#### DMCA

## Alternating-time Temporal Logic (1997)

### Cached

### Download Links

- [www-cad.eecs.berkeley.edu]
- [www.cis.upenn.edu]
- [www.cis.upenn.edu]
- [www.cis.upenn.edu]
- [www.cis.upenn.edu]
- [www.cis.upenn.edu]
- [www.eecs.berkeley.edu]
- DBLP

### Other Repositories/Bibliography

Venue: | Journal of the ACM |

Citations: | 605 - 53 self |

### Citations

4101 | Communicating sequential processes
- Hoare
- 1978
(Show Context)
Citation Context ...e an open system is a system that interacts with its environment and whose behavior depends on the state of the system as well as the behavior of the environment. Models for open systems, such as CSP =-=[Hoa85]-=-, I/O automata [Lyn96], and reactive modules [AH96], distinguish between internal nondeterminism, choices made by the system, and externalsnondeterminism, choices made by the environment. Consequently... |

2620 | A theory of timed automata
- Alur, Dill
- 1994
(Show Context)
Citation Context ...d game structures are infinite-state. In order to consider algorithmic solutions, we restrict our attention to timed game structures that are generated by a finite syntax borrowed from timed automata =-=[4]-=-. By restricting the strategies of TATL games to physically meaningful strategies using WC, we obtain TATL ∗ games. However, solving TATL ∗ games is undecidable, because TATL ∗ subsumes the linear-tim... |

1949 |
Distributed Algorithms
- Lynch
- 1996
(Show Context)
Citation Context ...system that interacts with its environment and whose behavior depends on the state of the system as well as the behavior of the environment. Models for open systems, such as CSP [Hoa85], I/O automata =-=[Lyn96]-=-, and reactive modules [AH96], distinguish between internal nondeterminism, choices made by the system, and externalsnondeterminism, choices made by the environment. Consequently, besides universal (d... |

1623 |
The Temporal Logic of Programs
- Pnueli
(Show Context)
Citation Context ...res doubly exponential time for both synchronous and asynchronous systems. 1 Introduction In 1977, Pnueli proposed to use linear-time temporal logic (LTL) to specify requirements for reactive systems =-=[Pnu77]-=-. A formula of LTL is interpreted over a computation, which is an infinite sequence of states. A reactive system satisfies an LTL formula if all its computations do. Due to the implicit use of univers... |

1493 | The Model Checker Spin
- Holzmann
- 1997
(Show Context)
Citation Context ...em of model checking is to verify whether a finite-state abstraction of a reactive system satisfies a temporal-logic specification [CE81, QS81]. Efficient model checkers exist for both LTL (e.g. SPIN =-=[Hol97]-=-) and CTL (e.g. SMV [McM93]), and are increasingly being used as debugging aids for industrial designs. The logics LTL and CTL have their natural interpretation over the computations of closed systems... |

1475 |
Symbolic model checking
- McMillan
- 1993
(Show Context)
Citation Context ...verify whether a finite-state abstraction of a reactive system satisfies a temporal-logic specification [CE81, QS81]. Efficient model checkers exist for both LTL (e.g. SPIN [Hol97]) and CTL (e.g. SMV =-=[McM93]-=-), and are increasingly being used as debugging aids for industrial designs. The logics LTL and CTL have their natural interpretation over the computations of closed systems, where a closed system is ... |

1373 | Automatic verification of finite-state concurrent systems using temporal logic specifications
- Clarke, Emerson, et al.
- 1986
(Show Context)
Citation Context ...he structure complexity of the problem is also PTIME-complete. It is interesting to compare the model-checking complexities of synchronous ATL and CTL. While both problems can be solved in time O(m`) =-=[CES86]-=-, the structure complexity of CTL model checking is only NLOGSPACE-complete [BVW94]. This is because CTL model checking is related to graph reachability, as synchronous ATL model checking is related t... |

