Ramadge - Wonham 87 → Control problem (Exact) Given a system S (with accepting states) and a specification K ⊆ Σ ∗ , does there exist a controller C such that L ( C ⊗ S ) = K ? Theorem ◮ ( S, Pref( K )) is controllable iff Pref( K ) · Σ uc ∩ Pref( L ( S )) ⊆ Pref( K ) . ◮ ( S, K ) is controllable without deadlock iff ◮ Pref( K ) · Σ uc ∩ Pref( L ( S )) ⊆ Pref( K ) ◮ Pref( K ) ∩ L ( S ) = K . ◮ If S is finite state and K regular then the control problem is decidable. When ( S, K ) is controllable, we can synthesize a finite state controller. Other results ◮ control under partial observation ◮ maximal controllable sub-specification ◮ generalization to infinite behaviors (Thistle - Wonham) ◮ . . . 9 / 65
Synthesis of reactive programs Pnueli-Rosner 89 y x ◮ Q x : domain for input variable x ◮ Q y : domain for output variable y ◮ Program: f : Q + x → Q y ◮ Input: x 1 x 2 · · · ∈ Q ω x . ◮ Behavior: ( x 1 , y 1 )( x 2 , y 2 )( x 3 , y 3 ) · · · with y n = f 1 ( x 1 · · · x n ) for all n > 0 . Implementability problem ◮ Given a linear time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that all f -behaviors satisfy ϕ ? ◮ Given a branching time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that its run-tree satisfies ϕ ? 10 / 65
Synthesis of reactive programs Pnueli-Rosner 89 y x ◮ Q x : domain for input variable x ◮ Q y : domain for output variable y ◮ Program: f : Q + x → Q y ◮ Input: x 1 x 2 · · · ∈ Q ω x . ◮ Behavior: ( x 1 , y 1 )( x 2 , y 2 )( x 3 , y 3 ) · · · with y n = f 1 ( x 1 · · · x n ) for all n > 0 . Implementability problem ◮ Given a linear time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that all f -behaviors satisfy ϕ ? ◮ Given a branching time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that its run-tree satisfies ϕ ? 10 / 65
Synthesis of reactive programs Pnueli-Rosner 89 y x ◮ Q x : domain for input variable x ◮ Q y : domain for output variable y ◮ Program: f : Q + x → Q y ◮ Input: x 1 x 2 · · · ∈ Q ω x . ◮ Behavior: ( x 1 , y 1 )( x 2 , y 2 )( x 3 , y 3 ) · · · with y n = f 1 ( x 1 · · · x n ) for all n > 0 . Implementability problem ◮ Given a linear time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that all f -behaviors satisfy ϕ ? ◮ Given a branching time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that its run-tree satisfies ϕ ? 10 / 65
Synthesis of reactive programs Implementability problem Given a linear time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that all f -behaviors satisfy ϕ ? Implementability � = Satisfiability ◮ Q x = { 0 , 1 } and ϕ = F ( x = 1) ◮ ϕ is satisfiable: (1 , 0) ω | = ϕ ◮ ϕ is not implementable since the input is not controllable. Implementability � = Validity of ∀ � x ∃ � y ϕ ◮ Q x = Q y = { 0 , 1 } and ϕ = ( y = 1) ← → F ( x = 1) ◮ ∀ � x ∃ � y ϕ is valid. ◮ ϕ is not implementable by a reactive program. For non-reactive terminating programs, Implementability = Validity of ∀ � x ∃ � y ϕ 11 / 65
Synthesis of reactive programs Implementability problem Given a linear time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that all f -behaviors satisfy ϕ ? Implementability � = Satisfiability ◮ Q x = { 0 , 1 } and ϕ = F ( x = 1) ◮ ϕ is satisfiable: (1 , 0) ω | = ϕ ◮ ϕ is not implementable since the input is not controllable. Implementability � = Validity of ∀ � x ∃ � y ϕ ◮ Q x = Q y = { 0 , 1 } and ϕ = ( y = 1) ← → F ( x = 1) ◮ ∀ � x ∃ � y ϕ is valid. ◮ ϕ is not implementable by a reactive program. For non-reactive terminating programs, Implementability = Validity of ∀ � x ∃ � y ϕ 11 / 65
