Efficient Bounded Reachability Computation for Rectangular Automata

Transcription

1 Efficient Bounded Reachability Computation for Rectangular Automata Xin Chen, Erika Ábrahám, and Goran Frehse RWTH Aachen University, Germany Université Grenoble Joseph Fourier - Verimag, France Abstract. We present a new approach to compute the reachable set with a bounded number of jumps for a rectangular automaton. The reachable set under a flow transition is computed as a polyhedron which is represented by a conjunction of finitely many linear constraints. If the bound is viewed as a constant, the computation time is polynomial in the number of variables. Introduction Hybrid systems are systems equipped with both continuous dynamics and discrete behavior. A popular modeling formalism for hybrid systems are hybrid automata. In this paper, we consider a special class of hybrid automata, called rectangular automata []. The main restriction is that the derivatives, invariants and guards are defined by lower and upper bounds in each dimension, forming rectangles or boxes in the value domain. Rectangular automata can be used to model not only simple timed systems but also asymptotically approximate hybrid systems with nonlinear behaviors [ 5]. Since hybrid automata often model safety-critical systems, their reachability analysis builds an active research area. The reachability problem is decidable only for initialized rectangular automata [], which can be reduced to timed automata [6]. The main merit of rectangular automata is that the reachable set under a flow is always a (convex) polyhedron. It means that the reachable set in a bounded number of jumps can be exactly computed as a set of polyhedra, unlike for general hybrid automata which need approximative methods such as [7 9]. In the past, some geometric methods are proposed for exactly or approximately computing the reachable sets in a bounded number of jumps (see, e.g., [4, ]). There are also tools like HyTech [0] and PHAVer[] which can compute bounded reachability for rectangular automata in a geometric way. However, nearly all of the proposed methods compute the exact reachable set under a flow based on the vertices of the initial set and the derivative rectangle. Since a d-dimensional rectangle has d many vertices, those methods are not able to handle high-dimensional cases. In [], an approximative method is proposed to over-approximate the reachable set by polyhedra which are represented by conjunctions of linear constraints. Since only d linear constraints are needed to

2 define a d-dimensional rectangle, the computation time of the method is polynomial in d. However, the accuracy degenerates dramatically when d increases. In this paper, we compute the reachable set as polyhedra which are represented by finite linear constraint sets [], where we need only d linear constraints to define a d-dimensional rectangle. We show that when the number of jumps is bounded by a constant, the computational complexity of our approach is polynomial in d. We also include the cases that some of the rectangles in the definition of a rectangular automaton are not full-dimensional. The paper is organized as follows. After introducing some basic definitions in Section, we describe our efficient approach for computing the bounded reachable set in Section. In Section 4, we compare our approach and PHAVer based on a scalable example. Missing proofs can be found in []. Preliminaries. Polyhedra and their computation For a point (or column vector) v R d in the d-dimensional Euclidean space R d we use v[i] to denote its ith component, i d, and v T for the row vector being its transpose. In the following we call linear inequalities c T x z for some c R d, z R and x a variable, also constraints. Given a finite set L of linear equalities and linear inequalities, we write S : L for S = {x R d x satisfies L L L}, and also write S : L instead of S : {L}. We say that L L is redundant in L if S : L = S : L\{L}. Redundant (in)equalities can be detected using linear programming [4]. A finite set {v,..., v d } R d of linearly independent vectors span an (d )- dimensional affine subspace Π of R d by the affine combinations of v,..., v d : Π = { i d λ i v i i n λ i =, λ i R} The affine hull aff(s) of a set S R d is the smallest affine subspace Π R d containing S, and we have that dim(s) = dim(aff(s)). We call a subset of a vector space full-dimensional if its affine hull is the whole space. A ((d )-dimensional) hyperplane in R d is a (d )-dimensional affine subspace of R d. Each hyperplane H can be defined as H : c T x = z for some c R d and z R. For d < d, a d -dimensional affine subspace H of R d is called a lower- or d -dimensional hyperplane and can be defined as an intersection of d d many hyperplanes (see []), i.e., as H : i d d ct i x = z i. Since every linear equation c T x = z can be expressed by c T x z c T x z, for d d, a d -dimensional hyperplane can be defined by a set of (d d ) constraints. A (d-dimensional) halfspace S in R d is a d-dimensional set S : c T x z for some c R d and z R. For d < d, a d -dimensional set S R d is a lower- or d -dimensional halfspace if it is the intersection of a (d-dimensional) halfspace S