1010 | E.: Design and Synthesis of Synchronization Skeletons using Branching Time Temporal Logic - Clarke, Emerson - 1982 |

788 | The control of discrete event systems
- Ramadge, Wonham
- 1989
(Show Context)
Citation Context ...ynthesis problem requires the construction of a reactive system that assigns to every possible input sequence an output sequence so that the resulting computation satisfies /. (3) Supervisory control =-=[RW89]-=-: given a finite-state machine whose transitions are partitioned into controllable and uncontrollable, and a set of safe states, the control problem requires the construction of a controller that choo... |

596 | Composing Specifications - Abadi, Lamport - 1989 |

568 | S.: Symbolic model checking for real-time systems
- Henzinger, Nicollin, et al.
- 1994
(Show Context)
Citation Context ... 〈1〉 � ✷true) ∧ ( � 〈2〉 � ✷true) This well-formedness check is the generalization to the game setting of the non-zenoness check for timed automata, which computes the states s such that s |=td ∃✷true =-=[18]-=-. If not all states of [T ] are well-formed, then the location invariants of T can be strengthened to characterize well-formed states (note that the set of well-formed states consists of a union of re... |

471 | On the synthesis of a reactive module - Pnueli, Rosner - 1989 |

354 | P.: An Automata-Theoretic Approach to Branching-Time Model Checking
- Kupferman, Vardi, et al.
- 2000
(Show Context)
Citation Context ... compare the model-checking complexities of synchronous ATL and CTL. While both problems can be solved in time O(m`) [CES86], the structure complexity of CTL model checking is only NLOGSPACE-complete =-=[BVW94]-=-. This is because CTL model checking is related to graph reachability, as synchronous ATL model checking is related to AND-OR graph reachability. 3.2 The asynchronous model Consider an asynchronous st... |

334 | Sometimes” and “Not Never” revisited: On branching versus linear time temporal logic - Emerson, Halpern - 1986 |

323 | Reactive modules
- Alur, Henzinger
- 1996
(Show Context)
Citation Context ... environment and whose behavior depends on the state of the system as well as the behavior of the environment. Models for open systems, such as CSP [Hoa85], I/O automata [Lyn96], and reactive modules =-=[AH96]-=-, distinguish between internal nondeterminism, choices made by the system, and externalsnondeterminism, choices made by the environment. Consequently, besides universal (do all computations satisfy a ... |

323 | Model-checking in dense real-time
- Alur, Courcoubetis, et al.
- 1993
(Show Context)
Citation Context ...eze quantifiers [5] for specifying timing constraints. The resulting logics are called TATL and TATL ∗ . The new logic TATL subsumes both the untimed game logic ATL, and the timed non-game logic TCTL =-=[3]-=-. For example, the TATL formula � 〈i〉 � ✸≤d p is true at a state s iff player i can force the game from s into a p state in at most d time units. A version of TATL has recently been studied on duratio... |

301 | A really temporal logic
- Alur, Henzinger
- 1989
(Show Context)
Citation Context ...e at a state s iff player i can force the game from s into a state that satisfies the proposition p. We interpret these logics over timed game structures, and enrich them by adding freeze quantifiers =-=[5]-=- for specifying timing constraints. The resulting logics are called TATL and TATL ∗ . The new logic TATL subsumes both the untimed game logic ATL, and the timed non-game logic TCTL [3]. For example, t... |

281 | Trace Theory for Automatic Hierarchical Verification of Speed-independent Circuits - Dill - 1989 |

279 |
Results on the propositional -calculus
- Kozen
- 1983
(Show Context)
Citation Context ...xpoint logic Temporal properties using the until operator can be defined as fixed points of next-time properties. For closed systems, this gives the ��-calculus as a generalization of temporal log=-=ics [Koz83]. In-=- a similar fashion, one can generalize alternating-time temporal logics to obtain an alternating-time ��-calculus, whose primitives are the parameterized next constructs hhAii and [[A]] , least an... |

