Results 1  10
of
31
Alternatingtime Temporal Logic
 Journal of the ACM
, 1997
"... Temporal logic comes in two varieties: lineartime temporal logic assumes implicit universal quantification over all paths that are generated by system moves; branchingtime temporal logic allows explicit existential and universal quantification over all paths. We introduce a third, more general var ..."
Abstract

Cited by 448 (47 self)
 Add to MetaCart
Temporal logic comes in two varieties: lineartime temporal logic assumes implicit universal quantification over all paths that are generated by system moves; branchingtime temporal logic allows explicit existential and universal quantification over all paths. We introduce a third, more general variety of temporal logic: alternatingtime temporal logic offers selective quantification over those paths that are possible outcomes of games, such as the game in which the system and the environment alternate moves. While lineartime and branchingtime logics are natural specification languages for closed systems, alternatingtime logics are natural specification languages for open systems. For example, by preceding the temporal operator "eventually" with a selective path quantifier, we can specify that in the game between the system and the environment, the system has a strategy to reach a certain state. Also the problems of receptiveness, realizability, and controllability can be formulated as modelchecking problems for alternatingtime formulas.
An automatatheoretic approach to linear temporal logic
 Logics for Concurrency: Structure versus Automata, volume 1043 of Lecture Notes in Computer Science
, 1996
"... Abstract. The automatatheoretic approach to linear temporal logic uses the theory of automata as a unifying paradigm for program specification, verification, and synthesis. Both programs and specifications are in essence descriptions of computations. These computations can be viewed as words over s ..."
Abstract

Cited by 217 (23 self)
 Add to MetaCart
Abstract. The automatatheoretic approach to linear temporal logic uses the theory of automata as a unifying paradigm for program specification, verification, and synthesis. Both programs and specifications are in essence descriptions of computations. These computations can be viewed as words over some alphabet. Thus,programs and specificationscan be viewed as descriptions of languagesover some alphabet. The automatatheoretic perspective considers the relationships between programs and their specifications as relationships between languages.By translating programs and specifications to automata, questions about programs and their specifications can be reduced to questions about automata. More specifically, questions such as satisfiability of specifications and correctness of programs with respect to their specifications can be reduced to questions such as nonemptiness and containment of automata. Unlike classical automata theory, which focused on automata on finite words, the applications to program specification, verification, and synthesis, use automata on infinite words, since the computations in which we are interested are typically infinite. This paper provides an introduction to the theory of automata on infinite words and demonstrates its applications to program specification, verification, and synthesis. 1
On the Synthesis of Discrete Controllers for Timed Systems
 in E.W. Mayr and C. Puech (Eds), Proc. STACS'95, LNCS 900
, 1995
"... Abstract. This paper presents algorithms for the automatic synthesis of realtime controllers by nding a winning strategy for certain games de ned by the timedautomata of Alur and Dill. In such games, the outcome depends on the players ' actions as well as on their timing. We believe that these res ..."
Abstract

Cited by 190 (20 self)
 Add to MetaCart
Abstract. This paper presents algorithms for the automatic synthesis of realtime controllers by nding a winning strategy for certain games de ned by the timedautomata of Alur and Dill. In such games, the outcome depends on the players ' actions as well as on their timing. We believe that these results will pave theway for the application of program synthesis techniques to the construction of realtime embedded systems from their speci cations. 1
Symbolic Controller Synthesis for Discrete and Timed Systems
 Hybrid Systems II, LNCS 999
, 1995
"... . This paper presents algorithms for the symbolic synthesis of discrete and realtime controllers. At the semantic level the controller is synthesized by finding a winning strategy for certain games defined by automata or by timedautomata. The algorithms for finding such strategies need, this way o ..."
Abstract

Cited by 108 (17 self)
 Add to MetaCart
. This paper presents algorithms for the symbolic synthesis of discrete and realtime controllers. At the semantic level the controller is synthesized by finding a winning strategy for certain games defined by automata or by timedautomata. The algorithms for finding such strategies need, this way or another, to search the statespace of the system which grows exponentially with the number of components. Symbolic methods allow such a search to be conducted without necessarily enumerating the statespace. This is achieved by representing sets of states using formulae (syntactic objects) over state variables. Although in the worst case such methods are as bad as enumerative ones, many huge practical problems can be treated by finetuned symbolic methods. In this paper the scope of these methods is extended from analysis to synthesis and from purely discrete systems to realtime systems. We believe that these results will pave the way for the application of program synthesis techniques to...
Synthesizing StateBased Object Systems from LSC Specifications
, 2000
"... Live sequence charts (LSCs) have been de ned recently as an extension of message sequence charts (MSCs � or their UML variant, sequence diagrams) for rich interobject speci cation. One of the main additions is the notion of universal charts and hot, mandatory behavior, which, among other things, en ..."
Abstract

