Reactive Synthesis Swen Jacobs <swen.jacobs@iaik.tugraz.at> - - PowerPoint PPT Presentation

โ–ถ
reactive synthesis
SMART_READER_LITE
LIVE PREVIEW

Reactive Synthesis Swen Jacobs <swen.jacobs@iaik.tugraz.at> - - PowerPoint PPT Presentation

Sep 16, 2022 220 likes โ€ข1.09k views

Reactive Synthesis Swen Jacobs <swen.jacobs@iaik.tugraz.at> VTSA 2013 Nancy, France 24.09.2013 u www.iaik.tugraz.at 2 End of Synthesis, Part I: Basics Synthesis as a Game General : LTL Synthesis Time-Efficient : GR(1)

slide-1
SLIDE 1

u www.iaik.tugraz.at

Reactive Synthesis

24.09.2013 Swen Jacobs <swen.jacobs@iaik.tugraz.at> VTSA 2013 Nancy, France

slide-2
SLIDE 2

End of Synthesis, Part I: Basics

Swen Jacobs VTSA 2013 2

  • Synthesis as a Game
  • General: LTL Synthesis
  • Time-Efficient: GR(1) Synthesis
  • Application: AMBA Bus Protocol
  • Space-Efficient: Bounded/Safraless Approaches
slide-3
SLIDE 3

Synthesis, Part II: Advanced Topics

Swen Jacobs VTSA 2013 3

  • Lazy Synthesis
  • Distributed Synthesis
  • Parameterized Synthesis
  • Quantitative Specifications
  • Robustness
slide-4
SLIDE 4

Swen Jacobs VTSA 2013 4

Lazy Synthesis

slide-5
SLIDE 5

Lazy Synthesis [VMCAI12]

Swen Jacobs VTSA 2013 5

  • Based on SMT-based Bounded Synthesis
  • Idea: instead of full translation to SMT, use lazy

encoding in abstraction refinement approach

  • Integrates model checking approach to test

candidate models and obtain counterexamples

slide-6
SLIDE 6

Lazy Synthesis: Overview

Swen Jacobs VTSA 2013 6

slide-7
SLIDE 7

Partial Design

Swen Jacobs VTSA 2013 7

  • Part of system already implemented
  • Other part to be synthesized
  • Interface of processes given
slide-8
SLIDE 8

Lazy Synthesis: Overview

Swen Jacobs VTSA 2013 8

Outer Loop:

  • Search for implementation of size ๐‘œ, increment ๐‘œ if

unrealizability is proved Synthesis Loop: For a given bound ๐‘œ:

  • 1. SOLVE: check satisfiability of constraints,
  • btain candidate implementation
  • 2. CHECK: model check candidate and white-box

with monitor automata

  • 3. REFINE: if errors are reachable,

construct constraints excluding error paths

slide-9
SLIDE 9

Lazy Synthesis: Solve Phase

Swen Jacobs VTSA 2013 9

  • Transition relation represented as function

๐‘ข๐‘ ๐‘๐‘œ๐‘ก: ๐”บ ๐ฝ ร— โ„• โ†’ โ„•,

  • Outputs as functions of type โ„• โ†’ ๐”บ
  • Initial constraints: size constraint, initial state
  • More constraints are added in subsequent calls
  • Check satisfiability of constraints and obtain model
slide-10
SLIDE 10

Lazy Synthesis: Check Phase

Swen Jacobs VTSA 2013 10

Translate assumptions & guarantees to safety automata Assumption: ๐‡๐† ๐‘†๐น๐ต๐ธ๐‘ Guarantee: ๐‡ ๐ถ๐‘‰๐‘‡๐‘†๐น๐‘…๐‘— โ†’ ๐† ๐‘๐ต๐‘‡๐‘ˆ๐น๐‘† = ๐‘— Restriction to safety depends on size bound

slide-11
SLIDE 11

Lazy Synthesis: Check Phase

Swen Jacobs VTSA 2013 11

  • Model-check candidate + white-box + automata
  • If errors found, call Refine phase,
  • therwise candidate model satisfies full spec
slide-12
SLIDE 12

