Tracking Differentiable Trajectories across Polyhedra Boundaries

Transcription

1 Tracking Differentiable Trajectories across Polhedra Boundaries Massimo Benerecetti Elect. Eng. and Information Technologies Università di Napoli Federico II, Ital Marco Faella Elect. Eng. and Information Technologies Università di Napoli Federico II, Ital ABSTRACT We analze the properties of differentiable trajectories subject to a constant differential inclusion which constrains the first derivative to belong to a given conve polhedron. We present the first eact algorithm that computes the set of points from which there is a trajector that reaches a given polhedron while avoiding another (possibl non-conve) polhedron. We discuss the connection with (Linear) Hbrid Automata and in particular the relationship with the classical algorithm for reachabilit analsis for Linear Hbrid Automata. Categories and Subject Descriptors D.2.4 [Software Engineering]: Software/Program Verification Kewords Reachabilit, Differentiabilit, Eact algorithm, Linear Hbrid Automata 1. INTRODUCTION Hbrid Automata are a mathematical abstraction of sstems that feature both discrete and continuous dnamics. Linear Hbrid Automata (LHAs) [2] were introduced as a computationall tractable model of hbrid sstems that still allows for non-trivial dnamics. In particular, LHAs can approimate comple dnamics up to an arbitrar precision [11]. In an LHA, discrete dnamics is represented b a finite set of control modes called locations, while the continuous dnamics is ensured b a finite set of real-valued variables. In each discrete location, the continuous dnamics is constrained b a differential inclusion of the tpe ẋ F, where ẋ is the vector of the time-derivatives of all the variables in This work was supported b the European Union 7th Framework Program project SHERPA. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To cop otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. HSCC 13, April 8 11, 2013, Philadelphia, Pennslvania, USA. Copright 2013 ACM /13/04...$ the sstem, and F R n is a conve polhedron. The main decision problem that was considered for LHAs is reachabilit, i.e., given two sstem configurations, sa an initial state and an error state, establish whether there is a sstem behavior that leads from the first to the second. A more comple task consists in verifing whether a given LHA can be modified (i.e., controlled) in such a wa that a given error configuration (or region) is not reached b an behavior. This problem can be called safet control and is analogous to a game with a safet objective. Both problems require an algorithm for the following sub-problem, which applies to a single discrete location: given a region G (for goal) and a region A (for avoid) of sstem configurations, find the set of points from which there is a trajector that reaches G while avoiding A at all times. We denote this set b RWA(G, A) for reach while avoiding. In reachabilit problems, the goal region G can be thought of as error states, and the avoidance region A is the complement of the invariant of the automaton, which is the set of configurations that make phsical sense for the sstem. Hence, RWA(G, A) is the set of states that reach an error state while remaining in the invariant. In a safet control problem, the goal region G is taken to be a set of uncontrollable states (such as, states outside the safe region) and A is a set of controllable states (included in the invariant). Then, RWA(G, A) identifies the region in which the environment can reach an error state while avoiding the good, controllable states. The RWA operator is recognized as a central tool in the analsis of various kinds of hbrid sstems: it corresponds to the Reach operator in Tomlin et al. [13] and Unavoid Pre in Balluchi et al. [4]; it was also used in the snthesis of controllers for reachabilit objectives [8]. Computing reach-while-avoiding. Computing of RWA(G, A) is simple when A is co-conve, corresponding to the case of reachabilit analsis for LHAs with conve invariants. In that case, RWA can be epressed in the first-order theor of reals and computed using a constant number of basic polhedra operations. When A is not co-conve, one ma adapt the procedure that is presented in one of the earl papers on LHAs, in the contet of reachabilit analsis in presence of non-conve invariants [2]. The idea of the algorithm is simple: consider a partition of the non-conve invariant I into a finite set of conve polhedra P 1,..., P n; then, split the location with invariant I into n different locations, each with conve invariant P i; finall, connect these new locations with

2 virtual transitions corresponding to the boundaries between two adjacent conve polhedra P i, P j. The problem with this approach is that the discrete transitions that model the crossing from one conve polhedron to an adjacent one do not preserve the differentiabilit of the trajectories. In other words, there are trajectories in the modified sstem that do not correspond to an trajector in the original sstem. Consider for eample the situation depicted in Figure 1. Assume that the invariant for the current location is P Q G and the goal is to reach G. Dashed lines identif topologicall open sides of polhedra. The flow constraint F is also depicted in the figure: it allows trajectories to move in a range of directions going from straight right to straight up, and it forbids stopping (i.e., it does not include the origin). Q P A 2 A 1 G Figure 1: Can the points in P reach the target region G while remaining in P Q G? The flow constraint F is shown on the r.h.s. The above procedure splits the invariant into three conve polhedra, and then performs a backward reachabilit analsis which starts from the goal G and progressivel enlarges the set of good states W b including the states that can reach W while remaining in one of the conve parts of the invariant. In our eample, the points in the line segment Q can reach the target b moving straight to the right, while remaining in one conve part of the invariant. Hence, in the first iteration the set Q is added to the set of good states W. The points in the line segment P can reach the etreme point of Q b moving straight up. Hence, in the second iteration the above procedure puts P in W. On the other hand, no differentiable trajector can start in a point of P and reach G while remaining in P Q G. In other words, the classical algorithm for reachabilit analsis of LHAs is based on trajectories that can take a finite number of sharp turns, i.e., a trajector that is differentiable almost everwhere. B rotating the polhedra in Figure 1 (including the flow constraint F ) b 45, it becomes apparent that the issue is also present with rectangular flow constraints. However, Rectangular Hbrid Automata and Games [12] do not ehibit the above issue, due to the presence of multiple restrictions, such as the fact that guards and invariants are conve and topologicall closed. In this paper, we present an eact algorithm for computing RWA(G, A) for general polhedra G and A, assuming that trajectories are differentiable everwhere. Our solution is related to the one proposed b Henzinger et al. [11], which however does not appl to general non-conve polhedra like the one presented in Figure 3. F The rest of the paper is organized as follows. Section 2 is devoted to preliminar definitions, including the problem statement. In Section 3.2 we recall the previous attempts at computing RWA and remark that the onl work for trajectories that are almost everwhere differentiable. We also la the basis for our algorithm, b introducing an operator (called Cross) that contains the points that can move in a differentiable fashion from a given conve polhedron P to another one P and spend a positive amount of time in the latter. In Section 4 we present a series of steps that