Synthesis of reactive programs Implementability problem Given a linear time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that all f -behaviors satisfy ϕ ? Implementability � = Satisfiability ◮ Q x = { 0 , 1 } and ϕ = F ( x = 1) ◮ ϕ is satisfiable: (1 , 0) ω | = ϕ ◮ ϕ is not implementable since the input is not controllable. Implementability � = Validity of ∀ � x ∃ � y ϕ ◮ Q x = Q y = { 0 , 1 } and ϕ = ( y = 1) ← → F ( x = 1) ◮ ∀ � x ∃ � y ϕ is valid. ◮ ϕ is not implementable by a reactive program. For non-reactive terminating programs, Implementability = Validity of ∀ � x ∃ � y ϕ 11 / 65
Synthesis of reactive programs Implementability problem Given a linear time specification ϕ over the alphabet Σ = Q x × Q y , Does there exist a program f such that all f -behaviors satisfy ϕ ? Theorem (Pnueli-Rosner 89) ◮ The specification ϕ ∈ LTL is implementable iff the formula � A ϕ ∧ AG ( EX ( x = a )) a ∈ Q x is satisfiable. ◮ When ϕ is implementable, we can construct a finite state implementation (program) in time doubly exponential in ϕ . 12 / 65
Program synthesis versus System control Equivalence The implementability problem for y x is equivalent to the control problem for the system Q x Q y 13 / 65
Outline Control for sequential systems Control for distributed systems 2 Synchronous semantics Asynchronous semantics 14 / 65
Distributed control inputs from E outputs to E Open distributed system S S 1 S 2 Specification ϕ S 3 S 4 Two problems, again ◮ Decide whether there exists a distributed controller st. ( S 1 ⊗ C 1 ) � · · · � ( S n ⊗ C n ) � E | = ϕ . ◮ Synthesis: If so, compute such a distributed controller. Peterson-Reif 1979, Pnueli-Rosner 1990 In general, the problems are undecidable. 15 / 65
Distributed control inputs from E outputs to E Controlled open distributed system S Open distributed system S Open distributed system S C 1 S 1 S 2 C 2 Specification ϕ C 3 S 3 S 4 C 4 Two problems, again ◮ Decide whether there exists a distributed controller st. ( S 1 ⊗ C 1 ) � · · · � ( S n ⊗ C n ) � E | = ϕ . ◮ Synthesis: If so, compute such a distributed controller. Peterson-Reif 1979, Pnueli-Rosner 1990 In general, the problems are undecidable. 15 / 65
Architectures with shared variables Architecture A = ( P , V , R, W ) ◮ P finite set of processes/agents. ◮ V finite set of Variables. ◮ R ⊆ P × V : ( a, x ) ∈ R iff a reads x . ◮ R ( a ) variables read by process a ∈ P , ◮ R − 1 ( x ) processes reading variable x ∈ V . ◮ W ⊆ P × V : ( a, x ) ∈ W iff a writes to x . ◮ W ( a ) variables written by process a ∈ P , ◮ W − 1 ( x ) processes writing to variable x ∈ V . Example a 1 x 1 a 4 x 4 x 0 x 3 a 2 x 2 a 3 x 5 16 / 65
Distributed systems with shared variables Distributed system/plant/arena ◮ A = ( P , V , R, W ) architecture. ◮ Q x (finite) domain for each variable x ∈ V . ◮ δ a ⊆ Q R ( a ) × Q W ( a ) legal actions/moves for process/player a ∈ P . ◮ q 0 ∈ Q V initial state where Q I = � x ∈ I Q x for I ⊆ V . 17 / 65
Distributed Synthesis Problem Given a distributed system and a specification Problem existence/synthesis of programs/strategies for the processes/players such that the system satisfies the specification (whatever the environment/opponent does). Main parameters ◮ Which subclass of architectures? ◮ Which semantics? synchronous (with our without delay), asynchronous ◮ What kind of specification? LTL, CLT ∗ , µ -calculus Rational, Recognizable word/tree ◮ What kind of memory for the programs? memoryless, local memory, causal memory finite or infinite memory 18 / 65
Distributed Synthesis Problem Given a distributed system and a specification Problem existence/synthesis of programs/strategies for the processes/players such that the system satisfies the specification (whatever the environment/opponent does). Main parameters ◮ Which subclass of architectures? ◮ Which semantics? synchronous (with our without delay), asynchronous ◮ What kind of specification? LTL, CLT ∗ , µ -calculus Rational, Recognizable word/tree ◮ What kind of memory for the programs? memoryless, local memory, causal memory finite or infinite memory 18 / 65