Lazy Synthesis: Refine Phase

Swen Jacobs VTSA 2013 12

  • If model checker finds errors, encode

them into SMT constraints, forbid them

  • In BDD-based implementation,

we can obtain tree of all error paths of minimum length

  • this tree can be translated

into a constraint that forbids all minimal errors

โˆˆ? ๐…๐Ÿ‘ โˆˆ ๐…๐Ÿ‘ โˆˆ ๐…๐Ÿ‘ โˆˆ ๐…๐Ÿ‘ โˆ‰ ๐…๐Ÿ‘ โˆˆ? ๐…๐Ÿ โˆˆ? ๐…๐Ÿ

slide-13
SLIDE 13

Lazy Synthesis: Refine Phase

Swen Jacobs VTSA 2013 13

  • Error tree translated to constraint

that forbids all error paths, restricted to interface of black-box

  • For every path, the constraint

expresses that at least one

  • utput needs to be different
slide-14
SLIDE 14

Lazy Synthesis: Overview

Swen Jacobs VTSA 2013 14

Outer Loop:

  • Search for implementation of size ๐‘œ, increment ๐‘œ if

unrealizability is proved Synthesis Loop: For a given bound ๐‘œ:

  • 1. SOLVE: check satisfiability of constraints,
  • btain candidate implementation
  • 2. CHECK: model check candidate and white-box

with monitor automata

  • 3. REFINE: if errors are reachable,

construct constraints excluding error paths

slide-15
SLIDE 15

Reconsider AMBA case study, with partial implementation for deterministic parts: โ€œThe arbiter indicates which bus master is currently the highest priority [...] by asserting the appropriate GRANTi

  • signal. When the current transfer completes, as indicated by

READY HIGH, then [...] the arbiter will change the MASTER[3:0] signals to indicate the bus master number.โ€ [AMBA Specification (Rev 2.0), ARM Ltd.]

Lazy Synthesis: AMBA Case Study

Swen Jacobs VTSA 2013 15

slide-16
SLIDE 16

Other statements translated to LTL: โ€œThe arbitration mechanism is used to ensure that only one master has access to the bus at any one time.โ€ โˆ€๐‘— โ‰  ๐‘˜: ๐‡ ๐‘†๐น๐ต๐ธ๐‘ โ†’ ยฌ ๐ป๐‘†๐ต๐‘‚๐‘ˆ๐‘— โˆง ๐ป๐‘†๐ต๐‘‚๐‘ˆ๐‘˜ Some statements modeled with auxiliary variables: โ€œNormally the arbiter will only grant a different bus master when a burst is completing.โ€ โˆ€๐‘—: ๐‡ ยฌ๐ธ๐น๐ท๐ฝ๐ธ๐น โ†’ ๐ป๐‘†๐ต๐‘‚๐‘ˆ๐‘— โ†” ๐˜ ๐ป๐‘†๐ต๐‘‚๐‘ˆ๐‘— (๐ธ๐น๐ท๐ฝ๐ธ๐น defined s.t. it is high when a burst completes)

Lazy Synthesis: AMBA Case Study

Swen Jacobs VTSA 2013 16

slide-17
SLIDE 17
  • AMBA with partial implementation for deterministic parts
  • crucial part synthesized: arbiter

Lazy Synthesis: AMBA Case Study

Swen Jacobs VTSA 2013 17

slide-18
SLIDE 18

Swen Jacobs VTSA 2013 18

AMBA: Bounded size of implementations

200 400 600 800 1000 1200 1400 1 2 3 4 5 6 7 8 9 10 KS cofactors new spec manual

#masters Circuit size More recent results go up to 16 masters

bounded/lazy

Synthesis time still grows (double) exponentially!

slide-19
SLIDE 19

AMBA: Bounded size of implementations

Swen Jacobs VTSA 2013 19

Synthesis time still grows (double) exponentially!

bounded/lazy

slide-20
SLIDE 20

Lazy Synthesis: Challenges

Swen Jacobs VTSA 2013 20

  • SMT solving incremental, but Model Checking

restarted every time

  • deep integration of incremental model checking?
  • interface and safety abstraction currently given by

hand

  • automatically minimize interface?
  • automatic safety abstraction, or use liveness model

checker?

  • Parallelize?
  • Extend to distributed case?
slide-21
SLIDE 21

Swen Jacobs VTSA 2013 21

Distributed Synthesis

slide-22
SLIDE 22

Why Distributed Synthesis?