lead from Cross (which deals with arbitrar differentiable trajectories) to a computationall simpler operator (called ClosCross) that onl reasons about straight-line trajectories. Then, in Section 5 we show how the latter operator can be computed using basic operations on polhedra. Section 6 argues that a finite number of repeated applications of Cross (plus a preliminar step) captures eactl RWA. Finall, we provide some conclusions in Section DEFINITIONS Let R (respectivel, R 0 ) denote the set of real numbers (resp., non-negative real numbers). Throughout the paper we consider a fied ambient space R n. A conve polhedron is a subset of R n that is the intersection of a finite number of open and closed half-spaces. A polhedron is a subset of R n that is the union of a finite number of conve polhedra. For a general (i.e., not necessaril conve) polhedron G R n, we denote b cl(g) its topological closure, b G its complement, and b [[G]] 2 Rn its representation as a finite set of conve polhedra. We assume w.l.o.g. that [[G]] contains mutuall disjoint conve polhedra, called patches of G. Let C [R 0 R n ] be a class of functions from the time domain to our ambient space. Given a conve polhedron F, called the flow constraint, an (F, C)-trajector is a function f C such that f(t) F for all t 0 such that f is differentiable in t. Given a point R n, let Adm C F () (for admissible) denote the set of (F, C)-trajectories f starting from (i.e., such that f(0) = ). We henceforth consider two classes of functions: the class C d of functions that are continuous and differentiable everwhere, and the class C ae of functions that are continuous everwhere and differentiable almost everwhere (i.e., alwas ecept for a finite set of time points). Given two disjoint polhedra G (for goal) and A (for avoid), we denote b RWA C F (G, A) (for reach while avoiding) the set of points from which there is an (F, C)-trajector that reaches G while avoiding A. Formall, we have: { RWA C F (G, A) = R n f Adm C F (), δ f 0 : } f(δ f ) G and 0 δ < δ f : f(δ) A. For ever RWA C F (G, A), an pair (f, δ f ) satisfing the condition in the definition of RWA C F will be called a witness for. Notice that RWA C F (G 1 G 2, A) = RWA C F (G 1, A) RWA C F (G 2, A), whereas RWA C F does not distribute over unions in the second argument (see [7]). Therefore, in the following we can assume, w.l.o.g., that the goal G is a conve polhedron.

3 3. TRACKING DIFFERENTIABLE TRAJECTORIES Starting from this section, we consider a fied flow constraint F, and we omit the F parameter from all notations. 3.1 The Previous Algorithm Let us briefl recall the previous approach to the problem, which can be used to compute RWA, assuming that trajectories are differentiable everwhere ecept for a finite set of time points. Given two conve polhedra P, P, let Reach(P, P ) be the set of points in P that can reach P via a trajector that remains within P P at all times (until P is reached). Formall, Reach(P, P ) = { P f Adm C ae (), δ 0 : f(δ) P and δ (0, δ) : f(δ ) P P }. It can be shown that Reach(P, P ) is a conve polhedron which can be computed from P, P, and F using basic polhedra operations [5, 7]. Then, Theorem 1 shows how RWA can be computed b iterative application of Reach. Theorem 1. [5, 7] For all polhedra G, A, and W, let τ ae(g, A, W ) = G Reach(P, P ). P [A ] P [W ] We have RWA Cae (G, A) = µw. τ ae(g, A, W ), where µw denotes the least fied point operator. Moreover, the fied point is reached within a finite number of iterations. B Knaster-Tarski fied point theorem, the fied point equation in Theorem 1 suggests the semi-algorithm consisting in repeated applications of τ ae(g, A, W ), starting from W =, i.e.: W 0 = and W i+1 = τ ae(g, A, W i) for all i 0. Theorem 1 states that there eists k > 0 such that W k = W k+1 = RWA Cae (G, A). The Reach and τ ae operators, together with Theorem 1, represent a reformulation of the original algorithm for reachabilit analsis of LHAs under non-conve invariants, which was epressed in terms of locations of a hbrid automaton. Notice that both we ourselves (in [5], later corrected b [7]) and Alur et al. (in [1, 2]) have claimed that τ ae (or ver similar variations thereof) can be used to compute RWA C d. Those claims are incorrect, as shown in the Introduction and again below. In the rest of the paper we show that significant new developments are required to correctl compute RWA C d. 3.2 Differentiable Trajectories Consider again the eample in Figure 1, and let A = A 1 A 2. It holds Reach(Q, G) = Q and Reach(P, Q) = P. On the other hand, when considering differentiable trajectories it holds RWA C d (G, A) = G Q. The points in P do not belong to RWA C d (G, A) because no differentiable trajector can start from P and turn into Q without hitting either A 1 or A 2. An obvious first step consists in modifing the definition of Reach b replacing Adm Cae with Adm C d. However, this replacement is not sufficient to solve the problem with the eample in Figure 1: it would still hold Reach(P, Q) = P, because the points in P can reach Q along a straight-line trajector, which is both in C ae and in C d. Then, we notice that all trajectories going from P to Q lie within P at all times, ecept for the final point, which belongs to Q. Hence, we modif the definition of Reach(P, P ) b requiring not onl that there eists a (differentiable) trajector from P to P contained in P P, but also that this trajector spends a positive amount of time in P : Reach (P, P ) = { P f Adm C d (), 0 δ 1 < δ 2 : δ (0, δ 1] : f(δ) P P and δ (δ 1, δ 2] : f(δ) P }. Unfortunatel, Reach still suffers from a shortcoming. Consider again the eample in Figure 1, but this time let the avoidance region be A = A 1. Notice that the status of the immediate neighborhood of P is identical to the previous case: Q is still a good neighbor (w.r.t. reaching G while avoiding A) and A 1 is still a bad neighbor. However, we have P RWA C d (G, A), because a differentiable trajector can start from P, pass instantaneousl through the left verte of Q, then curve into A 2 and finall reach G. The fact that P is a set of good points is essentiall due to A 2, which is not an immediate neighbor of P (in our terminolog, it is a weak neighbor, since cl(p ) cl(a 2) ). Therefore, we realize that Reach cannot solve this eample because it is constrained to consider pairs of adjacent conve polhedra. In particular, it holds Reach (P, A 2) = because P and A 2 are not adjacent, and Reach (P, Q) = because differentiable trajectories cannot start from P and spend a positive amount of time in Q while remaining in P Q. Guided b this eample, we devise a third version of Reach, called Cross, which carries three arguments: Cross(P, ˆP, P ) contains the points of P that can reach and spend a positive amount of time in P, via a trajector that remains within P P at all times, ecept for an intermediate time instant in which the trajector ma be in ˆP. Formall, Cross(P, ˆP, P ) = { P f Adm C d (), 0 δ 1 < δ 2 : δ (0, δ 1) : f(δ) P and f(δ 1) P ˆP P and δ (δ 1, δ 2] : f(δ) P }. Notice that the conditions above impl that f(δ 1) cl(p ) cl(p ). Hence, Cross(P, ˆP, P ) = Cross(P, ˆP cl(p ) cl(p ), P ), (1) and we can assume w.l.o.g. that ˆP cl(p ) cl(p ). We show in Section 6 that Cross is the main ingredient in a fied point characterization of RWA C d. Sections 4 and 5 prove that Cross(P, ˆP, P ) is a polhedron that can be computed using basic operations on conve polhedra. In the rest of the paper we alwas refer to the class of trajectories C d. Hence, we drop the corresponding superscript and write Adm for Adm C d and RWA for RWA C d. 4. FROM GENERAL TRAJECTORIES TO STRAIGHT DIRECTIONS As a first step towards the computation of the operator Cross(P, ˆP, P ) defined in the previous section, we will show how to reformulate it in terms of straight trajectories onl.

