Using model checking for analyzing dstributed power control problems

Model checking (MC) is a formal veriﬁcation technique which has known and still knows a resounding success in the computer science community. Realizing that the distributed power control (PC) problem can be modeled by a timed game between a given transmitter and its environment the authors wanted to know whether this approach can be applied to distributed PC. It turns out that it can be applied successfully and allows one to analyze realistic scenarii including the case of discrete transmit powers and games with incomplete information. The proposed methodology is as follows. We state some objectives a transmitter-receiver pair would like to reach. The network is modeled by a game where transmitters are considered as timed automata interacting with each other. The objectives are then translated into timed alternating-time temporal logic formulae and MC is exploited to know whether the desired properties are veriﬁed and determine a winning strategy


I. INTRODUCTION
Power control (PC) has been and is still recognized as an important technical problem in communication networks, especially in wireless networks.With the advent of new communications concepts, such as cognitive radio [12] and open spectrum access in unlicensed bands (see e.g., [16]), being capable of designing PC algorithms in a distributed way has become particularly important.When inspecting the literature related to distributed PC, a dominant methodology arises from the vast majority of existing works.The PC problem is generally modeled by a game where the players are the transmitters, the sets of strategies are the ranges for the transmit powers and the utility/payoff functions of the players can be for example, the transmission rate (see e.g., [15], [8], [3]) or energy-efficiency (see e.g., [7], [11], [9]).As the terminals are assumed to be free, selfish and rational decision-makers, one fundamental issue is to know whether there is a solution to this conflict of interests.In the literature of PC games the most used solution concept is the Nash equilibrium (NE).An NE corresponds to a game outcome/state effectively observed when every player does the best for itself (rationality assumption), knows the others do so (rationality is common knowledge), and has a complete knowledge of the game played (complete information assumption).One of the properties of such a state is that it is stable to a single deviation, i.e., if one player deviates from the equilibrium unilaterally, he looses in terms of utility.Therefore, a generic technical issue that is treated in works on distributed PC is the existence issue for an NE, which amounts to proving (mathematically) the existence of a fixed point.
In this paper a different point of view is adopted.The main two differences between the existing gametheoretic works and the work presented here is as follows.First, we make a different behavioral assumption for the players.Each transmitter does not assume that the others do the best for themselves but rather that they can form a coalition which can do the worst for the considered transmitter; a strategy allowing a player to reach its objective under these conditions is called a winning strategy.For instance, this worst-case assumption can be very relevant to engineers who want to design transmitters that have to reach a certain quality of service independently of the design/strategy of the other transmitters/manufacturers/operators.Second, we do not want to prove mathematically the existence of an NE or a network state having certain properties.Rather, we formulate the PC problem as a timed game [10] between the considered pair of nodes and its environment, and prove the existence or non-existence of such a (winning) strategy by translating the objective into a temporal logic formula [6] and exploiting the powerful technique of model checking (MC; see e.g., [5]).Although MC is not very well-known from the communications community, it is a concept of paramount importance in the computer science community, as witnessed by its inventors winning the ACM January 13, 2010 DRAFT Turing Award in 2007.It aims at checking, automatically, exhaustively and formally (with a computer) if a system (possibly involving several agents) verifies some properties expressed in a given logical language.
In our case, MC provides the answer to whether a certain property can be satisfied.Additionally, in the case where it is satisfied, the model checker is able to compute a winning strategy (a PC policy in our case).
Our motivation for using model checking (computational approach) instead of proving a theorem (analytical approach) is essentially twofold: we do not consider Nash equilibria (and therefore fixed-point solutions); our study aims at considering the practical case where transmit powers are discrete.Concerning the latter point, note that, as mentioned recently [14], the vast majority of works on distributed PC assume continuous transmit powers while in many existing communications systems it can only be discrete.All results based on compactness and convexity of the strategy sets of the players are not valid anymore.In particular, these results include existence, uniqueness, convergence results for pure Nash equilibria in non-cooperative PC games.Therefore, the case of discrete powers can become difficult and even impossible to solve analytically.
This paper is structured as follows.First, we describe the network model under investigation and justify the assumptions made (Sec.II).Second, we state some properties a given transmitter-receiver pair would like to be verified and present the strategic form of the distributed PC game viewed from a given transmitter (Sec.III).In Sec.IV, we reformulate this game into a timed game by using the notion of timed automaton and propose a way of modeling the timed game which is compatible with the model checker used, namely Uppaal-TiGA [2].In Sec.V, we translate the desired properties into formulae expressed in a given temporal logic and use Uppaal-TiGA to know whether the network allows theses properties to be verified.At last, in Sec.VI concluding remarks and possible extensions are provided.