Swen Jacobs VTSA 2013 22

  • Many interesting systems are distributed:
  • multi-threaded programs
  • multi-core processors
  • communication protocols
  • distributed control
  • โ€ฆ
  • Both a prerequisite and a motivation for

parameterized synthesis

slide-23
SLIDE 23

Distributed Synthesis

Swen Jacobs VTSA 2013 23

  • Several processes, each decides about subset of
  • utputs
  • Easy case: all processes have full information;

this reduces to standard synthesis problem

  • How so?
  • Every process has all inputs, but only subset of outputs
  • In worst case, synthesize full system for all processes

and throw away unnecessary outputs

slide-24
SLIDE 24

Partial Information

Swen Jacobs VTSA 2013 24

  • Hard case: every process only has limited

information about environment (and other processes)

  • Very hard, but decidable, for some architectures

like pipelines

slide-25
SLIDE 25

Partial Information

Swen Jacobs VTSA 2013 25

  • Undecidable if there is an information fork

[PnueliRosner90,FinkbeinerSchewe05]

slide-26
SLIDE 26

Partial Information: Bounded Synthesis

Swen Jacobs VTSA 2013 26

Semi-decision procedure possible, e.g. based on bounded synthesis. Model distributed systems by projection functions from a global state ๐‘ข to local state ๐‘’๐‘— ๐‘ข of component ๐‘— Partial information then expressed by constraints of the form ๐‘’๐‘— ๐‘ข = ๐‘’๐‘— ๐‘ขโ€ฒ โˆง ๐ฝ โˆฉ ๐ฝ๐‘— = ๐ฝโ€ฒ โˆฉ ๐ฝ๐‘— โ†’ ๐‘’๐‘— ๐œ ๐‘ข, ๐ฝ = ๐‘’๐‘— ๐œ ๐‘ขโ€ฒ, ๐ฝโ€ฒ (for every process ๐‘—)

slide-27
SLIDE 27

Swen Jacobs VTSA 2013 27

Parameterized Synthesis

slide-28
SLIDE 28

Parameterized Synthesis

[TACAS12,VMCAI13]

Swen Jacobs VTSA 2013 28

  • Many specifications are parametric in nature
  • AMBA, communication protocols, etc.

Can we synthesize building blocks for arbitrary size systems?

slide-29
SLIDE 29

Parameterized Synthesis

Swen Jacobs VTSA 2013 29

Building blocks:

  • Distributed synthesis
  • of uniform processes
  • Decidability results for parameterized verification
  • particularly, cutoffs
slide-30
SLIDE 30

Parameterized Verification

Swen Jacobs VTSA 2013 30

Parameterized verification is decidable for certain systems

Asynchronous System: No global clock, a subset of processes are allowed to make a move in every global step (decided by external scheduler). Token Ring: Processes only communicate by passing single (value-less) token in ring architecture. Always exactly one process is scheduled, except for token passing steps.

slide-31
SLIDE 31

Parameterized Verification

Swen Jacobs VTSA 2013 31

Parameterized verification is decidable for certain systems

Theorem [EmersonNamjoshi95]: In token rings with fair token passing, a given process implementation satisfies parameterized specification ๐œ’ in LTL\X iff it satisfies ๐Œ in a ring of small size: 2 processes for ๐œ’ = โˆ€๐‘—: ๐‘” ๐‘— 3 processes for ๐œ’ = โˆ€๐‘—: ๐‘”(๐‘—, ๐‘— + 1) 4 processes for ๐œ’ = โˆ€๐‘—, ๐‘˜: ๐‘” ๐‘—, ๐‘˜ 5 processes for ๐œ’ = โˆ€๐‘—, ๐‘˜: ๐‘” ๐‘—, ๐‘— + 1, ๐‘˜ Corollary: For parameterized synthesis in token rings, it is sufficient to synthesize a process implementation satisfying ๐œ’ in a ring of size 2 โ€“ 5.

slide-32
SLIDE 32

(Un)Decidability

Swen Jacobs VTSA 2013 32

Does decidability of parameterized verification make synthesis decidable? No, since even for two uniform processes in a token ring, distributed synthesis is undecidable. A reduction result from Clarke et al. [CTTV04] shows that parameterized synthesis for formulas โˆ€๐‘—: ๐œ’ ๐‘— reduces to synthesis of one process, which is decidable.

slide-33
SLIDE 33

Parameterized Synthesis: Procedure

Swen Jacobs VTSA 2013 33

  • 1. Use cutoff to reduce parameterized synthesis

problem to distributed synthesis problem

  • 2. Modified encoding (from bounded synthesis) of

realizability of specification with

  • uniform processes
  • in a token ring architecture
  • with fair scheduling and fair token-passing
  • 3. Solve problem with SMT solver

(for increasing bounds)

slide-34
SLIDE 34

Modified Encoding

Swen Jacobs VTSA 2013 34

Bounded synthesis encoding with following extensions:

  • synthesis of uniform processes:
  • add constraints that specify equivalence of local transitions
  • use same output labels for all processes
  • token-passing systems:
  • add constraints ensuring correct token passing of exactly
  • ne token in the ring
  • fairness of scheduling and token passing:
  • added directly to LTL specification
slide-35
SLIDE 35

