Maximum Realizability for Linear Temporal Logic Specifications

04/02/2018
by   Rayna Dimitrova, et al.
0

Automatic synthesis from linear temporal logic (LTL) specifications is widely used in robotic motion planning, control of autonomous systems, and load distribution in power networks. A common specification pattern in such applications consists of an LTL formula describing the requirements on the behaviour of the system, together with a set of additional desirable properties. We study the synthesis problem in settings where the overall specification is unrealizable, more precisely, when some of the desirable properties have to be (temporarily) violated in order to satisfy the system's objective. We provide a quantitative semantics of sets of safety specifications, and use it to formalize the "best-effort" satisfaction of such soft specifications while satisfying the hard LTL specification. We propose an algorithm for synthesizing implementations that are optimal with respect to this quantitative semantics. Our method builds upon the idea of the bounded synthesis approach, and we develop a MaxSAT encoding which allows for maximizing the quantitative satisfaction of the safety specifications. We evaluate our algorithm on scenarios from robotics and power distribution networks.

READ FULL TEXT VIEW PDF

Authors

page 1

page 2

page 3

page 4

04/06/2021

Neural Network-based Control for Multi-Agent Systems from Spatio-Temporal Specifications

We propose a framework for solving control synthesis problems for multi-...
06/14/2022

Specification sketching for Linear Temporal Logic

Virtually all verification and synthesis techniques assume that the form...
11/08/2019

Promptness and Bounded Fairness in Concurrent and Parameterized Systems

We investigate the satisfaction of specifications in Prompt Linear Tempo...
04/22/2022

Robustness-by-Construction Synthesis: Adapting to the Environment at Runtime

While most of the current synthesis algorithms only focus on correctness...
05/07/2021

Executable Interval Temporal Logic Specifications

In this paper the reversibility of executable Interval Temporal Logic (I...
06/14/2022

Measuring Inconsistency in Declarative Process Specifications

We address the problem of measuring inconsistency in declarative process...
08/05/2020

What to Do When You Can't Do It All: Temporal Logic Planning with Soft Temporal Logic Constraints

In this paper, we consider a temporal logic planning problem in which th...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

Automatic synthesis from temporal logic specifications is increasingly becoming a viable alternative for system design in a number of domains such as control and robotics [11, 5]. The main advantage of synthesis is that it allows the system designer to focus on what the system should do, rather than on how it should do it. Thus, the main challenge becomes providing the right specification of the system’s required behaviour. While significantly easier than developing a system at a lower level, specification design is in its own a difficult and error-prone task. For example, in the case of systems operating in a complex adversarial environment, such as robots, the specification might be over-constrained, and as a result unrealizable, due to failure to account for some of the possible behaviours of the environment. In other cases, the user might have several alternative specifications in mind, possibly with some preferences, and wants to know what the best realizable combination of requirements is. For instance, a temporary violation of a safety requirement might be acceptable, if it is necessary to achieve an important goal. In such cases it is desirable that, when the specification is determined to be unrealizable, the synthesis procedure provides a “best-effort” implementation either according to some user-given criteria, or according to the semantics of the specification language.

The challenges of specification design motivate the need to develop synthesis methods for maximum realizability problem, where the input to the synthesis tool consists of a hard specification which must be satisfied by the system, and soft specifications which describe other desired, possibly prioritized properties.

A key ingredient of the formulation of maximum realizability problem is a quantitative semantics of the soft requirements. Broadly speaking, one can distinguish between two types of quantitative satisfaction: intrinsic, which is based on the semantics of the qualitative operators of the specification language, and extrinsic, which requires the user to provide certain quantitative information in terms of costs, weights, priority, or in terms of quantitative operators of the specification language. The approach to maximum realizability that we propose in this paper is applicable to quantitative semantics from both classes.

Our main focus is on soft specifications of the form , where each is a syntactically safe LTL formula. For formulas of the form , we consider a quantitative semantics that is typically used in the context of robustness. More precisely, we consider an intrinsic quantitative semantics which accounts for how often is satisfied. In particular, we consider truth values corresponding to being satisfied at every point of an execution, being violated only finitely many times, being both violated and satisfied infinitely often, or being continuously violated from some point on. We define a function that determines the value in a given implementation of a conjunction of soft specifications, based on this semantics. Our method then synthesizes an implementation that maximizes the value of the soft specifications. We further extend our proposed method to address quantitative semantics based on user-provided relaxations of the soft specification, and weights capturing their priority.

