Ellipsoidal Techniques for Reachability Analysis

of Discrete-Time Linear Systems∗

Alex Kurzhanskiy and Pravin VaraiyaDepartment of Electrical Engineering and Computer Sciences

University of California, Berkeley, CA

June 30, 2005

Abstract

This paper describes the computation of reach sets for discrete-time linear controlsystems with time-varying coefficients and ellipsoidal bounds on the controls and initialconditions. The algorithms construct external and internal ellipsoidal approximationsso that they touch the reach set boundary from outside and from inside. Recurrencerelations that describe the time evolution of these approximations are provided. Thepaper also deals with discrete-time linear systems with singular state transition matrix.

1 Introduction

We extend the use of ellipsoidal methods for continuous-time linear systems developed in [1]to calculate the reach set for discrete-time linear systems. We also deal with systems with asingular state transition matrix and show how to approximate the reach set with any givenaccuracy using regularization and provide the means for picking the appropriate regulariza-tion parameters that guarantee this accuracy over a specified finite time interval. We makeno controllability assumptions regarding the system. Thus, the suggested regularizationtechnique also extends results of [1] to systems that are not completely controllable.

In case of singular state transition matrix, or if the system is not controllable at every timestep, the exact representation of the reach set on every time step by external ellipsoidalapproximation is not possible. But the exact representation is possible for the regularizedreach set that overapproximates the actual one, and whose boundary can be made arbitrarilyclose to the boundary of the actual one over any given finite time interval. Using internalellipsoidal approximations, on the other hand, it is always possible to exactly represent

∗Research supported by NSF Grant CCR-00225610.

1

the actual reach set. However, the concept of ‘good curves’ that was introduced in [1] andwithout which the computation process becomes heavy and complicated, can only be appliedfor systems with nonsingular state transition matrix. Therefore, in order to make use ofgood curves in the singular case, we perform the internal approximation of the regularizedreach set.

2 Related work

Research on dynamical and hybrid systems has produced methods for verification and con-troller synthesis. A common step in most methods is the calculation of reach sets. Forexample, [2] uses bounded model checking for verification of discrete-time linear hybridsystems. For that, the hybrid system is converted into a discrete transition system. Theconversion requires the computation of reach sets of discrete-time linear systems.

Exact computation of reach sets is not generally possible, and approximation techniquesare needed. The choice of the reach set representation determines the efficiency of suchtechniques. The more complex the representation is, the more costly is the storage of thesets, the more elaborate is the computation, but the better is the reach set approximation.Choosing the reach set representation is a compromise between these factors.

The level set method [3, 4] deals with general nonlinear controlled systems and gives exactrepresentation of their reach sets, but the computation is complex, requiring solving theHJB equation and finding the set of states that belong to sub-zero level set of the valuefunction. The method [4] is impractical for systems of dimension higher than three.

Reachability analysis of controlled linear systems with convex bounds on the control andinitial conditions reduces to effective manipulation with convex sets, performing set-valuedoperations such as unions, intersections, geometric sums and differences. Two basic objectsare used as convex approximations: various kinds of polytopes, e.g. general polytopes,zonotopes, parallelotopes, rectangular polytopes; and ellipsoids.

Reachability analysis and verification for discrete-time linear systems through general poly-topes are implemented in the Multi Parametric Toolbox (MPT) for Matlab [5], [6]. Thereach set at every time step is computed as the geometric sum of two polytopes. The pro-cedure consists in finding the vertices of the resulting polytope and calculating its convexhull. The convex hull algorithm employed by MPT is based on the Double Descriptionmethod [7] and implemented in the CDD/CDD+ package [8]. Its complexity is V n, whereV is the number of vertices and n is the state space dimension. Hence the use of MPT ispractical for low dimensional systems. But even in low dimensional systems the number ofvertices in the the reach set polytope can grow very large with the number of time steps.For example, consider the system,

xk+1 = Axk + uk,

2

with A =

[cos 1 − sin 1sin 1 cos 1

], uk ∈ {u ∈ R2 | ‖u‖∞ ≤ 1}, and x0 ∈ {x ∈ R2 | ‖x‖∞ ≤ 1}.

Starting with a rectangular initial set, the number of vertices of the reach set polytope is4k + 4 at the kth step.

In d/dt [9], the reach set is approximated by unions of rectangular polytopes [10]. The

x1(t0) x2(t0)

x2(t1)x1(t1)

x1(t2) x2(t2)

x1(t0) x2(t0)

x2(t1)x1(t1)R (t1)

R (t2)

R [t0,t 1]

R [t1,t 2]

(a)

(c)

(e)

(d)

(f)

(b)

Figure 1: Reach set approximation by union of rectangles.

algorithm works as follows. First, given the set of initial conditions defined as a polytope, theevolution in time of the polytope’s extreme points is computed (figure 1(a)). R(t1) in figure1(a) is the reach set of the system at time t1, and R[t0, t1] is the set of all points that can bereached during [t0, t1]. Second, the algorithm computes the convex hull of vertices of both,the initial polytope and R(t1) (figure 1(b)). The resulting polytope is then bloated to includeall the reachable states in [t0, t1] (figure 1(c)). Finally, this overapproximating polytope is inits turn overapproximated by the union of rectangles (figure 1(d)). The same procedure isrepeated for the next time interval [t1, t2], and the union of both rectangular approximationsis taken (figure 1(e,f)), and so on. Rectangular polytopes are easy to represent and thenumber of facets grows linearly with dimension, but a large number of rectangles must beused to assure the approximation is not overly conservative. Besides, the important part ofthis method is again the convex hull calculation whose implementation relies on the sameCDD/CDD+ library. This limits the dimension of the system and time interval for whichit is practical to calculate the reach set.

Polytopes can give arbitrarily close approximations to convex sets, but the number of ver-tices can grow prohibitively large and, as shown in [11], the computation of a polytope byits convex hull becomes intractable for large number of vertices in high dimensions.

The method of zonotopes for external approximation of reach sets is presented in [12]. A

3

zonotope is a special class of polytopes (see [13]) of the form,

Z = {x ∈ Rn | x = c +p∑

i=1

αigi, − 1 ≤ αi ≤ 1},

wherein c and g1, ..., gp are vectors in Rn. Thus, a zonotope Z is defined by its center cand generator vectors g1, ..., gp. The value p/n is called the order of the zonotope. Thiscompact representation and the fact that they are closed under linear transformation andgeometric sum, make zonotopes attractive for reach set computation. The difficulty is thatwith every integration step the order of the approximating zonotope increases by p/n. Thedifficulty can be averted by limiting the number of generator vectors, and overapproximatingzonotopes whose number of generator vectors exceeds this limit by lower order zonotopes.The zonotope method of [12] provides neither a notion of tightness of approximation noran estimate of the error resulting from the zonotope order reduction. Further, the methoddoes not indicate any way of control synthesis, i.e. finding a sequence of controls that drivesthe system to the desired terminal set or point.

