Search

Hierarchical graphs are used in order to describe systems with a sequential composition of sub-systems. A hierarchical graph consists of a vector of subgraphs. Vertices in a subgraph may "call" other subgraphs. The reuse of subgraphs, possibly in a nested way, causes hierarchical graphs to be exponentially more succinct than equivalent flat graphs. Early research on hierarchical graphs and the computational price of their succinctness suggests that there is no strong correlation between the complexity of problems when applied to flat graphs and their complexity in the hierarchical setting. That is, the complexity in the hierarchical setting is higher, but all "jumps" in complexity up to an exponential one are exhibited, including no jumps in some problems. We continue the study of the complexity of algorithms for hierarchical graphs, with the following contributions: (1) In many applications, the subgraphs have a small, often a constant, number of exit vertices, namely vertices from which control returns to the calling subgraph. We offer a parameterized analysis of the complexity and point to problems where the complexity becomes lower when the number of exit vertices is bounded by a constant. (2) We describe a general methodology for algorithms on hierarchical graphs. The methodology is based on an iterative compression of subgraphs in a way that maintains the solution to the problems and results in subgraphs whose size depends only on the number of exit vertices, and (3) we handle labeled hierarchical graphs, where edges are labeled by letters from some alphabet, and the problems refer to the languages of the graphs. [ABSTRACT FROM AUTHOR]

A complexity measure for regular languages based on the sensing required to recognize them was recently introduced by Almagor, Kuperberg, and Kupferman. Intuitively, the sensing cost quantifies the detail in which a random input word has to be read in order to decide its membership in the language, when the input letters composing the word are truth assignments to a finite set of signals. We introduce the notion of lazy sensing , where the signals are not sensed simultaneously. Rather, the signals are ordered, and a signal is sensed only if the values of the signals sensed so far have not determined the successor state. We study four classes of lazy sensing, induced by distinguishing between the cases where the order of the signals is static or dynamic (that is, fixed in advance or depends on the values of the signals sensed so far), and the cases where the order is global or local (that is, the same for all states of the automaton, or not). We examine the different classes of lazy sensing and the saving they enable, with respect to each other and with respect to (non-lazy) sensing. We also examine the trade offs between sensing cost and size. Our results show that the good properties of sensing are preserved in the lazy setting. In particular, saving sensing does not conflict with saving size: in all four classes, the lazy-sensing cost of a regular language can be attained in the minimal automaton recognizing the language. [ABSTRACT FROM AUTHOR]

Of special interest in formal verification are safety specifications, which assert that the system stays within some allowed region, in which nothing "bad" happens. Equivalently, a computation violates a safety specification if it has a "bad prefix"—a prefix all whose extensions violate the specification. The theoretical properties of safety specifications as well as their practical advantages with respect to general specifications have been widely studied. Safety is binary: a specification is either safety or not safety. We introduce a quantitative measure for safety. Intuitively, the safety level of a language L measures the fraction of words not in L that have a bad prefix. In particular, a safety language has safety level 1 and a liveness language has safety level 0. Thus, our study spans the spectrum between traditional safety and liveness. The formal definition of safety level is based on probability and measures the probability of a random word not in L to have a bad prefix. We study the problem of finding the safety level of languages given by means of deterministic and nondeterministic automata as well as LTL formulas, and the problem of deciding their membership in specific classes along the spectrum (safety, almost-safety, fraction-safety, etc.). We also study properties of the different classes and the structure of deterministic automata for them. [ABSTRACT FROM AUTHOR]

Synthesis is the automated construction of a system from its specification. In real life, hardware and software systems are rarely constructed from scratch. Rather, a system is typically constructed from a library of components. Lustig and Vardi formalized this intuition and studied LTL synthesis from component libraries. In real life, designers seek optimal systems. In this paper we add optimality considerations to the setting. We distinguish between quality considerations (for example, size – the smaller a system is, the better it is), and pricing (for example, the payment to the company who manufactured the component). We study the problem of designing systems with minimal quality-cost and price. A key point is that while the quality cost is individual – the choices of a designer are independent of choices made by other designers that use the same library, pricing gives rise to a resource-allocation game – designers that use the same component share its price, with the share being proportional to the number of uses (a component can be used several times in a design). We study both closed and open settings, and in both we solve the problem of finding an optimal design. In a setting with multiple designers, we also study the game-theoretic problems of the induced resource-allocation game. [ABSTRACT FROM AUTHOR]

