Timed-Automata Supervisor Synthesis

• Timed-Automata Supervisor is a control model that restricts event occurrences by strengthening guards and invariants to ensure nonblocking, maximal permissiveness, and controllability.
• It employs a finite abstraction via region equivalence to manage the infinite state space inherent in dense-time clocks, enabling backward elimination synthesis.
• The supervisor is reconstructed as a timed automaton that preserves the plant’s reset structure, effectively encoding timed control and preempting unsafe delays.

A timed-automata supervisor is a timed automaton $S^t$ synthesized for a timed plant $P^t$ under timed requirements $R^{p,t}$ so that $S^t$ is controllable with respect to $P^t \| R^{p,t}$, and the closed loop $S^t \| P^t \| R^{p,t}$ is nonblocking. In the formulation developed for supervisory control of timed automata, the supervisor is not merely a runtime state-feedback map: it is reconstructed as a timed automaton by restricting when controllable events may occur and how long time may elapse in locations, typically by strengthening guards and invariants while preserving the plant’s reset structure (Rashidinejad et al., 2021).

1. Problem formulation and motivation

The supervisory problem is posed over a timed plant $P^t$ and plantified timed requirements $R^{p,t}$. The explicit objective is to compute a maximally permissive timed supervisor $S^t$ that is controllable with respect to $P^t \| R^{p,t}$ and for which $P^t$0 is nonblocking. In this setting, a timed-automata supervisor is therefore characterized by three interlocking properties: controllability, nonblockingness, and maximal permissiveness (Rashidinejad et al., 2021).

The central difficulty is that timed automata have real-valued clocks and hence an infinite state space. The detailed treatment contrasts timed automata with extended finite automata: in the latter, variables change only on edge updates, whereas in timed automata clocks evolve continuously in every location. This difference prevents direct application of ordinary finite-automata supervisory-control algorithms. A standard workaround is to abstract the timed model to a finite untimed structure, but the required partition of dense-time valuations into finitely many equivalence classes is highly sensitive to the maximum clock constants and may cause severe state-space explosion. The resulting tension defines the topic: a timed-automata supervisor must preserve the semantics of timed control while remaining algorithmically synthesizable (Rashidinejad et al., 2021).

The role of supervision is standard in discrete-event systems: controllable behavior may be disabled to avoid bad outcomes, while uncontrollable behavior must remain admitted. What is specific here is that the final supervisory object is again a timed automaton. This makes the supervised behavior analyzable in the same formalism as the plant, rather than leaving it as a purely semantic restriction on runs (Rashidinejad et al., 2021).

2. Timed-automata structure and control semantics

The underlying timed-automata model uses locations, clocks, guards, reset sets, invariants, and time-elapse semantics. In the product construction, an edge has the form

$P^t$1

which makes explicit the source, event label, guard, reset set, and target. Time passes continuously in a location as long as its invariant holds, and discrete events may occur when their guards are satisfied (Rashidinejad et al., 2021).

The finite abstraction used for synthesis is based on region equivalence. Let $P^t$2 be the clock set, and let $P^t$3 be the largest integer appearing in a unary clock constraint involving $P^t$4. Two valuations $P^t$5 and $P^t$6 are region equivalent, written

$P^t$7

iff: first, for every $P^t$8, either $P^t$9 or both values exceed $R^{p,t}$0; second, for every $R^{p,t}$1 with $R^{p,t}$2, the property of having zero fractional part coincides; and third, for all $R^{p,t}$3 with $R^{p,t}$4, the ordering of fractional parts is preserved. This construction is the symbolic basis for a finite quotient of the timed system (Rashidinejad et al., 2021).

A timed-automata supervisor also depends on an event partition. Controllable events may be disabled. Uncontrollable events may not be disabled. Forcible events form a distinguished subclass that can preempt the passage of time when needed. In the region-based abstraction, continuous time progression is represented by time-jump transitions labeled $R^{p,t}$5 between neighboring clock regions. The key semantic point is that $R^{p,t}$6 is uncontrollable by default, but its controllability depends on the availability of a forcible event. If a forcible event is enabled in a symbolic state, then time progression into the next region may be preemptable; hence not every time predecessor of a bad state is itself bad (Rashidinejad et al., 2021).

This yields the characteristic timed notion of controllability. Ordinary uncontrollable events must always remain enabled. By contrast, a $R^{p,t}$7-transition may be removed only when it is controllable, namely when time elapse can be preempted through some enabled forcible event. The supervisor therefore acts on two semantic layers: disabling controllable events and preempting unsafe time progression (Rashidinejad et al., 2021).

3. Synthesis through region-equivalent quotient graphs

In the detailed construction, the synthesis route is indirect. One first forms the timed synchronous product $R^{p,t}$8, then untimes it into a finite-state Region Equivalent Quotient Graph (REQG), performs supervisory synthesis on that graph, and finally reconstructs a timed supervisor $R^{p,t}$9. The synchronization step must precede untiming, because relative timing information between clocks of different components would otherwise be lost (Rashidinejad et al., 2021).

