Safety First: A Two-Stage Algorithm for LTL Games Saqib Sohail - - PowerPoint PPT Presentation

▶
safety first a two stage algorithm for ltl games
SMART_READER_LITE
LIVE PREVIEW

Safety First: A Two-Stage Algorithm for LTL Games Saqib Sohail - - PowerPoint PPT Presentation

Nov 13, 2023 49 likes •1.29k views

Introduction Games Two Stage Synthesis Results Conclusions Safety First: A Two-Stage Algorithm for LTL Games Saqib Sohail Fabio Somenzi Department of Electrical and Computer Engineering University of Colorado at Boulder FMCAD 2009 Safety

slide-1
SLIDE 1

Introduction Games Two Stage Synthesis Results Conclusions

Safety First: A Two-Stage Algorithm for LTL Games

Saqib Sohail Fabio Somenzi

Department of Electrical and Computer Engineering University of Colorado at Boulder

FMCAD 2009

Safety First: A Two-Stage Algorithm for LTL Games

slide-2
SLIDE 2

Introduction Games Two Stage Synthesis Results Conclusions

Motivation

Recently, significant algorithmic advances in the game-theoretic approach to synthesis of reactive systems has renewed interest. Piterman 06, Piterman et al 06, Kupferman et al 06, Chatterjee et al 07, Bloem et al 07 are a few examples. Despite challenges in scalability, there is increasing hope that synthesis algorithms may be applied to the design and diagnosis

  • f intricate, safety critical protocols.

The focus will be on how to avoid some of these challenges without any compromises.

Safety First: A Two-Stage Algorithm for LTL Games

slide-3
SLIDE 3

Introduction Games Two Stage Synthesis Results Conclusions

Motivation

Recently, significant algorithmic advances in the game-theoretic approach to synthesis of reactive systems has renewed interest. Piterman 06, Piterman et al 06, Kupferman et al 06, Chatterjee et al 07, Bloem et al 07 are a few examples. Despite challenges in scalability, there is increasing hope that synthesis algorithms may be applied to the design and diagnosis

  • f intricate, safety critical protocols.

The focus will be on how to avoid some of these challenges without any compromises.

Safety First: A Two-Stage Algorithm for LTL Games

slide-4
SLIDE 4

Introduction Games Two Stage Synthesis Results Conclusions

Motivation

Recently, significant algorithmic advances in the game-theoretic approach to synthesis of reactive systems has renewed interest. Piterman 06, Piterman et al 06, Kupferman et al 06, Chatterjee et al 07, Bloem et al 07 are a few examples. Despite challenges in scalability, there is increasing hope that synthesis algorithms may be applied to the design and diagnosis

  • f intricate, safety critical protocols.

The focus will be on how to avoid some of these challenges without any compromises.

Safety First: A Two-Stage Algorithm for LTL Games

slide-5
SLIDE 5

Introduction Games Two Stage Synthesis Results Conclusions

Outline

1 Introduction 2 Games 3 Two Stage Synthesis

The Challenge Algorithm Optimizations Implementation Caveats

4 Results 5 Conclusions

Safety First: A Two-Stage Algorithm for LTL Games

slide-6
SLIDE 6

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

Automatically build design from specification Input:

Set of LTL formulae, e.g. G(req → F ack), G(¬req → X(¬ack)) Partition of the atomic propositions (input/output signals) Environment controls inputs and system controls outputs

The set of LTL formulae are converted to a non-terminating game with system as protagonist and environment as antagonist. Output: Automatically created functionally correct finite-state machine from the winning strategy of the system.

If such strategy doesn’t exist then the specification is unrealizable.

Safety First: A Two-Stage Algorithm for LTL Games

slide-7
SLIDE 7

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

Automatically build design from specification Input:

Set of LTL formulae, e.g. G(req → F ack), G(¬req → X(¬ack)) Partition of the atomic propositions (input/output signals) Environment controls inputs and system controls outputs

The set of LTL formulae are converted to a non-terminating game with system as protagonist and environment as antagonist. Output: Automatically created functionally correct finite-state machine from the winning strategy of the system.

If such strategy doesn’t exist then the specification is unrealizable.

