol of bstrction is to replce the complex (or unobservble) model S with n bstrct timed (gme) utomton A being smller in size, less complex nd fully observble. This method requires the user not only to supply the bstrction but lso to rgue tht the bstrction is correct in the sense tht ll relevnt properties estblished (controllble) for A lso hold for S; i.e. it should be estblished tht S A for some property-preserving reltionship between timed (gme) utomt. A long version of this pper cn be found in (Chtin et l., 2008) This work hs been supported by the EC FP7 under grnt numbers INFSO-ICT (Multiform nd ICT (Qusimodo nd the VKR Center of Excellence MT-LAB ( The possible choices for the preorder obviously depend hevily on the clss of properties to be preserved s well s the underlying modelling formlism. In this pper we introduce the logic ATCTL being universl frgment of the rel-time logic TCTL (Alur et l., 1993) (with propositions both on sttes nd events). We introduce the notions of strong nd wek lternting timed simultion between timed gme utomt. These reltions re proved to preserve controllbility with respect to ATCTL. As min results of the pper we show how strong nd wek timed lternting simultion problems my be reduced to sfety gmes for suitbly constructed products of timed gme utomt. These constructions llow the use of Uppl-Tig to provide direct tool support for checking preorders between timed gme utomt. Finlly, we show how timed lternting simultion cn be used to control efficiently prtilly observble system. This method is illustrted by generic cse study: We pply our construction for timed lternting simultion to synthesize control progrms for scenrio where the move of box on conveyor belt is prtilly observble. We compre experimentl results obtined by two different methods for this problem, one method using our wek lternting timed simultion preorder. Relted work. Decidbility for timed (bi)simultion between timed utomt ws given in (Cerns, 1992) using product region construction. This technique provided the computtionl bsis of the tool Epsilon (Cerns et l., 1993). In (Weise nd Lenzkes, 1997) zone-bsed lgorithm for checking (wek) timed bisimultion nd hence not suffering the region-explosion in Epsilon ws proposed though never implemented. For fully observble nd deterministic bstrct models timed simultion my be reduced to rechbility problem of S in the context of suitbly constructed testing utomton monitoring tht the behvior exhibited is within the bounds of A (Jensen et l., 2000). Alternting temporl logics were introduced

2 in (Alur et l., 1997) nd lternting simultion between finite-stte systems ws introduced in (Alur et l., 1998). In this pper we offer to our knowledge the first timed extension of lternting simultion. The ppliction of our method using wek lternting simultion for the problem of timed control under prtil observbility improves the direct method proposed in (Cssez et l., 2007) 2. TIMED GAMES AND PRELIMINARIES 2.1 Timed Automt Let X be finite set of rel-vlued vribles clled clocks. We note C(X) the set of constrints ϕ generted by the grmmr: ϕ ::= x k x y k ϕ ϕ where k Z, x,y X nd {<,,=,>, }. B(X) is the subset of C(X) tht uses only rectngulr constrints of the form x k. A vlution of the vribles in X is mpping v : X R 0. We write 0 for the vlution tht ssigns 0 to ech clock. For Y X, we denote by v[y ] the vlution ssigning 0 (resp. v(x)) for ny x Y (resp. x X \ Y ). We denote v + for R 0 the vlution s.t. for ll x X, (v + )(x) = v(x) +. For g C(X) nd v R X 0, we write v = g if v stisfies g nd [[g]] denotes the set of vlutions {v R X 0 v = g}. Definition 1. A Timed Automton (TA) (Alur nd Dill, 1994) is tuple A = (L,l 0,Σ,X,E,Inv) where L is finite set of loctions, l 0 L is the initil loction, Σ is the set of ctions, X is finite set of rel-vlued clocks, Inv : L B(X) ssocites to ech loction its invrint nd E L B(X) Σ 2 X L is finite set of trnsitions, where t = (l,g,,r,l ) E represents trnsition from the loction l to l, lbeled by, with