II. PROBLEM STATEMENT
Here we present the assumed signal model but it is important to keep in mind that the proposed approach is not inherent to the assumed communication model and network topology, and can be directly applied to other models just by changing the expressions of the different signal-to-interference plus noise ratios (SINRs).In this paper, we assume an interference channel [4] with K transmitter-receiver pairs (Tx i , Rx i ), i ∈ {1, ..., K}, as described in Fig. 1.The baseband signal received by Rx i , can be expressed by: where ∀(i, j) ∈ {1, ..., K} 2 , h ji represents the channel gain of the link between nodes j and i; x j (t) represents the signal transmitted by Tx j and is assumed to belong to a finite alphabet (an element of this alphabet January 13, 2010 DRAFT is called a symbol e.g., a quadrature amplitude modulation symbol), t being a time index associated with a certain rate at which the medium is used (symbol index, channel use index); z i (t) is the additive white complex noise at receiver i, z i is assumed to be distributed according to a zero-mean Gaussian random variable with variance σ 2 i .As we analyze a PC problem, we make the same assumptions as in the related works ( [7], [11], etc.), that is, the channel gains are assumed to be constant over the whole duration of the transmission but can be updated on a block-by-block basis; note that a block is defined as a sequence of N consecutive symbols which comprises a training sequence that is, a certain number of consecutive symbols used to estimate the channel, the SINR, etc. Usually, the PC problem consists in updating the power of a given transmitter every block duration.Here, with more generality, we assume that it can be updated within a block duration.We will therefore assume a block can be seen as N n consecutive sub-blocks of n symbols each and use a time index τ to indicate when, in a given block, the transmit power of a given transmitter is updated.Using this time or sub-block index, one can define within a given block the instantaneous SINR for receiver i as follows: with which means that the instantaneous power results from averaging the power over n consecutive symbols.
The vector (p 1 (τ ), ..., p K (τ )) will be called the network state for sub-block τ .We will call the time elapsed during n symbol durations a time unit (TU).In addition to the assumptions made so far we will suppose that: • Assumption 1.The transmit power of each transmitter i ∈ {1, ..., K} is discrete, p i (τ )[dBm] ∈ P i , P i = {P 0 , P 0 + ∆P, ..., P 0 + (M − 1)∆P }, and can be increased or decreased by at most one power increment ∆P every TU; w.l.o.g.M is assumed to be an odd integer.
• Assumption 2. Every arriving user starts transmitting at the power p i (t = 0)[dBm] = P wu = P 0 + M −1 2 ∆P ("wu" stands for wake up).• Assumption 3.Each transmitter can start/stop transmitting at any time but has to remain at the ON or OFF state during a minimum amount of time t ON or t OFF .
• Assumption 4. Each transmitter (say i) knows its SINR and (h ji ) j perfectly.
• Assumption 5.There is a maximum SINR, denoted by γ max , above which no transmitter is allowed to operate.
January 13, 2010 DRAFT • Assumption 6.Each receiver Rx i knows the channel gain h ii only.
• Assumption 7. The number of transmitters, i.e., K can possibly vary at any time, which means in particular that they can be asynchronous (to the best to the authors' knowledge the models currently available in the literature of distributed PC problems cannot account for this feature).
Let us give some motivations for these assumptions.First, concerning Assumption 1, note that the transmit power cannot vary arbitrarily over time, it can only be increased or decreased by one power step every TU.This might translate some physical limitations due to the transmitter (e.g., because of the finite power amplifier slew rate).In fact, for the model checker we exploit in Sec.V, this assumption allows for a dramatic reduction of complexity for the verification procedure.To conclude with Assumption 1, note that the discrete power assumption ensures the existence of a mixed NE in strategic-form non-cooperative PC games with complete information and rational users.In this paper we do not want to exploit this result for at least three reasons: it is demanding in terms of information assumptions; we do not focus on the case of network states having the NE property (namely there are stable to a single deviation) but look at states which can have different properties; mixed strategies are not always relevant in communication networks (e.g., for short transmissions, sporadic traffic with non-stationary network parameters).Note that [14] also addressed the case of discrete powers but the goal in [14]

