Save this PDF as:

Size: px
Start display at page:

Transcription

1 From Verication to Control: Dynamic Programs for Omega-regular Objectives y Luca de Alfaro Thomas A. Henzinger Rupak Majumdar Electrical Engineering and Computer Sciences, University of California, Berkeley Abstract. Dynamic programs, or xpoint iteration schemes, are useful for solving many problems on state spaces, including model checking on Kripke structures (\verication"), computing shortest paths on weighted graphs (\optimization"), computing the value of games played on game graphs (\control"). For Kripke structures, a rich xpoint theory is available in the form of the -calculus. Yet few connections have been made between dierent interpretations of xpoint algorithms. We study the question of when a particular xpoint iteration scheme ' for verifying an!-regular property on a Kripke structure can be used also for solving a two-player game on a game graph with winning objective. We provide a sucient and necessary criterion for the answer to be armative in the form of an extremal-model theorem for games: under a game interpretation, the dynamic program ' solves the game with objective ifand only if both (1) under an existential interpretation on Kripke structures, ' is equivalent to9, and (2) under a universal interpretation on Kripke structures, ' is equivalent to 8. In other words, ' is correct on all two-player game graphs i it is correct on all extremal game graphs, where one or the other player has no choice of moves. The theorem generalizes to quantitative interpretations, where it connects two-player games with costs to weighted graphs. While the standard translations from!-regular properties to the -calculus violate (1) or (2), we give a translation that satises both conditions. Our construction, therefore, yields xpoint iteration schemes that can be uniformly applied on Kripke structures, weighted graphs, game graphs, and game graphs with costs, in order to meet or optimize a given!-regular objective. 1 Introduction If is a property of a Kripke structure, then every -calculus formula ' that is equivalent to prescribes an algorithm for model checking. This is because the -calculus formula ' can be computed by iterative xpointapproximation. Indeed, the -calculus has been called the \assembly language" for model checking. In control, we are given a two-player game structure and an objective, and we wish to nd out if player 1 (the \controller") has a strategy such that for all strategies of player 2 (the \plant") This researchwas supported in part by the DARPA SEC grant F33615-C , the MARCO SRC grant 98-DT-660, the AFOSR MURI grant F , the NSF Theory grant CCR , and the NSF ITR grant CCR y An abbreviated version of this paper will appear in the Proceedings of the 16th Annual IEEE Symposium on Logic in Computer Science (LICS),

2 the outcome of the game meets the objective. If the outcome of a game is an innite sequence of states, then objectives are naturally specied as!-regular properties [15]. A simple but important objective is the reachability property 3T, for a set T of states, which asserts that player 1 wins if it can direct the game into the target set T, while player 2 wins if it can prevent the game from entering T forever. We write hh1ii3t for the reachability game with target T for player 1. A dynamic program for solving the reachability game can be viewed as evaluating a xpoint equation, namely, hh1ii3t = x:(t _ 1Pre(x)) where 1Pre(T ) is the set of states from which player 1 can force the game into T in a single step. It is not dicult to see that this xpoint equation is identical to the -calculus expression for model checking the reachability property 93T, namely, 93T = x:(t _ EPre(x)) (1) except for the use of the predecessor operator EPre in place of 1Pre, where EPre(T ) is the set of states that have a successor in T. For every!-regular property, it is well-known how to construct an equivalent -calculus formula ' [7, 4], which can then be used to model check 9, i.e., to compute the set of states from which there is a path satisfying. Now suppose we want to solve the control problem with objective. The question we set out to answer in this paper is whether ' is of any use for this purpose more specically, if we simply replace all EPre operators in ' by 1Pre operators, do we obtain an algorithm for solving the game with objective, i.e., for computing the set of states from which player 1 can ensure that holds? In general, the answer is negative. Consider the co-buchi property 32T, which asserts that, eventually, the target T is reached and never left again. The Emerson-Lei translation [7] yields the equivalent -calculus formula The Dam translation [4] gives 932T = x:(epre(x) _ (y:epre(y) ^ T )): (2) 932T = x:(epre(x) _ (T ^ EPre(y:(T ^ EPre(y))))) (3) and Bhat-Cleaveland [2] produce the same result. But neither of these formulas give the correct solution for games. To seethis, consider the following game on the state space fs 1 s 2 s 3 g. At s 1, player 2 can playtwomoves: one of them keeps the game in s 1, the other takes the game to s 2. At s 2, player 1 can playtwo moves: one of them keeps the game in s 2, the other takesthegametos 3. Once in s 3, the game remains in s 3 forever. The target set is T = fs 1 s 3 g. Then, hh1ii32t = fs 1 s 2 s 3 g. However, both equations (2) and (3) denote the smaller set fs 2 s 3 g when EPre is replaced by 1Pre. We present an extremal-model theorem which says that the xpoint formula ' over 1Pre solves the game with!-regular objective if and only if both of the following conditions are met: E The EPre version of ' is equivalent to the existential property 9. A The APre version of ' is equivalent to the universal property 8. (Here, APre(T ) is the set of states all of whose successors lie in T,and8 holds at a state if all paths from the state satisfy.) 2

3 In other words, for a xpoint formula ' to solve the game with!-regular objective, it is not only necessary but also sucient that ' coincides with under the two extremal, non-game interpretations. In the co-buchi example, while the expressions (2) and (3) satisfy condition E of the extremal-model theorem, they violate condition A. Bycontrast, in the reachability example, the expression (1) meets also condition A, because 83T = x:(t _ APre(x)): We show constructively that for every!-regular objective there is indeed a xpoint formula ' which meets both conditions of the extremal-model theorem. The construction is based on the determinization of!-automata [12, 13], and on the translation from alternating!-automata to -calculus [5]. In particular, for the co-buchi property we obtain The reader may check that both hh1ii32t = x:y:(1pre(x) _ (1Pre(y) ^ T )): (4) = x:y:(epre(x) _ (EPre(y) ^ T )) 932T 832T = x:y:(apre(x) _ (APre(y) ^ T )): In general, our translation provides optimal algorithms for solving games with!-regular objectives in particular, if the objective is given by a formula of linear temporal logic, then the resulting algorithm has a 2EXPTIME complexity in the length of [11]. Our results also shed light on a related question: given a \verication" -calculus formula ' v that uses only the predecessor operator EPre, what is the relation between ' v and its \control" version ' c, obtained by replacing EPre with 1Pre? From [6] we know that if ' v is deterministic, i.e., if every conjunction in ' v has at least one constant argument, then ' v species an!-regular language that is, ' v is equivalent to9 for some!-regular property. We introduce the syntactic class of strongly deterministic -calculus formulas, a subclass of the deterministic formulas, and we show that if ' v is strongly deterministic, then ' v solves the verication problem for specication 9 i' c solves the control problem for objective.this correspondence does not hold in general for deterministic formulas. We extend the connection between verication and control also to quantitative properties. Consider a graph with nonnegative edge weights, which represent costs. By dening an appropriate quantitative predecessor operator PreR, the dynamic program for reachability, x:(t _ PreR(x)), computes the cost of the shortest path to the target T. Similarly, consider a game whose moves incur costs. Then again, for a suitable quantitative predecessor operator 1Pre R, the dynamic program x:(t _ 1PreR(x)) computes the real value of the game, which is dened as the minimal cost for player 1 to reach the target T (or innity, if player 1 has no strategy to reach T ). For general!-regular objectives, we dene the cost of the innite outcome of a game as the cost of the shortest (possibly nite) prex that is a witness to the objective. We show that the extremal-model theorem applies to this quantitative setting also. This gives us dynamic programs for solving the real-valued games with respect to all!-regular objectives. For example, equation (4) with 1Pre replaced by 1Pre R species a dynamic program for the quantitative co-buchi game, whose value is the minimal cost for player 1 to reach and stay inside the target T (this cost is innite unless player 1 can enforce an innite sequence of moves all but nitely many of which have cost 0). 2 Reachability and Safety We dene our setting, and in doing so, review some well-known results about iterative solutions for simple verication, optimization, and control problems, where the objective is to reach or avoid a 3

4 1Pre B 2Pre B EPre B APre B (f)(s) = (f)(s) = 9a 2 ;1 (s):8b 2 ; 2 (s) :f((s a b)) (5) 9b 2 ; 2 (s):8a 2 ; 1 (s) 9a 2 ;1 (s):9b 2 ; 2 (s) :f((s a b)) (6) 8a 2 ; 1 (s):8b 2 ; 2 (s) Figure 1: Boolean game and transition predecessor operators given set of states (expending minimal cost). 2.1 ame structures We dene game structures over a global set A of actions, and a global set P of propositions. A (two-player) game structure =(S ; 1 ; 2 hi) (over A and P ) consists of a nite set S of states, two action assignments ; 1 ; 2 : S! 2 A n which dene for each state two nonempty, nite sets of actions available to player 1 and player 2, respectively, a transition function : S A A! S which associates with each state s and each pair of actions a 2 ; 1 (s) and b 2 ; 2 (s) a successor state, a weight function w: S A A! R 0 which associates with each state s and each pair of actions a 2 ; 1 (s) and b 2 ; 2 (s) a nonnegative real, and a proposition assignment hi: S! 2 P which denes for each states a nite set hsi P of propositions that are true in s. Intuitively, at state s, player 1 chooses an action a from ; 1 (s) and, simultaneously and independently, player 2 chooses an action b from ; 2 (s). Then, the game proceeds to the successor state (s a b). The nonnegative real w(s a b) represents the \cost" of the transition (s a b) (if it is to be minimized), or a \reward" (if it is to be maximized). iven a proposition p 2 P, a state s 2 S is called a p-state i p 2 hsi. If S is not given explicitly, then we write S to denote the state space of the game structure. ame structures are \concurrent" [1] they subsume \turn-based" game structures (i.e., and-or graphs), where in each state at most one of the two players has a choice of actions. A special case of turn-based games are the one-player structures. A one-player structure is either a player-1 structure or a player-2 structure. The game structure is a player-1 structure if ; 2 (s) is a singleton for all states s 2 S and is a player-2 structure if ; 1 (s) is a singleton for all s 2 S. In player-1 structures, player 2 has no choices, and in player-2 structures, player 1 has no choices. Every game structure denes an underlying transition structure K =(S! hi), where for all states s t 2 S, we have s! t i there exist actions a 2 ; 1 (s) and b 2 ; 2 (S) such that (s a b) = t. Transition structures do not distinguish between individual players. Restrictions of game structures. A player-1 restriction of the game structure =(S ; 1 ; 2 hi) is a game structure of the form 1 =(S ; 0 1 ; 2 hi) with; 0 1 (s) ; 1(s) for all states s 2 S. Symmetrically, a player-2 restriction of is a game structure of the form 2 =(S ; 1 ; 0 2 hi) with ; 0 2 (s) ; 2(s) for all s 2 S. In other words, for i =1 2, a player-i restriction of a game structure restricts the action choices that are available to player i. Strategies and runs. Consider a game structure =(S ; 1 ; 2 hi). A player-i strategy, for i =1 2, is a function i : S +! A that maps every nonempty, nite sequence of states to an action available to player i at the last state of the sequence that is, i (ss) 2 ; i (s) for every state sequence s 2 S and every state s 2 S. Intuitively, i (s s) indicates the choice taken by player i according to strategy i if the current state of the game is s, and the history of the game is s. We write i 4