240 |
P.: Automata-Theoretic Techniques for Modal Logics of Programs
- Vardi, Wolper
- 1986
(Show Context)
Citation Context ...L specifications, at no extra cost. In the asynchronous model, due to the presence of fairness constraints, ATL model checking requires the solution of infinite games, namely, generalized Buchi games =-=[VW86]-=-. Consequently, the model-checking complexity is quadratic in the size of the system, and the symbolic algorithm involves a nested fixed-point computation. The model-checking problem for ATL ? is much... |

239 | On the synthesis of discrete controllers for timed systems
- Maler, Pnueli, et al.
- 1995
(Show Context)
Citation Context ...we show that for timed automaton games, the optimal answers can be approximated to within any degree of precision. 1 Introduction Timed games are a formal model for the synthesis of real-time systems =-=[22, 20]-=-. While much research effort has been directed at algorithms for solving timed games [14, 9, 7, 16, 15, 8, 11], we find it useful to revisit the topic for two reasons. First, we wish to study a perfec... |

192 | On the synthesis of strategies in infinite games
- Thomas
- 1995
(Show Context)
Citation Context ...y, the full history of the game up to the current state. However, since all involved games are !- regular, the existence of a winning strategy implies the existence of a winning finite-state strategy =-=[Tho95]-=-, which depends only on a finite amount of information about the history of the game. Thus, the semantics of ATL and ATL ? can be defined, equivalently, using the outcomes of finite-state strategies o... |

190 | The complexity of tree automata and logics of programs (extended abstract - Emerson, Jutla - 1988 |

155 | Controller Synthesis For Timed Automata
- Asarin, Pnueli
- 1998
(Show Context)
Citation Context ...rategies, which do not allow a player to prevent time from diverging in order to achieve an objective. This restriction is often ensured by syntactic conditions on the cycles of timed automaton games =-=[7, 16, 8, 21]-=- or by semantic conditions that discretize time. We find such conditions unsatisfactory and unnecessary: unsatisfactory, because they rule out perfectly meaningful strategies that suggest an arbitrary... |

144 | Specification and Verification of Concurrent Systems - Queille, Sifakis - 1982 |

111 | Module checking
- Kupferman, Vardi, et al.
- 2001
(Show Context)
Citation Context ...uires the construction of a controller that chooses the controllable transitions so that the machine always stays within the safe set (or satisfies some more general LTL formula). (4) Module checking =-=[KV96]-=-: given an open system and a CTL ? formula ', the module-checking problem is to determine if, no matter how the environment restricts the external choices, the system satisfies '. All the above approa... |

98 | On the synthesis of an asynchronous reactive module - Pnueli, Rosner - 1989 |

90 | Efficient on-the-fly algorithms for the analysis of timed games
- Cassez, David, et al.
- 2005
(Show Context)
Citation Context ... degree of precision. 1 Introduction Timed games are a formal model for the synthesis of real-time systems [22, 20]. While much research effort has been directed at algorithms for solving timed games =-=[14, 9, 7, 16, 15, 8, 11]-=-, we find it useful to revisit the topic for two reasons. First, we wish to study a perfectly symmetric setup of the model, where all players (whether they represent a plant, a controller, a scheduler... |

87 | Liveness in Timed and Untimed Systems - Gawlick, Segala, et al. - 1993 |

79 | Discrete-time control for rectangular hybrid automata. TCS
- Henzinger, Kopke
- 1999
(Show Context)
Citation Context ...TATL. Theorem 1. The model-checking problem for TATL (over timed automaton games) is EXPTIME-complete. EXPTIME-hardness follows from the EXPTIME-hardness of alternating reachability on timed automata =-=[17]-=-.sModel checking of TATL allows us to check the well-formedness of a timed automaton game T: a state s of the timed game structure [T ] is well-formed iff s |=td ( � 〈1〉 � ✷true) ∧ ( � 〈2〉 � ✷true) Th... |

