SOFSEM 2009: Theory and Practice of Computer Science, 35 conf

Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen

Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Alfred Kobsa University of California, Irvine, CA, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen University of Dortmund, Germany Madhu Sudan Massachusetts Institute of Technology, MA, USA Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany

5404

Mogens Nielsen Antonín Kuˇcera Peter Bro Miltersen Catuscia Palamidessi Petr T˚uma Frank Valencia (Eds.)

SOFSEM 2009: Theory and Practice of Computer Science 35th Conference on Current Trends in Theory and Practice of Computer Science Špindler˚uv Mlýn, Czech Republic, January 24-30, 2009 Proceedings

13

Volume Editors Mogens Nielsen University of Aarhus, Aarhus Graduate School of Science Ny Munkegade Bldg 1521-110, DK-8000 Aarhus C, Denmark E-mail: [email protected] Antonín Kuˇcera Masaryk University, Faculty of Informatics Botanická 68a, 60200 Brno, Czech Republic E-mail: [email protected] Peter Bro Miltersen University of Aarhus, Department of Computer Science IT-parken, Aabogade 34, DK-8200 Aarhus N, Denmark E-mail: [email protected] Catuscia Palamidessi Frank Valencia Ecole Polytechnique Rue de Saclay, 91128 Palaiseau Cedex, France E-mail: {catuscia,frank.valencia}@lix.polytechnique.fr Petr T˚uma Charles University, Faculty of Mathematics and Physics Malostranské námˇestí 25, 118 00 Prague 1 Malá Strana, Czech Republic E-mail: [email protected] Library of Congress Control Number: Applied for CR Subject Classification (1998): F.2, F.1, D.2, H.3, H.2.8, H.4, F.3-4 LNCS Sublibrary: SL 1 – Theoretical Computer Science and General Issues ISSN ISBN-10 ISBN-13

0302-9743 3-540-95890-8 Springer Berlin Heidelberg New York 978-3-540-95890-1 Springer Berlin Heidelberg New York

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. springer.com © Springer-Verlag Berlin Heidelberg 2009 Printed in Germany Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper SPIN: 12601028 06/3180 543210

A New Analysis of Expected Revenue Combinatorial and Simultaneous Auctions Arne Andersson and Jim Wilenius Computing Science Division Dept. of Information Technology Uppsala University Box 337, SE-75105 Uppsala, Sweden {arnea,jim.wilenius}@it.uu.se

Abstract. We address the fundamental issue of revenue and efficiency in the combinatorial and simultaneous auction using a novel approach. Specifically, upper and lower bounds are constructed for the first-price sealed-bid setting of these two auctions. The question of revenue is important yet very few results can be found in the literature. Only for very small instances with 2 items have comparisons been made. Krishna et al. find that allowing combinatorial bids result in lower revenue compared to a second price simultaneous auction. We formulate a lower bound on the first-price combinatorial auction and an upper bound on the first-price simultaneous auction in a model where bidders have synergies from winning a specific set of items. With these bounds, we can (i) prove that asymptotically as the number of bidders increase, the combinatorial auction will be revenue-superior, and (ii) present a number of concrete examples where combinatorial auctions give higher expected revenue.

1

Introduction

It is a common belief that combinatorial auctions provide good solutions to resource-allocation in multi-commodity markets. The idea is that if a bidder has some synergy from winning a specific combination of items, he should be able to express this with one all-or-nothing bid (commonly combinatorial bid) for the entire combination. With such bids, and with a proper method for winner determination, it seems reasonable that the resulting allocation should be more efficient and give higher revenue to the auctioneer than if such bids were not allowed. However, although these properties seem to be fundamental, no real theoretical evidence with regards to revenue has so far been provided in the literature. In fact, the only known theoretical analysis, for the case of two items for sale [1,2], indicates an opposite result; the combinatorial auction gives a lower revenue. However, the case of two items is very far from most real cases. In the general case, we have many items and bidders, and some bidders have synergies from winning some specific combination(s) of items; for each combination the synergy is realized only when the entire combination is won. M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 1–2, 2009. c Springer-Verlag Berlin Heidelberg 2009 

2

A. Andersson and J. Wilenius

Table 1. Bidding scenario where bidders A-C have synergies on specific combinations, and bidder E bids independently on all items Bidders: item 1 item 2 item 3 item 4 item 5 item 6 Value per item: Synergy per item: Total Combination Value:

A B C • • • • • • • • • 0.8 0.5 0.6 1.0 1.0 1.0 5.4 4.5 4.8

E • • • • • • 0.7 -

An example of such a more realistic setting is illustrated in Table 1. In this example, bidders A through C each have an interest in a specific combination of items, and if they win all items in their combination they receive an extra value, a synergy. Bidder E bids on every item but has no synergy, and is indifferent to which items and the number of items he wins. The fundamental question is: if the auctioneer wishes to maximize his revenue, should he allow bids on combinations or not? In this article, we provide some new answers to these questions, by providing novel theoretical analysis of two natural and frequently used protocols: the first-price sealed-bid simultaneous auction and the first-price, sealed-bid combinatorial auction. The use of standard game theoretic tools unfortunately limits analysis to the smallest possible instances. As we will show below, these pitfalls can be avoided by formulating upper and lower bounds on the two auctions instead of deriving equilibrium strategies. This approach requires only the use of standard combinatorics and probability theory. With these bounds, we can (i) prove that asymptotically as the number of bidders increase, the combinatorial auction will be revenue-superior, and (ii) present a number of concrete examples where combinatorial auctions give higher expected revenue. We believe that our result contributes valuable new insights as well as theoretical support for the use of combinatorial auctions.

References 1. Gian, F.G., Albano, L., Lovo, S.: A comparison of standard multi-unit auctions with synergies. Economics Letters 71(1), 55–60 (2001) 2. Krishna, V., Rosenthal, R.W.: Simultaneous auctions with synergies. Games and Economic Behavior 17(1), 1–31 (1996)

Can Component/Service-Based Systems Be Proved Correct? Christian Attiogb´e LINA, UMR CNRS 6241, University of Nantes, France [email protected]

Abstract. Component-oriented and service-oriented approaches have gained a strong enthusiasm in industries and academia with a particular interest for service-oriented approaches. A component is a software entity with given functionalities, made available by a provider, and used to build other application within which it is integrated. The service concept and its use in web-based application development have a huge impact on reuse practices. Accordingly a considerable part of software architectures is influenced; these architectures are moving towards service-oriented architectures. Therefore applications (re)use services that are available elsewhere and many applications interact, without knowing each other, using services available via service servers and their published interfaces and functionalities. Industries propose, through various consortium, languages, technologies and standards. More academic works are also undertaken concerning semantics and formalisation of components and service-based systems. We consider here both streams of works in order to raise research concerns that will help in building quality software. Are there new challenging problems with respect to service-based software construction, to service construction, an especially to software verification? Besides, what are the links and the advances compared to distributed systems? A specific emphasis should be put on correctness properties of services and on service-based systems in order to ensure their quality and therefrom the durability of information systems and applications. Therefore an important research issue is to reason on the correctness of software applications that will dynamically use or embed existing services. For example, additionally to the formal specification of its functionalities, a service may embed its specific properties and the certificate/proof that guarantees these properties.

1

Introduction

Component-oriented and service-oriented approaches have gained a strong enthusiasm in industries and academia with a particular interest for service-oriented ones. A component is a software entity with given functionalities, made available by a provider, and used to build other application within which it is integrated. The M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 3–18, 2009. c Springer-Verlag Berlin Heidelberg 2009 

4

C. Attiogb´e

concept of service as a specific software entity which is delivered upon request via a network is not a new idea; think about telecommunication services, IP network services, etc. A service is a software entity that is designed for a given functionality, is made available through a network via a provider, and is linked and used on demand. An example is a calendar service used within a flight booking application in order to help the user in defining its flight departing and returning dates. The calendar service is a service integrated in the booking application; it may be replaced by another one or may even be disconnected, in which case the user may for example enter manually her/his dates. The service concept and its use in web-based application development have a huge impact on reuse practices. Accordingly a considerable part of software architectures is influenced; these architectures are moving towards service-oriented architectures (SOA). Applications (re)use services that are available elsewhere and several applications interact, without knowing each other, using the services available via service servers and their published interfaces and functionalities. The application designers are confident in the used services and their (unknown) providers; they are also confident in the used communication protocols, even if the services may have misleading semantics. Important issues at this stage are the description, the storage, the management and the retrieval of appropriate services from large certified libraries. Standardisation effort is therefore unavoidable to ensure certification. Software service descriptions take various forms; services are described either inside a software component which role is to provide a computation, or inside a software component which provides several other services as functionalities; services may be described using software components. When an external service is considered within a more general software application, one should think about the meaning of the interaction between the application and the external service and, consequently, the meaning of the application with or without the links with these external services. It is worth mentioning a few key features: service description, service discovery, service interaction, service-oriented applications and their architectures. In [15] Fiadeiro advocates for the emerging of a new discipline concerning software services. Papazoglou and van den Heuvel propose a general panel in [25] of the technology around service-oriented architecture. An accompanying work can be found in [24]. Are there new challenging problems with respect to service-based software construction, to service construction, to software verification? Besides, what are the links and the advances compared to distributed systems? Do the technical proposals meet the industry expectations? what are the current trends and the perspectives of service-oriented approaches? Considering the ubiquitous aspect of large scale distributed applications, the way software services are impacting software construction or the way they are being used or researched requires special care. The standardisation of service description languages constitutes an important step but is not yet sufficient.

Can Component/Service-Based Systems Be Proved Correct?

5

The meaning of services, their constraints and their properties are unavoidable to guarantee the well-functioning of global distributed applications that use them. The main message stressed here, is that there is a real need to think about services and components as software building units that should last several years or decades and that require for this purpose technical specifications and the guarantee of well-functioning. Indeed today Information Systems and Applications, due to the Internet, are inter-penetrated in such a way that failures or defects of some components or services may drastically impact users and their activities in the future. Then, a specific emphasis should be put on correctness properties of services and on service-based systems in order to ensure their quality. An important research issue is to reason on the correctness of software applications that will dynamically use or embed existing services provided by a third party. For example, additionally to the formal specification of its functionalities, a service may embed its specific properties and the certificate or the proof that guarantees these properties. From the methodological point of view, any given ”α-oriented” development method requires a clear description of what α is or supposed to be; therefore helping to differentiate an α-oriented approach from a β-oriented one. An α-oriented approach should make it explicit some concepts, laws, rules, guidance or method to apply it distinctly from β-oriented approach even if an α-oriented approach may be based on β-oriented ones with respect to methodological purpose. From this point of view, it should be clear how to situate service-oriented development relatively to distributed-system development. In the object-oriented approach for example, one considers the encapsulation of data and the methods that manipulate the data as elementary units (classes) which are related through inheritance, extension and client-ship. From this point of view, service-oriented approaches require a clear positioning that is currently disseminated through various existing works. However a systematic view that will favour the emergence of mature seamless development process and integrated tools and also academic courses is recommendable. According to a given business application a software functionality is a specific need which occurs time being, then an access and a link to the corresponding service is achieved on demand. The service should be first identified and the located before being used. A current widely admitted practice of service-based approaches is that services are available somewhere in the Internet; they are accessed on request and a given application may perform, during its execution access to the available services. Therefore it is worth underlying the issue on service correctness and interoperability. All these are challenging concerns. The standardisation of service descriptions including their specifications (interfaces, behaviour and semantics), their properties and their quality is the only way to overcome these challenges. The remaining of this article is structured around four sections. Section 2 is devoted to the introduction of the well-admitted notion of components and services. In Section 3 we deal with the analysis of component or services based

6

C. Attiogb´e

systems. Section 4 is devoted to research issues and related directions. Finally in Section 5 we give some concluding remarks.

2 2.1

Components and Services in Software Construction Reuse of Software

The reuse principle has always been present as a fundamental support for software construction. Functions, Modules and Classes have been the concrete entities that enforce reuse. In the same stream, Components and Services follow on, and are just the adaptation of the reuse practices to the environment of software construction. Indeed one may observe the evolution of the reuse entities from the point of view of centralised or decentralised environment. Functions, Modules and Classes are well-adapted to centralised environment. Libraries of these entities are available in situ for the software developers. With the maturity of network technologies and mainly the Internet protocols (via the TCP/IP facilities) the abstraction level of reuse entities changes: Component-based development appears in this context in the 90’s. Clearly as the software technological environment changes, abstraction level of reuse entities changes. Services are now, the most widely highlighted reuse entities. 2.2

Comparing Components and Services

Components are viewed as the abstraction of a part or a subsystem of an application. The notion of component is widely used in many disciplines and industries. For example the Hardware in a computer is made of several linked components (the CPU, input-output devices, storage units, etc). A computer is made of several components that interact at different levels (within the Hardware, the operating system and in the applications). Therefore a component is an independent building block that can be independently integrated in one application or within several applications. In a component-based approach the functionalities of a software are considered completely independent and designed as separate entities (the components) that can be composed afterthought in building a applications. The components can be designed and offered by a tier. Services are software building blocks used in building distributed applications. They are also used to integrate existing functionalities into new applications, or used to make different distributed applications communicate. A service is provided by a service provider and required by a consumer or a service client; it can be dynamically located and invoked. Therefore the network of computers, more specifically the Internet, is the support and the vehicle of services and consequently one of the main characteristics of service-based systems. Web-Services. Web-services are a specific implementation of services; they are now very popular through the industrial offers. They use XML and the Internet TCP/IP popular protocol.

Can Component/Service-Based Systems Be Proved Correct?

7

According to the W3C1 , A (web)service is a software system designed to support interoperable machine to machine interaction over a network. Components and Services share many commonalities; they are both independent entities used as building blocks in the construction of software applications. They provide interfaces to enable usage and interactions. However, a component is a packaging unit of one or several services; therefore it provides one or several services. A service can be built using components but a service is not necessarily built from components. Services are clearly located at the functionalities abstraction level. Services correspond to offered functionalities. Components are known and assembled in order to enable the usage of services. Components are integrated and compiled within new applications that use them. They become a specific part of the new application. Services are not compiled; they are dynamically linked at runtime within the applications that use them. Sharing aspect also particularise components and services. A priori a component is not shared between applications as the component is integrated within the application. One service may be shared by several clients. However there are variations on components and services that do not fit this distinction, components or their services may also be shared with specifically defined policies. From the service-based approach, interactions are not statically predefined. The services do not know their caller; service clients and the called services are bound upon request where clients behave like if services are always available. 2.3

Service-Based Systems

A service-based system is one that (re)uses services available elsewhere in the Internet to achieve its own functionalities. Note that a service-based system may be partially or totally architectured with components. The components of the system request some functionalities that are described as services outside the system. According to a user, the system is completely independent and autonomous; the user does not see the interactions on the background network. Service-based systems are distributed systems: they are systems made of collection of components (computers, software applications, devices, etc); they are perceived by a user as a single system. Their sub-systems are linked by a network equipped with communication protocols, and cooperate to share resources and to perform their assigned tasks. From the interaction point of view, services are facilities used by software applications to make communicate various sub-systems connected via the Internet in order to achieve given tasks. Compared with classical distributed systems, service-based systems have the main features but are rather impredictible for that their parts may be unknown at a given time. Indeed services are volatile distributed entities; they may be searched, dynamically linked with the rest of the system environment, and unlinked at another moment. Web-Services based applications are service-based systems that use the Internet and its protocols as the distribution platform. They are the widely used specialisation of service-based systems. 1

The World Wide Web Consortium.

8

C. Attiogb´e

2.4

Event-Based Style of Interaction

An event-based style of communication is well-adapted to the construction of service-based systems. In an event-based style of interaction, the components of a distributed application communicate via events which are generated by ones components and received by others. This kind of interaction facilitates the decoupling of components. Indeed an event notification system or an event management middleware handles the interaction between the components of the application. The components which are source or target of events are not specific components. Therefore an event-based style favours the integration of heterogeneous components and services in global applications. 2.5

Towards Standards for Service-Oriented Technology

Languages Web-Services Description Language (WSDL). The Web-Services Description Language is one of today de facto standard languages to define any kind of services. It is a markup language based on the XML. It is imposed by the industry. Business Process Execution Language (BPEL). The (Web-Service) Business Process Execution Language2 is an orchestration language for web-services; it is used to describe the interactions between web-services. BPEL can be simply viewed as a language to compose services at abstract or execution levels. Protocols Simple Object Access Protocol (SOAP). The Simple Object Access Protocol is an XML-based protocol to exchange information (or messages) in a distributed environment. It can be used in combination with a variety of other (Internet) protocols such as the HTTP protocol. It is also a protocol from the W3C consortium. Technically, the SOAP consists of three layers: – an external layer that defines a framework for describing message contents and how to process them, – a layer dedicated to data encoding; it describes a set of rules for expressing instances of application data, and – a layer dedicated to the representation convention for remote procedure calls and responses. WSDL is used to describe services based on the SOAP. Universal Description, Discovery and Integration (UDDI). The Universal Description, Discovery and Integration (UDDI) is a protocol over the HTTP protocol used to describe, locate and discover services. Web-Services conform to these standards (WSDL, SOAP, UDDI). 2

www-128.ibm.com/developerworks/library/specification/ws-bpel/

Can Component/Service-Based Systems Be Proved Correct?

2.6

9

Service-Oriented Approach and Architecture

An architecture involving web-services uses three entities and four relationships between them. The involved entities are: – a service (developer/provider), – a service registry or server (service library), – a client. The relationship are: – Service Registration, a service is registered on a server (service registry); the XML and HTTP protocol are used for that purpose; – Service Discovery: a client looks for a service by consulting a service registry which in turn sends back the located service to the client; the Universal Description, Discovery Integration (UDDI) protocol is used for this purpose. – Service Binding. A client is (dynamically) bound to the discovered service. Here, the Web-Service Description Language (WSDL) is used. – Service Invocation. A client invokes a service to which it is previously bounded. The offered service interacts with its client using the SOAP protocol. Service Oriented Architecture (SOA), originated from SUN company in the 90’s. It is an architectural style to build applications that use the services available on the Internet. The principle is that the services are loosely coupled since they are not originally known but discovered and bind upon demand; by the way, the components of an application are also loosely coupled since the services to link them are used upon demand. The SOA promotes the find, bind, use (services) method. It favours the integration of heterogeneous distributed systems. More details on SOA can be found in [11,12].

3

Formal Analysis of Component/Service-Based Systems

In the previous section we have considered the technologies of services as imposed by industries. Note that, considering problems to be solved, industrial time and delays are different from academic ones. Industrial constraints are also different; they often have to produce solutions with restricted delays. In this section, we consider the academic point of view with respect of software development features, methods and constraints. From this point of view, some stated properties need to be verified for software entities and applications. Verification is still a hard activity that consumes a lot of time and resources (and expertise on formal methods and tools). Ongoing research efforts in the context of service-oriented applications is for example the Sensoria FET European projet[13]. Related works and results on formalisation and semantics of services, reasoning on web-services, and their coordination can be found in [1,9,13,14,17].

10

3.1

C. Attiogb´e

Properties to Be Verified

First of all software service construction requires formal specifications in order to permit formal analysis. Expressive specification languages with formal semantics and tools are needed. The range of properties to be verified is very wide. To cite a few: – – – – – – – – – –

availability of service (reliability of servers), functional properties of services, reachability properties related to a given service or a functionality, side-effect functional properties, for example a called service does not take the control forever, correct interaction between a service an its clients; for example, the client is not blocked due to bad interaction with a requested service, correct interaction between the services of an application, heterogeneity and interoperability questions; services may come from various sources and have different semantic models; how do they interact, correctness of message exchange protocols, preservation of time-constraints, · · ·.

There are a real need for component/service models to face specification and verification aspects. 3.2

The Kmelia Model Proposal

We are experimenting on an abstract and formal component model named Kmelia. It is a multi-service component model formally defined [2,5]. In the Kmelia model a component has an interface made of provided services and required services. Services are used as composition units. The provided services have an interface made not only with usage information related to the signatures but also with pre and post conditions in order to ensure at least formal analysis. One strong idea of the model is that the development of component and their services may follow a formal construction (from abstract model to concrete code) in order to enable property verification at different layers. Service Specification. A Kmelia service has the following shape: service <serviceName(parameters)> interface <dependencies with other (sub)services> properties <specific property references> pre post behaviour end

Can Component/Service-Based Systems Be Proved Correct?

11

A service s of a component C is defined with an interface Is and a (dynamic) behaviour Bs : Is , Bs . Usually a required service does not have the same level of detail as a provided service since a part of these details is already in the (provided) service that calls it. The interface Is of a service s is defined by a 5-tuple σ, P, Q, Vs , Ss  where σ is the service signature (name, arguments, result). P is a precondition, Q is a postcondition, Vs is a set of local declarations and the service dependency Ss is a 4-tuple Ss = subs , cals , reqs , ints  of disjoint sets where subs (resp. cals , reqs , ints ) contains the provided services names (resp. the services required from the caller, the services required from any component, the internal services) in the s scope. Using a required service r in calp of a service p (as opposed to a component interface) implies r to be provided by the component which calls p. Using a provided service p in the subr of a service r but not in the component interface, means that p is accessible only during an interaction with r. The behaviour Bs of a service s is an extended labelled transition system (eLTS) defined by a 6-tuple S, L, δ, Φ, S0 , SF  with S the set of the states of s; L is the set of transition labels and δ is the transition relation (δ ∈ S × L → S). S0 is the initial state (S0 ∈ S), SF is the finite set of final states (SF ⊆ S), Φ is a state annotation function (Φ ∈ S → subs ). An eLTS is obtained when we allow nested states and transitions. This provides a means to reduce the LTS size and a flexible description with optional behaviours which take the form of sub-service names annotating some states. Transitions: The elements ((ss, label), ts) of δ have the concrete Kmelia syntax

ss--label-->ts where the labels are (possibly guarded) combinations of actions: [guard] action*. The actions may be elementary actions or communication

actions. An elementary action (an assignment for example) does not involve other services; it does not use a communication channel. A communication action is either a service call/response or a message communication. Therefore communications are matching pairs: send message(!)-receive message(?), call service(!!)-wait service start(??), emit service result(!!)-wait service result(??). The Kmelia syntax of a communication action (inspired by the Hoare’s CSP) is: channel(!|?|!!|??) message(param*). Channels: A communication channel is established between the interacting services when assembling components. A channel defines a context for the communication actions. At the moment one writes a behaviour, one does not know which components will communicate, but one has to know which channels will be used. A channel is usually named after the required service that represents the context. The placeholder keyword CALLER is a special channel that stands for the channel opened for a service call. From the point of view of a provided service p, CALLER is the channel that is open when p is called. From the point of view of the service that calls p, this channel is named after one of its required service, which is probably named p. The placeholder keyword SELF is a special channel that stands for the channel opened for an internal service call. In this case, the required service is also the provided service.

12

4 4.1

C. Attiogb´e

Research Issues for Service-Based Systems The Basic Context

The fundamental context of component or service-based system is that of distributed, asynchronous models. In an asynchronous model a set of processes cooperate to perform a task by exchanging messages over communication support. In some extent the context is that of distributed system with some specificities due to services such as volatility, discovery and dynamic binding. Service-based may be studied as distributed ones [8]. Correctness of component or service-based systems should be studied in this context. The good news are that distributed systems have been well researched, the bad news are that there are still challenging problems that are now exacerbated by the popularisation of web-services and applications. Numerous works have embraced formal verification of concurrent (distributed) systems [10,20,29,30]. The work in [19] focus for example on hardware but with asynchronous mode. In [26,27] the authors use the π-calculi to reason about services and systems. These are works that can support rigorous analysis of service-oriented systems. 4.2

Service Construction

First of all, as a service is a software entity that implements a given functionality, its construction should follows the development lifecycle of any software entity. It may be constructed by refinement from an abstract and formal model. However the specificities of distributed environment and particularly those of services may be taken into consideration: An event-based modelling for example is well-adapted to asynchronous systems. According to service features, the good abstraction level that favours reuse, the appropriate interface for service description and the specific characteristics of the current service should be the parameters of the service construction. The extension of service standard languages such as WSDL and BPEL is proposed. WSDL may integrate property description features in order to embed the properties inside the service interfaces. The extension may be good at addressing required working conditions description, functional and non-functional properties description and, interaction properties to make them easier. According to BPEL, the needed extensions may enable an easy checking of composition after extracting/discovering the interaction features. Also an eventbased interaction may facilitate loose composition. There is a need of expressive formally defined languages an tools. 4.3

Service Composition

As service-based systems are basically distributed systems, the classical problems studied in the scope of distributed systems should be considered again. The composition of services to build larger applications may cause deadlocks, access conflict to shared resources, race conditions, starvation, etc.

Can Component/Service-Based Systems Be Proved Correct?

13

Moreover, as services should be discovered before being used, planning the composition of services is a challenging question. To find the right services to be composed is a challenging issue that raises again the question of specification matching. Indeed one has to search for a service (which is unknown) with given criteria. The (partial) specification of the needed service is one of these criteria. The desired properties of the searched service are also candidates for the searching criteria. The searching activities are then becoming very tedious. Today searching systems are based on a database of published services which are known and explored by clients which retrieve the needed services. Correctness of service-based systems requires the proof of global properties by considering hypothesis on the future services that will be found and bound. That means, an analysis of a global system may be performed by considering assumptions on what the required services will be. Therefore, it remains to check that the concrete services satisfy the assumptions. As far as service composition is concerned, the interconnection between services may be loose since service-based systems have dynamically evolving architecture; this can be modelled and analysed using event-based approaches [3,4]. The extension of the languages like BPEL is a pragmatic way to undertake the process of improving service composition. An extension enabling one to check the ordering of events and also the temporal properties of service interaction is of real interest. 4.4

Service Certification

In order to ensure the quality of a published service which is devoted to be used in building quality software, the certification of the service quality is required. This may be achieved with respect to desired, functional and non-functional properties. A service may be certified as fulfilling given properties. That means the service implementation satisfies its formal specification that states its goals and properties. This is the standard correctness issue required for software entities or applications. However for the convenience of service context, we propose that the services embed their properties so that they can be verified by a third party entities, checked or considered for the integration of the services in other environments. Property-carrying services are therefore a solution towards the insurance of quality. A service may at least incorporate its functional specification, the properties that it guaranties and the properties that it assumes for a good functioning. The client of a provided service which carries its properties may be confident to the provided service. Consequently an application that integrates several services can coordinate and manage the properties required by ones and provided by others. From this setting, reasoning on the entire system my be undertaken. It is not straightforward to establish the correctness in this context of the composition of asynchronous (sub)systems. Works on Assume/Guarantee [16,18,22,31] may be beneficially reused in the component or service-based systems.

14

C. Attiogb´e

A service should also be certified by a certifier according to the features it has declared. That means the certifier checks the properties embedded in the service and in case of success certifies the service. But the certifier should in turn be a sure one. This matter may be managed by considering well-known provers, efficient proof-checkers and specialised proof centers with experts that perform the proof on demand for the certification purpose. Therefore only the certificates coming from the adopted proof centers may be the confident ones. We develop this idea of property-carrying services from the works on Proof-Carrying Code originally elaborated by Necula [21]. 4.5

Service-Based Application and Maintenance

Service registries may change; services also may change due to upgrades and evolution. Therefore clients of registries may be aware of the modifications and should be able to discover incompatibilities if there are any. How one can be sure that a new version of a service is still correct with its initial objectives. Here again, the certification approach may be used. A service of a system may be replaced by another one without breaking the initial objectives of the system. The formal analysis with respect to hypothesis on services should greatly help in doing this. Service registries should be efficient and adaptable to any form of service descriptions. They should offer the best retrieval features and reasonable response time. Results from database management systems should be exploited. An important research direction is that of substitutability between services or components. A service could be replaced by another one without breaking the chain of functionalities. The service binding should be elaborated to permit such changes. Again, services equipped with properties and certificates will favour this practice. 4.6

Interoperability of Service-Based Systems

Abstraction is a cornerstone for interoperability. When various systems are based on the same abstract view of the used entities and use predefined rules to exchange and reason about entities of interest, ensuring interoperability becomes easier. Consider for example the well-known Open System Interconnection model of the ISO; it is the reference model that ensures the interoperability between network protocols, operating systems and applications. Rules are defined at different levels of the model, and standards are defined and respected by developers of devices, protocols and software. Few examples are the widely used Transport Control Protocol (TCP), Simple Mail Transfer Protocol (SMTP) or Hyper Text Transfer Protocol (HTTP). The notions of services and service servers are already present there. Each network service is clearly and uniformly identified by a number that is used by all its clients. When a server is active, its clients requests and accesses the desired services by using the predefined usage manual of this service. According to service-based systems, exploiting the know-how in the networking, the experiment, methods and techniques of programming distributed system

Can Component/Service-Based Systems Be Proved Correct?

15

are the main ingredients to ensure quality. Practically, a multi-layered eventbased design and development approach is recommended. 4.7

Reliability

Correctness of services as software entities are not sufficient for reliability. For a service-based system to be reliable, its environment should be taken into account: global correctness, i.e. system level correctness should be considered. The availability of network level services is then an important parameter of the reliability. Permanent availability and good functioning of all the components of the global system is required; obviously this cannot be stated and systematically proved but assumptions may be made to ensure the acceptable reliability according to the considered application. For example, failures of some components may be acceptable, provided that the global system continues to offer a part of its functionalities or to offer its functionalities with more delays. How to check or detect failures of components/services of the system at hand? When a fixed number of interacting entities is considered, failure can be detected by considering the monitoring of the entities. In case of service-based systems which evolve dynamically as entities are found and bound and unbound, the monitoring is not straightforward. Hence a challenging issue. Works on dynamically evolving systems, considering group membership and distributed middleware systems may be beneficially used here. Ensemble [6,7] for example is a well-researched system that can be used for service-based systems. The QuickSilver3 [23] system is also a candidate to ensuring or studying reliability of web-service based systems. We also advocate for a server of service servers in order to facilitate access and updates. Indeed for a client of services, instead of looking for several service registries for example, it may always contact only one server of the registries which in turn redirects the requests or accesses to the right registries. It will be the role of the server of registries to manage and maintain up-to-date the information concerning the registries. This approach is more flexible and efficient than the former where the clients should know and maintain their information about several registries. 4.8

Security

Several problems and solutions have been studied with respect to Internet network applications. As service-based systems is based on this support, the same problems impact these systems and the adopted solutions are also available. Service registries need specific care as they should be continuously available. Technically a cluster of registries may fulfill the objectives. For example, false service registries may be avoided by considering friend service registries. Inaccurate service publishing may be avoided by considering well authenticated service publishers. 3

QuickSilver Scalable Multicast project website at Cornell: www.cs.cornell.edu/projects/quicksilver/QSM/

16

5

C. Attiogb´e

Concluding Remarks

The dissemination of software services through information systems and applications require now and quickly components and services of high quality. Providing verifiable correct services is one solution but it is only partial; more generally, the reliability of component or service-based systems is the true challenge. It goes beyond the components and services correctness; it deals with the environment of the used services, components and developed applications. Layers of properties and correctness proofs are required (services, service registries, components, client applications, certifiers, etc). To follow the objectives of correctness and reliability, it is worth considering the integration of correctness threats in the design and the development of the building blocks which are services. Current languages and techniques can be extended in this direction and they may also exploit existing results on formal analysis of concurrent distributed systems. We have indicated some research issues and work directions. The magnitude of the task is important. But there are already a considerable amount of foundation works that can be beneficially exploited. Results in the field of distributed asynchronous systems modelling and verification are of main interest. Works on property-carrying services certification will provide interesting assessments according to quality. However, efficient property verification techniques, tools and verification centers will be a major part of the effort. Language expressiveness and appropriate modelling techniques, based on specific domains, will help to manage verification complexity, by defining repeatable proof scenario that will accelerate verification and diminish analysis and development cost. Last, efficient simulation environments will be of great help in tuning service construction and service-based applications construction.

References 1. Abreu, J., Bocchi, L., Fiadeiro, J.L., Lopes, A.: Specifying and composing interaction protocols for service-oriented system modelling. In: Derrick, J., Vain, J. (eds.) FORTE 2007. LNCS, vol. 4574, pp. 358–373. Springer, Heidelberg (2007) 2. Andr´e, P., Ardourel, G., Attiogb´e, C.: Composing Components with Shared Ser´ (eds.) SC 2008. LNCS, vices in the Kmelia Model. In: Pautasso, C., Tanter, E. vol. 4954, pp. 125–140. Springer, Heidelberg (2008) 3. Attiogb´e, C.: Multi-process Systems Analysis using Event B: Application to Group Communication Systems. In: Liu, Z., He, J. (eds.) ICFEM 2006. LNCS, vol. 4260, pp. 660–677. Springer, Heidelberg (2006) 4. Attiogb´e, C.: Event-Based Approach to Modeling Dynamic Architecture: Application to Mobile Adhoc Network. In: Margaria, T., Steffen, B. (eds.) ISOLA 2008. CCIS, vol. 17, pp. 769–781 (2008) 5. Attiogb´e, C., Andr´e, P., Ardourel, G.: Checking Component Composability. In: L¨ owe, W., S¨ udholt, M. (eds.) SC 2006. LNCS, vol. 4089, pp. 18–33. Springer, Heidelberg (2006) 6. Birman, K., Hillman, R., Pleisch, S.: Building Network-centric Military Applications over Service Oriented Architectures. In: SPIE Defense and Security Symposium 2005 (2005)

Can Component/Service-Based Systems Be Proved Correct?

17

7. Birman, K.P., Chen, J., Hopkinson, K.M., Thomas, R.J., Thorp, J.S., van Renesse, R., Vogels, W.: Overcoming Communications Challenges in Software for Monitoring and Controlling Power Systems. Proceedings of the IEEE 9 (2005) 8. Birman, K.P.: Like it or not, Web Services are Distributed Objects! Comm. of the ACM, Viewpoints Column (2004) 9. Bocchi, L., Hong, Y., Lopes, A., Fiadeiro, J.: From BPEL to SRML: a Formal Transformational Approach. In: Dumas, M., Heckel, R. (eds.) WS-FM 2007. LNCS, vol. 4937, pp. 92–107. Springer, Heidelberg (2008) 10. Chockler, H., Farchi, E., Glazberg, Z., Godlin, B., Nir-Buchbinder, Y., Rabinovitz, I.: Formal Verification of Concurrent Software: two Case Studies. In: Ur, Farchi (eds.) [28], pp. 11–22. 11. Pulier, H.T.E. (ed.): Understanding Enterprise SOA. Wiley India Pvt. ltd., Chichester (2006) 12. Erl, T. (ed.): Service Oriented Architecture Concepts Technology and Desgin. Prentice-Hall, Englewood Cliffs (2005) 13. Fiadeiro, J.L., Lopes, A., Bocchi, L.: A formal approach to service-oriented architecture. In: Bravetti, M., N´ un ˜ ez, M., Zavattaro, G. (eds.) WS-FM 2006. LNCS, vol. 4184, pp. 193–213. Springer, Heidelberg (2006) 14. Fiadeiro, J.L., Lopes, A., Bocchi, L.: Algebraic Semantics of Service Component Modules. In: Fiadeiro, J.L., Schobbens, P.-Y. (eds.) WADT 2006. LNCS, vol. 4409, pp. 37–55. Springer, Heidelberg (2007) 15. Fiadeiro, J.L.: Software services: Scientific challenge or industrial hype? In: Liu, Z., Araki, K. (eds.) ICTAC 2004. LNCS, vol. 3407, pp. 1–13. Springer, Heidelberg (2005) 16. Giannakopoulou, D., Pasareanu, C.S., Cobleigh, J.M.: Assume-guarantee Verification of Source Code with Design-level Assumptions. In: International Conference on Software Engineering (ICSE 2004), pp. 211–220 (2004) 17. Abreu, J., Fiadeiro, J.: A Coordination Model for Service-oriented Interactions. In: Lea, D., Zavattaro, G. (eds.) COORDINATION 2008. LNCS, vol. 5052, pp. 1–16. Springer, Heidelberg (2008) 18. Mooij, A.J., Wesselink, J.W.: A Formal Analysis of a Dynamic Distributed Spanning Tree Algorithm. Technical Report No. 03-16, Technische Universiteit Eindhoven (2003) 19. Morin-Allory, K., Fesquet, L., Borrione, D.: Asynchronous Assertion Monitors for multi-Clock Domain System Verification. In: IEEE International Workshop on Rapid System Prototyping, pp. 98–102 (2006) 20. M¨ uhl, G., Fiege, L., Pietzuch, P.R.: Distributed Event-Based Systems. Springer, Heidelberg (2006) 21. Necula, G.C.: Proof-Carrying Code. In: 24th ACM Symposium on Principles of Programming Languages (POPL 1997) (1997) 22. Nipkow, T., Nieto, L.P.: Owicki/Gries in isabelle/HOL. In: Finance, J.-P. (ed.) FASE 1999. LNCS, vol. 1577, pp. 188–203. Springer, Heidelberg (1999) 23. Ostrowski, K., Birman, K.P.: Scalable Group Communication System for Scalable Trust. In: STC 2006: Proceedings of the first ACM workshop on Scalable trusted computing, pp. 3–6. ACM Press, New York (2006) 24. Papazoglou, M.P., Traverso, P., Dustdar, S., Leymann, F.: Service-Oriented Computing: a Research Roadmap. Cooperative Inf. Syst. 17(2), 223–255 (2008) 25. Papazoglou, M.P., van den Heuvel, W.-J.: Service Oriented Architectures: Approaches, Technologies and Research Issues. VLDB 16(3), 389–415 (2007)

18

C. Attiogb´e

26. Rychl´ y, M.: Towards Verification of Systems of Asynchronous Concurrent Processes. In: Proceedings of 9th International Conference ISIM 2006, pp. 123–130 (2006) 27. Rychl´ y, M.: Behavioural Modeling of Services: from Service-Oriented Architecture to Component-Based System. In: Software Engineering Techniques in Progress, pp. 13–27. Wroclaw University of Technology (2008) 28. Ur, S., Farchi, E. (eds.): Proceedings of the 4th Workshop on Parallel and Distributed Systems: Testing, Analysis, and Debugging, held in conjunction with the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2006), PADTAD 2006. ACM, New York (2006) 29. Wesselink, J.W., Romijn, J.M.T., Mooij, A.J.: Assertion-based Proof Checking of Chang-Roberts Leader Election in PVS. In: Namjoshi, K.S., Yoneda, T., Higashino, T., Okamura, Y. (eds.) ATVA 2007. LNCS, vol. 4762, pp. 341–361. Springer, Heidelberg (2007) 30. Wojcicki, M.A., Strooper, P.A.: A state-of-practice Questionnaire on Verification and Validation for Concurrent Programs. In: Ur, Farchi (eds.) [28], pp. 1–10. 31. Xu, Q., Swarup, M.: Compositional Reasoning Using the Assumption-Commitment Paradigm. In: de Roever, W.-P., Langmaack, H., Pnueli, A. (eds.) COMPOS 1997. LNCS, vol. 1536, pp. 565–583. Springer, Heidelberg (1998)

Probabilistic Acceptors for Languages over Infinite Words Christel Baier1 , Nathalie Bertrand2 , and Marcus Größer1 1

Technical University Dresden, Faculty Computer Science, Germany 2 INRIA Rennes Bretagne Atlantique, France

Abstract. Probabilistic ω-automata are variants of nondeterministic automata for infinite words where all choices are resolved by probabilistic distributions. Acceptance of an infinite input word requires that the probability for the accepting runs is positive. In this paper, we provide a summary of the fundamental properties of probabilistic ω-automata concerning expressiveness, efficiency, compositionality and decision problems.

While classical finite automata can serve to recognize languages over finite words or tree-like structures, ω-automata are acceptors for languages consisting of infinite objects. ω-automata play a central role for verification purposes, reasoning about infinite games and logics that specify nondeterministic behaviors. Many variants of ω-automata have been studied in the literature that can be classified according to their inputs (e.g., words or trees), their acceptance conditions (e.g., Büchi, Rabin, Streett, Muller or parity acceptance) and their semantics of the branching structure (e.g., deterministic, nondeterministic, or alternating). See, e.g., [Tho97, GTW02] for an overview of automata over infinite objects. In this paper, we study probabilistic variants of ω-automata for languages over infinite words. Although probabilistic finite automata (PFA) have attracted many researchers, see e.g. [Rab63, Paz66, Fre81, MHC03, DS90, BC03], probabilistic language acceptors for infinite words just have recently been studied. The formal definition of probabilistic ω-automata is roughly the same as for nondeterministic ω-automata, except that all choices are resolved by probabilistic distributions. Acceptance of an infinite word σ = a1 a2 a3 . . . requires that the generated sample run for σ (i.e., sequence of states that are passed in the automaton while reading σ letter by letter) meets the acceptance condition with positive probability. For instance, in the case of a probabilistic Büchi automaton (PBA), certain states are declared to be accepting and the acceptance condition requires to visit some accepting state infinitely often with positive probability. As this definition of the accepted language via the criterion “the probability for the accepting runs is > 0” appears to be the natural adaption of the definition of the accepted language of a nondeterministic automaton which relies on the criterion “there is at least one accepting run”, one might expect that probabilistic and nondeterministic ω-automata are rather close and enjoy similar properties. This, however, is not the case. The first surprising result is that PBA are more expressive than nondeterministic Büchi automata (NBA). Second, concerning the sizes of smallest automata for a given language, probabilistic and nondeterministic ω-automata are not comparable. That is, M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 19–33, 2009. c Springer-Verlag Berlin Heidelberg 2009 

20

C. Baier, N. Bertrand, and M. Größer

there are languages that can be accepted by PBA of polynomial size, while all NBA for these languages have at least exponentially many states, and vice versa. Another interesting observation is that in the probabilistic setting the Büchi condition is somehow more powerful than in the nondeterministic case, as there exists a polynomial transformation from PBA to probabilistic automata with Streett acceptance. This is known to be impossible in the nondeterministic case [SV89]. On the other hand, the price we have to pay for this extra power of PBA is that we lose decidability of algorithmic problems, such as the emptiness, universality or equivalence problem. The undecidability results for PBA have several important consequences. First, the concept of PBA is not adequate for solving algorithmic problems that are related to the emptiness or universality problems. This, e.g., applies to the verification of nondeterministic systems against PBA-specifications. Second, PBA can be viewed as a special instance of partially-observable Markov decision processes (POMDPs) which are widely used in various areas, including robotics and stochastic planning (see, e.g., [Son71, PT87, Lov91]) and the negative results established for PBA yield the undecidability of various verification problems for POMDPs. Organization. Section 1 recalls the definition of nondeterministic ω-automata with Büchi, Rabin or Streett acceptance conditions and introduces their probabilistic variants. Results on the expressiveness and efficiency of probabilistic Büchi, Rabin and Streett automata are summarized in Section 2. Composition operators for PBA are addressed in Section 3. Decision problems for PBA and the relation to POMDPs will be discussed in Section 4. Finally, Section 5 contains some concluding remarks. The material of this paper is a summary of the results presented in the papers [BG05, BBG08]. Further details can be found there and in the thesis by Marcus Größer [Grö08].

1 From Nondeterministic to Probabilistic ω-Automata We assume some familarity with classical nondeterministic automata over finite or infinite words; see e.g. [Tho97, GTW02]. We just recall some basic concepts of nondeterministic ω-automata. Later we will adapt these concepts to the probabilistic setting. Definition 1 (Nondeterministic ω-automata). A nondeterministic ω-automaton is a tuple N = (Q, Σ, δ, Q0 , Acc), where – Q is a finite nonempty set of states, – Σ is a finite nonempty input alphabet, – δ : Q × Σ → 2Q is a transition function that assigns to each state q and letter a ∈ Σ a (possibly empty) set δ(q, a) of states, – Q0 ⊆ Q is the set of initial states, – Acc is an acceptance condition (which will be explained later).

N is called deterministic if |Q0 | = 1 and |δ(q, a)| = 1 for all q ∈ Q and a ∈ Σ. The intuitive operational behavior of a nondeterministic ω-automaton N for some infinite input word σ = a1 a2 a3 . . . ∈ Σω is as follows. The automaton selects nondeterministically an initial state q0 ∈ Q0 . Then, it attempts to read the first letter a1 in

Probabilistic Acceptors for Languages over Infinite Words

21

/ then the austate q0 . If q0 does not have an outgoing a1 -transition (i.e., δ(q0 , a1 ) = 0) tomaton rejects. Otherwise, the automaton reads the first letter a1 and moves to some a1 -successor q1 of q0 (i.e., some state q1 ∈ δ(q0 , a1 )) and attempts to read the remaining / Otherwise word a2 a3 . . . from state q1 . That is, the automaton rejects if δ(q1 , a2 ) = 0. the automaton reads letter a2 and moves to some state q2 ∈ δ(q1 , a2 ) which is chosen nondeterministically, and so on. Any maximal state-sequence π = q0 q1 q2 . . . that can be obtained in this way is called a run for σ. We write inf(π) for the set of states p ∈ Q such that p = qi for infinitely many indices i ≥ 0. Each finite run q0 q1 . . . qi (where N fails to read letter ai+1 in the last state qi because δ(qi , ai+1 ) is empty) is said to be rejecting. The acceptance condition Acc imposes a condition on infinite runs and declares which of the infinite runs are accepting. Several acceptance conditions are known for nondeterministic ω-automata. We will consider three types of acceptance conditions: Büchi: A Büchi acceptance condition Acc is a subset F of Q. The elements in F are called final or accepting states. An infinite run π = q0 q1 q2 . . . is called (Büchi) / accepting if π visits F infinitely often, i.e., inf(π) ∩ F = 0. Streett: A Streett acceptance condition Acc is a finite set of pairs (Hl , Kl ) consisting of subsets Hl , Kl of Q, i.e., Acc = {(H1 , K1 ), . . . , (H , K )}. An infinite run π = q0 q1 q2 . . . is called (Streett) accepting if for each l ∈ {1, . . . , } we have: / inf(π) ∩ Hl = 0/ or inf(π) ∩ Kl = 0. Rabin: A Rabin acceptance condition Acc is syntactically the same as a Streett acceptance condition, i.e., a finite set Acc = {(H1 , K1 ), . . . , (H , K )} where Hl , Kl ⊆ Q for 1 ≤ l ≤ . An infinite run π = q0 q1 q2 . . . is called (Rabin) accepting if there is some l ∈ {1, . . ., } such that / inf(π) ∩ Hl = 0/ and inf(π) ∩ Kl = 0. Note that the semantics of Streett and Rabin acceptance conditions are duals of each other, i.e., for each infinite run π we have: π is accepting according to the Rabin condition Acc iff π is rejecting (i.e., not accepting) according to the Streett condition Acc. Furthermore, a Büchi acceptance condition F can be viewed as a special case of a Streett and Rabin condition with a single acceptance pair, namely {(F, Q)} for the Streett con/ F)} for the Rabin condition. dition and {(0, The accepted language of a nondeterministic ω-automaton N with the alphabet Σ, denoted L (N ), is defined as the set of infinite words σ ∈ Σω that have at least one accepting run in N .   L (N ) = σ ∈ Σω : there exists an accepting run for σ in N In what follows, we write NBA to denote a nondeterministic Büchi automaton, NRA for nondeterministic Rabin automata and NSA for nondeterministic Streett automata. Similarly, the notations DBA, DRA and DSA are used to denote deterministic ω-automata with a Büchi, Rabin or Streett acceptance condition.

22

C. Baier, N. Bertrand, and M. Größer

It is well-known that the classes of languages that can be accepted by NBA, DRA, NRA, DSA or NSA are the same. These languages are often called ω-regular and represented by ω-regular expressions, i.e., finite sums of expressions of the form α.βω where α and β are ordinary regular expressions (representing regular languages over finite words) and the language associated with β is nonempty and does not contain the empty word. In the sequel, we will identify ω-regular expressions with the induced ω-regular language. While deterministic ω-automata with Rabin and Streett acceptance (DRA and DSA) cover the full class of ω-regular languages, DBA are less powerful as, e.g., the language (a + b)∗ aω cannot be recognized by a DBA. Hence, the class of DBA-recognizable languages is a proper subclass of the class of ω-regular languages. Probabilistic ω-automata can be viewed as nondeterministic ω-automata where all nondeterministic choices are resolved probabilistically. That is, for any state p and letter a ∈ Σ either p does not have any a-successor or there is a probability distribution for the a-successors of p. Definition 2 (Probabilistic ω-automata). A probabilistic ω-automaton is a tuple P = (Q, Σ, δ, µ0 , Acc), where – Q is a finite nonempty set of states, – Σ is a finite nonempty input alphabet, – δ : Q × Σ × Q → [0, 1] is a transition probability function such that for all p ∈ Q and a ∈ Σ either ∑q∈Q δ(p, a, q) = 1 or δ(p, a, .) is the null-function (i.e. δ(p, a, q) = 0 for all q ∈ Q), – µ0 is the initial distribution, i.e., a function µ0 : Q → [0, 1] such that ∑q∈Q µ0 (q) = 1, – Acc is an acceptance condition (as for nondeterministic ω-automata). We refer to the states q0 ∈ Q where µ0 (q0 ) > 0 as initial states. If p is a state such that δ(q, a, p) > 0 then we say that q has an outgoing a-transition to state p. Acceptance conditions can be defined as in the nondeterministic case. In this paper, we just regard Büchi, Rabin and Streett acceptance and use the abbreviations PBA, PRA and PSA for probabilistic Büchi automata, probabilistic Rabin automata, and probabilistic Streett automata, respectively. The intuitive operational behavior of a probabilistic ω-automaton P for a given input word σ = a1 a2 . . . ∈ Σω is similar to the nondeterministic setting, except that the nondeterminism is resolved internally by the probabilistic distributions µ0 in the initial configuration and δ(q, a, ·) if the current state is q and the next letter to consume is a. That is, initially P chooses at random an initial state p0 according to the initial distribution µ0 . If P has consumed the first i input symbols a1 , . . . , ai and the current state is pi then P moves with probability δ(pi , ai+1 , p) to state p and tries to read the next input symbol ai+2 in state p = pi+1 . If there is no outgoing ai+1 -transition from the current state pi , then P rejects. As in the nondeterministic case, the resulting state-sequence π = p0 p1 p2 . . . ∈ Q∗ ∪ Qω is called a run for σ in P . If P rejects in state pi , i.e., δ(pi , ai+1 , ·) is the null function, then the obtained run is finite (and ends in state pi ). If the automaton never rejects while reading the letters ai of the input word σ = a1 a2 a3 . . . ∈ Σω , the generated

Probabilistic Acceptors for Languages over Infinite Words

23

run is an infinite state-sequence π = p0 p1 p2 . . . ∈ Qω . Acceptance of a run according to a Büchi, Rabin or Streett acceptance condition is defined as in the nondeterministic setting. Semantics of probabilistic ω-automata. While acceptance of an infinite word in a nondeterministic ω-automata requires the existence of an accepting run, a probabilistic ωautomaton accepts an infinite input word σ if the acceptance probability PrP (σ) is > 0. The formal definition of the acceptance probability relies on the view of an input word σ ∈ Σω as a scheduler when P is treated as a Markov decision process, i.e., an operational model for a probabilistic system where in each state q the letters that can be consumed in q are treated as actions that are enabled in q. Given a word/scheduler σ = a1 a2 a3 . . . ∈ Σω , the behavior of P under σ is given by a Markov chain Mσ where the states are pairs (q, i) where q ∈ Q stands for the current state and i is a natural number ≥ 1 that denotes the current word position. Stated differently, state (q, i) in the Markov chain Mσ stands for the configuration that P might have reached after having consumed the first i−1 letters a1 , . . . , ai−1 of the input word σ. Assuming that δ(q, ai+1 , ·) is not the null function, the transition probabilities from state (q, i) are given by the distribution δ(q, ai+1 , ·), i.e., from state (q, i) the Markov chain Mσ moves with probability δ(q, ai+1 , p) to state (p, i + 1). In case that δ(q, ai+1 , ·) = 0 then (q, i) is an absorbing state, i.e., a state without any outgoing transition. The runs for σ in P correspond to the paths in Mσ . We can now apply the standard concepts for Markov chains to reason about the probabilities of infinite paths and define the acceptance probability for the infinite word σ in P , denoted PrP (σ) or briefly Pr(σ), as the probability measure of the accepting runs for σ in the Markov chain Mσ . The formal definition of the accepted language of P is   L (P ) = σ ∈ Σω : PrP (σ) > 0 Sometimes we will add the subscript “Büchi”, “Streett’ or “Rabin” to make clear which type of acceptance condition is assumed and write LBüchi (P ), LRabin (P ) or LStreett (P ), respectively. Example 1 (Probabilistic Büchi automata). Let us have a look at a few examples of probabilistic ω-automata. In the pictures, if δ(q, a, ·) = 0 then the probability δ(q, a, p) is attached to the a-transition from q to p. If δ(q, a, p) = 1 then the edge is simply labeled with a. Similarly, if there is a single initial state q0 (i.e., µ0 (q0 ) = 1, while µ0 (q) = 0 for all other states q) we simply depict an incoming arrow to q0 . For PBA, we depict the accepting states (i.e., the states q ∈ F) by squares, non-accepting states by circles. Consider the PBA P over the alphabet Σ = {a, b} in the left part of Figure 1. State q0 is initial, while state q1 is accepting. More precisely, the initial distribution is given by µ0 (q0 ) = 1 and µ0 (q1 ) = 0, while the Büchi acceptance condition is given by the singleton F = {q1 }. The accepted language L (P ) = LBüchi (P ) is (a + b)∗aω . If we feed P with an infinite input word σ ∈ (a + b)∗ aω , then P stays with positive probability in the initial state q0 until the last b in σ has been read. From then on, P moves almost surely to the accepting state q1 and stays there forever when reading the infinite suffix aω . Thus, the acceptance probability for all words in (a + b)∗aω is positive. This yields that (a + b)∗ aω ⊆ L (P ).

