Abstract
Hybrid games combine discrete, continuous, and adversarial dynamics. Differential game logic () enables proving (classical) existence of winning strategies. We introduce constructive differential game logic (CdGL) for hybrid games, where proofs that a player can win the game correspond to computable winning strategies. This constitutes the logical foundation for synthesis of correct control and monitoring code for safetycritical cyberphysical systems. Our contributions include novel semantics as well as soundness and consistency.
Keywords
 Game logic
 Constructive logic
 Hybrid games
 Dependent types
This research was sponsored by the AFOSR under grant number FA95501610288 and the Alexander von Humboldt Foundation. The first author was also funded by an NDSEG Fellowship.
Download conference paper PDF
1 Introduction
Differential Game Logic () provides a calculus for proving the (classical) existence of winning strategies for hybrid games [42], whose mixed discrete, continuous, and adversarial dynamics are compelling models for cyberphysical systems (CPSs). Classical existence does not necessarily imply that the resulting winning strategies are computable, however. To overcome this challenge, this paper introduces Constructive Differential Game Logic (CdGL) with a CurryHoward correspondence: constructive proofs for constructive hybrid games correspond to programs implementing their winning strategies. We develop a new typetheoretic semantics which elucidates this correspondence and an operational semantics which describes the execution of strategies. Besides its theoretical appeal, this CurryHoward interpretation provides the foundation for proofdriven synthesis methods, which excel at synthesizing expressive classes of games for which synthesis and correctness require interactive proof. Hybrid games are a compelling domain for proofbased synthesis both because many CPS applications are safetycritical or even lifecritical, such as transportation systems, energy systems, and medical devices and because the combination of discrete, continuous, and adversarial dynamics makes verification and synthesis undecidable in both theory and practice. Our example model and proof, while short, lay the groundwork for future case studies.
Challenges and Contributions. In addition to [42], we build directly on Constructive Game Logic (CGL) [9] for discrete games. Compared to CGL, we target a domain with readilyavailable practical applications (hybrid games), and introduce new typetheoretic and operational semantics which complement the realizability semantics of CGL while making CurryHoward particularly clear and providing a simple notion of strategy execution. We overcome the following challenges in the process:

Our semantics must carefully capture the meaning of constructive hybrid game strategies, including strategies for differential equations (ODEs).

Soundness must be justified constructively. We adapt previous arguments to use constructive analysis [6, 12] by appealing to constructive formalizations of ODEs [17, 34]. This adaptation to our new semantics makes it possible to simplify statements of some standard lemmas.

We study 1D driving control as an example, which demonstrates the strengths of both games and constructivity. Games and constructivity both introduce uncertainties: A player is uncertain how their opponent will play, while constructive realnumber comparisons are never sure of exact equality. These uncertainties demand more nuanced proof invariants, but these nuances improve our fidelity to real systems.
These contributions are of likely interest to several communities. Other constructive program logics could reuse our semantic approach. Our example uses reachavoid proofs for hybrid games, a powerful, underexplored [48] approach.
2 Related Work
We discuss related works on games, constructive logic, and hybrid systems.
Games in Logic. Propositional GL was introduced by Parikh [39]. GL is a program logic in the spirit of Hoare calculi [26] or especially dynamic logics (DL) [47]: modalities capture the effect of game execution. GLs are unique in their clear delegation of strategy to the proof language rather than the model language, allowing succinct game specifications with sophisticated winning strategies. Succinct specifications are important: specifications are trusted because proving the wrong theorem would not ensure correctness. Relatives without this separation include SL [14], ATL [2], CATL [27], SDGL [23], structured strategies [49], DEL [3, 5, 56], evidence logic [4], and Angelic Hoare Logic [35].
Constructive Modal Logics. We are interested in the semantics of games, thus we review constructive modal semantics generally. This should not be confused with game semantics [1], which give a semantics to programs in terms of games. The main semantic approaches for constructive modal logics are intuitionistic Kripke semantics [58] and realizability semantics [32, 38]. CGL [9] used a realizability semantics which operate on a state, reminiscent of state in Kripke semantics, whereas we interpret CdGL formulas into type theory.
Modal CurryHoward is relatively littlestudied, and each author has their own emphasis. Explicit proof terms are considered for CGL [9] and a small fragment thereof [30]. Others [13, 18, 59] focus on intuitionistic semantics for their logics, fragments of CGL. Our semantics should be of interest for these fragments. We omit proof terms for space. CdGL proof terms would extend CGL proof terms [9] with a constructive version of existing classical ODE proof terms [8]. Propositional modal logic [37] has been interpreted as a type system.
Hybrid Systems Synthesis. Hybrid games synthesis is one motivation of this work. Synthesis of hybrid systems (1player games) is an active area. The unique strength of proofbased synthesis is expressiveness: it can synthesize every provable system. CdGL proofs support firstorder regular games with firstorder (e.g., semialgebraic) initial and goal regions. While synthesis and proof are both undecidable, interactive proof for undecidable logics is wellunderstood. The ModelPlex [36] synthesizer for CdGL’s classical systems predecessor dL [44] recently added [11] proofbased synthesis to improve expressiveness. CdGL aims to provide a computational foundation for a more systematic proofbased synthesizer in the more general context of games.
Fully automatic synthesis, in contrast, restricts itself to small fragments in order to sidestep undecidability. Studied classes include rectangular hybrid games [25], switching systems [52], linear systems with polyhedral sets [31, 52], and discrete abstractions [20, 21]. A wellknown [55] systems synthesis approach translates specifications into finitealternation games. Arbitrary firstorder games are our source rather than target language. Their approach is only known to terminate for simpler classes [50, 51].
3 Constructive Hybrid Games
Hybrid games in CdGL are 2player, zerosum, and perfectinformation, where continuous subgames are ordinary differential equations (ODEs) whose duration is chosen by a player. Hybrid games should not be confused with differential games which compete continuously [29, 43]. The players considered in this paper are Angel and Demon where the player currently controlling choices is always called Angel, while the player waiting to play is always called Demon. For any game \(\alpha \) and formula \(\phi ,\) the modal formula says Angel can play \(\alpha \) to ensure postcondition \(\phi ,\) while says Demon can play \(\alpha \) to ensure postcondition \(\phi \). These generalize safety and liveness modalities from DL. Dual games unique to GLs, take turns by switching the Angel and Demon roles in game \(\alpha \). The CurryHoward interpretation of a proof of a CdGL modality or is a program which performs each player’s winning strategy. Games can have several winning strategies, each corresponding to a different proof and a different program.