Safety First: A Two-Stage Algorithm for LTL Games

slide-8
SLIDE 8

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

Automatically build design from specification Input:

Set of LTL formulae, e.g. G(req → F ack), G(¬req → X(¬ack)) Partition of the atomic propositions (input/output signals) Environment controls inputs and system controls outputs

The set of LTL formulae are converted to a non-terminating game with system as protagonist and environment as antagonist. Output: Automatically created functionally correct finite-state machine from the winning strategy of the system.

If such strategy doesn’t exist then the specification is unrealizable.

Safety First: A Two-Stage Algorithm for LTL Games

slide-9
SLIDE 9

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

Automatically build design from specification Input:

Set of LTL formulae, e.g. G(req → F ack), G(¬req → X(¬ack)) Partition of the atomic propositions (input/output signals) Environment controls inputs and system controls outputs

The set of LTL formulae are converted to a non-terminating game with system as protagonist and environment as antagonist. Output: Automatically created functionally correct finite-state machine from the winning strategy of the system.

If such strategy doesn’t exist then the specification is unrealizable.

Safety First: A Two-Stage Algorithm for LTL Games

slide-10
SLIDE 10

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

The system’s intended behavior is described by combination of LTL formulae or as ω- regular automata. In a naive approach, all formulae and automata are reduced to

  • ne deterministic automaton, whose transition structure provides

the game graph. The acceptance condition is taken as the winning condition. This approach suffers from the high cost of determinization, which is prohibitive for even moderate-sized automata. How to avoid the high costs?

Safety First: A Two-Stage Algorithm for LTL Games

slide-11
SLIDE 11

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

The system’s intended behavior is described by combination of LTL formulae or as ω- regular automata. In a naive approach, all formulae and automata are reduced to

  • ne deterministic automaton, whose transition structure provides

the game graph. The acceptance condition is taken as the winning condition. This approach suffers from the high cost of determinization, which is prohibitive for even moderate-sized automata. How to avoid the high costs?

Safety First: A Two-Stage Algorithm for LTL Games

slide-12
SLIDE 12

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

The system’s intended behavior is described by combination of LTL formulae or as ω- regular automata. In a naive approach, all formulae and automata are reduced to

  • ne deterministic automaton, whose transition structure provides

the game graph. The acceptance condition is taken as the winning condition. This approach suffers from the high cost of determinization, which is prohibitive for even moderate-sized automata. How to avoid the high costs?

Safety First: A Two-Stage Algorithm for LTL Games

slide-13
SLIDE 13

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

The system’s intended behavior is described by combination of LTL formulae or as ω- regular automata. In a naive approach, all formulae and automata are reduced to

  • ne deterministic automaton, whose transition structure provides

the game graph. The acceptance condition is taken as the winning condition. This approach suffers from the high cost of determinization, which is prohibitive for even moderate-sized automata. How to avoid the high costs?

Safety First: A Two-Stage Algorithm for LTL Games

slide-14
SLIDE 14

Introduction Games Two Stage Synthesis Results Conclusions

LTL Synthesis - Pnueli and Rosner (POPL’89)

The system’s intended behavior is described by combination of LTL formulae or as ω- regular automata. In a naive approach, all formulae and automata are reduced to

  • ne deterministic automaton, whose transition structure provides

the game graph. The acceptance condition is taken as the winning condition. This approach suffers from the high cost of determinization, which is prohibitive for even moderate-sized automata. How to avoid the high costs?

Safety First: A Two-Stage Algorithm for LTL Games

slide-15
SLIDE 15

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game graph with a parity acceptance condition

player0 → wins if largest integer

  • ccuring infinitely often

is even player1 → wins if largest integer

  • ccuring infinitely often

is odd

Safety First: A Two-Stage Algorithm for LTL Games

slide-16
SLIDE 16

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game graph with a parity acceptance condition

player0 → wins if largest integer

  • ccuring infinitely often

is even player1 → wins if largest integer

  • ccuring infinitely often

is odd

Safety First: A Two-Stage Algorithm for LTL Games

slide-17
SLIDE 17

Introduction Games Two Stage Synthesis Results Conclusions

Game Graphs

A game graph G = ((S, E), S0, S1) is a directed graph (S, E) with a finite state space S, a set of edges E and a partition (S0, S1) of the state space belonging to player 0 and 1 respectively. We assume that every state has an outgoing edge. The game is started by placing a token in one of the Sinit and then this token is moved along the edges, when the token is in a state s ∈ S1, player 1 selects one of its outgoing edges and vice-versa. The result is an infinite path in the game graph termed as a play. A strategy for a player is a recipe that specifies how to extend finite path. Formally strategy for player i is a function σ : S∗.Si → S.