CheckMate [14] is a Matlab toolbox that can evaluate specifications for trajectories startingfrom the set of initial (continuous) states corresponding to the parameter values at thevertices of the parameter set. This provides preliminary insight into whether the specifica-tions will be true for all parameter values. The method of oriented rectangluar polytopesfor external approximation of reach sets is introduced in [15]. The basic idea is to con-struct an oriented rectangular hull of the reach set for every time step, whose orientationis determined by the singular value decomposition of the sample covariance matrix for thestates reachable from the vertices of the initial polytope. The limitation of CheckMate andthe method of oriented rectangles is that only autonomous (i.e. uncontrolled) systems areallowed, and only an external approximation of the reach set is provided.

Requiem [16] is a Mathematica notebook which, given a linear system, the set of initialconditions and control bounds, symbolically computes the reach set exactly, using the ex-perimental quantifier elimination package. Quantifier elimination is the removal of all quan-tifiers (the universal quantifier ∀ and the existential quantifier ∃) from a quantified system.Each quantified formula is substituted with quantifier-free expression with operations +, ×,= and <. For example, consider the discrete-time system

xk+1 = Axk + Buk

with A =

[0 10 0

]and B =

[01

]. For initial conditions x0 ∈ {x ∈ R2 | ‖x‖∞ ≤ 1} and

controls uk ∈ {u ∈ R | − 1 ≤ u ≤ 1}, the reach set for k ≥ 0 is given by the quantifiedformula

{x ∈ R2 | ∃x0, ∃k ≥ 0, ∃ui, 0 ≤ i ≤ k : x = Akx0 +k−1∑i=0

Ak−i+1Bui},

which is equivalent to the quantifier-free expression

−1 ≤ [1 0]x ≤ 1 ∧ − 1 ≤ [0 1]x ≤ 1.

4

It is proved in [17] that if A is constant and nilpotent or is diagonalizable with rational realor purely imaginary eigenvalues, the quantifier elimination package returns a quantifier freeformula describing the reachable set.

The reach set approximation via parallelotopes [18] employs the idea of parametrizationdescribed in [1] for ellipsoids. The reach set is represented as the intersection of tightexternal, and the union of tight internal, parallelotopes. The evolution equations for thecenters and orientation matrices of both external and internal parallelotopes are provided.This method also finds controls that can drive the system to the boundary points of thereach set, similarly to [19] and [1]. It works for general linear systems. The computationto solve the evolution equations for tight approximating parallelotopes, however, is moreinvolved than the one for ellipsoids, and in the case of discrete-time system this methoddoes not deal with singular state transition matrices.

In this paper we describe ellipsoidal techniques that extend the results of [1, 20]. Theellipsoidal calculus provides the following benefits:

• The complexity of the ellipsoidal representation grows quadratically with the dimen-sion of the state space, and stays constant with the number of time steps.

• It is possible to exactly represent the reach set of linear system through both externaland internal ellipsoids.

• It is possible to single out individual external and internal approximating ellipsoidsthat are optimal to some given criterion (e.g. trace, volume, diameter), or combinationof such criteria.

• We obtain simple analytical expressions for control sequences that steer the state toa desired target.

3 Reachability problem

Consider the discrete-time linear system with time-varying coefficients,

x[k + 1] = A[k]x[k] + B[k]u[k], k0 ≤ k < k1, (1)x[k0] = x0, (2)

in which x ∈ Rn is the state and u ∈ Rm is the control. The state transition matrix is

Φ(k + 1, k0) = A[k]Φ(k, k0), k ≥ k0, Φ(k, k) = I,

which for time-invariant systems simplifies as

Φ(k, k0) = Ak−k0.

5

The control u = u[k] is restricted to the nondegenerate ellipsoid

u[k] ∈ P[k] = E(p[k], P [k]) ={u[k] | 〈(u[k] − p[k]), P−1[k](u[k] − p[k])〉 ≤ 1

}, (3)

with p[k] ∈ Rm being the center of the ellipsoid and P [k] ∈ Rm×m its shape matrix. Theinitial condition is restricted to the nondegenerate ellipsoid X0 = E(x0,X0). The supportfunction of the ellipsoid E(p[k], P [k]) is

ρ(l | E(p[k], P [k])) = max{〈l, x〉 | x ∈ E(p[k], P [k])} = 〈l, p[k]〉 + 〈l, P [k]l〉1/2. (4)

Definition 3.1 The reach set X (k, k0, x0) at time step k > k0 from the initial position

(k0, x0) is the set of all states x[k] reachable at time k by the system (1) with x[k0] = x0

through all possible controls that satisfy (3).

The reach set X (k, k0,X0) is

X (k, k0,X0) =⋃

{X (k, k0, x0) | x0 ∈ X0)}.

Some important facts about reach sets follow.

Lemma 3.1 The set-valued map X (k, k0,X0) satisfies the semigroup property

X (k, k0,X0) = X (k, i,X (i, k0 ,X0)), k0 ≤ i ≤ k. (5)

Lemma 3.2 The reach set X (k, k0, E(x0,X0)) can be expressed as

X (k, k0, E(x0,X0)) = q[k] + Φ(k, k0)E(0,X0) +k−1∑i=k0

Φ(k, i + 1)E(0, B[i]P [i]BT [i]), (6)

where

q[k] = Φ(k, k0)x0 +k−1∑i=k0

Φ(k, i + 1)B[i]p[i]. (7)

Using (6) and (4), we obtain the next result.

Lemma 3.3 The support function of the reach set is

ρ(l | X (k, k0, E(x0,X0))) = 〈l, q[k]〉 + 〈l,Φ(k, k0)X0ΦT (k, k0)l〉1/2

+k−1∑i=k0

〈l,Φ(k, i + 1)B[i]P [i]BT [i]ΦT (k, i + 1)l〉1/2. (8)

Representation (6) leads to the next fact.

6

Lemma 3.4 The reach set X (k, k0, E(x0,X0)) is a convex compact set in Rn.