3.1 Syntax of CdGL
We introduce the language of CdGL with three classes of expressions e: terms f, g, games \(\alpha ,\beta ,\) and formulas \(\phi , \psi .\) We characterize terms semantically for the sake of generality: a shallow embedding of CdGL inside a proof assistant might use the host language for terms. For games and formulas, we find it more convenient to explicitly and syntactically define a closed language.
A (scalar) semantic term is a function from states to reals, which are understood constructively à la Bishop [6, 12]. We use Bishopstyle real analysis because it preserves many classical intuitions (e.g., uncountability) about \(\mathbb {R} \) while ensuring computability. Type2 [57] computability requires that all functions on real numbers are computable to arbitrary precision if represented as streams of bits, yet computability does not require that variables range over only computable reals. It is a theorem [57] that all such computable functions are continuous, but not always Lipschitzcontinuous nor differentiable.
We introduce commonly used term constructs, which are not exhaustive because the language of terms is open. The simplest terms are game variables \(x, y \in \mathcal {V}\) where \(\mathcal {V}\) is the (at most countable) set of variable identifiers. The game variables, which are mutable, contain the state of the game, which is globally scoped. For every base game variable x there is a primed counterpart \({x'}\) whose purpose within an ODE is to track the time derivative of x. Realvalued terms f, g are simply type2 computable functions, usually from states to reals. It is occasionally useful for f to return a tuple of reals, which are computable when every component is computable. Since terms are functions, operators are combinators: \(f + g\) is a function which sums the results of f and g.
Definition 1
(Terms). A term f, g is any computable function over the game state. The following constructs appear in this paper:
where \(c \in \mathbb {R}\) is a real literal, x a game variable, \(f + g\) a sum, \(f \cdot g\) a product, and \(f / g\) is real division of f by g. Divisors g are assumed to be nonzero. Minimum and maximum of terms f and g are written \(\min (f,g)\) and \(\max (f,g)\). Any differentiable term f has a definable (Sect. 4.2) spatial differential term \((f)',\) which agrees with the time derivative within an ODE.
CdGL is constructive, so Angel strategies make choices computably. Until his turn, Demon just observes Angel’s choices, and does not care whether Angel made them computably. We discuss gameplaying informally here, then formally in Sect. 4. In are the ODE and dual games, which respectively distinguish hybrid games from discrete games and games from systems.
Definition 2
(Games). The set of games \(\alpha ,\beta \) is defined recursively as such:
The test game is a noop if Angel proves \(\phi ,\) else Demon wins by default since Angel “broke the rules”. A deterministic assignment updates game variable x to the value of term f. Nondeterministic assignments ask Angel to compute the new value of \(x : \mathbb {R},\) i.e., Angel’s strategy for is a term whose value is assigned to x. The ODE game evolves ODE \({x'}=f\) for duration \(d \ge 0\) chosen by Angel such that Angel proves the domain constraint formula \(\psi \) is true throughout. We require that term f is effectivelylocallyLipschitz on domain \(\psi \), meaning that at every state satisfying \(\psi ,\) a neighborhood and coefficient L can be constructed such that L is a Lipschitz constant of f in the neighborhood. Effective local Lipschitz continuity guarantees unique solutions exist by constructive PicardLindelöf [34]. ODEs are explicitform, so no primed variable \({y'}\) for \(y \in \mathcal {V}\) is mentioned in f or \(\psi \). Systems of ODEs are supported, we present single equations for readability. In the choice game \(\alpha \cup \beta ,\) Angel chooses whether to play game \(\alpha \) or game \(\beta \). In the sequential composition game \(\alpha ;\beta \), game \(\alpha \) is played first, then \(\beta \) from the resulting state. In the repetition game Angel chooses after each repetition of \(\alpha \) whether to continue playing, but must not repeat \(\alpha \) infinitely. The exact number of repetitions is not known in advance, because it may depend on Demon’s reactions. In the dual game Angel takes the Demon role and viceversa while playing \(\alpha \). Demon strategies “wait” until a dual game is encountered, then play an Angelic strategy for \(\alpha \). We parenthesize games with braces \(\{ \alpha \}\) when necessary.
Definition 3
(CdGL Formulas). The CdGL formulas \(\phi \) (also \(\psi \)) are:
Above, \(f \sim g\) is a comparison formula for \({\sim }\mathrel {\in }\{\le , <, =, \ne , >, \ge \}\). The defining formulas of CdGL (and GL) are the modalities and . These mean that Angel or Demon respectively have a constructive strategy to play hybrid game \(\alpha \) and prove postcondition \(\phi \). We do not develop modalities for existence of classical strategies because those cannot be synthesized to executable code.
Standard connectives are defined from games and comparisons. Verum (\(\mathtt{tt}\)) is defined \(1 > 0\) and falsum (\(\mathtt{ff}\)) is \(0 > 1\). Conjunction \(\phi \wedge \psi \) is defined disjunction \(\phi \vee \psi \) is defined and implication \(\phi \rightarrow \psi \) is defined . Real quantifiers and are defined and respectively. As usual, equivalence \(\phi \leftrightarrow \psi \) reduces to \((\phi \rightarrow \psi ) \wedge (\psi \rightarrow \phi ),\) negation \(\lnot \phi \) is defined as \(\phi \rightarrow \mathtt{ff}\), and inequality is defined by \(f \ne g \equiv \lnot (f = g)\). Semantics and proof rules are needed only for core constructs, but we use derived constructs when they improve readability. Keep these definitions in mind, because the semantics and rules for some game connectives mirror firstorder connectives.
For convenience, we also write derived operators where Demon is given control of a single choice before returning control to Angel. The Demonic choice defined says Demon chooses which branch to take, but Angel controls the subgames. Demonic repetition is defined likewise by .
We write (likewise for \(\alpha \) and f) for the renaming of variable x for y and vice versa in formula \(\phi \), and write for the result of substitution of term f for game variable x in \(\phi \), if the substitution is admissible (Definition 12 on page 14).
3.2 Example Game
We give an example game and theorem statements, proven in [10]. Automotive systems are a major class of CPS. As a simple indicative example we consider timetriggered 1dimensional driving with adversarial timing. For maximum time T between control cycles, we let Demon choose any duration in [0, T]. When we need to prohibit pathological “Zeno” behaviors while keeping constraints realistic, we can further restrict \(t \in [T/2, T]\).