Safety First: A Two-Stage Algorithm for LTL Games

slide-18
SLIDE 18

Introduction Games Two Stage Synthesis Results Conclusions

Parity Game

For a game graph G = (Q, E) and a parity function π : Q → [k], a parity acceptance condition requires that the maximal π(s)

  • ccuring infinitely often is odd (even) for player1(0).

A generalized parity game for a game graph G = (Q, E) and a set of parity functions {πi|πi : Q → [ki]} is played between the conjunctive and disjunctive player. The conjunctive player wins if it has a strategy to win all the parity acceptance conditions while the disjunctive player wins if it has a strategy for some parity acceptance condition.

Safety First: A Two-Stage Algorithm for LTL Games

slide-19
SLIDE 19

Introduction Games Two Stage Synthesis Results Conclusions

Parity Game

For a game graph G = (Q, E) and a parity function π : Q → [k], a parity acceptance condition requires that the maximal π(s)

  • ccuring infinitely often is odd (even) for player1(0).

A generalized parity game for a game graph G = (Q, E) and a set of parity functions {πi|πi : Q → [ki]} is played between the conjunctive and disjunctive player. The conjunctive player wins if it has a strategy to win all the parity acceptance conditions while the disjunctive player wins if it has a strategy for some parity acceptance condition.

Safety First: A Two-Stage Algorithm for LTL Games

slide-20
SLIDE 20

Introduction Games Two Stage Synthesis Results Conclusions

Two Game Theoretic Approaches

The standard approach which is the focus of this talk, requires the determinization of word automata. LTL → NBW → DRW The Safraless Approach avoids determinization by working with Tree Automata. LTL → NGBW →

realizability

UGCW →

lang−empt

UGCT →

  • ptimistic−reduction

NBT

Safety First: A Two-Stage Algorithm for LTL Games

slide-21
SLIDE 21

Introduction Games Two Stage Synthesis Results Conclusions

Two Game Theoretic Approaches

The standard approach which is the focus of this talk, requires the determinization of word automata. LTL → NBW → DRW The Safraless Approach avoids determinization by working with Tree Automata. LTL → NGBW →

realizability

UGCW →

lang−empt

UGCT →

  • ptimistic−reduction

NBT

Safety First: A Two-Stage Algorithm for LTL Games

slide-22
SLIDE 22

Introduction Games Two Stage Synthesis Results Conclusions

Specification of a simple 2-Client Arbiter

Initially there are no acknowledgments. ¬ack0 ∧ ¬ack1 The acknowledgmnets are mutually exclusive. G(¬ack0 ∨ ¬ack1) There are no spurious acknowledgmnets. ∀i . G(¬reqi → X(¬acki)) Every request will eventually be acknowledged ∀i . G(reqi → F acki)

Safety First: A Two-Stage Algorithm for LTL Games

slide-23
SLIDE 23

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game Graph and Synthesized Strategy

Safety First: A Two-Stage Algorithm for LTL Games

slide-24
SLIDE 24

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game Graph and Synthesized Strategy

Safety First: A Two-Stage Algorithm for LTL Games

slide-25
SLIDE 25

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-26
SLIDE 26

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-27
SLIDE 27

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-28
SLIDE 28

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-29
SLIDE 29

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-30
SLIDE 30

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-31
SLIDE 31

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-32
SLIDE 32

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-33
SLIDE 33

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-34
SLIDE 34

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-35
SLIDE 35

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-36
SLIDE 36

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-37
SLIDE 37

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-38
SLIDE 38

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-39
SLIDE 39

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-40
SLIDE 40

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-41
SLIDE 41

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-42
SLIDE 42

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-43
SLIDE 43

Introduction Games Two Stage Synthesis Results Conclusions

Example: Game play & Strategy Computation for Player 1

[Player 1] wins if the maximal π(s) occuring infinitely often is odd.