If the matrices A[i], k0 ≤ i < k, are nonsingular, the ellipsoid Φ(k, k0)E(0,X0) in sum(6) is nondegenerate, and so the reach set X (k, k0, E(x0,X0)) contains an open set ofRn. Its boundary points have an important characterization: y is a boundary point ofX (k, k0, E(x0,X0)) only if there exists a support vector ly �= 0 so that

〈ly, y〉 = ρ(ly | X (k, k0, E(x0,X0))) = max{〈ly , x〉 | x ∈ X (k, k0, E(x0,X0))}. (9)

The control uy[i], k0 ≤ i < k, and the initial state x[k0] = x0y ∈ E(x0,X0), which drive thesystem (1) from the state x[k0] = x0y to a boundary point x[k] = y is determined from thefollowing theorem.

Theorem 3.1 Suppose A[i], k0 ≤ i < k, are nonsingular, and x[k] = y is a boundary pointof X (k, k0, E(x0,X0)). Then the control uy[i], k0 ≤ i < k, and the initial state x[k0] = x0y,which yield the unique trajectory xy[i] that reaches y = xy[k] from x0y = x[k0], and ensures(9), satisfy the following maximum principle for control:

〈ly,Φ(k, i + 1)B[i]uy [i]〉 = max{〈ly ,Φ(k, i + 1)B[i]u〉 | u ∈ Φ(k, i + 1)E(p[i], P [i])}= 〈ly,Φ(k, i + 1)B[i]p[i]〉

+〈ly,Φ(k, i + 1)B[i]P [i]BT [i]ΦT (k, i + 1)ly〉1/2 (10)

for k0 ≤ i < k, and the maximum condition for the initial state:

〈ly,Φ(k, k0)x0y〉 = max{〈ly , x〉 | x ∈ Φ(k, k0)E(x0,X0)}= 〈ly,Φ(k, k0)x0〉 + 〈ly,Φ(k, k0)X0ΦT (k, k0)ly〉1/2. (11)

Here ly is the support vector for the set X (k, k0, E(x0,X0)) at the point y that satisfies (9).

Remark. To simplify the notation we shall denote R[i] = B[i]P [i]BT [i] and from now onuse R[i] instead of B[i]P [i]BT [i] where possible.

4 External ellipsoidal approximations

Relation (6) shows that the reach set X (k, k0, E(x0,X0)) is a sum of k − k0 + 1 ellipsoids.We overapproximate the reach set by a single ellipsoid. Here we consider the situation whenmatrices A[i] are nonsingular. The case with singular A[i] is treated in section 6. In thebeginning we shall also assume that matrices R[i] are nonsingular.

Remark. R[i] are nonsingular if the matrices B[i] ∈ Rn×m have rank n (n ≤ m).

We shall look for external approximating ellipsoids for the reach set X (k, k0, E(x0,X0)) inthe class of ellipsoids E(q[k], Q[k]) that satisfy the following two relations:

q[k] = A[k − 1]q[k − 1] + B[k − 1]p[k − 1], q[k0] = x0, (12)

7

and

Q[k] =( k−1∑

i=k0

si[k] + s0[k])

×( k−1∑

i=k0

s−1i [k]Φ(k, i + 1)R[i]ΦT (k, i + 1)

+s−10 [k]Φ(k, k0)X0ΦT (k, k0)

), Q[k0] = X0, (13)

for arbitrary s0[k] > 0, si[k] > 0 for k > k0 and k0 ≤ i < k.

Using (8), it can be easily checked that

ρ(l | E(q[k], Q[k])) ≥ ρ(l | X (k, k0, E(x0,X0)))

for all directions l. Hence,

X (k, k0, E(x0,X0)) ⊆ E(q[k], Q[k]).

Definition 4.1 We say that ellipsoid E(q[k], Q[k]), defined by (12) and (13), is a tightexternal approximation of the reach set X (k, k0, E(x0,X0)) if there exists direction l suchthat

ρ(±l | E(q[k], Q[k])) = ρ(±l | X (k, k0, E(x0,X0))).

A tight external ellipsoid defined by direction l, touches the boundary of the reach set atpoint xl such that

ρ(l | X (k, k0, E(x0,X0))) = 〈l, xl〉 = ρ(l | E(q[k], Q[k])) = 〈l, q[k]〉 + 〈l, Q[k]l〉1/2.

This condition will be fulfilled if we choose

si[k] = 〈l,Φ(k, i + 1)R[i]ΦT (k, i + 1)l〉1/2, (14)

ands0[k] = 〈l,Φ(k, k0)X0ΦT (k, k0)l〉1/2. (15)

To check it, we substitute (14) and (15) into (13), calculate the support function of theresulting ellipsoid and arrive at (8). As we can see, for every direction l there exists a tightexternal ellipsoidal approximation of the reach set X (k, k0, E(x0,X0)), whose shape matrixis calculated by (13).

For all 0 ≤ i < k, the parameters si[k] in (15) and (14) depend on k. As a result, the sum(13) needs to be recomputed for every k with new values of s0[k] and si[k]. To get rid of thisdependency on k, and thus greatly reduce the computation effort, we introduce the notionof ‘good curves’. These are trajectories l[k] that satisfy the homogeneous adjoint equation

l[k] = AT [k]l[k + 1], l(k0) = l0. (16)

8

Vector l[k] can be expressed as

l[k] = ΦT (k0, k)l0 (for time-invariant systems: l[k] = ((Ak−k0)T )−1l0). (17)

With l[k] defined in (17), relations (14) and (15) simplify into

si = 〈l0,Φ(k0, i + 1)R[i]Φ(k0, i + 1)l0〉1/2 (18)

ands0 = 〈l0,X0l0〉1/2. (19)

Now si and s0 no longer depend on k. When substituted into (13), they give us a recurrencerelation for matrix Q[k],

Q[k + 1] = (1 + π[k])A[k]Q[k]AT [k] + (1 + π−1[k])R[k], Q[k0] = X0, (20)

in which π[k] is defined by

π[k] =sk∑k−1

i=k0si + s0

=〈l0,Φ(k0, k + 1)R[k]ΦT (k0, k + 1)l0〉1/2∑k−1

i=k0〈l0,Φ(k0, i + 1)R[i]ΦT (k0, i + 1)l0〉1/2 + 〈l0,X0l0〉1/2

=〈l0,Φ(k0, k + 1)R[k]ΦT (k0, k + 1)l0〉1/2

〈l0,Φ(k0, k)Q[k]ΦT (k0, k)l0〉1/2. (21)

The expression for the center of the approximating ellipsoid is given by

q[k + 1] = A[k]q[k] + B[k]p[k], q[k0] = x0. (22)

In both (20) and (22) k ≥ k0. We state this result as a theorem.

