Symbolic LTLf Synthesis

05/23/2017
by   Shufang Zhu, et al.
0

LTLf synthesis is the process of finding a strategy that satisfies a linear temporal specification over finite traces. An existing solution to this problem relies on a reduction to a DFA game. In this paper, we propose a symbolic framework for LTLf synthesis based on this technique, by performing the computation over a representation of the DFA as a boolean formula rather than as an explicit graph. This approach enables strategy generation by utilizing the mechanism of boolean synthesis. We implement this symbolic synthesis method in a tool called Syft, and demonstrate by experiments on scalable benchmarks that the symbolic approach scales better than the explicit one.

READ FULL TEXT VIEW PDF

page 1

page 2

page 3

page 4

11/29/2017

Symbolic vs. Bounded Synthesis for Petri Games

Petri games are a multiplayer game model for the automatic synthesis of ...
09/21/2017

A Symbolic Approach to Safety LTL Synthesis

Temporal synthesis is the automated design of a system that interacts wi...
02/13/2018

Reconciling Enumerative and Symbolic Search in Syntax-Guided Synthesis

Syntax-guided synthesis aims to find a program satisfying semantic speci...
11/19/2019

Hybrid Compositional Reasoning for Reactive Synthesis from Finite-Horizon Specifications

LTLf synthesis is the automated construction of a reactive system from a...
04/11/2017

Control Synthesis of Nonlinear Sampled Switched Systems using Euler's Method

In this paper, we propose a symbolic control synthesis method for nonlin...
07/03/2020

Supervisory Controller Synthesis for Non-terminating Processes is an Obliging Game

We present a new algorithm to solve the supervisory control problem over...
12/10/2020

xRAI: Explainable Representations through AI

We present xRAI an approach for extracting symbolic representations of t...

1 Introduction

The problem of synthesis from temporal specifications can be used to model a number of different problems in AI, in particular planning. Linear Temporal Logic, or ltl, is the standard formalism to describe these specifications, but while ltl is classically interpreted over infinite runs, many planning problems have a finite horizon, since they assume that execution stops after a specific goal is achieved. This context leads to the emergence of a version of ltl with alternative semantics over finite traces, called ltl. Some of the planning problems which can be reduced to ltl synthesis include several variants of conditional planning with full observability [Bacchus and Kabanza2000, Gerevini et al.2009]. A general survey of applications of ltl in AI and CS can be found in [Giacomo and Vardi2013].

ltl synthesis in infinite-horizon settings has been well investigated in theory since [Pnueli and Rosner1989], but the lack of good algorithms for the crucial step of automata determinization is prohibitive for finding practical implementations [Fogarty et al.2013]. In addition, usual approaches rely on parity games [Thomas1995], for which no polynomial-time algorithm is known. In contrast, in the finite-horizon setting the specification can be represented by a finite-state automaton, for which determinization is practically feasible [Tabakov et al.2012] and the corresponding game can be solved in polynomial time on the number of states and transitions of the deterministic automaton. This opens the possibility for theoretical solutions to be implemented effectively.

A solution to the ltl synthesis problem was first proposed in [De Giacomo and Vardi2015], based on DFA games. Following this method, an ltl specification can be transformed into a DFA with alphabet comprised of propositional interpretations of the variables in the formula. A winning strategy for the game defined by this DFA is then guaranteed to realize the temporal specification.

In this paper, we present the first practical implementation of this theoretical framework for ltl synthesis, in the form of a tool called Syft. Syft follows a symbolic approach based on an encoding of the DFA using boolean formulas, represented as Binary Decision Diagrams (BDDs), rather than an explicit representation through the state graph. We base the choice of a symbolic approach in experiments on DFA construction from an ltl specification. We compared between two methods for DFA construction: one symbolic using the tool MONA [Henriksen et al.1995], receiving as input a translation of the ltl specification to first-order logic, and one explicit using SPOT [Duret-Lutz et al.2016]. Although both methods display limited scalability, the results show that the symbolic construction scales significantly better.

