Not Quite There Yet: The Quest for the Right Environment Player Model in Games for Reactive Synthesis R¨ udiger Ehlers University of Bremen Dagstuhl Seminar 17111, March 2017 Using joint preliminary work done together with Roderick Bloem, Robert K¨ onighofer, and Rupak Majumdar 1
Synthesis of reactive systems Input Realizable Specification ⇒ + Input = { u , . . . } Not realizable Output Output = { v , . . . } 2
Games for synthesis G ( r → X g ) Specification 3
Games for synthesis r ∧ g ¬ r r q 0 q 1 start ¬ r ∧ g ¬ g q 2 tt Automaton G ( r → X g ) Specification 3
Games for synthesis r ∧ g ¬ r ¬ r * r r * r q 0 q 1 start q 0 q 1 start g ¬ r ¬ r ∧ g g ¬ g ¬ g ¬ g ∗ q 2 q 2 tt ∗ Automaton Game / Tree automaton G ( r → X g ) Specification 3
Games for synthesis r ∧ g ¬ r ¬ r * r r * r q 0 q 1 start q 0 q 1 start g ¬ r ¬ r ∧ g g ¬ g ¬ g ¬ g ∗ q 2 q 2 tt ∗ Automaton Game / Tree automaton g ¬ r r g r q 0 q 1 start g | = G ( r → X g ) ¬ r g Strategy / Mealy automaton Specification 3
Assumptions and guarantees in specifications Specification shape �� �� � � Assumptions → Guarantees 4
Demo 5
So what happened? Observation Requiring the system player to satisfy ( � Assumptions ) → ( � Guarantees ) leads to an incentive for the system player to actively work against ( � Assumptions ) . 6
So what happened? Observation Requiring the system player to satisfy ( � Assumptions ) → ( � Guarantees ) leads to an incentive for the system player to actively work against ( � Assumptions ) . Modifying the specification to exclude specific exploitive behavior would be a rat-race against the synthesis tool (and hence is no option). 6
So what happened? Observation Requiring the system player to satisfy ( � Assumptions ) → ( � Guarantees ) leads to an incentive for the system player to actively work against ( � Assumptions ) . Modifying the specification to exclude specific exploitive behavior would be a rat-race against the synthesis tool (and hence is no option). To obtain reasonable implementations in a game-based synthesis process, we need a winning condition for the system player that prevents her from trying to actively falsify A 6
So what happened? Observation Requiring the system player to satisfy ( � Assumptions ) → ( � Guarantees ) leads to an incentive for the system player to actively work against ( � Assumptions ) . Modifying the specification to exclude specific exploitive behavior would be a rat-race against the synthesis tool (and hence is no option). To obtain reasonable implementations in a game-based synthesis process, we need a winning condition for the system player that prevents her from trying to actively falsify A Note In well-separated specifications (Klein and Pnueli, 2010), this problem does not occur. 6
Alternative winning conditions Classification criteria T reat the two players in a symmetric fashion A ssume rationality of the environment player Criteria / game types Thanks go to Brenguier et al. (2017) for their excellent overview. 7
Alternative winning conditions Classification criteria T reat the two players in a symmetric fashion A ssume rationality of the environment player Criteria / game types Assume-Guarantee Synthesis (Chatterjee and Henzinger, 1 2007) T , A Thanks go to Brenguier et al. (2017) for their excellent overview. 7
Alternative winning conditions Classification criteria T reat the two players in a symmetric fashion A ssume rationality of the environment player Criteria / game types Assume-Guarantee Synthesis (Chatterjee and Henzinger, 1 2007) T , A Rational Synthesis (Fisman et al., 2010) T , A 2 Thanks go to Brenguier et al. (2017) for their excellent overview. 7
Alternative winning conditions Classification criteria T reat the two players in a symmetric fashion A ssume rationality of the environment player Criteria / game types Assume-Guarantee Synthesis (Chatterjee and Henzinger, 1 2007) T , A Rational Synthesis (Fisman et al., 2010) T , A 2 Assume-Admissible Synthesis (Brenguier et al., 2017) T , A 3 Thanks go to Brenguier et al. (2017) for their excellent overview. 7
But are T and A realistic to assume? Reactive system environment components Other technical systems: Only an approximation of their behavior is known Behavior can appear to be irrational due to unmodelled goals/behavior 8
But are T and A realistic to assume? Reactive system environment components Other technical systems: Only an approximation of their behavior is known Behavior can appear to be irrational due to unmodelled goals/behavior Human operators and “noise”: May not have a goal at all and/or completely unknown goal. Yet, obstructing the human is to be avoided 8