Distributed Synthesis Problem Given a distributed system and a specification Problem existence/synthesis of programs/strategies for the processes/players such that the system satisfies the specification (whatever the environment/opponent does). Main parameters ◮ Which subclass of architectures? ◮ Which semantics? synchronous (with our without delay), asynchronous ◮ What kind of specification? LTL, CLT ∗ , µ -calculus Rational, Recognizable word/tree ◮ What kind of memory for the programs? memoryless, local memory, causal memory finite or infinite memory 18 / 65
Distributed Synthesis Problem Given a distributed system and a specification Problem existence/synthesis of programs/strategies for the processes/players such that the system satisfies the specification (whatever the environment/opponent does). Main parameters ◮ Which subclass of architectures? ◮ Which semantics? synchronous (with our without delay), asynchronous ◮ What kind of specification? LTL, CLT ∗ , µ -calculus Rational, Recognizable word/tree ◮ What kind of memory for the programs? memoryless, local memory, causal memory finite or infinite memory 18 / 65
Distributed Synthesis Problem Given a distributed system and a specification Problem existence/synthesis of programs/strategies for the processes/players such that the system satisfies the specification (whatever the environment/opponent does). Main parameters ◮ Which subclass of architectures? ◮ Which semantics? synchronous (with our without delay), asynchronous ◮ What kind of specification? LTL, CLT ∗ , µ -calculus Rational, Recognizable word/tree ◮ What kind of memory for the programs? memoryless, local memory, causal memory finite or infinite memory 18 / 65
Outline Control for sequential systems Control for distributed systems Synchronous semantics 3 Asynchronous semantics 19 / 65
Pnueli-Rosner (FOCS’90) Pipeline a 1 y 1 a 2 y 2 a 3 y 3 a 4 x z 1 z 2 z 3 z 4 Restrictions ◮ Unique writer: | W − 1 ( x ) | = 1 for all x ∈ V ◮ Unique reader: | R − 1 ( x ) | = 1 for all x ∈ V ◮ Acyclic graph (0-delay) ◮ No restrictions on moves: δ a = Q R ( a ) × Q W ( a ) for all a ∈ P . ◮ Synchronous behaviors: q 0 q 1 q 2 · · · where q n ∈ Q V are global states. ◮ program with local memory: f a : Q ∗ R ( a ) → Q W ( a ) for all a ∈ P . ◮ Specification: LTL over input and output variables only. ◮ Input variables: In = W (environment) ◮ output variables: Out = R (environment) 20 / 65
0-delay synchronous semantics Example u a x v z b u → Q x and f z : ( Q x × Q v ) ∗ → Q z . Programs: f x : Q ∗ � � · · · u 1 u 2 u 3 ◮ Input: ∈ ( Q u × Q v ) ω . · · · v 1 v 2 v 3 · · · u 1 u 2 u 3 · · · v 1 v 2 v 3 ◮ Behavior: · · · x 1 x 2 x 3 · · · z 1 z 2 z 3 � x n = f x ( u 1 · · · u n ) with for all n > 0 . z n = f z (( x 1 , v 1 ) · · · ( x n , v n )) 21 / 65
Undecidability Architecture A 0 u v a b y x Theorem (Pnueli-Rosner FOCS’90) The synthesis problem for architecture A 0 and LTL (or CTL) specifications is unde- cidable. Proof Reduction from the halting problem on the empty tape. 22 / 65
Undecidability proof 1 SPEC 1 : processes a and b must output configurations 0 q 1 p 0 · · · u v : n ( v ) = p a b y # q + p C # ω : where C ∈ Γ ∗ Q Γ + x � � v = 1 ∧ ( v = 1 ∧ y = #) W ( v = 0 ∧ y ∈ Γ ∗ Q Γ + # ω ) ( v = 0 ∧ y = #) W where � �� � def y ∈ Γ ∗ Q Γ + # ω = y ∈ Γ U y ∈ Q ∧ X y ∈ Γ U ( y ∈ Γ ∧ X G y = #) 23 / 65
Undecidability proof 1 SPEC 1 : processes a and b must output configurations 0 q 1 p 0 · · · u v : n ( v ) = p a b y # q + p C # ω : where C ∈ Γ ∗ Q Γ + x � � v = 1 ∧ ( v = 1 ∧ y = #) W ( v = 0 ∧ y ∈ Γ ∗ Q Γ + # ω ) ( v = 0 ∧ y = #) W where � �� � def y ∈ Γ ∗ Q Γ + # ω = y ∈ Γ U y ∈ Q ∧ X y ∈ Γ U ( y ∈ Γ ∧ X G y = #) 23 / 65
Undecidability proof 2 SPEC 2 : processes a and b must start with the first configuration 0 q 10 · · · : n ( v ) = 1 u v a b y x # q +1 C 1 # ω � → y ∈ C 1 # ω �� � v = 0 W v = 1 ∧ X v = 0 − 24 / 65