24

C. Baier, N. Bertrand, and M. Größer

p0 a, 12

q0

a

a, 12 b PBA P for (a + b)∗ aω

b, c

b

q1

a, 12

a, 12

p1

p2 PBA P for (ab + ac)∗ (ab)ω

Fig. 1. Examples for PBA P (left) and P (right)

It remains to show that L (P ) is contained in (a + b)∗ aω . In fact, all words in L (P ) contain only finitely many b’s because only state q1 is accepting and only letter a can be read in state q1 . Hence, each accepted word σ ∈ L (P ) must have the suffix aω . For another example, regard the PBA P over the alphabet Σ = {a, b, c} shown in the right part of Figure 1. Let us first observe that the underlying nondeterministic Büchi automaton (NBA) that we obtain by ignoring the probabilities has an accepting run for each infinite word in (ab + ac)ω with infinitely many b’s, no matter whether there are only finitely ω c’s or infinitely many c’s. Thus, the accepted language of the NBA is (ac)∗ ab . This language is different from the accepted language of the PBA P which is L (P ) = (ab + ac)∗(ab)ω . Given an input word σ ∈ (ab + ac)∗ (ab)ω , say σ = x(ab)ω where x ∈ (ab + ac)∗ , then with positive probability P generates the run fragment p0 p2 p0 p2 . . . p0 p2 p0 when reading x. For the remaining suffix (ab)ω , P can always consume the next letter and almost surely P will visit p1 and p2 infinitely often. This yields PrP (σ) > 0 and σ ∈ L (P ). Vice versa, we have to show that L (P ) is a subset of (ab + ac)∗ (ab)ω . It is obvious that all accepted words σ ∈ L (P ) belong to ((ac)∗ ab)ω .3 The intuitive argument why any word σ in (ab + ac)ω with infinitely many c’s is rejected by P relies on the observation that almost all runs for σ are finite and end in state p1 , where the next input symbol is c and cannot be consumed in state p1 . (The formulation “almost all runs have property X” means that the probability measure of the runs where property X does not hold is 0.)  Note that each DBA can be viewed as a PBA (we just have to assign probability 1 to all edges in the DBA and deal with the initial distribution that assigns probability 1 to the unique initial state). As shown in Example 1 there is a PBA for the language (a + b)∗ aω which cannot be accepted by DBA. As a consequence we obtain that the class of DBArecognizable languages is a proper subclass of the class of languages L (P ) for some PBA P . 3

In fact, for each PBA P all words in L (P ) have at least one accepting run. Thus, L (P ) is always contained in the accepted language of the NBA that results by ignoring the transition probabilities.

Probabilistic Acceptors for Languages over Infinite Words

p0 a, 12 a, c

p1

25

b, c a, 12 a, b, c

b

p2

Fig. 2. PSA PS with acceptance condition Acc = {({p2 }, {p1 })}

Example 2 (Probabilistic Streett automaton). The PSA PS shown in Figure 2 accepts the language of all infinite words σ over Σ = {a, b, c} such that either σ contains only finitely many a’s or σ contains infinitely many b’s (or both). That is,

LStreett (PS ) = (a + b + c)∗(b + c)ω + ((a + b + c)∗b)ω . Note that each word in (a + b + c)∗(b + c)ω has an accepting run π which never leaves state p0 . This run π = pω 0 is accepting (as inf(π) = {p0 } and therefore inf(π) ∩ {p1 } = / and has positive measure. More precisely, the acceptance probability PrPS (σ) for a 0) word σ = xy with x ∈ {a, b, c}∗ and y ∈ {b, c}ω is ≥ 1/2k where k is the number of a’s in x. Hence, σ = xy ∈ LStreett (PS ). For the infinite words σ with infinitely many b’s all runs are accepting, since they either visit p1 , p2 only finitely many times (in which case / or they visit p2 infinitely often (as σ contains infinitely many b’s). inf(π) ∩ {p1 } = 0) Hence, PrPS (σ) = 1 which yields σ ∈ LStreett (PS ). Vice versa, for each word in LStreett (PS ) which contains infinitely many a’s, almost all runs will enter state p1 infinitely often. But then an accepting run must also visit state p2 infinitely often, which is only possible by reading letter b. Thus, all words accepted  by PS either contain only finitely many a’s or infinitely many b’s. Equivalence of ω-automata means that their accepted languages agree. The notion of the size, denoted |P |, of an ω-automaton P is used here as follows. The size of a PBA is simply the number of states. The size of a probabilistic Rabin or Streett automaton denotes the number of states plus the number of acceptance pairs.

2 Expressiveness of Probabilistic ω-Automata The three types of probabilistic ω-automata (Büchi, Rabin, Streett) are equally expressive. As the Büchi acceptance condition can be rewritten as a Rabin or Streett acceptance condition, each PBA can be viewed as a PRA or as a PSA with the same accepted language. Vice versa, there are polynomial transformations from PRA and PSA to PBA: Theorem 1 (Equivalence of PBA, PRA and PSA [BG05]) (a) For each PBA there is an equivalent PRA and an equivalent PSA of the same size. (b) Given a PRA PR with  acceptance pairs there exists an equivalent PBA of size O (|PR |).

26

C. Baier, N. Bertrand, and M. Größer

(c) Given a PSA PS with  acceptance pairs there exists an equivalent PBA of size O (2 |PS |). The transformation from PRA to PBA is roughly the same as in the nondeterministic case. The construction of a PBA of size O (2 |PS |) from a given PSA PS , however, crucially relies on the probabilistic semantics. In fact, it is worth noting that in the nonprobabilistic case it is known (see [SV89]) that there are families (Ln )n≥0 of languages Ln ⊆ Σω that are recognizable by nondeterministic Streett automata of size O (n), while each nondeterministic Büchi automaton for Ln has 2n or more states. Thus, the polynomial transformation from Streett to Büchi acceptance is specific for the probabilistic case. Let us now discuss the expressiveness of probabilistic ω-automata compared to their nondeterministic counterparts. The first observation is that each NBA can be transformed into an equivalent PBA. Hence, the class of languages that is recognizable by a PBA subsumes the class of ω-regular languages. A transformation from NBA into an equivalent PBA is obtained by using NBA that are deterministic-in-limit. These are NBA such that for each state p that is reachable from some accepting state q ∈ F and each letter a ∈ Σ state p has at most one outgoing a-transition. That is, as soon as an accepting state has been reached the behavior from then on is deterministic. [CY95] presented some kind of powerset construction which turns a given NBA N into an equivalent NBA Ndet that is deterministic-in-limit. If we now resolve the nondeterminsitic choices in Ndet by uniform distributions4 then Ndet becomes a PBA that accepts the same language as N (and Ndet ). This yields: Lemma 1 (see [BG05]). For each ω-regular language L ⊆ Σω there exists a PBA P with the alphabet Σ such that L (P ) = L. The powerset construction used in the transformation from N to Ndet can cause an exponential blow-up. In fact, the worst-case exponential blow-up cannot be avoided for the transformation from NBA to PBA since there are examples for families (Ln )n≥1 of ω-regular languages that are accepted by NBA of linear size, while each PBA for Ln has Ω(2n ) states [BG05]. An example for such a family of languages is ((a + b)∗a(a + b)n c)ω . Vice versa, there are languages Ln that can be recognized by PBA of size O (n), while any NSA for Ln has Ω(2n /n) states [BG05]. We now address the question whether each PBA can be transformed into an equivalent NBA. Surprisingly, this is not the case, as there are PBA where the accepted language is not ω-regular. An example is given in Figure 3 which shows a PBA Pλ where λ is an arbitrary real number in the open interval ]0, 1[. The PBA Pλ accepts the language

L (Pλ ) =



 ∞   ak1 bak2 bak3 b . . . : ∏ 1 − λki > 0 i=1

4

If q is a state in Ndet and a ∈ Σ such that q has k a-successors q1 , . . . , qk then we define / {q1 , . . . , qk }. Similarly, if Q0 δ(q, a, qi ) = 1k for 1 ≤ i ≤ k and δ(q, a, p) = 0 for all states p ∈ is the set of initial states in Ndet and Q0 is nonempty then we deal with the initial distribution µ0 that assigns probability 1/|Q0 | to each state in Q0 .

Probabilistic Acceptors for Languages over Infinite Words

27

b q0 a,λ

q1 a,1 − λ a

Fig. 3. PBA Pλ accepts a non-ω-regular language

To see this, let us first observe that all words in L (Pλ ) must contain infinitely many b’s. As Pλ cannot consume two consecutive b’s, all words in L (Pλ ) have the form ak1 bak2 bak3 b . . . where k1 , k2 , . . . is a sequence of positive natural numbers. We now show that ∞   PrPλ (ak1 bak2 bak3 b . . .) = ∏ 1 − λki i=1

The factors 1 − λki stand for the probability to move from state q0 to q1 when reading the subword aki . With the remaining probability λki , the automaton Pλ stays in state q0 , but then letter b at position k1 + . . . + ki + i of the input word ak1 bak2 bak3 b . . . cannot be consumed and Pλ rejects. Hence, the probability for run fragments of the form q0 . . . q0 q1 . . . q1 q0 that are generated while reading the subword aki b is precisely 1 − λki . This yields that the infinite product of these values agrees with the acceptance probability for the input word ak1 bak2 bak3 b . . .. The convergence condition which requires the infinite product over the values 1 − λki to be positive can easily be shown to be non-ω-regular, i.e., L (Pλ ) cannot be recognized by an NBA. Together with Lemma 1 we get: Theorem 2 (Expressiveness of PBA, [BG05]). The class of languages that are accepted by a PBA strictly subsumes the class of ω-regular languages. This stands in contrast to the fact that probabilistic finite automata (PFA) with the acceptance criterion “the accepting runs have a positive probability measure” can be viewed as nondeterministic finite automata, and hence, have exactly the power of regular languages. The PBA Pλ can also serve to illustrate another interesting property of PBA. Consider two values λ and ν ∈]0, 1[ with λ < ν. For any sequence (ki )i≥1 of natural numbers ki where the infinite product over the values 1 − νki converges to some positive value, also the infinite product over the values 1 − λki is positive, as we have 1 − νki < 1 − λki . Thus, L (Pν ) ⊆ L (Pλ ). In fact, whenever λ < ν then there are sequences (ki )i≥1 such that the product of the values 1 − λki converges to some positive real number, while the product of the values 1 − νki has value 0 [BBG08]. Hence: Lemma 2 (see [BBG08]). If λ < ν then L (Pν ) is a proper sublanguage of L (Pλ ). Thus, the languages of PBA are sensitive to the distributions for the successor states. That is, if we are given a PBA and modify the nonzero transition probabilities then also the accepted language might change. This property is surprising since the definition of

28

C. Baier, N. Bertrand, and M. Größer

the accepted language just relies on a qualitative criterion: the acceptance probability must be positive, but might be arbitrarily small. This should be opposed to the verification of finite-state Markov decision processes where it is known that whether or not a given linear time property holds with positive probability just depends on the underlying graph, but not on the concrete transition probabilities.

3 Composition Operators for PBA The most important composition operators for any class of languages over infinite words are the standard set operations union, intersection and complementation. In fact, the class of PBA-recognizable languages is closed under all three operations. Theorem 3 (see [BBG08]). The class of languages L (P ) for some PBA P is closed under union, intersection and complementation. For union, this is obvious since given two PBA P1 and P2 over the same alphabet with initial distributions µ1 and µ2 , respectively, we consider the PBA that arises from the disjoint union of P1 and P2 with the initial distribution µ(q) = 12 µi (q) if q is a state in Pi . If F1 and F2 are the sets of accepting states in P1 and P2 , respectively, then P requires to visit F1 ∪ F2 infinitely often. For intersection, we can reuse the ideas of an intersection operator on NBA. Given two PBA P1 and P2 over the same alphabet, we use a product construction P1 × P2 (which runs P1 and P2 in parallel) and equip P1 × P2 with the Streett condition consisting of two acceptance pairs. One of the acceptance pairs requires that an accepting state of P1 is visited infinitely often, the other one stands for the acceptance condition of P2 . This PSA P1 × P2 can then be transformed into an equivalent PBA (part (c) of Theorem 1). The most interesting operator is complementation. Given a PBA P with L = L (P ) ⊆ Σω , the idea for the construction of a PBA P for the language L = Σω \ L is somehow similar to the complementation of NBA via Safra’s determinisation operator [Saf88] and relies on the transformations sketched in Figure 4. Here, by a 0/1-PRA we mean a PRA PR where the acceptance probabilities for all words are 0 or 1, i.e., PrPR (σ) ∈ {0, 1} for each word σ ∈ Σω . Similarly, a 0/1-PSA is a PSA PS with PrPS (σ) ∈ {0, 1} for each word σ ∈ Σω . Given a 0/1-PRA PR , the duality of Rabin and Streett acceptance yields that LRabin (PR ) and LStreett (PR ) are complements of each other. Thus, in the second step of Figure 4 we may deal with the PSA PS which is syntactically the same as PR (but PS is viewed as a Streett and PR as a Rabin automaton). The last step of Figure 4 relies on the transformation from PSA to PBA (part (c) of Theorem 1). The interesting step is the first one in Figure 4 where we have to construct a 0/1PRA from a given PBA. The idea for this transformation is to design a 0/1-PRA PR that PBA P for L



0/1-PRA PR for L



0/1-PSA PS for L

Fig. 4. Complementation of a PBA



PBA P for L

Probabilistic Acceptors for Languages over Infinite Words

29

generates up to n sample runs of P and checks whether at least one of them is accepting, where n is the number of states in P . If so then PR accepts, otherwise it rejects. For the details of this construction we refer to [BBG08, Grö08]. Lemma 3 (From PBA to 0/1-PRA, [BBG08]). For each PBA there exists an equivalent 0/1-PRA.

4 Decision Problems for PBA For many applications of automata-like models, it is important to have (efficient) decision algorithms for some fundamental problems, like checking emptiness or language inclusion. For instance, the automata-based approach [VW86] for verifying ω-regular properties of a nondeterministic finite-state system relies on a reduction to the emptiness problem for NBA. Unfortunately, the emptiness problem and various other classical decision problems for automata cannot be solved algorithmically for PBA: Theorem 4 (Undecidability of PBA [BBG08]). The following problems are undecidable: – emptiness: given a PBA P , does L (P ) = 0/ hold? – universality: given a PBA P with the alphabet Σ, does L (P ) = Σω hold? – equivalence: given two PBA P1 and P2 , does L (P1 ) = L (P2 ) hold? To prove undecidability of the emptiness problem, we provided in [BBG08] a reduction from a variant of the emptiness problem for probabilistic finite automata (PFA) which has been shown to be undecidable [MHC03]. Undecidability of the universality problem then follows by the effectiveness of complementation for PBA. Undecidability of the PBA-equivalence problem is an immediate consequence of the undecidability of the emptiness problem (just consider P1 = P and P2 a PBA for the empty language). A consequence of Theorem 4 is that PBA are not appropriate for verification algorithms. Consider, e.g., a finite-state transition system T and suppose that a linear-time property p to be verified for T is specified by a PBA P in the sense that L (P ) represents all infinite behaviors where property p holds. (Typically p is a language over some alphabet Σ = 2AP where AP is a set of atomic propositions and the states in T are labeled with subsets of AP.) Then, the question whether all traces of T have property p is reducible to the universality problem for PBA and therefore undecidable. Similarly, the question whether T has at least one trace where p holds is reducible to the emptiness problem for PBA and therefore undecidable too. Another important consequence of Theorem 4 is that it yields the undecidability of the verification problem for partially observable Markov decision processes (POMDPs) against ω-regular properties. POMDPs provide an operational model for stochastic systems with non-observable behaviors. They play a central role in many application areas such as mobile robot navigation, probabilistic planning task, elevator control, and so on. See, e.g., [Son71, Mon82, PT87, Lov91]. The syntax of a POMDP can be defined as for probabilistic ω-automata, except that the acceptance condition has to be replaced with an equivalence relation ∼ on the states which formalizes which states cannot be

30

C. Baier, N. Bertrand, and M. Größer

distinguished from outside. The elements in the alphabet Σ are viewed as action names. The goal is then to design a scheduler S that chooses the actions for the current state and ensures that a certain condition X holds when the choices between different enabled actions in the POMDP M are resolved by S. For his choice the scheduler may use the sequence of equivalence classes that have been passed to reach the equivalence class of the current state. That is, the scheduler is supposed to observe the equivalence classes, but not the specific states. (Such schedulers are sometimes called “partial-information schedulers” or “observation-based schedulers”.) The emptiness problem for PBA is a special instance for the scheduler-synthesis problem for POMDPs. Given a PBA P = (Q, Σ, δ, µ0 , F), we regard the POMDP M = (Q, Σ, δ, µ0 , ∼) where ∼ identifies all states and ask for the existence of a scheduler that ensures that F will be visited infinitely often with positive probability. We first observe that the infinite words over Σ can be viewed as schedulers for M , and vice versa. Hence, L (P ) is nonempty if and only if there is a scheduler S such that PrM S (♦F) > 0, where PrM (♦F) denotes the probability that M visits F infinitely often when S is used to S schedule the actions in M . Similarly, the universality problem for PBA can be viewed as a special instance of the problem where we are given a POMDP M and a set F of states and ask for the existence of a scheduler S such that PrM S (♦F) = 1 where M PrS (♦F) denotes the probability that M under scheduler S eventually enters F and never leaves F from this moment on. Thus: Theorem 5 (Undecidability results for POMDPs, [BBG08]). The following problems are undecidable: – given a POMDP M and a set F of states, decide whether ∃S. PrM S (♦F) > 0 – given a POMDP M and a set F of states, decide whether ∃S. PrM S (♦F) = 1 The result of Theorem 5 is remarkable since the corresponding questions for fully observable Markov decision processes (i.e., POMDPs where the ∼-equivalence classes are singletons) are decidable in polynomial time. However, there some other instances of the verification problem for POMDPs which are decidable. This includes the following questions (for further details see [dA99, BBG08, Grö08]): ∃S. PrM S (F) > 0 ∃S. PrM S (♦F) > 0 ∃S. PrM S (F) = 1 ∃S. PrM S (♦F) = 1 ∃S. PrM S (♦F) = 1 ∃S. PrM S (♦F) > 0 From the decidability of the question whether a given POMDP M and set F of states in M has a scheduler S such that PrM S (♦F) = 1 we can derive the decidability of the emptiness problem for PBA under an alternative semantics that requires that almost all runs are accepting. Formally, this almost-sure semantics for PBA assigns the language   L =1 (P ) = σ ∈ Σω : PrP (σ) = 1

Probabilistic Acceptors for Languages over Infinite Words

31

to each PBA P . Thus, the switch from the standard semantics L (P ) to the almost-sure semantics simplifies algorithmic problems, but the almost-sure semantics has several other disadvantages. PBA with the almost-sure semantics are less expressive. They even do not cover the full class of ω-regular languages. For instance, the ω-regular language (a + b)∗aω cannot be recognized by a PBA with the almost-sure semantics. Since the complement (a∗ b)ω of this language is recognizable by a deterministic Büchi automaton (and therefore also by a PBA with the almost-sure semantics), PBA with the almost-sure semantics are not closed under complementation. Furthermore, there are PBA where the almost-sure semantics yields a non-ω-regular language. An example is the complement of the language L (Pλ ) which is recognizable by a PBA with the almost-sure semantics, while L (Pλ ) is not. We finally mention that the differences between the standard semantics L (P ) and the almost-sure semantics L =1 (P ) for PBA do not hold when switching to Rabin or Streett acceptance. Recall that by the results established in Lemma 3 and Theorem 1, PRA with the almost-sure semantics are as expressive as ordinary PRA (and PBA), and checking emptiness, universality or equivalence of PRA with the almost-sure semantics are undecidable.

5 Conclusion We gave a summary of the fundamental properties of probabilistic acceptors for infinite words formalized by probabilistic ω-automata with Büchi, Rabin or Streett aceptance conditions. The results show some major differences to nondeterministic (or alternating) ω-automata concerning the expressiveness, efficiency and decidability, which makes PBA interesting at least from a theoretical point of view. So far, just the basic principles of probabilistic ω-automata have been studied and many interesting problems still have to be addressed, such as characterizations of the class of PBA-recognizable languages (e.g., by some temporal or modal logic or some extension of monadic second-order logic or by an extension of ω-regular expressions), or alternative semantics for PBA where checking emptiness is decidable and the full class of ω-regular languages is covered. The undecidability of the emptiness problem and related problems shows that PBA with the standard semantics are not adequate for algorithmic purposes, e.g., the verification of systems with nondeterministic behaviors. The situation changes if the system to be verified is purely probabilistic (i.e., modelled by a Markov chain). In this case some decidability results for the verification problem against PBA-specifications can be established [BG05]. Being a special instance of POMDPs all negative results for PBA (undecidability) carry over from PBA to POMDP. Vice versa, for many algorithmic problems for POMDPs, algorithmic solutions for PBA can be combined with standard algorithms for (fully observable) Markov decision processes to obtain an algorithm that solves the analogous problem for POMDPs. Another application of probabilistic ω-automata is run-time verification where special types of PBA can serve as probabilistic monitors [CSV08]. Given the wide range of application areas of probabilistic finite automata, there might be various other applications of probabilistic ω-automata. For instance, the concept of probabilistic

32

C. Baier, N. Bertrand, and M. Größer

ω-automata is also related to partial-information games with ω-regular winning objectives [CDHR06] or could serve as starting point for studying quantum automata over infinite inputs, in the same way as PFA yield the basis for the definition of quantum finite automata [KW97, AF98]. For these reasons, we argue that the concept of probabilistic ω-automata is an interesting new research field with plenty of open questions that might lead to interesting applications.

References [AF98]

[BBG08]

[BC03] [BG05]

[CDHR06]

[CSV08]

[CY95] [dA99]

[DS90] [Fre81] [Grö08] [GTW02] [KW97]

[Lov91]

Ambainis, A., Freivalds, R.: 1-way quantum finite automata: strengths, weaknesses and generalizations. In: Proc. of the 39th Symposium on Foundations of Computer Science (FOCS 1998). IEEE Computer Society Press, Los Alamitos (1998) Baier, C., Bertrand, N., Grösser, M.: On decision problems for probabilistic Büchi automata. In: Amadio, R. (ed.) FOSSACS 2008. LNCS, vol. 4962, pp. 287–301. Springer, Heidelberg (2008) Blondel, V., Canterini, V.: Undecidable problems for probabilistic finite automata. Theory of Computer Systems 36, 231–245 (2003) Baier, C., Grösser, M.: Recognizing ω-regular languages with probabilistic automata. In: Proc. of the 20th IEEE Symposium on Logic in Computer Science (LICS 2005), pp. 137–146. IEEE Computer Society Press, Los Alamitos (2005) Chatterjee, K., Doyen, L., Henzinger, T.A., Raskin, J.-F.: Algorithms for ωregular games with imperfect information. In: Ésik, Z. (ed.) CSL 2006. LNCS, vol. 4207, pp. 287–302. Springer, Heidelberg (2006) Chadha, R., Sistla, A.P., Viswanathan, M.: On the expressiveness and complexity of randomization in finite state monitors. In: Proc. of the 23rd IEEE Symposium on Logic in Computer Science (LICS 2008), pp. 18–29. IEEE Computer Society Press, Los Alamitos (2008) Courcoubetis, C., Yannakakis, M.: The complexity of probabilistic verification. Journal of the ACM 42(4), 857–907 (1995) de Alfaro, L.: The verification of probabilistic systems under memoryless partialinformation policies is hard. In: Proc. of the 2nd International Workshop on Probabilistic Methods in Verification (ProbMiV 1999), vol. 9, pp. 19–32. Birmingham University, Research Report CSR-99-9 (1999) Dwork, C., Stockmeyer, L.: A time-complexity gap for two-way probabilistic finite state automata. SIAM Journal of Computing 19, 1011–1023 (1990) Freivalds, R.: Probabilistic two-way machines. In: Gruska, J., Chytil, M.P. (eds.) MFCS 1981. LNCS, vol. 118, pp. 33–45. Springer, Heidelberg (1981) Größer, M.: Reduction Methods for Probabilistic Model Checking. PhD thesis, Technical University Dresden, Faculty for Computer Science (2008) Grädel, E., Thomas, W., Wilke, T. (eds.): Automata, Logics, and Infinite Games. LNCS, vol. 2500. Springer, Heidelberg (2002) Kondacs, A., Watrous, J.: On the power of quantum finite state automata. In: Proc. of the 38th Symposium on Foundations of Computer Science (FOCS 1997), pp. 66–75. IEEE Computer Society Press, Los Alamitos (1997) Lovejoy, W.: A survey of algorithmic methods for partially observable Markov decision processes. Annals of Operations Research 28(1), 47–65 (1991)

Probabilistic Acceptors for Languages over Infinite Words [MHC03]

[Mon82] [Paz66] [PT87] [Rab63] [Saf88]

[Son71] [SV89]

[Tho97] [VW86]

33

Madani, O., Hanks, S., Condon, A.: On the undecidability of probabilistic planning and related stochastic optimization problems. Artificial Intelligence 147(12), 5–34 (2003) Monahan, G.: A survey of partially observable Markov decision processes: Theory, models, and algorithms. Management Science 28(1), 1–16 (1982) Paz, A.: Some aspects of probabilistic automata. Information and Control 9 (1966) Papadimitriou, C., Tsitsiklis, J.: The comlexity of Markov decision processes. Mathematics of Operations Research 12(3) (1987) Rabin, M.O.: Probabilistic automata. Information and Control 6(3), 230–245 (1963) Safra, S.: On the complexity of ω-automata. In: Proc. of the 29th Symposium on Foundations of Computer Science (FOCS 1988), pp. 319–327. IEEE Computer Society Press, Los Alamitos (1988) Sondik, E.J.: The Optimal Control of Partially Observable Markov Processes. PhD thesis, Stanford University (1971) Safra, S., Vardi, M.Y.: On ω-automata and temporal logic. In: Proc. of the 21st ACM Symposium on Theory of Computing (STOC 1989), pp. 127–137. ACM Press, New York (1989) Thomas, W.: Languages, automata, and logic. Handbook of formal languages 3, 389–455 (1997) Vardi, M.Y., Wolper, P.: An automata-theoretic approach to automatic program verification. In: Proc. of the 1st IEEE Symposium on Logic in Computer Science (LICS 1986), pp. 332–345. IEEE Computer Society Press, Los Alamitos (1986)

Automatic Verification of Heap Manipulation Using Separation Logic Josh Berdine Microsoft Research

Accurately representing the structure and manipulation of heap-allocated data structures is a key challenge for automatic verification of nontrivial code. Capturing this information is central to proving properties such as the absence of invalid memory accesses (for instance, deallocating memory twice or dereferencing dangling or NULL pointers), the absence of memory leaks, and data-structure integrity properties (for instance, that a doubly-linked list structure is properly linked in both directions). Significant advances in this area have recently been made by using separation logic for the abstract representation of program states and semantics of commands. Here we explain the core of the approach that has enabled these advances in the automatic verification of deep heap properties, without requiring programs to be annotated by the developer. Additionally, starting from this core for verification of partial correctness properties, we present new techniques for termination analysis of heap manipulating code that are based on generating an abstraction for termination from a proof of partial correctness. This results in a purely arithmetic abstraction of heap manipulating code, which enables recent advances in termination proving to be applied to code that operates not only on integer data, but also on heap-allocated data structures.

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, p. 34, 2009. c Springer-Verlag Berlin Heidelberg 2009 

Technology Diffusion in Social Networks The Role of Compatibility Nicole Immorlica Northwestern University, Evanston, IL, USA [email protected]

Abstract. Social networks form the basic structure for the diffusion of technologies throughout a society. We present a simple model of Morris [8] for this diffusion based on myopic best-response behavior of the agents and derive necessary and sufficient conditions for a new technology to inflitrate a network in which all agents are intially using an incumbant technology. We then discuss an extention of this model based on joint work with Kleinberg, Mahdian, and Wexler [6] which incorporates compatibility between technologies and discuss how this effects the diffusion. We find some surprising results: in some cases, for one technology to survive the introduction of another, the cost of adopting both technologies must be balanced within a narrow, intermediate range. We also extend our framework to the case of multiple technologies, where we find that a simple model captures the phenomenon of two firms adopting a limited “strategic alliance” to defend against a new, third technology.

1

Extended Abstract

A social network is a graph representing entities and relationships between them. A graph of people and their friendships, a graph of webpages and hyperlinks, or a graph of countries and trading relations are all examples of social networks. Social networks play a fundamental role in the diffusion of information or behaviors. Perhaps the most immediate example of such diffusion processes is technology adoption.1 In this case, agents in a social network face decisions regarding which, of a competing set of technologies, they wish to adopt. Various factors affect this decision, including the quality of the technology, the cost of adoption, and the externality derived from using the technology in the context of the social network. For example, in a friendship network, agents must decide what cell-phone plan to choose. Each plan has a quality related to the coverage of the cell company’s network for example, and a cost. Additionally, two friends have larger benefits if they share the same cell-phone plan as phone calls within the same cell network are typically cheaper. Thus the structure of the social network clearly has implications regarding technology adoption, as we see in the work of several computer scientists and economists [1,2,3,4,5,6,7,8]. 1

The term technology is used in a loose sense; similar stories can be told about any sort of information or signal.

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 35–36, 2009. c Springer-Verlag Berlin Heidelberg 2009 

36

N. Immorlica

Such phenomena can be modeled by a coordination game played on the edges of the social network. For the case of two competing technologies, the payoffs can be represented by a bimatrix game M . Entry Mab (r) for r = {0, 1} is the payoff to player r when r plays strategy a and the opponent (1 − r) plays strategy b. Each node in the social network selects a single strategy and plays that strategy in the coordination game M on each adjacent edge. The payoff to a node is then the aggregate of the payoffs in each of these games. In this talk, we study diffusion under myopic best-response dynamics in which, in each round, an arbitrary agent chooses a strategy which is a best response to the aggregate of her or his neighbors’ strategies [6,8]. That is, an agent assumes that she or he will be playing bimatrix game M with a random neighbor in subsequent rounds and chooses the strategy which achieves the highest expected value assuming the neighbors’ strategies will not change. We first discuss a class result of Morris [8] which characterizes conditions under which a new superior technology can inflitrate a network in which everyone is initially using an inferior incumbant technology. We then discuss a joint work with Kleinberg, Mahdian, and Wexler [6] which extends this model to the case where technologies have limited compatibilites. We observe that limited compatibility may help an inferior incumbant technology to survive the invasion of a superior technology. We further provide a characterization of the conditions under which this happens and observe that it is related to the existence of so-called bi-lingual buffers, or nodes which adopt both technologies. We then discuss extensions of this model to the case of multiple technologies.

References 1. Anderlini, L., Ianni, A.: Path dependence and learning from neighbours. Games and Economic Behavior 13, 141–177 (1996) 2. Blume, L.: The statistical mechanics of strategic interaction. Games and Economic Behavior 4, 387–424 (1993) 3. Blume, L.: The statistical mechanics of best-response strategy revision. Games and Economic Behavior 11, 111–145 (1995) 4. Ellison, G.: Learning, local interaction, and coordination. Econometrica 61, 1047– 1071 (1993) 5. Goyal, S., Janssen, M.: Non-exclusive conventions and social coordination. Journal of Economic Theory 77, 34–57 (1997) 6. Immorlica, N., Kleinberg, J., Mahdian, M., Wexler, T.: The role of compatibility in the diffusion of technologies in social networks. In: ACM Conference on Electronic Commerce (EC) (2007) 7. Mobius, M.: Death through success - telephone competition at the turn of the century. mimeo, Harvard University (2007) 8. Morris, S.: Contagion. The Review of Economic Studies 67, 57–78 (2000)

Service Oriented Architecture Pitfalls Radovan Janeˇcek Director of Service Portfolio Management R&D HP Software, Hewlett-Packard [email protected]

Abstract. The distributed software systems theory is comprehensively described and also deeply understood in academic community. The domain has its own interesting history of research and application. Almost every computer science graduate has some knowledge of distributed algorithms or fundamental properties and goals of such systems. And almost every software product nowadays is relying on some sort of a distributed system. It is therefore surprising that we are witnessing repeated failures of enterprise application integration middlewares, one of the most promising incarnations of the theory. The enterprise software industry is aligning behind new attempt to deliver so called Service Oriented Architecture (SOA), which is supposed to fix the existing middleware problems and finally deliver an ecosystem of applications talking to each other seamlessly. Despite all the promises and rightful expectations, there is very high risk of yet another failure though. The goal of this paper is to suggest how to give SOA a chance.

Personal Note I feel very lucky I had the opportunity to study and research distributed systems as a member of the Distributed Systems Research Group at Charles University in Prague. Even after ten years, I keep my best memories of the seminars, writing papers, and attending conferences. The experience and knowledge I had gathered during that time was indeed an invaluable asset for me when I co-founded the web services (later SOA) company called Systinet back in March 2000. Eventually, Systinet became a very successful SOA vendor and I have got involved in many large SOA projects in various industries in the past eight years. Systinet’s technology has also become an essential part of large middleware stacks from vendors such as Oracle, BEA, or TIBCO. I have continued leading SOA strategy and R&D management after Systinet was acquired by Mercury Interactive (2006) and later by Hewlett-Packard (2007). Today, the HP SOA product suite builds on the Systinet platform and its footprint on the market has increased dramatically. HP SOA Systinet is part of one of the largest enterprise software portfolios called Business Technology Optimization (BTO). I spent this year as the chief architect of BTO, focusing on defining and executing integration strategy for this giant portfolio of heterogeneous products. No surprise I chose SOA as the architecture and methodology framework for this non-trivial task. M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 37–45, 2009. c Springer-Verlag Berlin Heidelberg 2009 

38

R. Janeˇcek

When writing this paper, I have been trying to provide an industrial perspective, based on my experience from the SOA projects I have participated in. Trying to document every single position presented throughout the paper would, unfortunately, be a futile endeavor, since many of the experiences are not published in detail separately. I have therefore decided to take the liberty of adopting a stance that is unusual in academic circles, and present my statements without rigorous proof in references, hoping that the short justification presented here will make enough sense to underscore my points.

1

Transparency Issue

One of the main characteristics of distributed systems is that they provide various types of transparency [3]. Or, more precisely, they are supposed to provide. Let’s look at some of them: – Location transparency – an entity accessing distributed resources shouldn’t have to care about physical location of these resources. For example, an application accessing a file should see no difference whether the file resides on a local machine or on the other side of the globe. – Invocation transparency – as an implication of location transparency, it should be also transparent whether an application invokes its business logic locally or remotely. There are many technologies and approaches how to do Remote Procedure Calls (RPC), Remote Method Invocation (RMI), or Message Oriented Middlewares (MOM). – Transactional transparency – one of the very interesting goals for good middleware is to support distributed transactions. In theory, it should be possible to group multiple Invocations into a single transaction regardless of whether they are local or remote. – Technology and ’vendor’ transparency (also known as Interoperability) – applications are supposed to seamlessly exchange data independently of what programming language they are written in, what platform they run on, or what vendor they are produced by. All the above transparency requirements make a lot of sense. Unfortunately, there are at least three real world issues with relying on them. First, nothing is perfect and the more the application logic relies on the presence of the transparency features the more bad side-effects we get from those ’imperfections’. Second, even if we assume perfect functionality on the system level, there is always the need to ’configure’ the environment in order to make the transparency work well from the application point of view. The more elements we have (applications, orchestration engines, content level routers, transformation engines, security intermediaries, etc.), the more configuration activities have to be done to keep the overall system consistent. And because - unlike with IDE environments - there are usually no good tools, standards, and best practices, the configuration of such environments quickly becomes an unmanageable problem – also known as configuration hell.

Service Oriented Architecture Pitfalls

39

The third issue relates to people skills. Good object oriented design, evolutionready API definitions, wise use of transactions, and similar advanced topics are difficult to do well even within one single application. Bringing questionably designed APIs or transactions into distributed environment makes the resulting system very fragile, not performing, not scalable, or not usable at all. All in all, what started as a powerful theory bringing exciting products to the market is ending up as myriads of failed integration projects. Will SOA solve this integration pain?

2

Service Oriented Architecture Pitfalls

SOA is based on the concept of a Service as the entity providing certain business functionality. In addition to this, SOA puts a lot of emphasis on Contracts between the services and their consumers. Contracts go beyond just an API definition, specifying other technical aspects such as security policies, as well as non-technical aspects such as operation hours or expected number of transactions per day. Moreover, SOA insists on loose coupling, which implies many additional requirements on how to design the contracts to keep maximum independency of services from each other. SOA also insists on absolute adherence to industry standards. And SOA is also admitting that distribution has to be taken into account because it is not transparent. However, even after eight years of SOA being the hot topic on the market, we are still witnessing many failing SOA projects. Why? Because enterprise architects tend to look at SOA as yet another EAI middleware. I am often using terms “EAI in angle brackets” or “Snake-Oil Architecture” when describing SOA pitfalls. The ’transparency assumption’ and the ’EAI approach’ are the most significant technical reasons why SOA projects are failing. In simplified terms, EAI teaches us that we can keep weak underperforming endpoints and integrate them together using the middleware infrastructure that will remove the problems (scalability, versioning, reliability, etc.), while SOA encourages building strong services that will solve these problems on their own. Pitfall #1: SOA is seen as a better version of EAI that finally improves middleware weaknesses by providing better interoperability, more reliability, wider adopted standards, etc. Reality: SOA is an architecture on higher-level than EAI. It is architecture of loosely coupled independent services communicating to each other. EAI is appropriate for small scale integration projects. 2.1

Tight Coupling Versus Loose Coupling

A vast majority of integrated applications is tightly coupled. This means that changes in one of them necessitate changes on the consuming counterparts. Often, the tight coupling is desirable. Especially when dealing with exposing legacy

40

R. Janeˇcek

systems. For example, it is important to tightly couple database schema of a legacy system with newly created application logic to ensure data integrity and alignment with the application. In other words, the tight coupling is useful on the backend/frontend boundary. Unfortunately, having the transparency assumptions in mind, integration middlewares encourage developers to introduce tight coupling even among applications (i.e. frontend/frontend boundary). In this case, tight coupling is very undesirable because it brings unwanted dependencies to otherwise independent applications. That is why the recent Service Oriented Architecture practices brought the loose coupling idea. Loose coupling insists on keeping independence of collaborating endpoints (services). Building loosely coupled services requires architects not to rely on the invocation, location, or transactional transparency and rather explicitly redesign legacy APIs to respect the fact messages can be lost, network bandwidth can be limited, and so on. Pitfall #2: Architects expect loose coupling comes for free with using web services toolkits or with using standards like SOAP, WSDL, XML Schema, and so on. Reality: Loose coupling is a result of very careful API design. Standards and tools might (or might not) contribute to loose coupling. 2.2

Sameness Versus Application “Arbitrary” Behavior

Successful implementations of distributed systems share one characteristic: they expose endpoint APIs with very limited variability. We can point to distributed file systems, LDAP-based directories, email infrastructure, and similar. We can also say that the HTTP-based web infrastructure is a good example of oneAPI-for-all. And obviously, we can say it is also a hugely successful distributed system. On the other hand, application developers design service APIs in completely arbitrary way. They think in object orientation, where data is encapsulated by methods and where no commonality is required beyond the object or application they are designing. Why should this be an issue? In a constrained system, like the web, it is possible to make general assumptions about every communicating endpoint (because it has the same API). For example, it is possible to assume that certain operations are always idempotent. This assumption then allows for caching mechanisms or implementing much simpler reliable or transactional data exchanges. Having no constraints brings the ultimate flexibility but also the ultimate complexity. Pitfall #3: Services APIs are often designed only from particular application perspective. Reality: Service APIs should conform to constraints defined by central body. This process is usually called SOA Governance.

Service Oriented Architecture Pitfalls

2.3

41

Web Services Architecture Versus Web Architecture

There is an intensive discussion in the software community whether SOA should be based on Web Services Architecture (WSA) [1] or Representational State Transfer (REST) [2]. It’s important to keep in mind that REST is an architectural style of World Wide Web while WSA can be seen as evolutionary successor of CORBA. From the architecture perspective, REST represents the constrained architecture approach, where services must comply with several constraints such as uniformity of APIs, addressable resources, statelessness of client-service communication, and so on. WSA does not impose any limits over services. The reason why this discussion exists is that the REST style has been proven on the Web, as HTTP implements a RESTful distributed system. It has proven its scalability, whether with number of endpoints, users, or otherwise. From certain perspective, we can say that HTTP is turning web services (or web applications) into ’system-level’ components that expose the same behavior to the external world. And that’s why HTTP works well even on such a massive scale. Pitfall #4: RESTful services are considered insufficient for enterprise use cases because there is no standard way how to describe all kinds of application-level protocols. This makes design, development, management, and monitoring of such services more difficult. Reality: Design and development of RESTful services is indeed more difficult, especially for architects that are used to working with the traditional API model. At the same time, it is much easier to integrate such services together. Exposing WSA services is practical if they directly expose legacy business logic (with legacy API) and turning such API into a RESTful one would be very expensive. 2.4

Introducing New Business Logic

Let’s look at multi-tiered application architecture approach. While breaking one single application into two or more tiers is very often a desirable practice (because the breakdown again happens on frontend/backend boundary), applying the same principle among applications themselves is at least very questionable. Again, unfortunately, this is a common EAI practice based on the transparency assumptions. The simplest example consists of two independent applications A and B that we want to integrate together to implement specific use case. Let’s assume the use case analysis shows there is additional business logic that has to be implemented because none of the existing applications provide it – for example, a purchase order needs to be transformed and enriched before it is processed. Instead of putting this additional business logic into one of these applications, many architects tend to ’outsource’ this logic into the EAI middleware M (orchestration engines, business process engines, and so on). The architects feel

42

R. Janeˇcek

justified - isn’t it the case that the middleware will take care about reliability, security, and also host the new logic? But, at the same time, instead of having two stronger endpoints we suddenly have four: A, A2M, M2B, and B. Two more to configure, maintain, and pay for... Pitfall #5: It is easier to implement new business logic in the middle tier because it does not require changes in existing products. Reality: Any additional business logic should be pushed out to the endpoints as much as possible. This might be more difficult to develop but it keeps the overall SOA system simpler (i.e. cheaper). If there is still ’remaining’ business logic then it should be implemented as a new service and likely as a new application too. Pitfall #6: Introducing more intermediaries and middle tiers helps to decouple communicating services. Reality: In most cases, introducing new intermediate steps creates twice as many tightly coupled endpoints. 2.5

HUB Versus Point-to-Point

There is a common perception that direct point-to-point relationships among services should be eliminated because putting good middleware infrastructure in between the services helps getting more control and visibility over their communication. There is also a strong complexity argument. While services connected mutually to each other result in O(n2 ) problem, the hub-based solution has only O(n) complexity. This comparison speaks clearly for the hub, especially in large scale systems. At the same time, the above advantages are rather hypothetical, while the disadvantages are very real. Even if there are thousands of services deployed within an enterprise, only fractions of them are mutually interconnected. Also, it is very likely that there are multiple hubs (in the world of SOA, these hubs are called Enterprise Service Buses) from multiple vendors. It is a big challenge for many large companies to integrate different ESBs. This selfinflicted problem is even more difficult to solve than to just integrate individual services. Pitfall #7: Enterprise Service Bus improves visibility and control over the service communications as well as reduces complexity of service relationships. Reality: None of the promised benefits materialize. Providing visibility and control has to be a non-functional part of the service contract. In other words, the service is responsible for it. Service relationships are not complex compared to the complexity of setting up the service bus infrastructure.

Service Oriented Architecture Pitfalls

2.6

43

Common Data Model

Because EAI projects are usually smaller scale projects, it is often a reasonable idea to align on details of the shared data model among applications. It is often unreasonable to try defining a shared data model on enterprise level because it is difficult to demonstrate clear return on investment. What is very important though is to set up guidelines for how to align behind key metadata such as identifiers, versions, or business taxonomies, and how to externalize such metadata into standard protocols such as SOAP or Atom. In the world of SOA, the data model is purely driven by service contract. So it is very much acceptable to have two services offering two types of purchase order data entity. Pitfall #8: In order to implement good SOA, it is necessary to align on enterprise-wide common data model. Reality: Trying to align on the data model will only slow down the SOA projects. There is no strong reason to do so as long as service contracts are well defined and governed. 2.7

Enterprise Readiness

All the listed (and many other) fallacies and pitfalls that enterprise architects can fall into when implementing SOA are related to a common goal called the enterprise readiness. Software is enterprise ready when it exhibits many desired characteristics needed for large scale deployments: high availability, failover, strong security, openness, standard compliance, reliability, scalability, accessibility, localizability, and many others. Although enterprise readiness is only vaguely defined, there is a wide agreement on validity of this goal. However, there are many wrong ways how to achieve enterprise readiness for SOA. The pitfalls I mentioned earlier represent these wrong approaches: – It is indeed easier to control the data model and the object model in tightly coupled applications. Although tightly coupled applications are more fragile from the evolution perspective, they are more robust (easy to back up, replicate, and so on). Introducing loose coupling often requires giving up on enterprise requirements provided out of the box by middleware platforms. This is the step many architects are afraid to take. – It is definitely easier to describe application specific APIs without uniformity constraints. It is easier to directly expose legacy system APIs to the SOA level with web services toolkits rather than redesigning them along the REST lines. From the enterprise readiness perspective, fine grained arbitrary APIs are not considered problematic because middleware platforms will make sure the interactions among services and applications will be secure and reliable. Therefore, the industry prefers this higher flexibility in APIs definition even if such an approach is repeatedly failing in large scale environments. This flexibility is less enterprise ready!

44

R. Janeˇcek

– There are many middleware products taking care of the enterprise readiness – or at least promising so. It is therefore very tempting to use these middlewares without better thinking about unwanted consequences. These unwanted consequences include the configuration hell, overly fragmented business logic, higher deployment and maintenance costs, and the necessity of another integration layer (integration of multiple middlewares). In many small scale projects, the enterprise middleware is able to demonstrate return on investment despite the aforementioned issues. Unfortunately, SOA initiatives are enterprise-wide large scale projects requiring a different approach. This different approach suggests to invest into building strong (enterprise ready) services that are self sufficient. This also means that many enterprise features need to be addressed on the business logic level, as opposed to the system level. Pitfall #9: Enterprise readiness requirements seem to justify the use of middlewares and discourage the use of lighter-weight systems such as HTTP because they are not ’enterprise ready’. Reality: In large scale systems, the enterprise readiness requirements can only be practically met when the system entities (in our case SOA services) are enterprise ready themselves. 2.8

Organizational Impact of SOA

This paper warns of a danger of blind application of EAI technologies and methodologies when implementing SOA. There is, however, one more, and probably the most important, pitfall: assuming SOA does not require organizational changes in IT because it is ’just software architecture’. How can the potential users even know what SOA services are available for enterprise-wide use? Why should anybody be interested in sharing services he or she has developed with others? Why should anybody use somebody else’s services and expose his or her business to an unknown risk of failures of these services? Pitfall #10: SOA projects are defined purely as integration software projects without understanding the need of proper involvement of top IT and business stakeholders. Reality: SOA requires rather significant investments. If there are insufficient processes establishing visibility, trust, and control into the emerging ecosystem of services and their consumers, then the return on investment will not occur.

3

Summary

Building distributed systems is a very difficult task, where the software industry has developed a very good track record over the past few decades. We are

Service Oriented Architecture Pitfalls

45

using many distributed systems without even noticing. However, successful implementations of such systems are usually at very low-level – we say system level. Attempts to elevate all the powerful characteristics of the distributed systems onto an application (business logic) level often fail. This is a serious warning sign for the Service Oriented Architectures, which suggest turning the enterprise applications into composable services that are then being used to implement new distributed business logic. In order to succeed, enterprise architects must not rely on traditional promises of integration middlewares such as reliability, transparency, transactional integrity, and similar. Instead, whenever these characteristics are needed, they have to be implemented on the application level. In order to efficiently do so, it is extremely important to follow practices such as loose coupling or REST and to avoid pitfalls such as Enterprise Service Bus, Common Data Model, or middleware-hosted business logic.

References 1. Web Services Architecture, http://www.w3.org/TR/2004/NOTE-ws-arch-20040211 2. Fielding, R. T.: Architectural Styles and the Design of Network-Based Software Architectures, http://www.ics.uci.edu/∼ fielding/pubs/dissertation/top.htm 3. Reference Model of Open Distributed Processing, ITU-T Rec. X.901-X.904, ISO/IEC 10746

Algorithms for Solving Infinite Games Marcin Jurdzi´ nski Department of Computer Science University of Warwick [email protected]

Solving parity games is an algorithmic problem which is polynomial-time equivalent to the modal mu-calculus model checking problem [5], and hence of fundamental importance for the automated verification of computational systems [8]. Establishing its exact computational complexity is an intriguing long-standing open problem. The problem is known to be in UP (unambiguous NP) and coUP [9], but no polynomial time algorithm or complexity-theoretic evidence of hardness have been found, since almost two decades ago when its membership to NP and co-NP was exhibited [5]. This talk surveys recent algorithmic ideas which yield improved running time bounds for the problem. A modification of a classical recursive algorithm for solving parity games, that originates from the work of McNaughton and Zielonka, leads to a first subexponential deterministic algorithm [11]. A refinement of the above modification of the classical recursive algorithm, due to Schewe, in which another classical algorithm for solving parity games [10] is used as a subroutine, results in an algorithm with the best currently known provable time complexity [15]. A number of other two-player infinite games on graphs—including meanpayoff games [19], simple stochastic games [3], and discounted games [16]—share the intriguing complexity-theoretic status of parity games, and are of significant independent interest. They originate from the theory of stochastic games, and have been studied for over five decades within a number of communities, including artificial intelligence and planning, mathematical programming, and algorithms and computational complexity. Since solving parity games can be reduced in polynomial time to solving those games, the rich theory of the latter [6,19] is a fertile ground for exploring new algorithmic techniques for the former [1,18]. The second part of this talk outlines a research direction, in the quest for establishing the exact computational complexity of solving parity games, based on a branch of mathematical programming and combinatorial optimization that has attracted relatively little attention in theoretical computer science. Linear complementarity problem (LCP) is a fundamental algorithmic problem in the theory of mathematical programming [4], that both linear and quadratic programming can be reduced to. In general the problem is NP-hard, but for some classes of matrices (the input to an LCP is a matrix and a vector) the exact computational complexity is open. For the class of P-matrices, which is all-important M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 46–48, 2009. c Springer-Verlag Berlin Heidelberg 2009 

Algorithms for Solving Infinite Games

47

in the theory of LCP, the LCP problem is known to be in the PPAD, an important class of search problems [13]. P-matrix LCP is not, however, known to be PPAD-complete, and it is even conjectured to be solvable in polynomial time. On the other hand, the class of LCPs that arise from the fundamental problem of computing Nash equilibria in bimatrix games has been shown to be PPAD-complete [2]. LCP formulations for mean-payoff, simple stochastic games, and discounted games have been considered in literature [7,17]. We discuss a particularly natural P-matrix LCP formulation for discounted games [12]. Its transparent nature facilitates derivation and study of novel algorithmic approaches to discounted games, and hence also for parity games, from existing algorithmic results for the P-matrix LCP. One immediate corollary is membership of the problem of solving discounted and parity games in PPAD. We argue that natural pivoting algorithms for LCP correspond to previously known and new variations of strategy-improvement algorithms for discounted and parity games. This implies membership of the game problems in PLS, another important and natural class of search problems. The celebrated Cottle-Danzig and Lemke algorithms for LCP [4] yield new algorithms for solving discounted and parity games which deserve closer scrutiny. For example, prior to the discovery of PPAD-hardness of finding Nash equilibria, Savani and von Stengel have exhibited families of bimatrix games for which the Lemke-Howson algorithm runs in exponential time [14]. As such examples remain elusive for strategy-improvement algorithms on discounted or parity games [18], an alternative goal could be finding hard examples for the Lemke algorithm run on the associated P-matrix LCP.