Using a symbolic approach allows us to leverage techniques for boolean synthesis [Fried et al.2016] in order to compute the winning strategy. Our synthesis framework employs a fixpoint computation to construct a formula that expresses the choices of outputs in each state that move the game towards an accepting state. By giving this formula as input to a boolean synthesis procedure we can obtain a winning strategy whenever one exists.

Further experiments comparing the performance of the Syft tool with an explicit implementation E-Syft again display better scalability for the symbolic approach. Furthermore, a comparison with a standard ltl synthesis tool confirms that restricting the problem to finite traces allows for more efficient techniques to be used. Finally, the results show DFA construction to be the limiting factor in the synthesis process.

2 Preliminaries

2.1 ltl Basics

Linear Temporal Logic (ltl) over finite traces, i.e. ltl, has the same syntax as ltl over infinite traces introduced in [Pnueli1977]. Given a set of propositions , the syntax of ltl formulas is defined as follows:

and represent true and false respectively. is an atom, and we define a literal to be an atom or the negation of an atom. (Next) and (Until) are temporal operators. We also introduce their dual operators, namely (Weak Next) and (Release), defined as and . Additionally, we define the abbreviations and . Standard boolean abbreviations, such as (or) and (implies) are also used.

A trace is a sequence of propositional interpretations (sets), in which () is the -th interpretation of , and represents the length of . Intuitively, is interpreted as the set of propositions which are at instant . Trace is an infinite trace if , which is formally denoted as ; otherwise is a finite trace, denoted as . ltl formulas are interpreted over finite traces. Given a finite trace and an ltl formula , we inductively define when is for at step (), written , as follows:

  • ;

  • ;

  • iff ;

  • iff ;

  • , iff and ;

  • , iff and ;

  • , iff there exists s.t. and , and for all , , we have .

An ltl formula is in , denoted by , if and only if . We next define the ltl synthesis problem.

Definition 1 (ltl Synthesis).

Let be an ltl formula and be two disjoint atom sets such that . is the set of input variables and is the set of output variables. is realizable with respect to if there exists a strategy , such that for an arbitrary infinite sequence of propositional interpretations over , we can find such that is in the finite trace .

Moreover, variables in () are called X- (Y-)variables.

2.2 DFA Games

The traditional way of performing ltl synthesis is by a reduction to corresponding Deterministic Finite Automaton (DFA) games. According to [De Giacomo and Vardi2015], every ltl formula can be translated in 2EXPTIME to a DFA which accepts the same language as the formula.

Let the DFA be , where is the alphabet, is the set of states, is the initial state, is the transition function, and is the set of accepting states. A game on consists of two players, the controller and the environment. is the set of uncontrollable propositions, which are under the control of the environment, and is the set of controllable propositions, which are under the control of the controller. The DFA game problem is to check the existence of winning strategy for the controller and generate it if exists. A strategy for the controller is a function , deciding the values of the controllable variables for every possible history of the uncontrollable variables. To define a winning strategy for the controller, we use the definition of winning state below.

Definition 2 (Winning State).

Given a DFA , is a winning state if is an accepting state, or there exists such that, for every , is a winning state. Such is the winning output of winning state .

A strategy g is a winning strategy if, given an infinite sequence , there is a finite trace that ends at an accepting state. If the initial state is a wining state, then a winning strategy exists. After obtaining a DFA from the ltl specification, we can utilize the solution to the DFA game for ltl synthesis.

Formally, the winning strategy can be represented as a deterministic finite transducer, defined as below.

Definition 3 (Deterministic Finite Transducer).

Given a DFA , a deterministic finite transducer is defined as follows:

  • is the set of winning states;

  • is the transition function such that ;

  • is the output function such that is a winning output of q.

2.3 Boolean Synthesis

In this paper, we utilize the boolean synthesis technique proposed in [Fried et al.2016]. The formal definition of the boolean synthesis problem is as follows.

Definition 4 (Boolean Synthesis [Fried et al.2016]).