the gurd g, tht resets the clocks in R. One specil lbel τ is used to code the fct tht trnsition is not observble. A stte of TA is pir (l,v) L R X 0 tht consists of discrete prt nd vlution of the clocks. From stte (l,v) L R X 0 s.t. v = Inv(l), TA cn either let time progress or do discrete trnsition nd rech new stte. This is defined by the trnsition reltion built s follows: for Σ, (l,v) (l,v ) if there exists g,,y trnsition l l in E s.t. v = g, v = v[y ] nd v = Inv(l ); for 0, (l,v) (l,v ) if v = v + nd v,v [[Inv(l)]]. Thus the semntics of TA is the lbeled trnsition system S A = (Q,q 0, ) where Q = L R X 0, q 0 = (l 0,0) nd the set of lbels is Σ R 0. A run of timed utomton A is sequence q 1 t 0 1 q1 q 2 1 t q 2 2 q 2... of lternting time nd discrete trnsitions in S A. We use Runs((l,v),A) for the set of runs tht strt in (l,v). We write Runs(A) for Runs((l 0,0),A). If ρ is finite run we denote lst(ρ) the lst stte of the run nd Durtion(ρ) the totl elpsed time ll long the run. Definition 2. We define inductively the observtion ssocited to run ρ s the (possibly infinite) word Obs(ρ) over the lphbet Σ R defined s: Obs(( 1,t 1, 2,t 2,...)) def = ( i 1 i=1 i,t i1, i 2 i=i 1+1 i,t i2, i 3 i=i 2+1 i,t i3,...), where i 1 < i 2 <... re the indices of the observble trnsitions: Assumptions. We ssume tht: 1) every infinite run contins infinitely mny observble trnsitions; 2) from every stte, either dely ction with positive durtion or controllble ction cn occur. 2.2 ATCTL In this rticle, we consider universl frgment ATCTL of the rel-time logic TCTL (Alur et l., 1993) with propositions both on sttes nd ctions. Definition 3. A formul of ATCTL is either A φ 1 U φ 2 or A φ 1 W φ 2, where A denotes the quntifier for ll pth nd U (resp. W) denotes the temporl opertor until (resp. wek until ), the φ i s re pirs (φ s i,φλ i ) nd φs i (resp. φ λ i ) is set of sttes (resp. observble ctions). A run ρ of timed utomton A stisfies φ 1 U φ 2 iff there exists prefix ρ of ρ such tht: 1) only ctions of φ λ 1 occur in ρ nd 2) ll the sttes reched during the execution of ρ re in φ s 1 φ s 2 nd 3) either lst(ρ ) φ s 2 or the lst ction of ρ is in φ λ 2. Then we write ρ = φ 1 U φ 2. A run ρ of timed utomton A stisfies φ 1 W φ 2 iff either it stisfies φ 1 U φ 2 or only ctions of φ λ 1 occur in ρ nd ll the sttes reched during the execution of ρ re in φ s 1. Then we write ρ = φ 1 W φ 2. When ll the runs of timed utomton A stisfy property φ, we write A = A φ. We define lso the frgment ATCTL λ of ATCTL where only ctions re considered: the formuls of ATCTL λ re only the formuls A φ 1 Uφ 2 nd A φ 1 Wφ 2 where φ s 1 = L R X 0 nd φs 2 =. 2.3 Timed Gmes Definition 4. A Timed Gme Automton (TGA) (Mler et l., 1995) is timed utomton G with its set of trnsitions E prtitioned into controllble (E c ) nd uncontrollble (E u ) ctions. We ssume tht controllble trnsition nd n uncontrollble trnsition never shre the sme observble lbel. In ddition, invrints re restricted to Inv : L B (X) where B is the subset of B using constrints of the form x k. Given TGA G nd control property φ A φ 1 U φ 2 (resp. A φ 1 Wφ 2 ) of ATCTL, the rechbility (resp. sfety) control problem consists in finding strtegy f for the controller such tht ll the runs of G supervised by f stisfy the formul. By the gme (G,φ) we refer to the control problem for G nd φ. The forml definition of the control problems is bsed on the definitions of strtegies nd outcomes. In ny given sitution, the strtegies suggest to do prticulr ction fter given dely. A strtegy (Mler et l., 1995) is described by function tht during the course of the gme constntly gives informtion s to wht the plyers wnt to do, under the form of pir (,e) (R 0 E) {(, )}. (, ) mens tht the strtegy wnts to dely forever. The environment hs priority when choosing its ctions: if the controller nd the environment wnt to ply t the sme time, the environment ctully plys. In ddition, the environment cn decide not to tke ction if n invrint requires to leve stte nd the controller cn do so.