3 and a d -dimensional hyperplane H S. Note that for d d, a d -dimensional halfspace can be defined by a set of (d d )+ constraints. Given a constraint c T x z, its corresponding equation is c T x = z. The corresponding hyperplane of a d -dimensional halfspace S with d d is the (d )-dimensional hyperplane defined by the set of the corresponding equations of the constraints that define S. For a finite set L of constraints we call P : L a polyhedron. Polyhedra can also be understood as the intersection of finitely many halfspaces. Polytopes are bounded polyhedra. A constraint c T x z is valid for a polyhedron P if all x P satisfy it. For c T x z valid for P and for H F : c T x = z, the set F : P H F is a face of P. If F then we call H F a support hyperplane of P, and the vectors λc for λ > 0 are the normal vectors of H F. The hyperplane H : c T x = z is a support hyperplane of a polyhedron P if and only if for the support function ρ P : R d R { }, ρ P (v) = sup v T x s.t. x P, we have that ρ P (c) = z. We call a face F of a polyhedron P facet if dim(f ) = dim(p ), and vertex if dim(f ) = 0. For d -dimensional faces we simply write d -faces. We use NF(P ) to denote the number of P s facets. Given a face F of P, the outer normals of F are the vectors v F R d such that ρ P (v F ) = sup vf T x for any x F. We also define N (F, P ) as the set of the outer normals of F in P. For a d -dimensional polyhedron P : L P, every facet F P of P can be determined by some L FP L P, that is L FP defines a d -dimensional halfspace which contains P and the corresponding hyperplane is the affine hull of F P (see []). Lemma. If a constraint set L defines a d -dimensional polyhedron P R d and there is no redundant constraint in L, then the set L contains NF(P )+(d d ) constraints. Proof. We need a set L of (d d ) constraints to define aff(p ). For every facet F P of P, we need a constraint L FP such that L {L FP } determines F P. For a polyhedron P : i n {ct i x z i} and a scalar λ 0, the scaled polyhedron λp can be computed by λp : i n {ct i x λz i}. The conical hull of P is the polyhedral cone cone(p ) = λ 0 λp. If the conical hull of P is d -dimensional, then P is at least (d )-dimensional (see []). Example. Figure (a) shows a polyhedron P : x x x x with three irredundant constraints. The support hyperplanes H, H, H intersect P at its facets. The fourth hyperplane H 4 is also a support hyperplane of P, but it only intersects P at a vertex, and the related constraint x is redundant. The conical hull of P is shown in Figure (b). Given two polyhedra P : L P and Q : L Q, their intersection P Q can be defined by the union of their constraints P Q : L P L Q. The Minkowski sum P Q of P and Q is defined by P Q = {p+q p P, q Q}. It is still a polyhedron, as illustrated in Figure. We have the following important theorem for the faces of P Q.

4 x H : x x = x P H : x = H 4 : x = H : x = P 0 (a) x 0 (b) Fig.. A -dimensional polytope and its conical hull x x P x Q = x P Q 0 x 0 x 0 x Fig.. An example of P Q Theorem ([5, 6]). For any polytopes P and Q, each face F of P Q can be decomposed by F = F P F Q for some faces F P and F Q of P and Q respectively. Moreover, this decomposition is unique.. Rectangular automata A box B R d is an axis-aligned rectangle which can be defined by a set of constraints of the form x a or x a where x is a variable, and a, a are rationals. A box B : L B is bounded if for every variable x there are constraints x a and x a in L B for some rationals a, a, otherwise B is unbounded. Let B d be the set of all boxes in R d. Rectangular automata [] are a special class of hybrid automata [7]. Definition. A d-dimensional rectangular automaton is a tuple A = (Loc, Var, Flow, Jump, Inv, Init, Guard, ResetVar, Reset) where Loc is a finite set of locations, also called discrete states. Var = {x,..., x d } is a set of d ordered real-valued variables. We denote the variables as a column vector x = (x,..., x d ) T. Flow : Loc B d assigns each location a flow condition which is a box in R d. Jump : Loc Loc is a set of jumps (or discrete transitions). Inv : Loc B d maps to each location an invariant which is a bounded box. Init:Loc B d maps to each location a bounded box as initial variable values. Guard : Jump B d assigns to each jump a guard which is a box. ResetVar : Jump Var assigns to each jump a set of reset variables.