Undecidability proof 2 SPEC 2 : processes a and b must start with the first configuration 0 q 10 · · · : n ( v ) = 1 u v a b y x # q +1 C 1 # ω � → y ∈ C 1 # ω �� � v = 0 W v = 1 ∧ X v = 0 − 24 / 65
Undecidability proof 3 SPEC 3 : if n ( u ) = n ( v ) are synchronized then x = y 0 q 1 p 0 · · · u v 0 q 1 p 0 · · · a b # q + p C # ω y # q + p C # ω x n ( u ) = n ( v ) − → G ( x = y ) where def n ( u ) = n ( v ) = ( u = v = 0) U ( u = v = 1 ∧ ( u = v = 1 U u = v = 0)) 25 / 65
Undecidability proof 3 SPEC 3 : if n ( u ) = n ( v ) are synchronized then x = y 0 q 1 p 0 · · · u v 0 q 1 p 0 · · · a b # q + p C # ω y # q + p C # ω x n ( u ) = n ( v ) − → G ( x = y ) where def n ( u ) = n ( v ) = ( u = v = 0) U ( u = v = 1 ∧ ( u = v = 1 U u = v = 0)) 25 / 65
Undecidability proof 4 SPEC 4 : if n ( u ) = n ( v ) + 1 are synchronized then C y ⊢ C x 0 q 1 p +1 0 · · · u v 0 q +1 1 p 0 · · · a b # q + p +1 C x # ω y # q + p +1 C y # ω x � � Trans( y, x ) ∧ X 3 G x = y n ( u ) = n ( v ) + 1 − → x = y U where Trans( y, x ) is defined by � � ( y = cpa ∧ x = qcb ) ∨ ( y = pac ∧ x = bqc ) ( p,a,q,b, ← ) ∈ T,c ∈ Γ ( p,a,q,b, → ) ∈ T,c ∈ Γ � ∨ ( y = pa # ∧ x = bq ✷ ) ( p,a,q,b, → ) ∈ T 26 / 65
Undecidability proof 4 SPEC 4 : if n ( u ) = n ( v ) + 1 are synchronized then C y ⊢ C x 0 q 1 p +1 0 · · · u v 0 q +1 1 p 0 · · · a b # q + p +1 C x # ω y # q + p +1 C y # ω x � � Trans( y, x ) ∧ X 3 G x = y n ( u ) = n ( v ) + 1 − → x = y U where Trans( y, x ) is defined by � � ( y = cpa ∧ x = qcb ) ∨ ( y = pac ∧ x = bqc ) ( p,a,q,b, ← ) ∈ T,c ∈ Γ ( p,a,q,b, → ) ∈ T,c ∈ Γ � ∨ ( y = pa # ∧ x = bq ✷ ) ( p,a,q,b, → ) ∈ T 26 / 65
Undecidability proof 5 Lemma: winning strategies must simulate the Turing machine For each p ≥ 1 , if n ( u ) = p then C x = C p is the p -th configuration of the Turing machine starting from the empty tape. Proof u v a b y x Corollary Specifications 1-4 and 5: G x � = stop are implementable iff the Turing machine does not halt starting from the empty tape. 27 / 65
Undecidability proof 5 Lemma: winning strategies must simulate the Turing machine For each p ≥ 1 , if n ( u ) = p then C x = C p is the p -th configuration of the Turing machine starting from the empty tape. Proof 0 q 10 · · · u v SPEC 2 a b # q +1 C 1 # ω y x Corollary Specifications 1-4 and 5: G x � = stop are implementable iff the Turing machine does not halt starting from the empty tape. 27 / 65
Undecidability proof 5 Lemma: winning strategies must simulate the Turing machine For each p ≥ 1 , if n ( u ) = p then C x = C p is the p -th configuration of the Turing machine starting from the empty tape. Proof 0 q +1 1 p 0 · · · u v a Induction b # q + p +1 C p # ω y x Corollary Specifications 1-4 and 5: G x � = stop are implementable iff the Turing machine does not halt starting from the empty tape. 27 / 65
Undecidability proof 5 Lemma: winning strategies must simulate the Turing machine For each p ≥ 1 , if n ( u ) = p then C x = C p is the p -th configuration of the Turing machine starting from the empty tape. Proof 0 q +1 1 p 0 · · · u v 0 q +1 1 p 0 · · · a SPEC 3 Induction b # q + p +1 C p # ω # q + p +1 C p # ω y x Corollary Specifications 1-4 and 5: G x � = stop are implementable iff the Turing machine does not halt starting from the empty tape. 27 / 65
Undecidability proof 5 Lemma: winning strategies must simulate the Turing machine For each p ≥ 1 , if n ( u ) = p then C x = C p is the p -th configuration of the Turing machine starting from the empty tape. Proof 0 q 1 p +1 0 · · · u v 0 q +1 1 p 0 · · · SPEC 4 a SPEC 3 b # q + p +1 C p +1 # ω # q + p +1 C p # ω y x Corollary Specifications 1-4 and 5: G x � = stop are implementable iff the Turing machine does not halt starting from the empty tape. 27 / 65
