Hybrid games in CdGL are 2-player, zero-sum, and perfect-information, where continuous subgames are ordinary differential equations (ODEs) whose duration is chosen by a player. Hybrid games should not be confused with differential games which compete continuously [29, 43]. The players considered in this paper are Angel and Demon where the player currently controlling choices is always called Angel, while the player waiting to play is always called Demon. For any game \(\alpha \) and formula \(\phi ,\) the modal formula
says Angel can play \(\alpha \) to ensure postcondition \(\phi ,\) while
says Demon can play \(\alpha \) to ensure postcondition \(\phi \). These generalize safety and liveness modalities from DL. Dual games
unique to GLs, take turns by switching the Angel and Demon roles in game \(\alpha \). The Curry-Howard interpretation of a proof of a CdGL modality
or
is a program which performs each player’s winning strategy. Games can have several winning strategies, each corresponding to a different proof and a different program.
3.1 Syntax of CdGL
We introduce the language of CdGL with three classes of expressions e: terms f, g, games \(\alpha ,\beta ,\) and formulas \(\phi , \psi .\) We characterize terms semantically for the sake of generality: a shallow embedding of CdGL inside a proof assistant might use the host language for terms. For games and formulas, we find it more convenient to explicitly and syntactically define a closed language.
A (scalar) semantic term is a function from states to reals, which are understood constructively à la Bishop [6, 12]. We use Bishop-style real analysis because it preserves many classical intuitions (e.g., uncountability) about \(\mathbb {R} \) while ensuring computability. Type-2 [57] computability requires that all functions on real numbers are computable to arbitrary precision if represented as streams of bits, yet computability does not require that variables range over only computable reals. It is a theorem [57] that all such computable functions are continuous, but not always Lipschitz-continuous nor differentiable.
We introduce commonly used term constructs, which are not exhaustive because the language of terms is open. The simplest terms are game variables \(x, y \in \mathcal {V}\) where \(\mathcal {V}\) is the (at most countable) set of variable identifiers. The game variables, which are mutable, contain the state of the game, which is globally scoped. For every base game variable x there is a primed counterpart \({x'}\) whose purpose within an ODE is to track the time derivative of x. Real-valued terms f, g are simply type-2 computable functions, usually from states to reals. It is occasionally useful for f to return a tuple of reals, which are computable when every component is computable. Since terms are functions, operators are combinators: \(f + g\) is a function which sums the results of f and g.
Definition 1
(Terms). A term f, g is any computable function over the game state. The following constructs appear in this paper:
$$\begin{aligned} f,g ~\mathrel {::=}~ \cdots ~|~c ~|~x ~|~f + g ~|~f \cdot g ~|~f / g ~|~\min (f,g) ~|~\max (f,g) ~|~(f)' \end{aligned}$$
where \(c \in \mathbb {R}\) is a real literal, x a game variable, \(f + g\) a sum, \(f \cdot g\) a product, and \(f / g\) is real division of f by g. Divisors g are assumed to be nonzero. Minimum and maximum of terms f and g are written \(\min (f,g)\) and \(\max (f,g)\). Any differentiable term f has a definable (Sect. 4.2) spatial differential term \((f)',\) which agrees with the time derivative within an ODE.
CdGL is constructive, so Angel strategies make choices computably. Until his turn, Demon just observes Angel’s choices, and does not care whether Angel made them computably. We discuss game-playing informally here, then formally in Sect. 4. In
are the ODE and dual games, which respectively distinguish hybrid games from discrete games and games from systems.
Definition 2
(Games). The set of games \(\alpha ,\beta \) is defined recursively as such:
The test game
is a no-op if Angel proves \(\phi ,\) else Demon wins by default since Angel “broke the rules”. A deterministic assignment
updates game variable x to the value of term f. Nondeterministic assignments
ask Angel to compute the new value of \(x : \mathbb {R},\) i.e., Angel’s strategy for
is a term whose value is assigned to x. The ODE game
evolves ODE \({x'}=f\) for duration \(d \ge 0\) chosen by Angel such that Angel proves the domain constraint formula \(\psi \) is true throughout. We require that term f is effectively-locally-Lipschitz on domain \(\psi \), meaning that at every state satisfying \(\psi ,\) a neighborhood and coefficient L can be constructed such that L is a Lipschitz constant of f in the neighborhood. Effective local Lipschitz continuity guarantees unique solutions exist by constructive Picard-Lindelöf [34]. ODEs are explicit-form, so no primed variable \({y'}\) for \(y \in \mathcal {V}\) is mentioned in f or \(\psi \). Systems of ODEs are supported, we present single equations for readability. In the choice game \(\alpha \cup \beta ,\) Angel chooses whether to play game \(\alpha \) or game \(\beta \). In the sequential composition game \(\alpha ;\beta \), game \(\alpha \) is played first, then \(\beta \) from the resulting state. In the repetition game
Angel chooses after each repetition of \(\alpha \) whether to continue playing, but must not repeat \(\alpha \) infinitely. The exact number of repetitions is not known in advance, because it may depend on Demon’s reactions. In the dual game
Angel takes the Demon role and vice-versa while playing \(\alpha \). Demon strategies “wait” until a dual game
is encountered, then play an Angelic strategy for \(\alpha \). We parenthesize games with braces \(\{ \alpha \}\) when necessary.
