SLIDE 1 Strategy Synthesis for Linear Arithmetic Games
Azadeh Farzan1 Zachary Kincaid2
1University of Toronto 2Princeton University
January 12, 2018
SLIDE 2 Many problems in formal methods can be formulated as logical games.
- Functional synthesis
- inputs,
- utput s.t. specification holds
- Reactive synthesis
- event ,
response s.t. avoid bad state and event , response s.t. avoid bad state and
This paper: Algorithms for synthesizing winning strategies for satisfiability and reachability games in the theory of linear arithmetic.
SLIDE 3 Many problems in formal methods can be formulated as logical games.
- Functional synthesis
- ∀ inputs, ∃ output s.t. specification holds
- Reactive synthesis
- event ,
response s.t. avoid bad state and event , response s.t. avoid bad state and
This paper: Algorithms for synthesizing winning strategies for satisfiability and reachability games in the theory of linear arithmetic.
SLIDE 4 Many problems in formal methods can be formulated as logical games.
- Functional synthesis
- ∀ inputs, ∃ output s.t. specification holds
- Reactive synthesis
- ∀ event1, ∃ response1 s.t. avoid bad state and
∀ event2, ∃ response2 s.t. avoid bad state and · · ·
This paper: Algorithms for synthesizing winning strategies for satisfiability and reachability games in the theory of linear arithmetic.
SLIDE 5 Many problems in formal methods can be formulated as logical games.
- Functional synthesis
- ∀ inputs, ∃ output s.t. specification holds
- Reactive synthesis
- ∀ event1, ∃ response1 s.t. avoid bad state and
∀ event2, ∃ response2 s.t. avoid bad state and · · ·
This paper: Algorithms for synthesizing winning strategies for satisfiability and reachability games in the theory of linear arithmetic.
SLIDE 6
Satisfjability games
SLIDE 7 Game interpretation
ϕ ≜ ∃w.∀x.∃y.∀z.
(y < 1 ∨ 2w < y) ∧ (z < y ∨ x < z)
- matrix
- Two players: SAT and UNSAT
- SAT wants to make the formula true
- UNSAT wants to make the formula false
- A play of this game: SAT and UNSAT take turns picking elements of
. w x y z The SAT player wins if the corresponding structure is a model of the matrix.
SAT has a winning strategy
SLIDE 8 Game interpretation
ϕ ≜ ∃w.∀x.∃y.∀z.
(y < 1 ∨ 2w < y) ∧ (z < y ∨ x < z)
- matrix
- Two players: SAT and UNSAT
- SAT wants to make the formula true
- UNSAT wants to make the formula false
- A play of this game: SAT and UNSAT take turns picking elements of Q.
[ w x y z ] The SAT player wins if the corresponding structure is a model of the matrix.
SAT has a winning strategy
SLIDE 9 Game interpretation
ϕ ≜ ∃w.∀x.∃y.∀z.
(y < 1 ∨ 2w < y) ∧ (z < y ∨ x < z)
- matrix
- Two players: SAT and UNSAT
- SAT wants to make the formula true
- UNSAT wants to make the formula false
- A play of this game: SAT and UNSAT take turns picking elements of Q.
[w → 1; x y z ] The SAT player wins if the corresponding structure is a model of the matrix.
SAT has a winning strategy
SLIDE 10 Game interpretation
ϕ ≜ ∃w.∀x.∃y.∀z.
(y < 1 ∨ 2w < y) ∧ (z < y ∨ x < z)
- matrix
- Two players: SAT and UNSAT
- SAT wants to make the formula true
- UNSAT wants to make the formula false
- A play of this game: SAT and UNSAT take turns picking elements of Q.
[w → 1; x → 2 3; y z ] The SAT player wins if the corresponding structure is a model of the matrix.
SAT has a winning strategy
SLIDE 11 Game interpretation
ϕ ≜ ∃w.∀x.∃y.∀z.
(y < 1 ∨ 2w < y) ∧ (z < y ∨ x < z)
- matrix
- Two players: SAT and UNSAT
- SAT wants to make the formula true
- UNSAT wants to make the formula false
- A play of this game: SAT and UNSAT take turns picking elements of Q.
[w → 1; x → 2 3; y → −1; z ] The SAT player wins if the corresponding structure is a model of the matrix.
SAT has a winning strategy
SLIDE 12 Game interpretation
ϕ ≜ ∃w.∀x.∃y.∀z.
(y < 1 ∨ 2w < y) ∧ (z < y ∨ x < z)
- matrix
- Two players: SAT and UNSAT
- SAT wants to make the formula true
- UNSAT wants to make the formula false
- A play of this game: SAT and UNSAT take turns picking elements of Q.