Theorem 4.1 Let l[k] satisfy the equation (17). Then the ellipsoid E(q[k], Q[k]) given by(20) and (22), is such that for all k ≥ k0 the reach set

X (k, k0, E(x0,X0)) ⊆ E(q[k], Q[k])

andρ(l[k] | E(q[k], Q[k])) − ρ(l[k] | X (k, k0, E(x0,X0))) = 0.

The supporting hyperplane for the reach set X (k, k0, E(x0,X0)) generated by the vectorl[k] is also a supporting hyperplane for E(q[k], Q[k]) and touches it at the same point xl[k],given by

xl[k] = q[k] +Q[k]l[k]

〈l[k], Q[k]l[k]〉1/2. (23)

Since for every boundary point xl[k] of the reach set X (k, k0, E(x0,X0)) there exists di-rection l[k] and corresponding tight external ellipsoid E(q[k], Q[k]), the following result isestablished.

9

Theorem 4.2 The reach set X (k, k0, E(x0,X0)) can be expressed as

X (k, k0, E(x0,X0)) =⋂l[k]

E(q[k], Q[k]). (24)

If l[k] is a “good curve”, it specifies the external ellipsoid E(q[k], Q[k]), with Q[k] and q[k]coming from (20) and (22), which touches the reach set at some point xl[k]. In order forthe points xl[·] to form the system trajectory on k0, ..., k, that is, for xl[k] to satisfy

xl[k] = Φ(k, k0)x0 +k−1∑i=k0

Φ(k, i + 1)B[i]u[i],

the corresponding control u[i] ∈ E(p[i], P [i]) and the initial condition x0 ∈ E(x0,X0) arederived from the maximum principle for control (10) and maximum condition (11). Theyare specified by

u[i] =P [i]BT [i]ΦT (k0, i + 1)l0

〈l0,Φ(k0, i + 1)R[i]ΦT (k0, i + 1)l0〉1/2+ p[i], (25)

andx0

l =X0l0

〈l0,X0l0〉1/2+ x0. (26)

Thus, if the system starts at x0l at time step k0, the control u[i] will bring it at time step

k to the boundary point of the reach set, at which the reach set is touched by the externalapproximating ellipsoid E(q[k], Q[k]) defined by the direction l[k].

Remark. For n-dimensional system, every step of computation of external ellipsoidalapproximation requires 2n2 scalar multiplications for the center of ellipsoid and (8n3 +4n2 + 2n) scalar multiplications for its shape matrix. Since the trajectory of the center isthe same for different values of parameter l0, computing L ellipsoidal approximations for ktime steps requires

k(L(8n3 + 4n2 + 2n) + 2n2)

scalar multiplications. So, the complexity of computation grows linearly with the numberof time steps and number of approximations, and polynomially, as O(n3), with the statespace dimension.

5 Singular R

We start by stating a simple fact that will be useful in our proofs.

Lemma 5.1 Let a ≥ b > 0. Then from a2 − b2 < ε2 for some ε > 0, it follows thata − b < ε.

10

In case the matrix R[i] is singular for some i, the recurrence relations (20) are not validbecause we cannot guarantee that parameter si defined in (18) is strictly positive. Thus,we need to replace R[i] with a suitable nonsingular matrix. Define Rα[i],

Rα[i] = R[i] + α2I, k0 ≤ i < k, (27)

for α > 0. Rα[i] is positive definite and Rα[i] → R[i] as α → 0. Corresponding to Rα[i] wedefine the “regularized” reach set Xα(k, k0, E(x0,X0)),

Xα(k, k0, E(x0,X0)) = q[k] + Φ(k, k0)E(0,X0) +k−1∑i=k0

Φ(k, i + 1)E(0, Rα[i]), (28)

with support function

ρ(l | Xα(k, k0, E(x0,X0))) = 〈l, q[k]〉 + 〈l,Φ(k, k0)X0ΦT (k, k0)l〉1/2

+k−1∑i=k0

〈l,Φ(k, i + 1)Rα[i]ΦT (k, i + 1)l〉1/2, (29)

with q[k] determined from (7). The difference between the support functions of the regu-larized reach set Xα(k, k0, E(x0,X0)) and the actual reach set X (k, k0, E(x0,X0)) is

ρ(l | Xα(k, k0, E(x0,X0))) − ρ(l | X (k, k0, E(x0,X0)))

=k−1∑i=k0

(〈l,Φ(k, i + 1)Rα[i]ΦT (k, i + 1)l〉1/2 − 〈l,Φ(k, i + 1)R[i]ΦT (k, i + 1)l〉1/2).

Let us estimate the ith element of this sum,

〈l,Φ(k, i + 1)Rα[i]ΦT (k, i + 1)l〉1/2 − 〈l,Φ(k, i + 1)R[i]ΦT (k, i + 1)l〉1/2, k0 ≤ i < k.

Let σ(A[i]) be the largest singular value of matrix A[i], and denote

σmax = maxk0≤i<k

{σ(A[i])}. (30)

Then we can write

〈l,Φ(k, i + 1)Rα[i]ΦT (k, i + 1)l〉 − 〈l,Φ(k, i + 1)R[i]ΦT (k, i + 1)l〉= α2〈l,Φ(k, i + 1)ΦT (k, i + 1)l〉 ≤ σ2(k−i−1)

max α2.

Thus, by lemma 5.1, we obtain

0 ≤ 〈l,Φ(k, i + 1)Rα[i]ΦT (k, i + 1)l〉1/2 − 〈l,Φ(k, i + 1)R[i]ΦT (k, i + 1)l〉1/2 ≤ σk−i−1max α.

We now state the main result of this section.

Theorem 5.1 For any ε > 0 there exists α > 0, such that

0 ≤ ρ(l | Xα(k, k0, E(x0,X0))) − ρ(l | X (k, k0, E(x0,X0))) < ε

for all k ≥ k0, and all vectors l. More precisely, α can be chosen as

α =ε

2(σk−k0−1max + · · · + σ2

max + σmax + 1), (31)

where σmax is defined in (30).

11

Remark. In (30) we could have taken i strictly greater than k0. We leave this definitionas is, however, because it will be used in the next section in its present form.

Substituting R with Rα in (18) and (21), we obtain recurrence relations for Qα[k], the shapematrix of the tight external ellipsoid of the regularized reach set Xα(k, k0, E(x0,X0)). Therecurrence relation for the center of this ellipsoid (22) remains untouched. So, the relation

X (k, k0, E(x0,X0)) =⋂l[k]

E(q[k], Qα[k]) (32)

holds with ε accuracy in the Hausdorff metric. Expression (25) for the control is similarlymodified by replacing R with Rα.