References 1. Bj¨ orklund, H., Sandberg, S., Vorobyov, S.: A discrete subexponential algorithm for parity games. In: Alt, H., Habib, M. (eds.) STACS 2003. LNCS, vol. 2607, pp. 663–674. Springer, Heidelberg (2003) 2. Chen, X., Deng, X.: Settling the complexity of two-player Nash equilibrium. In: Foundations of Computer Science (FOCS), pp. 261–272. IEEE Computer Society Press, Los Alamitos (2006) 3. Condon, A.: The complexity of stochastic games. Information and Computation 96, 203–224 (1992) 4. Cottle, R.W., Pang, J.-S., Stone, R.E.: The Linear Complementarity Problem. Academic Press, London (1992) 5. Emerson, E.A., Jutla, C.S., Sistla, A.P.: On model-checking for fragments of µcalculus. In: Courcoubetis, C. (ed.) CAV 1993. LNCS, vol. 697, pp. 385–396. Springer, Heidelberg (1993) 6. Filar, J., Vrieze, K.: Competitive Markov Decision Processes. Springer, Heidelberg (1997) 7. G¨ artner, B., R¨ ust, L.: Simple stochastic games and P-matrix generalized linear complementarity problems. In: Li´skiewicz, M., Reischuk, R. (eds.) FCT 2005. LNCS, vol. 3623, pp. 209–220. Springer, Heidelberg (2005) 8. Gr¨ adel, E., Thomas, W., Wilke, T. (eds.): Automata, Logics, and Infinite Games. LNCS, vol. 2500. Springer, Heidelberg (2002)

48

M. Jurdzi´ nski

9. Jurdzi´ nski, M.: Deciding the winner in parity games is in UP ∩ co-UP. Information Processing Letters 68(3), 119–124 (1998) 10. Jurdzi´ nski, M.: Small progress measures for solving parity games. In: Reichel, H., Tison, S. (eds.) STACS 2000. LNCS, vol. 1770, pp. 290–301. Springer, Heidelberg (2000) 11. Jurdzi´ nski, M., Paterson, M., Zwick, U.: A deterministic subexponential algorithm for solving parity games. SIAM Journal on Computing (to appear, 2008) 12. Jurdzi´ nski, M., Savani, R.: A simple P-matrix linear complementarity problem for discounted games. In: Beckmann, A., Dimitracopoulos, C., L¨ owe, B. (eds.) CiE 2008. LNCS, vol. 5028, pp. 283–293. Springer, Heidelberg (2008) 13. Papadimitriou, C.H.: On the complexity of the parity argument and other inefficient proofs of existence. J. Comput. Syst. Sci. 48(3), 498–532 (1994) 14. Savani, R., von Stengel, B.: Hard-to-solve bimatrix games. Econometrica 74, 397– 429 (2006) 15. Schewe, S.: Solving parity games in big steps. In: Arvind, V., Prasad, S. (eds.) FSTTCS 2007. LNCS, vol. 4855, pp. 449–460. Springer, Heidelberg (2007) 16. Shapley, L.S.: Stochastic games. Proc. Nat. Acad. Sci. U.S.A. 39, 1095–1100 (1953) 17. Svensson, O., Vorobyov, S.: Linear complementarity and P-matrices for stochastic games. In: Virbitskaite, I., Voronkov, A. (eds.) PSI 2006. LNCS, vol. 4378, pp. 409–423. Springer, Heidelberg (2007) 18. V¨ oge, J., Jurdzi´ nski, M.: A discrete strategy improvement algorithm for solving parity games (Extended abstract). In: Emerson, E.A., Sistla, A.P. (eds.) CAV 2000. LNCS, vol. 1855, pp. 202–215. Springer, Heidelberg (2000) 19. Zwick, U., Paterson, M.: The complexity of mean payoff games on graphs. Theoretical Computer Science 158, 343–359 (1996)

Randomness and Determination, from Physics and Computing towards Biology Giuseppe Longo CNRS, Dépt. Informatique – ENS, and CREA, Polytechnique, Paris http://www.di.ens.fr/users/longo

Abstract. In this text we will discuss different forms of randomness in Natural Sciences and present some recent results relating them. In finite processes, randomness differs in various theoretical context, or, to put it otherwise, there is no unifying notion of finite time randomness. In particular, we will introduce, classical (dynamical), quantum and algorithmic randomness. In physics, differing probabilities, as a measure of randomness, evidentiate the differences between the various notions. Yet, asymptotically, one is universal: Martin-Löf randomness provides a clearly defined and robust notion of randomness for infinite sequences of numbers. And this is based on recursion theory, that is the theory of effective computability. As a recurring issue, the question will be raised of what randomenss means in biology, phylogenesis in particular. Finally, hints will be given towards a thesis, relating finite time randomness and time irreversibility in physical processes.

1

Introduction

In classical physical systems (and by this we mean also relativistic ones) randomness may be defined as ‘deterministic unpredictability’. That is, since Poincaré’s results and his invention of the geometry of dynamical systems, deterministic systems include various forms of chaotic ones, from weak (mixing) systems to highly sensitive ones to border conditions. Randomness can then be viewed as a property of trajectories within these systems, namely as unpredictability in finite time, [3], [15], [7]. Moreover, ergodicity (à la Birkhoff) provides a relevant and purely mahematical way to define randomness asymptotically, that is for infinite trajectories, still in deterministic systems inspired from physics but independently of finite time predictability of physical processes, [13]. Also recursion theory gave us a proper form of asymptotic randomness, for infinite sequences, in terms of Martin-Löf randomness, [31], [36]. This has been extensively developped by Chaitin, Schnorr, Calude and many others, [10], also in relation to physics. A third form of randomness must be mentioned: the randomness proper to quantum theories. This randomness is intrinsic to quantum measure and indetermination, two principial issues in quantum mechanics, as, according to the standard interpretation, it cannot be viewed as a form of (hidden or incomplete) M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 49–61, 2009. c Springer-Verlag Berlin Heidelberg 2009 

50

G. Longo

determination, [16], [1]. Technically, it differs from classical randomness in view of Bell inequalities and their role in probability measures, [5], [7]. It may be shown that these three forms of randomness differ in finite space and time. Yet, by hinting to some recent results by M. Hoyrup and C. Rojas in the team of the author and by T. Paul, we will see that they merge, asymptotically. This poses several open questions as for the correlations in finite time of classical, quantum and algorithmic radomness, an issue extensively studied by many, as these asymptotic analyses may propose a new perspective. The infinity of this sequences is essential, as we shall see. Yet, before jumping into infinity, let’s see how to randomness differs in the various theoretical frames, at finite time, in reference also to computer networks and concurrency, [4]. Later, we will correlate finite time randomness in different frames, by a conjecture on its relation (equivalence?) to time irreversibility. Finally, the question will be posed concerning the kind of randomness we may need of in theories of the living state of matter, where complex interactions between different levels of organization, in phylogenesis in particular, seem to give even stronger forms of unpredictability than the ones analyzed by physical or algorithmic theories.

2

A Few Structures of Physical Determination

In physics, the dynamics and “structures of determination” are very rich and vary from one theory to another (classical, relativistic, quantum, critical state physics. . .). They propose the theoretical frameworks, the causal relationships (when the notion of causality is meaningful) or, more generally, the correlations between objects or even the objects of a theory themselves. A great principle unifies the various theoretical frameworks: the geodesic principle, a consequence of the symmetries and of the symmetry breakings at the center of all physical theories, [17], [6]. As for computability theory, we are all aware of the new and very relevant role of computing in Natural Sciences. Yet, the reference to computer science in the analysis of natural phenomena is not neutral; it organizes the world by analogy to a formidable conceptual and practical tool, the digital machine, of which the strength resides also (and mainly) in identical iteration. This takes the form of primitive recursion (Herbrand’s and Gödel’s foundation of computability), which is iteration plus “increment a register”. Iteration is at the center of the reliability and portability of the software: it iterates or it does what it is expected to, a thousand or a million times, even in computational environments which differ, logically, a bitbut not too much though. Recursion and portability constitute and require iteratability. This is what leads Turing, its inventor, to say that his “discrete state machine” is Laplacian1 , [37] (see also the reflections in [27], [28]). By the analysis of programs, or by iterating computations, its evolution can be predicted. Unpredictability is practical, says he; it is not by principle, whereas it is the interesting principle in the continuous dynamics of the physics of chaotic 1

That is, (equational or functional) determination implies predictability.

Randomness and Determination, from Physics and Computing

51

determinism (Turing’s other pioneering exploration, [38]) as well as in quantum mechanics, albeit for other reasons. The situation is radically changing in computer networks and the related theoretical frames for concurrency: the complexity of physical space and time steps in along computations. And randomness pops out.

3

Randomness

“Random” is not the opposite of “deterministic”, in spite of the opposition of these concepts that is commonly made in computing and biology. As a matter of fact, the analysis of randomness is part of the proposal for a structure of determination of physical processes, in particular in classical dynamics, where randomness is deterministic unpredictability. But it is so also when it is related the very precise and specific notion of quantum indetermination and quantum measure of “deterministic evolutions of the state function” (determined by Schrödinger equation). 3.1

Classical

What would a dice say if we were to ask it: “Where will you go?” It would answer: “I will follow a geodesic, an optimal trajectory, from my initial conditions; a course which will minimize the Lagrangian action (energy×time). My trajectory is perfectly determined by Hamilton’s principle, otherwise known as the principle of least action. If you are unable to measure exactly my position-momentum or the boundary conditions, that’s your problem: my unpredictability, this randomness you make into a paradigm, is purely epistemic. As a classical object, my evolution is totally deterministic”. Now, classical (and relativistic) physical measurement is an interval, by principle (there is at least thermal fluctuation). So the processes which, all the while being deterministic, are “sensitive to the boundary conditions”, hence to perturbations or fluctuations below measure, escape prediction, and give us randomness as deterministic unpredictability, within deterministic chaotic systems, [24], [15]. The epistemic nature of classical randomness is also given by the co-existence of two complementary approaches to its analysis. One can understand the properties of dice throwing or coin tossing also by statistics. And probabilities, as measure, may be given a priori on the ground, say, of the symmetries of dice or coins. Thus, the same processes can be analyzed both in terms of deterministic unpredictability and of probabilities or statistical analyses. This a further reason to call classical randomness epistemic, one may easily change perspective. And the phenomenon is rather general. Since Poincaré (1890) we know of the unpredictibility of one of the simplest or dearest deterministic systems: the fragment of the Solar system made out of three celestial bodies in theri gravitational field. On a plane, nine equations, Newton-Laplace style, suffice to deermine it, yet. . . chaos pops out and today we can quantify its unpredictability, in (astronomically short) finite time, [26]. Of course, it is better to analyse coin tossing

52

G. Longo

in statistical terms (too many equations and rather useless) and the Solar system in equational ones (however,... we could bet on whether the Earth will still be on a “viable” orbit around the Sun in 100 milions years, since this is provably unpredictable, [26]). Yet, they belong to the same conceptual frame, as for determination. 3.2

Quantum

And if we asked the same question to a quanton, an elementary component of Quantum Physics? Firstly, and this is very important, the quanton must be produced and measured for it to be possible to hear or see its response – it is necessary to prepare the experiment and to choose a measuring instrument. If, for example, we were to throw it towards a Young’s double slit and if we were to place an interferometer behind the slits, the quanton would say that it is a wave which will pass through the two slits (hence the interference); if we were to rather place a particle counter behind the slits, it would say that it is a particle which will randomly select which slit to go through (50-50). Funny trajectory. . . its evolution is indeed determined by a wave equation, Schrödinger’s equation, but defined in a Hilbert space, a function space, outside of the world, beyond physical space-time. The measurement which brings us back to space-time in both cases, gives us a ‘trajectory’ which is not a trajectory, a paradigm of intrinsic randomness which is specific to quantum mechanics, [16], [1]. From a mathematical and experimental standpoint, Bell inequalities and Aspect’s experiment ([5]) demonstrate that this randomness is different than that of dynamical systems: the phenomena of entanglement give way to probability correlations that are incompatible with classical probabilistic “laws”. As a matter of fact, if two classical bodies (two coins) interact and then separate in space and time, their evolution is statistically independent. In contrast to this, the result of the probability measures of two quanta, which first interact and then travel away in space, are correlated (this is “quantum entanglement”). In short, if Bob in Paris and Alice in Rome, toss two “entangled quantum coins” (or measure the spin up-down of entangled quantons) at the same (relativistic) moment, they always obtain the same, random, result (or, more generally, the results are correlated). There is no way to act on the result, and thus to transmit instantaneously information, yet. . . something incompatible with classical (and relativistic) theories happens and this has been extensively checked, by experiments. Moreover, entanglement is the core idea in quantum computing. In summary, it is fair to call quantum randomness intrinsic or objective, in the sense that randomness is intrinsic to the theory (no ontological commitment is necessary!), [7]. In other words, for the standard interpretation (no hidden variables nor hidden determination), the theory is “complete”: there is no way to avoid probabilities in measure and entanglement forces non-locality of phenomena as probability correlations. The difference should be clear w.r. to classical randomness, where one can both use a deterministic analysis and an analysis in terms of statistical theories. Once more, in classical physics, in principle, the underlying process are fully determined: there are just non-observable

Randomness and Determination, from Physics and Computing

53

(hidden) fluctuations or perturbations, in border or initial conditions, that may cause massive (observable) changes in finite time (randomness as deterministic unpredictability). Classical physics computes (determines) over approximated measures and produces approximated results. In quantum physics what is determined and computed (by Schrödinger equation), is not what is measured, an exact but random value, whose probability value is the real projection of a complex number (a vector). 3.3

Computational

And what would the pixel on your computer screen say, as a discrete image of a physical trajectory? For it to move, there needs to be a program which describes a trajectory starting at this pixel’s location. This program could consist in the discretization of the mathematical representation of the most complex (or chaotic, § 3.1) of physical evolutions, that of a turbulence, for instance. Once discretized, this representation (equational, or directly given by an evolution function) affects a discrete database, within a discrete computational environment, made up of pixels, 0s or 1s, quite distinguishable from one another. The natural framework for its geometric description is discrete topology. Within the machine, the measurement of the initial conditions and that made at the boundary will be exact. That is, contrary to the physical (classical) framework with its interval-based metric and topology, the measurement of the initial situation and at the boundary is exact in the case of a digital machine, in the sense that we access digits, one by one. Moreover, in the isolated machine (not part of a network), the measurement (the access to the data) is also absolute, in the absoluteness of its time and space. If the trajectory of your dice, well simulated by means of very realistic images, is reinitialized using the same initial and boundary digital conditions, which can be done exactly, it will be identical, be it twice or a thousand times. . . Identical iteration, we insist, is the constitutive principle of the discrete state machine and of its computer programming. There is no randomness in the sequential machine: the pseudo-generators of random sequences are just that, pseudo and, if they are launched again in identical initial conditions (the discrete state machine can do this), they will identically iterate their sequences, well distributed for statistical measurement. They are random in the sole sense of having a “good” distribution of 0s and 1s, without regularities. Randomness is an hardware mistake or, more generally, must be introduced from outside (the theory). In networks, instead, with the existence of concurrency (different machines, distributed in space, “concurrently” allocated to the same calculation), the situation gets more complicated: the space-time of physics, even relativistic, introduces new challenges; in it, there is randomness, even of human or social origin (a computer is switched on/of in the net, by a human). So far, the new randomness which presents itself is manageable and relatively well managed; it is possible to make networks do, in general, what they were programmed to. So, to iterate: network software is globally reliable, portable. . . owing to the remarkable efforts

54

G. Longo

on the part of computer scientists. The fact that the databases remain discrete, with their well-separated topology, is of course at the basis of these successes. Yet, we believe, the blend of many forms of randomness in concurrent computer networks deserves an ad hoc analysisand major clarification: a plan for future work (see below). 3.4

Biological

And if we were to ask a species what will be its fate in the next ecosystem, in one year, in a million years? What “structure of determination” can enable us to speak of this randomness in a rigorous fashion, if randomness there is? And concerning the determination of the phenotype on the basis of the genotype, in ontogenesis? Is it possible to speak about this in the terms of classical physics or should quantum physics be preferred? A common characteristic in the various forms of physical randomness is due to the predetermination of the spaces of possibilities: random results or trajectories are given among already known possibilities (the six sides of a dice, the spinup/spin-down of a quanton. . .). In fact, in quantum physics, even in cases where particles can be “created”, sufficiently broad spaces are provided upstream (the Fock spaces of which Hilbert spaces are “foliations”), spaces which capture all the possible states, infinitely many in general. In biology, however, phase or reference spaces (or spaces of possible evolutions) are far from being predetermined. The possible and proper biological observables, phenotypes and species, are not pre-given or there is no way to give them, in a sound theory and in advance. An issue here is that species (and phenotypes) are co-constituted with their environment. To make an analogy with the reasons for chaos in planetry systems, some sort of “resonance effect” takes place in this co-consitutive process. The difference is that in the physical deterministic case, the resonance happens at one (and conceptually simple) level: the gravitational ineractions between a few planets, fully determined by Newton-Laplace equations. In evolution (but also in ontogenesis), the resonance takes place between different levels of organization, each deserving an analysis on terms of an appropiate structure of detemination. That is, between species, individuals, physical landscapes, but also organs and tissues and, very importantly, by two ways interactions between these levels and molecular activities, starting with DNA expression. Moreover, molecular events belong to microphysics, thus possibly subject to quantum analysis, thus, quantum probabilities. By this, one would need a theory encompassing both classical randomness, which may better fit the description of macroscopic interactions, and quantum randomness, as they may be retroacting one on top of the other. We are far form having such a theory, even in physics (we will mention a recent merging, but. . . at infinite time). While waiting for some sort of “unified” determination and probabilities, in biology and for this epistemic analysis (there is no ontology in the above: we are all made just of molecules), it would be good to have a sort of biological indetermination, comparable to the quantum indetermination of the conjugate dimensions of position/momentum. That is, to analyse the (in-)determination

Randomness and Determination, from Physics and Computing

55

at the level of the passage from one reference space (ecosystem), at a particular moment, to that of the “next” moment. And this passage would “contain” or express the biological (phylogenetic, ontogenetic) trajectories, which are just possibilities in a forthcoming, co-constituted ecosystem. For instance, when, over the course of evolution, a “latent potential” ([22]) manifests in the appearance of a new organ, an highly unpredictable phenomenon, it is the phenotypes and the interaction between individuals which change (the biological observables), and so the whole relevant space of analysis changes. Is this unpredictability to be analysed within a frame of chaotic determination or is it proper indetermination, like quantum randomness? A combination of the two? Once more, like in quantum physics, there is no ontological commitment here: the reader and the bacteria around/in him/her are all made of molecules and quanta. Yet, the question is: which theory is a good one for dealing with these strange bags of molecules we are? Darwin proposed a very relevant theory of species and organisms, totally disregarding molecules, but looking at the proper observables. Then, one day, perhaps, we will have a unification: we will be able to grasp at once molecule and species. So far, the so called “synthetic theory”, which pretends to understand evolution in molecular terms, has been shown to be incomplete: no way to understand the phylogenetic drift in terms of random mutations only, [22], [23]. In short, this is (also) because massive retroactive effects, from the ecosystem to the phenotype down to the genotype intervene even at the molecular level (e.g. mutations under stress) or make the expression even of identical DNA radically differ. A global analysis of some aspects of the phylogentic drift (its complexification as symmetry breaking) may be found in [8], by an analysis of “anti-entropy” as biologically organized lowering of disorder. I insist on the issue of randomness in biology, as it is amazing to observe that leading biologists, still now and along the lines of Crick and Monod ([32]), contrappose determination and randomness according to Laplace’s split: determined means predictable (in general, as Laplace knew that isolated critical points exist, where “des nuances insensibles” may lead to unpredictable trajectories), and radomness is its opposit (non-determination), to be analyzed by statistics and probabilities (to which Laplace greatly contributed). Along these laplacian lines, determinism, as it is predictable, yields “programmable”, which leads to the the idea that the “DNA is a program” (see [18] for an history, [30] for a critique from the point of view of physics and Theory of Programming). Yet, since Poincaré (1890), we know that classical randomness is deterministic unpredictability and that unpredictability pops out almost everywhere in non-linear systems. In conclusion, determination as necessity in life phenomena, understood in a laplacian way, is far removed from the frameworks of modern determination in physics, classical or quantum, even if it is supplemented by a few speckles of randomness. Crick’s “central dogma2 ” and the “one gene – one enzyme” hypothesis in Molecular Biology are good example of this. They guided research for decades and, the first, is still now believed by many, modulo the addition of a few 2

“Genetic Information” goes one-way, from DNA to RNA to proteins (and to the phenotype).

56

G. Longo

“epigenetic factors” and “norms of reaction” (for an alternative view, see [9]; more discussions and references are in [30]). By their linear causality, these asumptions are the opposite of the views on the interplay of interactions in XXth century physics. In these modern physical frames, causes become interactions and these interactions themselves dynamicaly constitute the fabric of the universe and of their manifestations; reshaping this fabric modifies the interactions, intervening upon the interactions appears to reshape the fabric, [6]. 3.5

More on Randomness in Computing

Physics has been able to propose two different notions of randomness in finite time: classical deterministic unpredictability and quantum randomness. As we shall mention, they merge in infinite time. Biology badly needs its own notion, while in search, of course, for unification with physical (molecular?) structures of determination. Computing generated its own very robust notion for infinite sequence, MartinLöf randomness, our next topic, yet it has no internal notion of randomness at finite time. Following Kolmogorof, Chaitin, Levin, Calude and many others deeply analysed sequence incompressiblity and showed that for infinite sequences, under suitable conditions, the incompressibility of initial segments yields Martin-Löf randomness. But, unless the physical generating process is spelled out, a finite sequence whose length coincides with its shortest generating program, is not random, it is just algorithmically incompressible. In other words, it is pseudorandom in the strongest wayand it is impossible to see in it any regularity what so ever. Yet, if one stays within theory of computation and no physical process is mentioned, there is no other way to give/conceive it but by a program, a formal/linguistic matter, as long as we stay in the finite. Some may see this as a terminological nuance, yet too much confusion in computing deserves clarification. Consider, say, a so called “non-deterministic” Turing Machine. This is just a formal, deterministic device, associating a set of numbers to a number. Its evolution is determined by an ill-typed input-output function. Indeed, it is a useful device as it allows to speed up computations by a form of basic parallelism. Yet, as long a physical process, chosing, at each step, one or a few of the elements in the output set, is not proposed, one cannot discuss about “determination” nor “randomness”: is it classical? quantum? Similarly for a finite sequence. Of course, a physical random sequence is incompressible, in principle, but the converse is false or ill defined. Similarly, the very difficult issue of non-determinism in concurrency deserves a closer attention and comparison with physics. As we said, classical (and relativistic) frames are deterministic, from our chaotic planetary system to coin tossing. Often, non determinism in networks is a “do not care” non determinism: the process works anyway, disregarding the specific underlying computational/determination structure (software and hardware). Other notions are known, and all handle the very difficult situation where, somewhat like in biology, various notions of randomness interact in a network (classical randomness, ‘humans’ whim switching on a computer, as we observed, a quantum experiment

Randomness and Determination, from Physics and Computing

57

guiding a computer action in a physics laboratory...). A large area of research deals with these processes by statistical tools, independently of the different causal structures. This is possible as the issue may be considered epistemic: like in classical systems, dice throwing and planetary systems may be analyzed also in purely statistical terms and by probabilities measures, independently of a fine analysis of determination. Yet, the question remains whether a closer analysis of randomness in concurrency may lead to a better understanding, in particular in relation with the rich structures of determination in physics. 3.6

Towards Infinity: Merging with Physics

Dynamical unpredictability is a finite time issue: the mathematical determination of an intended physical process, by a set of equations or by an evolution function, does not allow to predict the process beyond a certain finite amount of time. Today, we can compute the upper bound of predictability for the solar system and a lot more. Of course, as for dice or coins, the beginning of randomness, as unpredictability, is... immediate. Note that this forces to relate pure mathematics (the formal determination) and physical processes by the only form of access we have to them: physical measure. It is approximated measure, a physical (classical) principle, jointly to the (non-linear typically) structure of mathematical determination that produce unpredictability: by looking at the equations, say, one understands that, and sometimes even compute (by using Lyapounov exponents for example) when fluctuations below measure give diverging evolutions. However, we can stay within the purely mathematical realm and give a notion of randomness just by looking at the mathematical determination. The price to pay is the passage to (actual) infinity: these internal notions of randomness are necessarely asymptotic. Many forms of deterministic chaos allow different abstractions of this kind. A weak one, “mixing systems”, is sufficient to define Birkhoff ergodicity. In short, a trajectory (or, even a point generating it) is Birkhoff random when, w.r. to any observable (a continuous function taking values on the points of the trajectory), the temporal mean coincide with the spatial one. More formally: given a dynamical system (D, T, μ), a point x is (Birkhoff) random (or typical, in the ergodic sense) if, for any observable f ,  1 n lim (f (x) + f (T (x)) + . . . + f (T (x))) = f dμ n n That is, the average value of the observable f along the trajectory {x, T (x), T 2 (x), . . . T n (x), . . .} (its time average) is asymptotically equal to the space average of f (i.e. f dμ). As already announced, also computability theory may generate randomness. Algorithmic randomness (Martin-Löf, ’65, Chaitin and Schnorr) for infinite sequences was originally defined in Cantor Space D =: 2 given μ, a measure on D, an effective statistical test is an (effective) sequence {Un }n , with μ(Un ) ≤ 2n . That is, a statistical test is an infinite decreasing sequence of effective open sets in Cantor’s space (thus, it is given in recursion theory). By this, one can define x

58

G. Longo

to be ML-random if, for any statistical test {Un }n , x is not in ∩n Un (x passes all tests). In short, algorithmically random means not being contained in any effective intersection or to stay “eventually outside” any effective statistical test (to pass all tests). Now, by non obvious work, M. Hoyrup and C. Rojas, in their thesis under this author’s and S. Galatolo’s supervision, have reconstructed a fully general frame for computable dynamics. That is, they have given an effective structure to physically interesting dynamical systmes where Birkhoff ergodicity applies. By this, they could generalize Martin-Löf randomness to these spaces (under the weaker form of Schnorr’s randomness) and show that it coincides with ergodicity (Birkhoff randomness). Next building, in the same institution, T. Paul recently proved that the peculiar role of “infinite time” is somehow strenghtened by the comparison between quantum (intrinsic) indeterminism and classical (chaotic but deterministic) unpredictability [33], [34]. In a very syntethic way, he showed that, at the limit of small values of the Planck constant (semiclassical limit) and related long time behaviour, the two notions merge. If the analogy is not too audacious, these asymptotic unifications have a wellknown predecessor. Boltzmann “unified” thermodynamics and classical physics, asymptotically. In particular, he derived the second principle of thermodynamics, by an analysis of (or “as if there were”) infinitely many particles in a finite volume. That is, the “reduction” is performed at the limit, by the (thermodynamic) integral over infinitely many trajectories. More than a reduction, thus, to classical physics, it is a matter of unification by the invention of a new unifying frame. In short, in order to understand the abstract thermodynamic principles in terms of particles’ trajectories, Boltzmann had to redesign classical trajectories in the novel terms of statistical mechanics, he had to assume molecular chaos and perform a limit transition, an extremely original step, far away from Newton’s system.

4

A Thesis on Randomness and Irreversible Time

The ‘thesis’ I want to hint here (just a thesis so far, to be enriched by proofs or arguments we work at) is that finite time randomness is ‘related’ to irreversible time, in all the main physico-mathematical contexts. That is, one has irreversible time exactly “in presence” of randomness (and viceversa) in all the theoretical frames mentioned below (and above). Of course this thesis, yet to be ‘proved’, is worth per se, as it commits our understanding of randomness, a not so clearly defined notion in full generality, to irreversibility of time. Let’s hint to a few arguments for it. 4.1

Classical

In Euler-Lagrange or Newton-Laplace equations, typically, time is reversible. The same should be said, of course, for Einstein equations. Time appears squared,

Randomness and Determination, from Physics and Computing

59

so its sign has no influence on the evolution of the intended systems. But also a linear field (time is not squared) may be reversed: reverse the sign of the field and the particle goes backwords, in space and time. Reversibility corresponds to the mathematical invertibility of the function describing the trajectory. Poincaré, as recalled above, proved for us that non-linear (field) equations generate chaos, to put in modern terms. Diverging trajectories, whose divergence may be measured in various way (Lyapounov exponents, entropy growth. . .), imply finite time unpredictability of generic trajectories. That is, arbitrarely close points may rapidely diverge or fluctuations below observability, thus not knowable, lead to observably different (unpredictable) evolutions. This is exactly classical randomness, from dice to the solar system, both determinsitic (see above, and) chaotic systems, and many others. Of course, the finite time of unpredictability is very different in the two cases: from fractions of seconds to milions of years. But unpredictability puts an arrow on time: you need a future w.r. to a present to define it. Mathematically, non-linearity implies noninvertibility of functions and, thus, of the related trajectories: this is another way to impose a direction on time. 4.2

Thermodynamics

Thermodynamics is the realm of oriented time: the second principle, for increasing entropy, is the paradigm of time irreversible processes. But, what is entropy growth in general? It is downgrading of energy, by a diffusion process. And each diffusion, in physics, is given by random paths. Again then, irreversibility of time ‘goes toghether’ with randomness. Note that the divergence of trajectories in the non-linear dynamics mentioned above may also be measured in terms of proper notions of entropy growth. 4.3

Quantum

Schrödinger equation is linear, yet it is ‘reversible’, its own way, by the peculiar role of the imaginary ‘i’: the inversion of time, −t, yields a −i whose behaviour, squared, is the same as that of i. Yet, what is computed, the evolution of the state function by Schrödinger equation, is not what is measured. And measure, in quantum mechanics is a highly time irreversible process: no way to reconstruct the proper complex values after their projection over the real numbers (their modules) is given. Observe finally, that measure is a probability value of a random process. Once more, than, randomness pops out exactly when one deals with a time irreversible process. How can algorithmic randomness help in this? As hinted above, the (algorithmic) notion of randomness for finite strings (that is, generated in finite time, in principle) is purely formal: it is just a (very relevant) matter of algorithmic uncompressibility. The sentence, in theories of algorithms, “given a random finite sequence”, has no contextual meaning, as for the analysis of physico-mathematical determination, unless a physical agent producing the sequence is provided: will it be a series of quantum measure? or a series of coin tossing? the result of networks activity? their randomness differ, as we know.

60

G. Longo

Yet, computability theory provides a very robust, infinite time, notion of randomness, which may be unified (asymptotically) to the two forms of physical randomness mentioned above, both given also in finite time. One more indirect fall-out of these digital devices that are changing the world, are a rather extraodinary invention of ours, comparable to and as important as the invention of the alphabet, an early far from neutral discretization of language and knowledge, [25]; in particular, the sequential machines are alpha-numeric discrete state divices of incredible logical and physical stability. And, as for their use in the simulation of all sorts of physical processes, Turing’s insightful distinction between “model” and “imitation” helps to understand their effectiveness and pertinence w.r. to intelligibility of natural processes ([37], [27], [28]). In [29] further elements are given concerning these final remarks, including an analysis of the limits of the (classical) computational language in (quantum) physics. The point is not “super-computing”, that is the search for physical processes which would compute non-Turing-computable functions, but the varying meaning of equational and functional approaches in very different contexts. Quantum computing, typically, requires a truely novel insigth.

References 1. Causality, A.J.: Symmetries and Quantum Mechanics. Foundations of Physics Letters 15(5), 415–438 (2002) 2. Adler, R.L.: Topological entropy and equivalence of dynamical systems. American Mathematical Society (1979) 3. Alligood, K., Sauer, T., Yorke, J.: Chaos: an introduction to Dynamical Systems. Springer, New York (2000) 4. Aceto, L., Longo, G., Victor, B. (eds.): The difference between Sequential and Concurrent Computations, vol. (4-5). Cambridge University Press, Cambridge (2003) 5. Aspect, A., Grangier, P., Roger, G.: Experimental Realization of the EinsteinPodolsky-Rosen-Bohm Gedankenexperiment: A New Violation of Bell’s Inequalities. Phys. Rev. Let. 49, 91 (1982) 6. Bailly, F., Longo, G.: Mathématiques et sciences de la nature. La singularité physique du vivant. Hermann, Paris (English introduction, downloadable; ongoing translation) (2006) 7. Bailly, F., Longo, G.: Randomness and Determination in the interplay between the Continuum and the Discrete. Mathematical Structures in Computer Science 17(2) (2007) 8. Bailly, F., Longo, G.: Biological Organization and Anti-Entropy. Journal of Biological Systems (to appear, 2008) 9. Brett, D., Pospisil, H., Valcárcel, J., Reich, L., Bork, P.: Alternative splicing and genome complexity. Nature Genetics 30 (2001) 10. Calude, C.: Information and Randomness: An Algorithmic Perspective. Springer, New York (1994) 11. Calude, C., Stay, M.: From Heisemberg to Gödel via Chaitin. International J. Theor. Phys 44(7) (2005) 12. Connes, A.: A. Non-commutative Geometry. Academic Press, London (1994) 13. Cornfeld, I., Fomin, S., Sinai, Y.G.: Ergodic Theory. Springer, New York (1982)

Randomness and Determination, from Physics and Computing

61

14. Dahan Delmedico, A., Chabert, J.-L., Chemla, K.: Chaos et déterminisme, Seuil (1992) 15. Devaney, R.L.: An introduction to Chaotic Dynamical Systems. Addison-Wesley, Reading (1989) 16. Feynman, R.: Lectures in Physics. Addison-Wesley, Reading (1966) 17. van Frassen, B.: Lois et symetries, Vrin, Paris (1994) 18. Fox Keller, E.: The Century of the Gene, Gallimard (2000) 19. Galatolo, S., Hoyrup, M., Rojas, C.: Effective symbolic dynamics, random points, statistical behavior, complexity and entropy (submitted, 2008) 20. Galatolo, S., Hoyrup, M., Rojas, C.: A Constructive Borel-Cantelli lemma. Constructing orbits with required statistical properties (submitted, 2008) 21. Gandy, R.: Church’s Thesis and the principles for Mechanisms. In: Barwise, et al. (eds.) The Kleene Symposium. North Holland, Amsterdam (1980) 22. Gould, S.J.: Wonderful Life, WW. Norton (1989) 23. Lecointre, G., Le Guyader, H.: Classification phylogénétique du vivant, Paris, Belin (2001) 24. Lighthill, J.: The recent recognized failure of predictability in Newtonian dynamics. Proc. R. Soc. Lond. A 407, 35–50 (1986) 25. Herrenschmidt, C.: Les trois écritures, Gallimard (2007) 26. Laskar, J.: Large scale chaos in the Solar System. Astron. Astrophysics 287, L9–L12 (1994) 27. Longo, G.: Laplace, Turing and the ‘imitation game’ impossible geometry: randomness, determinism and programs in Turing’s test. In: Epstein, R., Roberts, G., Beber, G. (eds.) The Turing Test Sourcebook. Kluwer, Dordrecht (2007) 28. Longo, G.: Critique of Computational Reason in the Natural Sciences. In: Gelenbe, E., Kahane, J.-P. (eds.) Fundamental Concepts in Computer Science. Imperial College Press/World Scientific (2008) 29. Longo, G., Paul, T.: The Mathematics of Computing between Logic and Physics. In: Cooper, Sorbi (eds.) Computability in Context: Computation and Logic in the Real World. Imperial College Press/World Scientific (2008) 30. Longo, G., Tendero, P.-E.: The differential method and the causal incompleteness of Programming Theory in Molecular Biology. Foundations of Science (12), 337– 366 (2007); preliminary version in French in Evolution des concepts fondateurs de la biologie du XXIe siècle, DeBoeck, Paris (2007) 31. Martin-Loef, P.: The definition of random sequences. Information and Control 9, 602–619 (1966) 32. Monod, J.: Le Hasard et la Nécessité, PUF (1973) 33. Paul, T.: Échelles de temps pour l’évolution quantique à petite constante de Planck. Séminaire X-EDP, École Polytechnique, Palaiseau (2008) 34. Paul, T.: Semiclassical analysis and sensitivity to initial conditions. Information and Computation (to appear, 2008a) 35. Pour-El, M.B., Richards, J.I.: Computability in analysis and physics. Perspectives in mathematical logic. Springer, Berlin (1989) 36. Rojas, C.: Computability and Information in models of Randomness and Chaos. Math. Struct. in Computer Science 18, 291–307 (2008) 37. Turing, A.M.: Computing Machines and Intelligence. Mind LIX(236), 433–460 (1950) 38. Turing, A.M.: The Chemical Basis of Morphogenesis. Philo. Trans. Royal Soc. B237, 37–72 (1952) 39. V’yugin, V.V.: Ergodic Theorems for Individual Random Sequences. Theoretical Computer Science 207, 343–361 (1998)

When Analysis Fails: Heuristic Mechanism Design via Self-correcting Procedures David C. Parkes School of Engineering and Applied Sciences Harvard University [email protected]

Abstract. Computational mechanism design (CMD) seeks to understand how to design game forms that induce desirable outcomes in multiagent systems despite private information, self-interest and limited computational resources. CMD finds application in many settings, in the public sector for wireless spectrum and airport landing rights, to Internet advertising, to expressive sourcing in the supply chain, to allocating computational resources. In meeting the demands for CMD in these rich domains, we often need to bridge from the theory of economic mechanism design to the practice of deployable, computational mechanisms. A compelling example of this need arises in dynamic combinatorial environments, where classic analytic approaches fail and heuristic, computational approaches are required. In this talk I outline the direction of self-correcting mechanisms, which dynamically modify decisions via “output ironing” to ensure truthfulness and provide a fully computational approach to mechanism design. For an application, I suggest heuristic mechanisms for dynamic auctions in which bids arrive over time and supply may also be uncertain.

1

Introduction

Mechanism design theory from microeconomics holds appeal within computer science as providing a principled method to develop optimized mechanisms for resource and task allocation problems of all kinds, ranging from problems in electronic commerce such as sponsored search to problems in networked systems such as allocation of wireless bandwidth and compute time on shared computational grids.1 The essential problem addressed in mechanism design theory is that of implementation: given a set of N = {1, . . . , n} agents each with private information vi : X → R on their value for outcomes X, with vi ∈ V , design a game form 

1

This abstract is for an invited talk given at the 35th International Conference on Current trends in theory and practice of computer science (SOFSEM’09), January 24-30, 2009, Czech Republic. See Jackson [1], Nisan [2] and Parkes [3, chapter2] for introductory surveys.

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 62–66, 2009. c Springer-Verlag Berlin Heidelberg 2009 

When Analysis Fails: Heuristic Mechanism Design

63

in which agents send messages that represent reports about their valuations, so that the outcome selected in the equilibrium of the game satisfies some desired social choice function f : V n → X. For example, perhaps the goal is to allocate a resource to the agent with the highest value, in which case a second-price sealedbid [4] auction will implement the outcome in a dominant-strategy equilibrium. See Varian [5] for a simple exposition of this result and its generalization to the celebrated Vickrey-Clarke-Groves [4,6,7] mechanism. It is often useful in mechanism design to focus on direct-revelation mechanisms, simultaneous-move games in which each agent sends a message that corresponds to a report about its valuation. A direct-revelation mechanism is defined by a pair (g, t) of an outcome rule g : V n → X and payment rule t : V n → Rn , where ti (v) for v ∈ V n is the payment by agent i to the mechanism. The standard analytical approach is to impose constraints on (g, t) and find the mechanism that best-satisfies a set of desiderata (e.g., efficiency, revenue optimality, fairness, budget balance, and so forth) across the space of incentivecompatible (= non-manipulable) mechanisms. This is best illustrated by Myerson’s derivation of the revenue-optimal mechanism for selling a resource when the seller has a distribution function Fi to characterize the valuation of each buyer i ∈ N . Myerson was able to show an equivalence between the problem of finding the optimal incentive-compatible mechanism and the comparatively simple problem of maximizing expected “virtual surplus” subject to monotonicity constraints,2 and further reduce this to the problem of maximizing “ironed” virtual surplus. Ironing, for Myerson, is a process by which the virtual valuation functions are transformed into (weakly) non-decreasing functions of reported value by to “iron out” any such failure of monotonicity of virtual valuation as a function of valuation. But in many problems of practical interest, the rules of a mechanism must be specified by a computational procedure rather than an analytic formula because no tractable procedure exists to implement the “ideal” mechanism, and these problems present a need to address two kinds of bottlenecks: – The scalability bottleneck: mechanism rules must be realized by computationally tractable procedures. – The analytic bottleneck: analytic methods to derive useful mechanisms fail in discrete, multidimensional and combinatorial problems. Indeed, it is notable that very little progress has been made on extending Myerson’s analysis of revenue optimizing auctions to selling more than two goods. Computational mechanism design seeks to combine economic and computational thinking, and has made good progress on addressing the scalability bottleneck. Early progress came by working with existing mechanisms, while making 2

The virtual valuation of agent i given value vi is φi (vi ) = vi − [1 − Fi (vi )]/Fi (vi ), the virtual surplus of an allocation is the virtual valuation of the winner if the resource is allocated or the value of the seller for the resource otherwise, and monotonicity requires that the probability that an agent is allocated is (weakly) non-decreasing in its reported value, for all values of other agents.

64

D.C. Parkes

significant advances through concise and expressive bidding languages, methods for efficient preference elicitation, and with fast algorithms for determining the outcome of a mechanism given reports. Much of this progress was made in the important domain of combinatorial auctions, i.e. auctions in which agents have non-linear valuations on bundles of items [8]. A second wave of progress involved reconciling tensions between computational and economic constraints, and developing novel mechanisms, for instance through “prior-free” mechanisms [9], approximate mechanisms [10,11] and often working in problem domains that are particular to computer science such as those of network routing and job scheduling. But progress here was limited to addressing the scalability bottleneck and not the analytic bottleneck, in that where new mechanisms were derived the incentive-compatibility analysis was still performed by hand through mathematical analysis and this has limited progress. A new, third wave of progress in computational mechanism design must seek to address both the scalability and the analytic bottlenecks by leveraging computational methods also for the design of mechanisms. This includes automated mechanism design [12] and parameterized mechanism design [13]. But I do not find these approaches entirely satisfactory, and argue in this talk the following point, that a problem of computational mechanism design can be considered solved when we can take a state-of-the-art computational procedure for solving a centralized, cooperative problem and apply “with small modification” to solve the mechanism design problem. Clearly a lot is buried in the meaning of “with small modification,” but I will offer an illustrative example in the form of self-correcting mechanisms for dynamic auctions [14,15]. One of the underlying observations that drives work on self-correcting mechanisms is that rather than have a complete description of the rules of a mechanism, it is sufficient that mechanism properties be guaranteed only to the extent necessary to ensure equilibrium properties, so that selfinterested participants know how to best represent their own interests. Given this observation, the basic idea in self-correcting mechanisms is to achieve these sufficient properties through a computational procedure that acts as a “wrapper” to augment an underlying (possibly heuristic) computational method. A good example of a problem that exhibits both the scalability and analytic bottlenecks is that of dynamic multi-item auctions where bids arrive over time for multiple units of a resource, that may itself be in uncertain supply. Given a probabilistic model of bid dynamics, the underlying decision problem is one for which compelling computational methodologies exist but for which there are no closedform solutions. Moreover, a complete characterization of truthful mechanisms is available that requires that the mechanism policy is monotonic, in the sense that if an agent is allocated for some bid then it is allocated for all “higher” bids (= larger value, smaller quantity, more relaxed time constraints) [16]. In the absence of a computational methodology for mechanism design, mechanisms are

When Analysis Fails: Heuristic Mechanism Design

65

available for this problem only in the case of simple probabilistic environments for which the underlying decision problem has an analytic solution [17,18,19,20,21,22]. In illustrating the idea of self-correcting mechanisms I will show how the computational procedure of online stochastic combinatorial optimization [23] can be combined with a procedure to automatically perform sensitivity analysis of the decision policy “on the fly,” in order to modify allocation decisions as necessary to ensure monotonicity properties and thus truthfulness. The result is a scalable, dynamic auction for buyers with multi-unit demand that is demonstrated for both expiring goods (e.g. time on a compute server) non-expiring goods with a deadline (e.g. theater tickets). The sensitivity analysis procedure is a form of “ironing” in the sense of Myerson, except that it irons away failure of monotonicity in the outcome of the mechanism rather than in the inputs to a mechanism, but to the same end of providing a truthful equilibrium. Thus I think of this as output ironing, whereas Myerson’s procedure is one of input ironing. In summary, the main message of this talk is that there exists a need to couple characterizations of truthful (or “incentive-compatible”) mechanisms with a fully computational methodology in which state-of-the-art computational procedures for decision making and optimization are modified in order to achieve these properties and without needing to resort to analytic methods to design mechanisms. I refer to these mechanisms as “self-correcting” mechanisms and offer applications to dynamic auctions to illustrate the approach.

Acknowledgments Much of the content of this talk comes from collaborations with Ruggiero Cavallo, Satinder Singh and especially Florin Constantin and Quang Duong. This work is also supported in part by a Microsoft Fellowship and a Yahoo! Fellowship.

References 1. Jackson, M.O.: Mechanism theory. In: Derigs, U. (ed.) The Encyclopedia of Life Support Systems, EOLSS Publishers (2003) 2. Nisan, N.: Introduction to mechanism design (for computer scientists). In: Nisan, N., Roughgarden, T., Tardos, E., Vazirani, V. (eds.) Algorithmic Game Theory, Cambridge University Press, Cambridge (2007) 3. Parkes, D.C.: Iterative Combinatorial Auctions: Achieving Economic and Computational Efficiency. PhD thesis, Department of Computer and Information Science, University of Pennsylvania (May 2001) 4. Vickrey, W.: Counterspeculation, auctions, and competitive sealed tenders. Journal of Finance 16, 8–37 (1961) 5. Varian, H., MacKie-Mason, J.K.: Generalized Vickrey auctions. Technical report, University of Michigan (1995) 6. Clarke, E.H.: Multipart pricing of public goods. Public Choice 11, 17–33 (1971) 7. Groves, T.: Incentives in teams. Econometrica 41, 617–631 (1973) 8. Cramton, P., Shoham, Y., Steinberg, R. (eds.): Combinatorial Auctions. MIT Press, Cambridge (2006)

66

D.C. Parkes

9. Goldberg, A., Hartline, J., Karlin, A., Saks, M., Wright, A.: Competitive auctions. Games and Economic Behavior 55, 242–269 (2006) 10. Nisan, N., Ronen, A.: Algorithmic mechanism design. Games and Economic Behavior 35, 166–196 (2001) 11. Lehmann, D., O’Callaghan, L.I., Shoham, Y.: Truth revelation in approximately efficient combinatorial auctions. Journal of the ACM 49(5), 577–602 (2002) 12. Conitzer, V., Sandholm, T.: Applications of automated mechanism design. In: Proc. UAI Bayesian Modeling Applications Workshop, Acapulco, Mexico (2003) 13. Likhodedov, A., Sandholm, T.: Approximating revenue-maximizing combinatorial auctions. In: Proc. of the National Conference on Artificial Intelligence (AAAI) (2005) 14. Parkes, D.C., Duong, Q.: An ironing-based approach to adaptive online mechanism design in single-valued domains. In: Proc. 22nd National Conference on Artificial Intelligence (AAAI 2007) (2007) 15. Constantin, F., Parkes, D.C.: Self-correcting sampling-based dynamic multi-unit auctions. Technical report, Harvard University (2008) 16. Hajiaghayi, M.T., Kleinberg, R., Mahdian, M., Parkes, D.C.: Online auctions with re-usable goods. In: Proc. ACM Conf. on Electronic Commerce, pp. 165–174 (2005) 17. Hajiaghayi, M.T., Kleinberg, R., Parkes, D.C.: Adaptive limited-supply online auctions. In: Proc. ACM Conf. on Electronic Commerce, pp. 71–80 (2004) 18. Pai, M., Vohra, R.: Optimal dynamic auctions. Technical report, Kellogg School of Management (2008) 19. Lavi, R., Nisan, N.: Competitive analysis of incentive compatible on-line auctions. In: Proc. 2nd ACM Conf. on Electronic Commerce (EC 2000), pp. 233–241 (2000) 20. Gallien, J.: Dynamic mechanism design for online commerce. Operations Research (2006) 21. Gershkov, A., Moldovanu, B.: Dynamic revenue maximization with heterogeneous objects: A mechanism design approach. Technical report, University of Bonn (2008) 22. Pavan, A., Segal, I., Toikka, J.: Dynamic mechanism design: Revenue equivalence, profit maximization, and information disclosure. Technical report, Stanford University (2008) 23. Hentenryck, P.V., Bent, R.: Online Stochastic Combinatorial Optimization. MIT Press, Cambridge (2006)

On Compositionality, Efficiency, and Applicability of Abstraction in Probabilistic Systems Suzana Andova and Sonja Georgievska Department of Mathematics and Computer Science, Eindhoven University of Technology, P.O. Box 513, 5600 MB Eindhoven, The Netherlands {s.andova,s.georgievska}@tue.nl

Abstract. A branching bisimulation for probabilistic systems that is preserved under parallel composition has been defined recently for the alternating model. We show that besides being compositional, it is decidable in polynomial time and it preserves the properties expressible in probabilistic Computation Tree Logic (pCTL). In the ground-complete axiomatization, only a single axiom is added to the axioms for strong bisimulation. We show that the Concurrent Alternating Bit protocol can be verified using the process algebra and a set of recursive rules.

1

Introduction

Branching bisimulation is often used to reduce a model of a system to a smaller one, in which details, unimportant to the purposes at hand, can be abstracted away. For the compositionality of the analysis, it is particularly useful to be able to reduce the system components before they interact. The whole state space is then generated from the reduced components. Depending on the properties branching bisimulation preserves, the original model can be analyzed by looking at the smaller one. Thus, ideally, the bisimulation should preserve all properties of interest. Moreover, for this method to be useful in practice, it is crucial that the bisimulation reduction is performed efficiently. In the non-probabilistic setting branching bisimulation [16], has all these, and a number of other advantageous properties over other equivalences. The introduction of abstraction, and definition of branching bisimulation, into a framework that features probabilities, non-determinism and parallel composition, remains challenging. In the alternating model for probabilistic systems [18] that we use here, equivalences that abstract away from internal behavior have been defined in [21], [5], and [25]. The first two turn out not to be preserved by parallel composition, cf. [2]. It is shown that the branching bisimulation defined in [25] is the coarsest congruence for parallel composition included in the equivalence relation of [5]. In this paper we investigate whether the branching bisimulation of [25] fulfills the other feasibility criteria. We give an algorithm for deciding branching bisimilarity in polynomial time. We present a probabilistic extension of CTL logic, M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 67–78, 2009. c Springer-Verlag Berlin Heidelberg 2009 

68

S. Andova and S. Georgievska

without the next operator, and show that branching bisimulation preserves all properties expressible in this logic. In addition, we give an algebraic characterization of branching bisimulation, which puts it in another, model-independent, perspective. The set of algebraic laws, that ground-completely axiomatizes the relation, together with a set of recursive verification rules permit equivalence of two processes to be established by means of simple syntactic manipulation. We investigate the verification power of the new process algebra by verifying compositionally the Concurrent Alternating Bit Protocol (CABP). As channels are lossy, sending a continuous stream of data through the channels is a method to overcome the possible loss of data. This continuous sending of messages gives rise to a considerable level of parallelism, which, we believe, makes the verification of CABP an interesting example. We show that, after abstraction of internal activities, CABP behaves as a buffer. The paper is organized as follows. Sec. 2 gives a brief overview of branching bisimulation of [25]. In Sec. 3 we present the algorithm, and in Sec. 4 we treat pCTL and the preservation of the logical properties. In Sec. 5 we introduce the process algebra pACPτ , give the complete axiomatization and a set of sound verification rules. In Sec. 6 we employ our process algebra in the verification of the CABP. Sec. 7 ends with conclusions and related work. For an extended version of the paper with more details see [4].