III. PROPOSED NETWORK PROPERTIES AND POWER CONTROL GAME DEFINITION
Our ultimate objective is to know if, in the network described in the preceding section, every transmitter is satisfied.A transmitter will be said to be satisfied if he can exchange a certain volume of data and at the same time reach a transmission quality target.In fact, we assume that every transmitter wants to reach this objective independently of what the other transmitters do.As a consequence of this, the network can be seen from the point of view of a given transmitter, say i, as a game between itself and its environment.
The environment includes the other transmitters and the channel.The channel consists of the matrix H whose entries are the channel gains h ij .It is fixed for a given block of data.Therefore, transmitter i will be satisfied if there exists a winning strategy in the game between itself and its environment, that is, the desired properties will be verified whatever the environment does.The existence of such a winning strategy will be proven in Sec.V by using the Uppaal-TiGA model checker.We consider the following properties.
Let ∆τ and t out be two durations expressed in TUs and γ min , γ − be two SINR thresholds with γ min ≥ γ − .
• Property 3. The network satisfies Property 3 for player i if the following three relations are verified: January 13, 2010 • Property 2. The network satisfies Property 2 for player i if Property 3 is satisfied in the special case γ min = γ − or equivalently if t out = 0.
• Property 1.The network satisfies Property 1 for player i if Property 2 is satisfied in the special case ∆τ = 0 i.e., the target SINR γ min can be reached during at least for one sub-block index (namely τ i ).
In (4), vector lies in general in the product space But here, we have used the notation P −i to clearly indicate that we assume that the PC policy implemented by every transmitter cannot be arbitrary but has to verify Assumption 5: We therefore see that, for a fixed channel, transmitter i assumes the worst case in terms of environment, that is, in terms of behavior for the other transmitters.Said otherwise, a given transmitter is free to do what is best for itself but assumes that the other transmitters can form a coalition aiming at decreasing its chances to reach its objective.The drawback for this assumption is that the obtained results will be pessimistic and the desired property will be met more often than expected.But, we have to keep in mind that one of our goals was to relax the rationality assumption (every transmitter does the best for itself and this is common knowledge to every transmitter).We can see that in the proposed framework it is effectively not needed.
This framework can be very useful in some scenarii.For example, it can happen that, over a certain period of time, Tx 2 wants to maximize its transmission rate (high speed uploading) while later on, for a second phase, it wants to save its energy.From the point of view of Tx 1 , assuming that it always wants to save its energy, Tx 2 will not behave rationally over the first phase.In brief, the rationality assumption can be very questionable, especially in heterogeneous networks (with different manufacturers, operators, services, technologies, etc.).Therefore if Property q ∈ {1, 2, 3} is verified for transmitter i, it means that the latter can reach its objective in the worst environment.Now, let us comment the proposed properties separately.Property 1 allows a transmitter to be sure that for a fixed channel state, there will be a moment at which the packet it wants to send can be received reliably, independently of the power dynamics of the other transmitters.This occurs when a short message has to be transmitted.Property 2 allows, this time, the transmitter to be ensured to transmit a certain volume of data January 13, 2010 DRAFT (D ×∆τ bits where D is the data rate in bit/s) reliably within a time interval equals to the channel coherence time, i.e., the interval over which the channel state can be considered to be fixed.As t out = 0, the property also imposes that connectivity is never lost.Property 3, like Property 2, guarantees that a certain volume of data can be exchanged reliably but is more tolerant than Property 2. Indeed, it allows the receiver to operate below the minimum required SINR for ensuring a certain transmission quality target for a certain duration (t out TUs).For example, this allows one to account for interesting scenarii such as the case where a new transmitter enters the network.When a new user arrives, it can happen that the minimum SINR target of player i, i.e., γ min is not met for a short interval only and operating at a lower SINR γ − can suffice to maintain connectivity.We will comment more on this scenario below.Another scenario where considering this property is relevant is an application or a service where two levels of quality are admitted for the transmission.To conclude on Property 3 we make some comments on the physical feasibility of such a property: (4) translates the existence of a time windows over which the medium is sufficiently good, which happens e.g., when the link h ii is good enough or some transmitters stop emitting or the other transmitters are far enough from transmitter i; (5) translates the non-existence of a too wide windows over which the channel conditions are bad in the sense that the system is not robust to a network change over this time windows; (6) ensures that over the whole block or packet duration connectivity is not lost.
Here, we justify in a more detailed manner why we use two SINR thresholds (namely γ min and γ − ) instead of one as it is usually the case for the standard formulation of the PC problem (see e.g., [13]).Indeed, in [13] and related papers the goal is to minimize the transmit power under the constraint SINR i ≥ γ − with t out → +∞; this policy allows one to reach the minimum transmission quality target and save energy.Here, by allowing the SINR target to be different from the minimum SINR target we ensure a certain degree of robustness against networks changes like the arrival of a new user.Therefore the value of γ − has to be chosen in accordance with desired robustness degree.To be more concrete, let us consider an example.
Assume a network comprising 2 pairs of nodes at time τ and 3 pairs of nodes at time τ + 1 and the existence of a steady state for the network with two users, that is, p i (τ ) = p i .Without loss of generality, consider transmitter 1.Under typical assumptions, the probability that SINR 1 at time τ + 1 is less than γ − given that it equals γ min at time τ can be checked to be (see Appendix A): where α = . Additionally, if |h 31 | 2 is exponentially distributed (case of Rayleigh fading) we have that the probability of loosing connectivity (outage probability), which we call P out , is given by: Therefore by fixing a desired target for P out we find the appropriate value for γ min to be used in the PC algorithm.As a consequence, for a given channel state Properties 1-3 will be verified or not but γ min allows one to tune the probability of verifying the latter.The price to be paid for a certain robustness against the arrival of a new user is a higher energy consumption w.r.t. the standard assumption γ min = γ − .
At this point we have all the elements to define the PC game under investigation properly.As already mentioned, the game has to be defined from a given transmitter's point of view.Consider transmitter i.
⋆ Players.There are two players in the game.Transmitter i is the first player (protagonist) and the rest of the transmitters (−i) constitutes the second player (antagonist).
⋆ Strategies.A pure strategy for transmitter i consists of a sequence of causal functions (p τ i ) τ ∈{1,..., N n } with where H (τ ) is the set of possible game histories H (τ ) ⊂ P τ i ⊂ [0, P max ] τ that is, verifying Assumptions 1 to 7. Note that the choice of these functions does not depend on a particular action (vector of transmit powers) of the opponent (called a move in game theory) but only depends on the knowledge of the considered transmitter on the game.In particular, it depends on what he believes on its opponent and its objective.
⋆ Utilities.If a given Property is satisfied (resp.not satisfied) for transmitter i, transmitter i gets +1 (resp.−1) and the environment −i (i.e., the antagonist) gets −1 (resp.+1).If a player has several winning strategies (providing him with +1), he chooses the one minimizing the consumed energy or equivalently the quantity Proving the existence of a winning strategy for player i in the stated zero-sum game appears to be nontrivial.We note that one of the problems here is the dynamic aspect of the game, which is not present in the conventional approach of the distributed PC problem (e.g., [13]).Indeed, the other transmitters can start/stop emitting whenever they want to and also choose any feasible sequence of actions (p i (τ )) τ .Additionally the game is with incomplete information since a transmitter (say i) does not know all the game; for instance the channel gains of the others are not known (h jk , k = i).A possible way of tackling the considered problem January 13, 2010 DRAFT is to reformulate the game as a timed game, for which MC can be applied.This is the purpose of the next section.

