Distributed Synthesis for LTL Fragments

Transcription

1 Dstrbuted Synthess for LTL Fragments Krshnendu Chatterjee, Thomas A. Henznger, Jan Otop, Andreas Pavloganns IST Austra {chatterjee, tah, jotop, Abstract We consder the dstrbuted synthess problem for temporal logc specfcatons. Tradtonally, the problem has been studed for LTL, and the prevous results show that the problem s decdable ff there s no nformaton fork n the archtecture. We consder the problem for fragments of LTL and our man results are as follows: (1) We show that the problem s undecdable for archtectures wth nformaton forks even for the fragment of LTL wth temporal operators restrcted to next and eventually. (2) For specfcatons restrcted to globally along wth non-nested next operators, we establsh decdablty (n EXPSPACE) for star archtectures where the processes receve dsjont nputs, whereas we establsh undecdablty for archtectures contanng an nformaton fork-meet structure. (3) Fnally, we consder LTL wthout the next operator, and establsh decdablty (NEXPTIME-complete) for all archtectures for a fragment that conssts of a set of safety assumptons, and a set of guarantees where each guarantee s a safety, reachablty, or lveness condton. I. INTRODUCTION Synthess and dstrbuted synthess. The synthess problem s the most rgorous form of systems desgn, where the goal s to construct a system from a gven temporal logc specfcaton. The problem was orgnally proposed by Church [1] for synthess of crcuts, and has been revsted n many dfferent contexts, such as supervsory control of dscrete event systems [2], synthess of reactve modules [3], and several others. In a semnal work, Pnuel and Rosner [4] extended the classcal synthess problem to a dstrbuted settng. In the dstrbuted synthess problem, the nput conssts of () an archtecture of synchronously communcatng processes, that exchange messages through communcaton channels; and () a specfcaton gven as a temporal logc formula; and the synthess queston asks for a reactve system for each process such that the specfcaton s satsfed. The most common logc to express the temporal logc specfcaton s the lnear-tme temporal logc (LTL) [5]. Prevous results for dstrbuted synthess for LTL. In general the dstrbuted synthess problem s undecdable for LTL, but the problem s decdable for ppelne archtectures [4]. The undecdablty proof uses deas orgnatng from the undecdablty proof of three-player mperfect-nformaton games [6], [7]. The decdablty results for dstrbuted synthess have been extended to other smlar archtectures, such as oneway rngs [8], and also a dstrbuted games framework was proposed n [9]. Fnally, a complete topologcal crteron on the archtecture for decdablty of dstrbuted synthess for LTL was presented [10], where t was shown that the problem s decdable f and only f there s no nformaton fork n the underlyng archtecture. Archtectures wthout nformaton forks can essentally be reduced to ppelnes. Fragments of LTL. Whle LTL provdes a very rch framework to express temporal logc specfcatons, n recent years, several fragments of LTL have been consdered for effcent synthess of systems n the non-dstrbuted settng. Such fragments often encompass a large class of propertes that arse n practce and admt effcent synthess algorthms, as compared to the whole LTL. In [11], [12] the authors consdered a fragment of LTL wth only eventually (reachablty) and globally (safety) as the temporal operators. In [13] LTL wth only eventually and globally operators (but wthout next and untl operators) was consdered for effcent translaton to determnstc automata. The temporal logc specfcatons for reactve systems often consst of a set of assumptons and a set of guarantees, and the reactve system must satsfy the guarantees f the envronment satsfes the assumptons. In [14] the GR1 (generalzed reactvty 1) fragment of LTL was ntroduced where each assumpton and guarantee s a lveness condton; and t has been shown that GR1 synthess s very effectve to automatcally synthesze ndustral protocols such as the AMBA protocol [15], [16]. Our contrbutons. In ths work we consder the dstrbuted synthess problem