Undecidability proof 5 Lemma: winning strategies must simulate the Turing machine For each p ≥ 1 , if n ( u ) = p then C x = C p is the p -th configuration of the Turing machine starting from the empty tape. Proof 0 q 1 p +1 0 · · · u v 0 q +1 1 p 0 · · · SPEC 4 a SPEC 3 b # q + p +1 C p +1 # ω # q + p +1 C p # ω y x Corollary Specifications 1-4 and 5: G x � = stop are implementable iff the Turing machine does not halt starting from the empty tape. 27 / 65
Communication allows to cheat Architecture with communication u v a z b y x ◮ Strategy for a : ◮ copy u to z ( # p + q C 1 # ω if p = 1 (for SPEC 2 ) ◮ if u = 0 q 1 p 0 · · · then x = # p + q C 2 # ω othewise (for SPEC 4 ). ◮ Strategy for b : if z = 0 q ′ 1 p ′ 0 · · · and v = 0 q 1 p 0 · · · then # p + q C 1 # ω if p = 1 (for SPEC 2 ) if p = p ′ > 1 and q = q ′ (for SPEC 3 ) # p + q C 2 # ω y = # p + q C 1 # ω othewise (for SPEC 4 ). 28 / 65
More undecidable architectures Exercices 1. Show that the architecture below is undecidable. u w v a z b y x 2. Show that the undecidability results also hold for CTL specifications 29 / 65
Uncomparable information Definition For an output variable y , View ( y ) is the set of input variables x such that there is a path from x to y . Definition An architecture has uncomparable information if there exist y 1 , y 2 output variables such that View ( y 2 ) \ View ( y 1 ) � = ∅ and View ( y 1 ) \ View ( y 2 ) � = ∅ . Otherwise it is said to have preordered information. x 1 x 2 y 1 y 2 30 / 65
Uncomparable information Definition For an output variable y , View ( y ) is the set of input variables x such that there is a path from x to y . Definition An architecture has uncomparable information if there exist y 1 , y 2 output variables such that View ( y 2 ) \ View ( y 1 ) � = ∅ and View ( y 1 ) \ View ( y 2 ) � = ∅ . Otherwise it is said to have preordered information. x 1 x 2 x 3 x 4 y 1 y 2 y 3 y 4 30 / 65
Uncomparable information Definition For an output variable y , View ( y ) is the set of input variables x such that there is a path from x to y . Definition An architecture has uncomparable information if there exist y 1 , y 2 output variables such that View ( y 2 ) \ View ( y 1 ) � = ∅ and View ( y 1 ) \ View ( y 2 ) � = ∅ . Otherwise it is said to have preordered information. x 1 x 2 x 3 x 4 y 1 y 2 y 3 y 4 30 / 65
Uncomparable information Definition For an output variable y , View ( y ) is the set of input variables x such that there is a path from x to y . Definition An architecture has uncomparable information if there exist y 1 , y 2 output variables such that View ( y 2 ) \ View ( y 1 ) � = ∅ and View ( y 1 ) \ View ( y 2 ) � = ∅ . Otherwise it is said to have preordered information. x 1 x 2 x 3 x 4 y 1 y 2 y 3 y 4 30 / 65
Uncomparable information Definition For an output variable y , View ( y ) is the set of input variables x such that there is a path from x to y . Definition An architecture has uncomparable information if there exist y 1 , y 2 output variables such that View ( y 2 ) \ View ( y 1 ) � = ∅ and View ( y 1 ) \ View ( y 2 ) � = ∅ . Otherwise it is said to have preordered information. x 1 x 2 x 3 x 4 y 1 y 2 y 3 y 4 30 / 65
Uncomparable information yields undecidability Theorem Architectures with uncomparable information are undecidable for LTL or CTL input- output specifications. Proof for LTL specifications x 0 x 1 x 0 x 1 y 0 y 1 y 0 y 1 31 / 65
Uncomparable information yields undecidability Theorem Architectures with uncomparable information are undecidable for LTL or CTL input- output specifications. Proof for LTL specifications x 0 x 1 x 0 x 1 y 0 y 1 y 0 y 1 31 / 65
Uncomparable information yields undecidability Theorem Architectures with uncomparable information are undecidable for LTL or CTL input- output specifications. Proof for LTL specifications x 0 x 1 0 0 0 0 0 0 0 0 x 0 x 1 y 0 y 1 y 0 y 1 31 / 65