IV. TRANSLATING THE DISTRIBUTED PC PROBLEM INTO A TIMED GAME
We have presented the assumed network model in Sec.II and the properties we would like it to verify in Sec.III.In order to know whether these properties are verified or not we want to exploit the concept of MC and more specifically the Uppaal-TiGA model checker, which is the purpose of Sec.V. To this end, we need to translate the network model into a timed automaton model, and express the desired properties in a formal language named TATL (for timed alternating-time temporal logic).This is done in Sec.IV-B.
In order to make this paper sufficiently self-contained and the corresponding methodology applicable to other communication scenarii, we first review, in Sec.IV-A, some important notions on timed automata [1] and timed games [10].More details are provided in Appendices B and C.
A. Review of basic notions a) Timed automata: Roughly speaking, a timed automaton is a finite automaton enriched with clocks, which are real-valued variables used to measure the time elapsed between different events of the automaton.
All clocks evolve at the same rate, but their values can be reset when firing transitions.The values of the clocks can be used to enable or disable some of the transitions.A state (or configuration) of a timed automaton is a pair (ℓ, v) where ℓ is a location of the timed automaton and v is a valuation assigning to each clock of the automaton its nonnegative real value.There are two types of moves in timed automata: • Delay transitions: they consist in staying at the same location and letting time elapse.The automaton then goes from some configuration (ℓ, v) to another configuration (ℓ, v+t), where t ∈ R + and v+t : x → v(x) + t (all the clocks evolve at the same rate).
• Discrete transitions: they consist in firing a transition of the timed automaton.A transition ℓ g;a;r of the timed automaton comprises the following elements: -the source and target locations ℓ and ℓ ′ ; -a guard g, which is a constraint on clocks (for instance, "x ≥ 1", requiring that clock x must have a value greater than or equal to 1 for being allowed to fire this transition); -a label a on the transition, representing the corresponding event; -the set r of clocks to be reset (e.g., "x := 0"); January 13, 2010 DRAFT Firing this transition from a state (ℓ, v) is only allowed if the guard is satisfied.We then switch to state (ℓ ′ , v ′ ), with v ′ (x) = 0 if x ∈ r, and v ′ (x) = v(x) otherwise.
Timed automata are thus a finite representation of an infinite-state automaton.Still, the underlying infinitestate automaton is quite "regular", and this regularity allows one to have several problems decidable (for instance, "is there an execution of the automaton reaching a given state?"(reachability) or "do all executions avoid a given bad state?"(safety)).The algorithms generally rely on a finite-state automaton, called the region automaton [1], which roughly exhibits the same behaviors as the infinite-state automaton it abstracts.
More precise definitions for timed automata are provided in Appendix B.
b) Timed games: Timed games [10] are timed automata in which some transitions can be uncontrollable, in the sense that a player cannot neither prevent them from occurring nor force them to occur.In this setting, a given state is said to be reachable if there exists a strategy which, if consistently applied, and whichever uncontrollable transitions are applied, ensures that the goal state will be reached.In order to illustrate these notions let us consider a simple example of timed game.Consider a transmission game with two players (the transmitters).Assume that each transmitter has two possible actions: either transmit at full power (called High mode) or at low power (called Low mode).The transmission constraints are as follows.The transmitter has to stay for a minimum amount of time in each mode, and cannot stay there forever: precisely, transmitter i has to stay between m L i and M L i (resp.m H i and M H i ) TUs in the Low (resp.High) mode.
We also assume the existence of a state for which the system (or network) is blocked if both transmitters stay at the same time in the High mode for too long, say T TUs; the clock associated with the overall system or network will be denoted by y.Does a given user have a way of controlling its power in order to ensure that the network will not reach the blocking state, whatever the other transmitter will do?This situation can be modeled by a timed game (see Fig. 2 where some choices for the values for the guards and invariants have been made.Locations ℓ 0 to ℓ 3 model the different modes of the two transmitters and location ℓ 4 is the blocking location.We have considered the point of view of transmitter 1.We see that user 1 acts as a controller (playing with solid transitions) and the second user acts as the environment (controlling dashed transitions).One can show that the controller has no strategy to avoid reaching the blocking location ℓ 4 .Even in this simple example, the non-existence problem of a winning strategy is not trivial.The more general problem of PC is more complex than this problem, which is one of the reasons why automated techniques (such as MC) are used to answer this type of questions.For the interested reader more precise definitions for timed games are provided in Appendix C.