Classical network-formation games are played on a directed graph. Players have reachability objectives: each player has to select a path from his source to target vertices. Each edge has a cost, shared evenly by the players using it. We introduce and study network-formation games with regular objectives . In our setting, the edges are labeled by alphabet letters and the objective of each player is a regular language over the alphabet of labels. Unlike the case of reachability objectives, here the paths selected by the players need not be simple, thus a player may traverse some edges several times. Edge costs are shared by the players with the share being proportional to the number of times the edge is traversed. We study the existence of a pure Nash equilibrium (NE), the inefficiency of a NE compared to a social-optimum solution, and computational complexity problems in this setting. [ABSTRACT FROM AUTHOR]

Synthesis is the automated construction of a system from its specification. The system has to satisfy its specification in all possible environments. The environment often consists of agents that have objectives of their own. Thus, it makes sense to soften the universal quantification on the behavior of the environment and take the objectives of its underlying agents into an account. Fisman et al. introduced rational synthesis: the problem of synthesis in the context of rational agents. The input to the problem consists of temporal logic formulas specifying the objectives of the system and the agents that constitute the environment, and a solution concept (e.g., Nash equilibrium). The output is a profile of strategies, for the system and the agents, such that the objective of the system is satisfied in the computation that is the outcome of the strategies, and the profile is stable according to the solution concept; that is, the agents that constitute the environment have no incentive to deviate from the strategies suggested to them. In this paper we continue to study rational synthesis. First, we suggest an alternative definition to rational synthesis, in which the agents are rational but not cooperative. We call such problem strong rational synthesis. In the strong rational synthesis setting, one cannot assume that the agents that constitute the environment take into account the strategies suggested to them. Accordingly, the output is a strategy for the system only, and the objective of the system has to be satisfied in all the compositions that are the outcome of a stable profile in which the system follows this strategy. We show that strong rational synthesis is 2 ExpTime-complete, thus it is not more complex than traditional synthesis or rational synthesis. Second, we study a richer specification formalism, where the objectives of the system and the agents are not Boolean but quantitative. In this setting, the objective of the system and the agents is to maximize their outcome. The quantitative setting significantly extends the scope of rational synthesis, making the game-theoretic approach much more relevant. Finally, we enrich the setting to one that allows coalitions of agents that constitute the system or the environment. [ABSTRACT FROM AUTHOR]

The determinization of Büchi automata is a celebrated problem, with applications in synthesis, probabilistic verification, and multi-agent systems. Since the 1960s, there has been a steady progress of constructions: by McNaughton, Safra, Piterman, Schewe, and others. Despite the proliferation of solutions, they are all essentially ad-hoc constructions, with little theory behind them other than proofs of correctness. Since Safra, all optimal constructions employ trees as states of the deterministic automaton, and transitions between states are defined operationally over these trees. The operational nature of these constructions complicates understanding, implementing, and reasoning about them, and should be contrasted with complementation, where a solid theory in terms of automata run dag s underlies modern constructions. In 2010, we described a profile -based approach to Büchi complementation, where a profile is simply the history of visits to accepting states. We developed a structural theory of profiles and used it to describe a complementation construction that is deterministic in the limit. Here we extend the theory of profiles to prove that every run dag contains a profile tree with at most a finite number of infinite branches. We then show that this property provides a theoretical grounding for a new determinization construction where macrostates are doubly preordered sets of states. In contrast to extant determinization constructions, transitions in the new construction are described declaratively rather than operationally. [ABSTRACT FROM AUTHOR]