Decidability Pipeline a 1 y 1 a 2 y 2 a 3 y 3 a 4 x z 1 z 2 z 3 z 4 Pnueli-Rosner (FOCS’90) The synthesis problem for pipeline architectures and LTL specifications is non ele- mentary decidable. 32 / 65
Decidability proof 1 Pipeline y y x a z x a & b b z From distributed to global If f y : Q + x → Q y and f z : Q + y → Q z are local (distributed) strategies then we can define an equivalent global strategy h = f y ⊗ f z : Q + x → Q y × Q z by h ( x 1 · · · x n ) = ( y n , f z ( y 1 · · · y n )) where y i = f y ( x 1 , · · · , x i ) . From global to distributed z should only depend on y . We cannot transmit x to y if | Q y | < | Q x | . We have to check whether there exists a global strategy that can be distributed. 33 / 65
Decidability proof 1 Pipeline y y x a z x a & b b z From distributed to global If f y : Q + x → Q y and f z : Q + y → Q z are local (distributed) strategies then we can define an equivalent global strategy h = f y ⊗ f z : Q + x → Q y × Q z by h ( x 1 · · · x n ) = ( y n , f z ( y 1 · · · y n )) where y i = f y ( x 1 , · · · , x i ) . From global to distributed z should only depend on y . We cannot transmit x to y if | Q y | < | Q x | . We have to check whether there exists a global strategy that can be distributed. 33 / 65
Decidability proof 1 Pipeline y y x a z x a & b b z From distributed to global If f y : Q + x → Q y and f z : Q + y → Q z are local (distributed) strategies then we can define an equivalent global strategy h = f y ⊗ f z : Q + x → Q y × Q z by h ( x 1 · · · x n ) = ( y n , f z ( y 1 · · · y n )) where y i = f y ( x 1 , · · · , x i ) . From global to distributed z should only depend on y . We cannot transmit x to y if | Q y | < | Q x | . We have to check whether there exists a global strategy that can be distributed. 33 / 65
Decidability proof 2 Pipeline y y x a z x b a & b z Proof 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 34 / 65
Decidability proof 2 Pipeline y y x a z x b a & b z Proof 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 34 / 65
Tree automata non deterministic transitions a 1 2 a 1 a 2 Alternating transitions or 35 / 65
Tree automata non deterministic transitions p a 1 2 a 1 a 2 p 1 p 2 Alternating transitions or 35 / 65
Tree automata non deterministic transitions p a 1 2 a 1 a 2 p 1 p 2 Alternating transitions a 1 2 a 1 a 2 or 35 / 65
Tree automata non deterministic transitions p a 1 2 a 1 a 2 p 1 p 2 Alternating transitions p a 1 2 a 1 a 2 p 1 p 2 ∧ p 3 or 35 / 65
Tree automata non deterministic transitions p a 1 2 a 1 a 2 p 1 p 2 Alternating transitions p p a a 1 2 1 2 2 a 1 a 2 a 1 a 2 a 2 p 1 p 1 p 2 p 3 p 2 ∧ p 3 or 35 / 65
Decidability proof 3 Proof y y x a z x b a & b z 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 36 / 65
Decidability proof 3 Proof y y x a z x b a & b z 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A x A p ( y, z ) x 1 x 3 x 2 ( y 1 , z 1 ) ( y 2 , z 2 ) ( y 2 , z 2 ) p 1 p 2 p 3 36 / 65
Decidability proof 3 Proof y y x a z x b a & b z 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A y x A A ′ p ( y, z ) ( x, p ) z x 1 x 3 y 1 y 2 x 2 y 2 ( y 1 , z 1 ) ( y 2 , z 2 ) ( y 2 , z 2 ) z 1 z 2 z 2 p 1 p 2 p 3 ( x 1 , p 1 ) ( x 2 , p 2 ) ( x 3 , p 3 ) 36 / 65
Decidability proof 4 Proof y 1 y 2 y 3 x a 1 a 2 a 3 a 4 z 1 z 2 z 3 z 4 A ′ alternating 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 3. Transform the alternating TA A ′ to an equivalent non determinisitic TA A 1 (Muller and Schupp 1985). Exponential blow-up. 4. Iterate and check the last automaton for emptiness. 37 / 65
Decidability proof 4 Proof y 1 y 2 y 3 x a 1 a 2 a 3 a 4 z 1 z 2 z 3 z 4 A ′ alternating 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 3. Transform the alternating TA A ′ to an equivalent non determinisitic TA A 1 (Muller and Schupp 1985). Exponential blow-up. 4. Iterate and check the last automaton for emptiness. 37 / 65