We write x for the current position of the car, v for its velocity, a for the acceleration, \(A > 0\) for the maximum positive acceleration, and \(B > 0\) for the maximum braking rate. We assume \(x=v=0\) initially to simplify arithmetic. In timetriggered control, the controller runs at least once every \(T > 0\) time units. Time and physics are continuous, T gives an upper bound on how often the controller runs. Local clock t marks the current time within the current timestep, then resets at each step. The control game (\(\textsf {ctrl} \)) says Angel can pick any acceleration a that is physically achievable (\(B \le a \le A\)). The clock t is then reinitialized to 0. The plant game (\(\textsf {plant} \)) says Demon can evolve physics for duration \(t \in [0,T]\) such that \(v \ge 0\) throughout, then returns control to Angel.
Typical theorems in DLs and GLs are safety and liveness: are unsafe states always avoided and are desirable goals eventually reached? Safety and liveness of the 1D system has been proved previously: safe driving (\(\textsf {safety}\)) never goes past goal g, while live driving eventually reaches g (\(\textsf {liveness}\)).
Liveness theorem \(\textsf {liveness}\) requires a lower time bound () to rule out Zeno strategies where Demon “cheats” by exponentially decreasing durations to essentially freeze the progress of time. The limit \(t \ge T/2\) is chosen for simplicity. Safety theorem \(\textsf {safety}\) omits this constraint because even Zeno behaviors are safe.
Safety and liveness theorems, if designed carelessly, have trivial solutions including but not limited to Zeno behaviors. It is safe to remain at \(x=0\) and is live to maintain \(a = A,\) but not viceversa. In contrast to DLs, GLs easily express the requirement that the same strategy is both safe and live: we must remain safe while reaching the goal. We use this reachavoid specification because it is immune to trivial solutions. We give a new reachavoid result for 1D driving.
Example 4
(Reachavoid). The following is provable in and CdGL:
Angel reaches \(g=x \wedge v=0\) while safely avoiding states where \(x \le g\) does not hold. Angel is safe at every iteration for every time \(t \in [0,T]\), thus safe throughout the game. The (dual) test appears second, allowing Demon to win if Angel violates safety during \(t < T/2\).
1D driving is wellstudied for classical systems, but the constructive reachavoid proof [10] is subtle. The proof constructs an envelope of safe upper and live lower bounds on velocity as a function of position (Fig. 1). The blue point indicates where Angel must begin to brake to ensure timetriggered safety. It is surprising that Angel can achieve postcondition \(g=x \wedge v=0\), given that trichotomy (\(f < g \vee f = g \vee f > g\)) is constructively invalid. The key [10] is that comparison terms \(\min (f,g)\) and \(\max (f,g)\) are exact in Type 2 computability where bits of \(\min \) and \(\max \) may be computed lazily. Our exact result encourages us that constructivity is not overly burdensome in practice. When decidable comparisons (\(f < g + \delta \vee f > g\)) are needed, the alternative is a weaker guarantee \(g\varepsilon \le x \le g\) for parameter \(\varepsilon > 0\). This relaxation is often enough to make the theorem provable, and reflects the fact that real agents only expect to reach their goal within finite precision.
4 TypeTheoretic Semantics
In this section, we define the semantics of hybrid games and game formulas in type theory. We start with assumptions on the underlying type theory.
4.1 Type Theory Assumptions
We assume a Calculus of Inductive and Coinductive Constructions (CIC)like type theory [15, 16, 54] with polymorphism and dependency. We write M for terms and to say M has type \(\tau \) in CIC context \(\varDelta \). We assume firstclass (indexed [19]) inductive and coinductive types. We write \(\tau \) for type families and \(\kappa \) for kinds: type families inhabited by other type families. Inductive type families are written \(\mu {t:\kappa }.\,{\tau },\) which denotes the smallest solution ty of kind \(\kappa \) to the fixedpoint equation Coinductive type families are written \(\rho {t:\kappa }.\,{\tau },\) which denotes the largest solution ty of kind \(\kappa \) to the fixedpoint equation Typeexpression \(\tau \) must be monotone in t so smallest and largest solutions exist by KnasterTarski [24, Thm. 1.12]. Proof assistants like Coq reject definitions where monotonicity requires nontrivial proof; we did not mechanize our proofs because they use such definitions.
We use one predicative universe which we write \(\mathbb {T}\) and Coq writes Type 0. Predicativity is an important assumption because our semantic definition is a large elimination, a feature known to interact dangerously with impredicativity. We write \(\mathrm{{\Pi }} x\mathrel {:}\tau _1.\,\tau _2\) for a dependent function type with argument named x of type \(\tau _1\) and where return type \(\tau _2\) may mention x. We write \(\mathrm{{\Sigma }} x\mathrel {:}\tau _1.\,\tau _2\) for a dependent pair type with left component named x of type \(\tau _1\) and right component of type \(\tau _2,\) possibly mentioning x. These specialize to the simple function \(\tau _1 \Rightarrow \tau _2\) and product types \(\tau _1\,\texttt {*}\,\tau _2\) respectively when x is not mentioned in \(\tau _2\). Lambdas \((\lambda x:\tau .\, M)\) inhabit dependent function types. Pairs (M, N) inhabit dependent pair types. Application is \(M\ N\). Letbinding unpacks pairs, whose left and right projection are \(\pi _{L}M\) and \(\pi _{R}M\). We write \(\tau _1 + \tau _2\) for a disjoint union inhabited by \(\ell \cdot M\) and \(r \cdot M,\) and write \(\textsf {case}\ A\ \textsf {of}~ p \Rightarrow B~~ q \Rightarrow C\) for its case analysis.
We assume a real number type \(\mathbb {R} \) and a Euclidean state type . The positive real numbers are written \(\mathbb {R} _{>0}\), nonnegative reals \(\mathbb {R} _{\ge 0}\). We assume scalar and vector sums, products, inverses, and units. States s, t support operations \({s}\ x\) and \({{\textsf {set}}}\ {s}\ x\ v\) which respectively retrieve the value of variable x in or update it to v. The usual axioms of setters and getters [22] are satisfied. We write for the distinguished variable of type representing the current state. We will find it useful to consider the semantics of an expression both at current state and at states s, t defined in terms of (e.g., ).