B. Timed power control game modeling
In this section, we propose a model for the general PC game presented in Sec.II, taking into account the specificities of the model checker Uppaal-TiGA.We proceed in three steps.With each of the first two steps a figure representing the timed automaton effectively implemented is associated.In the first and second steps, for clarity, we restrict our attention to the case of two transmitter-receiver pairs.c) Step 1: Fig. 3 represents our model of a transmitter.Each transmitter has its own two clocks, denoted by x and y, and can be either ON or OFF.Clock y is used to force the transmitter to stay at least t ON (resp.t OFF ) TUs in the ON (resp.OFF) state.In the figure, which corresponds to the exact model implemented in Uppaal-TiGA, the quantities t ON and t OFF are renamed ondelay and offdelay, and switching between ON and OFF is represented by the three-state loop in the upper part of Fig. 3. Let us comment the other three loops.The one on the left represents the transmitter increasing its power.This can only happen if enough time has elapsed since the last change (i.e., if x ≥ delay where delay is some positive amount of time) and if the floor SINR target is not reached yet (this last condition is encoded by the constraint A 0 p 1 < m 1 (B 0 + C 0 • p 2 ), where A 0 , B 0 , C 0 and m 1 are chosen so that this equation represents the required condition on the SINR).The loop on the right is the opposite case, which corresponds to the situation where the transmitter decreases its power.The loop in the middle, represented by a dashed transition, is uncontrollable for the transmitter: the transmitter cannot prevent this transition from occuring (as soon as the guards are true).As a consequence, any winning strategy for the transmitter must in particular be able to handle with the case where this transition is fired.This is a "coding trick" we use to model the fact January 13, 2010 DRAFT that the transmitter has to decrease its power when it is too high, in the sense that it forces the transmitter to take this case into account: the transmitter has a winning strategy only if the latter is able to handle with the case where this transition is fired as soon as it is enabled.In a real communication system, the constraint SINR i ≤ γ max could be imposed to the transmitter (even if it is a free decision maker) e.g., by a regulator or the receiver itself (if the latter breaks the communication).Finally, let us stress on the fact that the transmitter depicted on Fig. 3 will "play" against a similar opponent that is, having similar constraints for increasing or decreasing its power but implementing any feasible PC policies.

d)
Step 2: An important feature we want the network to have is that the communication is broken if the SINR goes below a certain threshold.The objective of transmitter 1 will be to establish and maintain a communication on this network.To easily represent this objective, we add an observer automaton (observer here means that it plays no role in the evolution of the system, but changes states according to the values of the SINR.There is only one copy of this automaton in our system, which is used to keep track of whether transmitter 1 manages to establish and maintain a communication).This is what Fig. 4 represents.
This automaton has three states.State Emit represent the target state of transmitter 1, where it can emit with an SINR larger than γ min .Thus, player 1 can go to this state if the SINR is high enough, encoded by the condition A 0 p 1 ≥ H(B 0 + C 0 p 2 ).Then, state Emit2 is a degraded operating mode, in which the SINR can be below a given threshold (γ − ).Again, we make the transition to Emit2 uncontrollable to "force" the system to go to this state when the guard holds true.Two cases can occur in Emit2: either the transmitter manages to have its SINR back to a reasonable value, in which case it will be allowed to go back to the Emit state; or it does not manage to do so within timeout TUs (corresponding to t out ), in which case the system will be taken to the Stop state, representing the fact that the connection is broken.