Decidability proof 4 Proof y 1 y 2 y 3 x a 1 a 2 a 3 a 4 z 1 z 2 z 3 z 4 A 1 non deterministic 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 3. Transform the alternating TA A ′ to an equivalent non determinisitic TA A 1 (Muller and Schupp 1985). Exponential blow-up. 4. Iterate and check the last automaton for emptiness. 37 / 65
Decidability proof 4 Proof y 1 y 2 y 3 x a 1 a 2 a 3 a 4 z 1 z 2 z 3 z 4 A ′ 1 alternating 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 3. Transform the alternating TA A ′ to an equivalent non determinisitic TA A 1 (Muller and Schupp 1985). Exponential blow-up. 4. Iterate and check the last automaton for emptiness. 37 / 65
Decidability proof 4 Proof y 1 y 2 y 3 x a 1 a 2 a 3 a 4 z 1 z 2 z 3 z 4 A 2 non deterministic 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 3. Transform the alternating TA A ′ to an equivalent non determinisitic TA A 1 (Muller and Schupp 1985). Exponential blow-up. 4. Iterate and check the last automaton for emptiness. 37 / 65
Decidability proof 4 Proof y 1 y 2 y 3 x a 1 a 2 a 3 a 4 z 1 z 2 z 3 z 4 A ′ 2 alternating 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 3. Transform the alternating TA A ′ to an equivalent non determinisitic TA A 1 (Muller and Schupp 1985). Exponential blow-up. 4. Iterate and check the last automaton for emptiness. 37 / 65
Decidability proof 4 Proof y 1 y 2 y 3 x a 1 a 2 a 3 a 4 z 1 z 2 z 3 z 4 A 3 non deterministic 1. We first solve the global game: We obtain an ND tree-automaton A accepting the global strategies h : Q + x → Q y × Q z that implement the specification. Easily obtained from a ND tree automaton for the specification. 2. We build from A an alternating tree automaton A ′ accepting a local strategy f z : Q + y → Q z iff there exists a local strategy f y : Q + x → Q y such that h = f y ⊗ f z : Q + x → Q y × Q z is accepted by A 3. Transform the alternating TA A ′ to an equivalent non determinisitic TA A 1 (Muller and Schupp 1985). Exponential blow-up. 4. Iterate and check the last automaton for emptiness. 37 / 65
Decidability Pipeline a 1 y 1 a 2 y 2 a 3 y 3 a 4 x z 1 z 2 z 3 z 4 Pnueli-Rosner (FOCS’90) The synthesis problem for pipeline architectures and LTL specifications is non ele- mentary decidable. Peterson-Reif (FOCS’79) multi-person games with incomplete information. = ⇒ non-elementary lower bound for the synthesis problem. 38 / 65
Decidability Kupferman-Vardi (LICS’01) The synthesis problem is non elementary decidable for ◮ one-way chain, one-way ring, two-way chain and two-way ring, ◮ CTL ∗ specifications (or tree-automata specifications) on all variables, ◮ synchronous, 1-delay semantics, ◮ local strategies. one-way chain a 1 y 1 a 2 y 2 a 3 y 3 x z 1 z 2 z 3 39 / 65
Decidability Kupferman-Vardi (LICS’01) The synthesis problem is non elementary decidable for ◮ one-way chain, one-way ring, two-way chain and two-way ring, ◮ CTL ∗ specifications (or tree-automata specifications) on all variables, ◮ synchronous, 1-delay semantics, ◮ local strategies. one-way ring a 1 y 1 a 2 y 2 a 3 y 3 x z 1 z 2 z 3 39 / 65
Decidability Kupferman-Vardi (LICS’01) The synthesis problem is non elementary decidable for ◮ one-way chain, one-way ring, two-way chain and two-way ring, ◮ CTL ∗ specifications (or tree-automata specifications) on all variables, ◮ synchronous, 1-delay semantics, ◮ local strategies. two-way chain y 1 y 2 y 3 a 1 a 2 a 3 a 4 x y ′ y ′ y ′ 1 2 3 z 1 z 2 z 3 z 4 39 / 65
1-delay synchronous semantics Example u a x v z b u → Q x and f z : ( Q x × Q v ) ∗ → Q z . Programs: f x : Q ∗ � � · · · u 1 u 2 u 3 ◮ Input: ∈ ( Q u × Q v ) ω . · · · v 1 v 2 v 3 · · · u 1 u 2 u 3 · · · v 1 v 2 v 3 ◮ Behavior: · · · x 1 x 2 x 3 · · · z 1 z 2 z 3 � x n +1 = f x ( u 1 · · · u n ) with for all n > 0 . z n +1 = f z (( x 1 , v 1 ) · · · ( x n , v n )) 40 / 65