We say that a deterministic finite automaton (DFA) A is composite if there are DFAs A 1 , … , A t such that L ( A ) = ⋂ i = 1 t L ( A i ) and the index of every A i is strictly smaller than the index of A . Otherwise, A is prime . We study the problem of deciding whether a given DFA is composite, the number of DFAs required in a decomposition, decompositions that are based on abstractions, methods to prove primality, and structural properties of DFAs that make the problem simpler or are retained in a decomposition. We also provide an algebraic view of the problem and demonstrate its usefulness for the special case of permutation DFAs. [ABSTRACT FROM AUTHOR]

Abstract: A nondeterministic weighted finite automaton (WFA) maps an input word to a numerical value. Applications of weighted automata include formal verification of quantitative properties, as well as text, speech, and image processing. Many of these applications require the WFAs to be deterministic, or work substantially better when the WFAs are deterministic. Unlike NFAs, which can always be determinized, not all WFAs have an equivalent deterministic weighted automaton (DWFA). In Mohri (1997) [22], Mohri describes a determinization construction for a subclass of WFA. He also describes a property of WFAs (the twins property), such that all WFAs that satisfy the twins property are determinizable and the algorithm terminates on them. Unfortunately, many natural WFAs cannot be determinized. In this paper we study approximated determinization of WFAs. We describe an algorithm that, given a WFA and an approximation factor , constructs a DWFA that -determinizes . Formally, for all words , the value of in is at least its value in and at most times its value in . Our construction involves two new ideas: attributing states in the subset construction by both upper and lower residues, and collapsing attributed subsets whose residues can be tightened. The larger the approximation factor is, the more attributed subsets we can collapse. Thus, -determinization is helpful not only for WFAs that cannot be determinized, but also in cases determinization is possible but results in automata that are too big to handle. We also describe a property (the -twins property) and use it in order to characterize -determinizable WFAs. Finally, we describe a polynomial algorithm for deciding whether a given WFA has the -twins property. [Copyright &y& Elsevier]

Abstract: It has long been known that past-time operators add no expressive power to linear temporal logics. In this paper, we consider the extension of branching temporal logics with past-time operators. Two possible views regarding the nature of past in a branching-time model induce two different such extensions. In the first view, past is branching and each moment in time may have several possible futures and several possible pasts. In the second view, past is linear and each moment in time may have several possible futures and a unique past. Both views assume that past is finite. We discuss the practice of these extensions as specification languages, characterize their expressive power, and examine the complexity of their model-checking and satisfiability problems. [Copyright &y& Elsevier]

Abstract: We present a unified game-based approach for branching-time model checking of hierarchical systems. Such systems are exponentially more succinct than standard state-transition graphs, as repeated sub-systems are described only once. Early work on model checking of hierarchical systems shows that one can do better than a naive algorithm that “flattens” the system and removes the hierarchy. Given a hierarchical system and a branching-time specification ψ for it, we reduce the model-checking problem (does satisfy ψ?) to the problem of solving a hierarchical game obtained by taking the product of with an alternating tree automaton for ψ. Our approach leads to clean, uniform, and improved model-checking algorithms for a variety of branching-time temporal logics. In particular, by improving the algorithm for solving hierarchical parity games, we are able to solve the model-checking problem for the μ-calculus in Pspace and time complexity that is only polynomial in the depth of the hierarchy. Our approach also leads to an abstraction-refinement paradigm for hierarchical systems. The abstraction maintains the hierarchy, and is obtained by merging both states and sub-systems into abstract states. [Copyright &y& Elsevier]