Given two disjoint atom sets of input and output variables, respectively, and a boolean formula over , the boolean synthesis problem is to construct a function such that, for all , if there exists such that , then . The function is called the implementation function.

We treat boolean synthesis as a black box, using the implementation function construction in the ltl synthesis to obtain the output function of the transducer. For more details on techniques and algorithms for boolean synthesis we refer to [Fried et al.2016].

3 Translation from ltl Formulas to DFA

Following [De Giacomo and Vardi2015], in order to use DFA games to solve the synthesis problem, we need to first convert the ltl specification to a DFA. This section focuses on DFA construction. Given an ltl formula , the corresponding DFA can be constructed explicitly or symbolically.

3.1 DFA Construction

SPOT [Duret-Lutz et al.2016] is the state-of-the-art platform for conversion from ltl formulas to explicit Deterministic Büchi Automaton (DBA). The reduction rules from an ltl formula to an ltl formula are proposed in [Giacomo and Vardi2013], and are already implemented in SPOT. Thus by giving an ltl formula to SPOT, it returns the DBA for . can be trimmed to a DFA that recognizes the language of the ltl formula . For more details on this reduction, we refer to [Dutta et al.2013, Dutta and Vardi2014].

MONA [Henriksen et al.1995] is a tool that translates from the Weak Second-order Theory of One or Two successors (WS1S/WS2S) to symbolic DFA. First Order Logic (FOL) on finite words, which is a fragment of WS1S, has the same expressive power as ltl, so an ltl formula can be translated to a corresponding FOL formula [Giacomo and Vardi2013]. Taking such a FOL formula as input, MONA is able to generate the DFA for .

3.2 Evaluations

It is unnecessary to compare the outputs of SPOT and MONA in terms of size, since both tools return a minimized DFA.The key point is to test them in scalability. ltl and ltl have the same syntax, so we construct our benchmarks from 20 basic cases, half of which are realizable, from the ltl literature [Jobstmann and Bloem2006]. Regarding the ltl benchmarks, the semantics of ltl formulas is not, in general preserved, when moving to the finite-trace setting.

Since these basic cases are too small to be used individually to evaluate the DFA construction tools, we use a class of random conjunctions over basic cases [Daniele et al.1999]. Note that real specifications typically consist of many temporal properties, whose conjunction ought to be realizable. Formally, a random conjunction formula has the form: , where is the number of conjuncts, or the length of the formula, and is a randomly selected basic case (out of the 20 ones). Variables are chosen randomly from a set of candidate variables. Given and (the size of the candidate variable set), we generate a formula in the following way: (1) Randomly select basic cases; (2) For each case , substitute every variable with a random new variable chosen from atomic propositions. If is an X-variable in , then is also an X-variable in . The same applies to the Y-variables.

Each candidate variable may be chosen multiple times, so the number of variables in the formula varies. We generate 50 random formulas for each configuration , adding up to 4500 instances in total. Formula lengths range from 1 to 10, and varies in increments of 50 from 100 to 500. The platform used in the experiments is a computer cluster consisting of 2304 processor cores in 192 Westmere nodes (12 processor cores per node) at 2.83 GHz with 4GB of RAM per core, and 6 Sandy Bridge nodes of 16 processor cores each, running at 2.2 GHz with 8GB of RAM per core. Time out was set to 120 seconds. Cases that cannot generate the DFA within 120 seconds fail even if the time limit is extended, due to running out of memory.

Figure 1: Comparison of scalability between SPOT and MONA on the length of formulas

Here we consider the number of successfully converted cases for scalability evaluation. The results are summarized in Figure 1 and  2, which present the scalability of SPOT and MONA on and respectively. As grows, MONA demonstrates greater scalability, since SPOT cannot handle cases for . We conjecture that the poor scalability on of SPOT is due to the bad handling of conjunctive goals. In the comparison of scalability on , MONA is able to solve around twice as many cases than SPOT for each . Given these results, we adopt MONA for the DFA construction process and pursue a symbolic approach for ltl synthesis.