4 The main results of this section and the net one are summarized in Figure 4. We assume that we can compute the following basic operations on arbitrar conve polhedra P and P : the Boolean operations P P, P P, and P ; the topological closure cl(p ) of P ; finall, the pre- and post-flows of P, defined as follows: P = { δc P, δ 0, c F } P >0 = { δc P, δ > 0, c F } P = { + δc P, δ 0, c F } P >0 = { + δc P, δ > 0, c F }. Intuitivel, the pre- and post-flow operators compute the pre- and post-image, respectivel, of a conve polhedron with respect to the straight directions contained in F. The algorithm for P >0 and P >0 can be found in [6]. It is well known that P (resp., P ) is not a conve polhedron when F is non-necessaril closed. The following eample shows that the same is true even if both P and F are closed conve polhedra. This observation contradicts a claim made b Halbachs et al. [10]. Theorem 2. Given two closed conve polhedra P and F, the following hold: 1. P ma not be a conve polhedron; 2. P = P (P >0). Proof. To show that the first propert holds it suffices to consider the closed conve polhedra P = {(0, 0)} and F = {(, ) 1}. According to the definition, P = P {(, ) > 0}, which is a conve set but not a conve polhedron. As to the second propert, it is enough to observe that P = { + δc P, δ = 0, c F }. We start b splitting Cross(P, ˆP, P ) into three simpler operators, according to the properties of the trajector f and the dela δ 1 occurring in the definition of Cross: Cross 0 (P, P ) takes care of the case when δ 1 = 0; Cross + (P, P ) takes care of the case when δ 1 > 0 and f(δ 1) P P ; finall, Cross + (P, ˆP, P ) covers the remaining case, i.e., δ 1 > 0 and f(δ 1) ˆP. Hence, it holds: Cross(P, ˆP, P ) =Cross 0 (P, P ) Cross + (P, P ) Cross + (P, ˆP, P ). We recall the following result from the literature, which guarantees that ever point reachable from a point along an admissible and differentiable trajector can also be reached from along an admissible straight trajector. Lemma 1. [2] For all points R n, if there is a trajector f Adm() and a time δ > 0 such that f(δ) =, then there is a slope c F such that = + δc. The following result shows that Cross 0 can immediatel be reformulated in terms of straight directions and easil computed with basic polhedral operations. Given a set P R n, we sa that a trajector f lingers in P if there eists δ > 0 such that f(δ ) P for all 0 < δ < δ. Theorem 3. For all disjoint conve polhedra P, P, it holds: Cross 0 (P, P ) = P cl(p ) P. Proof. First, notice that the definition of Cross(P, ˆP, P ) boils down to the following: Cross 0 (P, P ) = { P f Adm(), δ > 0 : δ (0, δ] : f(δ ) P }. Now, we can prove the two sides of the equivalence. ( ) Let Cross 0 (P, P ) and let f Adm() be the trajector whose eistence is postulated b the definition of Cross 0. Since f lingers in P, in each neighborhood of there is a point in P. Hence, cl(p ). Moreover, Lemma 1 implies that P. ( ) Let P cl(p ) P and let P such that = + δc, for suitable δ 0 and c F. Since P and P are disjoint, it holds δ > 0. Then, the trajector f(δ) = + δc lingers in P and proves that Cross 0 (P, P ). Net, we show how Cross + (P, P ) can be epressed in terms of Cross + (P, ˆP, P ) for a suitable ˆP. Let the boundar between P and P be defined as: bndr(p, P ) (cl(p ) P ) (P cl(p )). It has been proved that bndr(p, P ) is a conve polhedron [7]. Lemma 2. For all conve polhedra P, P, it holds: Cross + (P, P ) = Cross + (P, bndr(p, P ), P ). Proof. ( ) Let Cross + (P, P ), according to the definition there eist a trajector f Adm() and two delas δ 1, δ 2 such that f stas in P from 0 to δ 1 (ecluded), then f(δ 1) P P, and finall f lies in P from δ 1 (ecluded) to δ 2. So, in each neighborhood of f(δ 1) there is both a point in P and a point in P. Hence, f(δ 1) cl(p ) cl(p ) and therefore f(δ 1) bndr(p, P ). ( ) Conversel, let Cross + (P, bndr(p, P ), P ). The thesis follows immediatel from the fact that bndr(p, P ) P P. Lemma 2 implies that the onl remaining task that we need to address is a wa to compute Cross + (P, ˆP, P ). As we shall show, this task turns out to be significantl involved. The first step towards the solution consists in reformulating Cross + in terms of straight trajectories. If we simpl replace the arbitrar trajector f Adm() in the definition of Cross + with a straight trajector of slope c, we obtain the following operator: StrCross(P, ˆP, P ) = { P c F, 0 < δ 1 < δ 2 : δ (0, δ 1) : + δc P and + δ 1c ˆP and δ (δ 1, δ 2] : + δc P }. Intuitivel, these are the points of P which can reach a point in P following a straight direction while remaining in P P at all times, ecept in a single point of ˆP. Clearl, StrCross(P, ˆP, P ) Cross + (P, ˆP, P ). In addition, an point in P which can reach StrCross(P, ˆP, P ) also belongs to Cross + (P, ˆP, P ): Lemma 3. For all conve polhedra P, ˆP and P the following holds: P StrCross(P, ˆP, P ) Cross + (P, ˆP, P ).