3 Assumption. A specil cse occurs in sttes in sttes where n invrint expires nd only n uncontrollble trnsition is possible. It is nturl to force such trnsition but this would complicte this pper significntly. To keep redbility, we consider models without this cse. Definition 5. Let G = (L,l 0,Σ,X,E,Inv) be TGA. A strtegy over G for the controller (resp. the environment) is function f from the set of runs Runs((l 0,0),G) to (R 0 E c ) {(, )} (resp. (R 0 E u ) {(, )}). We denote ((ρ),e(ρ)) def = f(ρ) nd we require tht for every run ρ leding to stte q, if (ρ) = 0 then the trnsition e(ρ) is possible from q. for ll (ρ), witing time units fter ρ is possible nd the ugmented run ρ = ρ (busing nottions) stisfies: f(ρ ) = ((ρ),e(ρ)). Furthermore, the controller is forced to ply if n invrint expires, (nd, by ssumption it cn lwys ply). This cn be specified s follows: if no positive dely is possible from q, then the strtegy of the controller stisfies (ρ) = 0. The restricted behvior of TGA when the controller plys strtegy f c nd the opponent plys strtegy f u is defined by the notion of outcome 1. The proposed notions of strtegies nd outcome re similr to the setting of symmetric concurrent gmes in de Alfro et l. (2003). Definition 6. Let G = (L,l 0, Σ,X,E,Inv) be TGA nd f c, resp. f u, strtegy over G for the controller, resp. the environment. The outcome Outcome(q,f c,f u ) from q in G is the (possibly infinite) mximl run ρ = (ρ 0,...,ρ i,...) such tht for every i N (or 0 i < ρ 2 for finite runs), ρ 2i = min{ { c (ρ 0,...,ρ 2i 1 ), u (ρ 0,...,ρ 2i 1 )} eu (ρ ρ 2i+1 = 0,...,ρ 2i ) if u (ρ 0,...,ρ 2i ) = 0 e c (ρ 0,...,ρ 2i ) otherwise A strtegy f c for the controller is winning in the gme (A, A φ) if for every f u, Outcome(q 0,f c,f u ) stisfies φ. We sy tht formul φ is controllble in A, nd we write A = c : A φ, if there exists winning strtegy for the gme (A, A φ). 3. PLAYING GAMES WITH TIMED GAMES In this section we let A nd B be two timed gme utomt. We wnt to find conditions tht ensure tht ny property of ATCTL λ tht is controllble in B is lso controllble in A. In the context of model-checking, simultion reltions llow us to verify some properties of concrete model using more bstrct version of the model, fter checking tht the bstrct model (wekly) simultes the concrete one. Here we re considering the more generl problem of controller synthesis: Some ctions re controllble (the models A nd B re TGA) nd we wnt to use n bstrction of the model to build controllers for some properties of the concrete model. For this we define two lternting simultion reltions ( strong one s nd wek one w ), such tht if A s B or A w B, then ny property of ATCTL λ tht is controllble in B is lso controllble in A. Moreover, the (wek) lternting 1 Unlike other ppers, we define here one single mximl run for ech (q, f c, f u) insted of the set of possible runs for (q, f c). simultion reltion cn be used to build the controller (or the winning strtegy) for A. 3.1 Strong Alternting Simultion In this section we ssume tht ll the trnsitions of the timed gmes re observble. We define lternting simultion reltions s reltions R between the sttes of A nd those of B such tht if (q A,q B ) R, then every property tht is controllble in B from q B is lso controllble in A from q A. Thus every controllble trnsition tht cn be tken from q B must be mtched by n eqully lbeled controllble trnsition from q A. And on the other hnd, every uncontrollble trnsition in A tends to mke A hrder to control thn B; then we require tht it is mtched by n eqully lbeled uncontrollble trnsition in B. Progress of time. We hve to check tht if