Cited by 83 (23 self)
 Add to MetaCart
Live sequence charts (LSCs) have been de ned recently as an extension of message sequence charts (MSCs � or their UML variant, sequence diagrams) for rich interobject speci cation. One of the main additions is the notion of universal charts and hot, mandatory behavior, which, among other things, enables one to specify forbidden scenarios. LSCs are thus essentially as expressive as statecharts. This paper deals with synthesis, which is the problem of deciding, given an LSC speci cation, if there exists a satisfying object system and, if so, to synthesize one automatically. The synthesis problem is crucial in the development of complex systems, since sequence diagrams serve as the manifestation of use cases  whether used formally or informally  and if synthesizable they could lead directly to implementation. Synthesis is considerably harder for LSCs than for MSCs, and we tackle it by de ning consistency, showing that an entire LSC speci cation is consistent i it is satis able by a statebased object system, and then synthesizing a satisfying system as a collection of nite state machines or statecharts. 1
Generalized Model Checking: Reasoning about Partial State Spaces
, 2000
"... We discuss the problem of model checking temporal properties on partial Kripke structures, which were used in [BG99] to represent incomplete state spaces. We first extend the results of [BG99] by showing that the modelchecking problem for any 3valued temporal logic can be reduced to two modelchec ..."
Abstract

Cited by 74 (6 self)
 Add to MetaCart
We discuss the problem of model checking temporal properties on partial Kripke structures, which were used in [BG99] to represent incomplete state spaces. We first extend the results of [BG99] by showing that the modelchecking problem for any 3valued temporal logic can be reduced to two modelchecking problems for the corresponding 2valued temporal logic. We then introduce a new semantics for 3valued temporal logics that can give more definite answers than the previous one. With this semantics, the evaluation of a formula OE on a partial Kripke structure M returns the third truth value? (read "unknown") only if there exist Kripke structures M1 and M2 that both complete M and such that M1 satisfies OE while M2 violates OE, hence making the value of OE on M truly unknown. The partial Kripke structure M can thus be viewed as a partial solution to the satisfiability problem which reduces the solution space to complete Kripke structures that are more complete than M wit...
Smart PlayOut of Behavioral Requirements
 The Weizmann Institute of Science
, 2002
"... We describe a methodology for executing scenariobased requirements of reactive systems, focusing on "playingout" the behavior using formal verification techniques for driving the execution. The methodology is implemented in full in our playengine tool . The approach appears to be useful in many s ..."
Abstract

Cited by 54 (37 self)
 Add to MetaCart
We describe a methodology for executing scenariobased requirements of reactive systems, focusing on "playingout" the behavior using formal verification techniques for driving the execution. The methodology is implemented in full in our playengine tool . The approach appears to be useful in many stages in the development of reactive systems, and might also pave the way to systems that are constructed directly from their requirements, without the need for intraobject or intracomponent modeling or coding.
Synthesizing Distributed Systems
, 2001
"... In system synthesis, we transform a specication into a system that is guaranteed to satisfy the speci cation. When the system is distributed, the goal is to construct the system's underlying processes. Results on multiplayer games imply that the synthesis problem for linear specications is undecid ..."
Abstract

Cited by 42 (1 self)
 Add to MetaCart
In system synthesis, we transform a specication into a system that is guaranteed to satisfy the speci cation. When the system is distributed, the goal is to construct the system's underlying processes. Results on multiplayer games imply that the synthesis problem for linear specications is undecidable for general architectures, and is nonelementary decidable for hierarchical architectures, where the processes are linearly ordered and information among them ows in one direction. In this paper we present a signicant extension of this result. We handle both linear and branching specications, and we show that a sucient condition for decidability of the synthesis problem is a linear or cyclic order among the processes, in which information ows in either one or both directions. We also allow the processes to have internal hidden variables, and we consider communications with and without delay. Many practical applications fall into this class. 1 Introduction In system synthesis, we...
Weak alternating automata and tree automata emptiness
 In Proc. 30th STOC
, 1998
"... Abstract Automata on infinite words and trees are used for specification and verification of nonterminating programs. The verification and the satisfiability problems of specifications can be reduced to the nonemptiness problem of such automata. In a weak automaton, the state space is partitioned in ..."
Abstract

Cited by 34 (16 self)
 Add to MetaCart
Abstract Automata on infinite words and trees are used for specification and verification of nonterminating programs. The verification and the satisfiability problems of specifications can be reduced to the nonemptiness problem of such automata. In a weak automaton, the state space is partitioned into partially ordered sets, and the automaton can proceed from a certain set only to smaller sets. Reasoning about weak automata is easier than reasoning about automata with no restricted structure. In particular, the nonemptiness problem for weak alternating automata over a singleton alphabet can be solved in linear time. Known translations of alternating automata to weak alternating automata involve determinization, and therefore involve a double exponential blowup. In this paper we describe simple and efficient translations, which circumvent the need for determinization, of parity and Rabin alternating word automata to weak alternating word automata. Beyond the independent interest of such translations, they give rise to a simple algorithm for deciding the nonemptiness of nondeterministic parity and Rabin tree automata. In particular, our algorithm for Rabin automata runs in
Synchronous and bidirectional component interfaces
 In CAV 02: Proc. of 14th Conf. on Computer Aided Verification, volume 2404 of Lect. Notes in Comp. Sci
, 2002
"... ..."