The approach to maximum realizability that we develop is based on the bounded synthesis technique. Bounded synthesis is able to synthesize implementations of optimal size by leveraging the power of SAT (or QBF, or SMT) solvers. Since maximum realizability is an optimization problem, we reduce its bounded version to maximum satisfiability (MaxSAT). More precisely, we encode the bounded maximum realizability problem with hard and soft specifications as a partial weighted MaxSAT problem, where hard specifications are captured by hard clauses in the MaxSAT formulation, and the weights of soft clauses encode the quantitative semantics of soft specifications. By adjusting these weights our approach can easily capture different variations of quantitative semantics. Although the formulation encodes the bounded maximum realizability problem (where the maximum size of the implementation is fixed), by providing a bound on the size of the optimal implementation, we are able to establish the completeness of our synthesis method. The existence of such completeness bound is guaranteed by considering quantitative semantics in which the values can be themselves encoded by LTL formulas.

We have applied the proposed synthesis method to examples from two domains where considering combinations of hard and soft specifications is natural and often unavoidable. For example, such a combination of specifications arises in power networks where generators of limited capacity have to power a set of vital and non-vital loads, whose total demand may exceed the capacity of the generators. Another example is robotic navigation, where due to the adversarial nature of the environment in which robots operate, safety requirements might prevent a system from achieving its goal, or a large number of tasks of different nature might not necessarily be consistent when posed together.

Related work. Maximum realizability and several closely related problems have attracted significant attention in recent years. Planning over a finite horizon with prioritized safety requirements was studied in [27], where the goal is to synthesize a least-violating control strategy. A similar problem for infinite-horizon temporal logic planning was studied in [15], which seeks to revise an inconsistent specification, minimizing the cost of revision with respect to costs for atomic propositions provided by the specifier. [19] describes a method for computing optimal plans for co-safe LTL specifications, where optimality is again with respect to the cost of violating each atomic proposition, which is provided by the user. All of these approaches are developed for the planning setting, where there is no adversarial environment, and thus they are able to reduce the problem to the computation of an optimal path in a graph. The case of probabilistic environments was considered in [20]. In contrast, in our work we seek to maximize the satisfaction of the given specification against the worst-case behaviour of the environment.

The problem setting that is the closest to ours is that of [26]. The authors of [26] study a maximum realizability problem in which the specification is a conjunction of a must (or hard, in our terms) LTL specification, and a number of weighted desirable (or soft, in our terms) specifications of the form , where is an arbitrary LTL formula. Their synthesis method requires translating to a mean-payoff term, by first approximating the LTL formula with a safety property. This approximation strengthens , while the transition to a mean-payoff weakens the resulting safety property. Thus, when is not a safety property, there is no clear relationship between and the corresponding mean-payoff term. The mean-payoff terms for the individual desirable specifications are combined in a weighted sum, and the synthesized implementation is optimal with respect to this combined term. In contrast, in our maximum realizability setting each satisfaction value is characterized as an LTL formula which is a relaxation of the original specification, and thus so is the optimal value.

To the best of our knowledge, our work is the first to employ MaxSAT in the context of reactive synthesis. MaxSAT has been used in [14] for preference-based planning. However, since maximum realizability is concerned with reactive systems, it requires a fundamentally different approach than planning.

The two other main research directions related to maximum realizability are quantitative synthesis and specification debugging. There are two predominant flavours of quantitative synthesis problems studied in the literature. In the first one (cf. [6]), the goal is to generate an implementation that maximizes the value of a mean-payoff objective, while possibly satisfying some -regular specification. In the second setting (cf. [1, 2, 25]), the system requirements are formalized in a multi-valued temporal logic. The synthesis methods in these works, however, do not solve directly the corresponding optimization problem, but instead check for the existence of an implementation whose value is in a given set. The optimization problem can then be reduced to a sequence of such queries.