5 x := 0 x := 0 l 0 ẋ [, ] ẋ [, ] x [ 5, 5] x [0, 0] e : x = 5 x := 0 e : x 5 x := [0, ] l ẋ [, ] ẋ [, ] x [ 5, 5] x [0, 5] Fig.. A rectangular hybrid automaton A F P F Q F F P F P Q P Fig. 4. A D example of R Reset : Jump B d maps to each jump a reset box such that for all e Jump and x i ResetVar(e) the box Reset(e) is bounded in dimension i. Example. Figure shows an example rectangular automaton. For brevity, we specify boxes by their defining intervals. The location set is Loc = {l 0, l }. The initial states are Init(l 0 ) = [0, 0] [0, 0] and Init(l ) =. The flows are defined by Flow(l 0 ) = [, ] [, ] and Flow(l ) = [, ] [, ], and the invariants by Inv(l 0 ) = [ 5, 5] [0, 0] and Inv(l ) = [ 5, 5] [0, 5]. There are two jumps Jump = {e, e } with e = (l 0, l ) and e = (l, l 0 ). The guards are Guard(e ) = [5, 5] (, + ) and Guard(e ) = (, + ) (, 5], the reset variable sets ResetVar(e ) = {x } and ResetVar(e ) = {x }, and the reset boxes Reset(e ) = [0, 0] (, + ) and Reset(e ) = (, + ) [0, ]. A configuration of A is a pair (l, u) such that l Loc is a location and u Inv(l) a vector assigning the value u[i] to x i for i =,..., d. There are two kinds of transitions between configurations: Flow: A transition (l, u) t (l, u ) where t 0, such that there exists b Flow(l) such that u = u+tb and for all 0 t t we have u+t b Inv(l). Jump: A transition (l, u) e (l, u ) such that e=(l, l ) Jump, u Guard(e), u Inv(l ) Reset(e), and u[i]=u [i] for all x i Var\ResetVar(e). An execution of A is a sequence (l 0, u 0 ) α0 (l, u ) α where αi is either a flow or a jump for all i. A configuration is reachable if it can be visited by some execution. The reachability computation is the task to compute the set of the reachable configurations. In this paper we consider bounded reachability with the number of jumps in the considered executions bounded by a positive integer. A New Approach for Reachability Computation In this section, we present a new approach to compute the reachable set for a rectangular automaton where the number of jumps is bounded.