A rational and selfish environment may have an incentive to cheat the system it interacts with. Cheating the system amounts to reporting a stream of inputs that is different from the one corresponding to the real behavior of the environment. The system may cope with cheating by charging penalties to cheats it detects. In this paper, we formalize this setting by means of weighted automata and their resilience to selfish environments. Automata have proven to be a successful formalism for modeling the on-going interaction between a system and its environment. In particular, weighted finite automata (WFAs), which assign a cost to each input word, are useful in modeling an interaction that has a quantitative outcome. Consider a WFA over the alphabet Σ. At each moment in time, the environment may cheat by reporting a letter different from the one it actually generates. A penalty function maps each possible false-report to a penalty, charged whenever the false-report is detected. A detection-probability function gives the probability of detecting each false-report. We say that is -resilient to cheating if ensures that the minimal expected cost of an input word is achieved with no cheating. Thus, a rational environment has no incentive to cheat . We study the basic problems arising in the analysis of this setting. In particular, we consider the problem of deciding whether a given WFA is -resilient with respect to a given penalty function η and a detection-probability function p; and the problem of achieving resilience with minimum resources, namely, given and η, finding the minimal (with respect to ) detection-probability function p, such that is -resilient. While for general WFAs both problems are shown to be PSPACE-hard, we present polynomial-time algorithms for deterministic WFAs. [ABSTRACT FROM AUTHOR]

Multi-valued Kripke structures are Kripke structures in which the atomic propositions and the transitions are not Boolean and can take values from some set. In particular, latticed Kripke structures, in which the elements in the set are partially ordered, are useful in abstraction, query checking, and reasoning about multiple view-points. The challenges that formal methods involve in the Boolean setting are carried over, and in fact increase, in the presence of multi-valued systems and logics. We lift to the latticed setting two basic notions that have been proven useful in the Boolean setting. We first define latticed simulation between latticed Kripke structures. The relation maps two structures M1 and M2 to a lattice element that essentially denotes the truth value of the statement "every behavior of M1 is also a behavior of M2". We show that latticed-simulation is logically characterized by the universal fragment of latticed µ-calculus, and can be calculated in polynomial time. We then proceed to defining latticed two-player games. Such games are played along graphs in which each transition have a value in the lattice. The value of the game essentially denotes the truth value of the statement "the ∨-player can force the game to computations that satisfy the winning condition". An earlier definition of such games involved a zig-zagged traversal of paths generated during the game. Our definition involves a forward traversal of the paths, and it leads to better understanding of multi-valued games. In particular, we prove a min-max property for such games, and relate latticed simulation with latticed games. [ABSTRACT FROM AUTHOR]

The complementation problem for nondeterministic word automata has numerous applications in formal verification. In particular, the language-containment problem, to which many verification problems is reduced, involves complementation. For automata on finite words, which correspond to safety properties, complementation involves determinization. The 2n blow-up that is caused by the subset construction is justified by a tight lower bound. For Büchi automata on infinite words, which are required for the modeling of liveness properties, optimal complementation constructions are quite complicated, as the subset construction is not sufficient. From a theoretical point of view, the problem is considered solved since 1988, when Safra came up with a determinization construction for Büchi automata, leading to a 2O(n log n) complementation construction, and Michel came up with a matching lower bound. A careful analysis, however, of the exact blow-up in Safra's and Michel's bounds reveals an exponential gap in the constants hiding in the O( ) notations: while the upper bound on the number of states in Safra's complementary automaton is n2n, Michel's lower bound involves only an n! blow up, which is roughly (n/e)n. The exponential gap exists also in more recent complementation constructions. In particular, the upper bound on the number of states in the complementation construction of Kupferman and Vardi, which avoids determinization, is (6n)n. This is in contrast with the case of automata on finite words, where the upper and lower bounds coincides. In this work we describe an improved complementation construction for nondeterministic Büchi automata and analyze its complexity. We show that the new construction results in an automaton with at most (0.96n)n states. While this leaves the problem about the exact blow up open, the gap is now exponentially smaller. From a practical point of view, our solution enjoys the simplicity of the construction of Kupferman and Vardi, and results in much smaller automata. [ABSTRACT FROM AUTHOR]