2

Preliminaries: Model and Branching Bisimulation

We use probabilistic transition systems (PTS) to model systems that exhibit probabilistic as well as non-deterministic behavior. PTSs follow the strictly alternating regime of the alternating model of Hansson [18]. They consist of two types of states: probabilistic states with outgoing probabilistic transitions, that model the probabilistic behavior of a system, and non-deterministic states with outgoing action transitions. The latter are labeled with actions from a set of action labels, representing atomic activities of a system, or with the unobservable event, which is denoted τ . We postulate special states nil, denoting successful termination, and d, denoting the (deadlock) state without outgoing transitions. Let A be a set of actions including τ . Definition 1. A PTS is a tuple (Sn , Sp , r, →, ), where Sn and Sp are disjoint sets of nondeterministic and probabilistic states, resp., r ∈ Sp is the initial node, also called root, → ⊆ Sn × A × (Sp ∪ {nil}) is an action transition relation, and  ⊆Sp × (0, 1] × Sn is a probabilistic transition relation such that, for all s ∈ Sp , (s,π,t)∈ π = 1 and for all t ∈ Sn , if (s, π1 , t) ∈  and (s, π2 , t) ∈  then π1 = π2 . We require that all nodes are reachable from the root. π

a

→ t rather than (s, a, t) ∈ →, and s  t (or s  t if the value of We write s − τ π is irrelevant in the context) rather than (s, π, t) ∈ . s  t denotes s − →t (a)

a

or s  t; s −−→ t denotes s − → t, or s = t and a = τ . By S we usually denote Sn ∪ Sp ∪ {nil} ∪ {d}. The root of a PTS x is denoted r(x). For a given PTS x = (Sn , Sp , r, →, ), the function P : S × S → [0, 1] which extends to a probability measure over all states is defined in the following way:

On Compositionality, Efficiency, and Applicability of Abstraction

69

⎧ π ⎨π, if s  t P (s, t) = 1, if s = t and s ∈ Sn ∪ {nil, d} ⎩0, otherwise.  For a set D ⊆ S, P (s, D) denotes t∈D P (s, t). Given an equivalence relation R ⊆ S × S and a state s ∈ S, S/R denotes the partitioning of S induced by R, and [s]R denotes the R−equivalence class of s. Definition 2 (Branching bisimulation and rooted version). Let x and y be PTSs, and let S all states of x and y. An equivalence relation R ⊆ S × S is a branching bisimulation iff for every (s, t) ∈ R the following hold: a

1. if s − → s for some a ∈ A and s ∈ S, then there exist t0 , . . . , tn , t ∈ S such (a)

that t0 = t, t0  t1  . . .  tn −−→ t , (s, ti ) ∈ R for all 0 ≤ i ≤ n, and (s , t ) ∈ R; 2. for all D ∈ S/R , P (s, D) = P (t, D); 3. [nil]R = {nil}. The PTSs x and y are branching bisimilar, x ∼ b y, if (r(x), r(y)) ∈ R for some branching bisimulation relation R. PTSs x and y are rooted branching bisimilar, x ∼ rb y, iff there exists a branching bisimulation R with (r(x), r(y)) ∈ R, such that, if r(x)  x and a → x for some x , x ∈ S and a ∈ A, then there exist y  , y  ∈ S such that x − a r(y)  y  , y  − → y  , (x , y  ) ∈ R, and (x , y  ) ∈ R; vice versa for y. Relation R is called rooted branching bisimulation for PTSs x and y. The condition 1. requires that, as usual, when an action transition is simulated, it may be preceded by a sequence of unobservable transitions that connect equivalent states. Condition 2. requires that all related states must have the same total probability to reach an equivalence class in one P -step, including its own equivalence class. It is easy to conclude that for a probabilistic state to be related to a non-deterministic one, it must reach its own class with probability 1 (the effect is that a τ -step that is immediately followed by a non-trivial probability distribution cannot be removed). This property turns out to be essential for preserving congruence of the branching bisimulation for parallel composition [25]. Condition 3. is necessary to distinguish successful (nil) from unsuccessful (d) termination, and also to guarantee compositionality for the sequential composition. ∼ b and ∼ rb are equivalence relations [25].

3

Deciding Branching Bisimilarity

In this section we define an algorithm that decides ∼ b in polynomial time. It is rather natural to base our algorithm on the one for the non-probabilistic branching bisimulation, , defined in [17], as the first condition of Def. 2 coincides with the definition of , if PTSs are turned into ordinary labeled transition systems τ by replacing probabilistic transitions  with silent − → transitions. For a given partition Π on a labeled transition system with a set of states S, the algorithm

70

S. Andova and S. Georgievska

of [17], GV-standard-bb, refines Π to the maximal branching bisimulation equivalence contained in Π. However, due to the second condition of Def. 2, we have to refine output partitions of GV-standard-bb, by means of a P-splitter. Definition 3. Let Π be a partition of S and B, B  ∈ Π. B  is P-splitter of B if there are s, t ∈ B for which P (s, B  ) = P (t, B  ). Ref ineΠ (B, B  ) = {B1 , . . . , Bk }, k ≥ 2 is a partition of B such that B  is not a P-splitter of Bi for all i, 1 ≤ i ≤ k. Ref ine(Π, B, B ) = Π \ {B} ∪ Ref ineΠ (B, B  ). The algorithm is given below. P robBB(x = (S, r(x), − →, ), Π) Π := {S}; Πf := ∅; while Π = Πf do Πf := GV-standard-bb(Π, x); if exists (B, B  ) := FindP-Split(Πf ) then Π := Refine(Πf , B, B  ) od return Π Lemma 1. For an input PTS x with a set of states S, the ProbBB algorithm outputs S/∼ b . The “while loop” can be executed at most |S| − 1 times. GV-standard-bb is polynomial on the number of states and the number of transitions of x [17]. The procedure FindP-Split, which finds a pair (B, B  ) with B  being a P-splitter of B, is polynomial, as it boils down to comparing elements (rows) in the matrix representation of P. Thus, Proposition 1. ∼ b is decidable in polynomial time.

4

Branching Bisimulation and pCTL

In this section we present the logic that we use to express properties of probabilistic systems. The logic we consider is a variant of the pCTL logic of [11] and a simplification of the logic of [9]. However, we need to add semantics in the setting with τ steps. We follow the approach in [13], where it is shown that CTL is in full agreement with the non-probabilistic branching bisimulation of [16], by extending transition systems to doubly-labeled Kripke structures. In the latter, relations defined on transition systems and on Kripke structures can be easily compared. We also interpret the logic over a similar straightforward extension in the probabilistic setting. Definition 4 (PTS to Extended PTS). Let x = (Sn , Sp , r, →, ) be a PTS. EPTS(x) is defined as (Sn , Sp , r, − → , , L), where a

– Sn = Sn ∪ {(s, a, t) | a ∈ A \ {τ } and s − → t}; τ a a – − → = {(s, τ, s) | s − → s} ∪ {(s, a, (s, a, t)) | s − → t} ∪ {((s, a, t), a, t) | s − → t}; – L: S → A ∪ {⊥} such that L(s) =⊥ and L((s, a, t)) = a for any s ∈ Sn and for any (s, a, t) ∈ Sn , where ⊥ is a new constant, ⊥ ∈ A.

On Compositionality, Efficiency, and Applicability of Abstraction

71

Intuitively, in EPTS(x) all states of PTS x are labeled with ⊥ and all transitions a a a s− → t where a = τ are ”split” into two transitions s − → (s, a, t) and (s, a, t) − → t. The added states (s, a, t) are labeled with a. On the other hand, an EPTS can be seen as a PTS if the labeling function L is ignored. In such a way, Def. 2 defines straightforwardly a branching bisimulation equivalence on EPTS. Proposition 2. Two states in a PTS x are branching bisimilar if and only if they are branching bisimilar in EPTS(x). To interpret the logic we need the standard notions of schedulers and paths on EPTSs. A scheduler resolves the non-deterministic choice by selecting one of possibly many action transitions, each time the execution reaches a nondeterministic node. This yields a fully probabilistic system, also called computation tree, which has the structure of probability space on paths associated to it. For a detailed description and definitions we refer to [5, 25]. The syntax of pCTL is generated by the following grammar: ψ := ⊥ | a | ¬ψ | ψ ∧ ψ  | ∃Pp (ψU ψ  ) where  ∈ {<, >, ≤, ≥}, p ∈ [0, 1], a ∈ A \ {τ }. Note that we neither include the usual CTL quantifiers A and E that range over paths like in [11], nor the next operator like in [9], since we consider branching bisimulation. Definition 5 (pCTL Semantics). For a given EPTS (Sn , Sp , r, − → , , L), satisfaction of a formula ψ in a state s, s  ψ, is defined inductively: s  ⊥ iff L(s) = ⊥; s  a iff L(s) = a; s  ¬ψ iff s  ψ; s  ψ ∧ ψ  iff s  ψ and s  ψ  ; s  ∃Pp (ψU ψ  ) iff there exists a scheduler σ such that the probability measure of the set of all paths in the computation tree induced by σ that start in s and satisfy formula ψU ψ  is  p, where a path ρ = s0 l1 s1 . . . satisfies formula ψU ψ  , ρ  ψU ψ  , iff there exists n ≥ 0 such that sn  ψ  and, for all i < n, si  ψ. Theorem 1. Branching bisimilar states in an EPTS satisfy the same pCTL formulas.

5

Probabilistic Process Algebra pACPτ

In this section we define a probabilistic process algebra pACPτ and give a ground-complete axiomatization for ∼ rb . In addition, we review the recursive verification rules of [3] in the new setting. pACPτ is an Extension of the Process Algebra ACP with operators that can specify probabilistic behavior and abstraction. The parallel composition operator is inherited from ACP, of course, with extended semantics. Let A again denote a set of atomic actions including the unobservable action τ . Let γ : A\{τ }×A\{τ } → A be a partial commutative and associative communication function [7]. The syntax of pACPτ is given by the following grammar: E ::= δ | a | E·E | E+E | E π E | EE | E  E | E|E | ∂H (E) | τI (E) | x

72

S. Andova and S. Georgievska

for a ∈ A, π∈(0, 1), I, H ⊆ A \ {τ } and x ∈ V , where V is a set of recursion variables. pACPτ expressions that do not contain any variables are called closed expressions; otherwise, they are called open expressions. A guarded recursive specification, used to model infinite processes, is a finite set of equations of the form x = sx (V ), where x ∈ V and s is a pACPτ expression in which all occurrences of variables from V are guarded [7]. Moreover, the only operators allowed in s are: a, for a ∈ Aτ , +, π and · , and the latter one only in a form t · s for a closed pACPτ expression t. Thus, we restrict ourself to finitely definable processes, for the reasons explained in [6, 14]. We assume the following binding strengths: · >  > +, i.e. · binds strongest. Operators  and | bind equally as , and  binds equally as +. Each pACPτ expression is interpreted as a PTS. We explain the semantic of the parallel composition and related to it operators only, for the other operators we refer to [3]. The parallel composition assumes that the probabilistic processes are mutually independent. Informally, if process p behaves as process p with probability π and q behaves as q  with probability ρ, then the parallel composition, pq, behaves as p q  with probability πρ, where the “subprocess” p q  can perform an action from p or from q  or can perform an action that is a result of communication (as in ACP). The left merge, communication and encapsulation operator have similar meanings as their counter-parts in ACP. The probability distribution of PTS p  q (at the outermost level) is determined only by the distribution of p. The probability distribution of PTS p | q is the product of the distributions of p and q. Theorem 2 (Congruence theorem [25]). Rooted branching bisimulation is a congruence with respect to the operators in pACPτ . Axiomatization. The ground-complete axiomatization of rooted branching bisimulation is given in Table 1. Note that a condition of type x = x + x appears several times in the axioms. It describes processes that are not initially probabilistic in nature. For example, it does not hold for x ≡ a 1/2 b, since x + x in this case is represented by (a 1/2 b) 1/2 (a+b), but it applies if x ≡ a+b. It can be checked that if x ∼ rb x+x, then there exists a rooted branching bisimulation R such that (r(x), r(x+x)) ∈ R, and if x  s and x  t then (s, t) ∈ R. We briefly discuss the most important axioms of Table 1. Axiom PrB characterizes the rooted branching bisimulation. It is a counterpart of the branching axiom in the nonprobabilistic setting [16]: x·(y + τ·(y + z)) = x·(y + z). Due to the conditions y = y + y and z = z + z, it removes only a τ step that is followed by a process with a trivial (Dirac) outermost distribution, namely y + z. Moreover, process y + τ ·(y + z) may be an alternative of some probabilistic choice. The other alternatives of the probabilistic choice are captured by w, and, clearly, this part does not change when τ is removed. An interesting observation is that there is no axiom of type x·τ = x, because, as stated in Section 2, not all τ steps preceded by a process are inert. Actually, the variant x·τ ·y = x·y if y = y + y holds and can be derived from PrB. There are three main laws that axiomatize the parallel composition operator: PM1 and PM2 which describe the interplay of  and , and the conditional

On Compositionality, Efficiency, and Applicability of Abstraction

73

Table 1. Axioms of pACPτ . a, b ∈ A ∪ {δ}, I, H ⊆ A \ {τ }, w, x, y, z ∈ V A1 A2 AA3 A4 A5 A6 A7 TI1 TI1’ TI2 TI3 TI4

x+y = y+x (x + y) + z = x + (y + z) a+a=a (x + y)·z = x·z + y·z x·(y·z) = (x·y)·z x+δ = x δ·x = δ τI (a) = a if a∈I τI (a) = τ if a∈I τI (x + y) = τI (x) + τI (y) τI (x·y) = τI (x)·τI (y) τI (x π y) = τI (x) π τI (y)

PA1 PA2 PA3 PA4 PA5

x π y = y 1−π x π y) π+ρ−πρ z x π (y ρ z) = (x  π+ρ−πρ x π x = x (x π y)·z = x·z π y·z (x π y) + z = (x + z) π (y + z)

D1 D2 D3 D4 D5

∂H (a) = a if a∈H ∂H (a) = δ if a ∈ H ∂H (x + y) = ∂H (x) + ∂H (y) ∂H (x·y) = ∂H (x)·∂H (y) ∂H (x π y) = ∂H (x) π ∂H (y)

M

x  y = x  y + y  x + x | y if CF

PM1 PM2 LM2 LM3 LM4

x  (y π z) = (x  y) π (x  z) (x π y)  z = (x  z) π (y  z) a  x = a·x a·x  y = a·(x  y) (x + y)  z = x  z + y  z

CM1 CM2 CM3 CM4 CM5

x = x + x and y = y + y a | b = γ(a, b), if γ(a, b) defined a | b = δ, otherwise x | (y + z) = x | y + x | z (x + y) | z = x | z + y | z a | b·x = (a | b)·x a·x | b = (a | b)·x a·x | b·y = (a | b)(x  y)

PrB x·((y + τ ·(y + z)) π w) = x·((y + z) π w) if y = y + y and z = z + z

axiom M which states on which processes the interleaving can be performed. PM1 and PM2 express that  distributes (left and right) over  . As long as at least one of the two parallel processes starts with a non-trivial probability distribution, these laws will be applied. Theorem 3 (Elimination theorem). Let p be a pACPτ closed expression. Then there is a pACPτ expression q without operators ,  , |, τI , and ∂H , such that pACPτ  p = q. Theorem 4 (Soundness and ground completeness). Let p and q be pACPτ expressions represented by processes x and y, respectively. Then pACPτ  p = q implies x ∼ rb y. If p and q are closed pACPτ expressions, then x ∼ rb y implies pACPτ  p = q. Theorem 5. pACPτ is an equationally conservative extension of ACP with abstraction as defined in [7]. Recursive Verification Rules. These rules are needed to reason about systems in which (infinite) internal activity, non-determinism and/or probability distributions over observable events are involved. They capture the idea that, when abstracting from a set of internal events, eventually an observable event

74

S. Andova and S. Georgievska

will be chosen. They mainly describe the effect τ -loops may have on certain combinations of probabilistic and non-deterministic choices. Assuming i, j ∈ I ⊆ A \ {τ }, we formulate the following rules (see also [3]) x = y+i · x, y = y + y x = z π (u+i · x), z = z+u, z = z+z , VR2 , and τ · τI (x) = τ · τI (y) τ · τI (x) = τ · τI (z) x = z+i · y, y = z π (u+j · x), z = z + z, z = z + u, VR3 . τ · τI (x) = τ · τI (y  ) for y  = z π (u+i · y  ) VR1

Due to the presence of non-deterministic choice, the fairness rules from the nonprobabilistic setting such as KFARs [7] appear in our setting as well, and VR1 is the simplest one. Rules VR2 and VR3 have a condition of the form z = z + u. Informally, it states that every process which can be reached from z in one step with a positive P -probability can mimic all activities of u. Proposition 3. Let z and u be PTSs such that z ∼ rb z + z and z ∼ rb z + u. There exists a rooted branching bisimulation R such that (r(z), r(z + z)), a → t (r(z), r(z + u)) ∈ R and, for all n, n , t such that r(z)  n, u  n and n − a for a ∈ A, there exists a transition n − → t for some t, such that (t, t ) ∈ R. VR2 expresses a situation in which, due to a τ -loop, a summand u of probabilistic process x can be dropped without affecting the behavior of x. The two conditions: z = z + z and z = z + u guarantee that every subprocess reachable from r(x), can perform the same set of actions that z can perform, and continue with the equivalent behavior to the one of z afterwards. These actions can be performed either directly in one step or after performing a τ -step back to the initial state of x. Under these conditions, the root of x and all nodes reachable from it in one probabilistic transition, are equivalent. Similarly for VR3 . Theorem 6. VR1 , VR2 and VR3 are sound w.r.t. ∼ rb .

6

Verification of the CAB Protocol

The main purpose of this section is to investigate whether the process algebra and the verification rules of Section 5 are effective in verification of transmission protocols. We do so by verifying the Concurrent Alternating Bit Protocol(CABP). CABP is used to reliably deliver data via an unreliable channel, using a system of acknowledgements. In order to overcome a possible loss of data, CABP continuously (re)sends the same datum until it receives an acknowledgement, confirming its correct delivery. Specification of CABP. CABP is described by six separate processes that communicate with each other: sender S and receiver R of data, sender AS and receiver AR of acknowledgments, and two channels, one carrying data (K), and the other one carrying acknowledgements (L). Probabilities are used to model the unreliable behavior of the channels. All six processes together model the entire protocol. A sketch of the system is provided in Fig. 1. Numbers 1 through 8 represent the gates at which actions are communicated.

On Compositionality, Efficiency, and Applicability of Abstraction M1

75

M1 1

S

3

K

4

L

6

8

AR

2

R

1

5 7

2

8

5

AS

M2

M2

Fig. 1. a.) Layout of the CABP. b.) External behavior of the two modules. Table 2. Specification of the sender, the receiver and the channel. π, ρ and 1−π−ρ model the probability that a message is sent correctly, corrupted or lost. Sender:

S = RM(0) P RM(b∈Bit) = d∈D r1 (d) · SF(d, b) SF((d, b)∈D×Bit) = s3 (d, b) · SF(d, b) + r8 (ac) · RM(1 − b)

Receiver: R RF(b∈Bit)

= = + RS((d, b)∈D×Bit) =

RF(0) P Pd∈D r4 (d, b) · RS(d, b) d∈D r4 (d, 1 − b) · RF(b) + r4 (⊥) · RF(b) s2 (d) · s5 (ac) · RF(1 − b)

P Channel: K = (d,b)∈D×Bit r3 (d, b) · Ks (d, b) Ks ((d, b)∈D×Bit) = (s4 (d, b) π s4 (⊥) ρ k) · K

We group these processes in two logical modules: module M1 is responsible for transmitting data and contains processes S, K, and R, while module M2 is responsible for transmitting acknowledgements and contains AS, L and AR. CABP is described by the parallel composition of these two modules. Thespecifications of the components of module M1 are given in Table 2, where is a short-hand notation for a non-deterministic choice of finitely many processes. We briefly sketch the intuition behind the processes of module M1 . The set D denotes a finite set of data elements. The sender, modeled by process S, uses action r1 to receive a datum from its environment. This datum, augmented with a bit (for acknowledgement purposes), is then repeatedly sent using action s3 . Alternatively, an acknowledgement is received using action r8 . The receiver reads data from the communication channel K using action r4 . A corrupted datum is represented by ⊥ (a mechanism for detecting faulty data is assumed). If a noncorrupted, expected datum is received (i.e. it carries the expected acknowledgement bit), it is sent to the environment via action s2 and the acknowledgement sender is triggered via action s5 . Finally, the unreliable channel uses action r3 for receiving a datum, action s4 for sending a (possibly corrupted) datum and action k for losing a datum. We distinguish between the external and the internal behavior of module M1 . The communications between the actions of module M1 are defined using a function γ, given by γ(rj (d, b), sj (d, b)) = cj (d, b), j = 3, 4 and γ(r4 (⊥), s4 (⊥)) = c4 (⊥) for all data (d, b)∈D×Bit. Process ∂H (S  K  R) then describes the

76

S. Andova and S. Georgievska

internal behavior of M1 , where H = {s3 (d, b), r3 (d, b), s4 (d, b), r4 (d, b), s4 (⊥), r4 (⊥) | (d, b)∈D×Bit} contains all actions that need to be blocked to enforce communication. The external behavior of module M1 is the behavior of module M1 after abstracting from the communications between the components in M1 , viz. the actions in the set I = {c3 (d, b), c4 (d, b), c4 (⊥), k | (d, b)∈D×Bit}. The external behavior of module M1 , thus, can be represented by τI (∂H (S  K  R)). Verification of the CABP. Our aim is to rewrite the process representing the external behavior of module M1 to a simpler process, for which it is easier to check that it behaves the way it is meant to behave. Similarly for M2 . From these simple specifications of the external behaviors of both modules, we can easily derive the process that represents the behavior of the entire protocol. The result for M1 is formulated in the following lemma. A similar statement holds for module M2 . NA is a special new constant, such that, every subprocess that is not of any interest to the overall behavior of the system is replaced by NA. Lemma 2. In pACPτ +V R1 + V R2 + V R3 it holds τI (∂H (S  K  R)) = M1 , where M1 (the external behavior of M1 ) is specified by: M1 = V1 (0),  V1 (b∈Bit) = d∈D r1 (b) · V2 (b, d), V2 (b∈Bit, d∈D) = r8 (ac)·NA + s2 (d)·V3 (b, d), V3 (b∈Bit, d∈D) = r8 (ac)·NA+s5 (ac)·V4 (b, d), V4 (b∈Bit, d∈D) = r8 (ac)·V1 (1−b). Theorem 7. In pACPτ +V R1 +V R2 +V R3 it holds: τ · τI∪J (∂H∪G (SKRASLAR)) P r1 (d) · s2 (d) · τI∪J (∂H∪G (SKRASLAR)). =τ· d∈D

From Theorems 1, 4, 6 and 7 we obtain that the CABP has the same pCTL properties as a one-place buffer.

7

Conclusion and Related Work

We showed that the branching bisimulation of [25] that is congruence for parallel composition has several desirable properties. It is decidable in polynomial time and it preserves probabilistic CTL formulas. Moreover, by giving a groundcomplete axiomatization and supporting recursive abstraction rules, we showed that, although restrictive at first sight, it can fruitfully be used to verify protocols such as the CAB protocol. To our knowledge, this is the first weak equivalence on probabilistic systems enjoying all three of these properties. Related work. Combining probabilistic and nondeterministic choices has turned out to be rather cumbersome to be captured within a general framework [24]. Many different approaches from axiomatic perspective have been taken, depending on the interpretation of the two types of choices and their interoperability (e.g. [1, 3, 14, 18, 19, 20]). To our knowledge, process algebra with probability, nondeterminism, abstraction, parallel composition and recursion has been previously considered only

On Compositionality, Efficiency, and Applicability of Abstraction

77

in [14]. The underlying semantical model are simple probabilistic automata (automata in short) [22]. This model is shown to be comparable to the alternating model [10, 23, 24], but when abstraction is not considered. When weak relations are defined, to achieve transitivity, it should be allowed for a single transition to be simulated by a convex combination of several transitions. A side-effect of this property is that weak equivalences in the automata model are not decidable in polynomial time [12]. On the other hand, the branching bisimulation that we consider in this paper, and the branching bisimulation for the automata model, both do not relate the processes a·τ ·(x π y) and a·(x π y), for x = y. The axioms that characterize the rooted branching bisimulation studied here can be compared with those given in [3] that characterize the rooted version of the weaker branching bisimulation of [5]. In [3] there are two additional axioms: x · τ = x and x · (τ · z π z) = x · z. The absence of the first equation here is discussed in Section 5, while the latter equation with a restriction z + z can be easily derived from PrB by taking δ for y and z for w. Logical characterization of various equivalences for Markov chains is treated in details in [8]. In [15] the semantics of pCTL* of [11] is extended to treat internal steps. Behaviors, on which path formulas are interpreted, ignore states with τ steps, together with the τ steps. With this semantic they show that the weak bisimulation of [21] is sound and complete for the presented logic. However, this semantics implies that two non-probabilistic systems that satisfy the same formulas are not necessary branching bisimilar. Our idea, on the other hand, was to extend the semantics in such a way, that it immediately follows that if two non-probabilistic systems satisfy the same formulas, then they are branching bisimilar. For these reasons, we built on [13], rather than on [15] or [22]. Acknowledgements. We would like to thank Jos Baeten, Erik de Vink and the anonymous reviewers for the useful remarks.

References ´ 1. Aceto, L., Esik, Z., Ing´ olfsd´ ottir, A.: Equational axioms for probabilistic bisimilarity. In: Kirchner, H., Ringeissen, C. (eds.) AMAST 2002. LNCS, vol. 2422, pp. 239–253. Springer, Heidelberg (2002) 2. Andova, S., Baeten, J.C.M., D’Argenio, P.R., Willemse, T.A.C.: A compositional merge of probabilistic processes in the alternating model. In: NWPT 2006 (2006) 3. Andova, S., Baeten, J.C.M., Willemse, T.A.C.: A complete axiomatisation of branching bisimulation for probabilistic systems with an application in protocol verification. In: Baier, C., Hermanns, H. (eds.) CONCUR 2006. LNCS, vol. 4137, pp. 327–342. Springer, Heidelberg (2006) 4. Andova, S., Georgievska, S., Trˇcka, N.: On compositionality, efficiency, and applicability of abstraction in probabilistic systems (2008), http://www.win.tue.nl/∼ sgeorgie/processalgebra.pdf 5. Andova, S., Willemse, T.A.C.: Branching bisimulation for probabilistic systems: characteristics and decidability. Theor. Comput. Sci. 356(3), 325–355 (2006) 6. Baeten, J.C.M., Bravetti, M.: A ground-complete axiomatization of finite state processes in process algebra. In: Abadi, M., de Alfaro, L. (eds.) CONCUR 2005. LNCS, vol. 3653, pp. 248–262. Springer, Heidelberg (2005)

78

S. Andova and S. Georgievska

7. Baeten, J.C.M., Weijland, W.P.: Process Algebra. Cambridge Tracts in Theoretical Computer Science, vol. 18. Cambridge University Press, Cambridge (1990) 8. Baier, C., Katoen, J.-P., Hermanns, H., Wolf, V.: Comparative branching-time semantics for Markov chains. Inf. Comput. 200(2), 149–214 (2005) 9. Baier, C., Kwiatkowska, M.: Model checking for a probabilistic branching time logic with fairness. Distrib. Comput. 11(3), 125–155 (1998) 10. Bandini, E., Segala, R.: Axiomatizations for probabilistic bisimulation. In: Orejas, F., Spirakis, P.G., van Leeuwen, J. (eds.) ICALP 2001. LNCS, vol. 2076, pp. 370– 381. Springer, Heidelberg (2001) 11. Bianco, A., de Alfaro, L.: Model checking of probabalistic and nondeterministic systems. In: Thiagarajan, P.S. (ed.) FSTTCS 1995. LNCS, vol. 1026, pp. 499–513. Springer, Heidelberg (1995) 12. Cattani, S., Segala, R.: Decision algorithms for probabilistic bisimulation. In: Brim, L., Janˇcar, P., Kˇret´ınsk´ y, M., Kucera, A. (eds.) CONCUR 2002. LNCS, vol. 2421, pp. 371–385. Springer, Heidelberg (2002) 13. De Nicola, R., Vaandrager, F.W.: Three logics for branching bisimulation. JACM 42(2), 458–487 (1995) 14. Deng, Y., Palamidessi, C., Pang, J.: Compositional reasoning for probabilistic finite-state behaviors. In: Middeldorp, A., van Oostrom, V., van Raamsdonk, F., de Vrijer, R. (eds.) Processes, Terms and Cycles: Steps on the Road to Infinity. LNCS, vol. 3838, pp. 309–337. Springer, Heidelberg (2005) 15. Desharnais, J., Gupta, V., Jagadeesan, R., Panangaden, P.: Weak bisimulation is sound and complete for PCTL*. In: Brim, L., Janˇcar, P., Kˇret´ınsk´ y, M., Kucera, A. (eds.) CONCUR 2002. LNCS, vol. 2421, pp. 355–370. Springer, Heidelberg (2002) 16. van Glabbeek, R.J., Weijland, P.: Branching time and abstraction in bisimulation semantics. JACM 43(3), 555–600 (1996) 17. Groote, J.F., Vaandrager, F.: An efficient algorithm for branching bisimulation and stuttering equivalence. In: Paterson, M. (ed.) ICALP 1990. LNCS, vol. 443, pp. 626–638. Springer, Heidelberg (1990) 18. Hansson, H.A.: Time and Probability in Formal Design of Distributed Systems. Elsevier, Amsterdam (1994) 19. Mislove, M.W., Ouaknine, J., Worrell, J.: Axioms for probability and nondeterminism. ENTCS 96, 7–28 (2004) 20. Morgan, C., McIver, A., Seidel, K., Sanders, J.W.: Refinement-oriented probability for CSP. Formal Aspects of Computing 8(6), 617–647 (1996) 21. Philippou, A., Lee, I., Sokolsky, O.: Weak bisimulation for probabilistic systems. In: Palamidessi, C. (ed.) CONCUR 2000. LNCS, vol. 1877, pp. 334–349. Springer, Heidelberg (2000) 22. Segala, R., Lynch, N.: Probabilistic simulations for probabilistic processes. Nordic J. of Computing 2(2), 250–273 (1995) 23. Segala, R., Turrini, A.: Comparative analysis of bisimulation relations on alternating and non-alternating probabilistic models. In: QEST 2005, pp. 44–53. IEEE Computer Society Press, Los Alamitos (2005) 24. Sokolova, A., de Vink, E.P.: Probabilistic automata: system types, parallel composition and comparison. In: Baier, C., Haverkort, B.R., Hermanns, H., Katoen, J.-P., Siegle, M. (eds.) Validation of Stochastic Systems. LNCS, vol. 2925, pp. 1–43. Springer, Heidelberg (2004) 25. Trˇcka, N., Georgievska, S.: Branching bisimulation congruence for probabilistic systems. In: QAPL 2008, ENTCS (to appear, 2008), http://www.win.tue.nl/∼ sgeorgie/TG08report.pdf

Framed Versus Unframed Two-Dimensional Languages Marcella Anselmo1 , Natasha Jonoska2 , and Maria Madonia3 1

3

Dipartimento di Informatica ed Applicazioni, Universit` a di Salerno I-84084 Fisciano (SA), Italy [email protected] 2 Department of Mathematics and Statistics, University of South Florida, Tampa FL 33620, USA [email protected] Dip. Matematica e Informatica, Universit` a di Catania, Viale Andrea Doria 6/a, 95125 Catania, Italy [email protected]

Abstract. In this paper we study a class of factor-closed tiling recognizable languages (FREC) that corresponds to certain symbolic dynamical systems called sofic subshifts. This class of languages is a subclass of the two-dimensional class of tiling recognizable languages, denoted REC. Differently from REC, languages in FREC can be recognized without framing pictures with a special boundary symbol. We study (un)ambiguity properties of FREC in comparison to the ones in REC. We show that a frame surrounding each block provides additional memory that can enforce the size and the content of pictures and can change (un)ambiguity properties. Consequently, we propose several variations of “unambiguity” for languages in FREC which may be better suited to understand this class.

1

Introduction

Two-dimensional languages are sets of two-dimensional arrays of symbols over a finite alphabet, also called blocks or pictures. Recognizable two-dimensional languages (REC) were introduced in [11] as a natural extension of one-dimensional regular languages. The definition that is extended to two dimensions is a characterization of a one-dimensional regular language as a projection of a local language [9]. A language is called local if it consists of all strings whose factors inside a sliding window of size 1 × 2 are part of a given finite set of two-symbol words called “dominoes”. In this definition a special boundary symbol inserted in the dominoes indicates the beginning and the end of the string. A language is regular if it is a symbol-to-symbol projection of a local language. In finite 

N.J. is partially supported by the NSF grants CCF #0523928 and CCF #0726396. M.A. and M.M. by MIUR Project “Automi e Linguaggi Formali: aspetti matematici e applicativi” (2005), by ESF Project AutoMathA” (2005-2010), by 60% Projects of University of Catania and Salerno (2006, 2007).

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 79–92, 2009. c Springer-Verlag Berlin Heidelberg 2009 

80

M. Anselmo, N. Jonoska, and M. Madonia

automata, the states of an automaton can be considered as symbols of the local language while the boundary symbol specifies “initial” and “final” states. Similarly, in two dimensions, each rectangular block of a recognizable picture language is surrounded by a frame made of a special boundary symbol. In two dimensions, testing whether a picture belongs to a local language is obtained by verifying whether every subblock inside a sliding window of size 2 × 2 belongs to a given finite set of 2 × 2 “tiles”. The REC family can be characterized in terms of automata, logic, grammars and regular expressions [12]. On the other side, tilings of the plane with Wang tiles have been extensively studied since early 1960s (for example [6,14,22]) and they are closely related to two-dimensional symbolic dynamical systems ([8,15,16,17,18]). Roughly speaking, two-dimensional symbolic dynamical systems, called subshifts of finite type are sets of tilings of the plane with Wang tiles invariant under translations. A subshift obtained as a symbol-to-symbol projection of a subshift of finite type is called sofic. A two-dimensional subshift uniquely determines the set of rectangular (finite) blocks (or pictures) that can be excised out of the tilings [18]. Such languages of pictures are in fact factor-closed and extendable (ultimately to a tiling of the plane). Languages that correspond to subshifts of finite type are a subclass of local two dimensional languages, whereas those that correspond to the sofic subshifts, are a subclass of REC. Due to being factor-closed and extendable, it seems natural to define such local and recognizable languages without frames surrounding the blocks. In this paper we consider picture languages without frames surrounding the pictures (called here FREC) and compare the change in a variety of properties under the framed vs unframed approaches. More specifically the paper focuses on determinism and unambiguity. In any computational model, determinism means unique choice of the next step in an allowed computation, while an unambiguous model requires that each accepted object admits only one successful computation. Both determinism and unambiguity correspond to some sort of uniqueness in the process of computation, but while determinism seems to be a “local” notion, unambiguity could be considered to be a “global” one. Normally determinism implies unambiguity. In [3], deterministic recognizable languages (DREC) were defined in the context of framed two-dimensional languages, while unambiguous ones (UREC) have been introduced in [11]. Some questions related to ambiguity in connection with determinism of framed recognizable picture languages has been studied in [1,2,3,4]. Ambiguity is also central to many open questions in two-dimensional symbolic dynamics; for example some related to entropy questions that are solved in one dimension [18], remain open in the two-dimensional case (see for example [20,21]). A natural question arises: to what extent the determinism and unambiguity properties of framed recognizable languages (REC) can be transferred to the unframed ones (FREC) and vice versa. As FREC is a subclass of REC, it is natural to expect that analogous determinism and unambiguity properties of languages in REC naturally hold in FREC. However, we show that this is not necessarily

Framed Versus Unframed Two-Dimensional Languages

81

the case. In fact, it turns out that the frame surrounding the blocks provides additional memory that, besides enforcing size and content of the recognized pictures, can also reduce the ambiguity of a language (Remark 5). The paper is organized as follows. In Section 2, we define FREC family and characterize it as a subset of REC. In Section 3, we recall definitions and results on determinism and unambiguity in REC. The same notions are introduced for FREC in Section 4; note that in this case we need to introduce a variety of new notions of ambiguity. Some results about finite and infinite ambiguity in FREC are presented in Section 5, while decidability properties are contained in Section 6. In the last section we point out similarities and differences between framed and unframed languages.

2

REC and FREC

In this section we briefly recall the definitions of two-dimensional local and recognizable languages introduced in [11,12] utilizing a special boundary symbol used to frame the rectangular arrays. We also introduce the class FREC of factorial recognizable languages that corresponds to the class of languages that define symbolic dynamical systems called sofic shifts [8,19]. Languages in this class are always factorial (also known as factor-closed) and extendable to a full tiling of the plane, consequently framing the arrays with a special boundary symbol is not needed. A block or picture over a finite alphabet Σ is a two-dimensional rectangular array of elements of Σ. Given a picture p, let r(p) = m, denote the number of rows and c(p) = n the number of columns of p; the pair (m, n) is called the size of p. The set of all pictures over Σ of size (m, n) is denoted by Σ m,n . The set of all pictures over Σ is denoted by Σ ∗∗ . A two-dimensional language (or a picture language) over Σ is a subset of Σ ∗∗ . The first recognition method, following the definition in [11,12], consists in surrounding the pictures with a boundary symbol and looking for allowed subpictures inside a window 2 × 2. Hence, for any picture (or block) p of size (m, n), we consider the framed picture p of size (m + 2, n + 2) obtained by surrounding p with a special boundary symbol # ∈ Σ. A tile is a picture of dimension (2, 2) and Bm,n (p) is the set of all sub-pictures, also called here factors, of size (m, n) x y then of a picture p. In particular, if t is a tile t = w z   z # # w # # # # w z y # # x # # ˆ B2,2 (t) = t, , , , , , , , . # # # # y # # x # # z # # w x y Given an alphabet Γ , a two-dimensional language L ⊆ Γ ∗∗ is local if there exists a finite set Θ of tiles over Γ ∪ {#} such that L = {p ∈ Γ ∗∗ |B2,2 ( p) ⊆ Θ} and we write L = L(Θ). We denote by LOC(Γ ) the family of all local picture languages over Γ . When the alphabet is understood from the context we simply write LOC, and the same convention is used for all other classes of languages in the sequel.

82

M. Anselmo, N. Jonoska, and M. Madonia

A tiling system is a quadruple (Σ, Γ, Θ, π) where Σ and Γ are finite alphabets, Θ is a finite set of tiles over Γ ∪ {#} and π : Γ → Σ is a projection. A two-dimensional language L ⊆ Σ ∗∗ is tiling recognizable if there exists a tiling system (Σ, Γ, Θ, π) such that L = π(L(Θ)) (extending π on the arrays). We denote by REC(Σ) (or simply REC) the family of all tiling recognizable two-dimensional languages over Σ. Example 1. Let Γ = {0, 1} and Lsq ⊆ Γ ∗∗ be the language of square pictures (i.e. pictures with as many rows as columns) with 1 on the main diagonal and 0 elsewhere. Lsq is local; Lsq = L(Θ) where Θ = B2,2 (tˆ) and t is the square of side 4 in Lsq . Let now Σ = {a} and L be the language of square pictures on Σ. L ∈ REC since L = π(Lsq ) where π is the projection mapping 0 and 1 to a. Let us introduce factorial recognizable languages. For a language L, denote by F (L) the set of all factors of L. We say that L is factor-closed if L = F (L). Definition 1. Given an alphabet Γ , a two-dimensional language L ⊆ Γ ∗∗ is factorial local if there exists a finite set Θ of tiles over Γ such that L = F ({p ∈ Γ ∗∗ |B2,2 (p) ⊆ Θ}), and we write L = Lu (Θ). We denote by FLOC(Γ ) the family of all factorial local two-dimensional languages over Γ . Definition 2. An unbordered tiling system is a quadruple (Σ, Γ, Θ, π) where Σ and Γ are finite alphabets, Θ is a finite set of tiles over Γ and π : Γ → Σ is a projection. A two-dimensional language L ⊆ Σ ∗∗ is factorial tiling recognizable if there exists an unbordered tiling system (Σ, Γ, Θ, π) such that L = π(Lu (Θ)) (extending π on the arrays). We denote by FREC(Σ) the family of all factorial tiling recognizable picture languages over Σ. Definition 3. A tiling system (Σ, Γ, Θ, π) for L ⊆ Σ ∗∗ is trim if for any Θ  Θ, π(L(Θ ))  π(L(Θ)). Remark 1. (a) If L ∈ FLOC then L ∈ LOC. Indeed, if L ∈ FLOC,  then L = t). Lu (Θ) for some set of tiles Θ. Consider the set of tiles Θ# = Θ ∪ t∈Θ B2,2 ( It follows that L = L(Θ# ) and, therefore, L ∈ LOC. (b) Note that for a local language L, L ∈ FLOC if and only if L = F (L); therefore, L ∈FLOC if and only if F (L) ∈ FLOC. (c) If L ∈ FREC then L ∈ REC. The vice versa does not hold. Indeed if L ∈ FREC then L is factor-closed, while REC (and similarly LOC) also contains not factor-closed languages (e.g. the languages of square pictures in Example 1). Following Remark 1 (a), FRECREC. The following proposition provides a way to characterize FREC as a subset of REC. Proposition 1. L ∈ F REC if and only if L ∈ REC and L = π(K) where K is a factor-closed local language.

Framed Versus Unframed Two-Dimensional Languages

83

Proof. Suppose L ∈ F REC. Then L ∈ REC (see Remark 1). Moreover, the language L(Θ# ), where Θ# is defined as in Remark 1, is local and factor-closed by construction, and L = π(L(Θ# )). Suppose L ∈ REC and L = π(K) for some factor-closed local language K i.e. there exists a tiling system T = (Σ, Γ, Θ, π) for L such that L(Θ) = K is factor-closed. Without loss of generality we assume that T is trim. Note that, if t) ⊆ Θ: since T is trim, any tile t must occur as a factor a tile t ∈ Θ, then B2,2 ( of some p ∈ K = L(Θ) and, since K is factor-closed, t ∈ K = L(Θ) too. Now, consider the set of tiles Θno# = Θ ∩ Γ 2,2 . We observe that L = π(Lu (Θno# )), i.e., L ∈ FREC. If p ∈ π(Lu (Θno# )) then p = π(p ) for some t) ⊆ Θ, we p ∈ Lu (Θno# ). Consider the picture p : since for any t ∈ Θ, B2,2 ( have that all factors of size (2, 2) of pˆ lying along the first two and the last two rows, as well as the leftmost two columns and the rightmost two columns of p are in Θ. Therefore B2,2 (p ) ⊆ Θ and p ∈ π(L(Θ)) = L. The other inclusion, L ⊆ π(Lu (Θno# )), follows directly from the definitions.  Proposition 2. There exists a language L ∈ LOC such that F (L) ∈ LOC. Proof. Let Lsq be the set of squares with 1 on the main diagonal and 0 elsewhere, as in Example 1. We have that Lsq ∈ LOC and F (Lsq ) ∈ / LOC. Otherwise, if # # , F (Lsq ) ∈ LOC and F (Lsq ) = L(Θ), then Θ would also contain tiles 0 1 # # . Then some pictures with more than one 1 in the first row would belong 1 0 to L(Θ), but not to F (Lsq ). 

3

Determinism and Unambiguity in REC

The definition of determinism for two-dimensional recognizable languages is discussed and introduced in [3], where deterministic recognizable languages (DREC) are defined according to some direction from corner to corner of pictures. Determinism is in fact an “oriented” notion, even in the one dimensional case. Unambiguous recognizable languages (UREC) have been introduced in [11]. A language belongs to UREC when every picture has a unique pre-image in its corresponding local language; and this is an “orientation-free” notion. Ambiguity for framed recognizable picture languages has been studied in connection with determinism in [1,2,3,4]. Deterministic recognizable languages are defined according to one of the four corner-to-corner directions: from top-left corner towards the bottom-right corner (denoted tl-br for short), and all the others corner-to-corner directions in the set Cor-Cor= { tl-br, tr-bl, bl-tr, br-tl } using a similar notation. A tiling system (Σ, Γ, Θ, π) is tl-br-deterministic if for any γ1 , γ2 , γ3 ∈ Γ ∪ {#} γ γ and σ ∈ Σ there is at most one tile 1 2 ∈ Θ, with π(γ4 ) = σ. Similarly dγ3 γ4 deterministic tiling systems are defined, for any d ∈Cor-Cor. A recognizable twodimensional language L is deterministic, if it is recognized by a d-deterministic

84

M. Anselmo, N. Jonoska, and M. Madonia

tiling system for some corner-to-corner direction d. Denote by DREC(Σ) the class of deterministic recognizable two-dimensional languages over the alphabet Σ. A tiling system (Σ, Γ, Θ, π) for L ⊆ Σ ∗∗ is unambiguous if for any picture p ∈ L there exists a unique local picture p ∈ L(Θ) such that p = π(p ) (p is said a pre-image of p). L is unambiguous if it is recognized by an unambiguous tiling system and UREC(Σ) denotes the family of all unambiguous two-dimensional languages over Σ. As one may expect, in REC, determinism implies unambiguity. Furthermore in [3] it is shown that DREC is strictly included in UREC and UREC in REC; the strict inclusions hold even if the alphabet is unary [2]. Let us now introduce the definitions of k-ambiguity, finite and infinite ambiguity for languages in REC. A similar definition of k-ambiguity for languages in REC is contained in [10]. Definition 4. A tiling system T = (Σ, Γ, Θ, π) recognizing L is said to be kambiguous if every picture p ∈ L has at most k pre-images. We say that a recognizable language L is k-ambiguous if k = min{s | T is s-ambiguous tiling system and T recognizes L }. We say that L is finitely ambiguous if it is k-ambiguous for some k and that L is infinitely-ambiguous if it is not finitely ambiguous. Example 2. Consider the language, denoted here L01 , of pictures on Σ = {0, 1} with at most one occurrence of 1. It is clear that L01 is factor-closed. We observe that L01 is in UREC: indeed we can consider a local alphabet {1, a, b, c, d, e, f, g, h} and a projection that maps all symbols to 0 except 1 which is mapped onto itself. Below it is an example of a picture p ∈ L01 with its corresponding pre-image p . # # # p = # # #

# 0 0 0 0 #

# 0 0 0 0 #

# 0 1 0 0 #

# 0 0 0 0 #

# # # # # #

# # # p = # # #

# e a g g #

# e a g g #

# c 1 d d #

# f b h h #

# # # # # #

The boundary constraints on the local symbols are such that only one of the symbols, say g can be surrounded by the boundary symbol, whereas for all other symbols there is at least one direction in which the boundary symbol cannot appear (for example a# is not allowed to appear in any tile). Therefore the only picture in the local language made of symbols other than 1 is a picture of all g, ensuring that pictures of all 0’s in L01 have unique pre-images. If by the contrary we allow symbols e, f , g, h be surrounded by # then the tiling system would be 4-ambiguous. In REC one sometimes considers some intermediate notions between determinism and unambiguity: the column- and the row-unambiguity. The resulting classes Col-UREC and Row-UREC strictly separate DREC from UREC (see [3]).

Framed Versus Unframed Two-Dimensional Languages

4

85

Determinism and Unambiguity in FREC

All the definitions of determinism, unambiguity and k-ambiguity in REC (see Section 3) extend to languages in FREC as well by taking unbordered tiling systems. Moreover, let us denote by DFREC(Σ) and UFREC(Σ), respectively, the families of all deterministic and unambiguous factorial recognizable twodimensional languages over Σ. Let us now introduce column- and row-unambiguous factorial recognizable languages, in an analogous way as for REC ([3]). With a notation similar to the one used for Cor-Cor, consider the set Side-Side of four side-to-side directions, i.e., Side-Side= { l-r, r-l, t-b, b-t }. Definition 5. An unbordered tiling system (Σ, Γ, Θ, π) is l-r-unambiguous if for any column col ∈ Γ m,1 , and column p ∈ Σ m,1 , there exists at most one column col ∈ Γ m,1 , such that π(col ) = p and col col ∈ L(Θ). Similar properties define d-unambiguous unbordered tiling systems, for any side-to-side direction d ∈ Side-Side. We say that a factorial recognizable language is column-unambiguous if it is recognized by a d-unambiguous unbordered tiling system for some d ∈ { l-r, r-l} and it is row-unambiguous if it is recognized by a d-unambiguous unbordered tiling system for some d ∈ { t-b, b-t}. Finally, we denote by Col-UFREC(Σ) the class of column-unambiguous factorial recognizable languages over the alphabet Σ and by Row-UFREC(Σ) the class of row-unambiguous factorial recognizable languages over the alphabet Σ. Consider the following examples. Example 3. The language L01 of pictures on Σ = {0, 1} with at most one occurrence of 1, as in Example 2, is in FREC. It can be recognized with the unbordered tiling system obtained from the tiling system in Example 2, by removing all of the tiles that contain the boundary symbol. Observe that L01 is in DFREC and it is infinitely ambiguous. For every tiling system recognizing L01 the symbol 0 must have at least two pre-images, say A, B. This is necessary in order to mark the appearance of 1 in the picture. Then every picture sliding along the boundaries of these two regions (without containing the symbol(s) that maps onto 1) projects on a block of all 0’s. Therefore pictures of all 0’s have a number of pre-images proportional to their size. Example 4. Consider the language L1 of all the pictures with exactly one column of b’s and a elsewhere, together with all their factors. Note that L1 is in FREC. Indeed, it can be recognized by an unbordered tiling system T in which symbol a has two different pre-images, one to mark “left” of column b and the other to mark “right” of column b. Further L1 is in Row-UFREC and Col-UFREC (T is column- and rowunambiguous) and it is 2-factorial-ambiguous (for any trim unbordered tiling system, a must have at least two pre-images. Furthermore T is an unbordered tiling system in which any picture has at most 2 pre-images).

86

M. Anselmo, N. Jonoska, and M. Madonia

Example 5. Consider language Labc consisting of pictures in L1 with some rows of c’s (eventually) concatened above and below them, together with all their factors. Labc is 2-factorial ambiguous (analogous as in Example 4). On the other hand it is not in Row-UFREC: for any unbordered tiling system for Labc , symbol a has two pre-images at least; and we cannot decide which is the local symbol to choose above (or below) a local symbol for c. Unambiguous languages in FREC coincide with factorial local languages. Whereas, there are unambiguous languages in REC that are not local (for example language L in Example 1). Proposition 3. F LOC = U F REC. Proof. If L ∈ F LOC then π is the identity and then L ∈ U F REC. If L ∈ U F REC then any symbol in Σ (viewed as a picture of size (1, 1)) has a unique pre-image. Then π is a one-to-one mapping and L ∈ F LOC.  We consider several variations of ambiguity. The classes of languages in FREC, as introduced so far, can be inserted in a scenario where they are classified according to the growth of the number of pre-images of pictures, as a function of the size of the picture. Observe that, in general, if L ∈ F REC is recognized by an unbordered tiling system T with γ symbols in Γ and p is a picture of size (m, n) then, trivially, p can have at most γ m×n pre-images. But we can have different situations corresponding to different levels of ambiguity. In the following, L is a language recognized by a tiling system T = (Σ, Γ, Θ, π) with γ symbols in Γ . 1) Any picture p ∈ L has at most one pre-image in Lu (Θ). These are languages in UFREC. 2) Any picture p ∈ L has at most one pre-image p in Lu (Θ), once a symbol in a corner of p is fixed. This class contains languages in Col-UFREC∩RowUFREC (the unambiguity on the next column/row, is required for columns/rows of any length: 1, 2, ... ). They are finitely ambiguous (any picture has at most γ pre-images, see Proposition 6). 3) Any picture p ∈ L has at most one pre-image p in Lu (Θ), once the first column (resp. the first row) of p is fixed. This class contains languages in ColUFREC (resp. Row-UFREC). They may be infinitely ambiguous, but any picture has at most γ m (resp. γ n ) pre-images. 4) Any picture p ∈ L has at most one pre-image p in Lu (Θ), once two consecutive sides on the perimeter of p are fixed. This class contains languages in DFREC. They may be infinitely ambiguous, but any picture has at most γ m+n−1 pre-images (if T is tl-br-deterministic, once the symbols for the first row and the first column of p are fixed, then p has at most one pre-image; there are at most γ m+n−1 such choices). Extending on the above classification it is natural to introduce a class of languages where for every block p ∈ L there is a unique pre-image p in Lu (Θ) once we fix the whole perimeter of p .