Safety First: A Two-Stage Algorithm for LTL Games

slide-44
SLIDE 44

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-45
SLIDE 45

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-46
SLIDE 46

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-47
SLIDE 47

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-48
SLIDE 48

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-49
SLIDE 49

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-50
SLIDE 50

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-51
SLIDE 51

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-52
SLIDE 52

Introduction Games Two Stage Synthesis Results Conclusions

Example: Generalized Parity Game

[Conjunctive Player] wins if it has a strategy to win all the parity functions [Disjunctive Player] wins if it has a strategy to win according to some parity function

Safety First: A Two-Stage Algorithm for LTL Games

slide-53
SLIDE 53

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Outline

1 Introduction 2 Games 3 Two Stage Synthesis

The Challenge Algorithm Optimizations Implementation Caveats

4 Results 5 Conclusions

Safety First: A Two-Stage Algorithm for LTL Games

slide-54
SLIDE 54

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

The Challenge

Generalized parity game is an NP-Complete problem and the current algorithm (Chatterjee et. al 07) is computationally very expensive. Is there a simpler solution to the complex problem? Is there a way to deal with properties one at a time?

Safety First: A Two-Stage Algorithm for LTL Games

slide-55
SLIDE 55

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

The Challenge

Generalized parity game is an NP-Complete problem and the current algorithm (Chatterjee et. al 07) is computationally very expensive. Is there a simpler solution to the complex problem? Is there a way to deal with properties one at a time?

Safety First: A Two-Stage Algorithm for LTL Games

slide-56
SLIDE 56

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

The Challenge

Generalized parity game is an NP-Complete problem and the current algorithm (Chatterjee et. al 07) is computationally very expensive. Is there a simpler solution to the complex problem? Is there a way to deal with properties one at a time?

Safety First: A Two-Stage Algorithm for LTL Games

slide-57
SLIDE 57

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Safety Properties

A safety condition for a game graph G = (Q, E) is a function π : Q → {0, 1} such that there is no transition (u, v) ∈ E such that π(u) = 0 and π(v) = 1.

Safety First: A Two-Stage Algorithm for LTL Games

slide-58
SLIDE 58

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Safety Properties

A safety condition for a game graph G = (Q, E) is a function π : Q → {0, 1} such that there is no transition (u, v) ∈ E such that π(u) = 0 and π(v) = 1.

Safety First: A Two-Stage Algorithm for LTL Games

slide-59
SLIDE 59

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Persistence Properties

A persistence condition for a game graph G = (Q, E) is a function π : Q → {1, 2}.

Safety First: A Two-Stage Algorithm for LTL Games

slide-60
SLIDE 60

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

The Claim

What is so unique about persistence properties? The winning states for persistence properties can be categorized into persistent and transient states. The computation of strategies is not necessary when we are only interested in determining the persistent and transient states. A transient state will stay a transient state for the subsequent games.

Safety First: A Two-Stage Algorithm for LTL Games

slide-61
SLIDE 61

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

The Claim

What is so unique about persistence properties? The winning states for persistence properties can be categorized into persistent and transient states. The computation of strategies is not necessary when we are only interested in determining the persistent and transient states. A transient state will stay a transient state for the subsequent games.

Safety First: A Two-Stage Algorithm for LTL Games

slide-62
SLIDE 62

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

The Claim

What is so unique about persistence properties? The winning states for persistence properties can be categorized into persistent and transient states. The computation of strategies is not necessary when we are only interested in determining the persistent and transient states. A transient state will stay a transient state for the subsequent games.

Safety First: A Two-Stage Algorithm for LTL Games

slide-63
SLIDE 63

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

The Claim

What is so unique about persistence properties? The winning states for persistence properties can be categorized into persistent and transient states. The computation of strategies is not necessary when we are only interested in determining the persistent and transient states. A transient state will stay a transient state for the subsequent games.

Safety First: A Two-Stage Algorithm for LTL Games

slide-64
SLIDE 64

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Input/Output based game → State based game

Safety First: A Two-Stage Algorithm for LTL Games

slide-65
SLIDE 65

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-66
SLIDE 66

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-67
SLIDE 67

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-68
SLIDE 68

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-69
SLIDE 69

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-70
SLIDE 70

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-71
SLIDE 71

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-72
SLIDE 72

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-73
SLIDE 73

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-74
SLIDE 74

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-75
SLIDE 75

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-76
SLIDE 76

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-77
SLIDE 77

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-78
SLIDE 78

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-79
SLIDE 79

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-80
SLIDE 80

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-81
SLIDE 81

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-82
SLIDE 82

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-83
SLIDE 83

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

How significant is the improvement?