Stop Emit Emit2
A 0 p 1 ≥H(B 0 +C 0 p 2 ) y:=0 Fig. 4. The observer implementing whether or not the connection can be established or maintained e) Step 3: In order to model a system with more than two transmitter-receiver pairs, the only things to be changed in steps 1 and 2 are the expressions of the SINRs and the corresponding constraints.For example the condition from Emit to Emit2 in the observer becomes V. MODEL CHECKING AND UPPAAL-TIGA Now we have translated the PC problem under investigation into a timed game, we will check if the corresponding game satisfies the required properties, which will be expressed as temporal logic formulas.
In order to make this paper self-contained, we first briefly review the concept of MC.Then, as the last step of our methodology we express the desired properties in TATL and use Uppaal-TiGA to check these properties are verified by the timed game modeling the network of interest.

A. Model checking
Formal verification is a field of computer science where the aim is to check that the behavior of an automated system satisfies some given properties.It relies on a mathematical basis, involving logical reasoning.Model checking is one of the existing formal-verification techniques: in this setting, the considered automated system is modeled by a finite-state automaton (or by exploiting a related formalism, depending on the properties under consideration).Model checking aims at automatically and exhaustively verifying that all the executions of this automaton satisfies the properties we want to check for the original system.Those properties can be expressed in various ways: basic properties such as reachability or safety can be checked, January 13, 2010 DRAFT but richer properties can be handled thanks to temporal logics.Those logics extend classical propositional logics with temporal modalities.For instance, ♦Goal expresses that "eventually, property Goal will hold true", and ¬Error expresses that "always (in the future), Error will not hold" (i.e., an error will never occur).Combining them, we can write (Request ⇒ ♦Grant) for expressing that any request is eventually granted.Original model-checking algorithms have been developed to handle timed automata and quantitative properties, such as "every request is granted within 10 time units".Temporal logics have been extended accordingly, so that the above property can be written (Request ⇒ ♦ ≤10 Grant).They have also been extended to deal with open systems (games and timed games).In this setting, MC aims at verifying controllability properties: "does there exist a strategy for restricting the behavior of the system in order to enforce the given property".Temporal logics have been extended in order to express this kind of properties.
In the following, we use the Uppaal-TiGA model-checker, which is a model-checker for timed control- The first sentence means that there is a strategy (control) under which all executions (A) eventually reach (<>) location Observer.Emit.The second sentence expresses that there is a strategy to make the system reach location Observer.Emit and stay there for at least ∆τ time units there (because clock Observer.y is reset when we enter this location, so that being in Observer.Emit with Observer.Emit > ∆τ is equivalent to staying in that location for ∆τ time units).Finally, the third statement requires the existence of a strategy whose outcomes satisfy the following property: it is always ([]) true that the observer is either in Emit of Emit2, except possibly at the very beginning, when y is small enough.This precisely encodes Property 3.