(First) Experiments

Swen Jacobs VTSA 2013 35

Can synthesize distributed arbiter in token ring of 4 processes with spec โˆ€๐‘—: ๐ป ๐‘ 

๐‘— โ†’ ๐บ๐‘•๐‘—

โˆ€๐‘— โ‰  ๐‘˜: ยฌ ๐‘•๐‘— โˆง ๐‘•๐‘˜ This takes Z3 about 10 sec. But: problem gets hard very fast. For extended spec with โˆ€๐‘—: ยฌ๐‘•๐‘—๐‘‰๐‘ 

๐‘— โˆง ๐ป ๐‘•๐‘— โ†’ ยฌ๐‘•๐‘—๐‘‰๐‘  ๐‘— ,

needs about 240 sec.

slide-36
SLIDE 36

Benefits of Parameterized Synthesis

Swen Jacobs VTSA 2013 36

slide-37
SLIDE 37

Parameterized Synthesis: Optimizations [VMCAI13]

Swen Jacobs VTSA 2013 37

Modular Synthesis:

  • Instead of one cutoff for whole system, use different

cutoffs for conjuncts โˆ€๐‘—: ๐ป ๐‘ 

๐‘— โ†’ ๐บ๐‘•๐‘—

cutoff 2 โˆ€๐‘— โ‰  ๐‘˜: ๐ปยฌ ๐‘•๐‘— โˆง ๐‘•๐‘˜ cutoff 4 (before: one cutoff for whole formula)

  • Encoded separately (with same uninterpreted

functions), conjoined for solving

  • large parts of specifications have small cutoffs

(properties are local to the process)

slide-38
SLIDE 38

Parameterized Synthesis: Optimizations

Swen Jacobs VTSA 2013 38

Size of SMT queries: full4: 6MB 0.6MB pnueli4: 21MB 4MB

slide-39
SLIDE 39

Parameterized Synthesis: Optimizations

Swen Jacobs VTSA 2013 39

More optimizations:

  • local synthesis for local properties โˆ€๐‘—: ๐œ’ ๐‘—
  • ptimized annotations (counters for SCCs)
  • bottom-up encoding of global transition relation
  • hard-coding token possession
slide-40
SLIDE 40

Parameterized Synthesis: Challenges

Swen Jacobs VTSA 2013 40

  • Make approach applicable to more architectures
  • lots of parameterized verification results can potentially

be lifted to synthesis

  • Find out what is needed to synthesize industrial case

studies, like AMBA, in parameterized way

  • theoretical extensions (synchronous, architecture)
  • additional optimizations
slide-41
SLIDE 41

Swen Jacobs VTSA 2013 41

Quantitative Specifications

slide-42
SLIDE 42

Swen Jacobs VTSA 2013 42

Specification Example: Arbiter

  • Input: r0, r1
  • Output: g0, g1
  • Specification (in LTL):
  • G(r0 ๏‚ฎ F g0)
  • G(r1 ๏‚ฎ F g1)
  • G ๏ƒ˜(g0 ๏ƒ™ g1)

Arbiter

r0, r1 g0, g1

Any nasty arbiters that satisfy the spec?

slide-43
SLIDE 43

Swen Jacobs VTSA 2013 43

Specification Example: Arbiter

  • Input: r0, r1
  • Output: g0, g1
  • Specification (in LTL):
  • G(r0 ๏‚ฎ F g0)
  • G(r1 ๏‚ฎ F g1)
  • G ๏ƒ˜(g0 ๏ƒ™ g1)
  • Unnecessary grants!
  • Arbitrary time between

request and grant!

Arbiter

r0, r1 g0, g1

slide-44
SLIDE 44

Swen Jacobs VTSA 2013 44

A Different Arbiter (Safety)

  • Input: r0, r1
  • Output: g0, g1

Specification (in LTL): Guarantees:

  • G(r0 ๏‚ฎ g0)
  • G(r1 ๏‚ฎ g1)
  • G ๏ƒ˜(g0 ๏ƒ™ g1)

Assumption:

  • G ๏ƒ˜(r0 ๏ƒ™ r1)

Any nasty arbiters that satisfy the spec?

Arbiter

r0, r1 g0, g1

slide-45
SLIDE 45

Swen Jacobs VTSA 2013 45

A Different Arbiter (Safety)

  • Input: r0, r1
  • Output: g0, g1

Specification (in LTL): Guarantees:

  • G(r0 ๏‚ฎ g0)
  • G(r1 ๏‚ฎ g1)
  • G ๏ƒ˜(g0 ๏ƒ™ g1)

Assumption:

  • G ๏ƒ˜(r0 ๏ƒ™ r1)
  • What if two requests

come simultaneously?