The complexity of “classical” algorithm of (Chatterjee et al 07) is given by O(m · n2d) ·

  • d

d1, d2, . . . , dk

  • ,

di = ⌈ki/2⌉ If πk is a safety condition, solving the game in two stages leads to a better bound for the second stage, O(m · n2d−2) ·

  • d−1

d1,...,dk−1

  • ,

while the first stage runs in O(m · n2). In practice, in the second stage, the number of transitions may decrease, and the removal of losing positions for π1 may reduce the number of colors in the remaining conditions.

Safety First: A Two-Stage Algorithm for LTL Games

slide-84
SLIDE 84

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

How significant is the improvement?

The complexity of “classical” algorithm of (Chatterjee et al 07) is given by O(m · n2d) ·

  • d

d1, d2, . . . , dk

  • ,

di = ⌈ki/2⌉ If πk is a safety condition, solving the game in two stages leads to a better bound for the second stage, O(m · n2d−2) ·

  • d−1

d1,...,dk−1

  • ,

while the first stage runs in O(m · n2). In practice, in the second stage, the number of transitions may decrease, and the removal of losing positions for π1 may reduce the number of colors in the remaining conditions.

Safety First: A Two-Stage Algorithm for LTL Games

slide-85
SLIDE 85

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Outline

1 Introduction 2 Games 3 Two Stage Synthesis

The Challenge Algorithm Optimizations Implementation Caveats

4 Results 5 Conclusions

Safety First: A Two-Stage Algorithm for LTL Games

slide-86
SLIDE 86

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Methodology

Identify the safety/persistent properties in the specification. Translate each property into a deterministic automaton. Compose the automaton with already existing game-graph and then playing the 2-player game on the relevant section of the graph. Determinize all the remaining non-safety/non-persistent properties and then compose with the game-graph and play the final generalized parity game on the relevant section of the graph. Select an appropriate strategy which in conjunction with the property automata can be translated into software/hardware.

Safety First: A Two-Stage Algorithm for LTL Games

slide-87
SLIDE 87

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Methodology

Identify the safety/persistent properties in the specification. Translate each property into a deterministic automaton. Compose the automaton with already existing game-graph and then playing the 2-player game on the relevant section of the graph. Determinize all the remaining non-safety/non-persistent properties and then compose with the game-graph and play the final generalized parity game on the relevant section of the graph. Select an appropriate strategy which in conjunction with the property automata can be translated into software/hardware.

Safety First: A Two-Stage Algorithm for LTL Games

slide-88
SLIDE 88

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Methodology

Identify the safety/persistent properties in the specification. Translate each property into a deterministic automaton. Compose the automaton with already existing game-graph and then playing the 2-player game on the relevant section of the graph. Determinize all the remaining non-safety/non-persistent properties and then compose with the game-graph and play the final generalized parity game on the relevant section of the graph. Select an appropriate strategy which in conjunction with the property automata can be translated into software/hardware.

Safety First: A Two-Stage Algorithm for LTL Games

slide-89
SLIDE 89

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Methodology

Identify the safety/persistent properties in the specification. Translate each property into a deterministic automaton. Compose the automaton with already existing game-graph and then playing the 2-player game on the relevant section of the graph. Determinize all the remaining non-safety/non-persistent properties and then compose with the game-graph and play the final generalized parity game on the relevant section of the graph. Select an appropriate strategy which in conjunction with the property automata can be translated into software/hardware.

Safety First: A Two-Stage Algorithm for LTL Games

slide-90
SLIDE 90

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Methodology

Identify the safety/persistent properties in the specification. Translate each property into a deterministic automaton. Compose the automaton with already existing game-graph and then playing the 2-player game on the relevant section of the graph. Determinize all the remaining non-safety/non-persistent properties and then compose with the game-graph and play the final generalized parity game on the relevant section of the graph. Select an appropriate strategy which in conjunction with the property automata can be translated into software/hardware.