B. Verification results obtained by using Uppaal-TiGA
We now provide some results we have obtained when running the Uppaal-TiGA model-checker for our models and the properties we are interested in.All the quantities used (reals) by Uppaal-TiGA have been approximated by rationals having 8 significant numbers.We have assumed a scenario with two transmitterreceiver pairs.Fig. 5 represents the topology of the network considered.We assume that three terminals have fixed positions and one terminal can move.Depending on the location of the mobile terminal (e.g., a laptop), the channel gains h ij have different values and the question is precisely to know if the three properties stated in Sec.III are verified in a given point.The channel gains are assumed to follow the following path loss model: where β = 0.01, d 0 is a reference distance taken to be equal to 0.1 m, d ij the distance between nodes i and j and λ the path loss exponent, taken to be equal to 3. The distance h = 0.  and Rx 1 are co-located, etc..With these conventions, the distance between Tx 1 and Rx 1 expresses as With the set of all possible positions for Tx 1 one can associate an image which is labeled by I (i,q) and defined as follows: a white pixel indicates that Property q ∈ {1, 2, 3} is satisfied for transmitter i ∈ {1, 2} at the considered point, a gray pixel indicates that Property q is not satisfied at the considered point and a black pixel indicates the positions of the fixed terminals.Here are some results we obtained by using Uppaal-TiGA.f) Image I (1,3) : Here we consider a simple scenario, which allows us to validate the model implemented with Uppaal-TiGA.Fig. 6 shows the area in which Property 3 is satisfied for transmitter 1 for ∆t = 1 TUs, t out = 3 TUs, t ON = 5 TUs, t OFF = 5 TUs.This area is a disk centered in the position of receiver 1, which can be explained by a simple calculation on the path loss effect.What is more surprising is the presence of the gray ring, which shows that connectivity can be lost as d 11 increases and then recovered while d 11 still increases.This non-trivial effect has been observed in many other scenarii.Our interpretation is that this effect is due to the discrete nature of the transmit power.Uppaal-TiGA allowed us to partly confirm this interpretation.Indeed, Uppaal-TiGA allows us to synthesize the corresponding strategies and play against it: we could not explore all possible plays, but the existence of the ring appearing in the figure seems to be linked to the fact that the transmitter has to decrease its power one more time by when moving from the closest inner adjacent white circle to the gray ring.Fig. 7 shows a zoom on a part of this area when the power increment is 1 dBm (instead of 3 dBm in the case of Fig. 6).The results provided here are useful not only because they can help assessing the coverage area of a receiver (important for an operator or network owner) but also because they show the importance of having a transmit power quantized more accurately for the highest values.Indeed, using different quantization steps (non-uniform quantization) for the transmit power (always in dB) should help removing the intermediate dead zones appearing in Fig. 7.  i is −92.2 dBm.Not surprisingly Fig. 8 shows that when transmitter 1 is too close to receiver 2 Property 1 cannot be verified for transmitter 2. This explains the gray area and the white area on the left.Here again, an a priori non-trivial effect appears.There is a small white area mixed with the gray area in which Property 1 is true.Our interpretation is as follows.When Tx 1 is close to Rx 1 , Tx 1 becomes less aggressive in terms of transmit power since its objective can be easily reached, which means that Rx 2 receives less interference.But only half of the "disk" is white because in the other half, Tx 1 seems to be too close to Rx 2 to allow Tx 2 and Rx 2 to be connected.The existence of such an area is interesting since it shows that designing sensing algorithms based on the distance only can have undesirable effects.Indeed, if Tx 2 implements such an algorithm based on the distance between itself and Tx 1 , it appears that the influence of Tx 1 is stronger when it is close to Rx 1 than what it is when it is close to Tx 2 .This shows the type of implications of our results in terms of design.Note that this type of algorithms is implictly assumed in the wireless game theory literature using best-response or learning-type algorithms.
Finally, Fig. 9 shows how players interact with each other by choosing their transmit power over time.
In this example, transmitter Tx 1 tries to establish and maintain a communication with its receiver Rx 1 , while Tx 2 initiates short communications.In this example, Tx 2 is rather far from its receiver, so that it is allowed to turn its power to its maximal value.In order to maintain the communication, Tx 1 also has to increase its power.This goes smoothly for the first communication initiated by Tx 2 , but communication of Tx 1 is broken at the second time, because Tx 1 , that is close to its receiver, had set its power to its minimal value and could not "react" in time to set its SINR back to a reasonable value.This both illustrates the sequence of actions associated with the winning strategies of the transmitters and shows that the proposed setup allows one to accomodate asynchronous transmitters.

C. Towards an implementable distributed power control algorithm
A natural and relevant issue is to assess the gap between the power control procedure and an algorithm implementable in a real terminal (a laptop, a mobile phone, a robot, a sensor, etc).Here we do not pretend that the proposed procedure is ready to be implemented in a real terminal but we still want to provide some elements towards reaching this objective.Consider transmitter i.There are two steps.The first step is performed off-line by a computation center (which can be different from the transmitter but not necessarily).
The second one is always performed on-line at the transmitter.
First step.Define a off-line function for which the output is • either a positive answer (yes or 1) associated with a non-zero sequence of functions (as defined in ( 10)), • or a negative answer (no or 0) associated with the zero sequence (connection failure) and the inputs are the (quantized) channel gains (|h ij |) j =i ), the (quantized) noise level σ 2 i , the maximum number of transmitters K max (already discrete), the sets of transmit powers P j , j ∈ {1, ..., K max (already discrete), and F q the logic formulae (written with the syntax of Uppaal-TiGA), where q ∈ {1, 2, ..., Q} is the formula index (Q = 3 in our case), translating the properties to be verified.For every possible 5−tuple (|h ij |) j , σ 2 i , K max , (P j ) j , (F q ) q the model checker is used to provide the value of the output of the function.The corresponding lookup table is stored in the transmitter memory.
Second step.Define an on-line function for which the output is a sequence of functions and the inputs are the channel gains (|h ij |) j =i .Every block duration, this function is runned (processing) and the look-up table (memory) gives the terminal the sequence of power control functions to be used (see (10)).Within a block, the transmitter plays its actions (transmit power levels) according to this sequence of functions.