the controller of B is ble to void plying ny ction during given dely, then the controller of A is ble to do the sme. To understnd why this is required, think of control property where the gol is simply to rech given time without plying ny observble ction, unless the environment plys n uncontrollble ction. If the controller of B is ble to wit, then it hs winning strtegy for this property. So the controller of A must be ble to win too. Symmetriclly, we should in principle check tht if the environment of A is ble to void plying during given dely, then the environment of B is ble to do the sme. Actully this property does not need to be checked since, by ssumption, the environment is never forced to ply. Definition 7. A strong lternting simultion reltion between two TGAs A nd B is reltion R Q A Q B such tht (q 0A,q 0B ) R nd for every (q A,q B ) R: (q B c q B ) = q A (q A u q A ) = q B (q B q B ) = q A (q A c q A (q A,q B ) R) (q B u q B (q A,q B ) R) (q A q A (q A,q B ) R) We write A s B if there exists strong lternting simultion reltion between A nd B. Theorem 1. If A nd B re two timed gmes such tht A s B, then for every formul A φ ATCTL λ, if B = c : A φ, then A = c : A φ. 3.2 Strong Alternting Simultion s Timed Gme In this section we show how to build timed gme Gme s (A,B) such tht A s B iff the controller hs winning strtegy. For simplicity we ssume tht A nd B shre no clock, h is free clock, nd the lbels used by controllble trnsitions of one timed gme re not used by ny uncontrollble trnsition of the other timed gme. Intuition Behind the Construction of Gme s (A,B). In order to check the existence of strong lternting simultion reltion between A nd B, we build gme tht consists in simulting the timed gmes A nd B simultneously, with the ide tht t ech time they re in sttes q A nd q B such tht (q A,q B ) R if there exists n lternting simultion reltion R between A nd B. More precisely, the controller of Gme s (A,B) tries to keep the gmes A nd B in sttes q A nd q B such tht (q A,q B ) R.

4 On the other hnd, the environment of Gme s (A,B) tries to show tht this is not lwys possible. For this it shows tht one of the implictions in Definition 7 does not hold from the current pir of sttes (q A,q B ). The wy of doing this depends on the kind of impliction tht is considered. For the first two implictions, the technique is the following: The environment plys one trnsition corresponding to the left hnd side of the impliction, nd chllenges the controller of Gme s (A,B) to ply trnsition corresponding to the right hnd side, tht imittes the trnsition plyed by the environment of Gme s (A,B). Therefore ll the controllble trnsitions of A nd the uncontrollble trnsitions of B become controllble in Gme s (A,B); nd the uncontrollble trnsitions of A nd the controllble trnsitions of B become uncontrollble in Gme s (A,B). We use the lbels to show which trnsitions re controllble (c) nd uncontrollble (u). The ide is to use vrible l to store the lst ction plyed by A, when A hs plyed nd B hs not imitted it yet. As soon s the ction of A hs been imitted by B, l is set to the vlue τ. As we did not present model with vribles in this rticle, we define the TGA by duplicting the sttes ccording to the possible vlues for l. But in rel-time context, we wnt to check tht the ctions re immeditely imitted. Moreover the gme must be plyed such tht every ply corresponds to vlid runs of A nd B. This implies tht the time constrints of A nd B re stisfied. For this reson we keep the clocks of A nd B nd we dd one clock h (ssumed to be different from those in A nd B). h is used to check tht the ctions re