77 | As soon as possible: Time optimal control for timed automata
- Asarin, Maler
(Show Context)
Citation Context ... degree of precision. 1 Introduction Timed games are a formal model for the synthesis of real-time systems [22, 20]. While much research effort has been directed at algorithms for solving timed games =-=[14, 9, 7, 16, 15, 8, 11]-=-, we find it useful to revisit the topic for two reasons. First, we wish to study a perfectly symmetric setup of the model, where all players (whether they represent a plant, a controller, a scheduler... |

73 |
Minimum and maximum delay problems in real-time systems
- Courcoubetis, Yannakakis
- 1991
(Show Context)
Citation Context ...is to determine the minimal time in which a player can force the game into a set of target states, using only reasonable strategies. This game problem is the generalisation of the non-game version of =-=[12]-=-. Formally, given a player i ∈ {1, 2}, a timed game structure G, a target proposition p ∈ Σ, and a run r of G, let T i ⎧ ⎪⎨ ∞ if r �∈ Timediv and r �∈ Blamelessi; ∞ if r ∈ Timediv and r does not visit... |

61 |
Number of quantifiers is better than number of tape cells
- Immerman
- 1981
(Show Context)
Citation Context ... solved in time linear in the number of edges, it follows that the labeling procedure requires linear time for each subformula. Furthermore, since reachability for AND-OR graphs, a PTIME-hard problem =-=[Imm81]-=-, can be reduced to model checking for synchronous ATL, we conclude the following theorem. Theorem 3.1 The synchronous model-checking problem for ATL is PTIME-complete, and can be solved in time O(m`)... |

61 | Optimal Strategies in Priced Timed Game Automata
- BOUYER, CASSEZ, et al.
- 2004
(Show Context)
Citation Context ... degree of precision. 1 Introduction Timed games are a formal model for the synthesis of real-time systems [22, 20]. While much research effort has been directed at algorithms for solving timed games =-=[14, 9, 7, 16, 15, 8, 11]-=-, we find it useful to revisit the topic for two reasons. First, we wish to study a perfectly symmetric setup of the model, where all players (whether they represent a plant, a controller, a scheduler... |

57 | The element of surprise in timed games
- Alfaro, Faella, et al.
- 2003
(Show Context)
Citation Context ...r of transitions in a finite interval of time; unnecessary, because timed automaton games can be solved without such conditions. We do not present a new model for timed games, but review the model of =-=[13]-=-, which is symmetric for all players and handles the divergence of dense time without constraining the players. We consider the two-player case. Previous work on the existence of controllers [14, 9, 2... |

55 |
Modular synthesis of reactive systems
- Rosner
- 1992
(Show Context)
Citation Context ...e asynchronous case can be reduced to the synchronous case similar to the proof of Theorem 3.2. For the lower bounds, we use a reduction from the realizability problem of LTL, a 2EXPTIME-hard problem =-=[Ros92]-=-, to model checking for synchronous ATL ? . By contrast, CTL ? model checking is only PSPACEcomplete [CES86], and its structure complexity is NLOGSPACE-complete [BVW94]. 5 Discussion The verification ... |

52 |
Multiple-person alternation, in
- Peterson, Reif
- 1979
(Show Context)
Citation Context ...esults on multiplayer games with incomplete information, it follows that the model-checking problem for ATL with incomplete information is undecidable in both the synchronous [Yan97] and asynchronous =-=[PR79]-=- cases. In the special case that all path quantifiers are parameterized by single agents, and no cooperation between agents with different information is possible, decidability follows from the result... |

49 | Timed control with partial observability
- Bouyer, D’Souza, et al.
- 2003
(Show Context)
Citation Context |