6 Singular A

When A[i] is singular for some i, k0 ≤ i < k, relation (17) is invalid because the inversefor the state transition matrix Φ(k, k0) does not exist; hence, we cannot use the expressionΦ(k0, k); and the subsequent formulas (18) and (20) do not make sense for singular A[i].The way around it is to regularize matrix A[i]. Let the singular value decomposition of A[i]be

A[i] = UiΣiVi,

and define the new matrix Aδ[i] by

Aδ[i] = Ui(Σi + δI)Vi = A[i] + δUiVi, k0 ≤ i < k, (33)

where δ > 0. As one can see, Aδ[i] is nonsingular for δ > 0, and Aδ[i] → A[i] as δ → 0.Corresponding to the matrix Aδ[i] there is an invertible state transition matrix Φδ(k, k0).

Remark. Here, actually, δ may depend on i, and Φδ(k, k0) is

Φδ(k, k0) = Aδk−1[k − 1]Aδk−2

[k − 2] · · ·Aδk0+1[k0 + 1]Aδk0

[k0].

We drop the subindices, however, to simplify the notation.

Let H be any symmetric positive definite matrix. We would like to find such δ > 0 that forgiven ε > 0,

−ε2 < 〈l, Aδ [i]HATδ [i]l〉 − 〈l, A[i]HAT [i]l〉 < ε2.

for all vectors l, and any i, then by lemma 5.1,

−ε < 〈l, Aδ [i]HATδ [i]l〉1/2 − 〈l, A[i]HAT [i]l〉1/2 < ε,

For that we write

Aδ[i]HATδ [i] − A[i]HAT [i] = δ(A[i]HV T

i UTi + UiViHAT [i]) + δ2UiViHV T

i UTi .

12

If we denote the largest singular value of H as h, and the largest singular value of thesymmetric matrix A[i]HV T

i UTi + UiViHAT [i] as

λ = λ(A[i]HV Ti UT

i + UiViHAT [i]),

then δ could be found from the inequality

hδ2 + λδ < ε2.

Thus, we arrive at the following lemma.

Lemma 6.1 Let H = HT > 0. Then, for any ε > 0 there exists δ > 0 such that

−ε < 〈l, Aδ [i]HATδ [i]l〉1/2 − 〈l, A[i]HAT [i]l〉1/2 < ε.

More precisely, δ can be chosen as

δ =−λ +

√λ

2 + 4ε2

2h + 1, (34)

where λ is the largest singular value of the matrix A[i]HV Ti UT

i + UiViHAT [i].

We define the regularized reach set Xδ,α(k, k0, E(x0,X0)) by

Xδ,α(k, k0, E(x0,X0)) = q[k] + Φδ(k, k0)E(0,X0) +k−1∑i=k0

Φδ(k, i + 1)E(0, Rα[i]). (35)

Its support function is

ρ(l | Xδ,α(k, k0, E(x0,X0))) = 〈l, q[k]〉 + 〈l,Φδ(k, k0)X0ΦTδ (k, k0)l〉1/2

+k−1∑i=k0

〈l,Φδ(k, i + 1)Rα[i]ΦTδ (k, i + 1)l〉1/2, (36)

where Rα[i] is defined in (27) and q[k] comes from (7) as before.

Our goal is to make the regularized reach set arbitrary close to the actual reach set for everyk ≥ k0, by the appropriate choice of parameters δi, k0 ≤ i < k and α. In other words, forany ε > 0 we should find δi > 0, k0 ≤ i < k, and α > 0, such that

0 ≤ ρ(l | Xδ,α(k, k0, E(x0,X0))) − ρ(l | X (k, k0, E(x0,X0))) < ε

for all k ≥ k0, and all vectors l. We now show how to construct such α and the sequenceδi. Let us estimate the difference of the support functions of the regularized reach set andthe actual reach set

ρ(l | Xδ,α(k, k0, E(x0,X0))) − ρ(l | X (k, k0, E(x0,X0)))= ρ(l | Aδ[k − 1]Xδ,α(k − 1, k0, E(x0,X0))) − ρ(l | A[k − 1]Xδ,α(k − 1, k0, E(x0,X0)))

+ρ(l | A[k − 1]Xδ,α(k − 1, k0, E(x0,X0))) − ρ(l | A[k − 1]X (k − 1, k0, E(x0,X0)))+ρ(l | E(0, Rα[k − 1])) − ρ(l | E(0, R[k − 1])). (37)

13

As we can see, this difference breaks up into three components. First, we analyze

ρ(l | Aδ[k − 1]Xδ,α(k − 1, k0, E(x0,X0))) − ρ(l | A[k − 1]Xδ,α(k − 1, k0, E(x0,X0)))

=k−2∑i=k0

(〈l, Aδ [k − 1]Φδ(k − 1, i + 1)Rα[i]ΦTδ (k − 1, i + 1)AT

δ [k − 1]l〉1/2

− 〈l, A[k − 1]Φδ(k − 1, i + 1)Rα[i]ΦTδ (k − 1, i + 1)AT [k − 1]l〉1/2)

+〈l, Aδ [k − 1]Φδ(k − 1, k0)X0ΦTδ (k − 1, k0)AT

δ [k − 1]l〉1/2

− 〈l, A[k − 1]Φδ(k − 1, k0)X0ΦTδ (k − 1, k0)AT [k − 1]l〉1/2.

Matrices Φδ(k−1, i+1)Rα[i]ΦTδ (k−1, i+1), k0 ≤ i < k−1, and Φδ(k−1, k0)X0ΦT

δ (k−1, k0)are symmetric positive definite. We use lemma 6.1: for any ε1 > 0 and k, k ≥ k0, thereexists δk−1 such that

−ε1 < ρ(l | Aδ[k− 1]Xδ,α(k− 1, k0, E(x0,X0)))− ρ(l | A[k− 1]Xδ(k− 1, k0, E(x0,X0))) < ε1.