VI. SUMMARIZING AND CONCLUDING REMARKS
In comparison with existing works on distributed power control we have made two key choices, leading to a different methodology to analyze the problem.Instead of assuming that every transmitter does what is best for itself we assume that, from a given transmitter point of view, the other transmitter can form a coalition January 13, 2010 DRAFT aiming at choosing the worst environment for the considered transmitter.This worst-case assumption allows one to cope with some assumptions on the behavior of the other transmitters, which can be invalid in certain scenarii like in heterogeneous networks or when transmitters does not act rationally.Although pessimistic, it also allows the engineer to design a transmitter-receiver pair able to operate successfully under any feasible network configuration.The second important choice made in this paper is that the existence of the desired network state (namely verifying some properties for each transmitter) is not proven mathematically as it usually the case for Nash equilibria; one of the motivations for this is that this problem was non-trivial especially because we have considered the practical assumption of discrete transmit-power and consider the dynamic aspect of the problem.Rather, we propose another approach.This approach consists in modeling the problem as a timed game between a given transmitter and its environment and ask a model checker for a rigorous answer to whether or not there exists a winning strategy (in the sense of certain desired properties for this player).Note that model checkers not only provide the answer to this question but also a winning strategy when it exists.In a concrete manner, this shows that it is possible to implement a certain mapping between a set of possible channel states and a set of winning strategies.At last, we have illustrated our approach by exploiting the Uppaal-TiGA model checker and shown how non-trivial verification results could be obtained.
In view of the obtained results, the proposed approach is quite general and seems to be promising.By general, we mean that it only applies to interference channels but also to any multiuser channels.Of course, the authors made some assumptions which can be discussed, which opens the possibility of extending the present work.For example, in addition to the extensions proposed above: (a) One could try to remove the assumption of the worst behavior assumption for the environment.Indeed the price to be paid for removing the rationality assumption is that the influence of the other transmitters is overestimated.In a non-cooperative network, the transmitters will not always be able to form a coalition to fight against a given transmitter.In particular, this means that if the Nash equilibrium is effectively the most appropriate solution concept, the proposed approach can be adapted to prove the existence and uniqueness of an NE when proving a fixedpoint theorem leads to a failure.The extension of our work to the Nash equilibrium solution concept would be an interesting and non-trivial extension since the protagonist-antagonist approach used in Uppaal-TiGA does not hold anymore;(b) The framework of time games allows one to deal with real-time applications while we have focused here on the case of delay-tolerant applications; (c) Since one can treat the case of dynamic games, it would be very interesting to compare the utilities obtained by Uppaal-TiGA and compare January 13, 2010 DRAFT with individually rational levels allowed by equilibria in repeated games; (d) Considering a constraint on the average transmit power and a finite energy constraint would also be a very practical feature to be included.The energy constraint should change the transmitters' behaviors, which is a priori not that easy to be predicted.
At time τ +1 one new transmitter arrives, transmitter 1 observes its new SINR but is only able to react at time τ +2.We precisely want that at least at time τ +1, while transmitter 1 is "surprised", its communication is not broken that is, its SINR does not go below a certain threshold, say γ − .At time τ + 1 the SINR of user 1 is: The probability that SINR of player 1 falls, at time τ + 1, below γ − given that it was equal to γ min at time τ The semantics of a timed automaton A is given by a labelled transition system T A .A state of A is a pair q = (l, ν) such that l ∈ L and ν |= I(l).We let Q denote the set of all states.
The game then evolves to a new state (according to the choice of Player 2) and the two players proceed to play as before.
Notice that, in the definition of a timed game, it is implicitly supposed that Player 1 can always formulate a choice (τ, a) in any reachable state q of the game.
We will now formalize the semantics through the concept of strategy.
Definition C.2: A (Player 1) strategy is a function Before defining the notion of a winning strategy, we need to define several other notions.We say that a run ρ is maximal if it is either infinite or ending in a deadlock.An objective Ω of a timed game is a subset of the runs of A. Let ρ be a run of the form q 1 − −− → q k+1 • • • , we denote by ρ i the prefix of ρ ending in q i .Given a strategy λ and a run ρ, we say that ρ is played according to λ if for every i, if λ(ρ i ) = (τ ′ i , a i ), then either τ i = τ ′ i and Action(e i ) = a i , or τ i ≤ τ ′ i and Action(e i ) = u.We denote by Outcome(ρ, λ) the set of maximal runs extending ρ and played according to λ.Given a state q, a strategy λ and an objective Ω, we say that the strategy λ is winning for the objective Ω from q if Outcome(q, λ) ⊆ Ω.

Fig. 3 .
Fig. 3. Our model of a transmitter.Equations in blue are guards of the closest transition, while updates are in green.
g) Image I (2,1) : This time we consider the point of view of transmitter 2 vis-a-vis the position of transmitter 1, where the noise power σ 2

Fig. 8 .
Fig. 8.I (2,1) : Influence of the position of Tx1 on connectivity between Tx2 and Rx2 in the sense of Property 1.

Fig. 9 .
Fig. 9. Transmit power versus time for the two users.