immeditely imitted: When the environment of Gme s (A,B) plys, h is reset, nd s soon s h > 0 nd l τ (i.e. the controller of Gme s (A,B) hs not plyed), the controller of Gme s (A,B) loses. Finlly, when the environment wnts to show tht the third impliction of Definition 7 does not hold, it simply wits until the invrint of q A expires. Of course, during this time, the invrint of q B must hold. This mounts to check tht for every ply, the corresponding runs of A nd B respect the invrints. Copying simply the invrints in the gme would not give the expected result: When n invrint of A expires, the environment would hve the freedom of forcing the controller to tke trnsition of B, which is not wht we wnt. Insted, we remove ll the invrints from the model nd tke them into ccount into the winning condition. If the invrint of Invst A of A (resp. Invst B of B) is not stisfied, then the controller (resp. the environment) loses the gme. Definition 8. The TGA of Gme s (A,B) is defined s (L,l 0, {u,c},x,e,inv) where L = L A L B (Σ {τ}), l 0 = (l 0A,l 0B,τ), X = X A X B {h}, Inv = true nd E = {((l A, l B, τ), g, u, R {h}, (l A, l B, )) (l A, g,, R, l A ) Eu A } {((l A, l B, τ), g, u, R {h}, (l A, l B, )) (l B, g,, R, l B ) Ec B } {((l A, l B, ), g, c, R, (l A, l B, τ)) (l A, g,, R, l A ) Ec A } {((l A, l B, ), g, c, R, (l A, l B, τ)) (l B, g,, R, l B ) Eu B } If the current stte of Gme s (A,B) is denoted ((l A,l B,l), v), the control property is the following: { } { } InvstA InvstB A W l τ = v(h) = 0 l τ = v(h) = 0 L1 L2 z>=1 z=0 b L3 y>=1 x=0 y=0 L5 x<=2 Fig. 1. Two timed gme utomt, where the trnsitions lbeled by re uncontrollble. Theorem 2. A s B iff B hs winning strtegy in the timed gme Gme s (A,B). 3.3 Wek Alternting Simultion As it is often the cse tht only observble ctions re of interest, we define wek reltion where only the observble behvior of the utomt is tken into ccount. We present here simple version of wek lternting simultion, where the use of unobservble controllble trnsitions of A nd unobservble uncontrollble trnsitions of B is restricted. Other choices re possible, but they usully mke the definition of wek lternting simultion nd/or its coding s timed gme very tricky. 2 Definition 9. A wek lternting simultion reltion between two TGAs A nd B is reltion R Q A Q B such tht (q 0A,q 0B ) R nd for every (q A,q B ) R: (q B c q B ) q A (q A c q A (q A,q B ) R) (q A u q A ) q B (q B u q B (q A,q B ) R) (q B q B ) q A (q { A q A (q A,q B ) R) τ (q B c q B ) (qa,q B ) R q A (q τ { A c q A (q A,q B ) R) τ (q (q A u q A ) A,q B ) R q B (q τ B u q B (q A,q B ) R) We write A w B if there exists wek lternting simultion reltion between A nd B. Remrk tht wek lternting simultion is lrger thn strong lternting simultion nd tht if A nd B re fully observble, then wek lternting simultion nd strong lternting simultion coincide. In Fig. 1 we show two timed gme utomt (denote A the one on the left nd B the one on the right) where the trnsitions lbeled by re uncontrollble. The other trnsitions re controllble, some lbeled by b, some unobservble. We hve A w B. Intuitively, the reson is tht the controller hs more freedom in A thn in B, becuse only one ction b is possible in B; but the environment of B cn lwys imitte the ctions of the environment of A. Theorem 3. If A nd B re two timed gmes such tht A w B, then for every formul A φ ATCTL λ, if B = c : A φ, then A = c : A φ. 2 For exmple, simply llowing n observble controllble trnsition to be imitted by sequence mde of n unobservble controllble trnsition τ followed by controllble poses the following problem: We must check tht the environment hs no possible ction from the intermedite stte, so tht it cnnot prevent the second ction from occurring. b L4