4.2 Semantics of CdGL
Terms f, g are typetheoretic functions of type . We will need differential terms \((f)',\) a definable term construct when f is differentiable. Not every term f need be differentiable, so we give a virtual definition, defining when \((f)'\) is equal to some term g. If \((f)'\) does not exist, then \((f)' = g\) is not provable. We define the (total) differential as the Euclidean dot product (\({\boldsymbol{\cdot }}\)) of the gradient (variable name: \(\nabla \)) with \({s'},\) which is the vector of values \(s\, {x'}\) assigned to primed variables \({x'}\). To show that \(\nabla \) is the gradient, we define the gradient as a limit, which we express in \((\varepsilon ,\delta )\) style. In this definition, f and g are scalarvalued, and the minus symbol is used for both scalar and vector difference.
For practical proofs, a library of standard rules for automatic, syntactic differentiation of common arithmetic operations [7] could be proven.
The interpretation of formula \(\phi \) is a predicate over states. A predicate of kind is also understood as a region, e.g., is the region containing states where \(\phi \) is provable. A CdGL context \(\varGamma \) is interpreted over a uniform state term where i.e., s usually mentions . We define to be the CIC context containing and for each \(\phi \in \varGamma \). The sequent \((\varGamma \vdash \phi )\) is valid if there exists M where . Formula \(\phi \) is valid iff sequent is valid. That is, a valid formula is provable in every state with a common proof term M. The witness may inspect the state, but must do so constructively. Formula semantics employ the Angelic and Demonic semantics of games, which determine how to win a game \(\alpha \) whose postcondition is \(\phi \). We write for the Angelic semantics of \(\alpha \) and for its Demonic semantics.
Definition 5
(Formula semantics). Angel and Demon strategies for a hybrid game \(\alpha \) with goal region P are inhabitants of \(\langle \!\langle {\alpha }\rangle \!\rangle \ P\) and \([[{\alpha }]]\ P,\) respectively.
Modality is provable in s when is inhabited so Angel has an \(\alpha \) strategy from s to reach region on which \(\phi \) is provable. Modality is provable in s when is inhabited so Demon has an \(\alpha \) strategy from s to reach region on which \(\phi \) is provable. For \({\sim } \mathrel {\in } \{\le ,<,=,\ne ,>,\ge \},\) the values of f and g are compared at state s in \(f \sim g\). The game and formula semantics are simultaneously inductive. In each case, the connectives which define \(\langle \!\langle {\alpha }\rangle \!\rangle \) and \([[{\alpha }]]\) are duals, because and are dual. Below, P refers to the goal region of the game and s to the initial state.
Definition 6
(Angel semantics). We define inductively (by a large elimination) on \(\alpha \):
Angel wins by proving both \(\psi \) and P at s. Angel wins the deterministic assignment by performing the assignment, then proving P. Angel wins nondeterministic assignment by constructively choosing a value v to assign, then proving P. Angel wins \(\alpha \cup \beta \) by choosing between playing \(\alpha \) or \(\beta ,\) then winning that game. Angel wins \(\alpha ;\beta \) if she wins \(\alpha \) with the postcondition of winning \(\beta \). Angel wins if she wins \(\alpha \) in the Demon role. Angel wins ODE game by choosing some solution sol of some duration \(d\) which satisfies the ODE and domain constraint throughout and the postcondition \(\phi \) at time \(d\). While toplevel postconditions rarely mention \({x'},\) intermediate invariant steps do, thus x and \({x'}\) both are updated in the postcondition. The construct \((sol,s,d \vDash {x'}=f),\) saying sol solves \({x'}=f\) from state s for time \(d\), is defined:
Note that variable sol stands for a function of the host theory, all of which are computable and therefore continuous. When \((sol,s,d \vDash {x'}=f)\) holds, sol is also continuously differentiable. Constructive PicardLindelöf [34] constructs a solution for every effectivelylocallyLipschitz ODEs, which need not have a closed form. The proof calculus we introduce in Sect. 5 includes both solutionbased proof rules, which are useful for ODEs with simple closed forms, and invariantbased rules, which enable proof even when closed forms do not exist.
Angel strategies for are inductively defined: either choose to stop the loop and prove P now, else play a round of \(\alpha \) before repeating inductively. By KnasterTarski [24, Thm. 1.12], this least fixed point exists because the interpretation of a game is monotone in its postcondition (Lemma 7).
Lemma 7
(Monotonicity). Let . If then there exists a term N such that
Definition 8
(Demon semantics). We define inductively (by a large elimination) on \(\alpha \):
Demon wins by proving P under assumption \(\psi \), which Angel must provide (Sect. 7). Demon’s deterministic assignment is identical to Angel’s. Demon wins by proving \(\psi \) for every choice of x. Demon wins \(\alpha \cup \beta \) with a pair of winning strategies. Demon wins \(\alpha ;\beta \) by winning \(\alpha \) with a postcondition of winning \(\beta \). Demon wins if he can win \(\alpha \) after switching roles with Angel. Demon wins if for an arbitrary duration and arbitrary solution which satisfy the domain constraint, he can prove the postcondition. Demon wins if he can prove P no matter how many times Angel makes him play \(\alpha \). Demon repetition strategies are coinductive using some invariant \(\tau '\). When Angel decides to stop the loop, Demon responds by proving P from \(\tau '\). Whenever Angel chooses to continue, Demon proves that \(\tau '\) is preserved. Greatest fixed points exist by KnasterTarski [24, Thm. 1.12] using Lemma 7.
It is worth comparing the Angelic and Demonic semantics of . An Angel strategy says how to compute x. A Demon strategy simply accepts \(x \in \mathbb {R} \) as its input, even uncomputable numbers. This is because Angel strategies supply a computable real while Demon acts with computable outputs given real inputs. In general, each strategy is constructive but permits its opponent to play classically. In the cyberphysical setting, the opponent is indeed rarely a computer.
5 Proof Calculus
To enable direct syntactic proof, we give a natural deductionstyle system for CdGL. We write \(\varGamma = \psi _1, \ldots , \psi _n\) for a context of formulas and \(\varGamma \vdash \phi \) for the naturaldeduction sequent with conclusion \(\phi \) and context \(\varGamma \). We begin with rules shared by CGL [9] and CdGL, then give the ODE rules. We write for the renaming of game variable x to y and vice versa in context \(\varGamma \). Likewise is the substitution of term f for game variable x. To avoid repetition, we write to indicate that the same rule applies for and . These rules write for the dual of . We write \(\mathop {\text {FV}}(e),\) \(\mathop {\text {BV}}(\alpha ),\) and \(\mathop {\text {MBV}}(\alpha )\) for the free variables of expression e, bound variables of game \(\alpha ,\) and mustbound variables of game \(\alpha \) respectively, i.e., variables which might influence the meaning of an expression, might be modified during game execution, or are written during every execution.