5 for the set of player-i strategies. We distinguish the following types of strategies. The strategy i is memoryless if in every state s 2 S, the choice of player i depends only on s that is, i (s s) = i (s) for all state sequences s 2 S. The strategy i is nite-memory if in every state s 2 S, the choice of player i depends only on s, and on a nite number of bits about the history of the game the formal denition is standard [5]. A run r of the game structure is a nonempty, nite or innite sequence s 0 (a 0 b 0 )s 1 (a 1 b 1 )s 2 ::: of alternating states s j 2 S and action pairs (a j b j ) 2 ; 1 (s j ) ; 2 (s j )such that s j+1 = (s j a j b j ) for all j 0. The rst state s 0 is called the source of the run. The weight of the run is w(r) = j0 w(s j a j b j ) the weight w(r) is either a real number, or innity (if the sum diverges). Let and be a pair of strategies for player 1 and player 2, respectively. The outcome R 1 2 (s) from state s 2 S of the strategies 1 and 2 is a source-s innite run of, namely, R 1 2 (s) = s 0 (a 0 b 0 )s 1 (a 1 b 1 )s 2 ::: such that (1) s 0 = s and (2) for all j 0, both a j = 1 (s 0 s 1 s j ) and b j = 2 (s 0 s 1 s j ). 2.2 Single-step verication and control Values and valuations. A value lattice is a complete lattice (V t u >?) of values V with join t, meetu, top element >, and bottom element?. iven u v 2 V,we write u v v i u = uuv. Consider a game structure = (S ; 1 ; 2 hi). A valuation f for on the value lattice V is a function from states to values that is, f: S! V. The set [S! V ] of valuations is again a lattice, with the lattice operations (t u >?) dened pointwise for example, for two valuations f 1 and f 2, we have (f 1 t f 2 )(s) = f 1 (s) t f 2 (s) for all states s 2 S. If f: S! V is a valuation such thatf(s) 2f>?g for all states s 2 S, then by ;f we denote the \complementary" valuation with ;f(s) => if f(s) =?, and ;f(s) =? if f(s) =>. For a set T S of states, we write [T ]: S! V for the valuation with [T ](s) = > if s 2 T, and [T ](s) =? if s 62 T. For a proposition p 2 P,wewrite[p]: S! V for the valuation with [p](s) => if p 2hsi, and [p](s) =? if p 62 hsi. Predecessor operators. Let V be a value lattice. Let Pre be a family of functions that contains, for every game structure, a strict (i.e., bottom-preserving), monotone, and continuous function Pre : [S! V ]! [S! V ]. The function family Pre is a predecessor-1 operator on V if for every game structure, every player-1 restriction 1 of, every player-2 restriction 2 of, and every valuation f: S! V, both Pre (f) w Pre 1 (f) and Pre (f) v Pre 2 (f). Symmetrically, the function family Pre is a predecessor-2 operator on V if for every game structure, every player-1 restriction 1 of, every player-2 restriction 2 of, and every valuation f: S! V, we have both Pre (f) v Pre 1 (f) andpre (f) w Pre 2 (f). Intuitively, the more actions are available to player 1 in a game structure, the \better" (i.e., closer to top in the valuation lattice) the result of applying a predecessor-1 operator to a valuation, and the \worse" (i.e., closer to bottom) the result of applying a predecessor-2 operator. Example 1: boolean game structures (\control"). Consider the boolean value lattice VB = (B _ ^ t f), where truth t is the top element and falsehood f is the bottom element. The valuations for a game structure on VB are called the boolean valuations for they correspond to the subsets of S. Figure 1 denes the predecessor operators 1PreB and 2PreB, applied to a game structure =(S ; 1 ; 2 hi), boolean valuation f: S! B, and state s 2 S. For a set T S of states, the boolean valuation 1Pre B [T ]: S! B of \controllable predecessors" is true at the states from which player 1 can force the game into T in a single step, no matter which action player 2 chooses. The operator 2PreB behaves symmetrically for player 2, and therefore solves the control problem for the player-2 objective ofreaching the target set T in a single step. The operator 1PreB is a predecessor-1 operator on VB,and2PreB is a predecessor-2 operator. 5

6 1Pre R 2Pre R EPre R APre R (f)(s) = (f)(s) = mina2;1 (s) : max b2;2 (s) min b2;2 (s) : max a2;1 (s) mina2;1 (s) : min b2;2 (s) max a2;1 (s) : max b2;2 (s) :w(s a b)+f((s a b)) (7) :w(s a b)+f((s a b)) (8) Figure 2: Quantitative game and transition predecessor operators Example 2: boolean transition structures (\verication"). Consider again the boolean value lattice VB. Figure 1 denes the predecessor operators EPreB and APreB. For a set T S of states, the boolean valuation EPre B [T ]: S! B of \possible predecessors" is true at the states that have some successor in T the boolean valuation APre B [T ]: S! B of \unavoidable predecessors" is true at the states that have all successors in T. For each game structure, the functions EPre B and APre B correspond to the branching-time \next" operators 9 and 8, respectively, of temporal logic interpreted over the underlying transition structure K. Therefore, EPreB and APreB solve the verication problems with the specications of possibly or certainly reaching the target set T in a single step. The operators EPre B and APreB are both predecessor-1 and predecessor-2 operators on VB. Example 3: quantitative game structures (\optimal control"). Consider the quantitative value lattice VR =(R 0 [ f1g min max 0 1), where 0 is the top element and 1 is the bottom element. Intuitively, each value represents a cost, and the smaller the cost, the \better." In particular, u v v i either u v 2 R 0 and u v, or u = 1 that is, the lattice is based on the reverse ordering of the reals. The valuations for a game structure on VR are called the quantitative valuations for they are the functions from S to the interval [0 1]. Figure 2 denes the predecessor operators 1PreR and 2PreR, applied to a game structure = (S ; 1 ; 2 hi), quantitative valuation f: S! [0 1], and state s 2 S. For a set T S of states, the quantitative valuation 1Pre R [T ]: S! [0 1]gives for each state the minimal cost for player 1 of forcing the game into T in a single step (if player 1 cannot force the game into T, then the cost is 1). The operator 2PreR behaves symmetrically for player 2, and therefore solves the optimal-control problem with the player-2 objective of reaching the target set T in a single step at minimal cost. The operator 1PreR is a predecessor-1 operator on VR, and2prer is a predecessor-2 operator. Example 4: quantitative transition structures (\optimization"). Consider again the quantitative value lattice VR. Figure 2 denes the predecessor operators EPre R and APreR. For a set T S of states, the quantitative valuation EPre R [T ]: S! [0 1] gives for each state the weight of the minimal transition into T (or 1, if no such transition exists), and APre R [T ]: S! [0 1] gives for each state the weight of the maximal transition into T (or 1, if some transition does not lead into T ). These are the single-step shortest-path and single-step longest-path problems on the underlying transition structure K. The operators EPreR and APreR are both predecessor-1 and predecessor-2 operators on VR. 2.3 Multi-step verication and control Multi-step verication (\Can a target set be reached in some number of steps?"), optimization (\What is the shortest path to the target?"), and control problems (\Can one player force the game into the target, in some number of steps, no matter what the other player does?") can be 6