Figure 2: Comparison of scalability between SPOT and MONA on the number of variables

4 Symbolic ltl Synthesis

From an explicit automaton, the DFA game can be solved following the approach described in [De Giacomo and Vardi2015], by searching the state graph to compute the set of winning states and choosing for each winning state a winning output. The winning states and outputs can then be used to construct a transducer that implements the winning strategy.

To solve a DFA game symbolically, we first use MONA to construct a symbolic representation of the DFA. Then, we perform a fixpoint computation over this symbolic representation to obtain a boolean formula encoding all winning states of the DFA along with their corresponding winning outputs. Finally, if the game is realizable, we can synthesize a winning strategy from this formula with the help of a boolean synthesis procedure. In the rest of this section we describe each of these steps in more detail.

We start by defining the concept of symbolic automaton:

Definition 5 (Symbolic Automaton).

Given a DFA , the corresponding symbolic automaton is defined as follows:

  • and are as defined for ;

  • is a set of new propositions such that every state corresponds to an interpretation ;

  • is an interpretation of the propositions in corresponding to the initial state ;

  • is a boolean function mapping interpretations , and of the propositions of , and to a new interpretation of the propositions of , such that if corresponds to a state then corresponds to the state ;

  • is a boolean formula over the propositions in , such that is satisfied by an interpretation iff corresponds to a final state .

Intuitively, the symbolic automaton represents states by propositional interpretations, the transition function by a boolean function and the set of final states by a boolean formula.

To solve the realizability problem over a symbolic automaton we compute a boolean formula over that is satisfied exactly by those interpretations that correspond to winning states. The specification is realizable if and only if satisfies . To solve the synthesis problem, we compute a boolean function such that for any sequence that satisfies: (1) is the initial state; (2) For every , ; (3) For every , there exists an such that satisfies . In other words, starting from the initial state, for any sequence of uncontrollable variables, if the controllable variables are computed by and the next state is computed by , the play eventually reaches an accepting state.

4.1 Realizability and Synthesis over Symbolic Automata

We can compute and through a fixpoint computation over two boolean formulas: , over the set of propositions , and , over . These formulas encode winning states and winning outputs in the following way: every interpretation such that corresponds to a winning state, and every interpretation such that corresponds to a winning state together with a winning output of that state. When we reach a fixpoint, should encode all winning states and all pairs of winning states and winning outputs.

In the procedure below, we compute the fixpoints of and starting from and . We assume that we are able to perform basic Boolean operations over the formulas, as well as substitution, quantification and testing for logical equivalence of two formulas.

In the first step of the computation, we initialize and , since every accepting state is a winning state. Note that is independent of the propositions from , since once the play reaches an accepting state the game is over and we don’t care about the outputs anymore. Then we construct and as follows: ,

An interpretation satisfies if either: satisfies ; or was not yet identified as a winning state, and for every input we can move from to an already-identified winning state by setting the output to . Note that it is important in the second case that has not yet been identified as a winning state, because it guarantees that the next transition will move closer to the accepting states. Otherwise, it would be possible, for example, for to accept an assignment to that moves from back to itself, making the play stuck in a self loop.

From , we can construct by existentially quantifying the output variables. This means that is satisfied by all interpretations that satisfy for some output, ignoring what the output is. The computation reaches a fixpoint when ( denoting logical equivalence). At this point, no more states will be added, and so all winning states have been found. By evaluating on we can know if there exists a winning strategy. If that is the case, can be used to compute this strategy. This can be done through the mechanism of boolean synthesis.

By giving as the input formula to a boolean synthesis procedure, and setting as the input variables and as the output variables, we get back a function such that if and only if there exists such that .

Using , we can define a symbolic transducer corresponding to the winning strategy of the DFA game.

Definition 6 (Symbolic Transducer).

Given a symbolic automaton and a function , the symbolic transducer is as follows:

  • , , , and are as defined for ;

  • is as defined above;

  • is the transition function such that and .

Note that selects a single winning output for each winning state. Such a transducer is a solution to the DFA game, and therefore to the ltl synthesis problem.

The following theorem states the correctness of the entire synthesis procedure:

Theorem 1.