Figure 2 gives the propositional game rules. Rule [?]E is modus ponens and [?]I is implication introduction because is implication. Angelic choices are disjunctions introduced by \(\langle \cup \rangle \)I1 and \(\langle \cup \rangle \)I2 and caseanalyzed by \(\langle \cup \rangle \)E. Angelic tests and Demonic choices are conjunctions introduced by \(\langle ? \rangle \)I and \([\cup ]\)I, eliminated by \(\langle ? \rangle \)E1, \(\langle ? \rangle \)E2, \([\cup ]\)E1, and \([\cup ]\)E2. Rule hyp applies an assumption.
Figure 3 covers assignment, choice, sequencing, duals, and monotonicity. Angelic games have injectors (\(\langle * \rangle \mathrm{S},\langle * \rangle \mathrm{G}\)) and case analysis (\(\langle * \rangle \mathrm{E}\)). Duality switches players by switching modalities. Sequential games are decomposed as nested modalities.
Monotonicity (M) is Lemma 7 in rule form. The second premiss writes to indicate that the bound variables of \(\alpha \) must be freshly renamed in \(\varGamma \) for soundness. Rule M is used for generalization because all GLs are subnormal, lacking axiom K (modal modus ponens) and necessitation. Common uses include concise righttoleft symbolic execution proofs and, in combination with , Hoarestyle sequential composition reasoning.
Nondeterministic assignments quantify over realvalued game variables. Assignments remember the initial value of x in fresh variable y () for sake of completeness, then provide an assumption that x has been assigned to f. Skolemization \([:*]\)I boundrenames x to y in \(\varGamma \), written . Specialization \([:*]\)E instantiates x to a term f by substituting . Existentials are introduced by giving a witness f in \(\langle {:\!*}\rangle \)I. Herbrandization \(\langle {:\!*}\rangle \)E unpacks existentials, soundness requires x is not free in \(\psi \).
Figure 4 provides rules for repetitions. In rule \(\langle * \rangle \)I, \(\mathcal {M}\) indicates an arbitrary termination metric where \(\boldsymbol{\succ }\) and \(\boldsymbol{\succcurlyeq }\) denote strict and nonstrict comparison in an arbitrary (effectively) wellfounded [28] partial order. Metavariable \({\boldsymbol{0}}\) represents a terminal value at which iteration stops; we will choose \({\boldsymbol{0}}= 0\) in our example, but \({\boldsymbol{0}}\) need not be 0 in general. \(\mathcal {M}_0\) is a fresh variable which remembers \(\mathcal {M}\). Angel plays by repeating an \(\alpha \) strategy which always decreases the termination metric. Angel maintains a formula \(\varphi \) throughout, and stops once \(0 \boldsymbol{\succcurlyeq }\mathcal {M}\). The postcondition need only follow from termination condition \(0 \boldsymbol{\succcurlyeq }\mathcal {M}\) and convergence formula \(\varphi \). Simple real comparisons \(x \ge y\) are not wellfounded, but inflated comparisons like \(x \ge y + 1\) are. Wellfounded metrics ensure convergence in finitely (but often unboundedly) many iterations. In the simplest case, \(\mathcal {M}\) is a realvalued term. Generalizing \(\mathcal {M}\) to tuples enables, e.g., lexicographic termination metrics. For example, the metric in the proof of Example 4 is the distance to the goal, which must decrease by some minimum amount each iteration.
Repetition games can be folded and unfolded (\([*]\)E, \([*]\)R). Rule FP says is a least prefixedpoint. It works backwards: first show \(\psi \) holds after then preserve \(\psi \) when each iteration is unwound. Rule loop is the repetition invariant rule. Demonic repetition is eliminated by \([*]\)E.
Like any firstorder program logic, CdGL proofs contain firstorder reasoning at the leaves. Decidability of constructive real arithmetic is an open problem [33], so firstorder facts are proven manually in practice. Our semantics embed CdGL into type theory; we defer firstorder arithmetic proving to the host theory. Even effectivelywellfounded \(\boldsymbol{\succcurlyeq }\) need not have decidable guards (\({\boldsymbol{0}}\boldsymbol{\succ }\mathcal {M}\vee \mathcal {M}\boldsymbol{\succcurlyeq }{\boldsymbol{0}}\)) since exact comparisons are not computable [6]. We may not be able to distinguish \(\mathcal {M}= {\boldsymbol{0}}\) from very small positive values of \(\mathcal {M},\) leading to one unnecessary loop iteration, after which \(\mathcal {M}\) is certainly \({\boldsymbol{0}}\) and the loop terminates. Comparison up to \(\varepsilon > 0\) is decidable [12] (\(f > g \vee (f < g + \varepsilon )\)).
Figure 5 gives the ODE rules, which are a constructive version of those from [42]. For nilpotent ODEs such as the plant of Example 4, reasoning via solutions is possible. Since CdGL supports nonlinear ODEs which often do not have closedform solutions, we provide invariantbased rules, which are complete [46] for invariants of polynomial ODEs. Differential induction DI [41] says \(\phi \) is an invariant of an ODE if it holds initially and if its differential formula [41] \((\phi )'\) holds throughout, for example \((f \ge g)' \equiv ((f)' \ge (g)')\). Soundness of DI requires differentiability, and \((\phi )'\) is not provable when \(\phi \) mentions nondifferentiable terms. Differential cut DC proves R invariant, then adds it to the domain constraint. Differential weakening DW says that if \(\phi \) follows from the domain constraint, it holds throughout the ODE. Differential ghosts DG permit us to augment an ODE system with a fresh dimension y, which enables [46] proofs of otherwise unprovable properties. We restrict the righthand side of y to be linear in y and (uniformly) continuous in x because soundness requires that ghosting \({y'}\) does not change the duration of an ODE. A linear righthand side is guaranteed to be Lipschitz on the whole existence interval of equation \({x'} = f,\) thus ensuring an unchanged duration by (constructive) PicardLindelöf [34]. Differential variants [41, 53] DV is an Angelic counterpart to DI. The schema parameters d and \(\varepsilon \) must not mention \(x,{x'},t,{t'}\). To show that f eventually exceeds g, first choose a duration d and a sufficiently high minimum rate \(\varepsilon \) at which \(hg\) will change. Prove that \(hg\) decreases at rate at least \(\varepsilon \) and that the ODE has a solution of duration d satisfying constraint \(\psi \). Thus at time d, both \(h \ge g\) and its provable consequents hold. Rules bsolve and dsolve assume as a side condition that sln is the unique solution of \({x'}=f\) on domain \(\psi \). They are convenient for ODEs with simple solutions, while invariant reasoning supports complicated ODEs.