Framed Versus Unframed Two-Dimensional Languages

87

Definition 6. Let T be an unbordered tiling system (Σ, Γ, Θ, π) recognizing L. Let p ∈ L and f be an inverse image of a frame that consists of first and last row of p and first and last column of p. We say that T is frame-unambiguous at p if there is at most one p ∈ Lu (Θ) with π(p ) = p such that the first and last row of p and the first and last column of p form the frame f . The tiling system T is frame-unambiguous if it is frame-unambiguous at p for every p ∈ L. A language L is frame-unambiguous if it is recognized by a frame-unambiguous unbordered tiling system. Example 6. Consider again language L01 . The unbordered tiling system sketched in Example 2 is frame-unambiguous. The definition of frame-unambiguity has several meanings and motivations. Factorial recognizable languages in two dimensions generalize factor-closed regular languages in one dimension. Such string languages can be represented by automata where every state is both initial and terminal. Unambiguity for such automata is generally defined (cf. [5]) as the existence of a unique path with fixed label, once an initial and a terminal state are fixed. In a two-dimensional case, the role of initial and terminal states is played by the symbols along the perimeter of the rectangle, i.e., the frame. Hence in two dimensions such condition translates into fixing a frame of symbols in a picture of the local language. Furthermore, the definition of frame-unambiguity can be viewed as the generalization of the unambiguity in REC. The role played by the frame of the special boundary symbols is replaced by the one of frames of symbols in the local alphabet. Finally this definition is more consistent with the one of determinism as shown in the following proposition. Note that, in FREC, determinism does not imply unambiguity (see Example 3). Proposition 4. If L ∈ DF REC then L is frame-unambiguous. Proof. Suppose that L is recognized by a tl-br-deterministic unbordered tiling system T (the proof goes analogously in the other cases). Then, in T, any picture has at most one pre-image, once the symbols on the first row and on the first column are fixed in the pre-image, and, therefore, T is frame-unambiguous. 

5

Finite and Infinite Ambiguity in FREC

In this section we show that there is a rich variety of ambiguity degrees in FREC according to the definitions in Section 4. First we show that there is a hierarchy of finitely factorial-ambiguous languages. Proposition 5. For any k ≥ 1, there exists a k-factorial-ambiguous language. Proof. (sketch) Consider the language Lh (h ≥ 1) of all the pictures that are factors of blocks with exactly h columns of b’s and a’s elsewhere (generalizing Example 4). Then in every tiling system recognizing Lh , the blocks of all a’s have at least h + 1 pre-images under the projection map. 

88

M. Anselmo, N. Jonoska, and M. Madonia

The following proposition shows the relationships among the classes of finitely ambiguous languages considered so far. Proposition 6. The class of unambiguous FREC is strictly included in (ColUFREC ∩ Row-UFREC) which on the other side is strictly included in the class of finitely ambiguous FREC. Proof. (sketch) U F REC ⊆(Col-UFREC∩Row-UFREC) since unambiguity holds in particular on pictures with two columns and on pictures with two rows. The inclusion is strict: consider language L1 in Example 4. For the second inclusion note that if L ∈ (Col-UFREC∩Row-UFREC) then it is possible to construct an unbordered tiling system recognizing L, say T, that is column-unambiguous and row-unambiguous, at the same time. Suppose T has γ symbols in Γ : then every picture has at most γ pre-images, as there are at most γ possible choices for the local symbol in the top-left corner. This inclusion is  also strict: consider language Labc in Example 5. The next proposition shows the relationships among the classes of languages that contain infinitely factorial ambiguous languages. Proposition 7. The class DFREC properly contains the class (Col-UFREC ∪ Row-UFREC) and is included in the class of frame unambiguous FREC. Proof. (sketch) We show that if an unbordered tiling system is l-r-column unambiguous then it is tl-br-deterministic. Otherwise there exist γ1 , γ2 , γ3 , γ4 , γ4 ∈ Γ , with γ4 = γ4 and π(γ4 ) = π(γ4 ), such that the two different tiles γ1 γ2 γ1 γ2 γ , ∈ Θ. The contradiction holds for column 1 and row γ1 γ2 . γ3 γ4 γ3 γ4 γ3 The inclusion is strict. Consider language L01 in Example 3: any unbordered tiling system recognizing L01 cannot be either column- or row-unambiguous. The inclusion of DFREC in frame-unambiguous FREC is Proposition 4. 

6

Decidability Properties

In this section we present some decidability observations. Recall that in REC, it is decidable whether a tiling system is deterministic, column- (row-) unambiguous, but it is undecidable whether it is unambiguous. Similarly, analogous results hold for unbordered tiling systems in FREC. Proposition 8. It is decidable whether a given unbordered tiling system is unambiguous, column-unambiguous, row-unambiguous and deterministic, respectively. The proof of the next (undecidability) result can be obtained by reduction from the following undecidable problem (see [7] for all details). Let Σ be a finite alphabet and S = {(u1 , v1 ), . . . , (uk , vk )} be a system where ui , vi ∈ Σ ∗ for all i = 1, . . . , k. The system S is uniquely decipherable (u.d.,

Framed Versus Unframed Two-Dimensional Languages

89

for short) if and only if the equalities ui1 . . . uip = uj1 . . . ujq and vi1 . . . vip = vj1 . . . vjq imply both p = q, and (i1 , . . . , ip ) = (j1 , . . . , jp ). The 2-dimensional Unique Decipherability Problem is the question whether a given system S is u.d. Proposition 9. It is undecidable whether a given unbordered tiling system is frame unambiguous. Proof. (sketch) The proof is similar to the proof of the undecidability of the unambiguity of a tiling system in REC as in [4]. We show that the 2-dimensional Unique Decipherability Problem reduces to the problem of deciding whether a given unbordered tiling system is frame unambiguous. Let S = {(u1 , v1 ), . . . , (uk , vk )} be a system where ui , vi ∈ Σ ∗ for all i = 1, . . . , k and let c ∈ / Σ. We define a picture language L(S) over the alphabet Σ ∪ {c} as the set of pictures p as below, together with all their factors. c

c ui1 vi1

. p = ..

..

... ... .

.. .

.. ...

c

.. .

c

vip c

uip

c0

. p = ..

.

c0 ui1

... ...

vi1 ci1

c0

c0

.. .

.. . vip

c

uip

cip ...

c0

Then L(S) ∈ F REC. An unbordered tiling system (Σ, Γ, Θ, π) recognizing L(S) can be constructed as follows. The local alphabet is Γ = Σ  ∪{c0 , c1 , . . . , ck } where Σ  is a local alphabet for recognizing the strings ui , vj , for all i, j = 1, . . . , k, and ui , vj are the pre-images of ui , vj , respectively. The pre-image of the generic picture p is p as sketched above. It follows that the unbordered tiling system (Σ, Γ, Θ, π) is frame unambiguous if and only if the system S is u.d. Indeed S is not u.d. if and only if when fixing a frame of c0 ’s around some picture as p, then it has two pre-images at least. Moreover if S is u.d. then, fixing a frame of local symbols, not all c0 ’s, around some proper factor q of p, means fixing symbols ci , and hence the pre-image of q is uniquely determined. 

7

Ambiguity in REC vs Ambiguity in FREC

In this section we compare results about recognizability and ambiguity of the languages in REC with the corresponding results for the class FREC. The following remarks highlight the differences between the two types of definitions. Remark 2. If L ∈ FLOC then L ∈ LOC. If L ∈ FREC then L ∈ REC. If L ∈ UFREC then L ∈ UREC. Vice versa: L factor-closed and L ∈ U REC do not imply that L ∈ U F REC, as shown in Examples 2 and 3 for language L01 .

90

M. Anselmo, N. Jonoska, and M. Madonia

Remark 3. In REC the following (strict) inclusions hold (see [3]): DREC  (Col-UREC ∪ Row-UREC )  UREC. On the other hand, in FREC the inclusions among the analogous classes hold in the opposite direction (see Propositions 6, 7): UFREC ⊆ ( Col-UFREC ∪ Row-UFREC ) ⊆ DFREC. Remark 4. Consider the relationship between determinism and unambiguity in REC compared to the one in FREC. In REC, determinism implies unambiguity. On the other hand in FREC, determinism does not imply unambiguity, not even finite ambiguity (see Example 2), however, it does imply frame unambiguity, as shown in Proposition 4. Remark 5. The introduction of boundaries in recognition of pictures can remarkably reduce the ambiguity of a language. Indeed, there exist k-factorial ambiguous languages, with k > 1, that are unambiguous in REC (consider L1 in Example 4). Furthermore, there exist infinitely factorial ambiguous languages, that are unambiguous in REC (consider L01 in Examples 2 and 3). Remark 6. Consider now the different degrees of ambiguity in REC and FREC respectively. In FREC, there are examples of languages that are unambiguous, as well as finitely ambiguous for any k ≥ 1, and infinitely ambiguous. On the other hand, in REC we only have examples of languages that are either unambiguous or infinitely ambiguous. The question whether this is always the case is still open.

8

Conclusions and Open Questions

In this paper we have introduced a class of two-dimensional languages (FREC) motivated by symbolic dynamics. The results obtained within this paper have indeed interesting analogies and interpretations in symbolic dynamics most of which we omit them due to lack of space. For example, Proposition 3, while not valid for framed languages, is not surprising for unframed ones. Shifts of finite type are defined with factorial local languages. Unambiguity of the projection of a tiling system, in fact, defines a conjugacy from the shift of finite type onto its image (see [18]). Consequently, every image of a factorial and extendable local language under an unambiguous projection defines a shift of finite type as well, and therefore it must be a local language. Furthermore, the examples and the observations presented with this exposition show existence of languages with different degrees of ambiguity in REC and FREC. It is still an open question whether there exists a non frame-unambiguous language in FREC. An example of such language which is extendable and also

Framed Versus Unframed Two-Dimensional Languages

91

has the uniform mixing property (see [13]) would provide another contrast between one and two dimensional symbolic dynamical systems, because in one dimension, every sofic shift is a factor of an equal entropy shift of finite type [18]. A similar question for REC is also open.

Acknowledgments Authors would like to thank Jarkko Kari for initiating the discussion about differences between framed and unframed languages during the workshop “Advanced in Two-Dimensional Language Theory” in Salerno, Italy, in May 2005.

References 1. Anselmo, M., Madonia, M.: Deterministic two-dimensional languages over oneletter alphabet. In: Bozapalidis, S., Rahonis, G. (eds.) CAI 2007. LNCS, vol. 4728, pp. 147–159. Springer, Heidelberg (2007) 2. Anselmo, M., Madonia, M.: Deterministic and unambiguous two-dimensional languages over one-letter alphabet. In: TCS (to appear, 2008) 3. Anselmo, M., Giammarresi, D., Madonia, M.: From determinism to nondeterminism in recognizable two-dimensional languages. In: Harju, T., Karhum¨ aki, J., Lepist¨ o, A. (eds.) DLT 2007. LNCS, vol. 4588, pp. 36–47. Springer, Heidelberg (2007) 4. Anselmo, M., Giammarresi, D., Madonia, M., Restivo, A.: Unambiguous Recognizable two-dimensional languages. RAIRO: Theoretical Informatics and Applications 2, 227–294 (2006) 5. B´eal, M.P., Perrin, D.: Symbolic Dynamics and Finite Automata. In: Rozenberg, G., Salomaa, A. (eds.) Handbook of Formal Languages, ch. 10, vol. 2. Springer, Heidelberg (1997) 6. Berger, R.: The undecidability of the Domino Problem, Memoirs AMS n. 66 (1966) 7. Chrobak, M., Rytter, W.: Unique decipherability for partially commutative alphabets. In: Fundamenta Informaticae, vol. X, pp. 323–336. North-Holland, Amsterdam (1987) 8. Coven, E., Johnson, A., Jonoska, N., Madden, K.: The Symbolic Dynamics of Multidimensional Tiling Systems. Ergodic Theory and Dynamical Systems 23, 447– 460 (2003) 9. Eilenberg, S.: Automata, Languages and Machines, vol. A. Academic Press, London (1974) 10. Fichtner, I.: Characterizations of Recognizable Picture Series. Ph.D Thesis Universit¨ at Leipzig, Institut f¨ ur Informatik, Abteilung Automaten und Sprachen (2007), http://www.informatik.uni-leipzig.de/∼ maeurer/diss.pdf 11. Giammarresi, D., Restivo, A.: Recognizable picture languages. In: Nivat, M., Saoudi, A., Wang, P.S.P. (eds.) Proc. 1st Internat. Colloq. on Parallel Image Processing; Internat. J. Pattern Recognition Artif. Intell. 6, 231–256 (1992) 12. Giammarresi, D., Restivo, A.: Two-dimensional languages. In: Rozenberg, G., Salomaa, A. (eds.) Handbook of Formal Languages, vol. III, pp. 215–268. Springer, Berlin (1997) 13. Jonoska, N., Pirnot, J.B.: Transitivity in two-dimensional local languages defined by dot systems. International Journal of Foundations of Computer Science 17(2), 435–464 (2006)

92

M. Anselmo, N. Jonoska, and M. Madonia

14. Kari, J.: A small aperiodic set of Wang tiles. Discrete Mathematics 160(1-3), 259– 264 (1996) 2 15. Kitchens, B., Schmidt, K.: Markov subgroups of (Z/2Z)Z . In: Walters, P. (ed.) Symbolic Dynamics and its Applications. Contemporary Mathematics, vol. 135, pp. 265–283 (1992) 16. Kitchens, B., Schmidt, K.: Automorphisms of compact groups. Ergod. Th. & Dynam. Sys. 9, 691–735 (1989) 17. Kitchens, B.: Symbolic Dynamics. Springer, New York (1998) 18. Lind, D., Marcus, B.: An Introduction to Symbolic Dynamics and Coding. Cambridge University Press, Cambridge (1995) 19. Madden, K., Johnson, A.: Factoring Higher Dimensional Shifts of Finite Type onto the Full Shift. Ergodic Theory and Dynamical Systems 25, 811–822 (2005) 20. Meester, R., Steif, J.E.: Higher-dimensional subshifts of finite type, factor maps and measures of maximal entropy. Pacific J. Math. 200(2), 497–510 (2001) 21. Quas, A., Trow, P.: Subshifts of multi-dimensional shifts of finite type. Ergodic Theory Dynam. Systems 20, 859–874 (2000) 22. Robinson, R.: Undecidability and Nonperiodicity of Tilings of the Plane. Inventiones Math. 12, 177–209 (1971)

Approximating Tree Edit Distance through String Edit Distance for Binary Tree Codes Taku Aratsu1 , Kouichi Hirata1 , and Tetsuji Kuboyama2 1

Department of Artificial Intelligence, Kyushu Institute of Technology Kawazu 680-4, Iizuka 820-8502, Japan {aratsu,hirata}@dumbo.ai.kyutech.ac.jp 2 Computer Center, Gakushuin University Mejiro 1-5-1, Toshima, Tokyo 171-8588, Japan [email protected]

Abstract. In this paper, we give an approximation of the tree edit distance through the string edit distance for binary tree codes, instead of one for Euler strings introduced by Akutsu (2006). Here, a binary tree code is a string obtained by traversing a binary tree representation with two kinds of dummy nodes of a tree in preorder. Then, we show that σ/2 ≤ τ ≤ (h + 1)σ + h, where τ is the tree edit distance between trees, σ is the string edit distance between their binary tree codes and h is the minimum height of the trees.

1

Introduction

It is one of the important tasks for data mining from tree-structured data such as HTML and XML data in web mining or RNA and glycan data in bioinformatics to introduce a similarity measure between two rooted ordered labeled trees (trees, for short), and compare them based on the similarity measure. The most famous similarity measure between trees is the tree edit distance [4,12]. While the tree edit distance is a metric, computing the tree edit distance is inefficient; The tree edit distance can be computed in O(n3 ) time [5]. In order to overcome such inefficiency and approximate the tree edit distance, many similarity measures between trees have been developed. In particular, the leaf histogram, the degree histogram and the label histogram [7], the binary branch (under the binary tree representation) [11] and the sibling distance [3] have been formulated as the similarly measures with constant factor lower bounds on the tree edit distance. Since it is sufficient to traverse a tree just once and not necessary to use dynamic programming, all of them can be computed in O(n) time. However, since none of them is a metric, they cannot have any upper bounds on the tree edit distance. Furthermore, Garofalakis and Kumar [6] have developed an algorithm for efficient embedding trees and, given both lower and 

This work is partially supported by Grand-in-Aid for Scientific Research 19300046 and 20500126 from the Ministry of Education, Culture, Sports, Science and Technology, Japan.

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 93–104, 2009. c Springer-Verlag Berlin Heidelberg 2009 

94

T. Aratsu, K. Hirata, and T. Kuboyama

upper bounds on the tree edit distance with move, which is different from the standard tree edit distance. Recently, Akutsu [1] has first introduced an approximation of the (standard) tree edit distance through the string edit distance, which can be computed in O(n2 ) time, between Euler strings of trees. Also Akutsu et al. [2] have developed this work by using a modified Euler string. Both of them have given not only a constant factor lower bound but also an upper bound on the tree edit distance. Let τ (T1 , T2 ) denote the tree edit distance between trees T1 and T2 and σ(s1 , s2 ) the string edit distance between strings s1 and s2 . For a tree T , let s(T ) and s (T ) be an Euler string and a modified Euler string of T , respectively. Then, the following two sequences hold, where h is the minimum height and n is the minimum number of nodes of T1 and T2 . σ(s(T1 ), s(T2 )) ≤ τ (T1 , T2 ) ≤ (2h + 1)σ(s(T1 ), s(T2 )) [1], 2   σ(s (T1 ), s (T2 )) ≤ τ (T1 , T2 ) ≤ O(n0.75 )σ(s (T1 ), s (T2 )) [2]. 6 In this paper, we give another approximation of the tree edit distance through the string edit distance. Instead of an Euler string or a modified Euler string, we adopt a binary tree code based on the modified version of binary tree representations [8,9,11]. For a tree T and a node v ∈ T , the binary tree representation b(T ) of T is a binary tree constructed by setting the first child of v in T as the left child of v in b(T ) and the next sibling of v in T as the right child of v in b(T ). In this paper, we introduce two kinds of dummy nodes, ⊥ and ; ⊥ is the left child of v in b(T ) if v in T has no children, and  is the right child of v in b(T ) if v in T has no right siblings. For such a binary tree representation b(T ) of T , we define the binary tree code bc(T ) of T as the string of labels obtained by traversing b(T ) in preorder. Then, we show the following approximation result of the tree edit distance τ (T1 , T2 ) through the string edit distance σ(bc(T1 ), bc(T2 )). σ(bc(T1 ), bc(T2 )) ≤ τ (T1 , T2 ) ≤ (h + 1)σ(bc(T1 ), bc(T2 )) + h. 2 This paper is organized as follows. In Section 2, we prepare the notions necessary for the later discussion. In Section 3, we introduce a binary tree representation with two dummy nodes ⊥ and  and a binary tree code, and then show several properties of the binary tree code. In Section 4, we show the lower and upper bounds on the tree edit distance between trees through the string edit distance between their binary tree codes as stated above. The proof of the upper bound is motivated by Akutsu [1]. Finally, in Section 5, we discuss the difference between our result and Akutsu’s one [1] in more detail.

2

String Edit Distance and Tree Edit Distance

In this section, we introduce both string edit distance and tree edit distance.

Approximating Tree Edit Distance through String Edit Distance

95

Let Σ be a finite set as an alphabet. For string s ∈ Σ and an integer i, s[i] denotes the i-th character of s and |s| denotes the length of s. An edit operation on strings is one of a deletion, a insertion or a substitution of a character of s. The edit distance between two strings, s1 and s2 and is defined as the minimum number of operations to transform s1 to s2 and denoted by σ(s1 , s2 ). We also define an alignment of two strings. An alignment between s1 and s2 is obtained by inserting gap symbol (denoted by ‘−’ where − ∈ Σ) into or at either end of s1 and s2 such that the resulting strings s1 and s2 are of the same length l, where it is not allowed for each i (1 ≤ i ≤ l) that both s1 [i] and l  f (s1 [i], s2 [i]), where s2 [i] are gap symbols. The cost of alignment is given as i=1

f (x, y) = 0 if x = y = −; f (x, y) = 1 otherwise. Then, an optimal alignment is an alignment with the minimum cost. It is straightforward that the cost of an optimal alignment is equal to the edit distance. Next, we define edit distance between trees, where we deal with just unit cost case. See [4] in more detail. A tree is a connected graph without cycles. A rooted tree is a tree with one node r chosen as its root . A tree T is ordered if a left-to-right order among siblings in T is given. A tree T is labeled if each node is assigned a symbol from Σ. In this paper, we call a rooted ordered labeled tree a tree simply. For a tree T = (V, E), we sometimes denote v ∈ T instead of v ∈ V , |T | instead of |V |, and V (T ) instead of V . Also we sometimes identify a node with its label. Furthermore, for v ∈ T , T (v) is a subtree of T of which root is v and that contains all descendants of v. An edit operations on trees is one of a deletion, an insertion or a substitution, where each operation is defined as follows. (See Figure 1.) 1. Substitution: Change the label of the node v in T . 2. Deletion: Delete a non-rooted node v in T with parent v  , making the children of v become the children of v  . The children are inserted in the place of v as a subsequence in the left-to-right order of the children of v  . 3. Insertion: The complement of deletion. Insert a node v as a child of v  in T making v the parent of a consecutive subsequence of the children of v  . The edit distance between two trees T1 and T2 is defined as the minimum number of operations to transform T1 to T2 , and denoted by τ (T1 , T2 ). It is known that there exists a close relationship between the edit distance and the ordered edit distance mapping (mapping, for simply) [4]. An M ⊆ V (T1 ) × V (T2 ) is called a mapping if the following conditions are satisfied for every pair (v1 , w1 ), (v2 , w2 ) ∈ M . (i) v1 = v2 iff w1 = w2 ; (ii) v1 is an ancestor of v2 iff w1 is an ancestor of w2 ; (iii) v1 is to the left of v2 iff w1 is to the left of w2 . It is well known that the mapping M maximizing id (M ) corresponds to the edit distance, for which τ (T1 , T2 ) = |T1 | + |T2 | − |M | − id (M ). Finally, a mapping M ⊆ V (T1 ) × V (T2 ) is a bottom-up mapping [10] if, for every pair (v, w) ∈ M , (i) for every v  ∈ T1 (v), there exists w ∈ T2 (w) such

96

T. Aratsu, K. Hirata, and T. Kuboyama

v

w

→

Substitution v v

v

→

Deletion

v v

v

→

Insertion

Fig. 1. Edit operations on trees

that (v  , w ) ∈ M and (ii) for every w ∈ T2 (w), there exists v  ∈ T1 (v) such that (v  , w ) ∈ M . The bottom-up mapping between two trees is the common complete subforest between two trees if labels are ignored.

3

Binary Tree Code

In this section, we formulate the modified version of a binary tree representation of a tree [8,9,11] with two kinds of dummy nodes. Then, we introduce a binary tree code of a tree as a string obtained by traversing the binary tree representation of a tree in preorder. Definition 1 (binary tree representation). Let T be a tree with the root r. Then, a binary tree representation b(T ) of T is a binary tree obtained by setting, for v ∈ T − {r}, the first child of v in T (or ⊥ if there does not exist) as the left child of v in b(T ) and the next sibling of v in T (or  if there does not exist) as the right child of v in b(T ). In particular, if v is the root r of T , then r is also the root of b(T ) and has just a left child. For a tree T , the string of nodes in T obtained by traversing in preorder denotes c(T ). Definition 2 (binary tree code). Let T be a tree. Then, the binary tree code of T is the string c(b(T )), and we denote it by bc(T ). Example 1. Consider trees T1 and T2 in Figure 2 (upper). Then, the binary tree representation of Ti is described as Figure 2 (lower). Hence, we obtain the binary tree code bc(Ti ) of Ti as follows. bc(T1 ) = aba⊥b⊥a⊥cbba⊥b⊥a⊥, bc(T2 ) = aaba⊥b⊥ca⊥bba⊥b⊥a⊥.

Approximating Tree Edit Distance through String Edit Distance a

a

a

a

b b

c

a a

b

a

c a

b a

b

⊥

b a

b

a

b

a a

⊥

b

⊥

⊥

a 

b ⊥

a 

b a

c

b c

⊥ 

b

T2

a

b

a

b

b

T1

a

97

⊥

a

 b

⊥

⊥ 

⊥ 

b(T1 )

b a

b a







⊥



b ⊥



b(T2 )

Fig. 2. A tree Ti (upper) and a binary tree representation b(Ti ) of Ti (lower) for i = 1, 2 in Example 1

Lemma 1. It holds that |b(T )| = |bc(T )| = 2|T |. Proof. It is sufficient to show that the number of dummy nodes in b(T ) is |T |. If |T | = 1, that is, T is a tree consisting of just a root r, then the statement is obvious, because the root r in b(T ) has just a left child ⊥. Suppose that the statement holds for |T | < n and consider the case that |T | = n. Let T be a tree with the root r, and suppose that r has children v1 , . . . , vm in T . By induction hypothesis, the number of dummy nodes in b(T (vi )) is |T (vi )| for 1 ≤ i ≤ m. Since vi is the root of b(T (vi )), vi in b(T (vi )) has just left child called a vi (which is the first child of vi in T (vi )). Then, by the definition of b(T ), the left child of vi in b(T ) is vi for 1 ≤ i ≤ m, the right child of vi in b(T ) is vi+1 for 1 ≤ i ≤ m − 1, and the right child of vm in b(T ) is . Also the root r in b(T ) has just the left child v1 and no dummy node. Then, the number of dummy nodes in b(T ) is |T (v1 )| + · · · + |T (vm )| + 1 = |T |, so the statement holds.  Lemma 2. The binary tree code bc(T ) can be constructed from a tree T in O(|T |) time. Conversely, the tree T can be constructed from a binary tree code bc(T ) in O(|T |) time.

98

T. Aratsu, K. Hirata, and T. Kuboyama

Proof. The first statement is obvious because b(T ) and bc(T ) can be constructed in O(|T |) time from T and b(T ), respectively. Then, we show the second statement. Let Σ be the set of all labels of nodes, where ⊥,  ∈ Σ. Then, for a binary tree code c, we can construct the tree S by scanning c from left to right as follows. Let a be a current word in c and p a current node in S, where an initial tree of S is empty. 1. First, we set a to the root of S and p to a. 2. If a ∈ Σ, then we set a to the rightmost child of p in S and update p to a. 3. If a ∈ {⊥, }, then we update p to the parent of p in S. Since c is a preorder traversal of b(T ), it is obvious that, if c = bc(T ), then it holds that S = T . Furthermore, the above construction runs in O(|T |) time.  Lemma 3. For trees T1 and T2 , it holds that τ (T1 , T2 ) = 0 iff bc(T1 ) = bc(T2 ). Proof. By the definition of bc(T ) and by the proof of Lemma 2, it holds that  bc(T1 ) = bc(T2 ) iff T1 = T2 , so the statement holds. Lemma 4. Let be a substring relation. For a binary tree code bc(T ), we can decode a subtree of T from bc(T ) inductively as follows. 1. a⊥ bc(T ) is a subtree of T . In this case, a is a leaf of T . 2. If s1 , . . . , sk bc(T ) are subtrees in T , then as1 · · · sk  bc(T ) is a subtree of T . Proof. Let T be a tree and bc(T ) a binary tree code of T . Also let Σ be the set of all labels of nodes in T . By Definition 2, ⊥ represents some node v in T has no children. Since bc(T ) is the preorder traversal of b(T ), v is corresponding to the previous symbol in Σ to ⊥ in bc(T ), so the statement 1 holds. On the other hand, by Definition 2,  represents some node v in T has no right siblings, so the parent v  of v in T is the root of some subtree of T . Since bc(T ) is the preorder traversal of b(T ), v  is corresponding to the nearest left symbol in Σ except subtrees of T to  in bc(T ), so the statement 2 holds.  Example 2. Consider the binary tree codes bc(T1 ) and bc(T2 ) in Example 1. Then, the underlined substring in bc(Ti ) is a subtree of Ti according to the decoding in Lemma 4. bc(T1 ) = a b a⊥ b⊥ a⊥ c b b a⊥ b⊥ a⊥, bc(T2 ) = a a b a⊥ b⊥ c a⊥ b b a⊥ b⊥ a⊥.

4

Lower and Upper Bounds on Tree Edit Distance

In this section, we investigate the approximation of the tree edit distance between trees through the string edit distance between their binary tree codes. Throughout of this section, let T1 and T2 be trees. First, we show the lower bound on τ (T1 , T2 ) for σ(bc(T1 ), bc(T2 )).

Approximating Tree Edit Distance through String Edit Distance

99

r v0

r v0

vl

vr

v v1

vn

vl

v1

T1

vn

vr

T2

r

r

r r

s1

s1

vl

s3

vl u

v

v1

u s2

s3

v

v1

v1

v1

vr

vr

v2

s2

v2

v2

v2

c(B1 (vr ))

c(B1 (vr ))

vn

vn

vn

vr

vn

vr





c(B1 (vr ))

c(B1 (vr ))

b(T1 )

b(T1 )

b(T2 )

b(T2 ) (vl exists)

(vl does not exist)

Fig. 3. T1 and T2 (upper) and b(T1 ) and b(T2 ) (lower) in the proof of Theorem 1

Theorem 1. It holds that σ(bc(T1 ), bc(T2 )) ≤ 2τ (T1 , T2 ). Proof. It is sufficient to show that σ(bc(T1 ), bc(T2 )) changes at most 2 when an edit operation is applied. (1) Substitution: Suppose that T2 is obtained from T1 by changing a label u ∈ T1 into a label v ∈ T2 . Then, it is obvious that σ(bc(T1 ), bc(T2 )) = 1. (2) Deletion: Suppose that T2 is obtained from T1 by deleting a node v ∈ T1 , where the root of T1 is r. Let v0 be the parent of v in T1 and v1 , . . . , vn the children of v in T1 . See Figure 3 (upper). Also let B1 denote b(T1 ). Note that the right child of vn in B1 is . Then, the last element of c(B1 (v1 )) is , so we denote the string by deleting  in the last of c(B1 (v1 )) by c− (B1 (v1 )). Also let “·” denote the string concatenation. Suppose that the left sibling vl of v exists in T1 . Then, b(T1 ) and b(T2 ) are described as Figure 3 (lower left), so bc(T1 ) and bc(T2 ) are of the following forms, where s1 is a binary tree code from r to vl , that is, the string obtained by deleting

100

T. Aratsu, K. Hirata, and T. Kuboyama

c(B1 (vl )) from c(B1 )(= bc(T1 )) and s2 is c(B(u)) for the first child u of vl in T1 (or an empty string if such an u does not exist). bc(T1 ) = s1 vl s2 v · c(B1 (v1 )) · c(B1 (vr )), bc(T2 ) = s1 vl s2 · c− (B1 (v1 )) · c(B1 (vr )). Suppose that no left sibling (vl ) of v exists in T1 . Then, b(T1 ) and b(T2 ) are described as Figure 3 (lower right), so bc(T1 ) and bc(T2 ) are of the following forms, where s3 is a binary tree code from r to v, that is, the string obtained by deleting c(B1 (v)) from c(B1 ). bc(T1 ) = s3 v · c(B1 (v1 )) · c(B1 (vr )), bc(T2 ) = s3 · c− (B1 (v1 )) · c(B1 (vr )). In both cases, if no right sibling (vr ) of v exists in T1 , then c(B1 (vr )) in bc(Ti ) is . Hence, it holds that σ(bc(T1 ), bc(T2 )) = 2 when a deletion is applied.  Next, we show the upper bound on τ (T1 , T2 ) for σ(bc(T1 ), bc(T2 )). In the following, we use the similar notions given by Akutsu [1]. Let (bc(T1 ) , bc(T2 ) ) be an alignment giving from σ(bc(T1 ), bc(T2 )). Also let MSP and MSSP be the following sets of pairs obtained from the alignment (bc(T1 ) , bc(T2 ) ). 1. MSP is the set {(p11 , p12 ), . . . , (pd1 , pd2 )} of maximal substring pairs, each of which is corresponding to a maximal consecutive region in (bc(T1 ) , bc(T2 ) ) without insertions, deletions or substitutions. 2. MSSP is the set {(t11 , t12 ), . . . , (tb1 , tb2 )} of maximal subtree string pairs, each of which is corresponding to a maximal subtree of Ti by decoding bc(Ti ) in Lemma 4. Example 3. Consider binary tree codes bc(T1 ) and bc(T2 ) in Example 1 (and also Example 2). Then, we obtain MSP = {(pi1 , pi2 ) | i = 1, 2, 3} and MSSP = {(ti1 , ti2 ) | i = 1, 2, 3, 4} as follows. 

p11



t11



p21

 t21



p31

t31



t41



        a⊥ c bba⊥b⊥ a⊥ , bc(T1 ) = a ba⊥b⊥ a⊥ bba⊥b⊥ a⊥  . bc(T2 ) = a a ba⊥b⊥   c     

t12

 p12



t22

 p22



t32



t42

p32



Note that MSSP is determined uniquely from the alignment (bc(T1 ) , bc(T2 ) ). For an MSSP , we construct the mapping M from the nodes in ti1 to ones in ti2 (with ignoring ⊥ and ). Lemma 5. M is a bottom-up mapping between T1 and T2 . Proof. It is straightforward.



Approximating Tree Edit Distance through String Edit Distance

101

Lemma 6. If |MSP | = d, then it holds that d ≤ σ(bc(T1 ), bc(T2 )) + 1. Proof. Let MSP be {(p11 , p12 ), . . . , (pd1 , pd2 )}. Then, there exist at least d − 1 gaps in the alignment (bc(T1 ) , bc(T2 ) ). Hence, it holds that d−1 ≤ σ(bc(T1 ), bc(T2 )), so the statement holds.  Let REST (pji ) be the total number of positions in substring pji that do not appear in MSSP . Also let h be the minimum height of T1 and T2 . Lemma 7. For every pji , it holds that REST (pji ) ≤ h. Proof. Let Ph+1 be a path a0 · · · ah with hight h (h + 1 nodes), where the root is a0 . Then, it holds that bc(Ph+1 ) = a0 · · · ah ⊥ · · · . Consider the case that pji = a0 · · · ah ⊥ and tli = ah ⊥ (for some 1 ≤ l ≤ b). Then, no substring of pji except tli is decoded as a subtree of Ph+1 , so it holds that REST (pji ) = h, which  is the worst case for REST (pji ). Lemma 8. Let k be σ(bc(T1 ), bc(T2 )). Then, it holds that

d  j=1

|pji | ≥ 2|Ti | − k.

Proof. By Lemma 1, it holds that |bc(Ti )| = 2|Ti | and the length of bc(Ti ) is the sum of |bc(Ti )| and the number of gaps. Since k(= σ(bc(T1 ), bc(T2 ))) is greater d  than the number of gaps, which is 2|Ti | − |pji |, the statement holds.  j=1

Theorem 2. Let h be the minimum height of T1 and T2 . Then, it holds that τ (T1 , T2 ) ≤ (h + 1)σ(bc(T1 ), bc(T2 )) + h. Proof. Let M be a bottom-up mapping as Lemma 5. Then, M is corresponding to the elements of tl1 and tl2 . Also let k be σ(bc(T1 ), bc(T2 )). For pji (1 ≤ j ≤ d), the number of positions assigned by M is at least |pji | − REST (pji ), and also at least |pji | − h by Lemma 7. Then, the following sequence holds for i = 1, 2. |M| ≥

d d   (|pji | − h) = |pji | − dh j=1

≥

d  j=1

j=1

|pji | − h(k + 1)

(by Lemma 6)

≥ 2|Ti | − k − h(k + 1) (by Lemma 8) = 2|Ti | − k(h + 1) − h. Hence, the following sequence holds. τ (T1 , T2 ) ≤ |T1 | + |T2 | − |M| − id (M) = |T1 | + |T2 | − 2|M| ≤ |T1 | + |T2 | − (2|T1 | + 2|T2 | − 2k(h + 1) − 2h) = −|T1 | − |T2 | + 2k(h + 1) + 2h. Since τ (T1 , T2 ) ≤ |T1 | + |T2 |, it holds that 2τ (T1 , T2 ) ≤ 2k(h + 1) + 2h, which  implies that τ (T1 , T2 ) ≤ (h + 1)k + h.

102

T. Aratsu, K. Hirata, and T. Kuboyama a

a c

b a

b a

d c

b a

b

a

d

a

d c

b

c

a

d

c

b

d

d

c

T1

T2 a a

b

b a

c

b

d

a

d

b

d

a ⊥

c d

⊥

⊥

⊥

⊥ 

⊥

⊥

d

⊥

c

a



c

b

 a

 ⊥

d d

⊥

⊥

⊥









c ⊥

b(T1 )



b

⊥





a



b(T2 )

Fig. 4. Trees Ti (upper) and binary tree representations b(Ti ) of Ti (lower) for i = 1, 2 in Example 4, where h = 6 and m = 3

Example 4. Consider trees T1 and T2 in Figure 4 (upper), where we assume that the hight h is 2m for simplicity. Then, b(T1 ) and b(T2 ) are described as Figure 4 (lower), so it holds that: bc(T1 ) = (ab)m a⊥(d⊥c⊥)m = (ab)m a⊥d⊥(c⊥d⊥)m−1 c⊥, m m−1 c⊥ = (ab)m a⊥d⊥ (c⊥d⊥)m−1 c⊥. bc(T2 ) = (ab) a⊥d⊥(c⊥d⊥)

Then, it holds that σ(bc(T1 ), bc(T2 )) = 2. On the other hand, it holds that τ (T1 , T2 ) = h = Θ(h). Hence, the upper bound of Theorem 2 is tight. By incorporating Theorem 1 with Theorem 2, we obtain the following main theorem of this paper. Theorem 3. Let h be the minimum height of T1 and T2 . Then, it holds that: σ(bc(T1 ), bc(T2 )) ≤ τ (T1 , T2 ) ≤ (h + 1)σ(bc(T1 ), bc(T2 )) + h. 2

5

Discussion

The approximation shown in Theorem 3 is slightly tighter than the following approximation of the tree edit distance through the string edit distance for Euler strings [1], where s(T ) is an Euler string of a tree T .

Approximating Tree Edit Distance through String Edit Distance

103

a a

a

b b

b

b

b

T1

b

b

T2

b b

e(T1 ) = e(T2 )

Fig. 5. Trees Ti (left) and the extended 2-ranked tree e(Ti ) of Ti (right) for i = 1, 2

σ(s(T1 ), s(T2 )) ≤ τ (T1 , T2 ) ≤ (2h + 1)σ(s(T1 ), s(T2 )). 2 It is obvious that we can rewrite (h + 1)σ(bc(T1 ), bc(T2 )) + h in Theorem 3 as (2h + 1)σ(bc(T1 ), bc(T2 )). On the other hand, we cannot improve (2h + 1)σ(s(T1 ), s(T2 )) to (h + 1)σ(s(T1 ), s(T2 )) + h, because of the upper bound on REST (pji ); It holds that REST (pji ) ≤ h for binary tree codes (Lemma 7), while it holds that REST (pji ) ≤ 2h for Euler strings [1]. This also implies a simpler tight example of the upper bound on the tree edit distance (Example 4) than one given in [1]. On the other hand, by using two dummy nodes  and ⊥ in binary tree codes, we can determine the subtrees as substrings of the binary tree code (Lemma 4). The dummy nodes  and ⊥ work as traversing down a and up a for a label a in Euler strings, respectively. Hence, we can construct bottom-up mapping from the binary tree codes (Lemma 5), and then give the approximation result according to the similar proof of [1]. The researches of tree similarity based on binary tree representation have been developed as [9,11]. In particular, Magniez and de Rougemont [9] have introduced a binary tree representation e(T ) without dummy nodes ⊥ and  in this paper, called an extended 2-ranked tree, and shown that τmv (e(T1 ), e(T2 )) ≤ 3τmv (T1 , T2 ), where τmv is a tree edit distance with moves. They also have pointed out that τmv (T1 , T2 ) ≤ 3τmv (e(T1 ), e(T2 )), but we can give trees T1 and T2 as a counterexample such that τmv (T1 , T2 ) = 1 > 0 but τmv (e(T1 ), e(T2 )) = 0 as Figure 5. Then, it is necessary for dummy nodes to give the upper bound on the tree edit distance with moves. It is a future work to investigate the relation between the tree edit distance with moves and the string edit distance for binary tree codes.

References 1. Akutsu, T.: A relationship between edit distance for ordered trees and edit distance for Euler strings. Inform. Proc. Let. 100, 105–109 (2006) 2. Akutsu, T., Fukagawa, D., Takasu, A.: Approximating tree edit distance through string edit distance. In: Asano, T. (ed.) ISAAC 2006. LNCS, vol. 4288, pp. 90–99. Springer, Heidelberg (2006)

104

T. Aratsu, K. Hirata, and T. Kuboyama

3. Aratsu, T., Hirata, K., Kuboyama, T.: Sibling distance for rooted ordered trees. In: Proc. ALSIP 2008, Working Notes of PAKDD Workshops, pp. 101–112 (2008) 4. Bille, P.: A survey on tree edit distance and related problems. Theoret. Comput. Sci. 337, 217–239 (2005) 5. Demaine, E.D., Mozes, S., Rossman, B., Weimann, O.: An optimal decomposition algorithm for tree edit distance. In: Arge, L., Cachin, C., Jurdzi´ nski, T., Tarlecki, A. (eds.) ICALP 2007. LNCS, vol. 4596, pp. 146–157. Springer, Heidelberg (2007) 6. Garofalakis, M., Kumar, A.: XML stream processing using tree-edit distance embedding. ACM Trans. Database System 30, 279–332 (2006) 7. Kailing, K., Kriegel, H.-P., Sch¨ onauer, S., Seidl, T.: Efficient similarity search for hierarchical data in large databases. In: Bertino, E., Christodoulakis, S., Plexousakis, D., Christophides, V., Koubarakis, M., B¨ ohm, K., Ferrari, E. (eds.) EDBT 2004. LNCS, vol. 2992, pp. 676–693. Springer, Heidelberg (2004) 8. Knuth, D.E.: The art of computer programing, 3rd edn. Fundamental algorithms, vol. 1. Addison-Wesley, Reading (1997) 9. Magniez, F., de Rougemont, M.: Property testing of regular tree languages. Algorithmica 42, 127–146 (2007) 10. Valiente, G.: An efficient bottom-up distance between trees. In: Proc. SPIRE 2001, pp. 212–219 (2001) 11. Yang, R., Kalnis, P., Tung, A.K.H.: Similarity evaluation on tree-structed data. In: Proc. SIGMOD 2005, pp. 754–765 (2005) 12. Zhang, K., Shasha, D.: Simple fast algorithms for the editing distance between trees and related problems. SIAM J. Comput. 18, 1245–1262 (1989)

The Shortcut Problem – Complexity and Approximation Reinhard Bauer1 , Gianlorenzo D’Angelo2, Daniel Delling1 , and Dorothea Wagner1 1

2

Faculty of Informatics, Universit¨at Karlsruhe (TH) {rbauer,delling,wagner}@informatik.uni-karlsruhe.de Department of Electrical and Information Engineering, University of L’Aquila [email protected]

Abstract. During the last years, speed-up techniques for D IJKSTRA’s algorithm have been developed that make the computation of shortest paths a matter of microseconds even on huge road networks. The most sophisticated methods enhance the graph by inserting shortcuts, i.e. additional edges, that represent shortest paths in the graph. Until now, all existing shortcut-insertion strategies are heuristics and no theoretical results on the topic are known. In this work, we formalize the problem of adding shortcuts as a graph augmentation problem, study the algorithmic complexity of the problem, give approximation algorithms and show how to stochastically evaluate a given shortcut assignment on graphs that are too big to evaluate it exactly.

1 Introduction Computing shortest paths in graphs is used in many real-world applications like routeplanning in road networks or for finding good connections in railway timetable information systems. In general, D IJKSTRA’s algorithm computes a shortest path between a given source and a given target. Unfortunately, the algorithm is slow on huge datasets. Therefore, it cannot be directly used for applications like car navigation systems or online working route-planners that require an instant answer of a source-target query. Often, this problem is coped with by dividing the computation of the shortest paths into two stages. In the offline stage, some data is precomputed that is used in the online stage to answer a query heuristically faster than D IJKSTRA’s algorithm. Such an algorithm is called a speed-up technique. During the last years, speed-up techniques have been developed for road networks (see [17,21] for an overview), that make the shortest path computation a matter of microseconds [5] even on huge road networks consisting of millions of nodes and edges. One core part of many of these speed-up techniques is the insertion of shortcuts [4,6,9,10,11,13,16,18,19,20], i.e. additional edges (u, v) whose length is the distance from u to v and that represent shortest u-v-paths in the graph. The strategies of assigning the shortcuts and of exploiting them during the query differ depending on the speed-up technique. Until now, all existing shortcut insertion strategies are heuristics and no theoretical worst-case or average case results are known. 

Partially supported by the Future and Emerging Technologies Unit of EC (IST priority – 6th FP), under contract no. FP6-021235-2 (project ARRIVAL) and the DFG (project WAG54/16-1).

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 105–116, 2009. c Springer-Verlag Berlin Heidelberg 2009 

106

R. Bauer et al.

All speed-up techniques that use shortcuts have one point in common. The shortcuts reduce the search space which corresponds to reducing the number of edges in a shortest path in the graph. Therefore, it seems reasonable to insert shortcuts in a manner that minimizes the average number of edges of a shortest path in the graph but keeps the space occupancy low. In this work we formalize this idea by defining the S HORTCUT P ROBLEM (SP) and give a theoretical study of the complexity of the problem. In particular, the arc-flag method [14] can easily be enriched by externally computed shortcuts. Therefore, considering SP independent from a specific speed-up technique can lead to a reversed process: first compute shortcuts according to SP and then apply a speed-up technique on the resulting graph. SHARC-Routing, a sophisticated variant of arc-flags, already uses externally computed shortcuts. Therefore, we consider it as a strong candidate to benefit from that approach (details in [4]). Finally, besides its relevance as a first step at all towards theoretical results on speed-up techniques, we consider the problem to be interesting on its own. To the best of our knowledge, the problem of finding shortcuts as stated in this work has never been treated before. Speed-up techniques that incorporate the usage of shortcuts are the following. Given a graph G = (V, E) the multi-level overlay graph technique [6,13,18,19,20] uses some centrality measures or separation strategies to choose a set of important nodes V  on the graph and sets the shortcuts S such that the graph (V  , S) is edge minimal among all graphs (V  , E  ) for which the distances between nodes in V  are the same in (V, E) and (V  , E  ). Highway hierarchies [16] and reach based pruning [10,11] iteratively sparsificate the graph according to the importance of the nodes. After each sparsification step, nodes v with small in- and out-degree are deleted and for (nearly) each pair of edges (u, v), (v, w) a shortcut (u, w) is inserted. SHARC-Routing [4] and Contraction Hierarchies [9] use a similar strategy. This paper is organized as follows. Section 2 introduces basic definitions. The S HORTCUT P ROBLEM and the R EVERSE S HORTCUT P ROBLEM are stated in Section 3. Furthermore results concerning complexity and non-approximability of the problems are given. Two approximation algorithms of SP that work on a special graph class and the corresponding worst-case bounds are reported in Section 4. A stochastical approach to evaluate a given solution of SP is introduced in Chapter 5. Our work is concluded by a summary and possible future work in Section 6. Some proofs in the paper have been omitted due to space restrictions. The full version containing all proofs can be found here [3].

2 Preliminaries Throughout the work G = (V, E, len) denotes a directed, weighted, graph with n nodes, m edges and positive length function len : E → + . Given a node v, N(v) denotes the set of neighbors of v, that is the set of nodes u ∈ V such that (u, v) ∈ E or (v, u) ∈ E. Given  a set S of nodes, the neighborhood of S is the set S ∪ u∈S N(u). A path P from x1 to xn in G is a finite sequence x1 , x2 , . . . , xn of nodes such that (xi , xi+1 ) ∈ E, i = 1, . . . , n − 1. The length of a path P in G is the sum of the length of all edges in P. A shortest path between nodes s and t is a path from s to t with minimum length. By P(s,t) we denote the set of all shortest s-t-paths. The hop-length |P| of a path P in G is the number of

The Shortcut Problem – Complexity and Approximation

107

edges in P. Given two nodes s,t the distance dist(s,t) from s to t is the length of a shortest path between s and t, while the hop-distance h(s,t) from s to t is the hop-length of a hop-minimal shortest path between s and t. The diameter of a graph is the length of the longest distance in G. The reverse graph G = (V, E, len) is the one obtained from G by substituting each (u, v) ∈ E by (v, u) and by defining len(v, u) = len(u, v). The eccentricity εG (v) of a node v is the maximum distance between v and any other node u of G. A shortcut is an edge (u, v) such that len(u, v) = dist(u, v). The notation G = (V, E ∪  E , len ) indicates a supergraph of G with shortcuts E  whereas len : E ∪ E  → + is such that len (u, v) equals dist(u, v) if (u, v) ∈ E  and equals len(u, v) otherwise. Further, h (s,t) denotes the hop-distance from s to t in G .

3 Problem Complexity In this section, we introduce the S HORTCUT P ROBLEM and the R EVERSE S HORTCUT P ROBLEM. We show that both problems are NP-hard. Moreover, there exists no polynomial time constant factor approximation algorithm for the R EVERSE S HORTCUT P ROBLEM and no polynomial time algorithm that approximates the S HORTCUT P ROB LEM up to an additive constant unless P = NP. Finally, we identify a critical parameter of the S HORTCUT P ROBLEM and discuss some monotonicity properties of the problem. The S HORTCUT P ROBLEM consists of adding a number c of shortcuts to a graph, such that the sum of the hop lengths of hop-minimal shortest paths on the graph becomes minimal. Definition 1 (S HORTCUT P ROBLEM (SP)). Given a graph G = (V, E, len), a positive integer c ∈ , find a graph G = (V, E ∪ E  , len ) such that |E  | ≤ c and



w(E  ) :=

∑

h(s,t) −

s,t∈V

∑

h (s,t)

s,t∈V

is maximal, whereas len : E ∪ E  → + equals dist(u, v) if (u, v) ∈ E  , equals len(u, v) otherwise, h(s,t) denotes the hop distance in (V, E) and h (s,t) denotes the hop distance in (V, E ∪ E  ). We call w(E  ) the decrease in overall hop length. The R EVERSE S HORTCUT P ROBLEM (RSP) is the variant of Definition 1 for which the decrease in overall hop length w(E  ) must be at least a given value k and the objective is to minimize |E  |. Definition 2 (R EVERSE S HORTCUT P ROBLEM (RSP)). Given a graph G = (V, E, len), a positive integer k ∈ , find a graph G = (V, E ∪ E  , len ) such that



w(E  ) :=

∑

s,t∈V

h(s,t) −

∑

h (s,t) ≥ k

s,t∈V

and |E  | is minimal, whereas len : E ∪ E  → + equals dist(u, v) if (u, v) ∈ E  , equals len(u, v) otherwise, h(s,t) denotes the hop distance in (V, E) and h (s,t) denotes the hop distance in (V, E ∪ E  ).

108

R. Bauer et al.

In order to show the complexity of the problems we make a transformation from M IN S ET C OVER. Definition 3 (M IN S ET C OVER). Given a collection C of subsets of a finite set U find a minimum cardinality set cover of U, i.e. a subset C of C such that every element in U belongs to at least one member of C and that |C | is minimal. Given an instance I = (C,U) of M IN S ET C OVER we construct an instance I  = (G, k) of RSP the following way (see Figure 1 for a visualization): we denote by Δ the value 2|C| + 1. We introduce a node s to G. For each ui ∈ U, we introduce a set of nodes Ui = {ui1 , . . . , uiΔ } to G. For each Ci in C, we introduce nodes Ci− , Ci+ and edges (Ci− ,Ci+ ), (Ci+ , s) to G. The graph furthermore contains, for each ui ∈ U and each C j ∈ C with ui ∈ C j , the edges (uir ,C− j ), r = 1, . . . , Δ . All edges are directed and have length 1. Finally we set k to be Δ · |U|. The transformation is polynomial. u1r

u2r

| u|U r

u3r ...

C1−

C2−

C3−

...

C1+

C2+

C3+

...

− C|C| + C|C|

s

Fig. 1. Instance I  after the transformation from M IN S ET C OVER (edges of the form (ur ,C− j ) are not drawn as they depend on the instance I)

Lemma 1. Let C be a solution of I, then there exists a solution E  of I  with |E  | = |C |. It directly follows that an optimal solution E  of the instance I  satisfies |E  | ≤ |C|. Lemma 2. There is an optimal solution E  of I  that only consists of shortcuts of the form (Ci− , s) for some i ∈ .



Proof. Let E be an optimal solution of I  . We decompose E = EA ∪· EB such that EA only contains shortcuts of the form (Ci− , s) for some i and EB contains all other shortcuts. If EB is not empty there exists an  ∈ such that for every j, r ∈ for which (ur ,C− j )∈E −   the shortcut (C j , s) is not contained in EA . Otherwise EA would be a feasible solution  in contradiction to the optimality of E.  and |EA | < |E| We fix such an . Let i ∈ be such that there is an edge (u1 ,Ci− ) ∈ E. Further, let p denote the number of nodes in U = {ur ∈ V | r = 1 . . . Δ } such that a shortcut (ur , s)  or (ur ,C+ . Assume that p > 1. Then, we could delete all j ) is in EB for some j ∈ shortcuts outgoing from a node in U from EB (this increases the overall hop length by at maximum 2|C|) and introduce the shortcut (Ci− , s) in EA (this decreases the overall hop length by at least Δ + 1 = 2|C| + 2). This solution would be better than the old one in contradiction to the optimality of EA ∪· EB . Hence, p is at most 1.