If we denote the maximum of the largest singular values of matrices

Φδ(k − 1, i + 1)Rα[i]ΦTδ (k − 1, i + 1),

k0 ≤ i < k − 1, andΦδ(k − 1, k0)X0ΦT

δ (k − 1, k0)

by hk−1, and the maximum of the largest singular values of the matrices

A[k−1]Φδ(k−1, i+1)Rα[i]ΦTδ (k−1, i+1)V T

k−1UTk−1+Uk−1Vk−1Φδ(k−1, i+1)Rα[i]ΦT

δ (k−1, i+1)AT [k−1],

k0 ≤ i < k − 1, and

A[k−1]Φδ(k−1, k0)X0ΦTδ (k−1, k0)V T

k−1UTk−1+Uk−1Vk−1Φδ(k−1, k0)X0ΦT

δ (k−1, k0)AT [k−1]

by λk−1, we have

δk−1 =−λk−1 +

√λ

2k−1 + 4( ε1

k−k0)2

2hk−1 + 1. (38)

Remark. If we could find upper bounds

h ≥ hi, λ ≥ λi,

for all i, k0 ≤ i < k, δ would not depend on i:

δk0 = · · · = δk−1 = δ =−λ +

√λ

2 + 4( ε1k−k0

)2

2h + 1. (39)

We now consider the third component of the difference (37). Let µ(R[i]) be the largestsingular value of the matrix R[i], and define

µmax = maxk0≤i<k

{µ(R[i])}. (40)

14

By choosing α asα =

√ε21 + 2µmaxε1, (41)

we can guaranteeε1 ≤ ρ(l | E(0, Rα[i])) − ρ(l | E(0, R[i])) ≤ α

for k0 ≤ i < k. We are finally ready to estimate the whole difference (37). We start withk = k0 + 1. Since Xδ,α(k0, k0, E(x0,X0)) = X (k0, k0, E(x0,X0)) = E(x0,X0), we can find δk0

from (38) such that

0 ≤ ρ(l | Xδ,α(k0 + 1, k0, E(x0,X0))) − ρ(l | X (k0 + 1, k0, E(x0,X0))) ≤ ε1 + α.

From here we get

0 ≤ ρ(l | A[k0+1]Xδ,α(k0+1, k0, E(x0,X0)))−ρ(l | A[k0+1]X (k0+1, k0, E(x0,X0))) ≤ σmax(ε1+α),

where σmax is defined in (30). Again, there exists δk0+1 such that for i = k0 + 2 we have

0 ≤ ρ(l | Xδ,α(k0 +2, k0, E(x0,X0)))−ρ(l | X (k0 +2, k0, E(x0,X0))) ≤ σmax(ε1 +α)+ε1 +α.

Continuing this process, for i = k we arrive at

0 ≤ ρ(l | Xδ,α(k, k0, E(x0,X0)))−ρ(l | X (k, k0, E(x0,X0))) ≤ (σk−k0−1max +σk−k0−2

max +· · ·+σmax+1)(ε1+α).

Theorem 6.1 For any ε > 0 there exist sequence {δi > 0}, k0 ≤ i < k, and parameterα > 0 such that

0 ≤ ρ(l | Xδ,α(k, k0, E(x0,X0))) − ρ(l | X (k, k0, E(x0,X0))) < ε

for all vectors l and k ≥ k0. Values for δi can be found from (38), α is defined in (41), withε1 determined from the inequality

ε1 +√

ε21 + 2µmaxε1 <

ε

σk−k0−1max + σk−k0−2

max + · · · + σmax + 1, (42)

where σmax and µmax come from (30) and (40) respectively.

Replacing Φ with Φδ and R with Rα in (17), (18) and (21), we obtain a recurrence relationfor the shape matrix of the tight external approximating ellipsoid of the regularized reachset:

Qδ,α[k + 1] = (1 + πδ,α[k])Aδ [k]Qδ,α[k]ATδ [k] + (1 + π−1

δ,α[k])Rα[k], Qδ,α[k0] = X0, (43)

where

πδ,α[k] =〈l0,Φδ(k0, k + 1)Rα[k]ΦT

δ (k0, k + 1)l0〉1/2

〈l0,Φδ(k0, k)Qδ,α[k]ΦTδ (k0, k)l0〉1/2

. (44)

The expression (24) is accordingly replaced with

Xδ,α(k, k0, E(x0,X0)) =⋂lδ[k]

E(q[k], Qδ,α[k]), (45)

15

where lδ[k] satisfieslδ[k] = ΦT

δ (k0, k)l0, (46)

and q[k] remains the same as before, coming from (22). Thus, by appropriately choosingthe parameters δi, k0 ≤ i < k, and α, we can externally approximate the actual reachset X (k, k0, E(x0,X0)), k ≥ k0, with ε-accuracy in Hausdorff metric for any given ε > 0.The corresponding control and the initial condition, which drive the system along the goodtrajectory are given by (25) and (26), with Φ substituted by Φδ and R by Rα. Formula (26)remains unchanged, and (25) is modified as

uδ,α[i] =P [i]BT [i]ΦT

δ (k0, i + 1)l0〈l0,Φδ(k0, i + 1)Rα[i]ΦT

δ (k0, i + 1)l0〉1/2+ p[i]. (47)

7 Example: regularized reach set

Consider the system[x1[k + 1]x2[k + 1]

]=

[0 10 0

] [x1[k]x2[k]

]+

[01

]u[k], k ≥ 0, (48)

where |u[k]| ≤ µ for all k, and x[0] ∈ E(0, I). The matrices R[i] are now constant and havethe form

R[i] = R =

[0 00 µ

].

Since Ak = 0, k > 1, the reach set X (k, 0, E(0, I)) is a sum of two degenerate ellipsoids,

X (k, 0, E(0, I)) = E(0, ARAT ) + E(0, R),

with

ARAT =

[0 10 0

] [0 00 µ

] [0 01 0

]=

[µ 00 0

].

As seen in figure 2 (a), the reach set X (k, 0, E(0, I)) is actually a square with side 2µ andcentered at the origin.

The singular value decomposition of A is

A = UΣV =

[1 00 1

] [1 00 0

] [0 1−1 0

].

Thus, by (33), Aδ can be expressed as

Aδ = A + δUV =

[0 1 + δ−δ 0

].

16

10 5 0 5 102.5

2

1.5

1

0.5

0

0.5

1

1.5

2

2.5

x1

x 2

(a) (b)

Figure 2: (a) Reach set X (k, 0, E(0, I)) of the system (48) for k > 1 (µ = 1). (b) Regularizedreach set Xδ,α at k = 10 with ε1 = 0.1.

The expression for Rα comes from (27),

Rα = R + αI =

[α 00 µ + α

].