[w → 1; x → 2 3; y → −1; z → 1] The SAT player wins if the corresponding structure is a model of the matrix.
SAT has a winning strategy
SLIDE 13 Game interpretation
ϕ ≜ ∃w.∀x.∃y.∀z.
(y < 1 ∨ 2w < y) ∧ (z < y ∨ x < z)
- matrix
- Two players: SAT and UNSAT
- SAT wants to make the formula true
- UNSAT wants to make the formula false
- A play of this game: SAT and UNSAT take turns picking elements of Q.
[w → 1; x → 2 3; y → −1; z → 1] The SAT player wins if the corresponding structure is a model of the matrix.
SAT has a winning strategy
SLIDE 14 Game interpretation
ϕ ≜ ∃w.∀x.∃y.∀z.
(y < 1 ∨ 2w < y) ∧ (z < y ∨ x < z)
- matrix
- Two players: SAT and UNSAT
- SAT wants to make the formula true
- UNSAT wants to make the formula false
- A play of this game: SAT and UNSAT take turns picking elements of Q.
[w → 1; x → 2 3; y → −1; z → 1] The SAT player wins if the corresponding structure is a model of the matrix.
⇒ SAT has a winning strategy
SLIDE 15 ∀x.∀y.∃lub. lub ≥ x ∧ lub ≥ y
∧ [∀ub.(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub]
Winning strategy: lub x y if x y then x else y
SLIDE 16
∀x.∀y.∃lub.∀ub.lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub] Winning strategy: lub x y if x y then x else y
SLIDE 17
∀x.∀y.∃lub.∀ub.lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub] Winning strategy: lub(x, y) = if x ≥ y then x else y
SLIDE 18
SimSat: SAT via mutual strategy improvement
[Farzan & Kincaid, IJCAI 2016]
S0 U beats S beats U beats Sn X beats Un X beats improves improves
SLIDE 19
SimSat: SAT via mutual strategy improvement
[Farzan & Kincaid, IJCAI 2016]
S0 U1 beats S beats U beats Sn X beats Un X beats improves improves
SLIDE 20
SimSat: SAT via mutual strategy improvement
[Farzan & Kincaid, IJCAI 2016]
S0 U1 beats S1 beats U beats Sn X beats Un X beats improves improves
SLIDE 21
SimSat: SAT via mutual strategy improvement
[Farzan & Kincaid, IJCAI 2016]
S0 U1 beats S1 beats U2
· · ·
beats Sn X beats Un X beats improves improves
SLIDE 22
SimSat: SAT via mutual strategy improvement
[Farzan & Kincaid, IJCAI 2016]
S0 U1 beats S1 beats U2
· · ·
beats Sn X beats Un X beats improves improves
SLIDE 23
SimSat: SAT via mutual strategy improvement
[Farzan & Kincaid, IJCAI 2016]
S0 U1 beats S1 beats U2
· · ·
beats Sn X beats Un X beats improves improves
SLIDE 24
SimSat: SAT via mutual strategy improvement
[Farzan & Kincaid, IJCAI 2016]
S0 U1 beats S1 beats U2
· · ·
beats Sn X beats Un X beats improves improves
SLIDE 25 Strategy skeletons
∀x.∀y.∃lub.∀ub.lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub] ∀x ∀y ∃lub ∀ub x
y
y ≥ x
improves
SLIDE 26 Strategy skeletons
∀x.∀y.∃lub.∀ub.lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub] ∀x ∀y ∃lub ∀ub x
y
y y x
improves
SLIDE 27 Strategy skeletons
∀x.∀y.∃lub.∀ub.lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub] ∀x ∀y ∃lub ∀ub
y
y y x
improves
SLIDE 28 From skeletons to strategies
∀x.∀y.∃lub.∀ub.lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub]
y
y
x ≤ 0
?