The Shortcut Problem – Complexity and Approximation

109

We now state a polynomial time algorithm that computes a desired solution out of  We repeatedly proceed as follows until EB is empty. First, we find the given solution E.  an  as defined above and a j such that (u1 ,C− j ) ∈ E. If no such  exists, EA is the desired solution. In case p = 1 we delete the shortcut with source node in U . In case p = 0  still is we delete an arbitrary shortcut with source node in an Ui , i = 1, . . . , |U|. If w(E) − high enough we do nothing. Otherwise we insert the shortcut (C j , s). Obviously, the algorithm runs in polynomial time and computes a desired solution.  Lemma 3. Let E  be an optimal solution of I  . Then, there exists a solution C of I with |E  | = |C |. Proof. Let E  be an optimal solution of I  . By Lemma 2, we know that there exists an optimal solution E  with |E  | = |E  | and shortcuts of the form (Ci , s) for some i ∈ .  We denote by U  the collection of sets Ui for which there is a shortcut (C− j , s) in E    and edges (uir ,C− j ) in E. As E is a feasible solution, we know that w(E ) = |E | +    Δ |U | ≥ k = Δ |U|. Because of |E | ≤ |C| < Δ we know that |U | = |U| which means that for every node in uir , there is a shortcut on a path to s. Therefore, the set {Ci |  (Ci− , s) ∈ E  } is a solution of I.



Theorem 1. Unless P = NP, no polynomial-time constant factor approximation algorithm exists for RSP. The S HORTCUT D ECISION P ROBLEM (SDP) is the variant of Definition 1 where the aim is to decide for a given c ∈ and a given k ∈ whether there exists a shortcut assignment E  with |E  | = c and w(E  ) ≥ k. The proof of the non-approximability of RSP directly transfers to a proof for the NP-completeness of SDP.





Corollary 1. SP and RSP are NP-hard, SDP is NP-complete. Theorem 2. Unless P = NP, no polynomial-time algorithm exists that approximates SP up to an additive constant. Proof. Assume there exists a polynomial-time algorithm A that approximates SP within a fixed bound of Δ . Then we can solve SDP in polynomial time as follows. = Let (G = (V, E, len), c, k) be an instance of SDP. We create a new instance (G 2    (V , E, len), c) of SP by adding, for each node v in G, χ := Δ + 1 + n nodes v1 , . . . , vχ  i , v) = 1, i = 1 . . . χ . This can be done in polyand directed edges (vi , v) such that len(v nomial time.  by A will be We will first prove, that the endpoints of all shortcuts inserted in G   in V : Let E be the set of all shortcuts inserted by A in G. Assume there is a shortcut ( u, v) ∈ (V \V )×V in E  . This shortcut only decreases the overall hop length on shortest paths by at most n2 . W.l.o.g we assume that it is possible to insert c shortcuts into G. Therefore there must be a shortcut (x, y) ∈ V × V that is not contained in E  . This shortcut will result in a decrease of overall hop length of at least χ . Therefore, deleting ( u, v) and inserting (x, y) would decrease the overall hop length on shortest path by more than Δ which is a contradiction to the approximation bound of A . With Δ := 0 it directly follows that an optimal solution of I  only consists of shortcuts in V × V . Given a set of shortcuts E  ⊆ V × V we denote the overall decrease of hop

110

R. Bauer et al.

 with w(E length in G with w(E  ) and in G   ). It is w(E   ) = (1 + χ )w(E  ). Given an ∗  optimal solution E for I and I , it follows (1 + χ ) (w(E ∗ ) − w(E)) = w(E  ∗ ) − w(E)  ≤ Δ ∗ ∗  Δ . Hence, w(E ) − w(E) ≤ 1+χ < 1 which implies w(E ) = w(E ) as both w(E ∗ ) and w(E  ) are integer values. Therefore, we have a polynomial time, exact algorithm for solving SP. We can use this algorithm to decide SDP in polynomial time.  Bounded number of shortcuts. If the number of shortcuts we are allowed to insert is bounded by a constant kmax , the number of possible solutions of SP is polynomial in the size of the graph:  2  n (n2 )! ≤ n2kmax . = 2 kmax (n − kmax )!kmax ! Evaluating a given solution means solving the APSP, hence this can be done in time O(n(n log n + m)). For this reason, the whole problem can be solved in polynomial time by a brute-force algorithm. Monotonicity. In order to show the hardness of working with the problem beyond the complexity results, Figure 2 gives an example that, given a shortcut assignment S and a shortcut s, s ∈ S, the following two inequalities do not hold in general: w(S ∪ {s}) ≥ w(S) + w(s) w(S ∪ {s}) ≤ w(S) + w(s).

(1) (2)

It is easy to verify that in Figure 2 the inequalities w({s1 , s2 }) > w(s1 ) + w(s2 ) and w({s1 , s2 , s3 }) < w({s1 , s2 }) + w(s3 ) hold. Note that Inequality 2 holds if for any pair of nodes (s,t) of graph G, there is at most one, unique shortest s-t-path in G. We prove that in the following lemma and corollary. Lemma 4. Given a graph G = (V, E) having unique shortest paths, a set of shortcuts S and a shortcut s. Then, w(S ∪ {s}) ≤ w(S) + w(s). Corollary 2. Given a graph G = (V, E) having unique shortest paths and a set of shortcuts S = {s1 , s2 , . . . , sk }. Then, w(S) ≤ ∑ki=1 w(si ). In the next section we use these results to present approximation algorithms which work in the case of graphs where shortest paths are unique for each pair of nodes. s3 3

s1

s2

Fig. 2. Example Graph G with shortcuts s1 , s2 , s3 , all edges for which no weight is given in the picture have weight 1

The Shortcut Problem – Complexity and Approximation

111

4 Approximation Algorithms In this section, we propose two polynomial time algorithms for approximatively solving SP in the special case that, for each pair s,t of nodes on the underlying graph, the shortest s-t-path is unique. It turns out that this class is highly relevant as in road networks, most shortest paths are unique and only little modifications have to be made to obtain a graph having unique shortest paths. The first algorithm is a greedy strategy that consists of iteratively solving the problem where the number of shortcuts allowed is one. This algorithm finds a c-approximation of the optimal solution. The second algorithm works  with bounded degree and is based on a partition of the nodes. It  for graphs finds an O λ · max 1, n2 /(λ 2 c) approximation of the optimal solution, where λ is the number of subsets of the underlying partition. 4.1 The Greedy Strategy Given a weighted directed graph G = (V, E, len), the G REEDY approximation scheme consists of iteratively constructing a sequence G = G0 , G1 , . . . , Gc of graphs where Gi+1 is the graph that results from solving SP on Gi for which the number of shortcuts allowed to insert is one. G REEDY is a polynomial time c-approximation of SP. The approximation bound follows directly from Lemma 4. In detail, our scheme works as follows. The value of w(s) in Gi can be computed by performing an all pairs shortest paths computation in Gi . Hence, each iteration step of G REEDY can be solved by evaluating every of the O(n2 ) possible shortcuts. This gives an overall time complexity of O(cn2 · n(n log n + m)). The following theorem shows the approximation ratio for G REEDY. Theorem 3. Given is a weighted directed graph G = (V, E, len) with unique shortest paths and a positive integer c ∈ . If S∗ is the set of shortcuts in an optimal solution for SP instance (G, c), then the solution G = (V, E ∪ E  , len ) computed by G REEDY is a factor c-approximation.



Proof. Let us consider s1 , that is the shortcut computed by the first iteration of G REEDY. Then, w(s) ≤ w(s1 ) for each s ∈ V ×V . Moreover, for any S ⊆ V ×V and for each s ∈ S, w(s) ≤ w(S) and, by Corollary 2, w(S) ≤ ∑s∈S w(s). If we write S∗ = {s∗1 , s∗2 , . . . s∗c }, it follows that c

c

i=1

i=1

w(S∗ )/w(E  )

≤ c holds.

w(S∗ ) ≤ ∑ w(s∗i ) ≤ ∑ w(s1 ) = cw(s1 ) ≤ cw(E  ). Hence, the inequality



4.2 Approximation via Partitioning Given a weighted, directed graph G = (V, E, len) with bounded degree B, our approximation scheme works as follows. It partitions V into small subsets, solves SP restricted to each subset and then chooses the best solution among all subsets as an approximated solution. If the subsets are small enough, then SP restricted to each set can be solved

112

R. Bauer et al.

in polynomial time. Furthermore, the approximation ratio depends on the number of subsets. In fact, if each optimal shortcut has both of its endpoints contained in one of the subsets, then the worst case approximation ratio is given by the number of subsets. Otherwise, we use the following lemma to bound the decrease in overall hop length on shortest paths of the shortcuts which cross more than one subset. Lemma 5. Let G = (V, E, len) be a weighted directed graph with unique shortest paths and s = (v1 , v ) be a shortcut in G. Let p = (v1 , v2 , . . . , v ) be the shortest path shortcut by s. If we divide s into a set of shortcuts s1 , s2 , . . . , sk such that s1 = (v j0 = v1 , v j1 ), s2 = (v j1 , v j2 ), . . . ,sk = (v jk−1 , v jk ), ji − ji−1 ≥ 2, for each i = 1, 2, . . . , k and  − 1 ≤ jk ≤  then, w(s) ≤ 2 ∑ki=1 w(si ). Corollary 3. Let G = (V, E, len) be a weighted directed graph where the shortest paths are unique and let S = {s1 , s2 , . . . , sk } be a set of shortcuts in G. For each si ∈ S, let Si be a set of shortcuts that fullfills the condition of Lemma 5 with respect to si . Then, w(S) ≤ 2 ∑ki=1 w(Si ). In detail, our scheme works as follows. First,√we partition the set V into sets P = {P1 , . . . , Pλ }, where each Pi has size size = c nε /B (i.e. λ = n/size ) for an arbitrary ε > 0. Then, for each cell Pi ∈ P, we compute the neighborhood Ci := Pi ∪ {u ∈ N(v) | v ∈ Pi } of Pi and solve the shortcut problem on G restricted to shortcuts in Ci . That is, we compute Si = argmax{w(S) | S ⊆ Ci ×Ci and |S| ≤ c}. Finally, we determine the set Ci , for which the shortcuts gain the most overall decrease in hop length and set the  len ) solution to be the according shortcuts. More formally, we compute G = (V, E ∪ S, where S = argmax{w(Si ) | i = 1, 2, . . . , λ } and len : E ∪ S → + is defined such that len (u, v) equals √ dist(u, v) if (u, v) ∈ S and equals len(u, v) otherwise. √ Since size = c nε /B and G has bounded degree B, √ |Ci | ≤ c nε holds. Hence, each solution Si can be computed by performing at most ( c nε )√2c = n2ε all pairs shortest λ = n/size = nB/ c nε partitions, the overall paths computations in G. As there are√ c ε 2 ε computation time is O( f (n) · n · n/ n ) = O( f (n) · (n/λ )2c · λ ), where f (n) is the time needed for computing all pairs shortest paths in G. The following theorem shows the approximation ratio for PARTITION. Theorem 4. Given a weighted directed graph G = (V, E, len) with bounded degree and unique shortest paths

integer c ∈ , then, the solution computed by  and a positive n2 PARTITION is an O λ · max 1, λ 2 c approximation for the optimal solution of the



SP instance (G, c) where λ denotes the number of cells used by PARTITION.

5 Approximative Evaluation of the Measure Function To evaluate the overall decrease in hop length for a given shortcut assignment, we require computing all pairs shortest paths in a graph. Since this computation requires O(n(n log n + m)) time, we provide a stochastical method to quickly evaluate the overall decrease in hop length in this section. This approach can be used for big networks, where APSP is prohibitive. Such networks often arise in the context of timetabling or

The Shortcut Problem – Complexity and Approximation

113

Algorithm 1. PARTITION

1 2 3 4 5 6

7

input : graph G = (V, E, len), number of shortcuts c, parameter ε > 0  len ) with shortcuts added output: graph G = (V, E ∪ S, √ Partition the set V into sets P = {P1 , . . . , Pλ } each of size size = c nε /B. forall Pi ∈ P do Ci := Pi ∪ {u ∈ N(v) | v ∈ Pi } Si := argmax{w(S) | S ⊆ Ci ×Ci and |S| ≤ c} S := argmax{w(Si ) | i = 1, 2, . . . , λ }  otherwise len : E ∪ S → + is such that as len (u, v) = dist(u, v) if (u, v) ∈ S, len (u, v) = len(u, v).  len ) Output G = (V, E ∪ S,

Ê

shortest-paths computation on road networks (see [8] for a prominent example). For the sake of simplicity we state the approach for the evaluation of μ := ∑s∈V ∑t∈V h (s,t), the adaption to SP is straightforward. More precisely, we apply the sampling technique to evaluate the measure function μ in an approximative way. We exploit Hoeffding’s Bound [12] to get a confidence intervall of the following unbiased estimation: If X1 , X2 , . . . , XK are real valued independent random variables with ai ≤ Xi ≤ bi and expected mean μ = [∑ Xi /K], then for ξ > 0   K    ∑i=1 Xi 2 −2K 2 ξ 2 / ∑K   i=1 (bi −ai ) .  K − μ  ≥ ξ ≤ 2e





Let X1 , X2 , . . . , XK be a family of random variables. For i = 1, 2, . . . , K, Xi equals |V | · ∑t∈V h (si ,t) where si is a node which is chosen uniformly at random. We estimate μ by μˆ := ∑Ki=1 Xi /K. Because of ( μˆ ) = μ we can apply Hoeffding’s Bound if we know an upper bound for the Xi . The value |V |3 is a trivial upper bound.



Definition 4. The shortest path diameter spDiam(G) of a graph G = (V, E, len) is the maximal hop length of a shortest path (shortest with respect to len) on G. If we know the shortest path diameter of a graph we obtain |V |2 spDiam(G) as upper bound for Xi . If we insert this into Hoeffdings Bound, we gain

 {|μˆ − μ | ≥ ξ } ≤ 2e−2Kξ /(|V | ·spDiam(G) ) 2

and



4

2

    μˆ − μ   ≥ lrel ≤ 2e−2K(μˆ ·lrel )2 /(|V |4 ·spDiam(G)2 )   μˆ 

for a parameter lrel . In [12] it is stated that Hoeffdings Bound stays correct if, when sampling from a finite population, the samples are being chosen without replacement. Algorithm 2 is an approximation algorithm that exploits the above inequality and that samples without replacement. To compute the exact shortest path diameter of a graph we have to compute APSP. We obtain an upper bound for the shortest path diameter the following way: first we

114

R. Bauer et al.

Algorithm 2. STOCH. EVALUATE OVERALL HOP LENGTH input : graph G = (V, E, len), size of confidence intervall lrel , significance level α output: approximation for the overall hop length on shortest paths 2

compute random order v1 , v2 , . . . , vn of V compute upper bound spDiam for shortest path diameter

3

i := 1; sum := 0; μˆ = −∞

1

4 5 6 7 8 9

while not (i = |V | or 2 · exp(−2i(μˆ · lrel /(|V |4 spDiam(G)2 )) ≤ α ) do T := grow hop minimal SP-Tree rooted at vi sum := sum + |V | · ∑t∈V h (vi ,t) μˆ := sum/i i := i + 1 output μˆ

compute an upper bound diam(G) for the diameter of G. To do that we choose a set of nodes s1 , s2 , . . . , sl uniformly at random. For each node si the value εG (si ) + εG (si ) is an upper bound for the diameter of G. We set diam(G) to be the minimum of these values over all si . Afterwards, we grow, for every node s on G, a shortest paths tree whose construction is stopped as soon as one vertex with distance of more than diam(G)/η is visited where η is a tuning parameter. We denote by τ the maximum hop-length of the shortest paths on any of the trees grown. Then spDiam = τ · η is an upper bound for the shortest path diameter of G. The pseudocode of that algorithm is given in Algorithm 3.

Algorithm 3. COMPUTE UPPER BOUND FOR SP-DIAMETER input : graph G = (V, E, len), tuning parameter l, tuning parameter η output: upper bound spDiam for shortest path diameter 1

diam(G) := ∞; τ := 0;

8

forall i = 1, . . . , l do s := choose node uniformly at random grow shortest paths tree rooted at s grow shortest paths tree rooted at s on the reverted graph diam(G) := min{diam(G), maxv∈V {dist(s, v)} + maxv∈V {dist(v, s)}} forall s ∈ V do T := grow partial shortest paths tree rooted at s. stop growing when first node with dist(s, v) ≥ diam(G)/η is visited. τ := max{τ , maximal number of edges of a path in T }

9

output τ · η

2 3 4 5 6 7

Obviously, the whole proceeding only makes sense for graphs for which the shortest path diameter is much smaller than the number of nodes. This holds for a wide range of real-world graphs, in particular for road networks. For example, the street network of Luxembourg provided by the PTV AG [1] consists of 30733 nodes and has a shortest path diameter of only 429.

The Shortcut Problem – Complexity and Approximation

115

6 Conclusion In this work we studied two problems. The S HORTCUT P ROBLEM (SP) is the problem of how to add a given number of edges to a weighted graph, such that distances do not change and the average number of hops on hop minimal shortest paths in the graph becomes minimal. The R EVERSE S HORTCUT P ROBLEM (RSP) is the variant of SP where the desired decrease in the average number of hops is fixed and the number of inserted edges has to be minimized. We want to stress out, that this is the first approach towards a theoretical foundation for inserting shortcuts, which is heuristically used by many speed-up techniques for D IJKSTRA’s algorithm. We proved that both problems are NP-hard and that there is no polynomial time constant factor approximation algorithm for RSP, unless P = NP. Furthermore, no polynomial time algorithm exists that approximates SP up to an additive constant, unless P = NP and that problem is solvable in polynomial time if the number of shortcuts to insert is bounded. Moreover, we gave two polynomial time approximation algorithms for SP that work for the case that shortest paths on the underlying graph are unique. Finally, we proposed a stochastical method to evaluate the measure function of SP very fast. This can be used for large input networks where an exact evaluation is prohibitive. There exists a wide range of possible future work on the problem. From the theoretical point of view the probably most interesting open question is that of the approximability of SP. It is still not known if it is in APX. Furthermore, it would be helpful to identify graph-classes for which SP or RSP become tractable. From the practical point of view, it is important to develop heuristics that find good shortcuts for real-world input. In particular, evolutionary algorithms and local search algorithms (similar to the greedy strategy) seem to be promising. The output of these algorithms should be experimentally tested on their benefit for different speed-up techniques. Further, it is interesting to evaluate the output of the currently used shortcut insertion strategies in the problem’s measure function.

References 1. PTV AG - Planung Transport Verkehr (1979), http://www.ptv.de 2. Proceedings of the 8th Workshop on Algorithm Engineering and Experiments (ALENEX 2006). SIAM, Philadelphia (2006) 3. Bauer, R., D’Angelo, G., Delling, D., Wagner, D.: The Shortcut Problem – Complexity and Approximation (Full Version), http://i11www.iti.uni-karlsruhe.de/members/ rbauer/pdf/bddw-SOFSEM09 FULL.pdf 4. Bauer, R., Delling, D.: SHARC: Fast and Robust Unidirectional Routing. In: Proceedings of the 10th Workshop on Algorithm Engineering and Experiments (ALENEX 2008), pp. 13–26. SIAM, Philadelphia (2008) 5. Bauer, R., Delling, D., Sanders, P., Schieferdecker, D., Schultes, D., Wagner, D.: Combining Hierarchical and Goal-Directed Speed-Up Techniques for Dijkstra’s Algorithm. In: McGeoch (ed.) [15], pp. 303–318 6. Bruera, F., Cicerone, S., D’Angelo, G., Stefano, G.D., Frigioni, D.: Dynamic Multi-level Overlay Graphs for Shortest Paths. Mathematics in Computer Science 1(4) (2008) 7. Demetrescu, C. (ed.): WEA 2007. LNCS, vol. 4525. Springer, Heidelberg (2007)

116

R. Bauer et al.

8. Demetrescu, C., Goldberg, A.V., Johnson, D.S. (eds.): 9th DIMACS Implementation Challenge - Shortest Paths (November 2006) 9. Geisberger, R., Sanders, P., Schultes, D., Delling, D.: Contraction Hierarchies: Faster and Simpler Hierarchical Routing in Road Networks. In: McGeoch (ed.) [15], pp. 319–333 10. Goldberg, A.V., Kaplan, H., Werneck, R.F.: Reach for A*: Efficient Point-to-Point Shortest Path Algorithms. In: ALENEX 2006 [2], pp. 129–143 (2006) 11. Goldberg, A.V., Kaplan, H., Werneck, R.F.: Better Landmarks Within Reach. In: Demetrescu (ed.) [7], pp. 38–51 12. Hoeffding, W.: Probability inequalities for sums of bounded random variables. Journal of the American Statistical Association 58(301), 713–721 (1963) 13. Holzer, M., Schulz, F., Wagner, D.: Engineering Multi-Level Overlay Graphs for ShortestPath Queries. In: ALENEX 2006 [2] (2006) 14. Lauther, U.: An Extremely Fast, Exact Algorithm for Finding Shortest Paths in Static Networks with Geographical Background. In: Geoinformation und Mobilit¨at - von der Forschung zur praktischen Anwendung, vol. 22, pp. 219–230. IfGI prints (2004) 15. McGeoch, C.C. (ed.): WEA 2008. LNCS, vol. 5038. Springer, Heidelberg (2008) 16. Sanders, P., Schultes, D.: Engineering Highway Hierarchies. In: Azar, Y., Erlebach, T. (eds.) ESA 2006. LNCS, vol. 4168, pp. 804–816. Springer, Heidelberg (2006) 17. Sanders, P., Schultes, D.: Engineering Fast Route Planning Algorithms. In: Demetrescu (ed.) [7], pp. 23–36 18. Schultes, D., Sanders, P.: Dynamic Highway-Node Routing. In: Demetrescu (ed.) [7], pp. 66–79 19. Schulz, F., Wagner, D., Weihe, K.: Dijkstra’s Algorithm On-Line: An Empirical Case Study from Public Railroad Transport. ACM Journal of Experimental Algorithmics, 5 (2000) 20. Schulz, F., Wagner, D., Zaroliagis, C.: Using Multi-Level Graphs for Timetable Information in Railway Systems. In: Mount, D.M., Stein, C. (eds.) ALENEX 2002. LNCS, vol. 2409, pp. 43–59. Springer, Heidelberg (2002) 21. Wagner, D., Willhalm, T.: Speed-Up Techniques for Shortest-Path Computations. In: Thomas, W., Weil, P. (eds.) STACS 2007. LNCS, vol. 4393, pp. 23–36. Springer, Heidelberg (2007)

Green Computing: Energy Consumption Optimized Service Hosting Walter Binder1 and Niranjan Suri2 1

2

Faculty of Informatics, University of Lugano Lugano, Switzerland [email protected] Institute for Human and Machine Cognition (IHMC) Florida, USA [email protected]

Abstract. Green Computing is a recent trend towards designing, building, and operating computer systems to be energy efficient. While programs such as Energy Star have been around since the early 1990s, recent concerns regarding global climate change and the energy crisis have led to renewed interest in Green Computing. Data centers are a significant consumers of energy - both to power the computers as well as to provide the necessary cooling. This paper proposes a new approach to reduce energy utilization in data centers. In particular, our approach relies on consolidating services dynamically onto a subset of the available servers and temporarily shutting down servers in order to conserve energy. We present initial work on a probabilistic service dispatch algorithm that aims at minimizing the number of running servers such that they suffice for meeting the quality of service required by service-level agreements. Given the estimated energy consumption and projected growth in data centers, the proposed effort has the potential to positively impact energy consumption. Keywords: Green computing, energy conservation, energy efficiency, data centers, service hosting, service dispatch, service-level agreements.

1 Introduction Computer systems are becoming increasingly ubiquitous and a part of the national infrastructure of every country, resulting in large installations of computer systems to provide critical services. These installations, normally referred to as data centers, have grown to require significant levels of electrical power, thereby contributing to the consumption of fossil fuels and generation of green house gases. In the United States alone, it is estimated that 61 billion kilowatt-hours (kWh) were utilized to power data centers in the year 2006, which equates to approximately US$ 4,5 billion. The projected growth by the year 2011 exceeds 100 billion kWh, with an estimated cost of US$ 7,4 billion. Moreover, it is estimated that 10 additional electrical power generation plants would need to be constructed in order to support this growth in the demand for data centers [1]. One of the reasons for the high levels of power consumption is that computers in these data centers tend to be continuously operating, regardless of the load being placed M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 117–128, 2009. c Springer-Verlag Berlin Heidelberg 2009 

118

W. Binder and N. Suri

on them. As long as computers are running, they produce heat which requires cooling mechanisms, another significant consumer of electricity. One possible approach to solving this problem is to shutdown computers that are idle and restart them when necessary. The notion of Green Computing has become popular given recent concerns about global climate change and the energy crisis. This paper proposes a new effort to achieve Green Computing in data centers. Our approach dynamically consolidates executing services, such as Web services or services used in Web 2.0 mashups, on a subset of the servers in a data center. The scientific contributions of this paper are energy consumption-optimized service dispatch algorithms to keep the number of running servers as small as possible, but sufficient to meet the current service demand. The service dispatch algorithms not only select the server to execute an incoming request, but they also manage the pool of running servers by respectively issuing shutdown and restart commands, according to the overall load. Monitoring techniques provide information on the average response time for service requests and on the idle time for each server. According to these parameters and to the quality of service (QoS) requirements described in service-level agreements (SLAs)1 , the service dispatch algorithms decide on which servers need to be running. We project that such an approach can significantly reduce the number of computers that need to be continuously operating and thereby reduce the overall power consumption by data centers. The rest of this paper is organized as follows. Section 2 gives an overview of our service hosting environment and describes the assumptions underlying our approach. Section 3 explains the mechanics of server shutdown and restart. Section 4 discusses two different approaches to energy-conserving service dispatch, an optimization algorithm and a probabilistic control algorithm. As the optimization algorithm requires careful modelling of the hosting environment, the services, and the expected service requests, which is difficult in practice, we emphasize our probabilistic control algorithm, which we present in more detail. Section 5 discusses related work, Section 6 outlines our ongoing research, and finally Section 7 concludes this paper.

2 Service Hosting Environment The hosting environment includes dedicated machines for three different purposes: Dispatchers, file servers, and compute servers. A Dispatcher receives service requests and chooses the compute servers to handle them. It also decides when to shutdown and restart compute servers. File servers provide all data sources. Compute servers host the services. Dispatchers and file servers are permanently running, whereas compute servers are running only if needed. The approach presented in this paper aims at minimizing the number of running compute servers while offering the required QoS to the clients. Each compute server hosts a Node Manager component. The Node Manager is responsible for monitoring idle time and average service response time. It communicates 1

Languages such as Web Service Level Agreements (WSLA) [2] or WS-Agreement [3] may be used to specify the conditions of service delivery and the QoS.

Green Computing: Energy Consumption Optimized Service Hosting

119

the measurements to a Dispatcher. Moreover, the Node Manager handles server shutdown upon request from a Dispatcher; for details, see Section 3. Each compute server may offer different computing resources and may have different energy consumption. Even though the hosting environment may consist of homogeneous hardware in the beginning, it is unlikely to maintain a homogeneous environment in the long term. E.g., individual cores on a multicore machine may fail, reducing the resources of a compute server. Moreover, additional compute servers (new models) may be installed in order to cope with an increasing service demand. Consequently, our service dispatch algorithm needs to take the different resources and energy consumption of the compute servers into account. The hosting environment may offer several different service types (ST). Each ST is uniquely identified by a service interface and a service-level agreement (SLA) that defines QoS parameters. The QoS parameters are specified according to a common ontology such as [4] or [5]. Currently, we focus on a single QoS parameter, service response time. Compute servers may be turned off only if the remaining compute servers can meet the required service response time for all STs in the hosting environment. Each ST represents either a stateless service or a stateful service. Stateful services provide sessions; within the same session, a client may send multiple requests that operate on the state resulting from previous requests within the session. A session may be explicitly terminated by the client, or automatically terminated by the compute server after some period of inactivity. For a stateless service, each request is independent of previous requests. After completing all accepted requests, the stateless service may be stopped. In contrast, a stateful service cannot be stopped while a session is active. We assume that the overall duration of a session is limited (which can be enforced with a timeout mechanism) in order to prevent sessions from arbitrarily delaying the termination of a stateful service. Alternatively, in order to avoid the aforementioned restriction regarding the total session duration, sessions may be migrated from one compute server to another. However, that requires additional dedicated middleware support. Each compute server can host any ST (and any combination of STs). That is, there are no dedicated machines for particular STs. This assumption will simplify the description of our service dispatch algorithm in Section 4.

3 Shutdown and Restart of Compute Servers In this section we discuss the mechanics of shutting down and restarting a compute server. When the Dispatcher decides to shut down a compute server, it sends a shutdown request to the Node Manager of the corresponding compute server, which prepares its shutdown. New service requests are no longer dispatched to that compute server. If the compute server is currently processing service requests or maintaining active sessions of stateful services, it is first necessary to make the compute server idle, which can be accomplished in two different ways. The first approach is to simply wait until existing service requests complete and all active sessions terminate. The second approach is to migrate the execution of service requests and active sessions onto another compute server. Although the latter appoach requires dedicated middleware support, it is

120

W. Binder and N. Suri

attractive for services that are stateful or long-running, which otherwise may significantly delay the effective shutdown of the compute server. Once a compute server is idle, the Node Manager requests the operating system to shut down the server in order to conserve energy. There are three possibilities to shutdown a compute server: (1) Shutdown the system completely (this approach will require that upon powerup, the system reboots from scratch, loads the operating system, and resumes execution); (2) Hibernate the system (the memory contents are saved onto secondary storage so that the system may be resumed by reloading the memory snapshot); (3) Suspend the system (the memory contents remain in memory, but the processor stops executing). Options 1 and 2 both result in the system being completely turned off, thereby requiring minimal power after shutdown (except for the Wake On LAN feature described below). In some situations, a shutdown and clean reboot may be preferred, as a means to clean out any resources held by the operating system. However, the hibernate and resume option is usually faster. Option 3 requires that the system maintain some power to keep the contents of memory from being lost. This option results in the fastest restart time at the expense of some power utilization while being suspended. The Dispatcher may also choose from one of the three options based on the circumstances. For example, short shutdown and restart cycles may cause the Dispatcher to choose option 3, whereas longer cycles may accommodate options 1 or 2. Also, policy may dictate that option 1 should be performed periodically to “clean” the system (e.g., to get rid of memory leaks). The restart mechanism utilizes the Wake On LAN [6] capability that is supported by most computers and LAN interfaces. Wake On LAN depends on a special magic packet that signals the Ethernet interface on a host to power on the host. The magic packet consists of the bytes 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF followed by the Ethernet MAC address of the host repeated 16 times. Therefore, the Dispatcher maintains a table of each compute server’s MAC address. When the Dispatcher wishes to wake up a compute server, a UDP packet is broadcast to the LAN with the appropriate MAC address of the compute server that should be started. The Dispatcher then awaits the Node Manager on the compute server to contact the Dispatcher indicating that the server is up before allocating service requests to it.

4 Energy Conserving Service Dispatch Dispatchers play two important roles in our architecture; they select the compute server to handle an incoming service request and they manage the pool of compute servers so as to minimize the overall energy consumption while respecting existing SLAs. In the following we concentrate on the latter issue, aiming at consolidating the offered services on a subset of the compute servers that suffices to meet the current service demand. We have considered two approaches, (1) an optimization algorithm based on a mathematical model of the hosting environment and the computational load, and (2) a probabilistic control algorithm that reacts to changes in the idle CPU time on compute servers and in the average service response time for each ST.

Green Computing: Energy Consumption Optimized Service Hosting

121

4.1 Optimization Algorithm The goal of the optimization algorithm, which we assume will execute periodically after a given time interval, can be informally described as follows: Choose a subset of the compute servers such that the overall energy consumption is minimized, while the expected load for the next time interval will not violate the SLA of any ST. As we do not know the load of the next time interval in advance, we can use monitoring information from the previous time interval or longer term statistics to predict the expected load for the next time interval. For each compute server, the energy consumption must be known. Since we are dealing with different STs and with heterogeneous compute servers, we introduce the notion of a Standardized Service Request (SSR) and express the resources of each compute server using the metric SSR/s (the number of SSRs that can be processed per second). For each ST, we define a factor fST such that one request for ST corresponds to fST SSRs. Assume a subset of the available compute servers and an expected number of service requests for each ST. Considering all possible schedules for the given number of service requests, we can estimate the expected total execution time for each ST under the simplifying assumptions that the selected compute servers operate in parallel and there are no dependencies between the individual service requests. This estimation is performed using the SSR metric. A schedule determines the number of service requests for each ST to be performed on each compute server, as well as the order of the service requests on each compute server. The estimated total execution time for all service requests of each ST allows us to compute the expected average service response time and we determine whether it meets or violates the SLA of the corresponding ST. Schedules that violate the SLA of at least one ST are invalid. Consequently, the optimization algorithm yields the set of compute servers with minimum overall energy consumption such that there is a valid schedule meeting the SLAs of all STs. There are many different techniques to implement the optimization algorithm, such as constraint optimization techniques, genetic algorithms, etc. While this approach gives a reference model, it is not well suited in practice, for the following four reasons: 1. The simplifying assumption that service requests are independent does not meet many practical situations. For example, it does not apply for stateful services. Moreover, each possible schedule may result in different resource contention, e.g., on the file servers. 2. The search space can be large and consequently the runtime of the optimization algorithm can be high. 3. An appropriate definition of the factors fST is difficult, as well as the specification of the resources of each compute server in terms of SSR/s. 4. Having found a valid schedule for a chosen set of compute servers based on estimated load does not guarantee that the actual executed schedule will be valid as well. First, the load estimation may be wrong, and, second, the service requests may arrive in a different order, resulting in a distinct schedule. For these reasons, we do not discuss the optimization algorithm in more detail, but instead we consider a second approach, a probabilistic control algorithm.

122

W. Binder and N. Suri

4.2 Probabilistic Control Algorithm In our probabilistic control algorithm, a Dispatcher distributes service requests to the most energy-efficient compute servers in a probabilistic manner. The algorithm aims at keeping as many compute servers turned off as possible without violating any SLAs. It relies on two principles: 1. If a running compute server si has idle time, the probability that service requests are dispatched to si is increased. Conversely, the probability that service requests are dispatched to the least energy-efficient compute server currently running sr is decreased by the same amount. If the probability that service requests are dispatched to sr becomes zero, the shutdown of sr is initiated. 2. In an overload situation, the algorithm first tries to better distribute the load amongst the running compute servers, and restarts an extra machine only as a last remedy. Having outlined the principles of our probabilistic control algorithm, we describe it now in more detail. We assume n compute servers represented by the n-tuple < s1 , ..., sn >, sorted according to their energy efficiency. If on average s j consumes more energy per service request than si , then i < j. In each configuration of the overall system, the first r ≥ 1 compute servers in the tuple are running, whereas the following n − r compute servers are switched off (or are in the process of switching themselves off). For each ST, there is a n-tuple pST of dispatch probabilities; pST (i) is the probability that a request for ST will be dispatched to compute server si . (∀ri=1 )(0 ≤ pST (i) ≤ 1); (∀ni=r+1 )(pST (i) = 0); ∑ni=1 pST (i) = 1. In an overload situation, if r < n, the control algorithm will turn on sr+1 (r will be incremented afterwards). Conversely, if for each ST, pST (r) = 0 (and r > 1, which is implied by the previous condition), the algorithm will turn off sr (r will be decremented afterwards). That is, before a compute server can be turned off, its dispatch probabilities must be zero for each ST. Periodically, the control algorithm adjusts the dispatch probabilities for each ST according to the compute servers’ recent activities. To this end, the control algorithm polls (from each compute server’s Node Manager) the average response time for each ST in the last time period, as well as the server’s idle time in the last time period. The pseudo-code in Fig. 1 illustrates our probabilistic control algorithm. It first checks for an overload situation of a running compute server for a service type X. We consider an overload if the idle time is below a given threshold Tbusy and if the average response time for service type X exceeds the corresponding SLA’s limit L reduced by a given ε . That is, we consider L − ε a “high-watermark” that should not be exceeded. If an overload situation of compute server si for service type X is detected, we look for another compute server sk where the idle time exceeds a given threshold Tidle and the average response time for all service types is below the respective “high-watermark”. If such a compute server sk is found, we reduce the dispatch probability of service type X on compute server si by the value Δ p and increment the dispatch probability of service type X on compute server sk by the same Δ p. The value Δ p is computed by the customizable function π (ST, src, dst), which returns the fraction of the dispatch probability of a given service type ST on compute server ssrc to be reallocated to server sdst ; 0 ≤ Δ p ≤ pST (src). Note that the control algorithm favors incrementing the dispatch

Green Computing: Energy Consumption Optimized Service Hosting

123

1. overload ← f alse; 2. For each running compute server si (1 ≤ i ≤ r): If the idle time of si is below a given threshold Tbusy and there is a service type X such that the average response time of si exceeds the corresponding SLA’s response time parameter reduced by a constant ε (i.e., overload of si ): (a) overload ← true; (b) restart ← true; (c) For 1 ≤ k ≤ r; k = i: If the idle time of compute server sk exceeds a given threshold Tidle and for each service type the average response time of sk does not exceed the corresponding SLA’s response time parameter reduced by ε : – Δ p := π (X, i, k); – pX (i) := pX (i) − Δ p; – pX (k) := pX (k) + Δ p; – restart ← f alse; – break; (d) If restart = true and r < n: – Initiate restart of sr+1 ; – r := r + 1; 3. If overload = f alse and r > 1: (a) For each running compute server si (1 ≤ i < r): If the idle time of si exceeds a given threshold Tidle and for each service type the average response time of si does not exceed the corresponding SLA’s response time parameter reduced by ε : – Select a service type X such that pX (r) ≥ pY (r) for all service types Y . – Δ p := π (X, r, i); – pX (r) := pX (r) − Δ p; – pX (i) := pX (i) + Δ p; (b) If for all service types X, pX (r) = 0, and sr has been running for a given minimum running time Trunning : – Initiate shutdown of sr ; – r := r − 1;

Fig. 1. Probabilistic control algorithm. The algorithm is periodically executed by the Dispatcher using recent monitoring data (average service response time, idle time) from the compute servers. r is the number of compute servers currently running.

probability of the most energy-efficient compute server that appears to have enough idle resources. If no overload situation is detected, the algorithm searches for idle resources on the running compute servers. If possible, the dispatch probability of compute server sr (which is the least energy-efficient compute server running) is reduced, while increasing the dispatch probability of a found compute server with enough idle resources. If the dispatch probabilities pX (r) for all service types X are zero, compute server sr is eligible to be shut down. However, we require each compute server to run for at least Trunning time units, so as to avoid continuously turning on and off the same compute server in case of workload fluctuations.

124

W. Binder and N. Suri

In summary, our control algorithm consolidates services on the most energy-efficient compute servers. In a single run of the presented control algorithm, at most one compute server is shutdown or restarted. The algorithm can be easily adapted to allow for the shutdown or restart of multiple compute servers in a single run.

5 Related Work Related work in this area falls into a few different categories. Here we consider various techniques for conserving energy, process and job scheduling, and the monitoring of SLAs. The issue of power consumption in data centers has gained the attention of many professionals in the IT industry. The Green Grid consortium2 has been established to advocate data center design and management to support energy efficiency and several white papers have been published, including ways to conserve power [7] and metrics for data centers [8]. Interfaces that allow managers to monitor power consumption and productivity have also been proposed [9]. These efforts address topics including rightsizing a data center during design time, enabling processor power saving, and powering down servers when not in use. However, their efforts to powering down servers is rather coarse grained. For example, they suggest turning off certain servers with dedicated roles, such as performing backups, when they are not scheduled to perform any activity. The approach proposed in this paper is dynamic and fine-grained and operates based on the active load as opposed to assuming fixed schedules. In [10], the author presents a holistic approach to green computing, including topics such as recycling, which is not the focus of this effort. In terms of power conservation, the author primarily highlights energy-efficient approaches to cooling. Another approach to conserving power is through server virtualization, which reduces the number of physical servers necessary, and hence, the power consumed. In our approach, the goal is to dynamically reduce the number of active server nodes, which will also reduce the heat generated and hence the power necessary to cool the systems. This can be combined with more energy efficient approaches to cooling, such as liquid cooling, to achieve even more power conservation. Finally, while virtualization is an effective technique to reducing power consumption, it addresses a different problem than the one in this paper. Virtualization is suitable in situations where multiple “computers” are necessary (for example, for ownership, isolation, or other reasons) within the data center but each of these computers does not need all the resources of a full server to be dedicated to them. Our approach is different and does not attempt to solve the virtualization problem. Instead, we are concerned with dynamically controlling the number of physical servers that are on or off in order to match energy consumption with real processing demand. Significant work has also been done on individual system or processor level control in order to reduce power consumption. Many modern CPUs can dynamically vary their power consumption based on load. For example, in [11] and [12], the authors are focused on dynamically monitoring and controlling the clock frequency and power consumption of a processor in order to provide just the required performance level. 2

http://www.thegreengrid.org/

Green Computing: Energy Consumption Optimized Service Hosting

125

However, they do not focus on turning off or suspending systems entirely, unlike this effort. Processor-level power control can certainly be combined with an approach such as the one described in this paper. Our service dispatch algorithms can be related to process scheduling and load balancing algorithms in operating systems, as well as to job scheduling in Grid computing. However, whereas existing algorithms typically focus only on performance goals, such as CPU utilization, throughput, response time, turnaround time, or fairness, our approach considers also energy consumption in the hosting environment (in addition to response time). Service dispatch in our probabilistic approach is closely related to lottery scheduling [13]. In lottery scheduling, each operating system process receives a number of lottery tickets proportional to its importance. The scheduler randomly selects a ticket and schedules the process corresponding to the ticket. Hence, in a probabilistic manner, important processes receive more CPU than less important processes. In lottery scheduling, tickets are not numbered; it is sufficient to maintain the number of tickets per process and hence the total number of tickets in the system. Tickets can be transferred between processes so as to reflect changes in process priorities. The ideas of lottery scheduling are directly applicable to service dispatch in our approach. For each service type X, we can replace the n-tuple pX of scheduling probabilities with a n-tuple of lottery tickets for service type X. The function π that decides on the reallocation of scheduling probabilities then determines the number of tickets to transfer. Dealing with lottery tickets is more efficient than handling probabilities, because only integer arithmetic is needed. However, it is important to properly choose the granularity of tickets, i.e., the total number of tickets for each service type. There is a large body of research addressing infrastructural facilities for SLA monitoring [2,14,15,16,17]. Some of these approaches integrate the monitoring mechanisms into the service middleware and help the server provider allocate resources so as to meet the conditions of service delivery stated in SLAs, while other approaches rely on a trusted monitor or on a reputation mechanism to provide reliable service rankings for clients. Our approach leverages monitoring information provided by the Node Manager; while we are also concerned with SLA-aware resource allocation, the main focus of our work in on reducing energy consumption in the hosting environment.

6 Ongoing Research In this section we summarize the direction of our ongoing research. Testbed and evaluation: The algorithms presented in this paper need to be evaluated, where the primary metric is the amount of energy conserved for a given workload with respect to the usual setting where all servers are continuously running. Ideally, the potential for energy savings will be examined using traces of service execution in data centers. Furthermore, we are working on a testbed that allows us to simulate different hosting environments, workloads, and service types. Regarding service types, we are not considering service functionality, but only performance models (e.g., response time). Concerning our probabilistic control algorithm, the testbed will be used to determine various algorithm parameters, such as the length of the time interval between

126

W. Binder and N. Suri

successive runs of the algorithm, or the function π that determines to which extend dispatch probabilities are reallocated. Migration: In order to improve energy utilization by reducing the time needed to prepare a compute server for shutdown, we are investigating techniques for service migration, either with the service state (for stateful services) or even with execution state (strong mobility [18]). Migration of services that are currently servicing clients must be done transparently. We will explore the Mockets3 communication library to achieve this capability. Optimization criteria: Currently, our service dispatch algorithms only consider energy consumption and average service response time as optimization goals. Several other optimization criteria should be considered as well. For instance, we would prefer to minimize the number of service types with non-zero dispatch probability on each compute server, in order to reduce the amount of active code (and possibly improve locality, cache hit rate, and therefore performance). Moreover, the selection of the next compute server to be shut down should not only be based on the energy-efficiency of the server (there may be many servers of the same model, i.e., with identical energy efficiency), but should also involve considerations regarding the effort required to prepare the shutdown (e.g., the number of active sessions). Distribution and replication: The service dispatch algorithms presented in this paper are centralized and may become performance bottlenecks. We are considering different ways to distribute our probabilistic control algorithm. One approach is to use a different Dispatcher for each service type. It is also possible to replicate the tuples of dispatch probabilities on multiple Dispatchers, while one particular Dispatcher is responsible of periodically updating these tuples, communicating them to the other Dispatchers, and handling the shutdown and restart of compute servers. Fault tolerance: The Dispatcher has to properly address the failure of compute servers; the dispatch probabilities of all service types for a failed compute server should be set to zero. Moreover, failures of the Dispatcher must be considered as well. Sudden fluctuations: A sudden and significant increase in service requests may cause temporary overload situations, possibly leading to the violation of SLAs until the needed machines are restarted. This could also increase the vulnerability in case of denial-of-service attacks. Both of these issues need to be considered.

7 Conclusion This paper has presented an approach to improving the energy efficiency of data centers that support execution of services. Unlike other approaches that rely on processor power control or improved cooling efficiency, our approach relies on trying to shut down server nodes that are under utilized. The Dispatcher component monitors the server response time in comparison with SLAs and consolidates services onto as few servers as possible. Idle servers are then shut down and restarted using Wake On LAN when necessary. 3

http://mockets.ihmc.us/

Green Computing: Energy Consumption Optimized Service Hosting

127

The work described here is preliminary and still in progress. The next steps have been outlined in the previous section. However, we anticipate that an approach such as the one presented in this paper can significantly reduce the energy requirements of data centers, which also helps reduce the costs incurred by data centers.

Acknowledgements The work presented in this paper has been supported by the Swiss National Science Foundation.

References 1. EPA: ENERGY STAR Program. Report to Congress on Server and Data Center Energy Efficiency. Technical report, United States Environmental Protection Agency (2007) 2. Dan, A., Davis, D., Kearney, R., Keller, A., King, R.P., Kuebler, D., Ludwig, H., Polan, M., Spreitzer, M., Youssef, A.: Web services on demand: WSLA-driven automated management. IBM Systems Journal 43(1), 136–158 (2004) 3. Andrieux, A., Czajkowski, K., Dan, A., Keahey, K., Ludwig, H., Nakata, T., Pruyne, J., Rofrano, J., Tuecke, S., Xu, M.: Web Services Agreement Specification (WS-Agreement), GFD-R-P.107 (March 2007), http://www.ogf.org/documents/GFD.107.pdf 4. Maximilien, M., Singh, M.: A Framework and Ontology for Dynamic Web Services Selection. IEEE Internet Computing 8(5), 84–93 (2004) 5. Ran, S.: A Model for Web Service Discovery with QoS. ACM SIGecom Exchanges 4(1), 1–10 (2003) 6. AMD: Magic Packet Technology (November 1995), http://www.amd.com/us-en/ assets/content type/white papers and tech docs/20213.pdf 7. Blackburn, M.: Five Ways to Reduce Data Center Server Power Consumption. The Green Grid (2008) 8. Belady, C., Patterson, M.: The Green Grid Productivity Indicator. The Green Grid (2008) 9. Verdun, G., Azevedo, D., Barrass, H., Berard, S., Bramfitt, M., Cader, T., Darby, T., Long, C., Gruendler, N., Macarthur, B., Morris, P., Rawson, A., Simonelli, J., Singh, H., Wallerich, J.: The Green Grid Metrics: Data Center Infrastructure Efficiency (DCIE) Detailed Analysis. The Green Grid (2008) 10. Murugesan, S.: Harnessing green IT: Principles and practices. IT Professional 10(1), 24–33 (2008) 11. Ge, R., Feng, X., Feng, W., Cameron, K.W.: CPU MISER: A performance-directed, run-time system for power-aware clusters. In: Proceedings of the 2007 International Conference on Parallel Processing (ICPP 2007), pp. 18–25. IEEE Computer Society, Los Alamitos (2007) 12. Hsu, C., Feng, W.: A power-aware run-time system for high-performance computing. In: Proceedings of the 2005 ACM/IEEE Supercomputing Conference (SC 2005). IEEE Computer Society, Los Alamitos (2005) 13. Waldspurger, C.A., Weihl, W.E.: Lottery scheduling: flexible proportional-share resource management. In: OSDI 1994: Proceedings of the 1st USENIX conference on Operating Systems Design and Implementation, Berkeley, CA, USA. USENIX Association (1994) 14. Sahai, A., Machiraju, V., Sayal, M., van Moorsel, A.P.A., Casati, F.: Automated SLA monitoring for web services. In: Feridun, M., Kropf, P.G., Babin, G. (eds.) DSOM 2002. LNCS, vol. 2506, pp. 28–41. Springer, Heidelberg (2002)

128

W. Binder and N. Suri

15. Ludwig, H., Dan, A., Kearney, R.: Cremona: An architecture and library for creation and monitoring of WS-Agreements. In: ICSOC 2004: Proceedings of the 2nd international conference on Service oriented computing, pp. 65–74. ACM Press, New York (2004) 16. Barbon, F., Traverso, P., Pistore, M., Trainotti, M.: Run-Time Monitoring of Instances and Classes of Web-Service Compositions. In: Proceedings of ICWS 2006 (2006) 17. Jurca, R., Binder, W., Faltings, B.: Reliable QoS monitoring based on client feedback. In: 16th International World Wide Web Conference (WWW 2007), Banff, Alberta, Canada, pp. 1003–1012. ACM, New York (2007) 18. Fuggetta, A., Picco, G.P., Vigna, G.: Understanding Code Mobility. IEEE Transactions on Software Engineering 24(5), 342–361 (1998)

On the OBDD Complexity of Threshold Functions and the Variable Ordering Problem (Extended Abstract) Beate Bollig LS2 Informatik, TU Dortmund, 44221 Dortmund, Germany [email protected]

Abstract. Ordered binary decision diagrams (OBDDs) are one of the most common dynamic data structures for Boolean functions. Among the many areas of application are verification, model checking, computer aided design, relational algebra, and symbolic graph algorithms. Threshold functions are the basic functions for discrete neural networks and are used as building blocks in the design of symbolic graph algorithms. In this paper the first exponential lower bound on the size of a more general model than OBDDs and the first nontrivial asymptotically optimal bound on the OBDD size for a threshold function are presented. Furthermore, if the number of different weights is a constant it is shown that computing an optimal variable order for multiple output threshold functions is NP-hard whereas for single output function the problem is solvable in deterministic polynomial time. Keywords: Computational complexity, ordered binary decision diagrams, threshold functions, variable ordering problem.