The choice of α and δ depends on the desired accuracy ε and the number of steps k (in ourexample k0 = 0) we want this accuracy to be maintained. So, α is determined from (41),wherein µmax = µ. And δ is given by (39), wherein λ = 2µ and h = 1. In both formulas ε1

should satisfy condition (42). For example, for µ = 1, the choice of ε1 = 10−10 guaranteesaccuracy ε ≤ 0.01 of the exact reach set approximation after 100 steps. Figure 2 (b) showsthe regularized reach set at time step k = 10. Here we picked ε1 = 0.1, calculated thecorresponding δ = 0.000025 and α = 0.45 and used the recurrence relation (43) to calculatethe shape matrix of the external ellipsoid for different direction vectors l0.

8 Internal ellipsoidal approximations

Consider the sum of k + 1 ellipsoids E(0,Hi), 0 ≤ i ≤ k with positive semidefinite Hi. Aninternal ellipsoidal approximation of this sum is given by

E(0, Q) ⊆k∑

i=0

E(0,Hi),

with

Q = Q[k] =( k∑

i=0

SiH1/2i

)T( k∑i=0

SiH1/2i

), (49)

and any orthogonal matrices Si, 0 ≤ i ≤ k, STi Si = I (see [1]).

Q[k] satisfies the recurrence relation

Q[k + 1] =( k+1∑

i=0

SiH1/2i

)T( k+1∑i=0

SiH1/2i

)

17

=( k∑

i=0

SiH1/2i + Sk+1H

1/2k+1

)T( k∑i=0

SiH1/2i + Sk+1H

1/2k+1

)

= Q[k] + Hk+1 +( k∑

i=0

SiH1/2i

)TSk+1H

1/2k+1

+(Sk+1H

1/2k+1

)T( k∑i=0

SiH1/2i

), (50)

with Q[0] = H0.

The following tightness condition is true (see [1]).

Theorem 8.1 Let H0 be positive definite. Then the inequality

〈l, Q[k]l〉 =

⟨l,( k∑

i=0

SiH1/2i

)T( k∑i=0

SiH1/2i

)l

⟩≤( k∑

i=0

〈l,Hil〉1/2)2

, (51)

which holds for any l ∈ Rn and any array of orthogonal matrices Si, 0 ≤ i ≤ k, turns intoequality for a given l ∈ Rn iff for all Hi there exist numbers ηi such that

SiH1/2i l = ηiS0H

1/20 l, 0 ≤ i ≤ k. (52)

Now let us return to system (1) with nonsingular matrices A[i], k0 ≤ i < k, and its reachset at time step k, X (k, k0, E(x0,X0)) given by (6). As we can see, the reach set is a sumof k + 1 ellipsoids. If we define Q[k] as

Q[k] = Φ(k, k0)(X

1/20 ST

0 +k−1∑i=k0

(Φ(k0, i + 1)R[i]ΦT (k0, i + 1))1/2STi [k]

)

×(S0X

1/20 +

k−1∑i=k0

Si[k](Φ(k0, i + 1)R[i]ΦT (k0, i + 1))1/2)ΦT (k, k0), (53)

with Q[k0] = X0, and in which S0 and Si[k], k0 ≤ i < k, are any orthogonal matrices,

E(q[k], Q[k]) ⊆ E(Φ(k, k0)x0,Φ(k, k0)X0ΦT (k, k0))

+E( k−1∑

i=k0

Φ(k, i + 1)B[i]p[i],k−1∑i=k0

Φ(k, i + 1)R[i]ΦT (k, i + 1))

= X (k, k0, E(x0,X0)), (54)

with q[k] coming from (7). So, the ellipsoid E(q[k], Q[k]) lies inside the reach setX (k, k0, E(x0,X0)).

18

Definition 8.1 Ellipsoid E(q[k], Q[k]) ⊆ X (k, k0, E(x0,X0)) is a tight internal approxima-tion of the reach set X (k, k0, E(x0,X0)) if there exists direction l such that

ρ(±l | E(q[k], Q[k])) = ρ(±l | X (k, k0, E(x0,X0))).

In order for E(q[k], Q[k]) to be a tight internal approximation of the reach set for a givendirection l, we use Theorem 8.1 and come up with the following tightness condition thatcan be checked by direct calculation.

Theorem 8.2 For a given time step k ≥ k0 and given direction l

ρ(l | E(q[k], Q[k])) = ρ(l | X (k, k0, E(x0,X0)))

iff S0 and Si[k], k0 ≤ i < k, satisfy the relation

Si[k](Φ(k0, i + 1)R[i]ΦT (k0, i + 1))1/2ΦT (k, k0)l = ηi[k]S0X1/20 ΦT (k, k0)l, (55)

with

ηi[k] =〈l,Φ(k, i + 1)R[i]ΦT (k, i + 1)l〉1/2

〈l,Φ(k, k0)X0ΦT (k, k0)l〉1/2. (56)

Let l[k] satisfy the good curve relation (17). In this case, expressions (55) and (56) simplifyinto

Si(Φ(k0, i + 1)R[i]ΦT (k0, i + 1))1/2l0 = ηiS0X1/20 l0, (57)

and

ηi =〈l0,Φ(k0, i + 1)R[i]ΦT (k0, i + 1)l0〉1/2

〈l0,X0l0〉1/2. (58)

Now ηi and Si, k0 ≤ i < k no longer depend on k. We are ready to write the recurrencerelation for the shape matrix Q[k] of the internal ellipsoid E(q[k], Q[k] that touches the reachset X (k, k0, E(x0,X0)) at points of the good trajectory specified by (17). Using definition(53) and relation (50) we get

Q[k + 1] = A[k]Q[k]AT [k] + R[k]

+ Φ(k + 1, k0)(MkSk(Φ(k0, k + 1)R[k]ΦT (k0, k + 1))1/2

+ (Φ(k0, k + 1)R[k]ΦT (k0, k + 1))1/2STk MT

k

)ΦT (k + 1, k0), (59)

with Q[k0] = X0, and

Mk = X1/20 ST

0 +k−1∑i=k0

(Φ(k0, i + 1)R[i]ΦT (k0, i + 1))1/2STi . (60)

The orthogonal matrices S0, Sk, k ≥ k0, are related by (57) and (58). The recurrencerelation for the center of the internal approximating ellipsoid q[k] is the same as for externaland is given by (22).

19

Theorem 8.3 Let l[k] satisfy the equation (17), then the ellipsoid E(q[k], Q[k]), where Q[k]and q[k] are the solutions of (59) and (22), is such that for all k ≥ k0, the following is true:

E(q[k], Q[k]) ⊆ X (k, k0, E(x0,X0))

andρ(l[k] | X (k, k0, E(x0,X0))) − ρ(l[k] | E(q[k], Q[k])) = 0.