5 3.4 Wek Alternting Simultion s Timed Gme In this section we dpt the contruction of Section 3.2 to the cse of wek lternting simultion. The symbols τ c nd τ u re used to code the situtions where the environment of Gme w (A,B) hs plyed n unobservble ction. This ction corresponds either to n unobservble uncontrollble ction of A (in which cse the symbol τ u is used), or to n unobservble controllble ction of B (in which cse the symbol τ c is used. As well s in the coding of strong lternting simultion, the symbol τ codes the situtions where ll the uncontrollble ctions of A nd ll the controllble ctions of B hve been imitted. The trnsitions of Gme w (A,B) (see the construction of E in Definition 10) re: those corresponding to the observble trnsitions (lines 1 to 4), similr to those in Definition 8; the unobservble trnsitions plyed by the environment of Gme w (A,B) (lines 5 nd 6); the trnsitions tht the controller of Gme w (A,B) tkes fter the environment hs plyed n unobservble trnsition (lines 7 to 10). They re of two kinds, corresponding to the disjunctions tht pper t the right of the lst two implictions in Definition 9: The controller of Gme w (A,B) hs the choice to tke zero or one unobservble ction. Definition 10. The TGA of Gme w (A,B) is defined s (L,l 0, {u,c},x,e,inv) where L = L A L B (Σ {τ c,τ u,τ}), l 0 = (l 0A,l 0B,τ), X = X A X B {h}, Inv = true nd E = {((l A, l B, τ), g, u, R {h}, (l A, l B, )) (l A, g,, R, l A ) Eu A τ} {((l A, l B, τ), g, u, R {h}, (l A, l B, )) (l B, g,, R, l B ) Ec B τ} {((l A, l B, ), g, c, R, (l A, l B, τ)) (l A, g,, R, l A ) Ec A τ} {((l A, l B, ), g, c, R, (l A, l B, τ)) (l B, g,, R, l B ) Eu B τ} {((l A, l B, τ), g, u, R {h}, (l A, l B, τ u)) (l A, g, τ, R, l A ) Eu A } {((l A, l B, τ), g, u, R {h}, (l A, l B, τc)) (l B, g, τ, R, l B ) Ec B } {((l A, l B, τ c), g, c, R, (l A, l B, τ)) (l A, g, τ, R, l A ) Ec A } {((l A, l B, τ u), g, c, R, (l A, l B, τ)) (l B, g, τ, R, l B ) Eu B } {((l A, l B, τ c),true, c,, (l A, l B, τ)) l A L A l B L B } {((l A, l B, τ u),true, c,, (l A, l B, τ)) l A L A l B L B } The control property is the sme s in Definition 8. Theorem 4. A w B iff B hs winning strtegy in the timed gme Gme w (A,B). 4. CONTROL UNDER PARTIAL OBSERVABILITY In (Cssez et l., 2007) we gve n on-the-fly lgorithm to solve the problem of timed controllbility under prtil observbility. The generl setup is the sme s in Section 2 where the controller nd the environment re competing for ctions. But in ddition, controller hs only imperfect or prtil informtion on the stte of the system (tht includes the environment), given in terms of finite number of observtions, tht re triggered either when discrete ction is plyed or when some clock reches given vlue. The controller cn only use such observtions to distinguish sttes nd bse its strtegy on. According to these rules, controllble ction is plyed until the observtion chnges. Therefore we re interested in strtegies where the ctions re chnged only when the observtion chnges. Such strtegies re clled observtion pos < N x := 0, pos++ x <= 1 x := 0 x > 0 Redy Win x >= N+3 Lose x > N+1 Win x >= N+3 Lose Fig. 2. Concrete (left) nd bstrct (right) model of box. bsed stuttering invrint strtegies (OBSI). A winning OBSI strtegy is such tht it leds to winning observtion whtever the environment chooses. The winning condition is given s prticulr observtion. The lgorithm presented in (Cssez et l., 2007) tht solves this problem is bsed on constructing sets of symbolic sttes ( l,z) with l being the discrete prt nd Z zone. The importnt point in the explortion lgorithm tht explins the experimentl results is tht the explortion is done by computing successors of sets of such sttes ccording to given ction σ until the current observtion chnges. The resulting spce-spce is prtitioned by the combintions of the observtions (exponentil), the number of sets of symbolic sttes is exponentil in function of the number of symbolic sttes, nd the number of sttes is itself exponentil in the number of clocks. 