6 . Facets of the reachable set under flow transitions For a location l of a rectangular automaton with Flow(l) = Q and Init(l) = P, the states reachable from P via the flow can be computed in a geometric way: R l (P ) = (P cone(q)) Inv(l). () As already mentioned, previously proposed methods compute R l (P ) by considering the evolutions of all vertices of P under the flow condition Q. That means, also all vertices of Q must be considered. Since Q is a bounded box, it has d vertices which make the computation intractable for large d. We present an approach to compute R l (P ) exactly based on three constraint sets which define P, Q and Inv(l) respectively. We show that if we are able to compute a constraint set that defines P Q in PTIME, then a constraint set which defines R l (P ) can also be computed in PTIME. We firstly investigate the faces of the set R = P cone(q) in the general case that P and Q are polytopes in R d. From the following two lemmata we derive that the number of R s facets is bounded by (n P +n P Q ) where n P is the number of the facets of P and n P Q is the number of the faces from dimension (dim(r) ) to (dim(r) ) in P Q. Lemma. Given a polytope Q R d and a positive integer d, a d -face F cone(q) of the polyhedron cone(q) can be expressed by cone(f Q ) where F Q is a nonempty face of Q and it is at least (d )-dimensional. Proof. The polyhedron cone(q) can be expressed by cone(v Q ) where V Q is the vertex set of Q. Then a nonempty face F cone(q) of cone(q) can be expressed by cone(v Q ) where V Q V Q is nonempty. Assume S is the halfspace whose corresponding hyperplane is H = aff(f cone(q) ). Since cone(q) S, we also have that Q S, moreover, we can infer that H is a support hyperplane of Q and F Q = H Q is a nonempty face of Q whose vertex set is V Q. Therefore, the face F cone(q) can be expressed by cone(f Q ). From the definition of conical hull, if F cone(q) is d -dimensional then F Q is at least (d )-dimensional. Lemma. Given two polytopes P, Q R d, any d -face F R of the polytope R = P cone(q) is either a d -face of P, or the decomposition F R = λ 0 (F P λf Q ) where F P, F Q are some nonempty faces of P, Q respectively and F P F Q is a face of P Q which is at least (d )-dimensional. Proof. We have two cases for a face F R of R, () F R is a face of P ; () F R can be expressed by F P cone(f Q ) where F Q is a nonempty face of Q (from Theorem and Lemma ). In the case (), we rewrite R and F R by R = P cone(q) = λ 0 (P λq) and F R = F P cone(f Q ) = λ 0(F P λf Q ) Since F R is a face of R, i.e., it is on the boundary of R, we infer that for all λ 0 the set F P λf Q is a face of P λq. Thus F P F Q is a face of P Q. Since F R is d -dimensional, the set F P F Q is at least (d )-dimensional.

7 Example. In Figure 4 on page 5, the set F is a facet of both P and R. In contrast, the facet F can be expressed by λ 0 (F P λf Q ). The facets of R can be found by enumerating all the facets of P, and all the faces from dimension (dim(r) ) to (dim(r) ) in P Q. Lemma 4. Let P : L P and P Q : L P Q be some polytopes with L P Q = {g j T x h j j m} irredundant. We define the constraint set L = i<j m L i,j such that for each i < j m, L i,j = {L i,j } if the intersection of H i : gi T x = h i, H j : gj T x = h j and P Q is nonempty, and L i,j is a constraint whose corresponding hyperplane H i,j satisfies () H i,j is a support hyperplane of P, () H i,j is a support hyperplane of P Q and () H i H j H i,j. Otherwise L i,j =. Suppose that L is the set of all constraints in L P and L P Q that are valid for R. Then the polytope R can be defined by L L. Note that L i,j is not unique for each i < j m, but we only need one of them. Intuitively, for any facet F R of R, if F R is also a facet of P then it can be determined by a subset L P of L P. Since the constraints in L P are also valid for R, we also have that L P L. Otherwise F R = λ 0 (F P λf Q ) for some nonempty faces F P, F Q of P, Q respectively. There are two cases, (a) if F P F Q is (dim(r) )-dimensional, then F R can be determined by a subset L P Q of L P Q, it is also included by L ; (b) if F P F Q is (dim(r) )-dimensional, the facet F R is determined by a subset of L. Hence, L L defines R.. Compute the reachable set under flow transitions In order to compute the constraint set that defines R, we need to find the hyperplanes H i,j stated in Lemma 4. We determine the H i,j : c T x = z by solving a feasibility problem for the normal vector c R d and the value z R as follows. Assume dim(r) = d R, P : L P and P Q is defined by the irredundant set L P Q = {g T j x h j j m}. Firstly, we check if the set H i H j (P Q) with H i : g T i x = h i and H j : g T j x = h j is nonempty by solving the following linear program: Find x I R d s.t. g T i x I = h i g T j x I = h j x I P Q. If such an x I is found, then the intersection is nonempty, and there must be a (d R )-face F P Q of P Q contained in it since L P Q is irredundant. We require that H i,j is a support hyperplane of P Q and contains F P Q. This can be ensured by finding c in the set C i,j = {αg i +βg j α, β 0, α+β > 0} and demanding c T x I = z. An example is shown in Figure 5. We also require that H i,j is a support hyperplane of P. This can be guaranteed by demanding ρ P (c) = z and c = αg i +βg j. In order to replace ρ P (αg i +βg j ) by αρ P (g i ) + βρ P (g j ), we need to ensure their equivalence. This can be done by finding at least one point p P such that gi T p = ρ P (g i ) and gj T p = ρ P (g j ). Since the (d R )-face F P Q is contained in H i H j, we have that gi T x = ρ P Q(g i )