7 hh1ii B hh2ii B 9 B 8B hh1ii R hh2ii R 9 R 8R (3p)(s) = (3p)(s) = (3p)(s) = (3p)(s) = : : (R : (s) has a prex in 3p) (9) : : (R : (s) has a prex in 3p) (10) 1 inf1 2 1 : sup : fw(r) j r is a prex of R 1 inf : sup 2 (s) andr 2 3pg (11) inf1 2 1 : inf : fw(r) j r is a prex of R 1 sup : sup 2 (s) andr 2 3pg (12) Figure 3: Boolean and quantitative reachability games solved by iterating the single-step solutions (\dynamic programming"). Here, we exemplify the solutions for the goals of reachability and safety more general objectives will be dealt with in Section 4. In the following, consider a game structure = (S ; 1 ; 2 hi) and a proposition p 2 P. Reachability. We dene 3p to be the set of minimal nite runs of that end in a p-state that is, the run s 0 (a 0 b 0 )s 1 (a 1 b 1 ) :::s m is in 3p i (1) p 2 hs m i and (2) for all 0 j < m, we have p 62 hs j i. Figure 3 denes four boolean valuations in [S! B ]. The valuation hh1ii B 3p is true at the states from which player 1 can control the game to reach ap-state the valuation hh2ii B 3p is true at the states from which player 2 can control the game to reach ap-state the valuation 9 B 3p is true at the states from which the two players can collaborate to reach ap-state the valuation 8 B 3p is true at the states from which no matter what the two players do, a p-state will be reached. The rst two valuations specify boolean games with the reachability objective 3p for players 1 and 2, respectively the last two valuations specify the branching-time properties 93p and 83p on the underlying transition structures. Figure 3 also denes the four corresponding quantitative valuations in [S! [0 1]] we use the convention that the inmum of an empty set of nonnegative reals is 1, and the supremum is 0. The valuation hh1ii R3p gives for each state the minimal cost for player 1 to direct the game to a p-state (or 1, ifplayer 1 cannot direct the game to a p-state) the valuation hh2ii R3p gives for each state the minimal cost for player 2 to direct the game to a p-state the valuation 9 R3p gives for each state the minimal cost to reach ap-state if both players collaborate the valuation 8 R3p gives for each state the maximal reward achievable, if both players collaborate, before a p-state is reached. The rst two valuations specify quantitative games with the reachability objective 3p for players 1 and 2, respectively the last two valuations specify shortest-path and longest-path problems on the underlying transition structure. The boolean and quantitative valuations for the reachability objective 3p can be characterized by least-xpoint expressions on the corresponding valuation lattice: hh1ii V 3p = x: ([p] t 1Pre V (x)) (13) hh2ii V 3p = x: ([p] t 2Pre V (x)) (14) 9 V 3p = x: ([p] t EPre V (x)) (15) 8 V 3p = x: ([p] t APre V (x)) (16) 7

8 hh1ii B (2p)(s) = : : (R 1 2 (s) 2 2p) (17) 9 B : (2p)(s) = : 8B (R : (s) 2 2p) (18) 1 hh1ii R(2p)(s) = 9 R (2p)(s) = 8R inf : sup : fw(r 1 2 (s)) j R 1 2 (s) 2 2pg (19) inf1 2 1 : inf : fw(r 1 sup : sup 2 (s)) j R 1 2 (s) 2 2pg (20) Figure 4: Boolean and quantitative safety games where V 2 fb Rg, and the variable x ranges over the boolean valuations in [S! B ] if V = B, and over the quantitative valuations in [S! [0 1]] if V = R. In other words, a single xpoint expression (namely, \3p = x:(p _ pre(x))") suces for the solution of boolean and quantitative verication and control problems, provided the pre-operator is interpreted appropriately. Fixpoint expressions prescribe algorithms. The solutions to the xpoint equations (13){(16) can be computed iteratively on the valuation lattice as the limit of a sequence x 0 x 1 x 2 :::of valuations: let x 0 =?, and for all k 0, let x k+1 =[p] t Pre V (x k), where Pre 2f1Pre 2Pre EPre APreg. For our four examples, the iteration converges in a nite number of steps. This is well-known in the case of boolean game structures and in the case of quantitative transition structures nite convergence can be shown inductively also for quantitative game structures. Safety. The complement of a reachability objective is a safety objective. We dene 2p to be the set of innite runs of the game structure that never leave p-states that is, the run s 0 (a 0 b 0 )s 1 (a 1 b 1 ) ::: is in 2p i p 2hs j i for all j 0. Figure 4 denes the boolean and quantitative valuations for the safety objective 2p. For example, the boolean valuation hh1ii B 2p is true at the states from which player 1 can control the game to stay within p-states the quantitative valuation 9 R2p gives for each state the minimal cost of an innite path that stays within p-states the boolean valuation 8 B 2p is true at the states from which p is an invariant. The boolean and quantitative valuations for the safety objective 2p can be characterized by greatest-xpoint expressions on the corresponding valuation lattice: hh1ii V 2p = x: ([p] u 1Pre V (x)) (21) hh2ii V 2p = x: ([p] u 2Pre V (x)) (22) 9 V 2p = x: ([p] u EPre V (x)) (23) 8 V 2p = x: ([p] u APre V (x)) (24) where V 2 fb Rg. The solutions to these xpoint equations can again be computed iteratively as the limit of a sequence x 0 x 1 x 2 ::: of valuations: let x 0 = >, and for all k 0, let x k+1 = [p] u Pre V (x k). This iteration converges for boolean game structures in a nite number of steps, but not necessarily for quantitative game or transition structures, where convergence may require! many steps. 8

9 hh1ii B (s) = : : (hr 1 2 (s)i 2L( )) (25) 9 B : (s) = : 8 (hr 1 B : (s)i 2L( )) (26) 1 hh1ii R (s) = 9 R (s) = 8 R inf : sup : fw(r[0::(hri )]) j r = R 1 2 (s) andhri 2L( )g (27) inf1 2 1 : inf : fw(r[0::(hri )]) j r = R 1 sup : sup 2 (s) andhri 2L( )g (28) Figure 5: Boolean and quantitative LTL games 3 An Extremal Model Theorem For verication problems, xpoint solutions are known for much richer objectives (\specications") than reachability and safety, and a xpoint theory the -calculus is available for this purpose. In the case of reachability and safety, the xpoint expressions we provided (namely, 3p = x: (p _ pre(x)) and 2p = x:(p ^ pre(x))) solve both the verication and control problems. This is not always the case: as we pointed out in the introduction, there are xpoint expressions that solve a verication problem over transition structures, but do not solve the corresponding control problem over game structures. We now characterize the xpoint expressions that solve both verication and control problems, provided the predecessor operators are interpreted appropriately. 3.1 Linear temporal logic Consider a game structure = (S ; 1 ; 2 hi). We express winning objectives for the innite game played on by formulas of linear temporal logic (LTL). The LTL formulas are generated by the grammar ::= p j: j _ j j U where p 2 P is a proposition, is the \next" operator, and U is the \until" operator. Additional constructs such as 3 = t U and 2 =:3: can be dened in the standard way. A trace :!! 2 P is an innite sequence of sets of propositions. Every LTL formula has a truth value on each trace. We write L( ) for the set of traces that satisfy a formal denition of L( ) can be found in [9]. Boolean LTL games. Every innite run r = s 0 (a 0 b 0 )s 1 (a 1 b 1 )s 2 ::: of the game structure induces a trace hri = hs 0 ihs 1 ihs 2 i ::: Consider a state s 2 S and an LTL formula. We say that player 1 can control state s for objective in the game structure if player 1 has a strategy such that for all strategies of player 2, the trace induced by the outcome of the game satises the formula that is, hr 1 2 (s)i 2 L( ). A suitable strategy 1 is a winning player-1 strategy for from s in. We write hh1ii B : S! B for the boolean valuation that is true at the states which can be controlled by player 1 for in see Figure 5. The player-2 winning valuation hh2ii B is dened symmetrically. Figure 5 also denes the boolean valuation 9B : S! B, which istrueat the states that satisfy the existential CTL formula 9 in the underlying transition structure K and the boolean valuation 8B : S! B, which is true at the states that satisfy the universal CTL formula 8 ink. 9

10 Quantitative LTL games. By hh1ii R we wish to denote the minimal cost for player-1 to achieve the objective. Recall the previous section. In reachability games, we compute the cost of winning as the weight of a nite run that reaches the target, while in safety games, the cost of winning is the weight of an innite run. This is because upon reaching the target, we know that the reachability objective is satised, while a safety objective can be witnessed only by the entire innite run generated by a game. We generalize this principle to arbitrary LTL formulas by dening the satisfaction index of a trace with respect to an LTL formula. iven a trace = ::: and a nonnegative integer k, thetrace 0 = ::: is a k-variant of i j = 0 j for all 0 j k. Let ( k) be the set of k-variants of. Foratrace andanltl formula, the satisfaction index ( ) is the smallest integer k 0such that ( k) L( ) if such ak exists, and ( ) = 1 otherwise. Intuitively, ( ) the minimal number of steps after which we can conclude that the trace satises the formula. For an innite run r and a nonnegative integer k, letr[0::k] be the the prex of r that contains k states. iven an LTL formula, the quantitative valuation hh1ii R : S! [0 1] is formally dened in Figure 5. For each state s 2 S, we say that hh1ii R (s) is the player-1 value of the game with objective at the state s of the game structure. A strategy 1 that attains the inmum is an optimal player-1 strategy for from s in. The player-2 valuation hh2ii R is dened symmetrically. Figure 5 also denes the quantitative valuation 9R : S! [0 1], which for each state s gives the minimum cost necessary for determining that some path from s in the underlying transition structure K satises (or 1, ifnosuch path exists). Dually, thevaluation 8 R : S! [0 1] gives for each state s the maximal reward attainable along some path from s in K until can no longer be violated. 3.2 Fixpoint calculi for games We dene a family of xpoint logics on game structures. The xpoint formulas are generated by the grammar ' ::= p j:p j x j ' _ ' j ' ^ ' j pre 1 (') j pre 2 (') j x: ' j x:' for propositions p 2 P and variables x. A xpoint formula ' is a one-player formula if either it contains no pre 2 -operator, or it contains no pre 1 -operator. In the former case, ' is a player-1 formula in the latter case, a player-2 formula. iven a value lattice V, a predecessor-1 operator Pre 1 on V, and a predecessor-2 operator Pre 2 on V, the closed xpoint formulas form a logic on game structures: for every game structure, every closed xpoint formula '(Pre 1 Pre 2 ) species a valuation [[']] : S! V. The syntactic operator pre 1 is interpreted semantically as the predecessor-1 operator Pre 1, and pre 2 is interpreted as Pre 2. To make the interpretation of the pre-operators explicit, we sometimes write '(Pre 1 Pre 2 ) when naming a xpoint formula. Then, '(Pre 0 1 Pre0 2) describes the syntactically identical xpoint formula, with the pre 1 -operator interpreted as Pre 0 1, and pre 2 interpreted as Pre 0 2. Likewise, the one-player formulas have only a single predecessor operator as argument. We now dene the semantics of xpoint formulas formally. Let V be a value lattice V,letPre 1 be a predecessor-1 operator on V, and let Pre 2 be a predecessor-2 operator on V. Let be a game structure. A variable environment E for is a function that maps every variable x toavaluation in [S! V ]. We write E[x 7! f] for the function that agrees with E on all variables, except that x is mapped to the valuation f. iven V, Pre 1, Pre 2,, and a variable environment E for, each xpoint formula ' species a valuation [[']] E : S! V, which is dened inductively by the 10