An optimal synthesis problem for an ordered sequence of prioritized -regular properties was studied in [3], where the classical fixpoint-based game-solving algorithms are extended to a quantitative setting. The main difference in our work is that we allow for incomparable soft specifications each with a number of prioritized relaxations, for which the equivalent sequence of preference-ordered combinations would be of length exponential in the number of soft specification. Our MaxSAT formulation avoids considering explicitly these combinations.

In specification debugging there is a lot of research dedicated to finding good explanations for the unsatisfiability or unrealizability of temporal specifications [8, 24, 22], and more generally at the analysis of specifications [7, 16, 13, 10]. Our approach to maximum realizability can prove useful for specification analysis, since instead of simply providing an optimal value, it computes an optimal relaxation of the given specification in the form of another LTL formula.

2 Maximum Realizability Problem

In this section, we first overview linear-time temporal logic, LTL, and the corresponding synthesis problem, which asks to synthesize an implementation, in the form of a transition system, that satisfies an LTL formula given as input.

Then, we proceed by providing a quantitative semantics for a class of LTL formulas, and the definition of the corresponding maximum realizability problem.

2.1 Specifications, Transition Systems, and the Synthesis Problem

Linear-time temporal logic (LTL) is a standard specification language for formalizing requirements on the behaviour of reactive systems. Given a finite set of atomic propositions, the set of LTL formulas is generated by the grammar where is an atomic proposition, is the next operator, is the until operator, and is the release operator. As usual, we define the derived operators finally: and globally: . An LTL formula is in negation normal form (NNF) if all the negations appear only in front of atomic propositions. Since every LTL formula can be converted to an equivalent one in NNF, we consider only formulas in NNF. A syntactically safe LTL formula is an LTL formula which contains no occurrences of the operator in its NNF.

Let be the finite alphabet consisting of the valuations of the propositions . A letter is interpreted as the valuation that assigns value to all and to all . LTL formulas are interpreted over infinite words . If a word satisfies an LTL formula , we write . The definition of the semantics of LTL can be found for instance in [4]. We denote with the length of , and with the set of its subformulas.

In the rest of the paper we assume that the set of atomic propositions is partitioned into disjoint sets of input propositions and output propositions .

A transition system over a set of input propositions and a set of output propositions is a tuple , where is a set of states, is the initial state, and the transition function maps a state and a valuation of the input propositions to a successor state and a valuation to the output propositions. Let be the set of all propositions. For we denote by , and by .

If the set is finite, then is a finite-state transition system. In this case we define the size of to be the number of its states, i.e., .

An execution of is an infinite sequence such that is the initial state, and for every . The corresponding sequence is called a trace. We denote with the set of all traces of a transition system .

We say that a transition system satisfies an LTL formula over atomic propositions , denoted , if for every .

The realizability problem for LTL is to determine whether for a given LTL formula there exists a transition system that satisfies . The LTL synthesis problem asks to construct such a transition system if one exists.

Often, the specification is a combination of multiple requirements, which might not be realizable in conjunction. In such a case, in addition to reporting the unrealizability to the system designer, we would like the synthesis procedure to construct an implementation that satisfies the specification “as much as possible”. Such implementation is particularly useful in the case where some of the requirements describe desirable but not necessarily essential properties of the system. To determine what “as much as possible” formally means, a quantitative semantics of the specification language is necessary. In the next subsection we provide such semantics for a fragment of LTL. The quantitative interpretation is based on the semantics of LTL formulas of the form .

2.2 Quantitative Semantics of Soft Safety Specifications

Let be LTL specifications, where each is a syntactically safe LTL formula. In order to formalize the maximal satisfaction of , we first give a quantitative semantics of formulas of the form .

Quantitative semantics of safety specifications.

For an LTL formula of the form and a transition system , we define the value of in as

Thus, the value of in a transition system

is a vector

, where the value corresponds to the value in the classical semantics of LTL. When , the values , and capture the extent to which holds or not along the traces of . For example, if , then holds infinitely often on each trace of , but there exists a trace of on which is violated infinitely often. When , then on some trace of , holds for at most finitely many positions.

Note that by the definition of , if , then (1) iff , (2) iff , and (3) iff . Thus, the lexicographic ordering on captures the preference of one transition system over another with respect to the quantitative satisfaction of .