8 g i H c H i,j H H H H i x I g j F R P Q H, H j Fig. 5. A -dimensional example of the vector c P Fig. 6. An example of H i,j and gj T x = ρ P Q(g j ) for all x F P Q. From Theorem, F P Q can be decomposed by F P F Q for some faces F P, F Q of P, Q respectively, and we can infer that for all x F P it holds that gi T x = ρ P (g i ) and gj T x = ρ P (g j ). Hence we can replace ρ P (αg i +βg j ) by αρ P (g i ) + βρ P (g j ). Then the vector c can be computed by solving the following problem: Find c R d s.t. { c = αgi +βg j α+β > 0 α 0 β 0 c T x I = αρ P (g i )+βρ P (g j ) () We set z = ρ P (c). An example of H i,j is given in Figure 6. We also need to find the valid constraints for R in L P and L P Q. Given a constraint L : c T x z, L is valid for R if and only if ρ R (c) z. Since ρ R (c) = ρ P (c)+λρ Q (c) = sup c T x+λ sup c T y s.t. x P, y Q, λ 0, we compute ρ P (c) and ρ Q (c) by linear programming. If ρ Q (c) 0 then ρ R (c) = ρ P (c), otherwise ρ R (c) =. If we have the constraints for P Q then Problem () is linear. Algorithm shows the computation of the irredundant constraints of R. Finally, the polytope L Rl (X) can be defined by the set L R L Inv(l) where L Inv(l) defines Inv(l).. Compute the reachable set after a jump A jump e = (l, l ) of a rectangular automaton can update a variable by a value in an interval [a, a]. If the set of the reachable states in l is computed as (l, R l (X)), then the set of states at which e is enabled can be computed by (l, R l (X) Guard(e)). Thus the reachable set after the jump e is (l, R e (R l (X))) where R e (R l (X)) ={u Inv(l ) Reset(e) u R l (X) Guard(e). x i Var\ResetVar(e).u [i] = u[i]} () The set R e (R l (X)) can also be computed in a geometric way. The guard can be considered by defining R l (X) Guard(e) : L Rl (X) L Guard(e). The polytope R e (R l (X)) can be defined by L e L Reset(e) where L e is the set of the constraints computed from L Rl (X) L Guard(e) by eliminating all reset variables by Fourier- Motzkin elimination [], and L Reset(e) defines the box Reset(e).

9 Algorithm Algorithm to compute R Input: P : L P, Q : L Q Output: An irredundant constraint set L R of R : Compute an irredundant constraint set L P Q of P Q; L R := ; : for all constraints c T x z in L P L P Q do : if c T x z is valid to R then 4: Add the constraint c T x z into L R; 5: end if 6: end for 7: for all constraints g T i x = h i and g T j x = h j in L P Q do 8: Find a hyperplane H i,j : c T x = z by solving Problem (); 9: if H i,j exists then 0: Add the constraint c T x z to L R; : end if : end for : Remove the redundant constraints from L R; 4: return L R x Guard(e) x x Reset(e) 4 P R l (X) 4 4 R e(r l (X)) 0 4 (a) The set P x x x (b) After eliminating x (c) The set R e(r l (X)) Fig. 7. A -dimensional example of resetting x to [, ] Example 4. We show an example in Figure 7, where R l (X) Guard(e) is given by the polytope P : x +x 0 x x 0 x x. The reset box is Reset(e) : x x, and Inv(l ) is the box [0, 5] [0, 5]. Firstly, we compute the maximum and minimum value of the variable x, and we obtain x and x. By using the constraint x, we eliminate the variable x from x +x 0 and obtain a new constraint x 4. Similarly, we use x to eliminate the variable x from x x 0 and get x 0.5. At last, the set R e (R l (X)) is the polytope R e (R l (X)) : x 4 x 0.5 x x Algorithm shows the computation of the reachable set after a jump. Although the Fourier-Motzkin elimination is double-exponential in general, in the next section we show that it is efficient on the reachable sets..4 Complexity of the reachability computation