4.1 Exmple of Use of Alternting Simultion for Timed Control under Prtil Observbility In this cse-study, box is plced on moving conveyor belt to rech plce where it will be filled. The box hs to go through number of steps, tht is prmeter N in the model. Ech step tkes vrible durtion (0 to 1 time unit); consequently, the exct time when the box rrives in the stte Redy is unknown. And the box might sty only N + 3 time units in the stte Redy. Figure 2 (left prt) shows model of the system s timed gme utomton. The loop represents the progress on the conveyor belt, incrementing the vrible pos, which represents the position on the belt. Thus the chllenge for the controller is to fill the box while it is in the stteredy. This would be esy if the controller observes the progress of the box on the conveyor belt. But we ssume precisely tht this is not the cse. Then the controller hs to fill the box t time where it is sure tht the box is in the stte Redy, however the box hs progressed on the conveyor belt. Now, using the control formul: c : A Win (where is the temporl opertor eventully, φ is shorthnd for true U φ), Uppl-Tig llows us to generte controller which will fill the box while it is in the stte Redy. However, the strtegy synthesized is bsed on full informtion, including the position of the box on the conveyor belt. In our context, this informtion is not vilble for the controller. We therefore introduce fully observble, bstrct model, shown in Figure 2 (right). Agin we use Uppl-Tig to check for controllbility. To gurntee tht the strtegy obtined from this bstrct model lso correctly controls our originl concrete model we use Uppl-Tig to estblish wek, timed lternting simultion between the two models using the technique presented in Section 3.

6 simultion N symbolic time sttes (seconds) Tble 1. Experimentl results prtil observbility N sets of time symbolic (seconds) sttes Actully, in order to tret this cse-study, we hd to use more generl simultion reltion thn the one presented in this pper: Indeed, the bstrct model does not fit the requirement tht controllble trnsition cn fire when n invrint expires. This cse requires quite tricky constructions tht we did not detil in this pper. 4.2 Experimentl Results We compre two methods for checking the controllbility of our property. Tble 1 shows the number of explored symbolic sttes nd the execution time obtined experimentlly. The first method is bsed on our simultion technique. The second method uses n implementtion in Ruby of the lgorithm presented in (Cssez et l., 2007) tht solves directly the control problem under prtil observbility. Beyond the fct tht the Ruby code is interpreted nd slow, we see clerly tht its execution time grows s n exponentil of N. In contrst the time required for checking the simultion reltion using Uppl-Tig is qudrtic. The number of symbolic sttes explored by our simultion-bsed method is liner, while the first method for prtil observbility explores qudrtic number of sets of symbolic sttes. In our exmple we hve the observtion y [0,1) for clock y tht belongs. This hs the effect of cutting zones down to regions