11 following equations: [[p]] E = [p] [[:p] E = ;[p] [[x]] E = E(x) [[' 1 _^ '2]] E = [' 1 ] E t u [[' 2 ] E pre [[ 1 (')]] Pre pre 2 E = 1 [[']] Pre E 2 [[ x: '] u E = t ff : S! V j f =[['] g E[x7!f] All right-hand-side (semantic) operations are performed on the valuation lattice [S! V ]. If ' is a closed formula, then ['] =[[']] E for any variable environment E. Provided that the predecessor operators Pre 1 and Pre 2 on V are computable, each formula '(Pre 1 Pre 2 ) prescribes a dynamic program for computing the valuation [['] over a game structure by iterative approximation. Example: mu-calculus. Choose the boolean value lattice VB, and the predecessor operators Pre 1 = EPreB and Pre 2 = APreB. The resulting logic on game structures coincides is the - calculus [8] on the underlying transition structures. Example: boolean game calculus. Choose the boolean value lattice VB, and the predecessor operators Pre 1 = 1PreB and Pre 2 = 2PreB. The resulting logic on game structures is the alternating-time -calculus of [1]. The player-i fragment, for i = 1 2, is expressive enough to compute the winning states for player i with respect to any LTL objective. Example: quantitative game calculus. Choose the quantitative value lattice VR, and the predecessor operators Pre 1 = 1PreR and Pre 2 = 2PreR. The resulting logic may be called the quantitative game calculus. We shall see that the player-i fragment, for i = 1 2, is expressive enough to compute all player-i values with respect to any LTL objective. Example: quantitative mu-calculus. Choose the quantitative value lattice VR, and the predecessor operators Pre 1 = EPreR and Pre 2 = APreR. The resulting logic may be called the quantitative -calculus. It can be used to compute, for example, the minimal and maximal weights of paths that satisfy LTL formulas in transition structures. Monotonicity. The following monotonicity property of xpoint formulas will be useful. Lemma 1 For every game structure, every 1-restriction 1 of, every 2-restriction 2 of, and every player-1 xpoint formula ', we have [[']] w [']] 1 and ['] v ['] 2. A symmetrical result holds for player-2 formulas. Lean xpoint formulas. We shall use xpoint formulas as algorithms for computing the values of LTL games. The quantitative interpretation of a xpoint formula, however, does not take into account the satisfaction index of the corresponding LTL formula, and may compute the cost of a trace even beyond the satisfaction index. For example, the LTL formula t has the satisfaction index 0, because every state has a successor. Hence (9R t)(s) = 0 for all game structures and states s 2 S. While 9B t = [EPre B (t)] for all game structures, if s 2 S is a state all of whose outgoing transitions have positive weights, then [EPreR(t)]] (s) > 0. This motivates the denition of lean xpoint formulas. A xpoint formula ' is valid if for every game structure and every state s 2 S,wehave ['(1PreB 2PreB )] (s) =t. A xpoint formula is lean if no valid subformula contains pre-operators. 11

12 From now on we will make heavy use of the following convenient notation. If f and g are two families of valuations, one each for every game structure, then we write f = g short for \f = g for all game structures." Lemma 2 Let be an LTL formula, and let ' be a lean one-player xpoint formula. Then 9B =['(EPreB )]] i 9R =['(EPreR)], and 8B =[['(APreB )]] i 8R =['(APreR)]. 3.3 From verication to control: a semantic criterion The following theorem characterizes the xpoint formulas that can be used for solving boolean as well as quantitative games with LTL winning objectives. The characterization reduces problems on two-player structures (control) and on quantitative structures (optimization) to problems on boolean one-player structures (verication), which are well-understood. Theorem 1 For every LTL formula and every lean player-i xpoint formula ', where i =1 2, the following four statements are equivalent: hhiiir =['(iprer)]. hhiiib =['(ipreb )]. 9R =['(EPreR)]] and 8R =[['(APreR)]. 9B =[['(EPreB )] and 8B =['(APreB )]. The theorem can be stated equivalently as follows: hhiii R =[['(ipre R)]] for all game structures i hhiii B =['(ipre B )] for all oneplayer structures. In other words, the xpoint formula ' prescribes an algorithm for computing the boolean or quantitative values of games with the winning objective i it does so on all boolean, extremal game structures, where one or the other player has no choice of actions. Proof sketch. Clearly, a xpoint formula ' that solves games with objective also works over one-player structures, which are special cases of games. For the implication from one-player to game structures, we argue by contradiction. We start with the boolean player-1 interpretation (the proof for player 2 is symmetric). First we notice that given a game structure for which the two valuations hh1ii B and ['(1Pre B )]] dier, we can construct a turn-based game structure 0 for which the valuations dier as well. There are two cases. If hh1ii B 0 (s) < ['(1Pre B )] 0 (s) for some state s 2 S 0, then we x a nite-memory optimal strategy of player 2 and show that in the resulting player-1 structure 1, there is a state t such that(9 1 B )(t) < ['(EPre B )] 1 (t). Similarly, if hh1ii B 0 (s) > ['(1Pre B )]] 0 (s) for some state s 2 S 0, then we x a nite-memory optimal strategy of player 1 and argue on the resulting player-2 structure. The proof for quantitative games follows by a similar argument. Finally, we go from quantitative to boolean structures using Lemma 2. 2 Suppose we are given an LTL formula. For verifying whether some path of a transition structure K satises, we can construct a -calculus formula '(EPreB ) that is equivalent to 9B over all transition structures, and check '(EPreB )over K this is, in fact, asymbolic model checking algorithm for LTL [3]. Now suppose that we want player 1 to control the game structure for the objective.theorem 1 tells us whether we can simply substitute the controllable predecessor 12

13 operator 1Pre B for the -calculus predecessor operator EPre B in the xpointformula ': the substitution works if and only if by substituting APreB for EPreB in ' we obtain a formula that is equivalent totheuniversal interpretation 8B of the LTL formula over all transition structures. To see that this property is not trivial (i.e., not satised by every -calculus formula '(EPre B ) that is equivalent to 9B ), consider the co-buchi formula = 32p. Over transition structures, 932p is equivalent to 9392p, which is equivalent to the -calculus formula x:(y:(p^epre B (y))_ EPreB (x)) indeed, this is the result of the standard translation from LTL to the -calculus for co- Buchi formulas [7, 4]. However, the corresponding game formula x:(y:(p ^ 1PreB (y)) _ 1PreB (x)) does not compute the boolean valuation hh1ii B 32p for all game structures : the game structure given in the introduction provides a counterexample. The criterion of Theorem 1 fails, because over transition structures, 8B 32p is not equivalent to8382p, and therefore 8B is not equivalent to x:(y:(p ^ APreB (y)) _ APreB (x)). This is not surprising, given that the solution of!-regular games requires deterministic (and hence Rabin chain)!-automata [15], whereas nondeterministic (and hence Buchi)!-automata suce for!-regular verication. The translations of [7, 4] from LTL to the -calculus go via nondeterministic Buchi automata, and thus cannot be used to solve!-regular games. The following theorem characterizes the cost of checking the criterion given in Theorem 1. There is a gap between the lower and upper bounds, which is due to the gap between the best known lower and upper bounds for the equivalence problem between an LTL formula and a -calculus formula. Theorem 2 Let be anltl formula, and let ' be a one-player xpoint formula. The complexity of checking whether 9B = ['] is in 2EXPTIME and PSPACE-hard in the size of, and in EXPTIME in the size of '. The complexity of checking whether 8B =['] is the same. 3.4 From verication to control: a syntactic criterion Not all xpoint formulas correspond to verication or control problems with respect to lineartime objectives. This is always the case, however, for the deterministic xpoint formulas. The deterministic xpoint formulas are generated by the grammar ' ::= p j:p j x j ' _ ' j p ^ ' j:p ^ ' j pre 1 (') j pre 2 (') j x: ' j x:': From [6] we know that if '(EPreB ) is a one-player deterministic xpoint formula, then there is an!-regular language such that 9B = [['(EPreB )]]. However, the examples (2) and (3) in the introduction illustrate that for such a formula '(EPreB ), in general it is not the case that hh1iib = ['(1Pre B )]]. In other words, the correspondence between the deterministic xpoint formula and the!-regular language does not necessarily carry over from verication to control. It is then natural to ask what other conditions we need, in addition to determinism, for a one-player xpoint formula to have related meanings in verication and control. We answer this question by introducing a subclass of the deterministic formulas. A xpoint formula ' is strongly deterministic i ' consists of a string of xpoint quantiers followed by a quantier-free part, which is generated by the grammar ::= p j:p j _ j p ^ j:p ^ j pre 1 () j pre 2 () ::= x j _ : Note that every strongly deterministic xpoint formula is lean. The following theorem shows that the one-player strongly deterministic xpoint formulas provide a syntactic class of xpoint 13