1 1.1

Introduction and Results Ordered Binary Decision Diagrams and Threshold Functions

When working with Boolean functions as in circuit verification, synthesis, and model checking, ordered binary decision diagrams, denoted OBDDs, introduced by Bryant [6], are one of the most often used data structures supporting all fundamental operations on Boolean functions. Furthermore, in the last years a research branch has emerged which is concerned with the theoretical design and analysis of so-called symbolic algorithms which solve graph problems on OBDD-represented graph instances (see, e.g., [9,10], [23]). Definition 1. Let Xn = {x1 , . . . , xn } be a set of Boolean variables. A variable order π on Xn is a permutation on {1, . . . , n} leading to the ordered list xπ(1) , . . . , xπ(n) of the variables. In the following a variable order π is sometimes identified with the corresponding order xπ(1) , . . . , xπ(n) of the variables if the meaning in clear from the context. M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 129–140, 2009. c Springer-Verlag Berlin Heidelberg 2009 

130

B. Bollig

Definition 2. A π-OBDD on Xn is a directed acyclic graph G = (V, E) whose sinks are labeled by Boolean constants and whose non sink (or inner ) nodes are labeled by Boolean variables from Xn . Each inner node has two outgoing edges one labeled by 0 and the other by 1. The edges between inner nodes have to respect the variable order π, i.e., if an edge leads from an xi -node to an xj -node, π −1 (i) ≤ π −1 (j) (xi precedes xj in xπ(1) , . . . , xπ(n) ). Each node v represents a Boolean function fv : {0, 1}n → {0, 1} defined in the following way. In order to evaluate fv (b), b ∈ {0, 1}n , start at v. After reaching an xi -node choose the outgoing edge with label bi until a sink is reached. The label of this sink defines fv (b). The size of a π-OBDD G is equal to the number of its nodes and the π-OBDD size of a function f , denoted by π-OBDD(f ), is the size of the minimal π-OBDD representing f . SBDDs (shared binary decision diagrams) are an extension of OBDDs that can express multiple functions. An SBDD represents a Boolean function f ∈ Bn,m : {0, 1}n → {0, 1}m by representing simultaneously the output functions f1 , f2 , . . . , fm of f , where the representations for the different coordinate functions f1 , f2 , . . . , fm may share nodes. The size of the the reduced π-SBDD representing f is described by the following structure theorem [18]. Theorem 1. The number of xπ(i) -nodes of the π-SBDD for f = (f1 , . . . , fm ) is the number si of different subfunctions fj|xπ(1) =a1 ,...,xπ(i−1) =ai−1 , 1 ≤ j ≤ m and a1 , . . . , ai−1 ∈ {0, 1}, essentially depending on xπ(i) (a function g depends essentially on a Boolean variable z if g|z=0 = g|z=1 ). It is well known that the size of an OBDD or an SBDD representing a function f depends on the chosen variable order and may vary between linear and exponential size. Since in applications the variable order π is not given in advance we have the freedom (and the problem) to choose a good order for the representation of f . Definition 3. The OBDD size or OBDD complexity of f (denoted by OBDD(f )) is the minimum of all π-OBDD(f ). Analogously the SBDD size or SBDD complexity of a multiple output function is defined. A variable order π is called optimal for a Boolean function f if π-OBDD(f ) (π-SBDD(f )) is equal to OBDD(f ) (SBDD(f )). Read-once branching programs, denoted BP1s, also sometimes called free binary decision diagrams, are a more general model where the variable orders on different paths may be different. Threshold functions are the basic functions for discrete neural networks. Definition 4. The threshold function Tw1 ,...,wn ,t ∈ Bn with integer weights w1 , . . . , wnand threshold value t computes 1 on input b iff b1 w1 + · · · + bn wn ≥ t. The sum ni=1 bi wi is called the weight of the input b. Obviously, the output of a threshold function depends on a partial input (b1 , . . . , bi ) only via the partial sum b1 w1 + · · · + bi wi and O(n(w1 + · · · + wn )) is

On the OBDD Complexity of Threshold Functions

131

an upper bound on the OBDD size for the representation of fw1 ,...,wn ,t according to an arbitrary variable order. Because of the importance of threshold functions several questions like the number of different threshold functions, the maximum weight of threshold functions, and the realization of general Boolean functions by a network of threshold functions have been investigated (see, e.g., [15]). Furthermore, for the analysis of the runtime of an OBDD-based algorithm for topological sorting generalized threshold functions called multivariate threshold functions have been defined in [22,23]. Later on multivariate threshold functions have been used to design and analyze symbolic graph algorithms (see, e.g., [16,17]). Another motivation for the investigation of threshold functions represented by BDDs is the following one. Many combinatorial problems can be formulated as 0/1 integer programs (0/1 IPs). Obviously, a linear constraint can be seen as a threshold function. In [1] a new approach is presented how to solve combinatorial problems using BDDs. An SBDD is used to represent a set of inequalities, afterwards the single output functions represented in the SBDD are combined by conjunction such that the final OBDD represents all 0/1 solutions of a linear program. Obviously, one aim is to find an SBDD of small size for the representation of all inequalities. 1.2

Results and Related Work

Although many exponential lower bounds on the OBDD size of Boolean functions are known and the method how to obtain such bounds is simple, there are only few functions where the OBDD size is asymptotically known exactly (see, e.g., [3,5].) In Section 2 we prove a nontrivial asymptotically optimal bound of Θ(n3 ) on the size of OBDDs representing a threshold function. 1/2 In [11] the first exponential lower bound of Ω(n2n /2 ) on the OBDD size of a threshold function is proved. Later on this lower bound has been improved up to 1−ε Ω(n2cn ), where c is a constant and ε is an arbitrary small constant (see [19]). Section 3 contains (to the best of our knowledge) the first exponential lower 1/2 bound of Ω(n−1/4 2n ) on the size of read-once branching programs (BP1s) for a threshold function on n variables. For this result, we use the fact that threshold functions with nonnegative weights are monotone functions and some of the smallest 1-inputs of our function correspond to the 1-inputs of a function with large read-once branching program size called permutation function PERM (see [13,14]). (The smallest 1-inputs b = (b1 , . . . , bn ) of a monotone function are 1-inputs for which the function value for each input b = (b1 , . . . , bn ), b = b and bi ≤ bi , is 0.) Since Boolean functions like the greater than function GT can be represented by a threshold function with exponential weights it is not difficult to see that also for threshold functions the choice of the variable order is essential to obtain OBDDs of small size. In [11,19] the relation between the variable order and the size of OBDDs representing threshold functions is investigated. In [11] it has been shown that the descending order of weights can lead to exponentially larger OBDDs than the optimal variable order. Moreover, it has been proved that the reversed variable order can only lead to an increase of n − 1 nodes.

132

B. Bollig

For general Boolean functions this property is not fulfilled. Furthermore, it is impossible to find a good variable order for threshold functions only from the total order of weights [19]. It is unknown whether there exists a polynomial deterministic algorithm for the computation of an optimal variable order for a threshold function with arbitrary weights. In [1] a 0/1 IP for finding an optimal variable order has been presented whose worst case runtime is exponential. The task to compute the optimal variable order for a general Boolean function f ∈ Bn,m given by an SBDD is NP-hard [20]. The result has been strengthened in [4] for single output functions f ∈ Bn given by an OBDD. For monotone functions the task is still NP-hard [12]. As has been expressed in [12] the next important goal seems to (dis)prove that computing an optimal variable order is NP-hard for threshold functions. In Section 4 we prove that for functions f = (f1 , . . . , fm ), where fi , 1 ≤ i ≤ m, are threshold functions represented by an SBDD, the problem to compute an optimal variable order is already NP-hard if there are only two different weights of linear size. For single output functions the situation is different. We show that there is an algorithm for the computation of an optimal variable order for a threshold function which has polynomial runtime if the number of different weights is a constant.

2

An Asymptotically Optimal Bound on the OBDD Complexity of a Threshold Function

In this section we prove an asymptotically optimal lower bound of Ω(n3 ) on the size of a threshold function. The corresponding upper bound follows from the observation that there can be at most as many nodes labeled by the same variable as the sum of the weights. The following lemma will be crucial for our lower bound proof. Lemma 1. Let i1 , i2 , . . . , ik be different integers in N and S := {s | s = k j=1 aj ij , aj ∈ {0, 1} for 1 ≤ j ≤ k}. The size of S is at least k(k + 1)/2 + 1. Proof. We prove by induction that the cardinality of S is at least k(k + 1)/2 + 1. For k = 1 there are two elements in S: 0 and i1 . Since N does not contain 0 and 2 = 2/2 + 1 we are done. Now, w.l.o.g. let i1 < i2 < . . . < ik−1 < ik . The size of S  := {s | s = k−1 j=1 aj ij , aj ∈ {0, 1} for 1 ≤ j ≤ k − 1} is at least (k − 1)k/2 + 1. We consider k−1  the k different elements s1 < s2 . . . < sk in S  , where s := j=1 aj ij and k−1  k−1   j=1 aj = k − 2 or j=1 aj = k − 1. S contains all elements in S and also s1 + ik , s2 + ik , . . . , sk + ik which are different and cannot be in S  since sk is the largest element in S  and s1 + ik > sk . Therefore, there are at least (k − 1)k/2 + 1 + k = k(k + 1)/2 + 1 elements in S. 2 Theorem 2. The OBDD complexity of the threshold function fn := T1,2,...,n,n(n+1)/4 is Θ(n3 ).

On the OBDD Complexity of Threshold Functions

133

In the following for the sake of simplicity we do not apply floor or ceiling functions to numbers even when they need to be integers whenever this is clear from the context and has no bearing on the essence of the proof. Proof. The upper bound on the OBDD complexity of fn is n · t = O(n3 ) for t = n(n + 1)/4. In the rest of the proof let π be an arbitrary but fixed variable order and j be an arbitrary but fixed integer in {0, 1, 2, . . . , n/8}. Our aim is to prove that there are at least j(j+1)/2+1 different subfunctions fn|xπ(1) =a1 ,...,xπ(j) =aj , a1 , . . . , aj ∈ {0, 1}, that essentially depend on xπ(j+1) . Therefore, we can conclude that the OBDD complexity of fn is at least Ω(n3 ). We call (xi , xn−i+1 ) an x-pair, 1 ≤ i ≤ n/2. The sum of an x-pair is n + 1. Let U be the set of variables {xπ(1) , . . . , xπ(j) } and L be Xn \ U . The x-variables (x2i−1 , xn−(2i−1)+1 , x2i , xn−2i+1 ), 1 ≤ i ≤ n/4, are called 1tuples. Note, that by setting two variables of a 1-tuple to 1 it is possible to obtain the sum 2i + n − (2i − 1) + 1 = n + 2 and the sum 2i − 1 + n − 2i + 1 = n. A 1-tuple is called destroyed with respect to U and L if one of its variables is in U . There are at least n/4 − j ≥ n/8 1-tuples that are not destroyed in L. Using Lemma 1 we know that there are at least j(j + 1)/2 + 1 different assignments to the variables in U that lead to different partial sums s1 , . . . , sj(j+1)/2+1 . It is not difficult to see that partial sums s and s , where |s − s | ≥ n + 1, correspond to different subfunctions. Therefore, we consider partial sums s and s where |s − s | < n + 1. Moreover, let s = p(n + 1) + r1 , s = p(n + 1) + r2 , and r1 < r2 < n + 1. If there exists an integer , where r1 ≤  ≤ r2 − 1 and xn− ∈ L, it is easy to see that s and s correspond to different subfunctions. Since |U | = j, there exists a variable xn− ∈ L, r1 ≤  ≤ r2 − 1, if the difference between r2 and r1 is greater than j. Therefore, we assume that r2 − r1 ≤ j. Because there are only j variables in U , there exists a variable xn−r2 −j  +1 or a variable xn−r1 +j  +1 , 0 ≤ j  ≤ j/2 ≤ n/16, in L. Assume that there is a variable xn−r2 −j  +1 ∈ L (the other case can be handled similarly). Our aim is to construct an assignment to the variables in L whose partial sum is n(n + 1)/4 − s = n(n + 1)/4 − (p + 1)(n + 1) + n + 1 − r2 , in order to prove that the assignments with the partial sums s and s correspond to different subfunctions. Since j ≤ n/8 we know that p is less than n/8. We choose a variable xn−r2 −j  +1 ∈ L, where j  ≤ n/16. Since there are at least n/8 not destroyed 1-tuples in L, we can choose j  not destroyed 1-tuples and furthermore, (n/4−p−1−j ) x-pairs in R. The variable xn−r2 −j  +1 and the chosen x-variables that do not belong to the chosen 1-tuples are set to 1. For each chosen 1-tuple we replace two of the corresponding variables by 1 such that their partial sum is n + 2, the other 2 variables are set to 0. The remaining variables in L are set to 0. Altogether the partial sum of the considered assignment is (n/4−p−1−j )(n+1)+n−r2 −j  +1+j (n+2) = (n/4−p−1)(n+1)+n−r2 +1 and we are done.

134

B. Bollig

Until now we have proved that there are at least j(j + 1)/2 + 1 different subfunctions obtained by replacing the variables in U by constants. In order to prove that there are at least j(j + 1)/2 + 1 nodes labeled by the variable xπ(j+1) , we have to show that the considered subfunctions essentially depend on the variable xπ(j+1) . Therefore, we consider an arbitrary partial sum s1 (n + 1) + s2 , 0 ≤ s1 < n/8 and 0 ≤ s2 < n + 1. Case 1: π(j + 1) + s2 ≥ n + 1 We consider the following assignment to the variables in L \ {xπ(j+1) }. Variables of (n/4 − s1 − 1) x-pairs are set to 1, the remaining variables are set to 0. Iff xπ(j+1) = 1 the functions value of fn is 1. Case 2: π(j + 1) + s2 < n + 1 We know that n + 1 − (π(j + 1) + s2) ≤ n/8 or there is at least one variable x in L where n + 1 − (π(j + 1) + s2 ) − n/8 ≤  < n + 1 − (π(j + 1) + s2 ). We consider the following assignment to the variables in L \ {xπ(j+1) }. - The variable x is set to 1. - Half of the variables of (n + 1) − (π(j + 1) + s2 ) −  1-tuples are set to 1 such that their corresponding sum is (n + 2)(n + 1 − (π(j + 1) + s2 ) − ). The remaining variables of the 1-tuples are set to 0. - Moreover, exactly n/4 − s1 − (n + 1 − (π(j + 1) + s2 ) − ) − 1 x-pairs are set to 1. The function value of fn is 1 iff xπ(j+1) is set to 1. Altogether we have shown that there are at least n/8 

j(j + 1)/2 + 1 = Θ(n3 )

j=0

different subfunctions that have to be represented in an OBDD for fn .

2

Note, that we have shown that π-OBDD(fn ) = Θ(n3 ) for every variable order π.

3

An Exponential Lower Bound on the BP1 Complexity of a Threshold Function

In this section we present to the best of our knowledge the first exponential lower bound on the size of read-once branching programs for a threshold function. Definition 5. The threshold function Tn is defined on n2 variables xij , 0 ≤ i, j ≤ n − 1, for n ∈ N. The threshold value t is 22n − 1 and the weights wij are defined as 2i + 2n+j . Theorem 3. The read-once branching program complexity of the function Tn is at least Ω(n−1/2 2n ).

On the OBDD Complexity of Threshold Functions

135

Proof. In [13,14] exponential lower bounds on the size of so-called nondeterministic BP1s representing the function PERMn , the test, whether a Boolean matrix contains exactly one 1-entry in each row and in each column, are presented. Here for the choice of the considered subpaths and for the estimation of the number of different chosen subpaths some of their ideas are used. Let G be a read-once branching program for the threshold function Tn . We consider 1-inputs of the function Tn with weight t and exactly n variables set to 1. It is easy to see that these 1-inputs have the property that for each index i or j, 0 ≤ i, j ≤ n − 1, there is exactly one variable xi∗ or x∗j set to 1. Next, we investigate the computation paths for these inputs, i.e., the corresponding paths to the 1-sink in G. The number of these paths is n!. Note, that there are exactly n 1-edges, i.e., variables set to 1, on these paths but there can be less than n2 edges altogether because variables may be left out. Now, we separate each investigated computation path p into its initial path until there are n/2 1-edge on the subpath for the first time and into the rest. Let Rp (Cp ) be the set of indices i for which a variable xi∗ (x∗i ) is set to 1 on p. If n/2 rows and columns have been chosen, there are n/2! possibilities to map the indices of the rows to the indices of the columns. Therefore,  n there is a set P , such that for of different initial paths from the source to the cut, |P | ≥ n/2 two different paths p and p we know that Rp = Rp or Cp = Cp . Since the weight of the inputs corresponding to the investigated computation paths is t we can conclude that two different initial paths p and p in P cannot lead to the same node in G. The reason is the following one. The weight of a path p is the sum of the weights of the variables set to 1 on p. Let wp be the weight of p and wp be the weight of p , w.l.o.g. wp < wp . Due to our construction we know that there is an extension of p with weight t − wp and an extension of p with weight t − wp leading to the 1-sink. Since wp + t − wp < t the subfunctions of Tn corresponding to p and p are different and the paths cannot lead to the same node in G. Hence, the size of the set P is a lower bound on the size of G. 2 Using Stirling’s formula we obtain a lower bound of Ω(n−1/2 2n ).

4

On the Variable Ordering Problem for SBDDs

In [19] it has been shown that it is not always possible to find a good variable order only from the total order of weights. In this section we investigate the problem OPTIMAL THRESHOLD SBDD (OTS for short). Input: An SBDD G for a threshold function f = (f1 , f2 , . . . , fn ) and a size bound s. Output: Yes, if the function f represented by G can be represented by an SBDD with at most s nodes. No, otherwise.

136

B. Bollig

Theorem 4. The problem OTS is NP-complete. Sketch of proof. The problem OTS is in NP. The SBDD can be guessed. The equivalence of OBDDs with respect to different variable orders can be verified in deterministic polynomial time [7]. Since each coordinate function fi , 1 ≤ i ≤ n , can be checked separately, we are done. As in [4,20] our NP-hardness proof uses a polynomial time reduction from the problem OPTIMAL LINEAR ARRANGEMENT (OLA for short) that is defined in the following way. Input: An undirected graph H = (V = {1, 2, . . . , n}, E) and a bound b. Output: Yes, if there is a permutation π on {1, 2, . . . , n} such that  |π(u) − π(v)| ≤ b. cost(π) := {u,v}∈E

No, otherwise. The cost of π measures the length of all edges if the vertices of H are arranged in linear order with respect to π. We present a polynomial time reduction from OLA to OTS. Let H = (V, E) and b be given and m := |E|. Since isolated vertices in H cannot influence the cost of a linear arrangement we assume in the following that there are no isolated vertices in H. We have to transform the input (H, b) for OLA into an input (G, s) for OTS such that the minimal SBDD size of the function represented by G is at most s iff the cost of an optimal linear arrangement for H is at most b. For the ith edge {j, k}, 1 ≤ i ≤ m and j, k ∈ {1, 2, . . . , n}, we introduce similar to the proof in [12] an edge-function  xi . fi (x1i , x2i , . . . , xni ) = (xji ∨ xki ) ∧ 1≤≤n ∈{j,k} /

The function fi can be encoded as a threshold function Tfi in the following way. The weights wji and wki are 1, the other weights wi are set to m, and tfi := m(n − 2) + 1. (Here we use the weight wi because our aim is to use only 2 different weights for our input for OTS.) It is easy to see that the size for an OBDD representing Tfi with respect to a variable order xπ(1)i , xπ(2)i , . . . , xπ(n)i is n + |π −1 (j) − π −1 (k)| − 1. Different edge functions are defined on disjoint sets of variables. Next, we introduce so called glue functions in order to relate the size of an optimal linear arrangement and the size of an optimal SBDD. The glue function gj , 1 ≤ j ≤ n, is defined on n · m variables x11 , x12 , . . . , xnm .  gj (x11 , x12 , . . . , xnm ) = (xj1 ∨ . . . ∨ xjm ) ∧ xi . 1≤≤n, =j 1≤i≤m

On the OBDD Complexity of Threshold Functions

137

The function gj can be encoded as a threshold function Tgj in the following way. The weights wji , 1 ≤ i ≤ m, are 1, all other weights wi are set to m, and tgj := m2 (n − 1) + 1. A blockwise variable order is a variable order where the variables of each block Bj := {xj1 , xj2 , . . . , xjm }, 1 ≤ j ≤ n, are tested one after another. The following lemma is easy to prove. Lemma 2. The SBDD size of T = (f1 , . . . , fm , g1 , . . . , gn ) with respect to a blockwise variable order Bπ(1) , . . . , Bπ(n) is n · m + cost(π) − m + mn(n + 1)/2 − 1. Representations of different glue functions gj  and gj  can only share nodes if all but the last one of the Bj  - and Bj  - variables have been tested. The representations of the edge functions cannot share nodes because they are defined on disjoint sets of variables. If a subfunction of a glue function depends on some Bi -variable it depends on all Bi -variables not yet tested. Therefore, an edge function only shares nodes with a glue function for variables that are the last variables of their corresponding blocks. In the situation of Lemma 2 only the last node in the SBDD can be shared. Altogether we are now able to define the size bound s in our reduction: s := n · m + cost(π) − m + mn(n + 1)/2 − 1. In order to prove the correctness of our reduction it remains to prove that some optimal variable order of T = (f1 , . . . , fm , g1 , . . . , gn ) is a blockwise variable order. Lemma 3. There exists a blockwise variable order that is optimal for T = (f1 , . . . , fm , g1 , . . . , gn ). Lemma 3 holds since the glue functions g1 , . . . , gn cannot share many nodes if the variables are not tested blockwise. Sketch of proof. We change a given (optimal) variable order π in at most (n − 1) phases until it is a blockwise variable order. If no phase increase the SBDD size we are done. First, we ensure that the last m variables build a block, then we do the same for the variables at positions (n − 2)m + 1, . . . , (n − 1)m, afterwards for the variables at positions (n − 3)m + 1, . . . , (n − 2)m and so on. Since our glue functions are very simple we have to count the nodes in the investigated SBDD very carefully. This can be done by case inspection and solving some combinatorial problems. As we have seen the problem OTS is already NP-complete if we uses only two different weights in all coordinate functions. In the next section we will see that in this case the situation for single output functions is easier.

138

5

B. Bollig

On the Variable Ordering Problem for OBDDs

In this section we show that for threshold functions, where the number of different weights is a constant, an optimal variable order and the size of an optimal OBDD can be computed in polynomial time with respect to the number of variables of the considered function. Moreover, for this computation it is unnecessary to create the corresponding OBDD. Due to the lack of space we only sketch the ideas. The following well-known fact is crucial for the correctness of our algorithm. Let Π be the set of variable orders π, where X 1 , xi , X 2 is a partition of the variable set Xn = {x1 , x2 , . . . , xn } and the X 1 -variables are situated before xi in π and the X 2 -variables after xi . The number of xi -nodes in a minimal π-OBDD representing a function f ∈ Bn is the same for all π ∈ Π. Our case is easier than the general one because we can summarize sets of variable orders. We only need the information how many variables of the given weights are situated before or after a variable xi . As a result we do not have to consider every variable order but only representatives of sets of variable orders. Therefore, at any time there can be only a polynomial number of information of polynomial length that we have to compute. In the following we use ideas of the dynamic programming approach of Friedman and Supowit [8] adapted for the special case of threshold functions. Let Tw1 ,w2 ,...,wn ,t be a threshold function on the variables x1 , x2 , . . . , xn , where |{wi | 1 ≤ i ≤ n}| = c for a constant c. W.l.o.g. let w1 , w2 , . . . , wc be different. A wi -variable is a variable of weight wi . In the following we identify sometimes subsets of variables with subsets of their corresponding weights if the meaning is clear from the context. We call two subsets of variables different if their cardinalities are different or there exists a weight wi , 1 ≤ i ≤ c, such that there are more wi -variables in one of the sets as in the other one. If two subsets are not different they are called identical. Identical subsets can be summarized into classes and for each class we can identify one representative with the corresponding class of subsets. It is not difficult to find the corresponding representative for a subset of variables. The number of representatives is at most O(nc+1 ). In a preprocessing step we compute for each representative S := {xi1 , xi2 , . . . , xik }, 1 ≤ k ≤ n, the set of corresponding possible sums of weights WS := {wS | ws = bi1 wi1 + · · · + bik wik , bij ∈ {0, 1} for 1 ≤ j ≤ k}. We process the chosen representatives in ascending order of their cardinalities k, 1 ≤ k ≤ n. At the beginning of a phase we know for each representative S of cardinality k − 1 the minimal number size(S) of nodes labeled by variables corresponding to S in an OBDD, where the S-variables are situated at the end of the corresponding variable order, and the corresponding partial variable order on the S-variables. Let S be the representative of the set Xn \ S. For each wi , 1 ≤ i ≤ c, for which not all variables with weight wi are in S, we compute the following: 1) Let xj be a variable with weight wi that is not contained in S and Swi be the representative of the subset Xn \ S ∪ {xj } and Swi be the representative of the subset S ∪ {xj }.

On the OBDD Complexity of Threshold Functions

139

2) For each element wSw in WSw we determine whether the following property i i Pd is fulfilled: there exists an element wS in WS , where wSw + wi + wS ≥ t i and wSw + wS < t. Let WS be the subset of the elements in WSw that i

wi

i

fulfill property Pd . 3) Let s1 , s2 , . . . , sl be the elements of WS and w.l.o.g. s1 < s2 < . . . < sl . For wi all sm , sm+1 , 1 ≤ m ≤ l − 1, we determine whether the property Pm is fulfilled: there exists an element w in WSwi , where sm +w < t and sm+1 +w ≥ t. Let WS be the subset of the elements in WS that fulfill property Pm . wi

wi

4) The number of Swi -nodes in a π-OBDD where the Swi -variables are situated at the end of π and a wi -variable at the beginning of the Swi -variables is size(S) + |WSw | + 1. i

5) For the computation of the minimal number size(Swi ) of nodes labeled by variables corresponding to Swi in an OBDD where the Swi -variables are situated at the end of the corresponding variable order, we have to take into consideration that for every weight wi , 1 ≤ i ≤ c, for which there is a wi -variable in Swi , a wi -variable can be the first variable of the Swi variables. Therefore, size(Swi ) is computed as the minimum number of at most c numbers. The number of necessary nodes and the corresponding partial variable order of the Swi -variables is stored. At the end of the nth phase we know an optimal variable order and the OBDD complexity of the function Tw1 ,w2 ,...,wn ,t .

Acknowledgment The author would like to thank S´ andor Fekete for discussions on the subject of the paper and an easier proof of Lemma 1.

References 1. Behle, M.: On threshold BDDs and the optimal variable ordering problem. In: Dress, A.W.M., Xu, Y., Zhu, B. (eds.) COCOA 2007. LNCS, vol. 4616, pp. 124– 135. Springer, Heidelberg (2007) 2. Bollig, B.: On the OBDD complexity of the most significant bit of integer multiplication. In: Agrawal, M., Du, D.-Z., Duan, Z., Li, A. (eds.) TAMC 2008. LNCS, vol. 4978, pp. 306–317. Springer, Heidelberg (2008) 3. Bollig, B., Range, N., Wegener, I.: Exact OBDD bounds for some fundamental functions. In: Geffert, V., Karhum¨ aki, J., Bertoni, A., Preneel, B., N´ avrat, P., Bielikov´ a, M. (eds.) SOFSEM 2008. LNCS, vol. 4910, pp. 174–185. Springer, Heidelberg (2008) 4. Bollig, B., Wegener, I.: Improving the variable ordering of OBDDs is NP-complete. IEEE Trans. on Computers 45(9), 993–1002 (1996)

140

B. Bollig

5. Bollig, B., Wegener, I.: Asymptotically optimal bounds for OBDDs and the solution of some basic OBDD problems. Journal of Computer and System Sciences 61, 558– 579 (2000) 6. Bryant, R.E.: Graph-based algorithms for Boolean function manipulation. IEEE Trans. on Computers 35, 677–691 (1986) 7. Fortune, F., Hopcroft, J.E., Schmidt, E.M.: The complexity of equivalence and containment for free single variable program schemes. In: Ausiello, G., B¨ ohm, C. (eds.) ICALP 1978. LNCS, vol. 62, pp. 227–240. Springer, Heidelberg (1978) 8. Friedman, S., Supowit, K.: Finding the optimal variable ordering for binary decision diagrams. IEEE Trans. on Computers 39(5), 710–713 (1990) 9. Gentilini, R., Piazza, C., Policriti, A.: Computing strongly connected components in a linear number of symbolic steps. In: Proc. of SODA, pp. 573–582. ACM Press, New York (2003) 10. Gentilini, R., Piazza, C., Policriti, A.: Symbolic graphs: linear solutions to connectivity related problems. Algorithmica 50, 120–158 (2008) 11. Hosaka, K., Takenaga, Y., Kaneda, T., Yajima, S.: Size of ordered binary decision diagrams representing threshold functions. Theoretical Computer Science 180, 47– 60 (1997) 12. Iwama, K., Nozoe, M., Yajima, S.: Optimizing OBDDs is still intractable for monotone functions. In: Brim, L., Gruska, J., Zlatuˇska, J. (eds.) MFCS 1998. LNCS, vol. 1450, pp. 625–635. Springer, Heidelberg (1998) 13. Jukna, S.: The effect of null-chains on the complexity of contact schemes. In: Csirik, J.A., Demetrovics, J., Gecseg, F. (eds.) FCT 1989. LNCS, vol. 380, pp. 246–256. Springer, Heidelberg (1989) 14. Krause, M., Meinel, C., Waack, S.: Separating the eraser Turing machine classes Le , N Le , co-N Le and Pe . Theoretical Computer Science 86, 267–275 (1991) 15. Muroga, S.: Threshold logic and its application. Wiley, New York (1971) 16. Sawitzki, D.: Experimental studies of symbolic shortest-path algorithms. In: Ribeiro, C.C., Martins, S.L. (eds.) WEA 2004. LNCS, vol. 3059, pp. 482–497. Springer, Heidelberg (2004) 17. Sawitzki, D.: On symbolic scheduling independent tasks with restricted execution times. In: Nikoletseas, S.E. (ed.) WEA 2005. LNCS, vol. 3503, pp. 277–289. Springer, Heidelberg (2005) 18. Sieling, D., Wegener, I.: NC-algorithms for operations on binary decision diagrams. Parallel Processing Letters 48, 139–144 (1993) 19. Takenaga, Y., Nozoe, M., Yajima, S.: Size and variable ordering of OBDDs representing threshold functions. In: Jiang, T., Lee, D.T. (eds.) COCOON 1997. LNCS, vol. 1276, pp. 91–100. Springer, Heidelberg (1997) 20. Tani, S., Hamagushi, K., Yajima, S.: The complexity of the optimal variable ordering problems of a shared binary decision diagram. In: Ng, K.W., Balasubramanian, N.V., Raghavan, P., Chin, F.Y.L. (eds.) ISAAC 1993. LNCS, vol. 762, pp. 389–396. Springer, Heidelberg (1993) 21. Wegener, I.: Branching Programs and Binary Decision Diagrams - Theory and Applications. SIAM Monographs on Discrete Mathematics and Applications (2000) 22. Woelfel, P.: Symbolic topological sorting with OBDDs. In: Rovan, B., Vojt´ aˇs, P. (eds.) MFCS 2003. LNCS, vol. 2747, pp. 671–680. Springer, Heidelberg (2003) 23. Woelfel, P.: Symbolic topological sorting with OBDDs. Journal of Discrete Algorithms 4(1), 51–71 (2006)

Natural Specifications Yield Decidability for Distributed Synthesis of Asynchronous Systems Thomas Chatain, Paul Gastin, and Nathalie Sznajder LSV, ENS de Cachan, CNRS 61, Av. du Pr´es. Wilson, F-94230 Cachan, France {Thomas.Chatain,Paul.Gastin,Nathalie.Sznajder}@lsv.ens-cachan.fr

Abstract. We study the synthesis problem in an asynchronous distributed setting: a finite set of processes interact locally with an uncontrollable environment and communicate with each other by sending signals – actions that are immediately received by the target process. The synthesis problem is to come up with a local strategy for each process such that the resulting behaviours of the system meet a given specification. We consider external specifications over partial orders. External means that specifications only relate input and output actions from and to the environment and not signals exchanged by processes. We also ask for some closure properties of the specification. We present this new setting for studying the distributed synthesis problem, and give decidability results: the non-distributed case, and the subclass of networks where communication happens through a strongly connected graph. We believe that this framework for distributed synthesis yields decidability results for many more architectures. Keywords: Distributed synthesis, Asynchronous systems.

1

Introduction

The synthesis problem consists in, given a high-level description of a system, automatically producing a program that behaves according to this specification. This can be parametrized by the specification language and the target model. In this work, we address this problem for open, distributed, asynchronous systems, with specifications over partial orders. In open reactive systems, the process interacts with an uncontrollable environment and its behavior depends on this interaction. The goal is then to synthesize strategies that control the actions of the system and not those of the environment (see for instance [1,7,8,15]). The distributed case (that is, considering a set of processes that can cooperate against an environment, each process having only a local view of the system) is more involved, and the main hardness result is due to [17]. They proved that, when all processes and the environment evolve synchronously, the general problem is undecidable for LTL specifications, and that LTL synthesis for pipelines is decidable 

Partially supported by projects ARCUS ˆIle de France–Inde, DOTS (ANR-06-SETIN003), and P2R MODISTE-COVER/Timed-DISCOVERI.

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 141–152, 2009. c Springer-Verlag Berlin Heidelberg 2009 

142

T. Chatain, P. Gastin, and N. Sznajder

(though non elementary). Some other classes of architectures have been proved decidable: 2-ways pipelines for CTL∗ specifications [9], doubly-flanked pipelines for local specifications [11], uniformly well-connected architecture for CTL∗ specifications [5]. Synthesis in an asynchronous communication framework has first been studied in [16]. They considered single-process implementations and lineartime specifications. Later, [12] considered the problem in a distributed setting and exhibited a specific class of controllers for which distributed synthesis is decidable for trace-closed specifications. They strenghtened this result in [13], where restrictions on communication patterns of controllers have been reduced. Considering controllers with causal memories yields decidability results for another subclass of systems in [4]. To reason about distributed synthesis in a more abstract framework, both with synchronous and asynchronous semantics, [14] proposed the framework of distributed games – a specialized version of multiplayer games. Recently, the synthesis of asynchronous distributed systems in the general case of μ-calculus specifications was studied in [3]. Here we study a new model, different from the one of [12] in two ways: when there, processes evolve asynchronously only with respect to each other, in our model they also evolve locally asynchronously with respect to the environment. A second difference is in the communication mechanism: whereas in [12] the synchronization of processes is done by rendez-vous (handshaking), we use signals and define for each action an owner that can trigger it, the signal being immediately received by the other process regardless of whether it is willing to receive it or not. This communication mechanism is more convenient than shared variables communication, and more realistic than rendez-vous. As in [5], we do not allow our specifications to constrain the internal behaviour of the system: communications between processes are only restricted by the communication architecture, not by the specification. This assumption is more natural from a practical point of view – when describing the way a system is expected to work, one is only concerned with its external behaviour, the way it interacts with the environment and not by internal communications processes may set up in order to achieve the specified global behaviour. In the framework of asynchronous distributed systems, executions are partial orders of actions. Our specifications will then be formulae whose models are partial orders of external actions. In addition, in order to rule out unnatural constraints between actions, specifications considered in this paper will have some closure properties, ensuring that we do not prevent causalities between events (this would restrain communication abilities of processes) or impose causalities between others when it would make no sense. With this model, we prove decidability for the synthesis problem for the class of architectures whose communication graph is strongly connected. We believe that the synthesis problem will be decidable for many more architectures with these hypotheses.

2

The Model

An architecture defines how a set of processes may communicate with each other and with an (uncontrollable) external environment. An important parameter of the problem is the type of communications allowed between processes. We are

Natural Specifications Yield Decidability for Distributed Synthesis

143

interested in asynchronous distributed systems, hence it would be natural to use unbounded fifo channels. However, this leads to infinite state systems, making decidability results more uncertain to obtain. A finite model can be obtained by using shared variables: processes can write on variables that can be read by other processes. But in an asynchronous system, communication is difficult to achieve with shared variables. Assume that process i wants to transmit to process j a sequence m1 , m2 , . . . of messages. First, i writes m1 to some shared variable x. But since processes evolve asynchronously, i does not know when m1 will be read by j. Hence, some acknowledgement is required from j to i before i may write m2 to x. Depending on the architecture, this may not be possible. In any cases, it makes synthesis of distributed programs satisfying a given specification harder. Hence, we will use point to point communication by signals in the vein of [10]. Sending a signal is an action but receiving a signal is not. Instead, all signals sent to some process j are automatically added to its local history, without requiring actions from j. The system is still asynchronous, meaning that processes evolve at different speeds. We are interested in synthesizing local programs, also called strategies. By local we mean that to decide which action it should execute next, a process j only knows its current local history, which automatically includes all signals sent to j in addition to the signals sent by j. Formally, an architecture is a tuple A = (Proc, E, (Ini )i∈Proc , (Outi )i∈Proc ) where (Proc, E) is the directed communication graph whose nodes are processes and there is an edge (i, j) ∈ E if process i may send signals to process j. For each process i ∈ Proc, the sets Ini and Outi define input and output signals that i may receive from or send to the environment. We assume that all these sets  are pairwise disjoint. We let In = i∈Proc Ini and Out = i∈Proc Outi be the sets of input and output signals of the whole system. Let also Γ = In ∪ Out. In order to realize a specification, the processes may choose for each communication link (i, j) ∈ E a set Σi,j of signals that i could send to j. Again, we assume that these sets are pairwise disjoint and disjoint from Γ . The complete  alphabet (of signals) is then Σ = Γ ∪ (i,j)∈E Σi,j . The actions in Γ are called external signals whereas the actions in Σ \ Γ are called internal signals. For each a ∈ Σ we let process(a) be the set of processes taking part in the execution of a: process(a) = {i} if a ∈ Ini ∪ Outi and process(a) = {i, j} if a ∈ Σi,j . It should be no surprise now that the concrete executions of our asynchronous distributed systems will be Mazurkiewicz traces. We consider the trace alphabet (Σ, D) where the dependence relation D ⊆ Σ × Σ is defined by: (a, b) ∈ D if process(a) ∩ process(b) = ∅. We recall that a Mazurkiewicz trace t over (Σ, D) is (an equivalence class of) a finite or infinite Σ-labelled poset t = (V, ≤, λ) such that for all x, y ∈ V , ↓x = {y ∈ V | y ≤ x} is finite, (λ(x), λ(y)) ∈ D implies x ≤ y or y ≤ x, and x  y implies (λ(x), λ(y)) ∈ D where x  y means that x < y and there is no z ∈ V such that x < z < y. We denote by R(Σ, D) the set of traces over (Σ, D) and by M(Σ, D) the set of finite traces. For i ∈ Proc, we denote by Σi = {a∈ Σ | i ∈ process(a)} the set of actions visible to process i and by Σic = Outi ∪ j|(i,j)∈E Σi,j the set of actions

144

T. Chatain, P. Gastin, and N. Sznajder

controlled by process i. A local strategy for process i is a mapping fi : Σi∗ → Σic . After a sequence of actions w ∈ Σi∗ visible to i (but not necessarily all initiated by i) fi (w) says which action in Σic the process i is willing to play. Observe that another action in Σi \ Σic can be executed by another process before process i had time to play according to its strategy. This would modify its local history, and thus may modify its strategy: processes are then reactive to signals sent to them by other processes and by the environment. A distributed strategy (or program) is a tuple F = (fi )i∈P roc of local strategies. Let t = (V, ≤, λ) be a run of the system and let v ∈ V . By definition of the dependence relation, the sets of events ↓i v = {x ∈ λ−1 (Σi ) | x ≤ v} and ⇓i v = ↓i v \{v} are totally ordered. We denote by λ(⇓i v) the word λ(x1 ) · · · λ(xn ) where {x1 , · · · , xn } = ⇓i v with x1 < · · · < xn . Let us fix a distributed strategy F . We say that a run t = (V, ≤, λ) is an F -run (or is compatible with strategy F ) if all controllable events are played according to F , i.e., for all v ∈ V such that λ(v) ∈ Σic , we have λ(v) = fi (λ(⇓i v)). Observe that, for a fixed distributed strategy F , even if inputs from the environment follow the same pattern, there are multiple F -runs depending on the scheduling of internal signals. A run t = (V, ≤, λ) is F -maximal if for any process i, either Vi = λ−1 (Σi ) is infinite, or fi is undefined on λ(Vi ).

3

The Specification

The specifications we consider only constrain external actions from Γ , i.e., actions that reflect communications with the environment. We want the processes to collaborate freely in order to achieve the specification, hence we do not constrain internal signals. Moreover, our specifications will be on partial orders, and not linearizations of executions. Indeed, specifying over interleavings allows to differentiate between equivalent linearizations, which is not desirable for distributed systems. For a concrete run t = (V, ≤, λ) we define the abstract (observable) run as the projection πΓ (t) = (λ−1 (Γ ), ≤ ∩ (λ−1 (Γ ))2 , λ). Specifications will then be formulae in some logical formalism whose models are Γ -labelled partial orders. We say that a concrete run t satisfies a specification ϕ if its projection πΓ (t) satisfies ϕ. Distributed synthesis: Given an architecture (Proc, E, (Ini )i∈Proc , (Outi )i∈Proc ) and a specification ϕ over Γ -labelled posest in an appropriate logic, decide whether there exist internal signal sets (Σi,j )(i,j)∈E and a distributed strategy F such that every F -maximal concrete F -run satisfies the specification ϕ. Acceptable Specifications. We explain now with some examples that not all specifications are acceptable in our framework. We start with an example showing that specifications must be closed under extensions of partial orders. Consider a distributed system with Proc = {p, q, r} and E = {(p, q), (q, r)}. Note that p cannot directly send signals to r. A natural specification could

Natural Specifications Yield Decidability for Distributed Synthesis

145

a

p

b

q

c r (a) Specification: A desired behavior p q

a

a

b

a b

c

r

b c

c

(b) Implementation: Three concrete runs p q r

a

a

b

a b

c

b c

c

(c) Corresponding observable (abstract) behaviors Fig. 1. Specifications must be closed under extensions

be that q must output b and that if p receives input a from the environment then r must later output c. This corresponds to the partial order represented in Figure 1(a). In order to implement this specification, when process p receives a it must send a signal to q and q should forward this signal to r so that r knows it should output c. But these internal signals will induce some additional ordering between a and b or between b and c as can be seen in Figure 1(b). None of the corresponding abstract runs in Figure 1(c) correspond to the partial order of the specification, though they are all extensions of it. Hence, we need to extend this specification so that it can be implemented. Formally, an (order) extension of a labelled partial order t = (V, ≤t , λ) is any partial order s = (V, ≤s , λ) with ≤t ⊆ ≤s . We will require our specifications to be closed under extensions. Next, we show that the specification should also be closed under some weakenings of the partial order. This is due to the fact that inputs from the environment are uncontrollable events. Hence, it seems unrealistic to try to impose a direct causality between any action on some process and an input event from the environment on another process. For instance, consider an architecture with two processes, one receiving service requests from a client and the other granting the service: Inc = {request} and Outs = {grant}. A naive specification could be an alternation of request and grant as presented in Figure 2(a). A possible implementation is presented in Figure 2(b) using two internal signals forward ∈ Σc,s and ready ∈ Σs,c . Since inputs from the environment are uncontrollable, we cannot enforce that the second request comes after the internal signal ready. Hence, the specification should also include the behavior of Figure 2(c) corresponding to the concrete run of Figure 2(d). Formally, if a partial order t = (V, ≤t , λ) satisfies a specification and if z t z  where z  is an input event from the environment and z, z  are not on the same

146

T. Chatain, P. Gastin, and N. Sznajder c s

c s

req

req

grant grant (a) Naive specification req

req

grant grant (c) Weakened specification

c s

c s

req fwd

req fwd

req ready ready fwd grant grant (b) Implementation req ready fwd ready grant grant (d) Implementation

Fig. 2. Client–Server

process, then the weakening s = (V, ≤s , λ) with ≤s = ≤t \ {(z, z  )} should also satisfy the specification (≤s is still an order relation since z  is a successor of z). We will define the weakest partial order induced by t. Recall that actions in Γ are either inputs from  the environment or outputs to the environment: Γ = In ∪ Out with In = i∈Proc Ini and Out = i∈Proc Outi . Consider now a Γ -labelled partial order t = (V, ≤, λ) and define / Σi ∧ λ(z  ) ∈ Ini ∧ z < z  Wt = {(z, z  ) ∈ V 2 | ∃i ∈ Proc, λ(z) ∈ ∧ (¬∃y, λ(y) ∈ Outi ∧ z < y < z  )} . The set Wt consists of all those pairs (z, z  ) for which the ordering in t is fortuitous. This happens when z, z  are on different processes and z  is an uncontrollable input from the environment, except if we find an output event y between z and z  which is on the same process as z  . Indeed, output y may have been triggered by z so we do not remove orderings to output events. We are now ready to define acceptable specifications. Definition 1. A specification is acceptable if it is closed under extension and weakening. Formally, a specification ϕ is acceptable if for all t = (V, ≤t , λ) such that λ−1 (Σi ) is totally ordered for all i ∈ Proc, if t |= ϕ, then – r |= ϕ for all r = (V, ≤r , λ) with ≤t ⊆ ≤r (extension), – s |= ϕ where s = (V, ≤s , λ) with ≤s = ≤t \ Wt (weakening). Observe that this definition of weakening removes all fortuitous orderings at once, but, since the specification is also closed under extension, all intermediary partial orders can also be obtained. AlocTL. Among different logics available to express specifications over partial orders, we will focus on local temporal logics (locTL), for they allow easy and intuitive specifications for distributed system, and they have a reasonable complexity. However, not all local temporal logic formulae are acceptable: the formula EM(a ∧ ¬ F b) meaning that there is a minimal a-event with no b-events in its future is not closed under extension (see e.g. [2] for a formal semantics of locTL). Also, the formula EM(a ∧ EX c) meaning that there is a minimal a-event

Natural Specifications Yield Decidability for Distributed Synthesis

147

immediately followed by a c-event is not closed under extension. In fact, in order to stay in the class of specifications closed under extensions, we have to rule out any modality that requires some concurrency between two events. For the closure by weakening, we restrict the use of the order relation between events on different processes so that the greater event is not an input. We introduce a syntactic restriction of a process based local temporal logic for which all formulae will be acceptable. The syntax of AlocTL(Γ, Proc) (or simply AlocTL if Γ and Proc are clear from the context) is given by: ϕ ::= a | ¬a | ¬ Xi  | ¬ Yi  | ϕ ∨ ϕ | ϕ ∧ ϕ | Xi ϕ | ϕ Ui ϕ | Gi ϕ | Fi,j (Out ∧ ϕ) | Y i ϕ | ϕ Si ϕ | Out ∧ Hi,j ϕ with a ∈ Γ and i, j ∈ Proc. The modalities Xi , Yi , Ui and Si are the usual next, yesterday, until and since restricted to the totally ordered events of process i. We can also express in our logic release (dual of until ): ϕRi ψ = (Gi ψ)∨(ψUi (ϕ∧ψ)). When restricted to the events of some process i, our logic has the full expressive power of LTL or FO. We only restrict how one can switch from one process to another so that closure under extensions and weakenings will be obtained. To switch from process i to process j, we use Fi,j or Hi,j . The first one allows to specify a response property triggered on process i for which the output is delivered on process j, e.g., G(request −→ Fi,j (Out ∧ grant)). The second modality may be used to specify that outputs should have a cause, e.g., G(grant −→ (Out ∧ Hj,i request)). We do not include negations or modalities of the form Xi,j since they lead out of acceptable specifications. We did not investigate the expressive power of our logic, but we believe it can express lots of interesting properties since it has the expressive power of FO when restricted to local events of each process, and allows response and cause properties between processes. The semantics defines when t, x |= ϕ where t = (V, ≤, λ) is a Γ -labelled partial order with Vi = λ−1 (Σi ) totally ordered for each i ∈ Proc, and x ∈ V : – t, x |= a ∈ Γ if λ(x) = a – t, x |= Xi ϕ if x ∈ Vi and t, y |= ϕ for some y ∈ Vi such that x < y and for all z ∈ Vi , z ≤ x or y ≤ z. – t, x |= Gi ϕ if x ∈ Vi and t, y |= ϕ for all y ∈ Vi such that x ≤ y. – t, x |= ϕ Ui ψ if x ∈ Vi and t, y |= ψ for some y ∈ Vi such that x ≤ y and for all z ∈ Vi , x ≤ z < y implies t, z |= ϕ. – t, x |= Fi,j (ϕ ∧ Out) if x ∈ Vi and t, y |= ϕ for some y ∈ Vj such that x ≤ y and λ(y) ∈ Out. The other modalities are defined similarly. As in [2], we have chosen to introduce initial formulae to address the problem of starting the evaluation of a formula. Those are defined by the syntax α ::= ⊥ |  | ¬ EMi  | EMi ϕ | α ∨ α | α ∧ α where ϕ is a formula of AlocTL. The semantics is given by t |= EMi ϕ if t, x |= ϕ where x is the minimal vertex of Vi .

148

T. Chatain, P. Gastin, and N. Sznajder

Proposition 1. The logic AlocTL is closed under extension and weakening. Observe that AlocTL is a natural fragment of FO(<) which is closed under extensions and weakenings. In our setting, it provides a convenient way to specify desired properties. Our decidability results will be stated for AlocTL but they would still hold for more general logics defining regular properties which are closed under extensions and weakenings.

4

Decidability Results

In this section we solve the synthesis problem for the subclass of architectures having a strongly connected communication graph: every process can send signals to everyone (though maybe not directly). In the following, we will simply call them strongly connected architectures. Singleton Architectures. A first step in solving the general problem is to handle the sequential case. This problem is slightly different from the asynchronous synthesis of [16] (where the communication was through shared variables) and [12] (where a single process does not evolve asynchronously with respect to its environment). In the sequential case, there is no internal action and then Σ = Γ = In ∪ Out, and all runs are total orders. The only specificity is that the system communicates asynchronously with the environment, i.e., there may be several signals from the environment before the process has a chance to play, and reciprocally. Since there is no possible weakening or extension, we are concerned with classical logics for specifications. We can deal both with linear time specifications (LTL, FO, MSO) or with branching time specifications (CTL∗ , μ-calculus) since all we need is regular specifications. With slight modifications of the proof technique used in [6], we obtain the following result. Theorem 1. The synthesis problem over the singleton architecture is decidable for regular specifications. Strongly Connected Architectures. Now, we show that the distributed synthesis problem is decidable for the whole subclass of strongly connected architectures. This is done by reduction to the synthesis problem over the singleton. On one hand, it is easy to simulate a distributed strategy with a sequential one. Conversely, when given a program for the singleton that produces only runs satisfying the specification, we can distribute it over the strongly connected architecture. We use a master-slave algorithm: we centralize the information by making all processes forward their local histories to a master process that takes all decisions about which action to output. This master process consequently sends back orders to the other processes, based on information it has and the given sequential strategy. Formally, we will prove the following main result.

Natural Specifications Yield Decidability for Distributed Synthesis

149

Theorem 2. The distributed synthesis problem over strongly connected architectures is decidable for AlocTL specifications. The rest of the section is devoted to the proof of this theorem. Let A = (Proc, E, (Ini )i∈Proc , (Outi )i∈Proc ) be an architecture with (Proc, E) strongly connected. Let S be an architecture with a single  process p and external signals Inp = In = i∈Proc Ini and Outp = Out = i∈Proc Outi . We show that the distributed synthesis problem for ϕ ∈ AlocTL(Γ, Proc) over A can be reduced to the synthesis problem for an associated specification ϕ ∈ AlocTL(Γ, {p}) over S. Then, we obtain Theorem 2 from Theorem 1. We have to change the specification since there is a single process in S and several processes in A. We do so in such a way that for all Γ -labelled total order t and all x ∈ t, we have t, x |= ϕ if and only if t, x |= ϕ. For instance, X i ϕ = Σi ∧ X((¬Σi ) U (Σi ∧ ϕ)) and Fi,j (Out ∧ ϕ) = Σi ∧ F(Outj ∧ ϕ) (where A = a∈A a for A ⊆ Σ). The following two propositions state that the synthesis problem for ϕ over A is reduced to the synthesis problem for ϕ over S. Proposition 2. If there are internal signals sets and a distributed winning strategy for ϕ over A, then there is a winning strategy for ϕ over S. The proof of this proposition is omitted due to lack of space. Proposition 3. If there is a winning strategy for ϕ over S then one can define internal signals sets and a distributed winning strategy for ϕ over A. Proof (Sketch). We want to simulate a sequential run of S in the distributed system A. Due to uncontrollable inputs from the environment, we cannot avoid some concurrency but we will restrict it as much as possible so that runs of A will be weakenings of sequential runs of S. To do so, we select a cycle in the communication graph and force the processes to communicate in a sequential way through this virtual ring – note that there may be no simple cycle, and some technical details arise when a process appears several times in the ring. For simplicity, we present here the proof assuming there is a simple cycle in (Proc, E) and we rename the processes Proc = {1, . . . , n} according to this cycle. Process 1 will be our master. Let f be a winning strategy for ϕ over S. To simulate f over S, the master Process 1 transforms its local history σ into a compatible sequential history ψ(σ) of S (the definition of ψ will be given later). If f is undefined on ψ(σ) then we let f1 (σ) = (Msg1 , ε) meaning that Process 1 wants to initiate a round collecting inputs received by other Processes. When receiving this signal, Process 2 sends a pair (Msg2 , τ ) where τ ∈ In∗1 is the sequence of inputs received by Process 1 since the last time it has sent a signal to Process 2. The round continues similarly for the other Processes. Formally, for 1 < i ≤ n, σ ∈ Σi∗ · Σic ∪ {ε}, τ ∈ In∗ and τ1 , τ2 ∈ In∗i , we let fi (σ · τ1 · (Msgi−1 , τ ) · τ2 ) = (Msgi , τ · τ1 · τ2 ).