  • Spec does not

guarantee robustness!

Arbiter

r0, r1 g0, g1

slide-46
SLIDE 46

Swen Jacobs VTSA 2013 46

Specifications

  • Claim: traditional specs have their drawbacks
  • Goal: introduce new specification language to state

properties like

  • ASAP
  • As little as possible
  • Robustness
  • โ€ฆ
slide-47
SLIDE 47

Swen Jacobs VTSA 2013 47

Boolean View โ€“ Black & White

Language is function mapping words to {0,1} System is a set of words A good system has only good words But: some systems are better than others! Now what?

good (1) bad (0) M2 M1 M3 M4 M1 M2 M3 M4 Set of all words

slide-48
SLIDE 48

Swen Jacobs VTSA 2013 48

Boolean View โ€“ Black & White

Updating the spec may be hard

  • Properties may be hard to find
  • You may loose abstraction
  • Spec may become long & unreadable

good (1) bad (0) M2 M1 M3 M4 M1 M2 M3 M4

slide-49
SLIDE 49

Swen Jacobs VTSA 2013 49

Revisit Basic Assumption

Language is function mapping words to {0,1}

good (1) bad (0) M2 M1 M3 M4 M1 M2 M3 M4

slide-50
SLIDE 50

Swen Jacobs VTSA 2013 50

Quantitative view โ€“ Grey scale

Language is function mapping words to โ„

bad (0) M2 M1 M3 M4 M1 M2 M3 M4 better >0

slide-51
SLIDE 51

Swen Jacobs VTSA 2013 51

Questions

Design Questions:

  • How do we assign a value to a word?
  • Given L: ๏“๏ท ๏‚ฎ โ„, what is the value of a system?

Technical Questions

  • How do we verify that the value of a system is OK?
  • How do we synthesize an optimal system?
slide-52
SLIDE 52

Swen Jacobs VTSA 2013 52

Value of a Word

  • Idea: reward good events
  • Use deterministic automata with weights on edges
  • A: ๏“๏ท ๏‚ฎ N๏ท
  • Summarize weights of a word. Options:
  • LA(w) = min(A(w))
  • LA(w) = max(A(w))
  • LA(w) = meanvalue(A(w))
  • Mean value gives you mean payoff automata
slide-53
SLIDE 53

Swen Jacobs VTSA 2013 53

Example: Quick Grants

เธ€๏€  w1 ๏€ฝ(rg r g rg)๏ท เธ€๏€  w2 ๏€ฝ(rg r g r g)๏ท เธ€๏€  w3 ๏€ฝ(rg rg rg )๏ท เธ€๏€  (111)๏ท เธ€๏€  (001)๏ท เธ€๏€  (000)๏ท เธ€๏€  value(w1) ๏€ฝ1 เธ€๏€  value(w2) ๏€ฝ 1

3

เธ€๏€  value(w3) ๏€ฝ 0

Value determined by mean-payoff automaton

Arbiter

r0, r1 g0, g1

slide-54
SLIDE 54

Swen Jacobs VTSA 2013 54

Value of a System

What is the value of a system?

  • The value of the worst word
  • The value of an average word
  • The value of the best word

Worst-case analysis is natural extension of Boolean case

bad (0) M2 M1 M3 M4 M1 M2 M3 M4 better

slide-55
SLIDE 55

Swen Jacobs VTSA 2013 55

Questions

Design Questions:

  • How do we assign a value to a word?
  • Given L: ๏“๏ท ๏‚ฎ R, what is the value of a system?

Technical Questions

  • How do we verify that the value of a system is OK?
  • How do we synthesize an optimal system?
slide-56
SLIDE 56

Swen Jacobs VTSA 2013 56

Compute System Value

  • Given a mean-payoff automaton A and

a reactive system S, compute value(S)

value = value๐ต1 + value๐ต2

2x

๐ต๐‘— S

slide-57
SLIDE 57

Swen Jacobs VTSA 2013 57

Specification ร— System

value = value๐ต1 + value๐ต2

2x

slide-58
SLIDE 58

Swen Jacobs VTSA 2013 58

Specification ร— System

2x Worst mean-payoff = payoff in minimum mean-payoff cycle

slide-59
SLIDE 59

Swen Jacobs VTSA 2013 59

How to Construct Optimal System?