Decidability Adequately connected sub-architecture Q x = Q for all x ∈ V y u b a x v c z Pnueli-Rosner (FOCS’90) ◮ An adequately connected architecture is equivalent to a singleton architecture. ◮ The synthesis problem is decidable for LTL specifications and pipelines of adequately connected architectures. 41 / 65
Decidability Adequately connected sub-architecture Q x = Q for all x ∈ V y u b a x x = u ⊗ v v c z Pnueli-Rosner (FOCS’90) ◮ An adequately connected architecture is equivalent to a singleton architecture. ◮ The synthesis problem is decidable for LTL specifications and pipelines of adequately connected architectures. 41 / 65
Decidability Adequately connected sub-architecture Q x = Q for all x ∈ V y y u u b a x x = u ⊗ v v c z v z Pnueli-Rosner (FOCS’90) ◮ An adequately connected architecture is equivalent to a singleton architecture. ◮ The synthesis problem is decidable for LTL specifications and pipelines of adequately connected architectures. 41 / 65
Decidability Adequately connected sub-architecture Q x = Q for all x ∈ V y y u u b a x x = u ⊗ v v c z v z Pnueli-Rosner (FOCS’90) ◮ An adequately connected architecture is equivalent to a singleton architecture. ◮ The synthesis problem is decidable for LTL specifications and pipelines of adequately connected architectures. 41 / 65
Information fork criterion (Finkbeiner–Schewe LICS ’05) u v p x 0 x 1 a b y 0 y 1 q w 42 / 65
Information fork criterion (Finkbeiner–Schewe LICS ’05) u v p x 0 x 1 a b y 0 y 1 q w 42 / 65
Information fork criterion (Finkbeiner–Schewe LICS ’05) u v p x 0 x 1 a b y 0 y 1 q w 42 / 65
Uniformly well connected architectures Definition An architecture is uniformly well connected if there is a uniform way to route variables in View ( y ) to y for each output variable y . Example u v w p p s t p p p y x z 43 / 65
Uniformly well connected architectures Definition An architecture is uniformly well connected if there is a uniform way to route variables in View ( y ) to y for each output variable y . Example u v w p p s t u ⊕ v v ⊕ w p p p y x z 43 / 65
Uniformly well connected architectures Definition An architecture is uniformly well connected if there is a uniform way to route variables in View ( v ) to v for each output variable v . ◮ If the capacity of internal variables is big enough then the architecture is uniformly well-connected. ◮ If the architecture is uniformly well-connected then we can use causal strategies instead of local ones. Proposition Checking whether a given architecture is uniformly well connected is NP-complete. Proof Reduction to the multicast problem in Network Information Flow. The multicast problem is NP-complete (Rasala Lehman-Lehman 2004). 44 / 65
Uniformly well connected architectures Definition An architecture is uniformly well connected if there is a uniform way to route variables in View ( v ) to v for each output variable v . ◮ If the capacity of internal variables is big enough then the architecture is uniformly well-connected. ◮ If the architecture is uniformly well-connected then we can use causal strategies instead of local ones. Proposition Checking whether a given architecture is uniformly well connected is NP-complete. Proof Reduction to the multicast problem in Network Information Flow. The multicast problem is NP-complete (Rasala Lehman-Lehman 2004). 44 / 65
Uniformly well connected architectures Theorem (PG, Nathalie Sznajder, Marc Zeitoun) Uniformly well connected architectures with preordered information are decidable for CTL* external specifications. Proof. x 1 x 2 x 3 x 4 y 1 y 2 y 3 y 4 Theorem: Kupferman-Vardi (LICS’01) The synthesis problem is decidable for pipeline architectures and CTL ∗ specifications on all variables. 45 / 65
Recommend
More recommend
