 # Comparator automata in quantitative verification

The notion of comparison between system runs is fundamental in formal verification. This concept is implicitly present in the verification of qualitative systems, and is more pronounced in the verification of quantitative systems. In this work, we identify a novel mode of comparison in quantitative systems: the online comparison of the aggregate values of two sequences of quantitative weights. This notion is embodied by comparator automata ( comparators, in short), a new class of automata that read two infinite sequences of weights synchronously and relate their aggregate values. We show that aggregate functions that can be represented with Büchi automaton result in comparators that are finite-state and accept by the Büchi condition as well. Such ω-regular comparators further lead to generic algorithms for a number of well-studied problems, including the quantitative inclusion and winning strategies in quantitative graph games with incomplete information, as well as related non-decision problems, such as obtaining a finite representation of all counterexamples in the quantitative inclusion problem. We study comparators for two aggregate functions: discounted-sum and limit-average. We prove that the discounted-sum comparator is ω-regular iff the discount-factor is an integer. Not every aggregate function, however, has an ω-regular comparator. Specifically, we show that the language of sequence-pairs for which limit-average aggregates exist is neither ω-regular nor ω-context-free. Given this result, we introduce the notion of prefix-average as a relaxation of limit-average aggregation, and show that it admits ω-context-free comparators.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1. Introduction

Many classic questions in formal methods can be seen as involving comparisons between different system runs or inputs. Consider the problem of verifying if a system satisfies a linear-time temporal property . Traditionally, this problem is phrased language-theoretically: and are interpreted as sets of (infinite) words, and is determined to satisfy if . The problem, however, can also be framed in terms of a comparison between words in and . Suppose a word is assigned a weight of 1 if it belongs to the language of the system or property, and 0 otherwise. Then determining if amounts to checking whether the weight of every word in is less than or equal to its weight in  .

The need for such a formulation is clearer in quantitative systems, in which every run of a word is associated with a sequence of (rational-valued) weights. The weight of a run is given by aggregate function , which returns the real-valued aggregate value of the run’s weight sequence. The weight of a word is given by the supremum or infimum of the weight of all its runs. Common examples of aggregate functions include discounted-sum and limit-average.

In a well-studied class of problems involving quantitative systems, the objective is to check if the aggregate value of words of a system exceed a constant threshold value [15, 16, 17]

. This is a natural generalization of emptiness problems in qualitative systems. Known solutions to the problem involve arithmetic reasoning via linear programming and graph algorithms such as negative-weight cycle detection, computation of maximum weight of cycles etc

[4, 19].

A more general notion of comparison relates aggregate values of two weight sequences. Such a notion arises in the quantitative inclusion problem for weighted automata , where the goal is to determine whether the weight of words in one weighted automaton is less than that in another. Here it is necessary to compare the aggregate value along runs between the two automata. Approaches based on arithmetic reasoning do not, however, generalize to solving such problems. In fact, the known solution to discounted-sum inclusion with integer discount-factor combines linear programming with a specialized subset-construction-based determinization step, rendering an EXPTIME algorithm [4, 7]. Yet, this approach does not match the PSPACE lower bound for discounted-sum inclusion.

In this paper, we present an automata-theoretic formulation of this form of comparison between weighted sequences. Specifically, we introduce comparator automata (comparators, in short), a class of automata that read pairs of infinite weight sequences synchronously, and compare their aggregate values in an online manner. While comparisons between weight sequences happen implicitly in prior approaches to quantitative systems, comparator automata make these comparisons explicit. We show that this has many benefits, including generic algorithms for a large class of quantitative reasoning problems, as well as a direct solution to the problem of discounted-sum inclusion that also closes its complexity gap.

A comparator for aggregate function for relation is an automaton that accepts a pair of sequences of bounded rational numbers iff , where is an inequality relation (, , , , ) or the equality relation . A comparator could be finite-state or (pushdown) infinite-state. This paper studies such comparators.