14 formulas for which the criterion of Theorem 1 applies. In particular, it follows that for every LTL formula, every one-player strongly deterministic xpoint formula ', and i =1 2, we have hhiiir =[['(iprer)]]. and every one-player strongly deterministic xpoint for- Theorem 3 For every LTL formula mula ', we have 9B =['(EPreB )] i 8B =['(APreB )]. Proof sketch. A strongly deterministic formula starts with a quantier prex. In the sequence x 1 :x 2 :::x 2k of alternating xpoints, the \evaluation order" is x 2 x 4 x 2k x 2k;1 x 1 (this reects the extension of the variables when the expression is being evaluated). Using this evaluation order, every one-player strongly deterministic xpoint formula '(EPre B ) can be brought into the normal form x 1 :x 2 :::x 2k :(d 0 _ W 2k j=1 (d j ^ EPreB (x j ))), for some k > 0 and some mutually exclusive boolean combinations d 0 d 1 ::: d 2k of propositions. The theorem follows from the fact that this formula has essentially the same structure as the solution formula of a Rabin-chain game (cf. [5] and Section 4). 2 While the one-player strongly deterministic xpoint formulas obey strict syntactic conditions, the proof of Theorem 3 shows that they suce for solving all control problems with Rabin-chain objectives. In turn, every!-regular property can be specied by a deterministic Rabin-chain automaton [10, 15]. We can therefore transform every control problem with an!-regular objective into a control problem with a Rabin-chain objective that is to be solved on the automata-theoretic product of the given game structure and a Rabin-chain automaton. Hence, at the cost of possibly enlarging the game structure, the one-player strongly deterministic xpoint formulas suce for the solution of games with arbitrary!-regular objectives. 4 Dynamic Programs for LTL We show that for every LTL formula we can construct an equivalent xpoint formula ' that meets the criterion of Theorem 1. The formula ' has the following properties: it solves both the verication problem (on transition structures) for specication and the control problem (on game structures) for objective, both under boolean and quantitative interpretations. The construction of ' is optimal for the boolean case, in that the 2EXPTIME complexity of the resulting algorithm for solving boolean games with LTL objectives matches the hardness of the problem [11]. 4.1 (Co)Buchi and Rabin-chain games The objective of a Buchi game is an LTL formula of the form 23p, for a proposition p 2 P, and the objective ofaco-buchi game is an LTL formulaoftheform32p. For V = fb Rg and i =1 2, the Buchi and co-buchi valuations can be computed by the xpoint formulas hhiii V 23p = [[y:x:(ipre V (x) _ (p ^ ipre V (y)))]] hhiii V 32p = [[x:y:(ipre V (x) _ (p ^ ipre V (y)))]]: The objective a Rabin-chain game is an LTL formula of the form = W k;1 j=0 (23d 2j ^:23d 2j+1 ), where k > 0 is called the index of, and d 0 ::: d 2k are boolean combinations of propositions such that = [d 2k ] [d 2k;1 ] [d 0 ] = S for all game structures. An alternative characterization of Rabin-chain games with objective can be obtained by dening a family : S!f0 1 ::: 2k ; 1g of index functions, one for every game structure, such that (s) =j 14

15 for all states s 2 [d j ] n [d j+1 ]. iven an innite run r of, letinf (r) S be the set of states that occur innitely often along r, and let MaxIndex( r)=maxf (s) j s 2 Inf (r)g be the largest index of such a state. Then, the run r satises the objective i MaxIndex( r) is even. For V 2 B R and i =1 2, the Rabin-chain valuation can be computed by thexpoint formula hhiii V = [ 2k;1 x 2k;1 :::x 1 :x 0 : _ 2k;1 j=0 (d j ^:d j+1 ^ ipre V (x j ))] where j = if j is even, and j = if j is odd (cf. [5]). Note that the xpoint solutions for Buchi, co-buchi, and Rabin-chain games are all one-player strongly deterministic xpoint formulas. 4.2 LTL games iven an LTL formula, we construct a lean one-player xpoint formula ' such that hhiii V = [' (ipre V )]] (29) for V 2 fb Rg and i =1 2. Following [5, 10], our construction is based on deterministic Rabinchain automata (also called parity automata [14]). A Rabin-chain automaton of index k over the input alphabet 2 P is a tuple C = (Q Q 0 hi ), where Q is a nite set of states, Q 0 Q is the set of initial states, : Q! 2 Q is the transition relation, hi: Q! 2 P assigns propositions to states, and : Q!f0 ::: 2k ; 1g is the acceptance condition. An execution of C from a source state q 0 2 Q is an innite sequence q 0 q 1 q 2 of automaton states such that q j+1 2 (q j ) for all j 0 if q 0 2 Q 0, then the execution is initialized. The execution e = q 0 q 1 q 2 ::: is generated by the trace hei = hq 0 ihq 1 ihq 2 i ::: The execution e is accepting if MaxIndex( e) is even. The language L(C) is the set of traces such that C has an initialized accepting execution e generated by. The automaton C is deterministic and total if (1a) for all states q 0 q 00 2 Q 0,ifq 0 6= q 00, then hq 0 i6= hq 00 i (1b) for all proposition sets P 0 P, there is a state q 0 2 Q 0 such thathq 0 i = P 0 (2a) for all states q 2 Q and q 0 q 00 2 (q), if q 0 6= q 00, then hq 0 i6= hq 00 i (2b) for all states q 2 Q and all proposition sets P 0 P, there is a state q 0 2 (q) such that hq 0 i = P 0. If C is deterministic and total, then we write (q P 0 ) for the unique state q 0 2 (q) with hq 0 i = P 0. From the LTL formula, we construct a deterministic, total Rabin-chain automaton C such that L( ) = L(C ), by rst building a nondeterministic Buchi automaton with the language L( ) [16], and then determinizing it [12, 13]. Let C =(Q Q 0 hi ). In order to obtain a lean xpoint formula ', we need to compute the set F Q of automaton states q such that all executions with source q are accepting. To this end, it suces to compute the set Q n F of states q 0 such that there is an execution e with source q 0 and MaxIndex( 0 e)iseven, where 0 is the complementary acceptance condition with 0 (q) =(2k ; 1) ; (q) for all states q 2 Q. This corresponds to checking the nonemptiness of a Rabin-chain automaton [5]. We derive the xpoint formula ' that satises (29) in two steps. First, we build a xpoint formula ' 0 that solves the game with objective on the product structure C, for all game structures. From ' 0, we then construct the formula ' that solves the game directly on, for all. Consider an arbitrary game structure =(S ; 1 ; 2 hi). Dene C =(S 0 ; 0 1 ;0 2 0 hi), where S 0 = f(s q) 2 S Q jhsi = hqig, where ; 0 i (s q) =; i(s) fori =1 2, where 0 ((s q) a 1 a 2 )= ((s a 1 a 2 ) (q h(s a 1 a 2 )i)). Finally, for q 62 F let hs qi = hsi [fc (q) g, and for q 2 F let hs qi = hsi[fp F c (q) g, where p F c 0 ::: c 2k;1 are new propositions. We construct ' 0 by proceeding similarly to [2]. We give the xpoint formula ' 0 in equational form it can then be unfolded into a nested xpoint formula in the standard way. The formula ' 0 is 15

16 composed of blocks B 0 0 ::: B0, where 2k;1 B0 0 is the innermost block and B0 W 2k;1 the outermost block. The block B 0 0 is a -block which consists of the single equation x 2k;1 0 = f _ j=0 (c j ^ pre 1 (x j ))). For 0 < ` 2k ; 1, the block B 0` is a -block if ` is odd, and a -block if ` is even in either case it consists of the single equation x` = x`;1. The output variable is x 2k;1. Then, (hh1ii B )(s) = [[' 0 (1PreB )]] C (s q) for all states s 2 S and for the unique q 2 Q 0 such that (s q) 2 S 0. The formula ' mimics on the evaluation of ' 0 on C. For each variable x` of ' 0, for 0 ` 2k ; 1, the formula ' contains the set fx q` j q 2 Qg of variables: the value of xq` at s keeps track of the value of x` at (s q). The formula ' is composed of the blocks B 0 ::: B 2k;1 : for 0 ` 2k ; 1, the block B` consists of the set fe q` j q 2 Qg of equations. The equation Eq` is derived from the equation for x` in ' 0 by replacing the variable x` on the left-hand side with the variable x q`, by replacing c j with t if (q) =j and W f otherwise, by replacing p F with t if q 2 F and f otherwise, and by replacing pre 1 (x j ) with pre 1 ( q 0 2(q) xq0 j ) the right-hand side is then W conjuncted with the propositions in hqi. The block B 2k;1 contains the extra equation x out = q2q 0 x q, 2k;1 which denes the output variable x out. Note that ' is independent of the game structure, and contains no propositions other than those in. Theorem 4 For every LTL formula and i = 1 2, we have hhiiib = [' (ipreb )]. Moreover, the xpoint formula ' is lean and its size is doubly exponential in the size of. Since ' is lean, by Theorem 1 it follows that hhiiir =[' (iprer)]]. The doubly exponential size of ' is optimal, because boolean games with LTL objectives are 2EXPTIME-hard [11]. References [1] R. Alur, T.A. Henzinger, and O. Kupferman. Alternating-time temporal logic. In Proc. 38th Symp. Foundations of Computer Science, pp. 100{109. IEEE Computer Society, [2]. Bhat and R. Cleaveland. Ecient model checking via the equational -calculus. In Proc. 11th Symp. Logic in Computer Science, pp. 304{312. IEEE Computer Society, [3] E.M. Clarke, O. rumberg, and D.E. Long. Verication tools for nite-state concurrent systems. In A Decade of Concurrency: Reections and Perspectives, LNCS 803, pp. 124{175. Springer, [4] M. Dam. CTL and ECTL as fragments of the modal -calculus. Theoretical Computer Science, 126:77{96, [5] E.A. Emerson and C. Jutla. Tree automata, mu-calculus, and determinacy. In Proc. 32th Symp. Foundations of Computer Science, pp. 368{377. IEEE Computer Society, [6] E.A. Emerson, C.S. Jutla, and A.P. Sistla. On model checking for fragments of -calculus. In CAV 93: Computer-aided Verication, LNCS 697, pp. 385{396. Springer, [7] E.A. Emerson and C. Lei. Ecient model checking in fragments of the propositional -calculus. In Proc. First Symp. Logic in Computer Science, pp. 267{278. IEEE Computer Society, [8] D. Kozen. Results on the propositional -calculus. Theoretical Computer Science, 27:333{354,