SLIDE 29 Tree interpolation (special case)
Given tree with leaves labeled by formulas s.t. the conjunction of all labels is inconsistent: n1 n2 n3 n4 n5 n6 n7 F4 F5 F6 F7 F F F We can find labels for internal nodes s.t.:
- label of root is false
- For all nodes ni
Fi
- conjunction of children’s labels implies Fi
- Fi uses only symbols common to descendents & non-descendents
SLIDE 30 Tree interpolation (special case)
Given tree with leaves labeled by formulas s.t. the conjunction of all labels is inconsistent: n1 n2 n3 n4 n5 n6 n7 F4 F5 F6 F7 F2 F3 F1 We can find labels for internal nodes s.t.:
- label of root is false
- For all nodes ni
Fi
- conjunction of children’s labels implies Fi
- Fi uses only symbols common to descendents & non-descendents
SLIDE 31 Tree interpolation (special case)
Given tree with leaves labeled by formulas s.t. the conjunction of all labels is inconsistent: n1 n2 n3 n4 n5 n6 n7 F4 F5 F6 F7 F2 F3 F1 We can find labels for internal nodes s.t.:
- label of root is false
- For all nodes ni
Fi
- conjunction of children’s labels implies Fi
- Fi uses only symbols common to descendents & non-descendents
SLIDE 32 Tree interpolation (special case)
Given tree with leaves labeled by formulas s.t. the conjunction of all labels is inconsistent: n1 n2 n3 n4 n5 n6 n7 F4 F5 F6 F7 F2 F3 F1 We can find labels for internal nodes s.t.:
- label of root is false
- For all nodes ni : Fi
- conjunction of children’s labels implies Fi
- Fi uses only symbols common to descendents & non-descendents
SLIDE 33 Tree interpolation (special case)
Given tree with leaves labeled by formulas s.t. the conjunction of all labels is inconsistent: n1 n2 n3 n4 n5 n6 n7 F4 F5 F6 F7 F2 F3 F1 We can find labels for internal nodes s.t.:
- label of root is false
- For all nodes ni : Fi
- conjunction of children’s labels implies Fi
- Fi uses only symbols common to descendents & non-descendents
SLIDE 34 Strategy synthesis
∀x.∀y.∃lub.∀ub. lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub]
∀x ∀y ∃lub ∀ub
y
F x y x ub x y y x false false
SLIDE 35 Strategy synthesis
∀x.∀y.∃lub.∀ub. lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub]
∀x ∀y ∃lub ∀ub x y x y ub1 ub2 F x y x ub F x y x ub x y y x false false
SLIDE 36 Strategy synthesis
∀x.∀y.∃lub.∀ub. lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub]
∀x ∀y ∃lub ∀ub x y x y ub1 ub2 ¬F(x, y, x, ub1) ¬F(x, y, x, ub1) x y y x false false
SLIDE 37 Strategy synthesis
∀x.∀y.∃lub.∀ub. lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub]
∀x ∀y ∃lub ∀ub x y x y ub1 ub2 ¬F(x, y, x, ub1) ¬F(x, y, x, ub1) x < y y < x false false
SLIDE 38 Strategy synthesis
∀x.∀y.∃lub.∀ub. lub ≥ x ∧ lub ≥ y ∧ [(ub ≥ x ∧ ub ≥ y) = ⇒ ub ≥ lub]
∀x ∀y ∃lub ∀ub
y
y ≥ x ¬F(x, y, x, ub1) ¬F(x, y, x, ub1) x < y y < x false false
SLIDE 39
Experiments
Name Alchemist-CSDT CVC4-1.5.1 SIMSYNTH max15 Timeout 3.3s Timeout array_search15 Timeout 0.1s 3.0s array_sum8_15 Timeout 0.0s 0.3s tenfunc2 0.0s 0.1s 0.1s polynomial4 0.0s 21.0s 0.0s hms Timeout Timeout 0.0s scaleweights Timeout 0.1s 0.3s lub10 Timeout 38.1s 4.0s inverse10 Timeout Timeout 2.4s round10 Error Timeout 8.8s puzzle35 Timeout Timeout 0.1s puzzle35_opt Timeout Unknown 0.2s
SLIDE 40
Reachability games
SLIDE 41 Definition A reachability game of dimension d consists of three formulas:
- init(x1, ..., xd): initial game state (chosen by REACH)
- reach(x1, ..., xd, x′
1, ..., x′ d): moves of REACH
1, ..., x′ d): moves of SAFE
REACH and SAFE alternate picking positions in Qd r1 s1 r2 s2 · · ·
safe(r1, s1) reach(s1, r1) safe(r2, s2)
init(r1) First player to make an illegal move loses.
SLIDE 42 Definition A reachability game of dimension d consists of three formulas:
- init(x1, ..., xd): initial game state (chosen by REACH)
- reach(x1, ..., xd, x′
1, ..., x′ d): moves of REACH
1, ..., x′ d): moves of SAFE
REACH and SAFE alternate picking positions in Qd r1 s1 r2 s2 · · ·
safe(r1, s1) reach(s1, r1) safe(r2, s2)
init(r1) First player to make an illegal move loses.