A comparator is -regular if it is finite-state and accepts by the Büchi condition. We relate -regular comparators to -regular aggregate functions , and show that -regular aggregate-functions entail -regular comparators. However, the other direction is still open: Does an -regular comparator for an aggregate function and a relation imply that the aggregate function is also -regular? Furthermore, we show that -regular comparators lead to generic algorithms for a number of well-studied problems including the quantitative inclusion problem, and in showing existence of winning strategies in incomplete-information quantitative games. Our algorithm yields PSPACE-completeness of quantitative inclusion when the -regular comparator is provided. The same algorithm extends to obtaining finite-state representations of counterexample words in inclusion.

Next, we show that the discounted-sum aggregation function admits an -regular comparator for all relations iff the discount-factor is an integer. We use this result to prove that discounted-sum aggregate function for discount-factor is -regular iff is an integer. Furthermore, we use properties of -regular comparators to conclude that the discounted-sum inclusion is PSPACE-complete, hence resolving the complexity gap.

Finally, we investigate the limit-average comparator. Since limit-average is only defined for sequences in which the average of prefixes converge, limit-average comparison is not well-defined. We show that even a Büchi pushdown automaton cannot separate sequences for which limit-average exists from those for which it does not. Hence, we introduce the novel notion of prefix-average comparison as a relaxation of limit-average comparison. We show that the prefix-average comparator admits a comparator that is -context-free, i.e., given by a Büchi pushdown automaton, and we discuss the utility of this characterization.

This paper is organized as follows: Preliminaries are given in § 2. Comparator automata is formally defined in § 3. The connections between -regular aggregate functions and -regular comparators is discussed in Section 3.1. Generic algorithms for -regular comparators are discussed in § 3.2-3.3. § 4 discusses discounted-sum aggregate function and its comparators with non-integer rational discount-factors (§ 4.1) and integer discount-factors (§ 4.2). The construction and properties of prefix-average comparator are given in § 5, respectively. We conclude with future directions in § 6.

### 1.1. Related work

The notion of comparison has been widely studied in quantitative settings. Here we mention only a few of them. Such aggregate-function based notions appear in weighted automata [1, 18], quantitative games including mean-payoff and energy games , discounted-payoff games [3, 4], in systems regulating cost, memory consumption, power consumption, verification of quantitative temporal properties [15, 16], and others. Common solution approaches include graph algorithms such as weight of cycles or presence of cycle , linear-programming-based approaches, fixed-point-based approaches , and the like. The choice of approach for a problem typically depends on the underlying aggregate function. In contrast, in this work we present an automata-theoretic approach that unifies solution approaches to problems on different aggregate functions. We identify a class of aggregate functions, ones that have an -regular comparator, and present generic algorithms for some of these problems.

While work on finite-representations of counterexamples and witnesses in the qualitative setting is known , we are not aware of such work in the quantitative verification domain. This work can be interpreted as automata-theoretic arithmetic, which has been explored in regular real analysis .

## 2. Preliminaries

[Büchi automaton ]

A (finite-state) Büchi automaton is a tuple , , , , , where is a finite set of states, is a finite input alphabet, is the transition relation, is the set of initial states, and is the set of accepting states  . A Büchi automaton is deterministic if for all states and inputs , and . Otherwise, it is nondeterministic. A Büchi automaton is complete if for all states and inputs , . For a word , a run of is a sequence of states s.t. , and for all . Let denote the set of states that occur infinitely often in run . A run is an accepting run if . A word is an accepting word if it has an accepting run. Büchi automata are closed under set-theoretic union, intersection, and complementation . Languages accepted by these automata are called -regular languages.

#### Reals over ω-words 

Given an integer base , its digit set is . Let , then there exist unique words and such that . Thus, and are respectively the -th least significant digit in the base representation of the integer part of , and the -th most significant digit in the base representation of the fractional part of . Then, a real-number in base is represented by , where if , if , and is the interleaved word of and . Clearly, . For all integer , we denote the alphabet of representation of real-numbers in base by . We adopt the definitions of function automata and regular functions  w.r.t. aggregate functions as follows: [Aggregate function automaton, -Regular aggregate function] Let be a finite set, and be an integer-valued base. A Büchi automaton over alphabet is an aggregate function automata of type if the following conditions hold:

• For all , there exists at most one such that , and

• For all , there exists an such that

and are the input and output alphabets, respectively. An aggregate function is -regular under integer base if there exists an aggregate function automaton over alphabet such that for all sequences and , iff .