150

T. Chatain, P. Gastin, and N. Sznajder

Here τ is the sequence of inputs collected by previous processes, τ1 consists of inputs received before the signal Msgi−1 and τ2 of the messages received after Msgi−1 and before Msgi could be sent. This explains the reordering τ · τ1 · τ2 . Assume now that f is defined on ψ(σ) and let i with a = f (ψ(σ)) ∈ Outi . If i = 1 then we simply let f1 (σ) = f (ψ(σ)). Now, if i > 1 then we let f1 (σ) = (Ord1 , a) to transmit to Process i the order to output a. The order is forwarded by each intermediary Process 1 < j < i only if j received no inputs since the last time it has sent a signal to j + 1. Then output a is performed by i and an acknowledgement is sent to Process 1. This acknowledgement will also collect inputs received by remaining processes. Formally, for 1 < i ≤ n, σ ∈ Σi∗ ·Σic ∪{ε}, τ ∈ In∗ and τ1 , τ2 ∈ In∗i , we let fi (σ · (Ordi−1 , a)) = (Ordi , a) fi (σ · (Ordi−1 , a)) = a fi (σ · (Ordi−1 , a) · a · τ2 ) = (Acki , τ2 )

if a ∈ / Outi if a ∈ Outi if a ∈ Outi

fi (σ · τ1 · (Acki−1 , τ ) · τ2 ) = (Acki , τ · τ1 · τ2 ) Now, if an intermediary process received some inputs from the environment before it could forward the order to Process i, then the basis on which Process 1 took is decision is no longer valid. Hence, we have to abort the order and signal this fact with a Nack. We also need to abort if i received the order but has also received inputs from the environment before it could execute the order. As above, Nack also collects inputs received by the remaining processes. Formally, for 1 < i ≤ n, σ ∈ Σi∗ · Σic ∪ {ε}, τ ∈ In∗ and τ1 , τ2 ∈ In∗i , we let fi (σ · τ1 · (Ordi−1 , a) · τ2 ) = (Nacki , τ1 · τ2 )

if τ1 · τ2 = ε

fi (σ · τ1 · (Nacki−1 , τ ) · τ2 ) = (Nacki , τ · τ1 · τ2 ) The sets of internal signals are implicitely defined by the strategies above: Σ1,2 = ({Ord1 } × Out) ∪ {(Msg1 , ε)} and for 1 < i ≤ n and j = 1 + (i mod n), Σi,j = ({Msgi , Acki , Nacki } × In∗ ) ∪ ({Ordi } × Out). Due to In∗ , the sets Σi,j are infinite. We explain in Remark 1 how to reduce to finite sets of signals, and strategies with finite-memories. To conclude the construction, we define the map ψ : Σ1∗ → Γ ∗ by induction. First, ψ(ε) = ε. Next, ψ(σ · b) = ψ(σ) · b for σ ∈ Σ1∗ and b ∈ Σ1 ∩ Γ . Finally, for σ ∈ Σ1∗ , a ∈ Out \ Out1 , τ ∈ In∗1 and τ  ∈ In∗ , let: ψ(σ · (Msg1 , ε) · τ · (Msgn , τ  )) = ψ(σ) · τ  · τ ψ(σ · (Ord1 , a) · τ · (Ackn , τ  )) = ψ(σ) · a · τ  · τ ψ(σ · (Ord1 , a) · τ · (Nackn , τ  )) = ψ(σ) · τ  · τ Note that, after sending Msg1 or Ord1 , ψ is undefined until the corresponding Msgn , Ackn or Nackn has been received by Process 1. When ψ is undefined then

Natural Specifications Yield Decidability for Distributed Synthesis

151

f1 is also undefined so that Process 1 waits for the end of the round. Note also that inputs in τ  may have been received before those in τ . Let t = (V, ≤t , λ) be an F -maximal F -run. We can easily check that all output events in λ−1 (Out) are totally ordered. We can also show that the history t computed by ψ is an f -maximal f -run which is a linear extension of πΓ (t). To conclude the proof, it remains to show that πΓ (t) is an extension of the weakening of t : ≤t \ Wt ⊆ ≤t ⊆ ≤t . For this, we will use the following claim whose proof is omitted for lack of space. Claim. For all x, y ∈ λ−1 (Γ ) such that x t y, if x
mod n)

= ({Msgi , Acki , Nacki } × QQ ) ∪ ({Ordi } × Out).

and the memory needed by each process 1 < i ≤ n is QQ . It is then easy to adapt the proof of Proposition 3.

5

Conclusion

In this paper, we have defined a new setting for the synthesis problem for distributed asynchronous systems, and proved that it is decidable for an interesting subclass of architectures. We believe that using signals in asynchronous systems, and restricting to acceptable specifications will help to overcome a lot of the common difficulties that usually lead to undecidability results. Future work includes the generalization of our decidability result to larger classes of architectures. Other interesting problems would be to study the expressivity of AlocTL or to define other logics for acceptable specifications.

152

T. Chatain, P. Gastin, and N. Sznajder

References 1. Church, A.: Logic, arithmetics, and automata. In: Proc. of Int. Symp. of Mathematicians, pp. 23–35 (1962) 2. Diekert, V., Gastin, P.: Local temporal logic is expressively complete for cograph dependence alphabets. In: Nieuwenhuis, R., Voronkov, A. (eds.) LPAR 2001. LNCS, vol. 2250, pp. 55–69. Springer, Heidelberg (2001) 3. Finkbeiner, B., Schewe, S.: Synthesis of asynchronous systems. In: Puebla, G. (ed.) LOPSTR 2006. LNCS, vol. 4407, pp. 127–142. Springer, Heidelberg (2007) 4. Gastin, P., Lerman, B., Zeitoun, M.: Distributed games with causal memory are decidable for series-parallel systems. In: Lodaya, K., Mahajan, M. (eds.) FSTTCS 2004. LNCS, vol. 3328, pp. 275–286. Springer, Heidelberg (2004) 5. Gastin, P., Sznajder, N., Zeitoun, M.: Distributed synthesis for well-connected architectures. In: Arun-Kumar, S., Garg, N. (eds.) FSTTCS 2006. LNCS, vol. 4337, pp. 321–332. Springer, Heidelberg (2006) 6. Kupferman, O., Madhusudan, P., Thiagarajan, P.S., Vardi, M.Y.: Open systems in reactive environments: Control and synthesis. In: Palamidessi, C. (ed.) CONCUR 2000. LNCS, vol. 1877, pp. 92–107. Springer, Heidelberg (2000) 7. Kupferman, O., Vardi, M.Y.: Church’s problem revisited. Bull. Symbolic Logic 5(2), 245–263 (1999) 8. Kupferman, O., Vardi, M.Y.: µ-calculus synthesis. In: Nielsen, M., Rovan, B. (eds.) MFCS 2000. LNCS, vol. 1893, pp. 497–507. Springer, Heidelberg (2000) 9. Kupferman, O., Vardi, M.Y.: Synthesizing distributed systems. In: Proc. of LICS 2001. Computer Society Press (2001) 10. Lynch, N., Tuttle, M.R.: An introduction to input/output automata. CWIQuarterly 2(3), 219–246 (1989) 11. Madhusudan, P., Thiagarajan, P.S.: Distributed control and synthesis for local specifications. In: Orejas, F., Spirakis, P.G., van Leeuwen, J. (eds.) ICALP 2001. LNCS, vol. 2076, pp. 396–407. Springer, Heidelberg (2001) 12. Madhusudan, P., Thiagarajan, P.S.: A decidable class of asynchronous distributed controllers. In: Brim, L., Janˇcar, P., Kˇret´ınsk´ y, M., Kucera, A. (eds.) CONCUR 2002. LNCS, vol. 2421, pp. 145–160. Springer, Heidelberg (2002) 13. Madhusudan, P., Thiagarajan, P.S., Yang, S.: The MSO theory of connectedly communicating processes. In: Ramanujam, R., Sen, S. (eds.) FSTTCS 2005. LNCS, vol. 3821, pp. 201–212. Springer, Heidelberg (2005) 14. Mohalik, S., Walukiewicz, I.: Distributed games. In: Pandya, P.K., Radhakrishnan, J. (eds.) FSTTCS 2003. LNCS, vol. 2914, pp. 338–351. Springer, Heidelberg (2003) 15. Pnueli, A., Rosner, R.: On the synthesis of a reactive module. In: Proc. of POPL 1989, pp. 179–190 (1989) 16. Pnueli, A., Rosner, R.: On the synthesis of an asynchronous reactive module. In: Ronchi Della Rocca, S., Ausiello, G., Dezani-Ciancaglini, M. (eds.) ICALP 1989. LNCS, vol. 372, pp. 652–671. Springer, Heidelberg (1989) 17. Pnueli, A., Rosner, R.: Distributed reactive systems are hard to synthesize. In: Proc. of FOCS 1990, vol. II, pp. 746–757. IEEE Press, Los Alamitos (1990)

Epistemic Strategies and Games on Concurrent Processes Konstantinos Chatzikokolakis1, Sophia Knight2 , and Prakash Panangaden2 1

2

Computing Laboratory, Oxford University, U.K. and LIX, ´ Ecole Polytechnique, France [email protected] School of Computer Science, McGill University, Montr´eal, Qu´ebec {sophia,prakash}@cs.mcgill.ca

Abstract. We develop a game semantics for process algebra with two interacting agents. The purpose of our semantics is to make manifest the role of knowledge and information flow in the interactions between agents and to control the information available to interacting agents. We define games and strategies on process algebras, so that two independent agents interacting according to their strategies determine the execution of the process, replacing the traditional scheduler. We show that different restrictions on strategies represent different amounts of information being available to a scheduler. We also show that a certain class of strategies corresponds to the syntactic schedulers of Chatzikokolakis and Palamidessi, which were developed to overcome problems with traditional schedulers modelling interaction. The restrictions on these strategies have an explicit epistemic flavour.

1

Introduction

Concurrent processes are a natural and widely used model of interacting agents. However, process algebra - as traditionally presented - has no explicit epistemic concepts, making it difficult to discuss what agents know and what has been successfully concealed. Epistemic concepts and indeed modal logics capturing “group knowledge” have proven very powerful in distributed systems [1,2]. Strangely, it has taken a long time for these ideas to surface in the process algebra community. Epistemic concepts play a striking role in the resolution of nondeterministic choices. Typically one introduces a scheduler (or adversary) to resolve nondeterminism. This scheduler represents a single global entity that resolves all the choices. Furthermore, traditional schedulers are effectively omniscient: they may use the entire execution history as well as all other information in order to resolve choices. This is reasonable when one is reasoning about correctness in the face of an unknown environment. In this case one wants a quantification over all possible schedulers in order to deliver strong guarantees about process behaviour. In security, however, one comes across conditions where omniscient schedulers are unreasonably powerful, creating circumstances where realistic security properties cannot be established. One wants to set up protocols that conceal some M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 153–166, 2009. c Springer-Verlag Berlin Heidelberg 2009 

154

K. Chatzikokolakis, S. Knight, and P. Panangaden

action(s) from outside observers, but if the scheduler is allowed to see these actions and reveal them through diabolical scheduling decisions, then there is no hope for designing a protocol that conceals the desired information. For example, randomness is often used as a way of concealing information, but if the scheduler is allowed to see the results of random choices and code these outcomes through scheduling policies then randomness has no power to obfuscate data. Consider for instance a voting system which collects people’s votes for candidate a or b, and outputs in some arbitrary order the list of people who have voted (for example to check whether everyone has voted). Among the possible schedulers, there is the one which lists first all the people who voted for a. Clearly, this scheduler completely violates the desired anonymity property. Usually when we want a correctness property to hold for a nondeterministic system we require that it holds for all choices of the scheduler: there is no way such universally quantified statements will be true if we permit such omniscient schedulers. How then is process algebra traditionally used to treat security issues? In fact scrutiny reveals that a completely demonic scheduler is not assumed all the time. For example, Schneider and Sidiropoulos [3] argue that a system is anonymous if the set of (observable) traces produced by one user is the same as the set of traces produced by another user. This is, in fact, an extremely angelic view of the scheduler. A perverse scheduler can most definitely leak information in this case by ensuring that certain traces never appear in one case even though the operational semantics permits them. Even a probabilistic (hence not overtly demonic) scheduler can leak information as discussed by Bhargava and Palamidessi1[4]. These issues manifest themselves particularly sharply in the problem of anonymity. One approach to solve the problem of reasoning about anonymity in the presence of demonic schedulers has been suggested in Chatzikokolakis and Palamidessi [5]: the interplay between the secret choices of the process and the choices of the scheduler is expressed by introducing two independent schedulers and a framework that allows one to switch between them. The ideas of demonic versus angelic schedulers, the idea of independent agents and the presence of epistemic concepts all suggest that games are a unifying theme. In this paper we propose a game-based semantic restriction on the information flow in a concurrent process. We introduce a turn-based game that is played between two agents and define strategies for the agents. The game is played with the process as the “playing field” and the players’ moves roughly representing the process executing an action. The information to which a player does not have access appears as a restriction on its allowed strategies. This is in the spirit of game semantics [6,7,8] where restrictions on strategies are used to describe limits on what can be computed. The restrictions we discuss have an epistemic character which we model using Kripke-style indistinguishability relations. We show that there is a particular epistemic restriction on strategies that exactly captures the syntactic restrictions developed by Chatzikokolakis and 1

They do not explicitly talk about schedulers in their paper but the import is the same.

Epistemic Strategies and Games on Concurrent Processes

155

Palamidessi [5]. It should be noted that this correspondence is significant since it only works with one precise restriction on the strategies, which characterizes the knowledge of the schedulers. This restriction is an important achievement because although Chatzikokolakis and Palamidessi showed that these schedulers solve certain security problems, this is the first time that the epistemic qualities of these schedulers have been made explicit. The advantage to thinking in terms of strategies is that it is quite easy to capture different restrictions on the knowledge of the agents as restrictions on the allowed strategies. Traditionally, if one were to try to introduce some entirely new restriction on what schedulers “know” one would have to rethink the syntax and the operational semantics of the process calculus with schedulers and work to convince oneself that the correct concept was being captured. With strategies, one can easily add such restrictions and it is clear that the restrictions capture the intended epistemic concept. For instance, our notion of introspection makes completely manifest what the agents know since it is couched as an explicit statement of what the choice of moves can depend on. Indeed, previously one only had an intuitive notion of what the schedulers of Chatzikokolakis and Palamidessi [5] “knew” and it required careful design to come up with the right rules to capture this in the operational semantics. Thus, strategies and restrictions are an ideal way to model interaction, independence and epistemic concepts in process algebra. Related work. There are many kinds of games used in economics, mathematics, logic and computer science. Even within logic there is a remarkable variety of games. The logical games most related to our games are Lorenzen games. Lorenzen games are dialogues that follow certain rules about the patterns of questions and answers. There is a notion of winning and the main results concern the correspondence between winning strategies and the existence of constructive proofs. The idea of dialogue games appears in programming language semantics culminating with the deep and fundamental results of Abramsky, Jagadeesan, Malacaria [8] and Hyland and Ong [7] on full abstraction for PCF. These games do not have a notion of winning. Rather the games simply delineate sets of possible plays and strategies are used to model programs. This has been a fruitful paradigm to which many researchers - far too many to enumerate - have contributed. It has emerged that games of this kind form a semantic universe where numerous kinds of language features coexist. Different features are simply modelled by different conditions on the strategies. The games that we describe are similar to these kinds of games in spirit but there are crucial differences. Our games are not dialogue games and there is no notion of question and answer, as a result conditions like bracketing have no meaning in our setting. There is no notion of winning in our games either. Our games are specifically intended to model multiple agents working in a concurrent language. While there have been some connections drawn between concurrent languages like the π-calculus and dialogue games [7] these are results that say that π-calculus can be used to describe dialogue games, not that dialogue games

156

K. Chatzikokolakis, S. Knight, and P. Panangaden

can be used to model π-calculus. The latter remains a fundamental challenge and one that promises to lead to a semantic understanding of mobility. “Innocence” is an important concept pervading game semantics [7,9]. This is a very particular restriction on what the players know. In order to define innocence much more complex structures come into play; one needs special indicators of dependence (called “justification pointers”) that are used to formalize a concept called the “view” of each process. In the end innocence, like introspection, is a statement about what knowledge the agents have. Our games have much less complicated structure because there are no issues with higher types and the introspection notion is relatively simple to define.

2

Background

We begin by introducing a process calculus with labelled actions and a protection operator. The labels on actions allow us to control what is visible about an action; if two actions have the same label then they are indistinguishable to an agent controlling the execution of the process. The protection operator, represented by curly brackets, indicates that the choice of the top-level action in the protected subprocess must be made independently from the choices concerning unprotected actions in the process. This idea is explained in more detail later. We let l and k represent labels, a and b actions, a ¯ and ¯b co-actions, τ the silent action, and α and β generic actions, co-actions, or silent action. The syntax for a process is as follows: P, Q ::= l : α.P | P |Q | P + Q | (νa)P | l : {P } | 0 The operational semantics for this process calculus is shown in Fig. 1. There are corresponding right rules for + and |; these operators are both associative and commutative. There is an additional condition that no derivation tree for a transition may contain more than one occurrence of the SWITCH rule. The reason for this condition is explained below. All of the rules are analogous to those of traditional process algebra, except for the rule SWITCH, which requires that protected processes do a silent action. The reason for the two restrictions on the SWITCH operator is that this operator is intended to represent choices made independently from the other choices in the process. For example in the process (l1 : a + l2 : b) | l3 : {k1 : τ . l4 : a + k2 : τ . l4 : b}, the left and right choices are represented as independent. This means that whatever agent controls whether the left part of the process performs an a or b action does not control how the choice on the right side of the process is resolved. This choice is resolved by an entity independent from the traditional scheduler. Therefore, we require that the protected subprocess do a silent action, because any other action would be observable to the outside world, and therefore observable to the scheduler, allowing it to base its decisions on the outcome of the protected choice, which would make this choice dependent on other choices. This independence is not a part of the operational semantics; rather, it represents the idea that the protected subprocess makes decisions independently from the main process. In

Epistemic Strategies and Games on Concurrent Processes P −−→ P  α = a, a ¯ α (νa)P −−→ (νa)P  α

ACT

α

l : α.P −−→ P

RES

P −−→ P  α P + Q −−→ P  α

SUM1

α τ P −−→ P  Q −−→ Q P −−→ P  P −−→ P  COM SWITCH α τ τ    P |Q −−→ P |Q P |Q −−→ P |Q l : {P } −−→ P  a

PAR1

157

a ¯

Fig. 1. Operational semantics

this paper we allow only one occurence of the SWITCH rule in the derivation tree of any transition. This is already enough for our purpose of capturing the independence of choice: control is passed from the first agent to the second, then the transition is performed and the control is again passed to the first agent. The use of nested SWITCHes would lead to a richer interaction between the two agents to select a single transition. We plan to investigate this idea in the future. Note also that we do allow multiple occurences of the switch operator, provided that they are not nested immediately next to each other. For example, l1 : {P1 } + l2 : {P2 } and l1 : {k1 : τ.l2 : {P }} are both allowed, but the process l1 : {k1 : {P }} cannot perform any action, since it would require two occurrences of the SWITCH rule in its derivation tree. A process P is deterministically labelled if, for any process reachable from P (including P itself), all enabled actions and bracketed subprocesses have distinct labels. For example, l1 : a + l1 : b and l1 : a + l1 : {l2 : τ } are not deterministically labelled, and no process with either of these as a (reachable) subprocess is deterministically labelled. However, l1 : a . l3 : c + l2 : b . l3 : c is deterministically labelled even though l3 occurs twice. This concept can be defined formally but the meaning should be clear from the intuitive definition.

3

Games and Strategies

In this section we define two player games on deterministically labelled processes. One game is defined for each deterministically labelled process. The two players are called X and Y . The moves in the game are labels and pairs of labels. Roughly, moves represent actions being taken by the process. The player X controls all the unprotected actions, and the player Y is in charge of all the top level actions within the protected subprocesses. We define strategies for games. A strategy is for one player and determines the moves the player will choose within the game. Games and strategies are both made up of valid positions, which are discussed in the next section. 3.1

Valid Positions

Valid positions are defined on a process and represent valid plays for that process. Every valid position is a string of moves (labels or pairs of labels from the process), each of which is assigned to a player X or Y , with player X moving

158

K. Chatzikokolakis, S. Knight, and P. Panangaden

first. The set of valid positions for a process represents all possible executions of the process, including partial executions. Definition 1. A valid position for a labelled process P is defined inductively: 1. ε is a valid position for any process P . α 2. If P −−→ P  and there is no occurrence of the SWITCH rule or the COM rule in the derivation tree for this transition, and if s is a valid position for P  and l is the label for the action α, then l.s is a valid position for P and this occurrence of l is an X move. τ 3. If P −−→ P  and the COM rule occurs in the derivation tree for this transition but the SWITCH rule does not occur anywhere, and if the synchronizing actions a and a ¯ are labelled l1 and l2 respectively, and s is a valid position for P  , then (l1 , l2 ).s is a valid position for P and (l1 , l2 ) is an X move. τ 4. If P −−→ P  and the SWITCH rule occurs in the derivation tree for this transition but the COM rule does not, and the bracketed subprocess chosen in the SWITCH rule is labelled l1 and the action chosen within the bracketed subprocess is labelled l2 , and s is a valid position for P  , then l1 and l1 .l2 .s are both valid positions for P , and l1 is an X move and l2 is a Y move. τ 5. If P −−→ P  and the SWITCH rule and COM rule both occur in the derivation tree for this transition, and if the bracketed subprocess in the SWITCH rule is labelled l1 and the actions synchronized within the bracketed subprocess are labelled l2 and l3 , and s is a valid position for P  , then l1 and l1 .(l2 , l3 ).s are both valid positions for P and l1 is an X move and (l2 , l3 ) is a Y move. Note that the set of valid positions is prefix closed. Example 1. Consider the process   P = (νb) l1 : {k1 : τ . l2 : a . l3 : b + k2 : τ . l2 : c . l3 : b} | l4 : ¯b . (l5 : d + l6 : e) . This example is interesting because it features consecutive choices by two different agents. It will be used later to exhibit the agents’ interaction and how their knowledge affects their strategies. Here are two of the valid positions for P , with the Y moves in bold: l1 .k1 .l2 .(l3 , l4 ).l5 and l1 .k2 .l2 .(l3 , l4 ).l6 . 3.2

Strategies

A strategy for a player is a subset of the valid positions, each position in the strategy ending with moves made by the player. The idea behind a strategy is that if, for example, player X finds himself in position s and s.m is in his strategy, then he will do move m.2 2

Unlike the usual game theoretic definition of strategy, our strategies are not functional, that is, they do not necessarily specify one move for the player to make in every situation. We can, however, put simple conditions on our strategies so that they are functional.

Epistemic Strategies and Games on Concurrent Processes

159

Definition 2. Let Z stand for either X or Y . In the game for P , a strategy for Z is a set S of valid positions such that ε is in S and if s.m ∈ S, then m is a Z move and every prefix of s ending with a Z move is in S. Example 2. For the process from the last example,   P = (νb) l1 : {k1 : τ . l2 : a . l3 : b + k2 : τ . l2 : c . l3 : b} | l4 : ¯b . (l5 : d + l6 : e) , one strategy for X is: {ε, l1 , l1 .k2 .l2 , l1 .k2 .l2 .(l3 , l4 ), l1 .k2 .l2 .(l3 , l4 ).l6 }. Another strategy for X is: {ε, l1 , l1 .k1 .l2 , l1 .k2 .l2 }. One strategy for Y is: {ε, l1 .k1 , l1 .k2 }. 3.3

Execution of Processes According to Strategies

In this section we define the execution of a process with two strategies- one for each player. However, not every pair of strategies defines a unique execution of a process. We define two simple restrictions on strategies, which together imply that executions are unique. Definition 3. A strategy S is deterministic if: s.m1 ∈ S, s.m2 ∈ S implies m1 = m2 . The second restriction is called completeness; it means that a strategy prescribes a move for the player whenever the player has a move available. In order to define completeness, we start with two subsidiary definitions. Definition 4. Let V denote the set of valid positions for P . For s a valid position for P , define enabled(s) = {m|s.m ∈ V }. Define enabledX (s) = {m|s.m ∈ V and m is an X move} and enabledY (s) = {m|s.m ∈ V and m is a Y move}. Note that a position can have X moves enabled or Y moves enabled, but not both. Definition 5. If s is a valid position for P and Z is a player, then Z(s) is the string of Z moves in s in the same order as they occur in s. A process is blocked if it has no transitions available. Definition 6. For a nonblocked process with valid positions V , a strategy S for player Z is complete if for all s ∈ S, for every string s such that Z(s ) = ε and s.s ∈ V and enabledZ (s.s ) = ∅, then s.s .m ∈ S for some move m. Completeness captures the idea that a player’s strategy always dictates a move whenever it is that player’s turn to play and a move is available. Note that if a deterministic strategy chooses a move m1 at a particular point and another move m2 is available to it, there is no need for a complete strategy to specify what happens after an m2 move, since this move will not be chosen. The condition Z(s) = ε ensures that a strategy can take into account all the moves made by the opponent but, of course, we do not want to quantify over moves made by the strategy’s own player.

160

K. Chatzikokolakis, S. Knight, and P. Panangaden

 Example 3. For P = (νb) l1 : {k1 : τ . l2 : a . l3 : b + k2 : τ . l2 : c . l3 : b} | l4 : ¯b . (l5 : d+ l6 : e)) the X strategy given above, S={ε, l1 , l1 .k2 .l2 , l1 .k2 .l2 .(l3 , l4 ), l1 .k2 .l2 . (l3 , l4 ).l6 } is not complete, because l1 ∈ S, l1 .k1 ∈ V , enabledX (l1 .k1 ) = ∅ and X(k1 ) = ε, but l1 .l2 .m ∈ S for any move m. To make this strategy complete, we can, for example, add the positions l1 .k1 .l2 , l1 .k1 .l2 .(l3 , l4 ), and l1 .k1 .l2 .(l3 , l4 ).l5 . Proposition 1. Consider a process P , S1 a deterministic, complete X strategy for P , and S2 a deterministic, complete Y strategy for P . Let S = {s ∈ S1 ∪ S2 | every prefix of s is in S1 ∪ S2 } Then the prefix ordering is a total order on S. Now we define the execution of a process according to a valid position. If s is s a valid position for P , then we will say P =⇒P  if starting from process P , the labels in s can be chosen in order and the end result is process P  . Definition 7. Let P be a deterministically labelled process. ε

1. P =⇒P . l α 2. P =⇒P  if P −−→ P  , there is no occurrence of the SWITCH rule or the COM rule in the derivation tree for this transition, and the action α is labelled l. (l1 ,l2 )

τ

3. P =⇒ P  if P −−→ P  and the COM rule occurs in the derivation tree for this transition but the SWITCH rule does not, and the synchronizing actions are labelled l1 and l2 . l1 .l2  τ 4. P =⇒P if P −−→ P  and the SWITCH rule occurs in the derivation tree for this transition but the COM rule does not, and the bracketed subprocess in the SWITCH rule is labelled l1 and the action chosen within the bracketed subprocess is labelled l2 . l1 .(l2 ,l3 )

τ

5. P =⇒ P  if P −−→ P  and the SWITCH rule and COM rule both occur in the derivation tree for this transition, and the bracketed subprocess in the switch rule is labelled l1 while the synchronizing actions within the bracketed subprocess are labelled l1 and l2 . l.s l s 6. P =⇒P  if P =⇒P  and P  =⇒P  . l1 .l2 .s  l1 .l2  s 7. P =⇒ P if P =⇒P and P  =⇒P  . s

It is easy to see that P =⇒P  for some P  if and only if s is a valid position for s P . Note that if s is a valid position for P , then P =⇒P  for exactly one process  P . The determinacy of P ’s labelling forces the process P  to be unique. Define the execution of a deterministically labelled process P with deterministic, complete X and Y strategies S1 and S2 as follows: Let s be the maximal element in S = {s ∈ S1 ∪ S2 | every prefix of s is in S1 ∪ S2 }. The execution of P according to S1 and S2 is the sequence of processes P, P1 ...Pn such that s

s

s

sn−1

s

1 2 3 n P =⇒P 1 =⇒P2 =⇒... =⇒Pn−1 =⇒Pn

and s = s1 s2 ...sn and each si is either a single X move or an X move followed by a Y move. This represents the sequence of moves that are chosen and processes that are reached if labels are chosen according to the strategies S1 and S2 .

Epistemic Strategies and Games on Concurrent Processes

3.4

161

Epistemic Restrictions on Strategies

Since certain strategies determine the execution of a process, we can use epistemic aspects of strategies to represent interacting agents’ restricted knowledge. In general, we impose epistemic conditions on strategies first by determining what knowledge is appropriate for each agent. Once the correct notion of the agent’s knowledge is determined, the condition on the strategy to enforce this knowledge is “if valid positions s1 and s2 are indistinguishable for player Z (Z’s knowledge about s1 and s2 is the same), then for any move m, s1 .m is in the strategy if and only if s2 .m is in the strategy.” We call restrictions of this form epistemic restrictions. For example, we could require that an agent only have knowledge of his own past moves. The epistemic restriction for a strategy S to satisfy this property is: if Z(s1 ) = Z(s2 ), then for all moves m, s1 .m ∈ S if and only if s2 .m ∈ S. Similarly, we could require that an agent only know what moves are currently available to him. The epistemic restriction expressing this for a strategy S is: if enabledZ (s1 ) = enabledZ (s2 ) then s1 .m ∈ S if and only if s2 .m ∈ S. We now single out a very important epistemic restriction, called introspection. An introspective strategy allows a player to “remember” not only his own history of moves, but also the moves that were available to him at every point in the past, including the current step. Introspective strategies are important because they exactly capture the intended independence requirement for the protection operator. Definition 8. For player Z, positions s1 and s2 are called Z indistinguishable if they satisfy the following conditions: 1. Z(s1 ) = Z(s2 ) 2. Z has at least one move available at s1 and at s2 . 3. For all prefixes s1 of s1 and s2 of s2 , if Z has a move available at both s1 and s2 and Z(s1 ) = Z(s2 ), then enabled(s1 ) = enabled(s2 ). In this definition, we describe an indistinguishability relation on positions where player Z has a move available. It is only defined on these positions because this relation governs the moves Z is allowed to make, so it only concerns positions where it is Z’s turn. We define two positions as indistinguishable if the player made the same series of moves to arrive at both positions, and at any point in the past where he had made a certain series of moves in both positions and had moves available, he had the same set of moves available in both positions. Definition 9. Given a process P and S a strategy for player Z on P , S is introspective if for every Z indistinguishable pair of valid positions s1 and s2 , for all moves m, s1 .m ∈ S if and only if s2 .m ∈ S. In other words, the player chooses the move he makes at each step based on his past moves, the moves that are available to him, and the moves that were available to him at each point in the past. If these conditions are all the same at two positions, the player cannot distinguish them, so he makes the same move at both positions.

162

K. Chatzikokolakis, S. Knight, and P. Panangaden

 Example 4. For P = (νb) l1 : {k1 : τ . l2 : a . l3 : b + k2 : τ . l2 : c . l3 : b} | l4 : ¯b . (l5 : d+ l6 : e)) the deterministic strategy given above for X, S = {ε, l1 , l1 .k1 .l2 , l1 .k2 .l2 , l1 .k1 .l2 .(l3 , l4 ), l1 .k2 .l2 .(l3 , l4 ), l1 .k1 .l2 .(l3 , l4 ).l5 , l1 .k2 .l2 .(l3 , l4 ).l6 } is not introspective, because in order to satisfy the introspection condition, l1 .k1 .l2 .(l3 , l4 ) and l1 .k2 .l2 .(l3 , l4 ) should have the same moves appended to them in S, since they are X indistinguishable. However, l1 .k1 .l2 .(l3 , l4 ).l5 ∈ S and l1 .k2 .l2 .(l3 , l4 ).l5 ∈ S, and similarly, l1 .k2 .l2 .(l3 , l4 ).l6 ∈ S and l1 .k2 .l2 .(l3 , l4 ).l5 ∈ S. Intuitively, this strategy represents X choosing l5 or l6 based on whether Y chose k1 or k2 , so that these choices are not independent. An example of an introspective strategy for X is the strategy containing l1 .k1 .l2 .(l3 , l4 ).l5 and l1 .k2 .l2 .(l3 , l4 ).l5 as well as all prefixes of these two positions ending in an X move, and ε. This introspective strategy makes X’s choice of move independent from Y ’s choice. Here is an example showing why the prefixes of the valid positions are discussed in the definition of introspective. Example 5. Consider P = l0 : {k1 : τ.(l1 : c.(l4 : f + l5 : g) + l2 : d) + k2 : τ.(l1 : c.(l4 : f + l5 : g) + l3 : e)}. Let X’s strategy be S = {ε, l0 , l0 .k1 .l1 , l0 .k2 .l1 , l0 .k1 .l1 .l4 , l0 .k2 .l1 .l5 }. This strategy is introspective. Even though X(l0 .k1 .l1 ) = X(l0 .k2 .l1 ) and enabledX (l0 .k1 .l1 ) = enabledX (l0 .k2 .l1 ), it is acceptable that the two strings have different moves appended to them, because enabledX (l0 .k1 ) = {l1 , l2 } and enabledX (l0 .k2 ) = {l1 , l3 }. This can be thought of as X being able to distinguish between the two positions l0 .k1 .l1 and l0 .k2 .l1 because he remembers what moves were available to him earlier and is able to use this information to tell apart the two positions.

4

Correspondence between Strategies and Schedulers

In this section, we first review the syntactic schedulers defined in Chatzikokolakis and Palamidessi [5] and then prove that deterministic complete introspective strategies correspond exactly to these schedulers. This result is important because these schedulers were defined purely syntactically, without any explicit reference to knowledge or equivalence between executions. Since the players’ knowledge is explicit in the definition of introspective strategies, this equivalence explains the knowledge requirements underlying the syntactic schedulers, which had not been discussed before. 4.1

Background on Schedulers

The new ingredient in the process calculus is explicit syntax for a pair of independent schedulers. The two schedulers operate independently and do not communicate with one another, and each scheduler controls certain choices. This makes it possible to represent independent choices in the process calculus. A

Epistemic Strategies and Games on Concurrent Processes

163

IF1

l ∈ tl(P ) P  ρ1 , η −−→ P   ρ1 , η  α P  if l then ρ1 else ρ2 , η −−→ P   ρ1 , η  l ∈ tl(P ) P  ρ2 , η −−→ P   ρ2 , η  α P  if l then ρ1 else ρ2 , η −−→ P   ρ2 , η 

α

ACT

α

l : α.P  σ(l).ρ, η −−→ P  ρ, η

SUM1

P  ρ, η −−→ P   ρ , η  α P + Q  ρ, η −−→ P   ρ , η 

IF2

PAR1

P  ρ, η −−→ P   ρ , η  α P |Q  ρ, η −−→ P  |Q  ρ , η 

SWITCH

α

α

α

P  η, 0 −−→ P  ||η  , 0 τ l : {P }  σ(l).ρ, η −−→ P   ρ, η  τ

¯ P  ρ, η −−→ P   ρ , η  α = a, a α (νa)P  ρ, η −−→ (νa)P   ρ , η  α

RES

P  σ(l1 ).0, 0 −−→ P   0, 0 Q  σ(l2 ).0, 0 −−→ Q  0, 0 τ P |Q  σ(l1 , l2 ).ρ, η −−→ P  |Q  ρ, η a

COM

a ¯

Fig. 2. Operational semantics for processes with schedulers

complete process is a labelled process augmented with a pair of schedulers. The notations σ(l) and σ(l1 , l2 ) are used to designate choices made by the schedulers. The latter is used to indicate that the scheduler has chosen to synchronize two processes. ρ, η ::= σ(l).ρ | σ(l, k).ρ | if l then ρ else η | 0 CP ::= P  ρ, η The operational semantics of the process calculus with schedulers are in Fig. 2. For the rules IF1 and IF2, we define the top level labels of a process: tl(l : α.P ) = tl(l : {P }) = {l}, tl(P1 +P2 ) = tl(P1 |P2 ) = tl(P1 )∪tl(P2 ), and tl((νa)P ) = tl(P ). Using the if then else construct, the scheduler can check whether a label is available and choose what to do based on that information. The SWITCH rule says that the curly brackets indicate a point where the secondary scheduler makes the next choice. After making this choice, control reverts to the primary scheduler. The choice made by the secondary scheduler must result in a τ observation because the process is encapsulated and cannot interact with the environment at this point. Of course, once control reverts to the primary scheduler, interactions with the external environment can indeed take place. The scheduler written first is called the primary scheduler and the second one is the secondary scheduler. A process is blocked if no transition is possible with any schedulers. Roughly speaking, a single primary or secondary scheduler for a process is nonblocking if it can be paired with any nonblocking secondary or primary scheduler (respectively) and not cause the process to be blocked3 . 3

Obviously, this would be a circular definition, so in the full paper we define nonblocking first inductively for a secondary scheduler, and then for a primary scheduler, with reference to nonblocking secondary schedulers.

164

4.2

K. Chatzikokolakis, S. Knight, and P. Panangaden

Correspondence Theorem

The main correspondence theorem can now be stated. Theorem 1. Given a deterministically labelled process P , a nonblocking primary scheduler ρ for P , and a nonblocking secondary scheduler η for P , there is a deterministic, complete, introspective X strategy S depending only on P and ρ, and a deterministic, complete, introspective Y strategy T depending only on P and η, such that the execution of P  ρ, η is identical to the execution of P with S and T . Furthermore, given a deterministically labelled process P , a deterministic, complete, introspective X strategy S for P , and a deterministic, complete, introspective Y strategy T for P , there is a nonblocking primary scheduler ρ depending only on S and P and a nonblocking secondary scheduler η depending only on T and P such that the execution of P with S and T is identical to the execution of P  ρ, η. Before we discuss the proof we make some observations on the quantifier structure of the statement of the theorem. One could imagine stating the first part as follows: ∀P, ρ∃S s.t. ∀η∃T . . . This is apparently stronger and certainly clearer than the original version which uses the clumsy phrase “depending only on...” However, this is not the case; it is actually weaker. The “new improved” version allows T to depend on ρ, which the version stated in the theorem does not allow. There is in fact a formal logic called “Independence Friendly” (IF) logic which allows quantifiers to be introduced with independence statements; this is just what the version in the statement of the theorem does, without, of course, dragging in all the formal apparatus of IF logic. In fact, it can be proved that there are statements of IF logic than cannot be rendered in ordinary first-order logic; the statement of the theorem is an example. The proof is available online in the full version of the paper at www.cs.mcgill.ca/∼sknigh8. It begins by stating a procedure to construct a strategy from a scheduler, then proves that the strategy constructed by this procedure always leads to the same choice of action in the process as the corresponding scheduler. Next it is proven that these strategies are always deterministic, complete, and introspective. To prove the other part of the theorem, a procedure is given to translate a deterministic, complete, introspective strategy into a syntactic scheduler.

5

Conclusions

In this paper we have given a semantic treatment of a process algebra with two kinds of choice in terms of games and strategies. This gives a semantic understanding of the “knowledge” possessed by schedulers when they resolve choices. This epistemic aspect is captured by restrictions on what the schedulers can see when they execute their strategies. In this short version we have not discussed the probabilistic case; we have, however, developed the theory for that case as well and have proved the correspondence theorem.

Epistemic Strategies and Games on Concurrent Processes

165

As far as we know there has been no work on a game semantics for process algebras with the notion of multiple schedulers. This work is a first step toward a systematic game semantic exploration of concurrency. First of all, we would like to develop a new paradigm for process algebra which is more naturally adapted to games. This will lead to richer notions of interactions between agents than synchronization and value or name passing. Second, we would like to enrich the epistemic aspects of the subject. In particular, we would like to move toward an explicit combination of modal process logic and epistemic logic so that we can describe in a compositional process-algebraic way how agents learn and exchange knowledge. Preliminary investigations into these ideas have been carried out by Borgstrom et al. [10] and by Deschesne et al. [11]. These approaches do not use games and are very closely tied to the operational semantics of specific calculi. Third, we would like to explore more subtle notions of transfer of control between the agents. Thus, for example, there could be a protracted dialogue between the agents before they decide on a process move. This could conceivably be fruitful for incorporating higher-order or mobile processes. Finally, we would like to combine the epistemic and probabilistic notions using ideas from information theory [12]. We have used these information theoretic ideas for an analysis of anonymity [13], indeed it was that investigation that sparked the research reported in [5] and which ultimately led to the present work. As far as we know, the only paper looking at epistemic logic and information theory is by Krasucki, Ndjatou and Parikh [14] where they quantify the amount of information shared when agents possess common knowledge. Acknowledgments. We would like to thank Samson Abramsky, Yannick Delbecque, Luke Ong and especially Catuscia Palamidessi for many helpful discussions.

References 1. Halpern, J.Y., Moses, Y.: Knowledge and common knowledge in a distributed environment. In: Proc. of Principles of Distributed Computing, pp. 50–61 (1984) 2. Fagin, R., Halpern, J.Y., Moses, Y., Vardi, M.Y.: Reasoning About Knowledge. MIT Press, Cambridge (1995) 3. Schneider, S., Sidiropoulos, A.: CSP and anonymity. In: Martella, G., Kurth, H., Montolivo, E., Bertino, E. (eds.) ESORICS 1996. LNCS, vol. 1146, pp. 198–218. Springer, Heidelberg (1996) 4. Bhargava, M., Palamidessi, C.: Probabilistic anonymity. In: Abadi, M., de Alfaro, L. (eds.) CONCUR 2005. LNCS, vol. 3653, pp. 171–185. Springer, Heidelberg (2005) 5. Chatzikokolakis, K., Palamidessi, C.: Making random choices invisible to the scheduler. In: Caires, L., Vasconcelos, V.T. (eds.) CONCUR 2007. LNCS, vol. 4703, pp. 42–58. Springer, Heidelberg (2007) 6. Abramsky, S., Jagadeesan, R.: Games and full completeness for multiplicative linear logic. J. Symbolic Logic 59(2), 543–574 (1994) 7. Hyland, J.M.E., Ong, C.H.L.: On full abstraction for PCF. Information and Computation 163, 285–408 (2000)

166

K. Chatzikokolakis, S. Knight, and P. Panangaden

8. Abramsky, S., Jagadeesan, R., Malacaria, P.: Full abstraction for PCF. Information and Computation 163, 409–470 (2000) 9. Danos, V., Harmer, R.: The anatomy of innocence. In: Fribourg, L. (ed.) CSL 2001 and EACSL 2001. LNCS, vol. 2142, pp. 188–202. Springer, Heidelberg (2001) 10. Borgstrom, J., Kramer, S., Nestmann, U.: Calculus of cryptographic communication. In: Proceedings of FCS-ARSPA 2006, pp. 91–112 (2006) 11. Deschesne, F., Mousavi, M., Orzan, S.: Operational and epistemic approaches to protocol analysis: Bridging the gap. In: Dershowitz, N., Voronkov, A. (eds.) LPAR 2007. LNCS, vol. 4790, pp. 226–241. Springer, Heidelberg (2007) 12. Shannon, C.: A mathematical theory of communication. Bell System Technical Journal 656, 379–423, 623–656 (1948) 13. Chatzikokolakis, K., Palamidessi, C., Panangaden, P.: Anonymity protocols as noisy channels. In: Montanari, U., Sannella, D., Bruni, R. (eds.) TGC 2006. LNCS, vol. 4661, pp. 281–300. Springer, Heidelberg (2007) 14. Krasucki, P., Ndjatou, G., Parikh, R.: Probabilistic knowledge and probabilistic common knowledge. In: ISMIS 1990, pp. 1–8. North-Holland, Amsterdam (1990)

On Finite Bases for Weak Semantics: Failures Versus Impossible Futures Taolue Chen1 , Wan Fokkink1,2, and Rob van Glabbeek3,4 1

4

CWI, Department of Software Engineering, P.O. Box 94079, 1090 GB Amsterdam, The Netherlands 2 Vrije Universiteit Amsterdam, Department of Theoretical Computer Science, De Boelelaan 1081a, 1081 HV Amsterdam, The Netherlands 3 National ICT Australia, Locked Bag 6016, Sydney, NSW 1466, Australia The University of New South Wales, School of Computer Science and Engineering, Sydney, NSW 2052, Australia

Abstract. We provide a finite basis for the (in)equational theory of the process algebra BCCS modulo the weak failures preorder and equivalence. We also give positive and negative results regarding the axiomatizability of BCCS modulo weak impossible futures semantics.

1 Introduction Labeled transition systems constitute a widely used model of concurrent computation. They model processes by explicitly describing their states and their transitions from state to state, together with the actions that produce these transitions. Several notions of behavioral semantics have been proposed, with the aim to identify those states that afford the same observations [12, 14]. For equational reasoning about processes, one needs to find an axiomatization that is sound and ground-complete modulo the semantics under consideration, meaning that all equivalent closed terms can be equated. Ideally, such an axiomatization is also ω-complete, meaning that all equivalent open terms can be equated. If such a finite axiomatization exists, it is said that there is a finite basis for the equational theory. For concrete semantics, so in the absence of the silent action τ , the existence of finite bases is well-studied [7, 14, 16], in the context of the process algebra BCCSP, containing the basic process algebraic operators from CCS and CSP. However, for weak semantics, that take into account the τ , hardly anything is known on finite bases. In [12], Van Glabbeek presented a spectrum of weak semantics. For several of the semantics in this spectrum, a sound and ground-complete axiomatization has been given, in the setting of the process algebra BCCS (BCCSP extended by τ ), see, e.g., [13]. But a finite basis has been given only for weak, delay, η- and branching bisimulation semantics [11, 18], and in case of an infinite alphabet of actions also for weak impossible futures semantics [22]. The reason for this lack of results on finite bases, apart from the inherent difficulties arising with weak semantics, may be that it is usually not so straightforward 

This work is partially supported by the Dutch Bsik project BRICKS.

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 167–180, 2009. c Springer-Verlag Berlin Heidelberg 2009 

168

T. Chen, W. Fokkink, and R. van Glabbeek

to define a notion of unique normal form for open terms in a weak semantics. Here we will employ a saturation technique, in which normal forms are saturated with subterms. In this paper, we focus on two closely related weak semantics, based on failures and impossible futures. A weak failure consists of a trace a1 · · · an and a set A, both of concrete actions. A state exhibits this weak failure pair if it can perform the trace a1 · · · an (possibly intertwined with τ ’s) to a state that cannot perform any action in A (even after performing τ ’s). In a weak impossible future, A can be a set of traces. Weak failures semantics plays an essential role for the process algebra CSP [3]. For convergent processes, it coincides with testing semantics [8, 19], and thus is the coarsest congruence for the CCS parallel composition that respects deadlock behavior. Weak impossible futures semantics [21] is a natural variant of possible futures semantics [20]. In [15] it is shown that weak impossible futures semantics, with an additional root condition, is the coarsest congruence containing weak bisimilarity with explicit divergence that respects deadlock/livelock traces (or fair testing, or any liveness property under a global fairness assumption) and assigns unique solutions to recursive equations. The heart of our paper is a finite basis for the inequational theory of BCCS modulo the weak failures preorder. The axiomatization consists of the standard axioms A1-4 for bisimulation, three extra axioms WF1-3 for failures semantics, and in case of a finite alphabet A, an extra axiom WFA . The proof that A1-4 and WF1-3 are a finite basis in case of an infinite alphabet is a sub-proof of the proof that A1-4, WF1-3 and WFA are a finite basis in case of a finite alphabet. Our proof has the same general structure as the beautiful proof for testing equivalences given in [8] and further developed in [17]. Pivotal to this is the construction of “saturated” sets of actions within a term [8]. Since here we want to obtain an ω-completeness result, we extend this notion to variables. Moreover, to deal with ω-completeness, we adopt the same general proof structure as in the strong case [9]. In this sense, our proof strategy can be viewed as a combination of the strategies proposed in [8] and [9]. Furthermore, we apply an algorithm from [2, 6, 10] to obtain a finite basis for BCCS modulo weak failures equivalence for free. At the end, we investigate the equational theory of BCCS modulo weak impossible futures semantics. This shows a remarkable difference with weak failures semantics, in spite of the strong similarity between the definitions of these semantics (and between their ground-complete axiomatizations). As said, in case of an infinite alphabet, BCCS modulo the weak impossible futures preorder has a finite basis [22]. However, we show that in case of a finite alphabet, such a finite basis does not exist. Moreover, in case of weak impossible futures equivalence, there is no finite ground-complete axiomatization, regardless of the cardinality of the alphabet. A finite basis for the equational theory of BCCSP modulo (concrete) failures semantics was given in [9]. The equational theory of BCCSP modulo (concrete) impossible futures semantics is studied in [4]. It is interesting to see that our results for weak semantics agree with their concrete counterparts, with very similar proofs. This raises a challenging open question: can one establish a general theorem to link the axiomatizability (or nonaxiomatizability) of concrete and weak semantics? Due to space restriction, some proofs, remarks and examples are omitted in the current paper. These include, in particular, proofs of Lemmas 1 and 3 and Theorems 5 and 6. However, they can be found in the full version of this paper [5].

On Finite Bases for Weak Semantics: Failures Versus Impossible Futures

169

2 Preliminaries BCCS(A) is a basic process algebra for expressing finite process behavior. Its signature consists of the constant 0, the binary operator + , and unary prefix operators τ and a , where a is taken from a nonempty set A of visible actions, called the alphabet, ranged over by a, b, c. We assume that τ ∈ / A and write Aτ for A ∪ {τ }, ranged over by α, β. t ::= 0 | at | τ t | t + t | x Closed BCCS(A) terms, ranged over by p, q, represent finite process behaviors, where 0 does not exhibit any behavior, p + q offers a choice between the behaviors of p and q, and αp executes action α to transform into p. This intuition is captured by the transition rules below. They give rise to Aτ -labeled transitions between closed BCCS terms. α

x → x α

αx → x

α

x + y → x

α

y → y α

x + y → y

We assume a countably infinite set V of variables; x, y, z denote elements of V . Open BCCS terms, denoted by t, u, v, may contain variables from V . Write var (t) for the set of variables occurring in t. The operational semantics is extended verbatim to open terms; variables generate no transition. We write t ⇒ u if there is a sequence of τ τ τ α α transitions t → · · · → u; furthermore t → denotes that there is a term u with t → u, α α and likewise t ⇒→ denotes that there are a terms u, v with t ⇒ u → v. The depth of a term t, denoted by |t|, is the length of the longest trace of t, not counting τ -transitions. It is defined inductively as follows: |0| = |x| = 0; |at| = 1 + |t|; |τ t| = |t|; |t + u| = max{|t|, |u|}. A (closed) substitution, ranged over by σ, ρ, maps variables in V to (closed) terms. For open terms t and u, and a preorder  (or equivalence ≡) on closed terms, we define t  u (or t ≡ u) if σ(t)  σ(u) (resp. σ(t) ≡ σ(u)) for all closed substitutions σ. a a Clearly, t → t implies that σ(t) → σ(t ) for all substitutions σ. An axiomatization is a collection of equations t ≈ u or of inequations t  u. The (in)equations in an axiomatization E are referred to as axioms. If E is an equational axiomatization, we write E t ≈ u if the equation t ≈ u is derivable from the axioms in E using the rules of equational logic (reflexivity, symmetry, transitivity, substitution, and closure under BCCS contexts). For the derivation of an inequation t  u from an inequational axiomatization E, denoted by E t  u, the rule for symmetry is omitted. We will also allow equations t ≈ u in inequational axiomatizations, as an abbreviation of t  u ∧ u  t. An axiomatization E is sound modulo a preorder  (or equivalence ≡) if for all terms t, u, from E t  u (or E t ≈ u) it follows that t  u (or t ≡ u). E is groundcomplete for  (or ≡) if p  q (or p ≡ q) implies E p  q (or E p ≈ q) for all closed terms p, q. Moreover, E is ω-complete if for all terms t, u with E σ(t)  σ(u) (or E σ(t) ≈ σ(u)) for all closed substitutions σ, we have E t  u (or E t ≈ u). When E is ω-complete as well as ground-complete, it is complete for  (or ≡) in the sense that t  u (or t ≡ u) implies E t  u (or E t ≈ u) for all terms t, u. The equational theory of BCCS modulo a preorder  (or equivalence ≡) is said to

170

T. Chen, W. Fokkink, and R. van Glabbeek

be finitely based if there exists a finite, ω-complete axiomatization that is sound and ground-complete for BCCS modulo  (or ≡). A1-4 below are the core axioms for BCCS modulo bisimulation semantics. We write t = u if A1-4 t ≈ u. A1 A2 A3 A4

x+y (x + y) + z x+x x+0

≈ ≈ ≈ ≈

y+x x + (y + z) x x

 Sum