for fragments of LTL. The prevous results n the lterature consdered the whole LTL and characterzed archtectures that lead to decdablty of dstrbuted synthess. In contrast, we consder fragments of LTL to present fner characterzatons of the decdablty results. Our man contrbutons are as follows: 1) Reachablty propertes. Frst we consder the fragment of LTL wth next and eventually (reachablty) as the only temporal operators, and establsh that the dstrbuted synthess problem s undecdable f there s an nformaton fork n the underlyng archtecture. In partcular, the problem s undecdable wth one nestng depth of the next operator and only one eventually operator;.e., f we consder the fragment of LTL that conssts of Boolean combnatons of atomc propostons and next of atomc propostons; and only one eventually as the temporal operator, then the dstrbuted synthess problem s undecdable ff there s an nformaton fork n the archtecture. 2) Safety propertes. We then consder the fragment of LTL wth next and globally (safety) as the only temporal operators, wth a sngle occurrence of the globally operator. We show that the dstrbuted synthess problem can be decdable under the exstence of nformaton forks; n partcular we establsh decdablty (n EXPSAPCE) for the star archtecture where processes have no common nputs from the envronment. However, we show that ISBN /13. Copyrght owned jontly by the authors and FMCAD Inc. 18 1

2 the problem remans undecdable for archtectures contanng an nformaton fork-meet, a structure n whch two processes receve sets of dsjont nputs, (as n the nformaton fork case), and a thrd process receves the unon of those sets. Moreover, our undecdablty proof agan uses specfcatons that do not contan nested next operators. In other words, f there s nformaton fork, the problem may be decdable, but f there s nformaton fork, and then the forked nformaton meets agan, then we obtan undecdablty. 3) Temporal specfcatons wthout the next operator. Snce our results show that even wth one nestng depth of the next operator, dstrbuted synthess s undecdable wth reachablty and safety objectves, we fnally consder the problem wthout the next operator. We show that f we consder a set of safety assumptons, and a set of guarantees such that each guarantee s a safety, reachablty, or a lveness guarantee, then the dstrbuted synthess problem s decdable (and NEXPTIME-complete) for all archtectures. Hence, our paper mproves upon exstng results by presentng fner (un)decdablty characterzatons of the dstrbuted synthess problem for fragments of LTL. We also remark that when we establsh decdablty, t s ether EXPSPACE or NEXPTIME-complete, as compared to prevous proofs of decdablty n dstrbuted synthess settng where the complexty s non-elementary. Thus as compared to the complexty of prevous decdablty results (tower of exponentals), our complextes (at most two exponentals) are very modest. II. MODEL DESCRIPTION Archtectures. An archtecture s a tuple A =(P,p e,v,e), where P = {p e,p 1,p 2,...p n } s a set of n +1 processes, p e s a dstngushed process representng the envronment, V s a set of (output) bnary varables, and E : P P!2 V defnes the communcaton varables between processes (.e, E(p, q) ={u, v} means that p wrtes to varables u, v, and q reads from them). For every process p 2P, we denote wth O(p) = S q2p E(p, q) the set of output varables of p, and wth I(p) = S q2p E(q, p) the set of nput varables of p. We requre that for all p, q 2P: O(p) \ O(q) =;,.e., no two processes wrte to the same varable. Fnally, we wll denote wth P = P\{p e }. An archtecture descrbes a dstrbuted reactve system, wth the envronment provdng the nputs va O(p e ), and the system respondng va I(p e ). The par (P,E) descrbes the archtecture of the system as a multgraph, wth P beng the set of nodes, and E(p, q) the set of drected p! q edges wth the correspondng varables as labels. Trees. We defne a (full) B-tree T over some fnte set B as the set of all nodes x 2 2 B. A (possbly nfnte) sequence of nodes =(x 1,x 2...) forms a path n T, f for every 1 we have x +1 = x z, for some z 2 2 B. For such a path, we wll use [] to denote the element of at the -th poston, whle [, 1] denotes the nfnte suffx of startng at poston. An A-labeled B-tree T s a B-tree equpped wth a labelng functon of ts nodes, : 2 B! 2 A. For every node x = yz 2 T wth z 2 2 B we denote wth ` (x) =z [ (x),.e., the ` of x conssts of the branch z from the parent and the label (x). For a (possbly nfnte) path =(x 1,x 2,...), we defne wth ` ( ) =(` (x 1 ),` (x 2 )...). Local strateges. For every process p 2P,alocal strategy p s a functon p : 2 I(p)! 