If an ltl formula is realizable with respect to , the symbolic transducer corresponds to a winning strategy for .

Proof.

The translation from ltl to FOL is correct from [Giacomo and Vardi2013]. Correctness of the construction of the symbolic DFA from the FOL formula follows from the correctness of MONA [Henriksen et al.1995]. The winning state computation is correct due to being an implementation of the algorithm in [De Giacomo and Vardi2015]. The synthesis of is correct from the definition of boolean synthesis. ∎

4.2 ltl Synthesis via ltl Synthesis

An alternative procedure to ltl synthesis can be obtained by a reduction to ltl synthesis. This reduction allows tools for general ltl synthesis to be used in solving the ltl synthesis problem. The reduction works as follows. 1) Given an ltl formula over propositions , there is an ltl formula over propositions where is a new variable, and is satisfiable iff is satisfiable (see [Giacomo and Vardi2013, Li et al.2014]). 2) If , and and are the set of input and output variables of , respectively, set and as the input and output variables of , respectively. Intuitively, the variable is an output variable that indicates when the finite trace should end. As such, when the ltl property is satisfied, the controller can set this variable to . The result of solving the ltl synthesis problem for corresponds to solving the ltl synthesis problem for . The correctness of the reduction is guaranteed by the following theorem, which follows from the construction in [Giacomo and Vardi2013] together with being an output variable.

Theorem 2.

is realizable with respect to if and only if is realizable with respect to .

In Section 6, we use this reduction to compare our ltl synthesis implementation with tools for standard ltl synthesis over infinite traces.

5 Implementation

We implemented the symbolic synthesis procedure described in Section 4 in a tool called Syft, using Binary Decision Diagrams (BDDs) to represent the boolean formulas. For comparison, we also implemented the explicit version in a tool called E-Syft. Both were implemented in C++11, and Syft uses CUDD-3.0.0 as the BDD library.

Each tool consists of two parts: DFA construction and the synthesis procedure. Based on the evaluations of the performance of DFA construction in Section 3, we adopt MONA to construct the DFA to be given as input to the synthesis procedure. The DFA is given by MONA as a Shared Multi-terminal BDD (ShMTBDD) [Bryant1992, Morten et al.1996], which represents the function . A ShMTBDD is a binary decision diagram with roots and terminal nodes () representing states in the automaton. Formally speaking, is a transition in the DFA if and only if starting from the root representing state and evaluating the interpretation leads to the terminal representing state . To evaluate an interpretation on a ShMTBDD, take the high branch in every node labeled by a variable and the low branch otherwise. We next describe how we preprocess the DFA given by MONA.

5.1 Preprocessing the DFA of MONA

From ShMTBDD to Explicit DFA. Each root in an ShMTBDD corresponds to an explicit state in the DFA. Moreover, a root of the ShMTBDD includes the information about if the state is initial or accepting, thus enabling and to be easily extracted for the explicit DFA. To construct the transition function, we enumerate all paths in the ShMTBDD, each path from (root) to (terminal node) corresponding to one transition from state to in the DFA. Note that the size of the explicit DFA may be exponential on the size of the ShMTBDD.

From ShMTBDD to BDD. Following Section 4, we can construct a symbolic automaton in which the transition function is in form of a (multi-rooted) BDD that describes a boolean function . Thus we need to first generate the BDD for the given ShMTBDD.

The basic idea is as follows: (1) From the ShMTBDD of , construct a Multi-Terminal BDD (MTBDD) for with new boolean variables encoding the states, where every path through the state variables, representing an interpretation , leads to the node under the root in the ShMTBDD. Then, for each transition in , there exists an equivalent transition in . (2) Decompose the MTBDD into a sequence of BDDs , , where each , when evaluated on an interpretation , computes the -th bit in the binary encoding of state .