SLIDE 43
Cinderella-Stepmother
b1 b2 b3 b5 b4 capacity = 3
SLIDE 44
Cinderella-Stepmother
b1 b2 b3 b5 b4 capacity = 3
SLIDE 45
Cinderella-Stepmother
b1 b2 b3 b5 b4 capacity = 3
SLIDE 46
Cinderella-Stepmother
b1 b2 b3 b5 b4 capacity = 3
SLIDE 47 Formalizing Cinderella-Stepmother
init ≜ ( 5 ∑
i=1
bi = 1 ) ∧
5
∧
i=1
bi ≥ 0 reach ≜
5
∑
i=1
b′
i = 1 +
( 5 ∑
i=1
bi ) ∧
5
∧
i=1
b′
i ≥ bi
safe ≜ ¬overflow ∧ ∨ emptyi where
( 5 ∨
i=1
bi > 3 ) emptyi ≜ b′
i, b′ i+1, b′ i+2, b′ i+3, b′ i+4 = 0, 0, bi+2, bi+3, bi+4
SLIDE 48
Safety trees
n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 n5: b ≤ 2, 2, 1, 3, 3 n6: b ≤ 2, 2, 3, 3, 1 n9: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n10: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 n11: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n12: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ true : ⟨0, 0, b3, b4, b5⟩ b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ true : ⟨b1, b2, b3, 0, 0⟩ true : ⟨0, 0, b3, b4, b5⟩ true : ⟨b1, b2, 0, 0, b5⟩ true : ⟨0, 0, b3, b4, b5⟩
SLIDE 49
Safety trees
n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 n5: b ≤ 2, 2, 1, 3, 3 n6: b ≤ 2, 2, 3, 3, 1 n9: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n10: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 n11: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n12: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ true : ⟨0, 0, b3, b4, b5⟩ b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ true : ⟨b1, b2, b3, 0, 0⟩ true : ⟨0, 0, b3, b4, b5⟩ true : ⟨b1, b2, 0, 0, b5⟩ true : ⟨0, 0, b3, b4, b5⟩ Annotation: set of positions the game could be in
SLIDE 50
Safety trees
n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 n5: b ≤ 2, 2, 1, 3, 3 n6: b ≤ 2, 2, 3, 3, 1 n9: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n10: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 n11: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n12: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ true : ⟨0, 0, b3, b4, b5⟩ b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ true : ⟨b1, b2, b3, 0, 0⟩ true : ⟨0, 0, b3, b4, b5⟩ true : ⟨b1, b2, 0, 0, b5⟩ true : ⟨0, 0, b3, b4, b5⟩ Annotation: set of positions the game could be in Move: next position Guard: condition under which to make the move
SLIDE 51
n1: true ∀b0.init(b0) ⇒ ∃b1.safe(b0, b1) n : n : true true b b b b init b safe b b b b b reach b b b b b safe b b n : true b b b n : true true b b b n : true b b b n : true true b b b b b b b b b n : n : b b b b b b b b n : true true b b b n : true true b b b n : n : true b b b true b b b n : true b b b n : true b b b
SLIDE 52
n : true b init b b safe b b n1: b ≤ 3, 3, 3, 3, 3 n2: true true : ⟨0, 0, b3, b4, b5⟩ ∀b0.init(b0) ⇒ (safe(b0, 00b3b4b5) ∧ ∀b1.reach(00b3b4b5, b1)∃b2.safe(b1, b2) n : true b b b n : true true b b b n : true b b b n : true true b b b b b b b b b n : n : b b b b b b b b n : true true b b b n : true true b b b n : n : true b b b true b b b n : true b b b n : true b b b
SLIDE 53
n : true b init b b safe b b n1: b ≤ 3, 3, 2, 2, 2 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 3, 3, 3 true : ⟨0, 0, b3, b4, b5⟩ n3: true true : ⟨0, 0, b3, b4, b5⟩ n : true b b b n : true true b b b b b b b b b n : n : b b b b b b b b n : true true b b b n : true true b b b n : n : true b b b true b b b n : true b b b n : true b b b
SLIDE 54
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 3, 3, 3, 3, 3 true : ⟨0, 0, b3, b4, b5⟩ n4: true true : ⟨0, 0, b3, b4, b5⟩ b b b b b b n : n : b b b b b b b b n : true true b b b n : true true b b b n : n : true b b b true b b b n : true b b b n : true b b b
SLIDE 55
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 3, 3, 3, 3, 3 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b ∀b0.∀b1.∀b2.∃b4.∀b5.∃b6 n : n : b b b b b b b b n : true true b b b n : true true b b b n : n : true b b b true b b b n : true b b b n : true b b b
SLIDE 56