The REQG has symbolic states of the form $S^t$0, where $S^t$1 is a product location and $S^t$2 is a clock region. It contains two transition types. Event transitions,

$S^t$3

connect event successors. Time-jump transitions,

$S^t$4

connect immediate time successors, that is, adjacent clock regions. The explicit retention of $S^t$5-transitions distinguishes the REQG from a standard region automaton and supports synthesis by making time progression manipulable as a symbolic transition relation (Rashidinejad et al., 2021).

On the untimed side, the baseline DES synthesis loop is backward elimination: compute blocking states; if none exist, return the automaton; otherwise compute bad states; remove controllable events leading to bad states; remove unreachable states and repeat. The timed variant modifies this by treating $S^t$6 according to forcibility. The prescribed order is critical. First compute reachable blocking states. Then compute bad states. Next remove controllable non-$S^t$7 transitions that lead to bad states. Only afterward remove controllable $S^t$8-transitions leading to bad states. Finally, if a state has lost all outgoing forcible events and also has no outgoing $S^t$9-transition—excluding states that originally lacked $P^t \| R^{p,t}$0 because of invariants or the maximum clock region—restore the $P^t \| R^{p,t}$1-transition as uncontrollable and iterate again (Rashidinejad et al., 2021).

This ordering prevents premature removal of time-jump transitions. A $P^t \| R^{p,t}$2-transition may appear controllable because some forcible event is currently enabled, yet later iterations may remove that forcible event because it leads to blocking behavior. Once that happens, the $P^t \| R^{p,t}$3-transition is no longer preemptable and must be treated as uncontrollable. The synthesis therefore combines backward propagation of badness with a dynamic reclassification of time progression based on the currently retained forcible choices (Rashidinejad et al., 2021).

4. Reconstruction of the supervisor as a timed automaton

After synthesis on the REQG, the supervisor is reconstructed as a timed automaton from the uncontrolled timed product $P^t \| R^{p,t}$4. The reconstruction does not introduce new resets. Instead, it restricts the original timed structure so that only those event occurrences and residence-time regions retained in the synthesized REQG remain possible (Rashidinejad et al., 2021).

For each controllable edge $P^t \| R^{p,t}$5 from a location $P^t \| R^{p,t}$6, let $P^t \| R^{p,t}$7 be the set of indices of supervisor states corresponding to source location $P^t \| R^{p,t}$8 from which that edge is still permitted. The guard is then strengthened as

$P^t \| R^{p,t}$9

This ensures that the event may occur only in those clock regions where the symbolic supervisor preserved the corresponding transition (Rashidinejad et al., 2021).

For each location $S^t \| P^t \| R^{p,t}$0, let $S^t \| P^t \| R^{p,t}$1 be the set of indices of supervisor states whose location component is $S^t \| P^t \| R^{p,t}$2. The invariant is then strengthened as

$S^t \| P^t \| R^{p,t}$3

This is the timed-automata realization of time preemption. If synthesis removes certain $S^t \| P^t \| R^{p,t}$4-moves leaving location $S^t \| P^t \| R^{p,t}$5, the invariant is tightened so that time cannot remain in the location long enough to reach the forbidden regions. In short, event disabling becomes guard strengthening, while time preemption becomes invariant strengthening (Rashidinejad et al., 2021).

The bus-pedestrian example makes this concrete. Under ordinary DES treatment, symbolic state $S^t \| P^t \| R^{p,t}$6 is blocking, both $S^t \| P^t \| R^{p,t}$7 and $S^t \| P^t \| R^{p,t}$8 are uncontrollable, and the initial transition must be disabled, yielding an empty supervisor. Under timed DES semantics, declaring $S^t \| P^t \| R^{p,t}$9 forcible makes the relevant $P^t$0-transitions controllable where $P^t$1 is enabled, so the dangerous time-jump can be removed and the supervisor can be reconstructed by changing both a guard and an invariant. This demonstrates that a timed-automata supervisor can encode the effect of forcing an urgent event before unsafe delay through invariant tightening rather than through additional control variables (Rashidinejad et al., 2021).

The reconstruction step also exposes an expressiveness issue. In the “TDES interval problem,” removal of $P^t$2-moves can require a disjunctive invariant such as

$P^t$3

The paper’s solution is to allow richer supervisor guard and invariant expressions, including disjunctions of region formulas. This is necessary to obtain a unique maximally permissive timed supervisor after timing; otherwise, the same REQG supervisor may correspond to multiple non-equivalent timed-automata restrictions (Rashidinejad et al., 2021).

5. Correctness guarantees, examples, and computational limits

The synthesized supervisor is intended to be controllable, nonblocking, and maximally permissive. Controllability holds because synthesis removes only controllable ordinary events and those $P^t$4-events deemed controllable through forcibility; uncontrollable events are never removed. Nonblockingness is obtained by iterating the synthesis loop until no reachable blocking states remain. Maximal permissiveness follows because synthesis starts from the uncontrolled product and removes only the necessary controllable behavior (Rashidinejad et al., 2021).