The idea of splitting the ShMTBDD into BDDs is illustrated on Figure 3. As shown in this example, bits are used to denote the four states . In step (1), root is substituted by that corresponds to the formula (). After replacing all roots with corresponding interpretations, the MTBDD is produced. In step (2), can be represented by respectively, where denotes the leftmost bit. Bit for both and is . So by forcing all paths that proceed to terminals and in the MTBDD to reach terminal node , and all paths to terminals and to reach terminal node , BDD is generated. BDD is constructed in an analogous way for bit .


Figure 3: Transformation from ShMTBDD to BDD

5.2 Implementing the Synthesis Algorithms

Explicit Synthesis. Following [De Giacomo and Vardi2015], the main algorithm for explicit synthesis is as follows: starting from accepting states in , iteratively expand the set of winning states. For every state that is not yet a winning state, if we find an assignment such that for all assignments of input variables, is a winning state, then is set to be the winning output of the new winning state . All assignments of have to be enumerated in the worst case. Fixpoint checking is accomplished by checking that no new winning state was added during each iteration. The transducer is generated according to Definition 3.

Symbolic Synthesis. The input here is a symbolic automaton , in which the transition relation is represented by a sequence of BDDs, where each corresponding to bit , and the formula for the accepting states, is represented by BDD . We separate the DFA game into two phases, realizability and strategy construction.

Following the theoretical framework in Section 4, from the accepting states , we construct two BDD sequences and , such that and , where and are the BDDs of the boolean formulas and respectively. The fixpoint computation terminates as soon as .

Our implementation uses the CUDD BDD library [Somenzi2016], where fundamental BDD operations are provided. In realizability checking, is constructed from by first substituting each bit of the binary encoding of the state with the corresponding BDD . The BDD operation Compose is used for such substitution. CUDD also provides the operations UnivAbstract and ExistAbstract for universal and existential quantifier elimination respectively. For fixpoint checking, we use canonicity of BDDs, which reduces equivalence checking to constant-time BDD equality comparison. To check realizability, the fixpoint BDD is evaluated on interpretation of state variables, returning if realizable.

Since veision 3.0.0, CUDD includes a built-in boolean synthesis method SolveEqn, which we can use to generate the function . From , the symbolic transducer can be constructed according to Definition 6.

6 Experiments

The experiment was divided into two parts and resulted in two major findings. First, we compared the symbolic approach against the explicit method and showed that the symbolic approach is clearly superior to the explicit one. Second, we evaluated our ltl synthesis implementation against the reduction to ltl synthesis presented in Section 4.2, and again show our approach to be more efficient.

We carried out experiments on the same platform as Section 3. For the synthesis experiments, besides the original 20 basic cases we also collected 80 instances from the ltl synthesis tool  [Bohy et al.2012], making 100 cases in total. In this section, denotes the length of the formulas and denotes the approximate number of variables. Due to the construction rules of the formula, as described in Section 3, each variable is chosen randomly and may be chosen multiple times. Thus, the exact number of variables in a formula for a given varies in the range .

6.1 Symbolic vs Explicit

We aim to compare the results on two aspects: 1) the scalability of each approach; 2) the performance on each procedure (automata construction/safety game) of ltl synthesis.

Scalability on the length of formulas. We evaluated the scalability of Syft and E-Syft on 2000 benchmarks where the formula length ranges from 1 to 10 and , as MONA is more likely to succeed in constructing the DFA for this value of . Each accounts for 200 of the 2000 benchmarks. Figure 4 shows the number of cases the tools were able to solve for each . As can be seen, the symbolic method can handle a larger number of cases than the explicit one, which demonstrates that the symbolic method outperforms the explicit approach in scalability on the length of the formula.

Figure 4: Comparison of scalability of Symbolic against Explicit on the length of formula

Scalability on the number of variables. In this experiment, we compared the scalability over the number of variables , which varies from 10 to 60, where is fixed as 5. As can be seen in Figure 5, for smaller cases the two approaches behave similarly, since they succeed in almost all cases. The same happens for larger cases, because MONA cannot construct the DFAs. For intermediate values the difference is more noticeable, showing better performance by the symbolic tool. The number of cases that the explicit method can solve sharply declines when . However, the symbolic tool can handle more than 40 variables. Both methods tend to fail for at the DFA conversion stage.