10 Algorithm Algorithm to compute the constraints of R e (R l (X)) Input: The jump e = (l, l ), the constraints of R l (X) : L Output: The constraints of R e(r l (X)) : Compute the constraint set L P of P = R l (X) Guard(e); S L P ; : for all x i ResetVar(e) do : Eliminate x i from the constraints in S by Fourier-Motzkin elimination; 4: end for 5: return S L Reset(e) Algorithm Reachability computation for a rectangular automaton Input: A rectangular hybrid automaton A Output: The reachable set of A : R A {(l, Init(l)) l Loc}; : Define a queue Q with elements (l, X) R A; : while Q is not empty do 4: Get (l, X) from Q; Y R l (X); R A R A {(l, Y )}; 5: for all e = (l, l ) Jump do 6: Z R e(y ); 7: if (l, Z) / R A then 8: Insert (l, Z) into Q; R A R A {(l, Z)}; 9: end if 0: end for : end while : return R A The reachable set of a rectangular automaton A can be computed by Algorithm. Any reachable set R l (X) in Algorithm is computed by a sequence X 0 R l0 (X 0 ) X R l (X ) X k R lk (X k ) where X j = R ej (R lj (X j )) for j k, and X 0 = Init(l 0 ). Although the termination of Algorithm is not guaranteed, if we lay an upper bound k on k then it always stops. We prove that if k is viewed as a constant, then the computation is polynomial in the number of the variables of A. We prove it by showing that an irredundant constraint set of X j can be computed from an irredundant constraint set of X j in PTIME. Notice that this property is not possessed by any of the methods proposed in the past. Lemma 5. For j k, both NF(X j ) and NF(X j B j ) are polynomial in NF(X j ). Proof. By Lemma, the size of the irredundant constraint set of X j is proportional to NF(X j ), then we consider the facets of X j. We define G j = Inv(l j ) Guard(e j+ ) and B j = Flow(l j ). If the whole space is R d, in order to maximize the number of X j s facets, we assume B i, G i for 0 i j are full-dimensional

11 boxes, and X j is also full-dimensional. Since X j can be expressed by R ej (( R e ((X 0 λ 0 B 0 ) G 0 ) λ j B j ) G j ) a j λ j b j a 0 λ 0 b 0 a facet F Xj of it can be uniquely expressed by F (λ 0,..., λ j ) (4) a j λj b j a 0 λ0 b 0 where a i a i and b i b i for 0 i j, such that (i) F (λ 0,..., λ j ) is a face of the box Φ(λ 0,..., λ j ) = R ej (( R e ((X 0 λ 0 B 0 ) G 0 ) λ j B j ) G j ) and there is no higher dimensional face of Φ(λ 0,..., λ j ) can be used to express F Xj ; (ii) if the maximum dimension of all those faces F (λ 0,..., λ j ) is d where d d j, then there are exactly (d d ) many λ i where 0 i j such that these parameters help to determine N (F Xj, X j ); (iii) for any 0 i j, if λ i helps to determine N (F Xj, X j ), then the box G i could also help to determine N (F Xj, X j ); (iv) for any 0 i j, any γ i, γ i where { a i < γ i, γ i < b i, if a i < b i γ i = γ i = a i, otherwise we have that F (γ 0,..., γ j ), F (γ 0,..., γ j ) have the maximum dimension among all the faces F (λ 0,..., λ j ), and N (F (γ 0,..., γ j ), Φ(γ 0,..., γ j )) = N (F (γ 0,..., γ j ), Φ(γ 0,..., γ j )). In brief, the above properties tell that N (F Xj, X j ) depends on (a) the set N (F (γ 0,..., γ j ), Φ(γ 0,..., γ j )) in the property (iv), i.e., the outer normals of a bounded box face (we call those faces related), (b) the (d d ) parameters in the property (ii), and (c) the dependence of N (F Xj, X j ) and G i for every 0 i j such that λ i helps to determine N (F Xj, X j ). Thereby if F B is a d -face of a bounded box, it has at most ( d d j d d ) related facets in Xj. Given a dimension d where d d j, as we said, if a d -face F B of a bounded box B is related to some facet F Xj then there are exactly (d d ) many λ i s help to determine the outer normals of F Xj. Thus there are (d d ) steps to determine N (F Xj, X j ). We define P i as the set of the d -faces in B which possibly have related facets in X j after the ith step. Obviously, P 0 contains all the d -faces in B. In every (i + )th step, at least half of the faces in P i lose the possibility to have related facets in X j since X i is a union of boxes and every box is centrally symmetric. Hence, there are at most ( )) ( ) (d d ) Fd d = ) dd d ( (d d d d = d -faces of B could have related facets in X j, where Fd d is the number of the d - ( faces in B. Therefore, there are at most d d j d ) d d )( d facets in Xj which are d