5 To prove Lemma 3, we shall need the following result, which shows how to connect, in an admissible and differentiable fashion, two points which can be connected b the concatenation of two straight-line trajectories. Due to space constraints, the proof of the following lemma, as well as those of several other results, can be found in the Appendi. Lemma 4 (Interpolation). Given three points 0, 1, 2 R n, two directions c 0, c 1 F and two delas δ 0, δ 1 0 such that: 1 = 0 + δ 0c 0 and 2 = 1 + δ 1c 1, there eists a trajector f Adm( 0) such that f(0) = c 0, f(δ 0+δ 1) = 2, f(δ 0 + δ 1) = c 1, and f(δ) is a strict conve combination of 0, 1, 2 for all δ (0, δ 0 + δ 1). Figure 2: When a point P can reach another point which is in StrCross(P, ˆP, P ), can differentiabl cross into P (see Lemma 3). Here, ˆP = {z}. Proof of Lemma 3. Let P StrCross(P, ˆP, P ). The proof is illustrated in Figure 2. Let StrCross(P, ˆP, P ) such that {}. There eist c F and 0 < δ 1 < δ 2 satisfing the definition of StrCross(P, ˆP, P ) for. Let z = + δ 1c, b construction it holds z ˆP cl(p ) cl(p ). B appling Lemma 4 with 0 =, 1 =, and 2 = z, we get a differentiable trajector f in Adm() from to z whose derivative in z is c. Moreover, f is contained in P, with the possible eception of z ˆP. Therefore, the concatenation of f and the straight trajector g(δ) = z + δc is everwhere differentiable and crosses into P. As a consequence, Cross + (P, ˆP, P ). While Lemma 3 provides a sound approimation of Cross + in terms of straight trajectories, it does not, unfortunatel, ensure completeness. Indeed, there ma be points that belong to Cross + (P, ˆP, P ) but not to StrCross(P, ˆP, P ). z 1 ˆP z 2 P P A Figure 3: Reaching points in StrCross is not necessar to be in Cross +. Consider the situation depicted in Figure 3, where P and P are open rectangles, ˆP contains a single point z (the upper right corner of the closure of P ), and the line segment A (which does not include ˆP ) is a region to avoid. Given the flow constraint depicted on the right-hand side of the figure, z P P F it holds StrCross(P, ˆP, P ) =, as no straight trajector leads from P to P passing through ˆP. Notice, however, that the point z 1, ling in the closure of P, is reachable from b following a straight trajector which alwas remains in the closure of P. Then, a straight trajector, with derivative c, leads from z 1 to a point z 2, which lies in the closure of P, without ever leaving the closures of the two polhedra. Finall, z 2 can reach in P, following a straight trajector that never leaves the closure of P. Therefore, Lemma 4, applied with 0 =, 1 = z 1 and 2 = z, gives a differentiable trajector from to z, which never leaves P ecept for the end point z ˆP and whose derivative in z is c (the straight direction from z 1 to z 2). Similarl, another application of Lemma 4, this time applied to 0 = z, 1 = z 2 and 2 =, gives a differentiable trajector from z to, which never leaves P ecept for the starting point z ˆP and whose derivative in z is, again, c. The concatenation of these two trajectories in z is depicted in Figure 3 and is a differentiable trajector from to which never leaves P P ecept for the single point z ˆP. Hence, we have that Cross + (P, ˆP, P ). This eample suggests that the straight trajector reformulation of Lemma 3, while not complete, can be etended, eploiting Lemma 4, b also allowing certain straight trajectories ling in the closures of P and P. We, therefore, obtain the following operator: ClosCross(P, ˆP, P ) = { cl(p ) P c F, 0<δ1 <δ 2 : δ (0, δ 1) : + δc cl(p ) and + δ 1c ˆP and δ (δ 1, δ 2) : + δc cl(p ) and + δ 2c cl(p ) P }. The following theorem ensures that ClosCross allows us to obtain a sound and complete reformulation of Cross + in terms of straight trajectories. Theorem 4. For all conve polhedra P, ˆP and P the following holds: Cross + (P, ˆP, P ) = P ClosCross(P, ˆP, P ). Before proving Theorem 4, we need an additional result, connecting arbitrar trajectories and straight trajectories. Consider a differentiable trajector ling within a conve polhedron P. Along an tangent to the curve one can find a point that is still in the closure of P (if not in P itself) and that is reachable from the initial point of the curve. The following lemma formalizes this propert. Lemma 5 (Tangent). Let P be a conve polhedron, a point, f Adm() a trajector, and ˆδ > 0 a dela such that in all non-empt intervals (δ, ˆδ) there is a time γ such that f(γ) P. Then, there eists δ > 0 such that f(ˆδ) δ f(ˆδ) cl(p ) {} >0. Proof of Theorem 4. ( ) This part of the proof has been illustrated in the above discussion regarding the eample in Figure 3. A full proof is provided in the Appendi. ( ) Let Cross + (P, ˆP, P ) and let f Adm() and δ 1, δ 2 be the trajector and the delas whose eistence is postulated b the definition of Cross +. B definition, P. Let = f(δ 1), recall that ˆP. Moreover, since f(δ) P for all δ [0, δ 1), we also have that cl(p ).