Given

  • A classical specification ๏ช
  • A quantitative specification ๏น

Construct a reactive system S that

  • satisfies ๏ช and
  • optimizes ๏น.
slide-60
SLIDE 60

Swen Jacobs VTSA 2013 60

Synthesis of Reactive Systems

Classical Specification Construct two player game Solve game Construct system Correct system

slide-61
SLIDE 61

Swen Jacobs VTSA 2013 61 Swen Jacobs VTSA 2013 61

Synthesis of Reactive Systems

Safety Construct two player game Solve game Construct system Correct system

+ Mean- payoff Mean- payoff Optimal

[EhrenfeuchtMycielski79]

slide-62
SLIDE 62

Swen Jacobs VTSA 2013 62

Example: Quick Grants

turn into game.

Arbiter

r0, r1 g0, g1

slide-63
SLIDE 63

Swen Jacobs VTSA 2013 63

game strategy

Mean payoff game:

  • Circle maximizes, square minimizes.
  • Unmarked edges have value 0

value? strategy?

Example: Quick Grants

ยฌ๐‘  ๐‘• (1) ๐‘  ๐‘• (1) ยฌ๐‘•

slide-64
SLIDE 64

Swen Jacobs VTSA 2013 64

Drawbacks of Worst Case Analysis?

  • Input: r0, r1
  • Output: g0, g1

Specification (in LTL): Guarantees:

  • G(r0 ๏‚ฎ g0)
  • G(r1 ๏‚ฎ g1)
  • G ๏ƒ˜(g0 ๏ƒ™ g1)
  • minimize #grants

Assumption:

  • G ๏ƒ˜(r0 ๏ƒ™ r1)

Suppose payoff 1 when no grant is given

Worst case value? Optimal implementation?

Arbiter

r0, r1 g0, g1

slide-65
SLIDE 65

Swen Jacobs VTSA 2013 65

Drawbacks of Worst Case Analysis?

  • Input: r0, r1
  • Output: g0, g1

Specification (in LTL): Guarantees:

  • G(r0 ๏‚ฎ g0)
  • G(r1 ๏‚ฎ g1)
  • G ๏ƒ˜(g0 ๏ƒ™ g1)
  • minimize #grants

Assumption:

  • G ๏ƒ˜(r0 ๏ƒ™ r1)

Worst case: grant in every tick โ€“ payoff 0 Thus, behavior when no requests arrive is irrelevant! Arbiter that behaves best in worst case ๏‚น best arbiter!

Arbiter

r0, r1 g0, g1

slide-66
SLIDE 66

Swen Jacobs VTSA 2013 66

Drawbacks of Worst-Case Analysis

G(r ๏‚ฎ g) mininize #g value? worst-case optimal: 0

  • ptimal strategy?

ยฌ๐‘  ๐‘•(0) ๐‘  ๐‘•(0) ยฌ๐‘•(1) ยฌ๐‘•(1)

An optimal, but undesirable strategy!

slide-67
SLIDE 67

Swen Jacobs VTSA 2013 67

Admissibility

  • Strategy ๏ณ dominates strategy ๏ณโ€™ if

๏€ขantagonist strategies ๏ฒ, payoff(๏ณ, ๏ฒ) ๏‚ณ payoff(๏ณโ€™, ๏ฒ) ๏€คantagonist strategy ๏ฒ, payoff(๏ณ, ๏ฒ) > payoff(๏ณโ€™, ๏ฒ)

  • Strategy ๏ณโ€™ is admissible if there is no ๏ณ such that

๏ณ dominates ๏ณโ€™

  • Careful: theorems from Boolean games break.
  • e.g. admissible strategy may not be winning
  • Not all mean payoff games have finite admissible
  • ptimal strategies!
slide-68
SLIDE 68

Swen Jacobs VTSA 2013 69

Case II: Liveness

  • Liveness spec stated as parity automata
  • Solve Mean-payoff parity game

[ChatterjeeHenzingerJurdzinski05]

  • Lexicographic version for multiple objectives

[BloemChatterjeeHenzingerJobstmann09]

slide-69
SLIDE 69

Swen Jacobs VTSA 2013 70

Robustness

(An Application of Quantitative Specs)

slide-70
SLIDE 70

Swen Jacobs VTSA 2013 71

A robust system behaves โ€œreasonablyโ€ even in circumstances that were not anticipated in the requirements specification.

[GhezziJazayeriMandrioli91] Questions

  • How do you specify robustness?
  • How do you check robustness or construct robust

systems? Very little attention in formal methods

Robustness

slide-71
SLIDE 71

Swen Jacobs VTSA 2013 72

Example: Air Traffic Control

The air traffic control system must track up to 50 planes. (In that case,) response time must be at most 1 second.