Figure 5: Comparison of scalability of Symbolic against Explicit on the number of variables

Synthesis vs DFA Construction. In this experiment we studied the effect of on the time consumed by DFA construction and synthesis. The percentage of time consumed by each is shown in Figure 6. We observe that for large cases, DFA construction dominates the running time. As the size of the DFA increases, DFA construction takes significantly longer, while synthesis time increases more slowly, widening the gap between the two. This result allows us to conclude that the critical performance limitation of synthesis is the DFA construction process rather than synthesis itself.

Figure 6: Comparison of scalability of Symbolic against Explicit on the number of variables

6.2 Comparison with Standard ltl Synthesis

Here we adopted Acacia+ [Bohy et al.2012], in which LTL2BA [Gastin and Oddoux2001] is the automaton constructor, as the ltl synthesis tool and SPOT [Duret-Lutz et al.2016] as the translator to convert from ltl formulas to ltl formulas, as presented in Section 4.2. We evaluated the effectiveness of each approach in terms of the number of solved cases. Figure 7 shows the number of solved cases as the length of the formula grows. As shown in the figure, Acacia+ is only able to solve a small fraction of the instances that Syft can solve. The evidence here confirms that restricting the problem to finite traces allows more efficient techniques to be used for synthesis.

Figure 7: Comparison of scalability of Symbolic approach against Acacia+ on the length of the formula

6.3 Discussion

The symbolic synthesis method scales better than the explicit approach both on the length of ltl formulas and the number of variables. The performance of the symbolic method, however, relies critically on the DFA-construction process, making this the bottleneck of ltl synthesis. Comparing with the reduction from ltl synthesis to ltl synthesis, the advantage of our approach is that the DFA construction can leverage techniques developed for finite-state automata, which cannot be applied to the construction of automata over infinite words, a key step in ltl synthesis.

7 Conclusion

We presented here the first realization of a symbolic approach for ltl synthesis, based on the theoretical framework of DFA games. Our experimental evaluation shows that these techniques are far more efficient than a reduction to standard ltl synthesis. Furthermore, our experiments on DFA construction and synthesis have shown that a symbolic approach to this problem has advantages over an explicit one. In both cases, however, the limiting factor for scalability was DFA construction. When the DFA could be constructed, the symbolic procedure was able to synthesize almost all cases, but for larger numbers of variables DFA construction is not able to scale.

These observations suggest the need for more scalable methods of symbolic DFA construction. A promising direction would also be to develop techniques for performing synthesis “on the fly” during the construction of the DFA, rather than waiting for the entire automaton to be constructed before initiating the synthesis procedure.

In [Giacomo and Vardi2013] an alternative formalism for finite-horizon temporal specifications is presented in the form of Linear Dynamic Logic over finite traces, or ldl. ldl is strictly more expressive than ltl, but is also expressible as a DFA. Therefore, given a procedure to perform the conversion from ldl to DFA, our approach can be used in the same way. This would allow synthesis to be performed over a larger class of specifications.

8 Acknowledgment

Work supported in part by NSFC Projects No. 61572197 and No. 61632005, MOST NKTSP Project 2015BAG19B02, STCSM Project No.16DZ1100600, project Shanghai Collaborative Innovation Center of Trustworthy Software for Internet of Things (ZF1213), NSF grants CCF-1319459 and IIS-1527668, NSF Expeditions in Computing project “ExCAPE: Expeditions in Computer Augmented Program Engineering” and by the Brazilian agency CNPq through the Ciência Sem Fronteiras program.