6 Theory: Soundness
Following constructive counterparts of classical soundness proofs for , we prove that the CdGL proof calculus is sound: provable formulas are true in the CIC semantics. For the sake of space, we give statements and some outlines here, reporting all proofs and lemmas elsewhere [10]. Similar lemmas have been used to prove soundness of [45], but our new semantics lead to simpler statements for Lemmas 10 and 11. The coincidence property for terms is not proved but assumed, since we inherit a semantic treatment of terms from the host theory. Let be s with the values of x and y swapped. Let be \({{\textsf {set}}}\ {s}\ x\ (f\ s).\) Defined CIC term \(s \overset{{V}}{=} t \leftrightarrow \texttt {*}_{x\in V}{(s\ x = t\ x)}\) says s and t agree on all \(x \in V\).
Lemma 9
(Uniform renaming). Let rename x and y in proof term M.

If then .
Lemma 10
(Coincidence). Assume \(s\overset{{V}}{=} t\) where \(V \supseteq \mathop {\text {FV}}(\varGamma ) \cup \mathop {\text {FV}}(\phi ).\)

If then exists N such that .
Lemma 11
(Bound effect). Let and let \(V\subseteq \mathop {\text {BV}}(\alpha )^\complement ,\) the complement of bound variables of \(\alpha \).

There exists M such that iff there exists N such that .

There exists M such that iff there exists N such that .
Definition 12
(Term substitution admissibility [40, Def. 6]). For a formula \(\phi ,\) (likewise for context \(\varGamma ,\) term f, and game \(\alpha \)) we say is admissible if x never appears free in \(\phi \) under a binder of \(\{x\} \cup \mathop {\text {FV}}(f)\).
Lemma 13
(Term substitution). Let substitute f for x in proof term M. Let and be admissible.

If then .
The converse implication also holds, though its witness is not necessarily M.
Soundness of the proof calculus follows from the lemmas, and soundness of the ODE rules employing several known results from constructive analysis.
Theorem 14
(Soundness). If holds, then sequent \((\varGamma \vdash \phi )\) is valid. As a special case, if holds, then formula \(\phi \) is valid.
Proof Sketch
By induction on the derivation. The assignment case holds by Lemma 13 and Lemma 9. Lemma 10 and Lemma 11 are applied when maintaining truth of a formula across changing state. The equality and inequality cases of DI and DV employ the constructive meanvalue theorem [10, Thm. 21], which has been formalized, e.g., in Coq [17]. Rules DW, bsolve, and dsolve follow from the semantics of ODEs. Rule DC uses the fact that prefixes of solutions are solutions. Rule DG uses constructive PicardLindelöf [34], which constitutes an algorithm for arbitrarily approximating the solution of any Lipschitz ODE, with a convergence rate depending on its Lipschitz constant. \(\square \)
We have shown that every provable formula is true in the typetheoretic semantics. Because the soundness proof is constructive, it amounts to an extraction algorithm from CdGL into type theory: for each CdGL proof, there exists a program in type theory which inhabits the corresponding type of the semantics.
7 Theory: Extraction and Execution
Another perspective on constructivity is that provable properties must have witnesses. We show Existential and Disjunction properties providing witnesses for existentials and disjunctions. For modal formulas and we show proofs can be used as winning strategies: a bigstep operational semantics \(\textsf {play}\) allows playing strategies against each other to extract a proof that their goals hold in some final state t. Our presentation is more concise than defining the language, semantics, and properties of strategies, while providing key insights.
Lemma 15
(Existential Property). Let . If then there exist terms \(f:\mathbb {R} \) and N such that .
Lemma 16
(Disjunction Property). If then there exists a proof term N such that or .
The proofs follow their counterparts in type theory. The Disjunction Property considers truth at a specific state. Validity of \(\phi \vee \psi \) does not imply validity of either \(\phi \) or \(\psi \). For example, \(x < 1 \vee x > 0\) is valid, but its disjuncts are not.
Function \(\textsf {play}\) below gives a bigstep semantics: Angel and Demon strategies \(\textsf {as}\) and \(\textsf {ds}\) for respective goals \(\phi \) and \(\psi \) in game \(\alpha \) suffice to construct a final state t satisfying both. By parametricity, t was found by playing \(\alpha \), because \(\textsf {play}\) cannot inspect P and Q, thus can only prove them via \(\textsf {as}\) and \(\textsf {ds}\).
Applications of \(\textsf {play}\) are written \(\textsf {play}_{\alpha }\ s\ \textsf {as}\ \textsf {ds}\) (P and Q implicit). Game consistency (Corollary 17) is by \(\textsf {play}\) and consistency of type theory. Note that is played by swapping the Angel and Demon strategies in \(\alpha \).
Corollary 17
(Consistency). It is never the case that both and are inhabited.
Proof
Suppose and then \(\pi _{R}(\textsf {play}_{\alpha }\ s\ \textsf {as}\ \textsf {ds}) : \bot ,\) contradicting consistency of type theory. \(\square \)
The \(\textsf {play}\) semantics show how strategies can be executed. Consistency is a theorem which ought to hold in any GL and thus helps validate our semantics.
8 Conclusion and Future Work
We extended Constructive Game Logic CGL to CdGL for constructive hybrid games. We contributed new semantics. We presented a natural deduction proof calculus for CdGL and used it to prove reachavoid correctness of 1D driving with adversarial timing. We showed soundness and constructivity results.
The next step is to implement a proof checker, game interpreter, and synthesis tool for CdGL. Function \(\textsf {play}\) is the highlevel interpreter algorithm, while synthesis would commit to one Angel strategy and allow blackbox Demon implementations for an external environment. Angel strategies are positive and are synthesized by extracting witnesses from each introduction rule. Demonic invariants and test conditions describe allowed observable behaviors. Demon strategies are negative and characterized by observable behaviors, so it suffices to monitor their compliance with invariants and test conditions extracted from the proof.