17 [9] Z. Manna and A. Pnueli. The Temporal Logic of Reactive and Concurrent Systems: Specication. Springer, [10] A.W. Mostowski. Regular expressions for innite trees and a standard form of automata. In Proc. 5th Symp. Computation Theory, LNCS 208, pp. 157{168. Springer, [11] R. Rosner. Modular Synthesis of Reactive Systems. PhD Thesis, Weizmann Institute of Science, Rehovot, Israel, [12] S. Safra. On the complexity of!-automata. In Proc. 29th Symp. Foundations of Computer Science, pp. 319{327. IEEE Computer Society, [13] S. Safra. Exponential determinization for!-automata with strong-fairness acceptance condition. In Proc. 24th Symp. Theory of Computing, pp. 275{282. ACM, [14] W. Thomas. Automata on innite objects. In Handbook of Theoretical Computer Science, vol. B, pp. 133{191. Elsevier, [15] W. Thomas. On the synthesis of strategies in innite games. In STACS 95: Theoretical Aspects of Computer Science, LNCS 900, pp. 1{13. Springer, [16] M.Y. Vardi and P. Wolper. Reasoning about innite computations. Information and Computation, 115:1{37,

Testing LTL Formula Translation into Büchi Automata

Testing LTL Formula Translation into Büchi Automata Heikki Tauriainen and Keijo Heljanko Helsinki University of Technology, Laboratory for Theoretical Computer Science, P. O. Box 5400, FIN-02015 HUT, Finland

Model Checking II Temporal Logic Model Checking

1/32 Model Checking II Temporal Logic Model Checking Edmund M Clarke, Jr School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213 2/32 Temporal Logic Model Checking Specification Language:

linear hybrid automata is undecidable the method provides also diagnostic information that aids in design

Symbolic Analysis of Hybrid Systems y Rajeev Alur 1 Thomas A. Henzinger 2 Howard Wong-Toi 3 Abstract. A hybrid system is a dynamical system whose behavior exhibits both discrete and continuous change.

Verication by Finitary Abstraction Weizmann Institute of Sciences and Universite Joseph Fourier, Grenoble Fourth International Spin Workshop (SPIN'98) Paris 2.11.98 Joint work with: Y. Kesten Ben Gurion

Checking. E. M. Clarke O. Grumberg K. L. McMillan X. Zhao

Ecient Generation of Counterexamples and Witnesses in Symbolic Model Checking E. M. Clarke O. Grumberg K. L. McMillan X. Zhao School of Computer Science Computer Science Dept. Cadence Berkeley Labs. School

Model Checking: An Introduction

Announcements Model Checking: An Introduction Meeting 2 Office hours M 1:30pm-2:30pm W 5:30pm-6:30pm (after class) and by appointment ECOT 621 Moodle problems? Fundamentals of Programming Languages CSCI

Formal Verification Coverage: Computing the Coverage Gap between Temporal Specifications

Formal Verification Coverage: Computing the Coverage Gap between Temporal Specifications Sayantan Das Prasenjit Basu Ansuman Banerjee Pallab Dasgupta P.P. Chakrabarti Department of Computer Science & Engineering

Applying Gauss elimination from boolean equation systems to simple integer equation systems

Applying Gauss elimination from boolean equation systems to simple integer equation systems Kevin van der Pol Eindhoven University of Technology January 19, 2012 Abstract We define a direct transformation

Software Modeling and Verification

Software Modeling and Verification Alessandro Aldini DiSBeF - Sezione STI University of Urbino Carlo Bo Italy 3-4 February 2015 Algorithmic verification Correctness problem Is the software/hardware system

From Workflow Design Patterns to Logical Specifications

AUTOMATYKA/ AUTOMATICS 2013 Vol. 17 No. 1 http://dx.doi.org/10.7494/automat.2013.17.1.59 Rados³aw Klimek* From Workflow Design Patterns to Logical Specifications 1. Introduction Formal methods in software

On strong fairness in UNITY

On strong fairness in UNITY H.P.Gumm, D.Zhukov Fachbereich Mathematik und Informatik Philipps Universität Marburg {gumm,shukov}@mathematik.uni-marburg.de Abstract. In [6] Tsay and Bagrodia present a correct

logic language, static/dynamic models SAT solvers Verified Software Systems 1 How can we model check of a program or system?

5. LTL, CTL Last part: Alloy logic language, static/dynamic models SAT solvers Today: Temporal Logic (LTL, CTL) Verified Software Systems 1 Overview How can we model check of a program or system? Modeling

T-79.186 Reactive Systems: Introduction and Finite State Automata

T-79.186 Reactive Systems: Introduction and Finite State Automata Timo Latvala 14.1.2004 Reactive Systems: Introduction and Finite State Automata 1-1 Reactive Systems Reactive systems are a class of software

Constructing Automata from Temporal Logic Formulas : A Tutorial

Constructing Automata from Temporal Logic Formulas : A Tutorial Pierre Wolper Université de Liège, Institut Montefiore, B28, 4000 Liège, Belgium pw@montefiore.ulg.ac.be, http://www.montefiore.ulg.ac.be/~pw/

1 if 1 x 0 1 if 0 x 1

Chapter 3 Continuity In this chapter we begin by defining the fundamental notion of continuity for real valued functions of a single real variable. When trying to decide whether a given function is or

arxiv:1112.0829v1 [math.pr] 5 Dec 2011

How Not to Win a Million Dollars: A Counterexample to a Conjecture of L. Breiman Thomas P. Hayes arxiv:1112.0829v1 [math.pr] 5 Dec 2011 Abstract Consider a gambling game in which we are allowed to repeatedly

A Systematic Approach. to Parallel Program Verication. Tadao TAKAOKA. Department of Computer Science. Ibaraki University. Hitachi, Ibaraki 316, JAPAN

A Systematic Approach to Parallel Program Verication Tadao TAKAOKA Department of Computer Science Ibaraki University Hitachi, Ibaraki 316, JAPAN E-mail: takaoka@cis.ibaraki.ac.jp Phone: +81 94 38 5130

On Omega-Languages Defined by Mean-Payoff Conditions

On Omega-Languages Defined by Mean-Payoff Conditions Rajeev Alur 1, Aldric Degorre 2, Oded Maler 2, Gera Weiss 1 1 Dept. of Computer and Information Science, University of Pennsylvania, USA {alur, gera}@cis.upenn.edu

MetaGame: An Animation Tool for Model-Checking Games

MetaGame: An Animation Tool for Model-Checking Games Markus Müller-Olm 1 and Haiseung Yoo 2 1 FernUniversität in Hagen, Fachbereich Informatik, LG PI 5 Universitätsstr. 1, 58097 Hagen, Germany mmo@ls5.informatik.uni-dortmund.de

x if x 0, x if x < 0.

Chapter 3 Sequences In this chapter, we discuss sequences. We say what it means for a sequence to converge, and define the limit of a convergent sequence. We begin with some preliminary results about the

Which Semantics for Neighbourhood Semantics?

Which Semantics for Neighbourhood Semantics? Carlos Areces INRIA Nancy, Grand Est, France Diego Figueira INRIA, LSV, ENS Cachan, France Abstract In this article we discuss two alternative proposals for

Language. Johann Eder. Universitat Klagenfurt. Institut fur Informatik. Universiatsstr. 65. A-9020 Klagenfurt / AUSTRIA

PLOP: A Polymorphic Logic Database Programming Language Johann Eder Universitat Klagenfurt Institut fur Informatik Universiatsstr. 65 A-9020 Klagenfurt / AUSTRIA February 12, 1993 Extended Abstract The

An Automata-Theoretic Approach to Linear Temporal Logic

An Automata-Theoretic Approach to Linear Temporal Logic Moshe Y. Vardi? Rice University Department of Computer Science P.O. Box 1892 Houston, TX 77251-1892, U.S.A. Email: vardi@cs.rice.edu URL: http://www.cs.rice.edu/

A Propositional Dynamic Logic for CCS Programs

A Propositional Dynamic Logic for CCS Programs Mario R. F. Benevides and L. Menasché Schechter {mario,luis}@cos.ufrj.br Abstract This work presents a Propositional Dynamic Logic in which the programs are

Timed Automata. Jennifer Nist. Chair of Software Engineering Albert-Ludwigs Universität Freiburg

Seminar: Automata Theory Timed Automata Jennifer Nist 11 th February 2016 Chair of Software Engineering Albert-Ludwigs Universität Freiburg Jennifer Nist Timed Automata 11 th February 2016 1 / 28 Outline

International Journal of Foundations of Computer Science c World Scientific Publishing Company Büchi Complementation Made Tighter Ehud Friedgut Hebrew University, Institute of Mathematics, Jerusalem 91904,