  • What happens when plane 51 arrives?
  • System crashes?
  • Airplane 51 is ignored?
  • Response time goes up to 1.2 seconds?
  • What about airplane 52? 53? 99?

You want graceful degradation! But: digital systems have no natural notion of continuity!

0,2 0,4 0,6 0,8 1 1,2 1,4 4 8 12 16 20 24 28 32 36 40 44 48 52 56

Response time

[Davis90]

slide-72
SLIDE 72

Swen Jacobs VTSA 2013 73

Example: Arbiter

  • Input: r0, r1
  • Output: g0, g1

Specification (in LTL): Guarantees G:

  • G(r0 ๏‚ฎ X g0)
  • G(r1 ๏‚ฎ X g1)
  • G ๏ƒ˜(g0 ๏ƒ™ g1)

Assumption A:

  • G ๏ƒ˜(r0 ๏ƒ™ r1)

Arbiter

r0, r1 g0, g1

slide-73
SLIDE 73

Swen Jacobs VTSA 2013 74 Two Correct Controllers

Input trace: r1r2 r1 ๐‘ 2 ๐œ• Output trace: ๐‘•1๐‘•2 ๐‘•1๐‘•2 ๐œ• r1r2 r1 ๐‘ 2 ๐œ• ๐‘•1๐‘•2 ๐‘•1๐‘•2 ๐œ•

Specification: A ๏‚ฎ G

g1g2 g1g2 g1g2 ๏ž r1r2 r1 r1r2 r1 M1 g1g2 g1g2 r2 ๏ƒš r1r2 r1r2 r2 r1 r1 ๏ƒš M2

Does not recover from an error! Does recover from an error!

Verification does not distinguish between two systems Synthesis may give you either system

slide-74
SLIDE 74

Swen Jacobs VTSA 2013 75

What May Go Wrong?

  • System errors
  • Soft errors (transient)
  • Permanent faults
  • Environment errors
  • Operator error
  • Transmission line error
  • Implementation error

We focus on environment errors

slide-75
SLIDE 75

Swen Jacobs VTSA 2013 76

What is Reasonable?

Typical proposals:

  • System behavior unchanged [FeySuelflowDrechsler]
  • System behaves according to original spec

[SeshiaLiMitra]

  • System recovers to safe state [self-stabilization,

Dijkstra]

  • System recovers to safe state quickly [Baarir et al.]
slide-76
SLIDE 76

Swen Jacobs VTSA 2013 77

What is Reasonable?

Claim: User should decide what is reasonable For arbiter: When two requests come

  • drop one?
  • drop both?
  • grant both?

How do we state what is preferable?

g1 = G(r1 ๏‚ฎ X g1) ๏ƒ™ G(r2 ๏‚ฎ X g2) g2 = G ๏ƒ˜(g1 ๏ƒ™ g2) a = G ๏ƒ˜(r1 ๏ƒ™ r2) Spec: a๏‚ฎ g1 ๏ƒ™ g2 Arbiter

r0, r1 g0, g1

slide-77
SLIDE 77

Swen Jacobs VTSA 2013 78

Stating what is Preferable

Case by case analysis of wrong behavior?

  • bothersome!
  • impossible?

0,2 0,4 0,6 0,8 1 1,2 1,4 4 8 12 16 20 24 28 32 36 40 44 48 52 56

Response time planes response time (s) ๏‚ฃ50 1 51 1.1 52 1.2 53 1.3 โ€ฆ โ€ฆ

slide-78
SLIDE 78

Swen Jacobs VTSA 2013 79

Proposal: Error Functions as Automata

Error measure d is sum of weights on edges Good properties of this error function:

  • Behavior ฯƒ is error-free: d(ฯƒ)=0
  • Behavior ฯƒ has errors:

d(ฯƒ)>0 Bad property:

  • Does not distinguish between single and multiple

errors

r1 r1 r1g1 r1g1 (0) (0) (0) (0) g1 true (1)

G(r1 ๏‚ฎ X g1)

(1)

Environment error: 0 System error: 0 Environment error: 1 System error: โˆž

r1 0 1 1 1 1 1 ... r2 0 0 0 0 0 0 ... g1 0 0 1 1 1 1 โ€ฆ g2 1 1 0 0 0 0 โ€ฆ r1 0 1 1 1 1 1 ... r2 0 1 0 0 0 0 ... g1 0 0 0 1 1 1 โ€ฆ g2 1 1 1 0 0 0 โ€ฆ

slide-79
SLIDE 79

Swen Jacobs VTSA 2013 80

A Better Error Function

r1 r1 r1g1 r1g1 (0) (0) (0) (0) g1(1)