References

  • [Bacchus and Kabanza2000] Fahiem Bacchus and Froduald Kabanza. Using Temporal Logics to Express Search Control Knowledge for Planning. Artif. Intell., 116(1-2):123–191, 2000.
  • [Bohy et al.2012] Aaron Bohy, Véronique Bruyère, Emmanuel Filiot, Naiyong Jin, and Jean-François Raskin. Acacia+, a Tool for LTL Synthesis. In CAV, 2012.
  • [Bryant1992] Randal E. Bryant. Symbolic Boolean Manipulation with Ordered Binary-Decision Diagrams. ACM Comput. Surv., 24(3):293–318, 1992.
  • [Daniele et al.1999] Marco Daniele, Fausto Giunchiglia, and Moshe Y. Vardi. Improved Automata Generation for Linear Temporal Logic. In CAV, 1999.
  • [De Giacomo and Vardi2015] Giuseppe De Giacomo and Moshe Y. Vardi. Synthesis for LTL and LDL on Finite Traces. In IJCAI, 2015.
  • [Duret-Lutz et al.2016] Alexandre Duret-Lutz, Alexandre Lewkowicz, Amaury Fauchille, Thibaud Michaud, Etienne Renault, and Laurent Xu. Spot 2.0 — A Framework for LTL and -automata Manipulation. In ATVA, 2016.
  • [Dutta and Vardi2014] Sonali Dutta and Moshe Y. Vardi. Assertion-based flow monitoring of SystemC models. In MEMOCODE, pages 145–154, 2014.
  • [Dutta et al.2013] Sonali Dutta, Moshe Y. Vardi, and Deian Tabakov. CHIMP: A Tool for Assertion-Based Dynamic Verification of SystemC Models. In the Second International Workshop on Design and Implementation of Formal Tools and Systems, 2013.
  • [Fogarty et al.2013] Seth Fogarty, Orna Kupferman, Moshe Y. Vardi, and Thomas Wilke. Profile Trees for Büchi Word Automata, with Application to Determinization. In GandALF, 2013.
  • [Fried et al.2016] Dror Fried, Lucas M. Tabajara, and Moshe Y. Vardi. BDD-Based Boolean Functional Synthesis. In CAV, 2016.
  • [Gastin and Oddoux2001] Paul Gastin and Denis Oddoux. Fast LTL to Büchi Automata Translation. In CAV, 2001.
  • [Gerevini et al.2009] Alfonso Gerevini, Patrik Haslum, Derek Long, Alessandro Saetti, and Yannis Dimopoulos. Deterministic planning in the fifth international planning competition: PDDL3 and experimental evaluation of the planners. Artif. Intell., 173(5-6):619–668, 2009.
  • [Giacomo and Vardi2013] Giuseppe De Giacomo and Moshe Y. Vardi. Linear Temporal Logic and Linear Dynamic Logic on Finite Traces. In IJCAI, 2013.
  • [Henriksen et al.1995] Jesper G. Henriksen, Jakob L. Jensen, Michael E. Jørgensen, Nils Klarlund, Robert Paige, Theis Rauhe, and Anders Sandholm. Mona: Monadic Second-order Logic in Practice. In TACAS, 1995.
  • [Jobstmann and Bloem2006] Barbara Jobstmann and Roderick Bloem. Optimizations for LTL synthesis. In FMCAD, 2006.
  • [Li et al.2014] Jianwen Li, Lijun Zhang, Geguang Pu, Moshe Y. Vardi, and Jifeng He. LTL Satisfiability Checking. In ECAI, 2014.
  • [Morten et al.1996] Biehl Morten, Klarlund Nils, and Rauhe Theis. Mona: decidable arithmetic in practice (demo). In FTRTFT, 1996.
  • [Pnueli and Rosner1989] Amir Pnueli and Roni Rosner. On the Synthesis of a Reactive Module. In POPL, 1989.
  • [Pnueli1977] A. Pnueli. The temporal logic of programs. pages 46–57, 1977.
  • [Somenzi2016] Fabio Somenzi. CUDD: CU Decision Diagram Package 3.0.0. Universiy of Colorado at Boulder. 2016.
  • [Tabakov et al.2012] D. Tabakov, K.Y. Rozier, and M. Y. Vardi. Optimized temporal monitors for SystemC. Formal Methods in System Design, 41(3):236–268, 2012.
  • [Thomas1995] Wolfgang Thomas. On the Synthesis of Strategies in Infinite Games. In STACS, 1995.