References
Abramsky, S., Jagadeesan, R., Malacaria, P.: Full abstraction for PCF. Inf. Comput. 163(2), 409–470 (2000). https://doi.org/10.1006/inco.2000.2930
Alur, R., Henzinger, T.A., Kupferman, O.: Alternatingtime temporal logic. J. ACM 49(5), 672–713 (2002). https://doi.org/10.1145/585265.585270
Benthem, J.: Logic of strategies: what and how? In: van Benthem, J., Ghosh, S., Verbrugge, R. (eds.) Models of Strategic Reasoning. LNCS, vol. 8972, pp. 321–332. Springer, Heidelberg (2015). https://doi.org/10.1007/9783662485408_10
van Benthem, J., Pacuit, E.: Dynamic logics of evidencebased beliefs. Stud. Logica. 99(1–3), 61–92 (2011). https://doi.org/10.1007/s112250119347x
van Benthem, J., Pacuit, E., Roy, O.: Toward a theory of play: a logical perspective on games and interaction. Games (2011). https://doi.org/10.3390/g2010052
Bishop, E.: Foundations of Constructive Analysis. McGrawHill, New York (1967)
Bohrer, R., Fernández, M., Platzer, A.: \(\sf dL_{\iota }\): definite descriptions in differential dynamic logic. In: Fontaine, P. (ed.) CADE 2019. LNCS (LNAI), vol. 11716, pp. 94–110. Springer, Cham (2019). https://doi.org/10.1007/9783030294366_6
Bohrer, R., Platzer, A.: Toward structured proofs for dynamic logics. CoRR abs/1908.05535 (2019), http://arxiv.org/abs/1908.05535
Bohrer, R., Platzer, A.: Constructive game logic. ESOP 2020. LNCS, vol. 12075, pp. 84–111. Springer, Cham (2020). https://doi.org/10.1007/9783030449148_4
Bohrer, R., Platzer, A.: Constructive hybrid games. CoRR abs/2002.02536 (2020), https://arxiv.org/abs/2002.02536
Bohrer, R., Tan, Y.K., Mitsch, S., Myreen, M.O., Platzer, A.: VeriPhy: verified controller executables from verified cyberphysical system models. In: Grossman, D. (ed.) PLDI, pp. 617–630. ACM (2018). https://doi.org/10.1145/3192366.3192406
Bridges, D.S., Vita, L.S.: Techniques of Constructive Analysis. Springer, New York (2007). https://doi.org/10.1007/9780387381473
Celani, S.A.: A fragment of intuitionistic dynamic logic. Fundam. Inform. 46(3), 187–197 (2001). http://content.iospress.com/articles/fundamentainformaticae/fi46301
Chatterjee, K., Henzinger, T.A., Piterman, N.: Strategy logic. In: Caires, L., Vasconcelos, V.T. (eds.) CONCUR 2007. LNCS, vol. 4703, pp. 59–73. Springer, Heidelberg (2007). https://doi.org/10.1007/9783540744078_5
Coquand, T., Huet, G.P.: The calculus of constructions. Inf. Comput. 76(2/3), 95–120 (1988). https://doi.org/10.1016/08905401(88)900053
Coquand, T., Paulin, C.: Inductively defined types. In: MartinLöf, P., Mints, G. (eds.) COLOG 1988. LNCS, vol. 417, pp. 50–66. Springer, Heidelberg (1990). https://doi.org/10.1007/3540523359_47
CruzFilipe, L., Geuvers, H., Wiedijk, F.: CCoRN, the constructive Coq repository at Nijmegen. In: Asperti, A., Bancerek, G., Trybulec, A. (eds.) MKM 2004. LNCS, vol. 3119, pp. 88–103. Springer, Heidelberg (2004). https://doi.org/10.1007/9783540278184_7
Degen, J., Werner, J.: Towards intuitionistic dynamic logic. Log. Log. Philos. 15(4), 305–324 (2006). https://doi.org/10.12775/LLP.2006.018
Dybjer, P.: Inductive families. Formal Asp. Comput. 6(4), 440–465 (1994). https://doi.org/10.1007/BF01211308
Filippidis, I., Dathathri, S., Livingston, S.C., Ozay, N., Murray, R.M.: Control design for hybrid systems with TuLiP: the temporal logic planning toolbox. In: Conference on Control Applications, pp. 1030–1041. IEEE (2016). https://doi.org/10.1109/CCA.2016.7587949
Finucane, C., Jing, G., KressGazit, H.: LTLMoP: experimenting with language, temporal logic and robot control. In: IROS, pp. 1988–1993. IEEE (2010). https://doi.org/10.1109/IROS.2010.5650371
Foster, J.N.: Bidirectional programming languages. Technical report MSCIS1008, Department of Computer & Information Science, University of Pennsylvania, Philadelphia, PA, March 2010
Ghosh, S.: Strategies made explicit in dynamic game logic. In: Workshop on Logic and Intelligent Interaction at ESSLLI, pp. 74–81 (2008)
Harel, D., Kozen, D., Tiuryn, J.: Dynamic Logic. MIT Press, Cambridge (2000)
Henzinger, T.A., Horowitz, B., Majumdar, R.: Rectangular hybrid games. In: Baeten, J.C.M., Mauw, S. (eds.) CONCUR 1999. LNCS, vol. 1664, pp. 320–335. Springer, Heidelberg (1999). https://doi.org/10.1007/3540483209_23
Hoare, C.A.R.: An axiomatic basis for computer programming. Commun. ACM 12(10), 576–580 (1969). https://doi.org/10.1145/363235.363259
van der Hoek, W., Jamroga, W., Wooldridge, M.J.: A logic for strategic reasoning. In: Dignum, F., Dignum, V., Koenig, S., Kraus, S., Singh, M.P., Wooldridge, M.J. (eds.) AAMAS. ACM (2005). https://doi.org/10.1145/1082473.1082497
Hofmann, M., van Oosten, J., Streicher, T.: Wellfoundedness in realizability. Arch. Math. Log. 45(7), 795–805 (2006). https://doi.org/10.1007/s0015300600035
Isaacs, R.: Differential Games: A Mathematical Theory with Applications to Warfare and Pursuit, Control and Optimization. Series in Applied Mathematics (SIAM), Wiley, New York (1965)
Kamide, N.: Strong normalization of programindexed lambda calculus. Bull. Sect. Log. Univ. Łódź 39(1–2), 65–78 (2010)
Kloetzer, M., Belta, C.: A fully automated framework for control of linear systems from temporal logic specifications. IEEE Trans. Automat. Control 53(1), 287–297 (2008). https://doi.org/10.1109/TAC.2007.914952
Lipton, J.: Constructive Kripke semantics and realizability. In: Moschovakis, Y. (ed.) Logic From Computer Science, pp. 319–357. Springer, New York (1992). https://doi.org/10.1007/9781461228226_13