Example 1

Consider a robot working as a museum guide. We want to synthesize a transition system representing a navigation strategy for the robot. One of the requirements is that its tour should visit the special exhibition infinitely often, formalized in LTL as . We also desire that the robot never enters the staff’s office, formalized as . Now, suppose that initially the key for the special exhibition is in the office. Thus, in order to satisfy , the robot must violate . In any case, a strategy in which the office is entered only once, which satisfies is preferable to one which enters the office over and over again, and only satisfies . Thus, we want to synthesize a strategy with maximal value .

In order to compare implementations with respect to their satisfaction of a conjunction of several safety specifications, we will extend the above definition. We consider the case when the specifier has not expressed any preference for the individual conjuncts. Consider the following example.

Example 2

We consider again the museum guide robot, now with two soft safety specifications. The specification requires that the robot does not enter the narrow passage if it is occupied. The second one, , requires that the robot never enters the library. Passing through the library is an alternative to using the passage. Now, unless these specifications are given priorities, it is preferable to satisfy each of and infinitely often, rather than avoid entering the library by going through a occupied passage every time, or vice versa.

Quantitative semantics of conjunctions.

To capture the idea illustrated in Example 2, we define a value function, which intuitively gives higher values to transition systems in which a fewer number of soft specifications have low values. Formally, let the value of in be

where for . To compare transition systems according to these values, we use lexicographic ordering on .

Example 3

For the specifications in Example 2, the value function defined above assigns value to a system that satisfies and , but satisfies neither of and . It assigns the smaller value to an implementation that satisfies , but not .

Note that in the definition above we have reversed the order of the sums of the values and , with the sum over being the first, and the sum over being last. In this way, a transition system that satisfies all soft requirements to some extent is considered better in the lexicographic ordering than a transition system that satisfies one of them and violates all the others. We could instead consider the inverse lexicographic ordering, thus giving preference to satisfying some soft specification, over having some lower level of satisfaction over all of them. The next example illustrates the differences between these two variations.

Example 4

For the two soft specifications from Example 2, reversing the order of the sums in the definition of results in giving the higher value to a transition system that satisfies but not , and the lower value to the one that guarantees only and . The most suitable ordering usually depends on the specific application.

In Appendix 0.D we discuss generalizations of the framework, where the user provides a set of relaxations for each of the soft specifications, and possibly a priority ordering among the soft specifications, or numerical weights.

2.3 Maximum realizability

Using the definition of quantitative satisfaction of soft safety specifications, we now define the maximum realizability problem, which asks to synthesize a transition system that satisfies a given hard LTL specification, and is optimal with respect to the satisfaction of a conjunction of soft safety specifications.

Maximum realizability problem: Given an LTL formula and formulas , where each is a syntactically safe LTL formula, the maximum realizability problem asks to determine if there exists a transition system such that , and if the answer is positive, to synthesize a transition system such that , and such that for every transition system with it holds that .

Bounded maximum realizability problem: Given an LTL formula and formulas , where each is a syntactically safe LTL formula, and a bound , the bounded maximum realizability problem asks to determine if there exists a transition system with such that , and if the answer is positive, to synthesize a transition system such that , and such that for every transition system with and , it holds that .

3 Preliminaries

In this section we recall bounded synthesis, introduced in [23], and in particular the approach based on reduction to SAT. We begin with the necessary preliminaries from automata theory, and the notion of annotated transition systems.

3.1 Bounded Synthesis

A Büchi automaton over a finite alphabet is a tuple , where is a finite set of states, is the initial state, is the transition relation, and is a subset of the set of states. A run of on an infinite word is an infinite sequence of states, where is the initial state and for every it holds that .

A run of a Büchi automaton is accepting if it contains infinitely many occurrences of states in . A co-Büchi automaton differs from a Büchi automaton in the accepting condition: a run of a co-Büchi automaton is accepting if it contains only finitely many occurrences of states in . For a Büchi automaton the states in are called accepting states, while for a co-Büchi automaton they are called rejecting states. A nondeterministic automaton accepts a word if some run of on is accepting. A universal automaton accepts a word if every run of on is accepting.

The run graph of a universal automaton on a transition system is the unique graph with set of nodes and set of labelled edges such that iff and . That is, is the product of and .

A run graph of a universal Büchi (resp. co-Büchi) automaton is accepting if every infinite path contains infinitely many (resp. finitely) many occurrences of states in . A transition system is accepted by a universal automaton if the unique run graph of on is accepting. We denote with the set of transition systems accepted by .