We introduce and study three notions of typeness for automata on infinite words. For an acceptance-condition class γ (that is, γ is weak, Büchi, co-Büchi, Rabin, or Streett), deterministic γ-typeness asks for the existence of an equivalent γ-automaton on the same deterministic structure, nondeterministic γ-typeness asks for the existence of an equivalent γ-automaton on the same structure, and γ-powerset-typeness asks for the existence of an equivalent γ-automaton on the (deterministic) powerset structure – one obtained by applying the subset construction. The notions are helpful in studying the complexity and complication of translations between the various classes of automata. For example, we prove that deterministic Büchi automata are co-Büchi type; it follows that a translation from deterministic Büchi to deterministic co-Büchi automata, when exists, involves no blow up. On the other hand, we prove that nondeterministic Büchi automata are not co-Büchi type; it follows that a translation from a nondeterministic Büchi to nondeterministic co-Büchi automata, when exists, should be more complicated than just redefining the acceptance condition. As a third example, by proving that nondeterministic co-Büchi automata are Büchi-powerset type, we show that a translation of nondeterministic co-Büchi to deterministic Büchi automata, when exists, can be done applying the subset construction. We give a complete picture of typeness for the weak, Büchi, co-Büchi, Rabin, and Streett acceptance conditions, and discuss its usefulness. [ABSTRACT FROM AUTHOR]

In formal verification, we verify that a system is correct with respect to a specification. Even when the system is proven to be correct, there is still a question of how complete the specification is and whether it really covers all the behaviors of the system. The challenge of making the verification process as exhaustive as possible is even more crucial in simulation-based verification, where the infeasible task of checking all input sequences is replaced by checking a test suite consisting of a finite subset of them. It is very important to measure the exhaustiveness of the test suite, and indeed there has been extensive research in the simulation-based verification community on coverage metrics, which provide such a measure. It turns out that no single measure can be absolute, leading to the development of numerous coverage metrics whose usage is determined by industrial verification methodologies. On the other hand, prior research of coverage in formal verification has focused solely on state-based coverage. In this paper we adapt the work done on coverage in simulation-based verification to the formal-verification setting in order to obtain new coverage metrics. Thus, for each of the metrics used in simulation-based verification, we present a corresponding metric that is suitable for the setting of formal verification and describe an algorithmic way to check it. [ABSTRACT FROM AUTHOR]

Abstract: One source of complexity in the -calculus is its ability to specify an unbounded number of switches between universal and existential branching modes. We therefore study the problems of satisfiability, validity, model checking, and implication for the universal and existential fragments of the -calculus, in which only one branching mode is allowed. The universal fragment is rich enough to express most specifications of interest, and therefore improved algorithms are of practical importance. We show that while the satisfiability and validity problems become indeed simpler for the existential and universal fragments, this is, unfortunately, not the case for model checking and implication. We also show the corresponding results for the alternation-free fragment of the -calculus, where no alternations between least and greatest fixed points are allowed. Our results imply that efforts to find a polynomial-time model-checking algorithm for the -calculus can be replaced by efforts to find such an algorithm for the universal or existential fragment. [Copyright &y& Elsevier]

Abstract: In the automata-theoretic approach to verification, we translate specifications to automata. Complexity considerations motivate the distinction between different types of automata. Already in the 60s, it was known that deterministic Büchi word automata are less expressive than nondeterministic Büchi word automata. The proof is easy and can be stated in a few lines. In the late 60s, Rabin proved that Büchi tree automata are less expressive than Rabin tree automata. This proof is much harder. In this work we relate the expressiveness gap between deterministic and nondeterministic Büchi word automata and the expressiveness gap between Büchi and Rabin tree automata. We consider tree automata that recognize derived languages. For a word language , the derived language of , denoted , is the set of all trees all of whose paths are in . Since often we want to specify that all the computations of the program satisfy some property, the interest in derived languages is clear. Our main result shows that is recognizable by a nondeterministic Büchi word automaton but not by a deterministic Büchi word automaton iff is recognizable by a Rabin tree automaton and not by a Büchi tree automaton. Our result provides a simple explanation for the expressiveness gap between Büchi and Rabin tree automata. Since the gap between deterministic and nondeterministic Büchi word automata is well understood, our result also provides a characterization of derived languages that can be recognized by Büchi tree automata. Finally, it also provides an exponential determinization of Büchi tree automata that recognize derived languages. [Copyright &y& Elsevier]