Math 317 HW #7 Solutions

Math 17 HW #7 Solutions 1. Exercise..5. Decide which of the following sets are compact. For those that are not compact, show how Definition..1 breaks down. In other words, give an example of a sequence

Undergraduate Notes in Mathematics. Arkansas Tech University Department of Mathematics

Undergraduate Notes in Mathematics Arkansas Tech University Department of Mathematics An Introductory Single Variable Real Analysis: A Learning Approach through Problem Solving Marcel B. Finan c All Rights

Today s Agenda. Automata and Logic. Quiz 4 Temporal Logic. Introduction Buchi Automata Linear Time Logic Summary

Today s Agenda Quiz 4 Temporal Logic Formal Methods in Software Engineering 1 Automata and Logic Introduction Buchi Automata Linear Time Logic Summary Formal Methods in Software Engineering 2 1 Buchi Automata

Agenda. Quick Overview Properties, Automata and State Machines Model Checking. Pallab Dasgupta, Dept. of Computer Sc & Engg, IIT Kharagpur

Model Checking Agenda Quick Overview Properties, Automata and State Machines Model Checking 2 Formal Property Verification What is formal property verification? Verification of formal properties? Formal

Development of dynamically evolving and self-adaptive software. 1. Background

Development of dynamically evolving and self-adaptive software 1. Background LASER 2013 Isola d Elba, September 2013 Carlo Ghezzi Politecnico di Milano Deep-SE Group @ DEIB 1 Requirements Functional requirements

Verification of hybrid dynamical systems

Verification of hybrid dynamical systems Jüri Vain Tallinn Technical University/Institute of Cybernetics vain@ioc.ee Outline What are Hybrid Systems? Hybrid automata Verification of hybrid systems Verification

1. R In this and the next section we are going to study the properties of sequences of real numbers.

+a 1. R In this and the next section we are going to study the properties of sequences of real numbers. Definition 1.1. (Sequence) A sequence is a function with domain N. Example 1.2. A sequence of real

Logic, Algebra and Truth Degrees 2008. Siena. A characterization of rst order rational Pavelka's logic

Logic, Algebra and Truth Degrees 2008 September 8-11, 2008 Siena A characterization of rst order rational Pavelka's logic Xavier Caicedo Universidad de los Andes, Bogota Under appropriate formulations,

A Logic Approach for LTL System Modification

A Logic Approach for LTL System Modification Yulin Ding and Yan Zhang School of Computing & Information Technology University of Western Sydney Kingswood, N.S.W. 1797, Australia email: {yding,yan}@cit.uws.edu.au

Formal Verification by Model Checking

Formal Verification by Model Checking Natasha Sharygina Carnegie Mellon University Guest Lectures at the Analysis of Software Artifacts Class, Spring 2005 1 Outline Lecture 1: Overview of Model Checking

Program Synthesis is a Game

Program Synthesis is a Game Barbara Jobstmann CNRS/Verimag, Grenoble, France Outline Synthesis using automata- based game theory. MoBvaBon, comparison with MC and LTL. Basics Terminology Reachability/Safety

Temporal Logics. Computation Tree Logic

Temporal Logics CTL: definition, relationship between operators, adequate sets, specifying properties, safety/liveness/fairness Modeling: sequential, concurrent systems; maximum parallelism/interleaving

SYNTHESIS FROM PROBABILISTIC COMPONENTS

Logical Methods in Computer Science Vol. 10(2:17)2014, pp. 1 24 www.lmcs-online.org Submitted Feb. 29, 2012 Published Jun. 30, 2014 SYNTHESIS FROM PROBABILISTIC COMPONENTS YOAD LUSTIG a, SUMIT NAIN b,

Sequences and Convergence in Metric Spaces

Sequences and Convergence in Metric Spaces Definition: A sequence in a set X (a sequence of elements of X) is a function s : N X. We usually denote s(n) by s n, called the n-th term of s, and write {s

ω-automata Automata that accept (or reject) words of infinite length. Languages of infinite words appear:

ω-automata ω-automata Automata that accept (or reject) words of infinite length. Languages of infinite words appear: in verification, as encodings of non-terminating executions of a program. in arithmetic,

Mathematics for Economics (Part I) Note 5: Convex Sets and Concave Functions

Natalia Lazzati Mathematics for Economics (Part I) Note 5: Convex Sets and Concave Functions Note 5 is based on Madden (1986, Ch. 1, 2, 4 and 7) and Simon and Blume (1994, Ch. 13 and 21). Concave functions

Sets and functions. {x R : x > 0}.

Sets and functions 1 Sets The language of sets and functions pervades mathematics, and most of the important operations in mathematics turn out to be functions or to be expressible in terms of functions.

Course 221: Analysis Academic year , First Semester

Course 221: Analysis Academic year 2007-08, First Semester David R. Wilkins Copyright c David R. Wilkins 1989 2007 Contents 1 Basic Theorems of Real Analysis 1 1.1 The Least Upper Bound Principle................

WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT?

WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT? introduction Many students seem to have trouble with the notion of a mathematical proof. People that come to a course like Math 216, who certainly

Induction and Recursion

Induction and Recursion Winter 2010 Mathematical Induction Mathematical Induction Principle (of Mathematical Induction) Suppose you want to prove that a statement about an integer n is true for every positive

Math 317 HW #5 Solutions

Math 317 HW #5 Solutions 1. Exercise 2.4.2. (a) Prove that the sequence defined by x 1 = 3 and converges. x n+1 = 1 4 x n Proof. I intend to use the Monotone Convergence Theorem, so my goal is to show

Automata on Infinite Words and Trees

Automata on Infinite Words and Trees Course notes for the course Automata on Infinite Words and Trees given by Dr. Meghyn Bienvenu at Universität Bremen in the 2009-2010 winter semester Last modified:

Chapter 7. Sealed-bid Auctions

Chapter 7 Sealed-bid Auctions An auction is a procedure used for selling and buying items by offering them up for bid. Auctions are often used to sell objects that have a variable price (for example oil)

Doomsday Equilibria for Games on Graphs

Doomsday Equilibria for Games on Graphs Krishnendu Chatterjee Laurent Doyen IST Austria LSV, ENS Cachan & CNRS Emmanuel Filiot Jean-François Raskin Université Libre de ruxelles U.L.. Two-player games on

Automata-based Verification - I

CS3172: Advanced Algorithms Automata-based Verification - I Howard Barringer Room KB2.20: email: howard.barringer@manchester.ac.uk March 2006 Supporting and Background Material Copies of key slides (already

Learning Threshold Functions with Small Weights using Membership Queries

Learning Threshold Functions with Small Weights using Membership Queries Elias Abboud Research Center Ibillin Elias College P.O. Box 102 Ibillin 30012 Nader Agha Research Center Ibillin Elias College P.O.

http://aejm.ca Journal of Mathematics http://rema.ca Volume 1, Number 1, Summer 2006 pp. 69 86

Atlantic Electronic http://aejm.ca Journal of Mathematics http://rema.ca Volume 1, Number 1, Summer 2006 pp. 69 86 AUTOMATED RECOGNITION OF STUTTER INVARIANCE OF LTL FORMULAS Jeffrey Dallien 1 and Wendy

Solving nonlinear equations in one variable

Chapter Solving nonlinear equations in one variable Contents.1 Bisection method............................. 7. Fixed point iteration........................... 8.3 Newton-Raphson method........................

Random vs. Structure-Based Testing of Answer-Set Programs: An Experimental Comparison

Random vs. Structure-Based Testing of Answer-Set Programs: An Experimental Comparison Tomi Janhunen 1, Ilkka Niemelä 1, Johannes Oetsch 2, Jörg Pührer 2, and Hans Tompits 2 1 Aalto University, Department

Basic Concepts of Point Set Topology Notes for OU course Math 4853 Spring 2011

Basic Concepts of Point Set Topology Notes for OU course Math 4853 Spring 2011 A. Miller 1. Introduction. The definitions of metric space and topological space were developed in the early 1900 s, largely

4.4 The recursion-tree method

4.4 The recursion-tree method Let us see how a recursion tree would provide a good guess for the recurrence = 3 4 ) Start by nding an upper bound Floors and ceilings usually do not matter when solving

Reliability Guarantees in Automata Based Scheduling for Embedded Control Software

1 Reliability Guarantees in Automata Based Scheduling for Embedded Control Software Santhosh Prabhu, Aritra Hazra, Pallab Dasgupta Department of CSE, IIT Kharagpur West Bengal, India - 721302. Email: {santhosh.prabhu,

CBV Semantics (Draft) Navit Fedida, John Havlicek, Nissan Levi, and Hillel Miller Motorola, Inc. 7700 W. Parmer Lane Austin, TX 78729 13 January 2002 Abstract A precise denition is given of the semantics

On closed-form solutions of a resource allocation problem in parallel funding of R&D projects

Operations Research Letters 27 (2000) 229 234 www.elsevier.com/locate/dsw On closed-form solutions of a resource allocation problem in parallel funding of R&D proects Ulku Gurler, Mustafa. C. Pnar, Mohamed

x a x 2 (1 + x 2 ) n.

Limits and continuity Suppose that we have a function f : R R. Let a R. We say that f(x) tends to the limit l as x tends to a; lim f(x) = l ; x a if, given any real number ɛ > 0, there exists a real number

Monitoring Metric First-order Temporal Properties

Monitoring Metric First-order Temporal Properties DAVID BASIN, FELIX KLAEDTKE, SAMUEL MÜLLER, and EUGEN ZĂLINESCU, ETH Zurich Runtime monitoring is a general approach to verifying system properties at

Adaptive Online Gradient Descent Peter L Bartlett Division of Computer Science Department of Statistics UC Berkeley Berkeley, CA 94709 bartlett@csberkeleyedu Elad Hazan IBM Almaden Research Center 650

Feature Specification and Automated Conflict Detection

Feature Specification and Automated Conflict Detection AMY P. FELTY University of Ottawa and KEDAR S. NAMJOSHI Bell Laboratories Large software systems, especially in the telecommunications field, are

NOTES ON MEASURE THEORY. M. Papadimitrakis Department of Mathematics University of Crete. Autumn of 2004

NOTES ON MEASURE THEORY M. Papadimitrakis Department of Mathematics University of Crete Autumn of 2004 2 Contents 1 σ-algebras 7 1.1 σ-algebras............................... 7 1.2 Generated σ-algebras.........................