The bounded synthesis approach is based on the following property.

Lemma 1 ([18])

For every LTL formula we can construct a universal co-Büchi automaton that has at most states and is such that for every transition system it holds that if and only if .

An annotation of a transition system with respect to a universal co-Büchi automaton is a function that maps nodes of the run graph of on to the set . Intuitively, such an annotation is valid if every node that is reachable from the node is annotated with a natural number, which is an upper bound on the number of rejecting states on any path from to .

Formally, an annotation is valid if

  • , i.e., the pair of initial states is labelled with a number, and

  • whenever , then for every edge in the run graph of on we have that is annotated with a number (i.e., ), such that , and if , then .

Valid annotations of finite-state systems correspond to accepting run graphs. An annotation is -bounded if for all and .

The synthesis method proposed in [23, 12] employs the following result in order to reduce the bounded synthesis problem to checking the satisfiability of propositional formulas. A transition system is accepted by a universal co-Büchi automaton iff there exists a -bounded valid annotation for and

. One can estimate a bound on the size of the transition system, which allows to reduce the synthesis problem to its bounded version. Namely, if there exists a transition system that satisfies an LTL formula

, then there exists a transition system satisfying with at most states.

Let be a universal co-Büchi automaton for the LTL formula . Given a bound on the size of the sought transition system , the bounded synthesis problem can be encoded as a satisfiability problem with the following sets of propositional variables and constraints.

Variables: The variables represent the sought transition system , and the sought valid annotation of the run graph of on . A transition system with states is represented by Boolean variables and for every , , and output proposition . The variable encodes the existence of transition from to on input , and the variable encodes being true in the output from state on input .

The annotation is represented by the following variables. For each and , the annotation is represented by a Boolean variable and a vector of Boolean variables: the variable encodes the reachability of from the initial node in the corresponding run graph, and the vector of variables represents the bound for the node .

Constraints for input-enabled : .

Constraints for valid annotation:

where is a formula over the variables that characterizes the transitions in between and on labels consistent with , and is a formula over the annotation variables such that if , and if .

3.2 Maximum Satisfiability (MaxSAT)

While the bounded synthesis problem can be encoded into SAT, for the synthesis of a transition system that satisfies a set of soft specifications as well as possible, we need to solve an optimization problem. In the next section we will reduce the bounded maximum realizability problem to a partial weighted MaxSAT problem.

MaxSAT is a Boolean optimization problem. Similarly to SAT, instances of MaxSAT are given as propositional formulas in conjunctive normal form (CNF). That is, a MaxSAT instance is a conjunction of clauses, each of which is a disjunction of literals, where a literal is a Boolean variable or its negation. The objective in MaxSAT is to compute a variable assignment that maximizes the number of satisfied clauses. In weighted MaxSAT, each clause is associated with a positive numerical weight and the objective is now to maximize the sum of the weights of the satisfied clauses. Finally, in partial weighted MaxSAT, there are two types of clauses, namely hard and soft clauses, where only the soft clauses are associated with weights. In order to be a solution to a partial weighted MaxSAT formula, a variable assignment must satisfy all the hard clauses. An optimal solution additionally maximizes the sum of the weights of the soft clauses.

In the encoding in the next section we use hard clauses for the hard specification, and soft clauses to capture the soft specifications in the maximum realizability problem. The weights for the soft clauses will encode the lexicographic ordering on values of conjunctions of soft specifications.

4 From Maximum Realizability to MaxSAT

We now describe the proposed MaxSAT-based approach to maximum realizability. First, we establish an upper bound on the minimal size of an implementation that satisfies a given LTL specification and maximizes the satisfaction of a conjunction of soft safety specifications according to the value function for such formulas described in Section 2.2. The established bound can be used to reduce the maximum realizability problem to its bounded version, which, in turn, we encode as a MaxSAT problem.

4.1 Bounded Maximum Realizability

To establish an upper bound on the minimal (in terms of size) optimal implementation, we make use of an important property of the function defined in Section 2.2. Namely, the property that for each of the possible values of there is a corresponding LTL formula that encodes this value in the classical LTL semantics, as we formally state in the next lemma.