[Weighted -automaton [11, 20]] A weighted automaton over infinite words is a tuple , where is a Büchi automaton with all states as accepting, is a weight function, and is the aggregate function [11, 20]. Words and runs in weighted automata are defined as they are in Büchi automata. The weight-sequence of run of word is given by where for all . The weight of a run , denoted by , is given by . Here the weight of a word in weighted automata is defined as is a run of in . In general, weight of a word can also be defined as the infimum of the weight of all its runs. By convention, if a word its weight .

[Quantitative inclusion] Let and be weighted -automata with the same aggregate function . The strict quantitative inclusion problem, denoted by , asks whether for all words , . The non-strict quantitative inclusion problem, denoted by , asks whether for all words , .

Quantitative inclusion, strict and non-strict, is PSPACE-complete for limsup and liminf , and undecidable for limit-average . For discounted-sum with integer discount-factor it is in EXPTIME [7, 11], and decidability is unknown for rational discount-factors

[Incomplete-information quantitative games] An incomplete-information quantitative game is a tuple , where , , are sets of states, observations, and actions, respectively, is the initial state, is the transition relation, is the weight function, and is the aggregate function. The transition relation is complete, i.e., for all states and actions , there exists a state s.t. . A play is a sequence , where . The observation of state is denoted by . The observed play of is the sequence , where . Player has incomplete information about the game ; it only perceives the observation play . Player receives full information and witnesses play . Plays begin in the initial state . For , Player selects action . Next, player selects the state , such that . The weight of state is the pair of payoffs . The weight sequence of player along is given by , and its payoff from is given by for aggregate function , denoted by , for simplicity. A play on which a player receives a greater payoff is said to be a winning play for the player. A strategy for player is given by a function since it only sees observations. Player follows strategy if for all , . A strategy is said to be a winning strategy for player if all plays following are winning plays for .

[Büchi pushdown automaton ] A Büchi pushdown automaton (Büchi PDA) is a tuple , where , , , and are finite sets of states, input alphabet, pushdown alphabet and accepting states, respectively. is the transition relation, is a set of initial states, is the start symbol. A run on a word of a Büchi PDA is a sequence of configurations satisfying (1) , , and (2) ( for all . Büchi PDA consists of a stack, elements of which are the tokens , and initial element . Transitions push or pop token(s) to/from the top of the stack. Let be the set of states that occur infinitely often in state sequence of run . A run is an accepting run in Büchi PDA if . A word is an accepting word if it has an accepting run. Languages accepted by Büchi PDA are called -context-free languages (-CFL).

#### Notation

For an infinite sequence , denotes its -th element, and denotes the finite word . Abusing notation, we write and if and are an accepting word and an accepting run of respectively. An infinite weight-sequence is bounded if the absolute value of all of its elements are bounded by a fixed number.

For missing proofs and constructions, refer to the supplementary material.

## 3. Comparator automata

Comparator automata (often abbreviated as comparators) are a class of automata that can read pairs of weight sequences synchronously and establish an equality or inequality relationship between these sequences. Formally, we define: [Comparator automata] Let be a finite set of rational numbers, and denote an aggregate function. A comparator automaton for aggregate function with inequality or equality relation is an automaton over the alphabet that accepts a pair of (infinite) weight sequences iff

. From now on, unless mentioned otherwise, we assume that all weight sequences are bounded, natural-number sequences. The boundedness assumption is justified since the set of weights forming the alphabet of a comparator is bounded. For all aggregate functions considered in this paper, the result of comparison of weight sequences is preserved by a uniform linear transformation that converts rational-valued weights into natural numbers; justifying the natural number assumption.

When the comparator for an aggregate function and a relation is a Büchi automaton, we call it an -regular comparator. Likewise, when the comparator is a Büchi pushdown automaton, we call it an -context-free comparator. Due to closure properties of Büchi automata, if the comparator for an aggregate function for any one inequality is -regular for all equality and inequality relations, then the comparator for the function for all inequality and equality relations also -regular. Later, we see that discounted-sum comparator is -regular (§ 4) and prefix-average comparator with (or ) is -context-free (§ 5).