6 Cross(P, ˆP, P ) Cross 0 (P, P ) Cross + (P, P ) Cross + (P, ˆP, P ) ˆP = bndr(p, P ) Theorem 3 Theorem 4 P cl(p ) P P ClosCross(P, ˆP, P ) Lemma 7 P RMirCross(P, ˆP, P ) Figure 4: The main steps required for computing Cross when ˆP cl(p ) cl(p ). Equation 1 in Section 3.2 shows that the latter condition does not restrict generalit. Let c = f(δ 1) F, b Lemma 5, there eists γ 1 > 0 such that u 1 γ 1c cl(p ) {}. Since u 1 cl(p ) and cl(p ), then for all δ (0, γ 1) we have u 1 + δc cl(p ). Similarl, b appling Lemma 5 backwards from a point f(δ) P (it is sufficient to consider an δ (δ 1, δ 2)), we obtain another value γ 2 > 0, such that u 2 + γ 2c cl(p ) P. Since cl(p ) and u 2 cl(p ), then for all δ (γ 1, γ 1 + γ 2) we have + δc cl(p ). As a consequence, we obtain that P StrCross(P, ˆP, P ). In conclusion, Theorems 3 and 4 allow us to compute Cross(P, ˆP, P ) provided we can compute ClosCross(P, ˆP, P ), or at least its pre-flow. Indeed, that is the subject of the following section. 5. COMPUTING THE Cross + OPERATOR We start b introducing some preliminar geometric notions. 5.1 Geometric Primitives An affine combination of two points and is an point z = a+(1 a), for a R. An affine set is an set of points closed under affine combinations. The empt set, a single point, a line, a hper-plane, and the whole ambient space are all eamples of affine sets. Given a conve polhedron P, the affine hull of P, denoted ahull(p ), is the smallest affine set containing P. Given a polhedron P R n, the affine dimension of P is the natural number k n, such that the maimum number of affinel independent points in P is k + 1. The relative interior of a conve polhedron P, denoted rint(p ), is the interior of P taken in the space corresponding to the affine hull of P itself. More formall, rint(p ) if and onl if there is a ball N ɛ() of radius ɛ > 0 centered in, such that N ɛ() ahull(p ) P. Similarl, given a polhedron P, we call the set N a relative neighborhood of a point P, if there is a ball N ɛ() of radius ɛ > 0, such that N = N ɛ() ahull(p ). Intuitivel, the relative neighborhood of is a neighborhood of relative to the the affine hull of P. The point reflection of a point w.r.t. a point, in smbols mirror(, ), is the point z, beond along the line connecting and, such that = z. Similarl, one can define the reflection mirror(, Q) of w.r.t. an affine set Q. More precisel, mirror(, Q) is defined as the point reflection of w.r.t. the orthogonal projection of on Q. Finall, the above definitions can be etended to sets of points P, giving rise to the reflections mirror(p, ) and mirror(p, Q). For a conve polhedron Q which is not necessaril an affine set, we will abuse the notation and write mirror(p, Q) when we mean mirror(p, ahull(q)). The affine hull and the relative interior can be easil computed using the standard double description of conve polhedra via constraints and generators [3]. Moreover, it is well known that the reflection of a point w.r.t. a given affine set is a linear transformation, and as such it is eactl computable starting from a representation of the affine set. The details are beond the scope of the present paper. 5.2 Computation of Cross + In Section 4 we have reduced the problem of computing the set Cross + (P, ˆP, P ) to the problem of computing (the pre-flow of) ClosCross(P, ˆP, P ), with ˆP a conve polhedron and ˆP cl(p ) cl(p ). In the rest of the section, we shall then assume that ˆP is an conve polhedron contained in the closures of P and P. The main difficult we have to face in order to compute ClosCross(P, ˆP, P ) is to ensure that the points collected in the set can actuall cross from P to P following a single admissible straight direction in F. Clearl, if a point cl(p ) can reach a point ˆP along a straight direction c F, i.e., = +δc for some δ > 0, then its point reflection w.r.t., namel mirror(, ), is reachable from along the same admissible direction, indeed mirror(, ) = + 2δc. For instance, in Figure 5 if point can reach point along a straight direction, then it can also reach its point reflection (w.r.t. ) along the same direction. The observation above motivates the definition: MirCross(P,, P ) = cl(p ) P {} >0 mirror(cl(p ) P, ). The set MirCross(P,, P ) collects all the points of the closure of P, reachable from P, that can reach, following a single straight trajector passing through, some point of the portion of the closure of P that can, in turn, reach P. In addition, when cl(p ) cl(p ), an point belonging to MirCross(P,, P ) can reach, following a single straight trajector, some point in cl(p ) P, never leaving cl(p ) cl(p ), as required b the definition of ClosCross(P, {}, P ). As a consequence, a point belongs to MirCross(P,, P ) if and onl if it belongs to ClosCross(P, {}, P ). This approach ensures that, when ˆP contains a single point, we can compute the set of points in ClosCross(P, ˆP, P ) that cross from P to P along a straight direction passing through ˆP. B generalizing the operator MirCross to take an arbitrar conve polhedron Q as second argument, we obtain the following: MirCross(P, Q, P ) = cl(p ) P Q >0 mirror(cl(p ) P, Q). The set MirCross(P, Q, P ) is a conve polhedron 1 containing points of the closure of P which: (i) are reachable (along a straight trajector) from P, (ii) can reach a point 1 It is eas to verif that cl(p ) P is a conve polhedron even when P is not.

7 in Q in a positive amount of time along a straight direction, and (iii) have a reflection w.r.t. the affine hull of Q which lies in the portion of the closure of P that can reach P. z ahull(q) w Figure 5: Relationship between the point reflection = mirror(, ) and the reflection = mirror(, Q) w.r.t. Q. The affine hull of Q is drawn truncated. It is important to notice that, differentl from the case of a single point, the straight trajector reaching Q from a point cl(p ) P, which is clearl admissible, need not be the same straight line connecting with its reflection w.r.t. Q. Even worst, this straight line ma not even be an admissible trajector. Figure 5 shows that the point reflection of w.r.t. ma be different from the reflection of with respect to Q even when Q. The following result, however, ensures that, if Q is an open set w.r.t. its affine hull, namel when Q = rint(q), and Q cl(p ) cl(p ), then for all Q, an point in the set MirCross(P,, P ) can reach some point in the set MirCross(P, Q, P ), and vice versa. Lemma 6. For all conve polhedra P, P, Q cl(p ) cl(p ) such that Q = rint(q), points Q, and directions c F, let D Q (resp., D ) be the set of delas δ > 0 such that δc MirCross(P, Q, P ) (resp., δc MirCross(P,, P )). Then, either D Q = D = or both D Q and D are non-empt intervals having the infimum 0. As a consequence of Lemma 6, whenever ˆP is the relative interior of itself and is included in cl(p ) cl(p ), a point in the closure of P can reach the closure of P following a single straight trajector passing through ˆP if and onl if it can reach a point in MirCross(P, ˆP, P ). It is now eas to solve the problem for a general conve polhedron ˆP which is not a relative interior. It suffices to recursivel decompose ˆP into conve polhedra Q, each of which is the relative interior of itself, and compute MirCross(P, Q, P ) for each such component. This leads to the following operator, called RMirCross for recursive: let RMirCross(P,, P ) =, and RMirCross(P, ˆP, P ) = MirCross(P, rint( ˆP ), P ) RMirCross(P, Q, P ). Q [ ˆP \rint( ˆP ) ] The operator can easil be computed b a recursive algorithm, whose termination is guaranteed b noticing that for ever Q [[ ˆP \ rint( ˆP )]], the affine dimension of Q is strictl lower than the affine dimension of ˆP, down to the case where Q contains a single point, in which case Q is the relative interior of itself and the recursion terminates. As an eample, Figure 6 depicts sets RMirCross(P, ˆP, P ), ClosCross(P, ˆP, P ) and Cross + (P, ˆP, P ), assuming that the upper etreme of the segment labeled ˆP actuall belongs to ˆP, while the lower one does not. Dashed boundaries identif topologicall open sides of polhedra. It is eas to verif that no admissible differentiable trajector can cross from a point along the dashed boundaries of C 1 C 2 to P passing through ˆP, hence the belong neither to ClosCross(P, ˆP, P ) nor to Cross + (P, ˆP, P ). The reason wh the do not belong to RMirCross(P, ˆP, P ) is that the operator considers the relative interior of ˆP first, collecting C 1. Then, it recursivel considers the upper etreme point of ˆP, sa. The resulting set RMirCross(P,, P ) is empt, as none of the points of P that can reach (namel, the points along the upper boundaries of C 1 and C 2 and below) has a point relfection w.r.t. ling in the closure of P. C 2 P ˆP P C 3 C 1 Figure 6: Difference between ClosCross and RMirCross. We have C 1 = RMirCross(P, ˆP, P ), C 1 C 2 = ClosCross(P, ˆP, P ), and C 1 C 2 C 3 = Cross + (P, ˆP, P ). The following lemma ensures that a point can reach the set ClosCross(P, ˆP, P ) if and onl if it can reach the set RMirCross(P, ˆP, P ), allowing us to obtain the desired result: Lemma 7. Let P, ˆP and P be conve polhedra, with ˆP cl(p ) cl(p ), then ClosCross(P, ˆP, P ) = RMirCross(P, ˆP, P ). Proof. ( ) Let RMirCross(P, ˆP, P ). Then, there is a point RMirCross(P, ˆP, P ), which is reachable from. Hence, there must be a polhedron Q ˆP, with Q = rint(q) and MirCross(P, Q, P ). B the definition of MirCross(P, Q, P ), must belong to cl(p ), must be reachable from P, and must reach a point in z Q along a straight direction c F in a positive amount of time δ > 0 (i.e., z = + δc). Clearl, the set of delas D Q of Lemma 6 contains at least δ, since z δc = MirCross(P, Q, P ). Therefore, Lemma 6 ensures that both D Q and D z are nonempt time intervals with infimum 0. Let δ z be an time instant contained in D z and δ = min{δ, δ z} > 0. Then, let z δ c cl(p ), it holds MirCross(P, z, P ). As a consequence, cl(p ) P, it can reach z in a positive amount of time δ along direction c, and in time 2δ, along the same direction c, it can reach a point in cl(p ) P. This gives us a point ClosCross(P, ˆP, P ). Finall, we obtain the thesis ClosCross(P, ˆP, P ), b observing F

8 that, since reaches along a direction in F and, in turn, reaches along some direction in F, also reaches along a direction in F. ( ) As to the other direction, let ClosCross(P, ˆP, P ). This means that reaches a point cl(p ) P. In addition, there are two positive delas 0 < δ 1 < δ 2 and a direction c F, such that + δc cl(p ) for all δ (0, δ 1), + δc cl(p ) for all δ (δ 1, δ 2), z + δ 1c ˆP and + δ 2c cl(p ) P. Let δ = min{δ 1, δ 2 δ 1}. Clearl, the point z 1 z δ c cl(p ) is reachable from along direction c, hence from as well. Similarl, the point z 2 z + δ c cl(p ) can reach along direction c, hence also an point reachable from in P. It is immediate to verif that z 1 = mirror(z 2, z) mirror(cl(p ) P, z). We, then, obtain that z 1 MirCross(P, z, P ). Since, however, z ˆP, there is a Q ˆP, with Q = rint(q) and which contains z. Now, the application of Lemma 6 gives us a point z 1 (possibl different from z 1), such that z 1 MirCross(P, Q, P ) RMirCross(P, ˆP, P ) which is reachable from z 1 along direction c. Therefore, z 1 is reachable also from, along the same direction. Once again, since reaches, which, in turn, reaches z 1, also can reach z 1 and we obtain that RMirCross(P, ˆP, P ), as desired. In conclusion, for all conve polhedra P, ˆP and P, whenever ˆP cl(p ) cl(p ) we can compute Cross + (P, ˆP, P ) b means of the following: Cross + (P, ˆP, P ) = P RMirCross(P, ˆP, P ). 6. FIXPOINT CHARACTERIZATION OF REACH-WHILE-AVOIDING In this section, we show how to use the Reach and Cross operators to compute RWA C d. Analogousl to the τ ae operator, we define the following: τ d (G, A, W ) = G Reach(P, G) P [A ] P [A ] ˆP,P [W ] Cross(P, ˆP, P ). We prove that a finite number of repeated applications of τ d (G, A, W ), starting from W =, capture eactl all points in RWA C d (G, A). Theorem 5. For all conve polhedra G and polhedra A, such that G A =, we have RWA C d (G, A) = µw. τ d (G, A, W ). (2) Moreover, the fipoint is reached in a finite number of iterations. In the following, let W 0 = and W i+1 = τ d (G, A, W i), for all i 0. In order to prove the above theorem, we proceed as follows. First, in Section 6.1 we prove that there is a normal form for witnesses, which in turn induces a partition of RWA(G, B) into a finite number of classes R 0,..., R k. Then, in Section 6.2, we show that the points belonging to the class R i are included in the (i + 1)-th iteration of the fipoint (2), i.e., to W i+1. Finall, in Section 6.3 we prove that whenever W is a subset of RWA(G, A), τ d (G, A, W ) is also a subset of RWA(G, A). Together, these results impl that W k+1 coincides with RWA(G, B). 