Safety First: A Two-Stage Algorithm for LTL Games

slide-91
SLIDE 91

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Algorithm

1. SAFETY-FIRST(G, SPECIFICATION) 2. (SAFETY, NON − PERSISTENT) ← SPECIFICATION 3. foreach ϕ ∈ SAFETY 3.1 G = G automatonϕ

det

3.2 (Qsys, Esys) ← CHATTERJEE(G, ϕ) 3.3 (Qnew, Enew) ← OPTIMIZE(Qsys, Esys) 3.4 G = (Qnew, Enew) end foreach 4. foreach ϕ ∈ NON − PERSISTENT 4.1 G = G automatonϕ

det

end foreach 5 (Qsys, Esys, σsys) ← CHATTERJEE(G, ϕ1, ϕ2..., ϕn) 6 SYNTHESIZE(Qsys, Esys, σsys)

Safety First: A Two-Stage Algorithm for LTL Games

slide-92
SLIDE 92

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Algorithm

1. SAFETY-FIRST(G, SPECIFICATION) 2. (SAFETY, NON − PERSISTENT) ← SPECIFICATION 3. foreach ϕ ∈ SAFETY 3.1 G = G automatonϕ

det

3.2 (Qsys, Esys) ← CHATTERJEE(G, ϕ) 3.3 (Qnew, Enew) ← OPTIMIZE(Qsys, Esys) 3.4 G = (Qnew, Enew) end foreach 4. foreach ϕ ∈ NON − PERSISTENT 4.1 G = G automatonϕ

det

end foreach 5 (Qsys, Esys, σsys) ← CHATTERJEE(G, ϕ1, ϕ2..., ϕn) 6 SYNTHESIZE(Qsys, Esys, σsys)

Safety First: A Two-Stage Algorithm for LTL Games

slide-93
SLIDE 93

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Algorithm

1. SAFETY-FIRST(G, SPECIFICATION) 2. (SAFETY, NON − PERSISTENT) ← SPECIFICATION 3. foreach ϕ ∈ SAFETY 3.1 G = G automatonϕ

det

3.2 (Qsys, Esys) ← CHATTERJEE(G, ϕ) 3.3 (Qnew, Enew) ← OPTIMIZE(Qsys, Esys) 3.4 G = (Qnew, Enew) end foreach 4. foreach ϕ ∈ NON − PERSISTENT 4.1 G = G automatonϕ

det

end foreach 5 (Qsys, Esys, σsys) ← CHATTERJEE(G, ϕ1, ϕ2..., ϕn) 6 SYNTHESIZE(Qsys, Esys, σsys)

Safety First: A Two-Stage Algorithm for LTL Games

slide-94
SLIDE 94

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Algorithm

1. SAFETY-FIRST(G, SPECIFICATION) 2. (SAFETY, NON − PERSISTENT) ← SPECIFICATION 3. foreach ϕ ∈ SAFETY 3.1 G = G automatonϕ

det

3.2 (Qsys, Esys) ← CHATTERJEE(G, ϕ) 3.3 (Qnew, Enew) ← OPTIMIZE(Qsys, Esys) 3.4 G = (Qnew, Enew) end foreach 4. foreach ϕ ∈ NON − PERSISTENT 4.1 G = G automatonϕ

det

end foreach 5 (Qsys, Esys, σsys) ← CHATTERJEE(G, ϕ1, ϕ2..., ϕn) 6 SYNTHESIZE(Qsys, Esys, σsys)

Safety First: A Two-Stage Algorithm for LTL Games

slide-95
SLIDE 95

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Algorithm

1. SAFETY-FIRST(G, SPECIFICATION) 2. (SAFETY, NON − PERSISTENT) ← SPECIFICATION 3. foreach ϕ ∈ SAFETY 3.1 G = G automatonϕ

det

3.2 (Qsys, Esys) ← CHATTERJEE(G, ϕ) 3.3 (Qnew, Enew) ← OPTIMIZE(Qsys, Esys) 3.4 G = (Qnew, Enew) end foreach 4. foreach ϕ ∈ NON − PERSISTENT 4.1 G = G automatonϕ

det

end foreach 5 (Qsys, Esys, σsys) ← CHATTERJEE(G, ϕ1, ϕ2..., ϕn) 6 SYNTHESIZE(Qsys, Esys, σsys)