#### Limsup comparator

We explain comparators through an example. The limit supremum (limsup, in short) of a bounded, integer sequence , denoted by , is the largest integer that appears infinitely often in . The limsup comparator for relation is a Büchi automaton that accepts the pair of sequences iff .

The working of the limsup comparator for relation is based on non-deterministically guessing the limsup of sequences and , and then verifying that . Büchi automaton (Fig. 1) illustrates the basic building block of the limsup comparator for relation . Automaton accepts pair of number sequences iff , and , for integer . (Lemma 3).

Let and be non-negative integer sequences bounded by . Büchi automaton (Fig. 1) accepts iff , and .

###### Proof.

Let have an accepting run in . We show that . The accepting run visits state infinitely often. Note that all incoming transitions to accepting state occur on alphabet while all transitions between states and occur on alphabet , where denotes the set . So, the integer must appear infinitely often in and all elements occurring infinitely often in and are less than or equal to . Therefore, if is accepted by then , and , and .

Conversely, let . We prove that is accepted by . For an integer sequence when integers greater than can occur only a finite number of times in . Let denote the index of the last occurrence of an integer greater than in . Similarly, since , let be index of the last occurrence of an integer greater than . Therefore, for sequences and integers greater than will not occur beyond index . Büchi automaton (Fig. 1) non-deterministically determines . On reading the -th element of input word , the run of exits the start state and shifts to accepting state . Note that all runs beginning at state occur on alphabet where . Therefore, can continue its infinite run even after transitioning to . To ensure that this is an accepting run, the run must visit accepting state infinitely often. But this must be the case, since occurs infinitely often in , and all transitions on , for all , transition into state . Hence, for all integer sequences , bounded by , if , and , the automaton accepts . ∎

Let be an integer upper bound, and be the inequality relation. The limsup comparator with relation accepting pair of bounded-sequence iff is -regular.

###### Proof.

The union of Büchi automata (Fig 1, Lemma 3) for , when is the upper bound results in the limsup comparator for relation . ∎

Due to closure properties of Büchi automata, this implies that limsup comparator for all inequalities and equality relation is also -regular. The limit infimum (liminf, in short) of an integer sequence is the smallest integer that appears infinitely often in it; its comparator has a similar construction to the limsup comparator. One can further prove that the limsup and liminf aggregate functions are also -regular aggregate functions.

### 3.1. ω-Regular aggregate functions

This section draws out the relationship between -regular aggregate functions and -regular comparators. We begin with showing that -regular aggregate functions entails -regular comaparators for the aggregate function. Let be the upper-bound on weight sequences, and be the integer base. Let be an aggregate function. If aggregate function is -regular under base , then its comparator for all inequality and equality relations is also -regular.

###### Proof.

We show that if an aggregate function is -regular under base , then its comparator for relation is -regular. By closure properties of -regular comparators, this implies that comparators of the aggregate function are -regular for all inequality and equality relations.

But first we prove that for a given integer base there exists an automaton such that for all , accepts iff . Let , and be an integer base. Let and . Then, the following statements can be proven using simple evaluation from definitions:

• When and . Then .

• When

• If : Since and eventually only see digit i.e. they are necessarily identical eventually, there exists an index such that it is the last position where and differ. If , then . If , then .

• If but : Let be the first index where and differ. If then . If then .

• Finally, if and : Then .

• When

• If : Since and eventually only see digit i.e. they are necessarily identical eventually. Therefore, there exists an index such that it is the last position where and differ. If , then . If , then .

• If but : Let be the first index where and differ. If then . If then .

• Finally, if and : Then .

• When and . Then .

Since the conditions given above are exhaustive and mutually exclusive, we conclude that for all and integer base , let and . Then iff one of the following conditions occurs:

1. and .

2. , , and when is the last index where and differ.

3. , , , and when is the first index where and differ.

4. , , and when is the last index where and differ.

5. , , , and when is the first index where and differ.

Note that each of these five condition can be easily expressed by a Büchi automaton over alphabet for an integer . For an integer , the union of all these Büchi automata will result in a Büchi automaton such that for all and and , iff interleaved word .