Abstract: In the automata-theoretic approach to model checking we check the emptiness of the product of a system S with an automaton for the complemented specification. This gives rise to two automata-theoretic problems: complementation of word automata, which is used in order to generate , and the emptiness problem, to which model checking is reduced. Both problems have numerous other applications, and have been extensively studied for nondeterministic Büchi word automata (NBW). Nondeterministic generalized Büchi word automata (NGBW) have become popular in specification and verification and are now used in applications traditionally assigned to NBW. This is due to their richer acceptance condition, which leads to automata with fewer states and a simpler underlying structure. In this paper we analyze runs of NGBW and use the analysis in order to describe a new complementation construction and a symbolic emptiness algorithm for NGBW. The complementation construction exponentially improves the best known construction for NGBW and is easy to implement. The emptiness algorithm is almost identical to a known variant of the Emerson–Lei algorithm, and our contribution is the strong relation we draw between the complementation construction and the emptiness algorithm—both naturally follow from the analysis of the runs, which easily implies their correctness. This relation leads to a new certified model-checking procedure, where a positive answer to the model-checking query is accompanied by a certificate whose correctness can be checked by methods independent of the model checker. Unlike certificates generated in previous works on certified model checking, our analysis enables us to generate a certificate that can be checked automatically and symbolically. [Copyright &y& Elsevier]

Abstract: We continue the study of combinatorial property testing. For a property , an -test for , for , is a randomized algorithm that given an input x, returns “yes’’ if x satisfies , and returns “no’’ with high probability if x is -far from satisfying , where -far essentially means that an -fraction of x needs to be changed in order for it to satisfy . In (Proceedings of the 40th IEEE Symposium on Foundations of Computer Science, 1999, pp. 645–655), Alon et al. show that regular languages are -testable with a constant (depends on and and independent of x) number of queries. We extend the result in (Proceedings of the 40th IEEE Symposium on Foundations of Computer Science, 1999, pp. 645–655) to -regular languages: given a nondeterministic Büchi automaton on infinite words and a small , we describe an algorithm that gets as input an infinite lasso-shape word of the form , for finite words x and y, samples only a constant number of letters in x and y, returns “yes’’ if , and returns “no’’ with probability if is -far from . We also discuss the applicability of property testing to formal verification, where -regular languages are used for the specification of the behavior of nonterminating reactive systems, and computations correspond to lasso-shape words. [Copyright &y& Elsevier]

We consider state-based behavior in object-oriented analysis and design, as it arises, for example, in specifying behavior in the UML using statecharts. We first provide a rigorous and analyzable model of object systems and their reactivity. The definition is for basic one-thread systems, but can be extended in appropriate ways to more elaborate models. We then address the notion of inheritance and behavioral conformity and the resulting substitutability of classes, whereby inheriting should retain the system's original behaviors. Inheritance is a central issue of crucial importance to the modelling, design, and verification of object-oriented systems, and the many deep and unresolved questions around it cannot be addressed without a precise definition of the systems under consideration. We use our definition to give a clear and rigorous picture of what exactly is meant by behavioral conformity and how computationally complex it is to detect. [ABSTRACT FROM AUTHOR]

In implementation verification, we check that an implementation is correct with respect to a specification by checking whether the behaviors of a transition system that models the program''s implementation correlate with the behaviors of a transition system that models its specification. In this paper, we investigate the effect of concurrency on the complexity of implementation verification. We consider trace-based and tree-based approaches to the verification of concurrent transition systems, with and without fairness. Our results show that in almost all cases the complexity of the problem is exponentially harder than that of the sequential case. Thus, as in the model-checking verification methodology, the state-explosion problem cannot be avoided. [Copyright &y& Elsevier]