Lombardi, H., Mahboubi, A.: Théories géométriques pour l’algèbre des nombres réels. Contemp. Math. 697, 239–264 (2017)
Makarov, E., Spitters, B.: The Picard algorithm for ordinary differential equations in Coq. In: Blazy, S., PaulinMohring, C., Pichardie, D. (eds.) ITP 2013. LNCS, vol. 7998, pp. 463–468. Springer, Heidelberg (2013). https://doi.org/10.1007/9783642396342_34
Mamouras, K.: Synthesis of strategies using the Hoare logic of angelic and demonic nondeterminism. Log. Methods Comput. Sci. 12(3), 1–41 (2016). https://doi.org/10.2168/LMCS12(3:6)2016
Mitsch, S., Platzer, A.: ModelPlex: verified runtime validation of verified cyberphysical system models. Form. Methods Syst. Des. 49(1), 33–74 (2016). https://doi.org/10.1007/s107030160241z
Murphy VII, T., Crary, K., Harper, R., Pfenning, F.: A symmetric modal lambda calculus for distributed computing. In: LICS. IEEE (2004), https://doi.org/10.1109/LICS.2004.1319623
van Oosten, J.: Realizability: a historical essay. Math. Structures Comput. Sci. 12(3), 239–263 (2002). https://doi.org/10.1017/S0960129502003626
Parikh, R.: Propositional game logic. In: FOCS, pp. 195–200. IEEE (1983). https://doi.org/10.1109/SFCS.1983.47
Platzer, A.: Differential dynamic logic for hybrid systems. J. Autom. Reas. 41(2), 143–189 (2008). https://doi.org/10.1007/s1081700891038
Platzer, A.: Differentialalgebraic dynamic logic for differentialalgebraic programs. J. Log. Comput. 20(1), 309–352 (2010). https://doi.org/10.1093/logcom/exn070
Platzer, A.: Differential game logic. ACM Trans. Comput. Log. 17(1), 1:11:51 (2015). https://doi.org/10.1145/2817824
Platzer, A.: Differential hybrid games. ACM Trans. Comput. Log. 18(3), 19:119:44 (2017). https://doi.org/10.1145/3091123
Platzer, A.: Logical Foundations of CyberPhysical Systems. Springer, Cham (2018). https://doi.org/10.1007/9783319635880
Platzer, A.: Uniform substitution for differential game logic. In: Galmiche, D., Schulz, S., Sebastiani, R. (eds.) IJCAR 2018. LNCS (LNAI), vol. 10900, pp. 211–227. Springer, Cham (2018). https://doi.org/10.1007/9783319942056_15
Platzer, A., Tan, Y.K.: Differential equation invariance axiomatization. J. ACM 67, 1 (2020). https://doi.org/10.1145/3380825
Pratt, V.R.: Semantical considerations on FloydHoare logic. In: FOCS, pp. 109–121. IEEE (1976). https://doi.org/10.1109/SFCS.1976.27
Quesel, J.D., Platzer, A.: Playing hybrid games with KeYmaera. In: Gramlich, B., Miller, D., Sattler, U. (eds.) IJCAR 2012. LNCS (LNAI), vol. 7364, pp. 439–453. Springer, Heidelberg (2012). https://doi.org/10.1007/9783642313653_34
Ramanujam, R., Simon, S.E.: Dynamic logic on games with structured strategies. In: Brewka, G., Lang, J. (eds.) Knowledge Representation, pp. 49–58. AAAI Press (2008). http://www.aaai.org/Library/KR/2008/kr08006.php
Shakernia, O., Pappas, G.J., Sastry, S.: Semidecidable synthesis for triangular hybrid systems. In: Di Benedetto, M.D., SangiovanniVincentelli, A. (eds.) HSCC 2001. LNCS, vol. 2034, pp. 487–500. Springer, Heidelberg (2001). https://doi.org/10.1007/3540453512_39
Shakernia, O., Pappas, G.J., Sastry, S.: Decidable controller synthesis for classes of linear systems. In: Lynch, N., Krogh, B.H. (eds.) HSCC 2000. LNCS, vol. 1790, pp. 407–420. Springer, Heidelberg (2000). https://doi.org/10.1007/3540464301_34
Taly, A., Tiwari, A.: Switching logic synthesis for reachability. In: Carloni, L.P., Tripakis, S. (eds.) EMSOFT, pp. 19–28. ACM (2010). https://doi.org/10.1145/1879021.1879025
Tan, Y.K., Platzer, A.: An axiomatic approach to liveness for differential equations. In: ter Beek, M.H., McIver, A., Oliveira, J.N. (eds.) FM 2019. LNCS, vol. 11800, pp. 371–388. Springer, Cham (2019). https://doi.org/10.1007/9783030309428_23
The Coq development team: The Coq proof assistant reference manual (2019). https://coq.inria.fr/
Tomlin, C.J., Lygeros, J., Sastry, S.S.: A game theoretic approach to controller design for hybrid systems. Proc. IEEE 88(7), 949–970 (2000)
Van Benthem, J.: Games in dynamicepistemic logic. Bull. Econ. Res. 53(4), 219–248 (2001)
Weihrauch, K.: Computable Analysis  An Introduction. Texts in Theoretical Computer Science, Springer, Heidelberg (2000). https://doi.org/10.1007/9783642569999
Wijesekera, D.: Constructive modal logics I. Ann. Pure Appl. Log. 50(3), 271–301 (1990). https://doi.org/10.1016/01680072(90)90059B
Wijesekera, D., Nerode, A.: Tableaux for constructive concurrent dynamic logic. Ann. Pure Appl. Log. 135(1–3), 1–72 (2005). https://doi.org/10.1016/j.apal.2004.12.001
Acknowledgements
We thank Jon Sterling for suggestions regarding our choice of type theory and for references to the literature. We thank the anonymous reviewers for their helpful feedback.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.
Copyright information
© 2020 The Author(s)
About this paper
Cite this paper
Bohrer, R., Platzer, A. (2020). Constructive Hybrid Games. In: Peltier, N., SofronieStokkermans, V. (eds) Automated Reasoning. IJCAR 2020. Lecture Notes in Computer Science(), vol 12166. Springer, Cham. https://doi.org/10.1007/9783030510749_26
Download citation
DOI: https://doi.org/10.1007/9783030510749_26
Published:
Publisher Name: Springer, Cham
Print ISBN: 9783030510732
Online ISBN: 9783030510749
eBook Packages: Computer ScienceComputer Science (R0)