in prctice. In ddition, those regions cn combine nd define different sets of symbolic sttes, which is exponentil. This exponentil shows up only in time nd not in spce. This is due to on-the-fly inclusion checks tht remove sets, hence they do not pper t the end. We note tht the inclusion check between two sets of sttes is more complex thn ordinry inclusion check between two zones. This behviour is similr to determiniztion of nondeterministic utomt tht cn give such combintoril blow-ups. 5. CONCLUSION We hve defined strong nd wek lternting timed simultion between timed gme utomt nd shown tht these reltions preserve controllbility w.r.t. ATCTL λ. Moreover we hve proposed coding of the strong nd wek lternting simultion problems s timed gmes. Any winning strtegy of the timed gme cn be used to build the wek lternting timed simultion reltion nd vice vers. We hve shown how lternting timed simultion reltions cn be used to control efficiently prtilly observble systems. We used our tool Uppl-Tig to solve the timed gmes generted from generic cse-study. Though focus in this pper is on timed (wek) lternting simultion preorders the given constructions my be dpted to support the checking of other timed preorders, including redy simultion preorder nd (wek) bisimultion. Also our constructions were designed so tht it is stritforwrd to ddpt them to preorders between networks of timed gme utomt. REFERENCES Alur, R., Courcoubetis, C., nd Dill, D.L. (1993). Modelchecking in dense rel-time. Inf. Comput., 104(1), Alur, R. nd Dill, D. (1994). A theory of timed utomt. Theoreticl Computer Science, 126(2), Alur, R., Henzinger, T.A., nd Kupfermn, O. (1997). Alternting-time temporl logic. In FOCS, Alur, R., Henzinger, T.A., Kupfermn, O., nd Vrdi, M.Y. (1998). Alternting refinement reltions. In CONCUR, volume 1466 of LNCS, Springer. Bozg, M., Dws, C., Mler, O., Olivero, A., Tripkis, S., nd Yovine, S. (1998). Kronos: model-checking tool for rel-time systems. In CAV, volume 1427 of LNCS. Cssez, F., Dvid, A., Fleury, E., Lrsen, K.G., nd Lime, D. (2005). Efficient on-the-fly lgoriths for the nlysis of timed gmes. In CONCUR, volume 3653 of LNCS. Cssez, F., Dvid, A., Lrsen, K.G., Lime, D., nd Rskin, J.F. (2007). Timed control with observtion bsed nd stuttering invrint strtegies. In ATVA, volume 4762 of LNCS, Springer. Cerns, K. (1992). Decidbility of bisimultion equivlences for prllel timer processes. In CAV, volume 663 of LNCS. Springer. Cerns, K., Godskesen, J.C., nd Lrsen, K.G. (1993). Timed modl specifiction theory nd tools. In CAV, volume 697 of LNCS. Springer. Chtin, Th., Dvid, A., nd Lrsen, K.G. (2008). Plying gmes with timed gmes. Reserch Report LSV-08-34, LSV, ENS Cchn, Frnce. de Alfro, L., Fell, M., Henzinger, T.A., Mjumdr, R., nd Stoeling, M. (2003). The element of surprise in timed gmes. In CONCUR Concurrency Theory, volume 2761 of LNCS, Jensen, H.E., Lrsen, K.G., nd Skou, A. (2000). Scling up Uppl utomtic verifiction of rel-time systems using compositionlity nd bstrction. In FTRTFTS, volume 1926 of LNCS. Springer. Jessen, J.J., Rsmussen, J.I., Lrsen, K.G., nd Dvid, A. (2007). Guided controller synthesis for climte controller using uppl-tig. In FORMATS, volume 4763 of LNCS. Springer. Lrsen, K.G., Pettersson, P., nd Yi, W. (1997). Uppl in nutshell. Journl of Softwre Tools for Technology Trnsfer (STTT), 1(1-2), Mler, O., Pnueli, A., nd Sifkis, J. (1995). On the synthesis of discrete controllers for timed systems. In STACS, volume 900 of LNCS. Springer. Weise, C. nd Lenzkes, D. (1997). Efficient sclinginvrint checking of timed bisimultion. In STACS, volume 1200 of LNCS. Springer.