Now we come to the main part of the proof. Let be an -regular aggregate function with aggregate function automata . We will construct an -regular comparator for with relation . Note that is present in the comparator iff for and , for as described above. Since and are both Büchi automata, the comparator for function with relation is also a Büchi auotmaton. Therefore, the comparator for aggregate function with relation is -regular. ∎

The converse direction of whether -regular comparator for an aggregate function for all inequality or equality relations will entail -regular functions under an integer base is trickier. For all aggregate functions considered in this paper, we see that whenever the comparator is -regular, the aggregate function is -regular as well. However, the proofs for this have been done on a case-by-cass basis, and we do not have an algorithmic procedure to derive a function (Büchi) automaton from its -regular comparator. We also do not have an example of an aggregate function for which the comparator is -regular but the function is not. Therefore, we arrive at the following conjecture: Let be the upper-bound on weight sequences, and be the integer base. Let be an aggregate function. If the comparator for an aggregate function is -regular for all inequality and equality relations, then its aggregate function is also -regular under base .

### 3.2. Quantitative inclusion

The aggregate function or comparator of a quantitative inclusion problem refer to the aggregate function or comparator of the associated aggregate function. This section presents a generic algorithm (Algorithm 1) to solve quantitative inlcusion between -weighted automata and with -comparators. This section focusses on the non-strict quantitative inclusion. (Algorithm 1) is an algorithm for quantitative inclusion between weighted -automata and with -regular comparator for relation . takes , and as input, and returns iff . The results for strict quantitative inclusion are similar. We use the following motivating example to explain steps of Algorithm 1.

#### Motivating example

Let weighted -automata and be as illustrated in Fig. 3-3 with the limsup aggregate function. The word has one run with weight sequence in and two runs with weight sequence and run with weight sequence . Clearly, ). Therefore . From Theorem 3 we know that the limsup comparator for is -regular.

We use Algorithm 1 to show that using its -regular comparator for . Intuitively, the algorithm must be able to identify that for run of in , there exists a run in s.t. is accepted by the limsup comparator for .

#### Key ideas

A run in on word is said to be dominated w.r.t if there exists a run in on the same word such that . holds if for every run in is dominated w.r.t. .

constructs Büchi automaton that consists of exactly the domianted runs of w.r.t . returns iff contains all runs of . To obtain , it constructs Büchi automaton that accepts word iff and are runs of the same word in and respectively, and i.e. if and are weight sequence of and , respectively, then is present in the -regular comparator for aggregate function with relation . The projection of on runs of results in .

#### Algorithm details

For sake a simplicity, we assume that every word present in is also present in i.e. (qualitative inclusion). has three steps: (a). (Lines 3-4): Enables unique identification of runs in and through labels. (b). (Lines 5-7): Compares weight of runs in with weight of runs in , and constructs . (c). (Line 8): Ensures if all runs of are diminished.

1. : transforms weighted -automaton into Büchi automaton by converting transition with weight in to transition in , where is a unique label assigned to transition . The word iff run on word with weight sequence . Labels ensure bijection between runs in and words in . Words of have a single run in . Hence, transformation of weighted -automata and to Büchi automata and enables disambiguation between runs of and (Line 3-4).

The corresponding for weighted -automata and from Figure 33 are given in Figure 66 respectively.

2. : The output of this step is the Büchi automaton , that contains the word iff is a dominated run in w.r.t (Lines 5-7).

constructs s.t. word iff and are runs of the same word in and respectively (Line 5). Concretely, for transition in automaton , where , transition is in , as shown in Figure 6.

intersects the weight components of with comparator (Line 6). The resulting automaton accepts word iff , and and are runs on the same word in and respectively. The result of between with the limsup comparator for relation (Figure 9) is given in Figure 9.

The projection of on the words of returns which contains the word iff is a dominated run in w.r.t (Line 7), as shown in Figure 9.

3. : iff (qualitative equivalence) since consists of all runs of and consists of all domianted runs w.r.t (Line 8).

Büchi automaton consists of all domianted runs in w.r.t .

###### Proof.

Let be the comparator for