12 related to some d -faces of B. By considering all max(d j, 0) d d, we can conclude that NF(X j ) is polynomial in NF(X j ) for j. Similarly, we can also prove that NF(X j B j ) is polynomial in NF(X j ) for j. Now we give our method to compute X j from X j. The most expensive part in the computation is computing X j B j. We decompose B j by B j = [a, a ] [a, a ] [a d, a d ] d, such that for i d, x[i] a i, x[i] a i are irredundant constraints for B j and [a i, a i ] i is a line segment (-dimensional box) defined by the following constraint set: {x[i] a i, x[i] a i } {x[i ] 0 i i} { x[i ] 0 i i} We denote the polytope resulting from adding the first m line segments onto X j by Xj m, then for all m d, NF(Xm j ) is polynomial in NF(X j ). Since an irredundant constraint set for Xj m can be computed in PTIME based on an irredundant constraint set of X m j, we conclude that an irredundant constraint set which defines X j B j can be computed in a time polynomial in d if j is viewed as a constant. Next we consider the complexity of the Fourier-Motzkin elimination on the set R lj (X j ). Since NF(X j+ ) is polynomial in NF(X j ), the polyhedron resulting from the elimination of each reset variable has a number of facets which is polynomial in NF(X j ). Since eliminating one variable is PTIME, we conclude that the Fourier-Motzkin elimination on R lj (X j ) is polynomial in d if j is viewed as a constant. If we use interior point methods [4] to solve linear programs then the bounded reachability computation is polynomial in d. Theorem. The computational complexity of R lj (X j ) is polynomial in d if j is viewed as a constant. Theorem. The computational complexity of the reachable set with a bounded number of jumps is polynomial in d if the bound is viewed as a constant. Unfortunately, the worst-case complexity is exponential in j. However, it only happens in extreme cases. The exact complexity of our approach mainly depends on the complexity of solving linear programs. 4 Experimental Results We implemented our method in MATLAB using the CDD tool [8] for linear programming. We compared our implementation with PHAVer (embedded in SpaceEx [9]) on a scalable artificial example. Since there are rare high dimensional examples published, we design a scalable example which is given in Figure 8, where d is the (user-defined) dimension of the automaton and i denotes all the integers from to d. The automaton A d helps to generate reachable sets with large numbers of vertices and facets, and for each jump, nearly half of the variables are reset.