47 |
Optimal reachability for weighted timed games
- Alur, Bernadsky, et al.
- 2004
(Show Context)
Citation Context ...he special case where every cycle of the timed automaton ensures syntactically that a positive amount of time passes [7], and the special case where the game is restricted to a finite number of moves =-=[2]-=-. The general case for weighted timed automaton games is known to be undecidable [10]. Average reward games in the framework of [13] are considered in [1], but with the durations of time moves restric... |

46 | Realizable and unrealizable concurrent program specifications - Abadi, Lamport, et al. - 1989 |

46 |
The control of dense real-time discrete event systems
- Wong-Toi, Hoffmann
- 1991
(Show Context)
Citation Context ...we show that for timed automaton games, the optimal answers can be approximated to within any degree of precision. 1 Introduction Timed games are a formal model for the synthesis of real-time systems =-=[22, 20]-=-. While much research effort has been directed at algorithms for solving timed games [14, 9, 7, 16, 15, 8, 11], we find it useful to revisit the topic for two reasons. First, we wish to study a perfec... |

44 | Module checking revisited - Kupferman, Vardi - 1997 |

44 |
Checking that finite-state concurrent pro- grams satisfy their linear specification
- Lichtenstein, Pnueli
- 1984
(Show Context)
Citation Context ...s fixed. Since the structure is typically much larger than the formula, and its size is the most common computational bottle-neck, the structure-complexity measure is of particular practical interest =-=[LP85]-=-. 3.1 The synchronous model Model checking for synchronous ATL is very similar to CTL model checking [CE81, QS81, BCM + 90]. We first present a symbolic algorithm, which manipulates state sets of the ... |

34 | Timed control synthesis for external specifications - D’Souza, Madhusudan - 2002 |

30 | On Optimal Timed Strategies
- BRIHAYE, BRUYÈRE, et al.
- 2005
(Show Context)
Citation Context ...a positive amount of time passes [7], and the special case where the game is restricted to a finite number of moves [2]. The general case for weighted timed automaton games is known to be undecidable =-=[10]-=-. Average reward games in the framework of [13] are considered in [1], but with the durations of time moves restricted to either 0 or 1. 2 Timed Games 2.1 Timed Game Structures We borrow our formalism... |

25 | Dense real-time games
- Faella, LaTorre, et al.
- 2002
(Show Context)
Citation Context |

13 | Automata-theoretic decision of timed games
- Faella, Torre, et al.
- 2002
(Show Context)
Citation Context |

12 | Average reward timed games
- Adler, Alfaro, et al.
- 2005
(Show Context)
Citation Context ...ame is restricted to a finite number of moves [2]. The general case for weighted timed automaton games is known to be undecidable [10]. Average reward games in the framework of [13] are considered in =-=[1]-=-, but with the durations of time moves restricted to either 0 or 1. 2 Timed Games 2.1 Timed Game Structures We borrow our formalism from [13]. A timed game structure is a tuple G = 〈S, Σ, σ, A1, A2, Γ... |

6 | Checking Timed ATL for Durational Concurrent Game Structures
- LAROUSSINIE, MARKEY, et al.
- 2006
(Show Context)
Citation Context ...rmula � 〈i〉 � ✸≤d p is true at a state s iff player i can force the game from s into a p state in at most d time units. A version of TATL has recently been studied on durational concurrent structures =-=[19]-=-. The model checking of these logics requires the solution of timed games. Timed game structures are infinite-state. In order to consider algorithmic solutions, we restrict our attention to timed game... |

1 |
Deciding branchingtime logic
- Emerson, Sistla
- 1984
(Show Context)
Citation Context ...hat accepts all trees induced by out(w; FA ) for any set FA of strategies, and a Rabin tree automaton T/ that accepts all trees satisfying the CTL ? formula 8/ 0 . By [KV96], Tw;A has jW j states. By =-=[ES84]-=-, T/ has 2 2 O(j/j) states and 2 O(j/j) acceptance pairs. The intersection of the two automata is a Rabin tree automaton that contains the outcome trees satisfying 8/ 0 . Hence, by the semantics of AT... |