The treatment of bad states clarifies the safety semantics. A blocking state is reachable but cannot reach a marked state. A bad state is one from which the supervisor cannot prevent blocking behavior because the transition to trouble is uncontrollable. The closure property is explicit: any state from which a bad state can be reached through an uncontrollable transition is also bad. In timed systems, this includes $P^t$5-predecessors only when the relevant $P^t$6 is currently uncontrollable; if a forcible event can preempt that $P^t$7, the predecessor need not be rejected (Rashidinejad et al., 2021).

Several examples exhibit the distinctions. In the deadlock example, states $P^t$8 and $P^t$9 are blocking, their uncontrollable predecessors become bad, and the supervisor disables a controllable event over the interval $R^{p,t}$0, effectively changing the edge guard to require $R^{p,t}$1. In the bus-pedestrian example, ordinary DES synthesis is too pessimistic and returns an empty supervisor, whereas timed synthesis with a forcible $R^{p,t}$2 retains a nonempty supervisor by preempting unsafe time progression. A separate “premature $R^{p,t}$3-removal” example justifies the staged handling and possible restoration of $R^{p,t}$4-transitions (Rashidinejad et al., 2021).

The principal limitation is computational. The method is region-based rather than zone-based; the symbolic structure is the REQG. The paper emphasizes that the region graph is too sensitive to state-space explosion to use it for practical applications, and that its size is highly sensitive to the maximum clock constants. This suggests that the method is primarily suitable for small theoretical examples and conceptual comparison, rather than large practical timed systems (Rashidinejad et al., 2021).

The framework also depends on several assumptions visible in the construction: integer clock constants, synchronization of plant and requirement before untiming, preservation of plant resets, and allowance of a richer grammar for supervisor guards and invariants when unique reconstruction requires disjunctions. A timed-automata supervisor in this sense is therefore both a control object and a representational compromise between exact dense-time behavior and finite-state supervisory computation (Rashidinejad et al., 2021).

6. Related frameworks and adjacent developments

Several adjacent lines of work delimit the scope of the timed-automata supervisor concept. Determinization is one such boundary. The deterministic membership problem asks whether a nondeterministic timed automaton can be replaced by a deterministic one with the same timed language. This is directly relevant when a supervisory specification or observer must be implemented deterministically. The sharp frontier is that decidability holds for one-clock nondeterministic timed automata without $R^{p,t}$5-transitions when the number of clocks in the target deterministic automaton is fixed in advance, while two clocks, $R^{p,t}$6-transitions, or an unbounded target clock budget lead to undecidability; even the positive fragment is non-primitive-recursive-hard (Clemente et al., 2021).

A second neighboring tradition is Brandin–Wonham timed DES, where time is represented by a global $R^{p,t}$7 event rather than dense clocks. In that setting, supervisor localization decomposes a monolithic timed supervisor into local controllers for prohibitible events and local preemptors for forcible events, preserving closed and marked behavior exactly (Zhang et al., 2013). Under partial observation and communication delay, the same framework introduces timed relative coobservability, channel models, and localized delayed implementations whose intersection reproduces the synthesized decentralized timed behavior (Zhang et al., 2016). Networked supervisory control extends this further to delayed control channels and non-FIFO observation channels, synthesizing a supervisor that is timed networked controllable, nonblocking, time-lock free, and timed networked maximally permissive (Rashidinejad et al., 2021). Bounded-time nonblocking supervisory control adds another timed layer by requiring that each task class reach marker states within a specified number of ticks and computing the supremal controllable bounded-time completable sublanguage (Zhang et al., 2024).

Other related models provide verification substrates rather than direct supervisor synthesis. Higher-dimensional timed automata model true concurrency with duration and admit PSPACE-complete reachability via zone-based algorithms, suggesting a basis for supervisory reasoning over overlapping actions, but they do not supply controllability or maximal-permissiveness results (Fahrenberg, 2018). Stochastic timed automata equip timed automata with randomized delays and randomized discrete choices and use the thick graph abstraction for almost-sure verification; this is directly useful for verifying closed-loop timed behavior under uncertainty, but it is not a supervisory synthesis theory (Bertrand et al., 2014).

Taken together, these lines of work show that “timed-automata supervisor” names a family of closely related ideas rather than a single formalism. In the dense-time timed-automata setting, the defining feature is a supervisor represented again as a timed automaton through systematic restriction of guards and invariants. In tick-based timed DES, the analogous feature is a finite-state supervisor that disables events and preempts time via forcible events. The dense-time formulation centered on $R^{p,t}$8, $R^{p,t}$9, REQG synthesis, and TA reconstruction remains the clearest statement of a timed-automata supervisor as a supervisor whose output is itself a timed automaton (Rashidinejad et al., 2021).