6.1 Canonicit In this section, we introduce a normal form for witnesses. For a point RWA(G, A) and a witness (f, δ f ) for, for all δ between 0 and δ f, f(δ) lies in one of the conve polhedra that constitute A. In general, a witness can enter in and eit from the same polhedron P [[A]] an unbounded number of times. However, we prove that there are special witnesses, called A-canonical, that do not spend a positive amount of time more than once in the same polhedron. Given a witness ξ = (f, δ f ) and a conve polhedron P, let P ξ be the set of delas δ δ f such that f lies in P in an open interval around δ. Formall, P ξ = { 0 δ δ f γ > 0 δ (δ γ, δ + γ) : f(δ ) P }. We sa that a witness ξ = (f, δ f ) for is P -canonical if either P ξ = or f(δ) P for all δ (inf P ξ, sup P ξ ). The definition implies that once a P -canonical witness spends a positive amount of time in P and then eits from it, it can onl return to P for instantaneous visits (i.e., in isolated time points). For a non-conve polhedron B, we sa that the witness ξ is B-canonical if it is P -canonical for all P [[B]]. Lemma 8 (Canonicit). For all RWA(G, A) there eists an A-canonical witness for. If a witness ξ = (f, δ f ) lies entirel within a polhedron B (i.e., f(δ) B for all δ [0, δ f ]), it induces a partition of the interval [0, δ f ] in a possibl infinite 2 sequence of intervals I 0, I 1,..., I α,... such that f lies in the same patch P α [[B]] during each interval I α and two subsequent polhedra are distinct (i.e., we do not partition more often than necessar). We call the sequence of pairs (I α, P α) the B-segmentation of ξ. Notice that for all pairs of subsequent intervals I α, I α+1, at most one of them is singular (i.e., of length 0). Consider the B-segmentation of a B-canonical witness. For all patches P [[B]], there is at most one non-singular time interval during which the witness lies in P. Since ever other interval in the sequence must be non-singular, the segmentation can contain at most 2 [[B]] + 1 intervals (i.e., [[B]] non-singular intervals interleaved with [[B]] + 1 singular ones). Now, for a witness ξ define rank(ξ) as the length (i.e., the order tpe) of its A-segmentation, and rank() the minimum rank of all witnesses for. In light of Lemma 8 and the above discussion, we obtain the following result. Corollar 1. For all points RWA(G, A), it holds rank() 2 [[A]] + 1. The above corollar provides the main reason wh our fipoint procedure terminates. However, in order to prove that our fipoint characterization is complete, we need more than A-canonicit. We also need witnesses to be canonical w.r.t. the intermediate results of the computation, i.e., the sets W i. Hence, we introduce the following definition and the corresponding lemma. We sa that a polhedron B refines A if for all P [[B]] there eists P [[A]] such that P P. Notice that this implies B A. Lemma 9. Let B be a refinement of A. Then, for all RWA(G, A) there eists a B-canonical witness ξ such that rank(ξ) = rank(). 2 In fact, the order tpe of this sequence ma be greater than ω, so that the sequence needs to be indeed b ordinals.

9 B-canonicit is a sort of regularit condition w.r.t. the internal boundaries of B (i.e., the boundaries between different patches of B). The following lemma formalizes this regularit. Lemma 10. For all polhedra B, if a witness ξ = (f, δ f ) is contained in B and it is B-canonical then for all δ [0, δ f ] there eists a non-empt open time interval (δ, δ + γ) during which f lies in the same polhedron P [[B]]. 6.2 Completeness We can now prove that all points in RWA(G, A) will be eventuall included in the fied point (2). Theorem 6 (Completeness). Let RWA(G, A) and r = rank(). If r = 0 then W 1 and if r > 0 then W r. Proof. First, we assume w.l.o.g. that G is one of the patches of A. If this is not the case, modif [[A]] as follows: replace each P [[A]] with [[P \ G]]; then, add G as an etra patch. Let RWA(G, A). If rank() = 0 then there eists a witness for that is entirel contained in G [[A]]. Then, b definition of τ d we have τ d (G, A, ) = W 1. For the higher values of r we proceed b induction. If rank() = 1, there eists a witness ξ = (f, δ f ) for that is entirel contained in two patches P, G [[A]]. More precisel, f(δ f ) G and f(δ) P G for all δ [0, δ f ]. Hence, it holds Reach(P, G) τ d (G, A, ) = W 1. Net, assume that rank() = r + 1 > 1. We appl Lemma 9 to and W r. This is legitimate, as W r can be represented in a wa that refines A. Indeed, according to the definition of τ d, W r is the union of G and several other polhedra, each of which is included in some P [[A]]. Then, b Lemma 9 there eists a witness ξ = (f, δ f ) for that is W r-canonical and such that rank(ξ) = r + 1. Let (I i, P i) i=0,...,r+1 be the A-segmentation of ξ. We distinguish the following cases. Case1: I 0 = [0, 0] = {0}, i.e., f immediatel leaves the first polhedron P 0. In this case, for all δ I 1 the rank of f(δ) is at most r because the suffi of f starting from δ is a witness for f(δ) and its rank is r. B inductive hpothesis, it holds f(δ) W r. Since ξ is W r-canonical, b Lemma 10 f lingers in some P [[W r]]. Hence, f proves that Cross 0 (P 0, P ) τ d (G, A, W r) = W r+1. Case2: I 0 {0}, i.e., f lingers in P 0. Let δ 0 be the right etreme of I 0, for all δ (δ 0, δ f ] it holds rank(f(δ)) r. B inductive hpothesis, f(δ) W r. B Lemma 10, applied to ξ and δ 0, there eists a non-empt time interval (δ 0, δ 0+γ) and a patch P [[W r]] such that f(δ) P for all δ (δ 0, δ 0+γ). If I 0 is right-closed, i.e., I 0 = [0, δ 0], then f(δ 0) P 0. Then, f proves that Cross + (P 0, P 0, P ) W r+1. Otherwise, rank(f(δ 0)) r 1 and, therefore, b inductive hpothesis f(δ 0) W r. In particular, let ˆP [[W r]] be the patch such that f(δ 0) ˆP. Then, f proves that Cross + (P 0, ˆP, P ) W r Correctness The following auiliar result states that from each point in RWA(G, A) there is a witness trajector that follows a straight line for a positive amount of time. Lemma 11. For all RWA(G, A) there eist a witness (f, δ f ), a dela δ δ f, and a slope c F such that f(δ) = c for all δ [0, δ ). z g P P f( δ) Figure 7: Case 1 of Lemma 7: connecting to a witness that starts from. Notice that point z need not be in P. With the result given b the lemma above, we are now read to prove that the fi-point procedure is correct, namel that at an iteration of the procedure the operator τ d onl adds points which belong to RWA(G, A). Theorem 7 (Incremental correctness). For all conve polhedra G and polhedra A and W, such that G A = and W RWA(G, A), it holds τ d (G, A, W ) RWA(G, A). Proof. Let