The simulation preorder for labeled transition systems is defined locally, and operationally, as a game that relates states with their immediate successor states. Simulation enjoys many appealing properties. First, simulation has a denotational characterization: system S simulates system I iff every computation tree embedded in the unrolling of I can be embedded also in the unrolling of S. Second, simulation has a logical characterization: S simulates I iff every universal branching-time formula satisfied by S is satisfied also by I. It follows that simulation is a suitable notion of implementation, and it is the coarsest abstraction of a system that preserves universal branching-time properties. Third, based on its local definition, simulation between finite-state systems can be checked in polynomial time. Finally, simulation implies trace containment, which cannot be defined locally and requires polynomial space for verification. Hence simulation is widely used both in manual and in automatic verification. Liveness assumptions about transition systems are typically modeled using fairness constraints. Existing notions of simulation for fair transition systems, however, are not local, and as a result, many appealing properties of the simulation preorder are lost. We propose a new view of fair simulation by extending the local definition of simulation to account for fairness: system Sfairly simulates system I iff in the simulation game, there is a strategy that matches with each fair computation of I a fair computation of S. Our definition enjoys a denotational characterization and has a logical characterization: S fairly simulates I iff every fair computation tree (whose infinite paths are fair) embedded in the unrolling of I can be embedded also in the unrolling of S or, equivalently, iff every Fair-∀AFMC formula satisfied by S is satisfied also by I (∀AFMC is the universal fragment of the alternation-free μ-calculus). The locality of the definition leads us to a polynomial-time algorithm for checking fair simulation for finite-state systems with weak and strong fairness constraints. Finally, fair simulation implies fair trace containment and is therefore useful as an efficiently computable local criterion for proving linear-time abstraction hierarchies of fair systems. [Copyright &y& Elsevier]

Presents a study which considered assume-guarantee specifications in which the guarantee is specified by branching temporal formulas in modular verification in programming. Types of temporal logics; Conclusions.

Capacitated automata (CAs), introduced by Kupferman and Tamir at 2014, are a variant of finite-state automata in which each transition is associated with a (possibly infinite) capacity that bounds the number of times the transition may be traversed in a single run. We continue the study of the theoretical properties of CA and solve problems that were left open by Kupferman and Tamir. We show that union and intersection of CAs involve an exponential blow-up and that determinization and complementation involve a doubly-exponential blow-up. This blow-up is carried over to the complexity of the universality and containment problems, which we show to be EXPSPACE-complete. On the positive side, capacities do not increase the complexity when used in the deterministic setting. Also, the containment problem for nondeterministic CAs is PSPACE-complete when capacities are used only in the left-hand side automaton. Our results suggest that while the succinctness of CAs leads to a corresponding increase in the complexity of some decision problems, there are also cases in which succinctness comes at no price. The study of CAs concerns the linear-time approach. We continue to study the branching-time approach, where the corresponding model is that of capacitated systems , and the interesting relation between systems is simulation. We study a game-theoretic approach to simulation of capacitated systems, and prove that deciding simulation between capacitated systems is PSPACE-complete. Thus, while in the linear-time approach the naive algorithm that removes capacities from the CA is optimal, in the branching-time approach we can do better than capacity removal. [ABSTRACT FROM AUTHOR]

In resource allocation games , selfish players share resources that are needed in order to fulfill their objectives. The cost of using a resource depends on the load on it. In the traditional setting, the players make their choices concurrently and in one-shot. That is, a strategy for a player is a subset of the resources. We introduce and study dynamic resource allocation games. In this setting, the game proceeds in phases. In each phase each player chooses one resource. A scheduler dictates the order in which the players proceed in a phase, possibly scheduling several players to proceed concurrently. The game ends when each player has collected a set of resources that fulfills his objective. The cost for each player then depends on this set as well as on the load on the resources in it – we consider both congestion and cost-sharing games. We argue that the dynamic setting is the suitable setting for many applications in practice. We study the stability of dynamic resource allocation games, where the appropriate notion of stability is that of subgame perfect equilibrium, study the inefficiency incurred due to selfish behavior, and also study problems that are particular to the dynamic setting, like constraints on the order in which resources can be chosen or the problem of finding a scheduler that achieves stability. [ABSTRACT FROM AUTHOR]