Safety First: A Two-Stage Algorithm for LTL Games

slide-96
SLIDE 96

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Algorithm

1. SAFETY-FIRST(G, SPECIFICATION) 2. (SAFETY, NON − PERSISTENT) ← SPECIFICATION 3. foreach ϕ ∈ SAFETY 3.1 G = G automatonϕ

det

3.2 (Qsys, Esys) ← CHATTERJEE(G, ϕ) 3.3 (Qnew, Enew) ← OPTIMIZE(Qsys, Esys) 3.4 G = (Qnew, Enew) end foreach 4. foreach ϕ ∈ NON − PERSISTENT 4.1 G = G automatonϕ

det

end foreach 5 (Qsys, Esys, σsys) ← CHATTERJEE(G, ϕ1, ϕ2..., ϕn) 6 SYNTHESIZE(Qsys, Esys, σsys)

Safety First: A Two-Stage Algorithm for LTL Games

slide-97
SLIDE 97

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Outline

1 Introduction 2 Games 3 Two Stage Synthesis

The Challenge Algorithm Optimizations Implementation Caveats

4 Results 5 Conclusions

Safety First: A Two-Stage Algorithm for LTL Games

slide-98
SLIDE 98

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Restrict the state space with the reachable winning states. Remove the constant bits in the reachable winning state space. Find dependencies between state-variables and remove the dependant variables. (Efficiently re-encode the state space).

Safety First: A Two-Stage Algorithm for LTL Games

slide-99
SLIDE 99

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Restrict the state space with the reachable winning states. Remove the constant bits in the reachable winning state space. Find dependencies between state-variables and remove the dependant variables. (Efficiently re-encode the state space).

Safety First: A Two-Stage Algorithm for LTL Games

slide-100
SLIDE 100

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Restrict the state space with the reachable winning states. Remove the constant bits in the reachable winning state space. Find dependencies between state-variables and remove the dependant variables. (Efficiently re-encode the state space).

Safety First: A Two-Stage Algorithm for LTL Games

slide-101
SLIDE 101

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Restrict the state space with the reachable winning states. Remove the constant bits in the reachable winning state space. Find dependencies between state-variables and remove the dependant variables. (Efficiently re-encode the state space).

Safety First: A Two-Stage Algorithm for LTL Games

slide-102
SLIDE 102

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Outline

1 Introduction 2 Games 3 Two Stage Synthesis

The Challenge Algorithm Optimizations Implementation Caveats

4 Results 5 Conclusions

Safety First: A Two-Stage Algorithm for LTL Games

slide-103
SLIDE 103

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Implementation

The LTL formula is determinized by the tool Wring using explicit state based translation. It is able to detect persistence properties and determinizes them using subset-construction

  • therwise uses Piterman’s determinization procedure.

Chatterjee’s algorithm for generalized-parity games has been implemented in VIS which uses BDDs for internal representation and computation. The game-graph is represented as an input-based game but the algorithm virtually converts it into a turn-based game.

Safety First: A Two-Stage Algorithm for LTL Games

slide-104
SLIDE 104

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Implementation

The LTL formula is determinized by the tool Wring using explicit state based translation. It is able to detect persistence properties and determinizes them using subset-construction

  • therwise uses Piterman’s determinization procedure.

Chatterjee’s algorithm for generalized-parity games has been implemented in VIS which uses BDDs for internal representation and computation. The game-graph is represented as an input-based game but the algorithm virtually converts it into a turn-based game.

Safety First: A Two-Stage Algorithm for LTL Games

slide-105
SLIDE 105

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Outline

1 Introduction 2 Games 3 Two Stage Synthesis

The Challenge Algorithm Optimizations Implementation Caveats

4 Results 5 Conclusions

Safety First: A Two-Stage Algorithm for LTL Games

slide-106
SLIDE 106

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Caveats

The game-theoretic approach in synthesizing the safety properties introduces more state variables compared to a manual implementation where the programmer can take advantage by combining internal signals. Aggressive dependency removal of state-variables has a negative impact on performance as it affects the early quantification schedule, dependencies up to 3 state variables results in enhanced performance times.