13 x d 5d x i [0, ] l 0 ẋ i [i, i ] x j := [, ] where d/ + j d l ẋ i [ i, i + ] x i [ 0d, 0d] x i [ 0d, 0d] x d 8d x j := [0, ] where j d/ Fig. 8. Rectangular automaton A d Dimension MaxJmp PHAVer Our method Memory Time Memory Time ToLP LPs Constraints < < < n.a. t.o. < n.a. t.o. < n.a. t.o. < < < < n.a. t.o. < n.a. t.o. < n.a. t.o. < Table. Experimental results. Time is in seconds, memory in MBs. MaxJmp is the bound on the number of jumps, ToLP is the total linear programming time, LPs is the number of linear programs solved (including the detection of redundant constraints), Constraints is the number of irredundant constraints computed, n.a. means not available, t.o. means that the running time was greater than one hour. The experiments were run on a computer with a.8 GHz CPU and 4GB memory, the operating system is Linux. The experimental results are given by Table. Since MATLAB does not provide a build-in function to monitor the memory usage of its programs on Linux, the listed memory usage is the total memory usage minus MATLAB memory usage before the experiment. Our method can handle A 0 efficiently, however PHAVer stops at A 7. Our implementation is a prototype and the running times can even be improved by a C++ implementation and a faster LP solver. 5 Conclusion We introduced our efficient approach for the bounded reachability computation of rectangular automata. However, the method of computing the reachable set under a flow transition can also be applied to linear hybrid automata. With some

14 more effort this approach can also be adapted for the approximative analysis of hybrid systems with nonlinear behavior. References. T. A. Henzinger, P. W. Kopke, A. Puri, and P. Varaiya. What s decidable about hybrid automata? J. Comput. Syst. Sci., 57():94 4, T.A. Henzinger, P. Ho, and H. Wong-Toi. Algorithmic analysis of nonlinear hybrid systems. Automatic Control, IEEE Transactions on, 4(4): , apr J. Preußig, S. Kowalewski, H. Wong-Toi, and T. A. Henzinger. An algorithm for the approximative analysis of rectangular automata. In Proc. of FTRTFT 98, volume 486 of LNCS, pages Springer, H. Wong-Toi and J. Preußig. A procedure for reachability analysis of rectangular automata. In Proc. of American Control Conference, volume, pages vol., L. Doyen, T. A. Henzinger, and J. Raskin. Automatic rectangular refinement of affine hybrid systems. In Proc. of FORMATS 05, volume 89 of LNCS, pages Springer, R. Alur and D. L. Dill. A theory of timed automata. Theor. Comput. Sci., 6():8 5, A. Chutinan and B. H. Krogh. Computing polyhedral approximations to flow pipes for dynamic systems. In Proc. of CDC 98. IEEE Press, O. Stursberg and B. H. Krogh. Efficient representation and computation of reachable sets for hybrid systems. In Proc. of HSCC 0, volume 6 of LNCS, pages Springer, A. Girard. Reachability of uncertain linear systems using zonotopes. In Proc. of HSCC 05, volume 44 of LNCS, pages Springer, T. A. Henzinger, P.-H. Ho, and H. Wong-Toi. Hytech: A model checker for hybrid systems. Software Tools for Technology Transfer, ():0, G. Frehse. Phaver: Algorithmic verification of hybrid systems past hytech. In Proc. of HSCC 05, volume 44 of LNCS, pages Springer, G. M. Ziegler. Lectures on Polytopes, volume 5 of Graduate Texts in Mathematics. Springer, X. Chen, E. Abraham, and G. Frehse. Efficient bounded reachability computation for rectangular automata. Technical report, RWTH Aachen University, 0. http: //www-i.informatik.rwth-aachen.de/i/hybrid_research_pub0/. 4. S. Boyd and L. Vandenberghe. Convex Optimization. Cambridge University Press, K. Fukuda. From the zonotope construction to the minkowski addition of convex polytopes. J. Symb. Comput., 8(4):6 7, C. Weibel and K. Fukuda. Computing faces up to k dimensions of a minkowski sum of polytopes. In Proc. of CCCG 05, pages 56 59, T. A. Henzinger. The theory of hybrid automata. In Proc. of LICS 96, pages 78 9, K. Fukuda. cdd, cddplus and cddlib homepage. ~fukuda/cdd_home/. 9. G. Frehse, C. Le Guernic, A. Donzé, R. Ray, O. Lebeltel, R. Ripado, A. Girard, T. Dang, and O. Maler. Spaceex: Scalable verification of hybrid systems. In Proc. of CAV, LNCS. Springer, 0.