The control that drives the system along the good trajectory is indicated in (25) for thosevectors l0, for which

〈l0,Φ(k0, i + 1)R[i]ΦT (k0, i + 1)l0〉 �= 0, k0 ≤ i < k,

and the initial condition in (26).

For every boundary point of the reach set X (k, k0, E(x0,X0)) there exists direction l[k] andcorresponding tight internal ellipsoid E(q[k], Q[k]). Thus, we arrive at the result similar totheorem 4.2.

Theorem 8.4 The reach set X (k, k0, E(x0,X0)) can be expressed as

X (k, k0, E(x0,X0)) =⋃l[k]

E(q[k], Q[k]). (61)

Remark. The results of this section are also valid for singular matrices R[i], and no specialregularization as in the case of external approximation is needed.

Until now, in discussing internal ellipsoidal approximations, we assumed A[i] to be non-singular. In case of singular A[i], the recurrence relations above lose their sense becausematrix Φ(k0, k) does not exist. It is still possible to build internal approximating ellipsoidsusing (49) even for the singular case, since the reach set of a linear discrete-time systemfor every time step k is nothing else but a finite sum of ellipsoids. However, the recurrencerelations in the case of singular matrix A cease to exist, making the calculation of tightinternal approximating ellipsoids a rather involved procedure because for every k the ma-trices Si need to be recomputed. Therefore, we suggest the following way out for singularcase. Instead of the actual reach set X (k, k0, E(x0,X0)) we consider the regularized reachset Xδ,α(k, k0, E(x0,X0)) defined in (35) and constructed according to theorem 6.1. Matri-ces Aδ[i] are nonsingular, so are Rα[i], and the relations (57)-(60). Recall the example (48)from section 7. Figure 3 illustrates the internal ellipsoidal approximations of the regularized

reach set at k = 10 for three different initial directions, l0 =

(10

),

( √3

2−1

2

)and

(12√3

2

).

20

−4 −3 −2 −1 0 1 2 3 4

−1

−0.8

−0.6

−0.4

−0.2

0

0.2

0.4

0.6

0.8

1

x1

x 2

Figure 3: Internal ellipsoidal approximations of the regularized reach set Xδ,α at k = 10.

9 Conclusion

This paper extends the results of [1] to linear discrete-time systems. We do not assumecontrollability of the system and also consider the situation when the state transition matrixΦ(k, k0) is singular. It was shown that in these situations it is possible to approximatethe actual reach set with any given ε-accuracy by regularizing matrices B[i]P [i]BT [i] andA[i]. Theorem 6.1 provides the means of picking the appropriate regularization parameters.Internal ellipsoidal approximations work well even with singular matrices B[i]P [i]BT [i] andΦ(k, k0). However, in order to use the concept of ‘good curves’ and the recurrence relations(57)-(60), we still need to perform the regularization.

References

[1] A. Kurzhanski and P. Varaiya, “On ellipsoidal techniques for reachability analysis,”Optimization Methods and Software, vol. 17, pp. 177–237, 2000.

[2] N. Giorgetti and G. Pappas, “Bounded model checking for hybrid dynamical systems,”in IEEE Conference on Decision and Control, Seville, Spain, 2005, submitted.

[3] I. Mitchell and C. Tomlin, “Level set methods for computation in hybrid systems,” inHybrid Systems: Computation and Control, ser. Lecture Notes in Computer Science,N. Lynch and B. Krogh, Eds. Springer, 2000, vol. 1790, pp. 21–31.

[4] “Level set toolbox,” www.cs.ubc.ca/˜mitchell/ToolboxLS.

21

[5] M. Kvasnica, P. Grieder, M. Baotic, and M. Morari, “Multi parametric toolbox (mpt),”in Hybrid Systems: Computation and Control, R. Alur and G. Pappas, Eds. Springer,2004, vol. 2993, pp. 448–462.

[6] “Mpt homepage,” control.ee.ethz.ch/˜mpt.

[7] T. Motzkin, H. Raiffa, G. Thompson, and R. Thrall, “The double description method,”in Conttributions to Theory of Games, H.W.Kuhn and A.W.Tucker, Eds. PrincetonUniversity Press, 1953, vol. 2.

[8] “Cdd/cdd+ homepage,” www.cs.mcgill.ca/˜fukuda/soft/cdd home/cdd.html.

[9] “d/dt homepage,” www-verimag.imag.fr/˜tdang/ddt.html.

[10] E. Asarin, O. Bournez, T. Dang, and O. Maler, “Approximate reachability analysisof piecewise linear dynamical systems,” in Hybrid Systems: Computation and Control,ser. Lecture Notes in Computer Science, N.Lynch and B.H.Krogh, Eds. Springer,2000, vol. 1790, pp. 21–31.

[11] D. Avis, D. Bremner, and R. Seidel, “How good are convex hull algorithms?” Compu-tational Geometry: Theory and Applications, vol. 7, pp. 265–301, 1997.

[12] A. Girard, “Reachability of uncertain linear systems using zonotopes,” in Hybrid Sys-tems: Computation and Control, ser. Lecture Notes in Computer Science. Springer,2005, to appear.

[13] “Zonotope methods on wolfgang kuhn homepage,” www.decatur.de.

[14] “CheckMate homepage,” www.ece.cmu.edu/˜webk/checkmate.

[15] O. Stursberg and B. Krogh, “Efficient representation and computation of reachablesets for hybrid systems,” in Hybrid Systems: Computation and Control, ser. LectureNotes in Computer Science, O.Maler and A.Pnueli, Eds. Springer, 2003, vol. 2623,pp. 482–497.

[16] “Requiem homepage,” www.seas.upenn.edu/˜hybrid/requiem/requiem.html.

[17] G. Lafferriere, G. Pappas, and S. Yovine, “Symbolic reachability computation for fam-ilies of linear vector fields,” Journal of Symbolic Computation, vol. 32, pp. 231–253,2001.

[18] E. Kostousova, “Control synthesis via parallelotopes: optimization and parallel com-putations,” Optimization Methods and Software, vol. 14, no. 4, pp. 267–310, 2001.

[19] P. Varaiya, “Reach set computation using optimal control,” Proc. of KIT Workshopon Verification on Hybrid Systems. Verimag, Grenoble., 1998.

[20] A. Kurzhanski and P. Varaiya, “Dynamic optimization for reachability related prob-lems,” Journal of Optimization, Theory and Applications, vol. 108, no. 2, pp. 227–251,2001.

22