The size of deterministic automata required for recognizing regular and ω -regular languages is a well-studied measure for the complexity of languages. We introduce and study a new complexity measure, based on the sensing required for recognizing the language. Intuitively, the sensing cost quantifies the detail in which a random input word has to be read in order to decide its membership in the language. We study the sensing cost of regular and ω -regular languages, as well as applications of the study in practice, especially in the monitoring and synthesis of reactive systems. [ABSTRACT FROM AUTHOR]

Network games are widely used as a model for selfish resource-allocation problems. The classical model abstracts the fact that different users may use a resource at different times and for different duration – factors that play an important role in determining the costs of the users in reality. We consider here timed network games , which add time to network games. Each vertex v in the network is associated with a cost function, mapping the load on v to the price that a player pays for staying in v for one time unit with this load. The network is equipped with clocks , and, as in timed automata, edges are guarded by constraints on the values of the clocks, and their traversal may involve resetting some clocks. We also study the fragment of network games with a single clock that is not reset and thus keeps track only of the global time elapsed. [ABSTRACT FROM AUTHOR]

Presents a responses to a comment on object systems and behavioral inheritance. Augmentation of the symbols.

Weighted automata map input words to values, and have numerous applications in computer science. A result by Krob from the 90s implies that the universality problem is decidable for weighted automata over the tropical semiring with weights in N ∪ { ∞ } and is undecidable when the weights are in Z ∪ { ∞ }. We continue the study of the borders of decidability in weighted automata over the tropical semiring. We give a complete picture of the decidability and complexity of various decision problems for them, including non-emptiness, universality, equality, and containment. For the undecidability results, we provide direct proofs, which stay in the terrain of state machines. This enables us to tighten the results and apply them to a very simple class of automata. In addition, we provide a toolbox of algorithms and techniques for weighted automata, on top of which we establish the complexity bounds. [ABSTRACT FROM AUTHOR]

We consider concurrent two-player games with reachability objectives. In such games, at each round, player 1 and player 2 independently and simultaneously choose moves, and the two choices determine the next state of the game. The objective of player 1 is to reach a set of target states; the objective of player 2 is to prevent this. These are zero-sum games, and the reachability objective is one of the most basic objectives: determining the set of states from which player 1 can win the game is a fundamental problem in control theory and system verification. There are three types of winning states, according to the degree of certainty with which player 1 can reach the target. From type-1 states, player 1 has a deterministic strategy to always reach the target. From type-2 states, player 1 has a randomized strategy to reach the target with probability 1. From type-3 states, player 1 has for every real a randomized strategy to reach the target with probability greater than . We show that for finite state spaces, all three sets of winning states can be computed in polynomial time: type-1 states in linear time, and type-2 and type-3 states in quadratic time. The algorithms to compute the three sets of winning states also enable the construction of the winning and spoiling strategies. [Copyright &y& Elsevier]

Network games (NGs) are played on directed graphs and are extensively used in network design and analysis. Search problems for NGs include finding special strategy profiles such as a Nash equilibrium and a globally-optimal solution. The networks modeled by NGs may be huge. In formal verification, abstraction has proven to be an extremely effective technique for reasoning about systems with big and even infinite state spaces. We describe an abstraction-refinement methodology for reasoning about NGs. Our methodology is based on an abstraction function that maps the state space of an NG to a much smaller state space. We search for a global optimum and a Nash equilibrium by reasoning on an under- and an over-approximation defined on top of this smaller state space. When the approximations are too coarse to find such profiles, we refine the abstraction function. We extend the abstraction-refinement methodology to labeled networks, where the objectives of the players are regular languages. Our experimental results demonstrate the effectiveness of the methodology. [ABSTRACT FROM AUTHOR]