Environment error: 0 System error: 0

r1 0 1 1 1 1 1 ... r2 0 0 0 0 0 0 ... g1 0 0 1 1 1 1 โ€ฆ g2 1 1 0 0 0 0 โ€ฆ similar for

  • ther properties

g1 true

Environment error: 1 System error: 1

r1 0 1 1 1 1 1 ... r2 0 1 0 0 0 0 ... g1 0 0 0 1 1 1 โ€ฆ g2 1 1 1 0 0 0 โ€ฆ

slide-80
SLIDE 80

Swen Jacobs VTSA 2013 81

Error Specifications

  • Specs have the form A ๏‚ฎ G
  • Error specs consist of an error automaton for the

environment and one for the system

  • For each word: an error value for environment and for

system

  • Specify
  • How you interpret incorrect input?
  • How to continue with output
  • Typical choices for input:
  • ignore input
  • reset
  • treat like similar input
slide-81
SLIDE 81

Swen Jacobs VTSA 2013 82

Robustness

Robustness = recovery from error

  • We call a system robust if
  • Finite environment error implies finite system error

g1g2 g1g2 g1g2 ๏ž g1g2 g1g2 r1r2 r1 r2 ๏ƒš r1r2 r1r2 r1r2 r2 r1 r1 r1 ๏ƒš M1 M2

  • Cf. two arbiters
slide-82
SLIDE 82

Swen Jacobs VTSA 2013 83

Refining the Idea โ€“ Quantitative Specs

Spec is of the form A ๏‚ฎ G

  • A are assumptions on

environment

  • G are guarantees of system

Idea: take ratio of system errors to environment errors

  • Airplanes: ratio of excess

planes to excess response time

  • Arbiter: ratio of double

requests to missed requests

0,2 0,4 0,6 0,8 1 1,2 1,4 4 8 12 16 20 24 28 32 36 40 44 48 52 56

Response time

Arbiter

r0, r1 g0, g1

slide-83
SLIDE 83

Swen Jacobs VTSA 2013 84

Ratios

System is k-robust if For every environment error, there are at most k system errors (in the limit) ๏€คd: sys-err = k ๏ƒ— env-err + d

env-err sys-err

d

slide-84
SLIDE 84

Swen Jacobs VTSA 2013 85

Robustness โ€“ Wrap-up

Questions:

  • how to specify robustness (graceful degradation)
  • how to check robustness
  • how to synthesize robust systems

One solution:

  • User defines costs for โ€œnon-standardโ€ behavior
  • Value of a words: mean payoff automaton
  • Value of a system: minimium value of its words
  • Combining values: addition or lexicographic
  • Robustness means that system can only make finitely

many errors if the system does

  • k-robustness means that the ration between system faults

and environment faults is at most k.

slide-85
SLIDE 85

Swen Jacobs VTSA 2013 86

Concluding - Synthesis

  • Synthesis: Applying game theory to real problems
  • Solving games
  • Constructing efficient strategies/implementations
  • Distributed and parameterized cases
  • Specification
  • influences complexity, expressibility, ease of use
  • Quantitative measures may help
slide-86
SLIDE 86

Thanks for your interest and patience.

slide-87
SLIDE 87

Bibliography

[VMCAI12] B. Finkbeiner, S. Jacobs: Lazy Synthesis. VMCAI 12. [PnueliRosner90] A. Pnueli, R. Rosner: Distributed Reactive Systems are Hard to

  • Synthesize. FOCS 90.

[FinkbeinerSchewe05] B. Finkbeiner, S. Schewe: Uniform Distributed Synthesis. LICS 05. [TACAS12] S. Jacobs, R. Bloem: Parameterized Synthesis. TACAS 12. [VMCAI13] A. Khalimov, S. Jacobs, R. Bloem: Towards Efficient Parameterized

  • Synthesis. VMCAI 13.

[EmersonNamjoshi95] E. Emerson, K. Namjoshi: Reasoning about Rings. POPL 95. [EhrenfeuchtMycielski79] A. Ehrenfeucht, J. Mycielski: Positional Strategies for Mean Payoff Games. IJGT 79. [ChatterjeeHenzingerJurdzinski05] K. Chatterjee, T. Henzinger, M. Jurdzinski: Mean- Payoff Parity Games. LICS 05. [BloemChatterjeeHenzingerJobstmann09] R. Bloem, K. Chatterjee, T. Henzinger, B. Jobstmann: Better quality in synthesis through quantitative objectives. CAV 09. [GhezziJazayeriMandrioli91] C. Ghezzi, M. Jazayeri, D. Mandrioli: Software qualities and principles.