2.1 Complexity Classes

15-859(M): Randomized Algorithms Lecturer: Shuchi Chawla Topic: Complexity classes, Identity checking Date: September 15, 2004 Scribe: Andrew Gilpin 2.1 Complexity Classes In this lecture we will look

Introduction to Software Verification

Introduction to Software Verification Orna Grumberg Lectures Material winter 2013-14 Lecture 4 5.11.13 Model Checking Automated formal verification: A different approach to formal verification Model Checking

Ordered rewriting and unfailing completion techniques have been introduced in Ref. 6 and successfully applied for deciding (or, in general, semi-decid

SOLVING SYMBOLIC ORDERING CONSTRAINTS HUBERT COMON y CNRS and Laboratoire de Recherche en Informatique Bat. 490, Universite de Paris Sud, 91405 ORSAY cedex, France. comon@sun8.lri.fr Received Revised ABSTRACT

Regular Languages and Finite Automata

Regular Languages and Finite Automata 1 Introduction Hing Leung Department of Computer Science New Mexico State University Sep 16, 2010 In 1943, McCulloch and Pitts [4] published a pioneering work on a

Chapter 7. Continuity

Chapter 7 Continuity There are many processes and eects that depends on certain set of variables in such a way that a small change in these variables acts as small change in the process. Changes of this

CS787: Advanced Algorithms Topic: Online Learning Presenters: David He, Chris Hopman 17.3.1 Follow the Perturbed Leader 17.3.1.1 Prediction Problem Recall the prediction problem that we discussed in class.

A simple criterion on degree sequences of graphs

Discrete Applied Mathematics 156 (2008) 3513 3517 Contents lists available at ScienceDirect Discrete Applied Mathematics journal homepage: www.elsevier.com/locate/dam Note A simple criterion on degree

Formal Verification Methods 3: Model Checking

Formal Verification Methods 3: Model Checking John Harrison Intel Corporation Marktoberdorf 2003 Fri 1st August 2003 (11:25 12:10) This presentation was not given in Marktoberdorf since it mostly duplicates

ALMOST COMMON PRIORS 1. INTRODUCTION

ALMOST COMMON PRIORS ZIV HELLMAN ABSTRACT. What happens when priors are not common? We introduce a measure for how far a type space is from having a common prior, which we term prior distance. If a type

x 2 f 2 e 1 e 4 e 3 e 2 q f 4 x 4 f 3 x 3

Karl-Franzens-Universitat Graz & Technische Universitat Graz SPEZIALFORSCHUNGSBEREICH F 003 OPTIMIERUNG und KONTROLLE Projektbereich DISKRETE OPTIMIERUNG O. Aichholzer F. Aurenhammer R. Hainz New Results

PLANT CONV 1 CONV 2. Digital Control Automaton

A Logical Approach to Specication of Hybrid Systems M. V. Korovina 1 and O. V. Kudinov 2 1 Insitute of Informatics Systems, Lavrent'ev pr., 6, Novosibirsk, Russia, email: rita@ssc.nsu.ru 2 Institute of

Partitioning edge-coloured complete graphs into monochromatic cycles and paths

arxiv:1205.5492v1 [math.co] 24 May 2012 Partitioning edge-coloured complete graphs into monochromatic cycles and paths Alexey Pokrovskiy Departement of Mathematics, London School of Economics and Political

Topology-based network security

Topology-based network security Tiit Pikma Supervised by Vitaly Skachek Research Seminar in Cryptography University of Tartu, Spring 2013 1 Introduction In both wired and wireless networks, there is the

A first step towards modeling semistructured data in hybrid multimodal logic

A first step towards modeling semistructured data in hybrid multimodal logic Nicole Bidoit * Serenella Cerrito ** Virginie Thion * * LRI UMR CNRS 8623, Université Paris 11, Centre d Orsay. ** LaMI UMR

A simple algorithm with no simple verication

A simple algorithm with no simple verication Laszlo Csirmaz Central European University Abstract The correctness of a simple sorting algorithm is resented, which algorithm is \evidently wrong" at the rst

Measure Theory. Jesus Fernandez-Villaverde University of Pennsylvania

Measure Theory Jesus Fernandez-Villaverde University of Pennsylvania 1 Why Bother with Measure Theory? Kolmogorov (1933). Foundation of modern probability. Deals easily with: 1. Continuous versus discrete

A Lower Bound for Area{Universal Graphs. K. Mehlhorn { Abstract. We establish a lower bound on the eciency of area{universal circuits.

A Lower Bound for Area{Universal Graphs Gianfranco Bilardi y Shiva Chaudhuri z Devdatt Dubhashi x K. Mehlhorn { Abstract We establish a lower bound on the eciency of area{universal circuits. The area A

Using Patterns and Composite Propositions to Automate the Generation of Complex LTL

University of Texas at El Paso DigitalCommons@UTEP Departmental Technical Reports (CS) Department of Computer Science 8-1-2007 Using Patterns and Composite Propositions to Automate the Generation of Complex

Chap2: The Real Number System (See Royden pp40)

Chap2: The Real Number System (See Royden pp40) 1 Open and Closed Sets of Real Numbers The simplest sets of real numbers are the intervals. We define the open interval (a, b) to be the set (a, b) = {x

Bisimulation and Logical Preservation for Continuous-Time Markov Decision Processes

Bisimulation and Logical Preservation for Continuous-Time Markov Decision Processes Martin R. Neuhäußer 1,2 Joost-Pieter Katoen 1,2 1 RWTH Aachen University, Germany 2 University of Twente, The Netherlands

Fixed-Point Logics and Computation

1 Fixed-Point Logics and Computation Symposium on the Unusual Effectiveness of Logic in Computer Science University of Cambridge 2 Mathematical Logic Mathematical logic seeks to formalise the process of

The Relative Worst Order Ratio for On-Line Algorithms

The Relative Worst Order Ratio for On-Line Algorithms Joan Boyar 1 and Lene M. Favrholdt 2 1 Department of Mathematics and Computer Science, University of Southern Denmark, Odense, Denmark, joan@imada.sdu.dk

A CTL-Based Logic for Program Abstractions

A CTL-Based Logic for Program Abstractions Martin Lange 1 and Markus Latte 2 1 Dept. of Computer Science, University of Kassel, Germany 2 Dept. of Computer Science, Ludwig-Maximilians-University Munich,

CARDINALITY, COUNTABLE AND UNCOUNTABLE SETS PART ONE

CARDINALITY, COUNTABLE AND UNCOUNTABLE SETS PART ONE With the notion of bijection at hand, it is easy to formalize the idea that two finite sets have the same number of elements: we just need to verify

Lecture 1: Course overview, circuits, and formulas

Lecture 1: Course overview, circuits, and formulas Topics in Complexity Theory and Pseudorandomness (Spring 2013) Rutgers University Swastik Kopparty Scribes: John Kim, Ben Lund 1 Course Information Swastik

Induction. Margaret M. Fleck. 10 October These notes cover mathematical induction and recursive definition

Induction Margaret M. Fleck 10 October 011 These notes cover mathematical induction and recursive definition 1 Introduction to induction At the start of the term, we saw the following formula for computing

The Goldberg Rao Algorithm for the Maximum Flow Problem

The Goldberg Rao Algorithm for the Maximum Flow Problem COS 528 class notes October 18, 2006 Scribe: Dávid Papp Main idea: use of the blocking flow paradigm to achieve essentially O(min{m 2/3, n 1/2 }

CHAPTER 7 GENERAL PROOF SYSTEMS

CHAPTER 7 GENERAL PROOF SYSTEMS 1 Introduction Proof systems are built to prove statements. They can be thought as an inference machine with special statements, called provable statements, or sometimes

Bounded-width QBF is PSPACE-complete

Bounded-width QBF is PSPACE-complete Albert Atserias 1 and Sergi Oliva 2 1 Universitat Politècnica de Catalunya Barcelona, Spain atserias@lsi.upc.edu 2 Universitat Politècnica de Catalunya Barcelona, Spain

Optimal Index Codes for a Class of Multicast Networks with Receiver Side Information

Optimal Index Codes for a Class of Multicast Networks with Receiver Side Information Lawrence Ong School of Electrical Engineering and Computer Science, The University of Newcastle, Australia Email: lawrence.ong@cantab.net

Algorithmic Software Verification

Algorithmic Software Verification (LTL Model Checking) Azadeh Farzan What is Verification Anyway? Proving (in a formal way) that program satisfies a specification written in a logical language. Formal

1.1 Related work For non-preemptive scheduling on uniformly related machines the rst algorithm with a constant competitive ratio was given by Aspnes e

A Lower Bound for On-Line Scheduling on Uniformly Related Machines Leah Epstein Jir Sgall September 23, 1999 lea@math.tau.ac.il, Department of Computer Science, Tel-Aviv University, Israel; sgall@math.cas.cz,

The Generalized Railroad Crossing: A Case Study in Formal. Abstract

The Generalized Railroad Crossing: A Case Study in Formal Verication of Real-Time Systems Constance Heitmeyer Nancy Lynch y Abstract A new solution to the Generalized Railroad Crossing problem, based on