But are T and A realistic to assume? Reactive system environment components Other technical systems: Only an approximation of their behavior is known Behavior can appear to be irrational due to unmodelled goals/behavior Human operators and “noise”: May not have a goal at all and/or completely unknown goal. Yet, obstructing the human is to be avoided Mixture of human operator and technical system The answer to the question in the slide title... ...is “ usually not ”. 8
Partial solution: Cooperative synthesis Basic idea (Bloem et al., 2015) For a specification ψ = A → G , we synthesize a controller that satisfies ψ along all of its traces, and 1 for every prefix trace t in the controller language that can be 2 extended to a word that satisfies A , there exists a trace extension t ′ such that tt ′ is a trace of the controller and tt ′ | = A . 9
Partial solution: Cooperative synthesis Basic idea (Bloem et al., 2015) For a specification ψ = A → G , we synthesize a controller that satisfies ψ along all of its traces, and 1 for every prefix trace t in the controller language that can be 2 extended to a word that satisfies A , there exists a trace extension t ′ such that tt ′ is a trace of the controller and tt ′ | = A . Effect A → G is satisfied along all traces (classical corretness) The environment assumptions A are never fully violated – the environment always has a chance to work towards A ∧ G .. 9
Potential problems with the partial solution The environment may be too weak Problem: How should the environment know what to play in order to enforce A ? 10
Potential problems with the partial solution The environment may be too weak Problem: How should the environment know what to play in order to enforce A ? However: In practice, this is most likely not a big deal (due to the structure of the game solving/synthesis algorithms). 10
Potential problems with the partial solution The environment may be too weak Problem: How should the environment know what to play in order to enforce A ? However: In practice, this is most likely not a big deal (due to the structure of the game solving/synthesis algorithms). The environment may be too strong Problem: The environment may be able to enforce a showdown . Consequence: The specification becomes unrealizable . 10
Showdown – Explanatory example ↑↓ ↑↓ Specification Assumptions: Wagon behaves according to its dynamics and visits both blue regions infinitely often (while standing still) Guarantees: Goods are transported between the blue regions 11
Showdown – Explanatory example ↑↓ ↑↓ Observation The environment can get itself into a situation in which it cannot satisfy the assumption made about it any more. 11
Showdown – Explanatory example ↑↓ ↑↓ Observation The environment can get itself into a situation in which it cannot satisfy the assumption made about it any more. No problem for classical A → G and cooperative synthesis 11
Showdown – Explanatory example ↑↓ ↑↓ Thought Experiment (1) Let us assume that the system has the capability to slow down the wagon. 11
Showdown – Explanatory example ↑↓ ↑↓ Thought Experiment (1) Let us assume that the system has the capability to slow down the wagon. The system then has to slow down the wagon (if the slow-down mechanism is accounted for in the system dynamics that are part of the assumptions) 11
Showdown – Explanatory example ↑↓ ↑↓ Thought Experiment (2) Now let us furthermore assume that the wagon transports raw eggs, which break when force-slowing down the wagon 11
Showdown – Explanatory example ↑↓ ↑↓ Thought Experiment (2) Now let us furthermore assume that the wagon transports raw eggs, which break when force-slowing down the wagon Effect: The specification becomes unrealizable 11
So what happened? Analysis For every prefix trace in the controller that can be extended to one that satisfies A , the controller needs to offer one that satisfies A Thus, then the wagon speeds towards the cliff, the controller needs to stop the wagon (as the environment assumption can still be satisfied) By stopping the wagon, the raw eggs break. So if the environment speeds towards the edge every time the eggs have been loaded, eggs break during every delivery → hence, the system player loses. Observation But that is unreasonable: if the environment strategizes against the system, the system should not need to satisfy the guarantees. 12
Recommend
More recommend