τ d (G, A, W ). If G P [A ] Reach(P, G), it is eas to verif that either G or there is a straight-line trajector that starts from and reaches G without hitting A. Otherwise, it holds P [A ] ˆP,P [W ] Cross(P, ˆP, P ). In particular, let P [[A]] and ˆP, P [[W ]] be such that Cross(P, ˆP, P ). We distinguish two cases based on the definition of Cross. Case 1: Cross 0 (P, P ). This case is illustrated b Figure 7. According to the definition of Cross 0, let f Adm() and δ > 0 be such that f(δ) P for all δ (0, δ]. Notice that f shows that cl(p ), because in ever neighborhood of there is a point in P. B Lemma 1, there is a slope c F and a dela γ > 0 such that f( δ) = + γc. Consider an arbitrar point of the tpe +δ c, for 0 < δ γ. Being a conve combination of a point in cl(p ) and a point in P, different from, belongs to P. B Lemma 11, has a witness that starts with a straight line segment, and this witness must linger in one of the patches in [A]]. Hence, there eists a dela ˆδ < γ and a patch P [[A]] such that all points + δ c, for 0 < δ ˆδ, have a witness that starts with a straight line segment and lingers in P (it ma be P = P ). Let ξ = (g, δ g) be such a witness for the point = + ˆδc. B construction, there eists δ > 0 such that g(δ ) P for all 0 < δ δ and moreover g follows a straight line segment of a given slope c F at all times between 0 and δ. Let z = g(δ ). B appling Lemma 4 to points 0 =, 1 =, and 2 = z, we obtain a trajector f that starts in and reaches z with final slope c. Moreover, each point of f (ecept its etremes) is a strict conve combination of two points in cl(p ) (namel, and ) and a point in P (namel, z); hence it belongs to P. Finall, f can be connected to g at point z, giving rise to a witness for the fact that RWA(G, A). Case 2: Cross + (P, ˆP, P ). This case is illustrated in f

10 f P z P Figure 8: Case 2 of Lemma 7: connecting two witnesses (the dashed line starting from and the dotted line starting from u) into a single one. Notice that point v need not be in P. Figure 8. Let f Adm() and δ 1, δ 2 be the trajector and the delas identified b the definition of Cross +(P, ˆP, P ). Let = f(δ 1), z = f(δ 2), and t be an arbitrar point between them (i.e., t = f(δ ) for δ (δ 1, δ 2)). Let c = f(δ 1), b appling Lemma 5 backwards from t, we obtain that there eists δ > 0 such that w f(δ 1) + δ c cl(p ) {t} >0. Let w be an intermediate point between w and t. Net, consider the points ling on the line segment between t and z. Clearl, the belong to P. Hence, from each of them there is a witness that starts with a straight line segment (Lemma 11) and lingers in a patch in [[A]]. Let us pick a point u along the segment connecting t and z, in such a wa that all points between u (included) and t (ecluded) have a witness that lingers in the same patch P [[A]] (it ma be P = P ). Let f be such a witness for the point u. In detail, f starts with a straight line segment and lingers in P. Formall, there eist a slope c F and a dela δ such that f (δ) = u + δc for all δ [0, δ ]. Let v = f (δ ). Let t be an intermediate point on the line connecting t and u. In order to connect f to f, we appl Lemma 4 three times. First, to points 0 =, 1 = w, and 2 = w ; then, to points 0 = w, 1 = t, and 2 = t ; finall, to points 0 = t, 1 = u, and 2 = v. In this wa, we obtain three admissible trajectories f 1, f 2, f 3. The trajector obtained b concatenating f, the three trajectories f 1, f 2, f 3, and f is a witness for. 7. CONCLUSIONS We considered the problem of computing the set of points that can reach a given polhedron while avoiding another one via a differentiable trajector that is subject to a polhedral differential inclusion. We have shown that previous solutions do not guarantee differentiabilit of the trajectories. We provided a precise formulation of the problem, showing that significant developments are needed to obtain the correct solution. This enabled us to devise the first eact algorithm in the literature to solve the problem. u w t w v t f As future work, we plan to implement the proposed algorithm using a librar for polhedra manipulation. Additionall, it ma be of interest to integrate our algorithm in frameworks that approimate comple dnamics with differential inclusions [9]. 8. REFERENCES [1] R. Alur, T. Henzinger, and P.-H. Ho. Automatic smbolic verification of embedded sstems. In RTSS 93: Real-Time Sstems Smposium, pages 2 11, [2] R. Alur, T. Henzinger, and P.-H. Ho. Automatic smbolic verification of embedded sstems. IEEE Trans. Softw. Eng., 22: , March [3] R. Bagnara, P. M. Hill, and E. Zaffanella. Not necessaril closed conve polhedra and the double description method. Formal Aspects of Computing, 17: , [4] A. Balluchi, L. Benvenuti, T. Villa, H. Wong-Toi, and A. Sangiovanni-Vincentelli. Controller snthesis for hbrid sstems with a lower bound on event separation. Int. J. of Control, 76(12): , [5] M. Benerecetti, M. Faella, and S. Minopoli. Revisiting snthesis of switching controllers for linear hbrid sstems. In Proc. of the 50th IEEE Conf. on Decision and Control. IEEE, [6] M. Benerecetti, M. Faella, and S. Minopoli. Towards efficient eact snthesis for linear hbrid sstems. In GandALF 11: 2nd Int. Smp. on Games, Automata, Logics and Formal Verification, volume 54 of Electronic Proceedings in Theoretical Computer Science, [7] M. Benerecetti, M. Faella, and S. Minopoli. Automatic snthesis of switching controllers for linear hbrid sstems: Safet control. Theoretical Computer Science, To appear. [8] M. Benerecetti, M. Faella, and S. Minopoli. Reachabilit games for linear hbrid sstems. In HSCC 12: Hbrid Sstems Computation and Control. 15th Int. Conf., pages ACM, [9] X. Briand and B. Jeannet. Combining control and data abstraction in the verification of hbrid sstems. IEEE Trans. on Computer-Aided Design of Integrated Circuits and Sstems, 29(10): , oct [10] N. Halbwachs, Y.-E. Pro, and P. Roumanoff. Verification of real-time sstems using linear relation analsis. Formal Methods in Sstem Design, 11: , [11] T. Henzinger, P.-H. Ho, and H. Wong-toi. Algorithmic analsis of nonlinear hbrid sstems. IEEE Transactions on Automatic Control, 43: , [12] T. Henzinger, B. Horowitz, and R. Majumdar. Rectangular hbrid games. In CONCUR 99: Concurrenc Theor. 10th Int. Conf., volume 1664 of Lect. Notes in Comp. Sci., pages Springer, [13] C. Tomlin, J. Lgeros, and S. Shankar Sastr. A game theoretic approach to controller design for hbrid sstems. Proc. of the IEEE, 88(7): , 2000.