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b b b b b b b n5: b ≤ 3, 3, 3, 3, 3 n6: b ≤ 3, 3, 3, 3, 3 b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ n7: true true : ⟨0, 0, b3, b4, b5⟩ n8: true true : ⟨0, 0, b3, b4, b5⟩ n : n : true b b b true b b b n : true b b b n : true b b b
SLIDE 57
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b b b b b b b n5: b ≤ 3, 3, 3, 3, 3 n6: b ≤ 3, 3, 3, 3, 3 b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ n : true true b b b n8: true true : ⟨0, 0, b3, b4, b5⟩ n : n : true b b b true b b b n : true b b b n : true b b b
SLIDE 58
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b b b b b b b n5: b ≤ 2, 2, 2, 3, 3 n6: b ≤ 3, 3, 3, 3, 3 b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ n : true true b b b n8: true true : ⟨0, 0, b3, b4, b5⟩ n9: b ≤ 3, 3, 3, 3, 3 n10: true true : ⟨b1, b2, b3, 0, 0⟩ true : ⟨0, 0, b3, b4, b5⟩ n : true b b b n : true b b b
SLIDE 59
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b b b b b b b n5: b ≤ 2, 2, 1, 3, 3 n6: b ≤ 3, 3, 3, 3, 3 b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ n : true true b b b n8: true true : ⟨0, 0, b3, b4, b5⟩ n9: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n10: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨b1, b2, b3, 0, 0⟩ true : ⟨0, 0, b3, b4, b5⟩ n : true b b b n : true b b b
SLIDE 60
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b b b b b b b n5: b ≤ 2, 2, 1, 3, 3 n6: b ≤ 3, 3, 3, 3, 3 b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ n : true true b b b n : true true b b b n9: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n10: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨b1, b2, b3, 0, 0⟩ true : ⟨0, 0, b3, b4, b5⟩ n : true b b b n : true b b b
SLIDE 61
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b b b b b b b n5: b ≤ 2, 2, 1, 3, 3 n6: b ≤ 2, 2, 3, 3, 2 b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ n : true true b b b n : true true b b b n9: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n10: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨b1, b2, b3, 0, 0⟩ true : ⟨0, 0, b3, b4, b5⟩ n11: b ≤ 3, 3, 3, 3, 3 true : ⟨b1, b2, 0, 0, b5⟩ n12: true true : ⟨0, 0, b3, b4, b5⟩
SLIDE 62
n : true b init b b safe b b n1: b ≤ 3, 3, 1, 1, 1 ∧ (b3 + b5) ≤ 1 n : true true b b b b init b safe b b b b b reach b b b b b safe b b n2: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b n3: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨0, 0, b3, b4, b5⟩ n : true true b b b b b b b b b n5: b ≤ 2, 2, 1, 3, 3 n6: b ≤ 2, 2, 3, 3, 2 b5 ≤ 2 : ⟨b1, b2, 0, 0, b5⟩ b3 ≤ 2 : ⟨b1, b2, b3, 0, 0⟩ n : true true b b b n : true true b b b n9: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 n10: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 3 true : ⟨b1, b2, b3, 0, 0⟩ true : ⟨0, 0, b3, b4, b5⟩ n11: b ≤ 3, 3, 2, 2, 2 ∧ (b3 + b5) ≤ 2 true : ⟨b1, b2, 0, 0, b5⟩ n12: b ≤ 1, 1, 3, 3, 3 ∧ (b3 + b5) ≤ 2 true : ⟨0, 0, b3, b4, b5⟩
SLIDE 63
Cinderella-Stepmother
Capacity Winner Time c=3 Cinderella 2.2s c=2.5 Cinderella 53.8s c=2 Cinderella 68.9s c=1.8 — Timeout c=1.7 Stepmother 2.5s c=1.6 Stepmother 1.5s c=1.5 Stepmother 1.4s c=1.4 Stepmother 0.2s
SLIDE 64
Cinderella-Stepmother
Capacity Winner Time c=3 Cinderella 2.2s c=2.5 Cinderella 53.8s c=2 Cinderella 68.9s c=1.8 — Timeout c=1.7 Stepmother 2.5s c=1.6 Stepmother 1.5s c=1.5 Stepmother 1.4s c=1.4 Stepmother 0.2s
“the problem becomes more challenging for 1.5 ≤ c < 3 …in such cases fully automated strategy synthesis seems unrealistic, and computer-assisted proofs driven by user-provided hints or templates are more plausible.”
– Beyene, Chaudhuri, Popeea & Rybalchenko; POPL’14
SLIDE 65 Summary
- Complete procedure for satisfiability games
- Extends LRA decision procedure to strategy synthesis
- Semi-algorithm for reachability games
- Synthesize strategies for bounded games, then generalize
- Complete for finite REACH strategies