Definition 3
(CdGL Formulas). The CdGL formulas \(\phi \) (also \(\psi \)) are:
Above, \(f \sim g\) is a comparison formula for \({\sim }\mathrel {\in }\{\le , <, =, \ne , >, \ge \}\). The defining formulas of CdGL (and GL) are the modalities
and
. These mean that Angel or Demon respectively have a constructive strategy to play hybrid game \(\alpha \) and prove postcondition \(\phi \). We do not develop modalities for existence of classical strategies because those cannot be synthesized to executable code.
Standard connectives are defined from games and comparisons. Verum (\(\mathtt{tt}\)) is defined \(1 > 0\) and falsum (\(\mathtt{ff}\)) is \(0 > 1\). Conjunction \(\phi \wedge \psi \) is defined
disjunction \(\phi \vee \psi \) is defined
and implication \(\phi \rightarrow \psi \) is defined
. Real quantifiers
and
are defined
and
respectively. As usual, equivalence \(\phi \leftrightarrow \psi \) reduces to \((\phi \rightarrow \psi ) \wedge (\psi \rightarrow \phi ),\) negation \(\lnot \phi \) is defined as \(\phi \rightarrow \mathtt{ff}\), and inequality is defined by \(f \ne g \equiv \lnot (f = g)\). Semantics and proof rules are needed only for core constructs, but we use derived constructs when they improve readability. Keep these definitions in mind, because the semantics and rules for some game connectives mirror first-order connectives.
For convenience, we also write derived operators where Demon is given control of a single choice before returning control to Angel. The Demonic choice
defined
says Demon chooses which branch to take, but Angel controls the subgames. Demonic repetition
is defined likewise by
.
We write
(likewise for \(\alpha \) and f) for the renaming of variable x for y and vice versa in formula \(\phi \), and write
for the result of substitution of term f for game variable x in \(\phi \), if the substitution is admissible (Definition 12 on page 14).
3.2 Example Game
We give an example game and theorem statements, proven in [10]. Automotive systems are a major class of CPS. As a simple indicative example we consider time-triggered 1-dimensional driving with adversarial timing. For maximum time T between control cycles, we let Demon choose any duration in [0, T]. When we need to prohibit pathological “Zeno” behaviors while keeping constraints realistic, we can further restrict \(t \in [T/2, T]\).
We write x for the current position of the car, v for its velocity, a for the acceleration, \(A > 0\) for the maximum positive acceleration, and \(B > 0\) for the maximum braking rate. We assume \(x=v=0\) initially to simplify arithmetic. In time-triggered control, the controller runs at least once every \(T > 0\) time units. Time and physics are continuous, T gives an upper bound on how often the controller runs. Local clock t marks the current time within the current timestep, then resets at each step. The control game (\(\textsf {ctrl} \)) says Angel can pick any acceleration a that is physically achievable (\(-B \le a \le A\)). The clock t is then reinitialized to 0. The plant game (\(\textsf {plant} \)) says Demon can evolve physics for duration \(t \in [0,T]\) such that \(v \ge 0\) throughout, then returns control to Angel.
Typical theorems in DLs and GLs are safety and liveness: are unsafe states always avoided and are desirable goals eventually reached? Safety and liveness of the 1D system has been proved previously: safe driving (\(\textsf {safety}\)) never goes past goal g, while live driving eventually reaches g (\(\textsf {liveness}\)).
Liveness theorem \(\textsf {liveness}\) requires a lower time bound (
) to rule out Zeno strategies where Demon “cheats” by exponentially decreasing durations to essentially freeze the progress of time. The limit \(t \ge T/2\) is chosen for simplicity. Safety theorem \(\textsf {safety}\) omits this constraint because even Zeno behaviors are safe.
Safety and liveness theorems, if designed carelessly, have trivial solutions including but not limited to Zeno behaviors. It is safe to remain at \(x=0\) and is live to maintain \(a = A,\) but not vice-versa. In contrast to DLs, GLs easily express the requirement that the same strategy is both safe and live: we must remain safe while reaching the goal. We use this reach-avoid specification because it is immune to trivial solutions. We give a new reach-avoid result for 1D driving.
Example 4
(Reach-avoid). The following is provable in
and CdGL:
Angel reaches \(g=x \wedge v=0\) while safely avoiding states where \(x \le g\) does not hold. Angel is safe at every iteration for every time \(t \in [0,T]\), thus safe throughout the game. The (dual) test
appears second, allowing Demon to win if Angel violates safety during \(t < T/2\).
1D driving is well-studied for classical systems, but the constructive reach-avoid proof [10] is subtle. The proof constructs an envelope of safe upper and live lower bounds on velocity as a function of position (Fig. 1). The blue point indicates where Angel must begin to brake to ensure time-triggered safety. It is surprising that Angel can achieve postcondition \(g=x \wedge v=0\), given that trichotomy (\(f < g \vee f = g \vee f > g\)) is constructively invalid. The key [10] is that comparison terms \(\min (f,g)\) and \(\max (f,g)\) are exact in Type 2 computability where bits of \(\min \) and \(\max \) may be computed lazily. Our exact result encourages us that constructivity is not overly burdensome in practice. When decidable comparisons (\(f < g + \delta \vee f > g\)) are needed, the alternative is a weaker guarantee \(g-\varepsilon \le x \le g\) for parameter \(\varepsilon > 0\). This relaxation is often enough to make the theorem provable, and reflects the fact that real agents only expect to reach their goal within finite precision.