Lemma 2

For every transition system and soft safety specifications , if , then there exists an LTL formula such that and the following conditions hold

  • , where ,

  • for every , if , then .

The following theorem is a consequence of Lemma 2.

Theorem 4.1

Given an LTL specification and soft safety specifications , if there exists a transition system , then there exists such that

  • for all with ,

  • and ,

where .

The bound above is estimated based on the size of the specifications, using a worst-case bound on the size of the corresponding automata. Given automata for all the specifications and , a potentially better bound can be estimated based on the size of these automata.

Lemma 2 immediately provides a naive synthesis procedure, which searches for an optimal implementation by enumerating possible formulas and solving the corresponding realizability questions. The total number of these formulas is , where is the number of soft specifications. The approach that we propose avoids this rapid growth, by reducing the optimization problem to a single MaxSAT instance, and thus it also makes use of the power of MaxSAT solvers.

4.2 Automata and Annotations for Soft Safety Specifications

Let be an LTL formula, where is a syntactically safe LTL formula.

The first step in the MaxSAT reduction is the construction of a universal Büchi automaton for each soft safety specification and its modification to incorporate the relaxation of to , as we now describe.

Proposition 1

Given an LTL formula where is syntactically safe, we can construct a universal Büchi automaton such that , and has a unique non-accepting sink state, that is, there exists a unique state such that , and for every it holds that .

From , which has at most states, we obtain a universal automaton constructed by redirecting all the transitions leading to to the initial state . Formally, , where , , and the transition relation is defined as

Let be the set of transitions in that correspond to transitions in leading to .

The next proposition formalizes the property that a transition system is accepted by iff the run graph of on does not contain an edge corresponding to a transition in .

Proposition 2

Let be a transition system and let be the run graph of on . Then, iff for every with , is not reachable from in .

We define an annotation function for a transition system and the automaton . The value of for the initial node of the run graph determines whether satisfies or . A function is –valid annotation if it is such that

  • , i.e., the pair of initial states is labelled with a number, and

  • if , then for every edge in the run graph of on we have that , and

    • if , then , and

    • if , then .

This definition guarantees that if is a bounded –valid annotation for and , then the number of rejecting edges in each path in the run graph of on is finite, which implies as stated below.

Proposition 3

Let be a finite-state transition system, and be the run graph of on . Then, if and only if there exists a –valid -bounded annotation for and .

If the run graph of on contains a reachable edge which belongs to , then we can conclude that . However, if each infinite path in the run graph contains only a finite number of occurrences of edges in , then . In particular, we have that if , then , and if is -bounded and , then .

This property of allows us to capture the satisfaction of and of with soft clauses for the same annotation function in the MaxSAT formulation.

4.3 MaxSAT Encoding of Bounded Maximum Realizability

Let be a universal co-Büchi automaton for the LTL formula .

For each syntactically safe formula , , we consider two universal automata: the universal automaton constructed as described in Section 4.2 and a universal co-Büchi automaton for the formula . Given a bound on the size of the sought transition system, we encode the bounded maximum realizability problem as a MaxSAT problem with the following sets of variables and constraints.

Variables: The MaxSAT formulation includes the variables from the SAT formulation of the bounded synthesis problem, which represent the sought transition system and the sought valid annotation of the run graph of on . Additionally, it includes variables for representing the annotations and for and respectively, similarly to in the SAT encoding. More precisely, the annotations for and are represented respectively by variables and where and , and and where and .

The set of constraints includes and from the SAT formulation as hard constraints, as well as the following constraints for the new annotations.

Hard constraints for valid annotations: For each , let

and is a formula over obtained from . The formula is analogous to defined in Section 3.1.

Soft constraints for valid annotations: For each we define

where is the bound on the size of the transition system.

The definition of the soft constraints guarantees that if and only if there exist corresponding annotations that satisfy all three of the soft constraints for . Similarly, if , then and can be satisfied.

The weights are selected in a way that reflects the ordering of transition systems with respect to their satisfaction of , as stated below.

Lemma 3

Let and be transition systems such that and . Let and be variable assignments satisfying the constraint system, such that is an optimal assignment consistent with , and is an optimal assignment consistent with . Furthermore, let and be the sums of the weights of the soft clauses satisfied in and