Safety First: A Two-Stage Algorithm for LTL Games

slide-107
SLIDE 107

Introduction Games Two Stage Synthesis Results Conclusions The Challenge Algorithm Optimizations Implementation Caveats

Caveats

The game-theoretic approach in synthesizing the safety properties introduces more state variables compared to a manual implementation where the programmer can take advantage by combining internal signals. Aggressive dependency removal of state-variables has a negative impact on performance as it affects the early quantification schedule, dependencies up to 3 state variables results in enhanced performance times.

Safety First: A Two-Stage Algorithm for LTL Games

slide-108
SLIDE 108

Introduction Games Two Stage Synthesis Results Conclusions

Results

Anzu (Bloem et al 07) Why Safety-First?

Full LTL. No pre-synthesis

Safety First: A Two-Stage Algorithm for LTL Games

slide-109
SLIDE 109

Introduction Games Two Stage Synthesis Results Conclusions

Results

Anzu (Bloem et al 07) Why Safety-First?

Full LTL. No pre-synthesis

Safety First: A Two-Stage Algorithm for LTL Games

slide-110
SLIDE 110

Introduction Games Two Stage Synthesis Results Conclusions

Results

Anzu (Bloem et al 07) Why Safety-First?

Full LTL. No pre-synthesis

Safety First: A Two-Stage Algorithm for LTL Games

slide-111
SLIDE 111

Introduction Games Two Stage Synthesis Results Conclusions

Results

Anzu (Bloem et al 07) Why Safety-First?

Full LTL. No pre-synthesis

Safety First: A Two-Stage Algorithm for LTL Games

slide-112
SLIDE 112

Introduction Games Two Stage Synthesis Results Conclusions

Results

Safety First: A Two-Stage Algorithm for LTL Games

slide-113
SLIDE 113

Introduction Games Two Stage Synthesis Results Conclusions

Conclusions

In practice large chunk of the Specification is of safety type. Splitting the synthesis process in two stages has opened the door for optimizations which may not affect the worst-case complexity but are practically very significant. Without loss of generality in the LTL specification, Safety-First is already competitive. Incrementally compute a good BDD order.

Safety First: A Two-Stage Algorithm for LTL Games

slide-114
SLIDE 114

Introduction Games Two Stage Synthesis Results Conclusions

Conclusions

In practice large chunk of the Specification is of safety type. Splitting the synthesis process in two stages has opened the door for optimizations which may not affect the worst-case complexity but are practically very significant. Without loss of generality in the LTL specification, Safety-First is already competitive. Incrementally compute a good BDD order.

Safety First: A Two-Stage Algorithm for LTL Games

slide-115
SLIDE 115

Introduction Games Two Stage Synthesis Results Conclusions

Conclusions

In practice large chunk of the Specification is of safety type. Splitting the synthesis process in two stages has opened the door for optimizations which may not affect the worst-case complexity but are practically very significant. Without loss of generality in the LTL specification, Safety-First is already competitive. Incrementally compute a good BDD order.

Safety First: A Two-Stage Algorithm for LTL Games

slide-116
SLIDE 116

Introduction Games Two Stage Synthesis Results Conclusions

Conclusions

In practice large chunk of the Specification is of safety type. Splitting the synthesis process in two stages has opened the door for optimizations which may not affect the worst-case complexity but are practically very significant. Without loss of generality in the LTL specification, Safety-First is already competitive. Incrementally compute a good BDD order.

Safety First: A Two-Stage Algorithm for LTL Games

slide-117
SLIDE 117

Introduction Games Two Stage Synthesis Results Conclusions

THANK YOU

Safety First: A Two-Stage Algorithm for LTL Games

slide-118
SLIDE 118

Introduction Games Two Stage Synthesis Results Conclusions

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-119
SLIDE 119

Introduction Games Two Stage Synthesis Results Conclusions

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-120
SLIDE 120

Introduction Games Two Stage Synthesis Results Conclusions

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-121
SLIDE 121

Introduction Games Two Stage Synthesis Results Conclusions

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-122
SLIDE 122

Introduction Games Two Stage Synthesis Results Conclusions

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games

slide-123
SLIDE 123

Introduction Games Two Stage Synthesis Results Conclusions

Example: Simple Arbiter revisited

Safety First: A Two-Stage Algorithm for LTL Games