2 O(p), settng the output varables of p accordng to the hstory of ts nput varables. Observe that every such local strategy p can be vewed as a labelng of an O(p)-labeled I(p)-tree T p. A local strategy p has fnte memory f there exsts a fnte set M, m 0 2M, and functons f : M 2 I(p)!Mand g : M!2 O(p) such that for all x = x 1 x 2...x k wth x 2 2 I(p), we have p(x) =g(f(...(f(f(m 0,x 1 ),x 2 )...,x k )). The memory of p s sad to be M, whle f M =1, then p s called memoryless. Collectve strateges. The collectve strategy of the archtecture A s a functon : 2 O(pe)! 2 V \O(pe), mappng every fnte sequence of the outputs of the envronment to a subset of the outputs of the processes p accordng to the composton ( p : p 2P ). The collectve strategy can be vewed as a (V \ O(p e ))-labeled O(p e )-tree T and for any nfnte path n T, we wll call ` ( ) a computaton. Hence, T descrbes a dstrbuted algorthm, and every nfnte path =(x 1,x 2,...) startng from the root represents a dstrbuted computaton ` ( ), accordng to the local strateges ( p : p 2P ). Synthess (realzablty). We wll consder dstrbuted reactve systems wth specfcatons gven by temporal logc formulae. For temporal logc formulae we wll consder LTL; see [5] for the formal syntax and semantcs of LTL. The problem of realzablty of a temporal logc formula n an archtecture A asks whether there exst local strateges p for every process p, such that for every nfnte path of the (V \O(p e ))-labeled O(p e )-tree T of the collectve strategy, wth startng from the root, we have ` ( ) =. If admts such strateges p for every p 2P, then t s called realzable, and the collectve strategy gves an mplementaton for on A. III. SYNTHESIS FOR REACHABILITY SPECIFICATIONS In the current secton we dscuss the synthess problem for reachablty specfcatons, where the objectve conssts of propostonal formulae connected wth Boolean operators and non-nested X (next) operators. We wll show that even under such restrctons, the synthess problem remans undecdable for all archtectures contanng an nformaton fork, va a reducton from the haltng problem of Turng machnes. Fragment LTL. We consder LTL that conssts of formulae from the followng LTL fragment: = P XP = 1 ^ 2 1 _ 2 = Q! where P, Q are propostonal formulae, X s the next operator, s the eventually temporal operator. We consder the standard semantcs of LTL. Formula represents a reachablty objectve, and Q wll capture the ntal nput n the archtecture. Turng machnes. Let M be a determnstc Turng machne fxed throughout ths secton and let Q be the set of states 2 19

3 of M (see [17] for detaled descrptons of Turng machnes). The machne M works over the alphabet {0, 1, t}, and ts tape s bounded by # symbols. The machne M cannot move left on a # symbol, and movng rght to a # symbol effects n extendng the tape by a blank symbol t. In our analyss, M starts wth the empty tape. A confguraton of M s a word #vqaut#, where a 2{0, 1}, v, u 2{0, 1} and q 2Q. Such a confguraton has the standard nterpretaton as an nfnte tape such that v s the part of the tape precedng the head, q s the current state of M, a s the letter under the head, and u s a sequence of symbols succeedng the head. The blank symbol t represents the rghtmost cell of the tape that has not been altered by M. We defne the projecton? over words w from some alphabet contanng?, such that? (w) s the result of omttng all? symbols from w. We defne a scattered confguraton C of M as a word over ={0, 1, t,?, #}[Q such that? (C) s a confguraton of M. Informaton-fork archtecture. We frst consder the archtecture A 0 (Fgure 1), characterzed as an nformaton fork n [10], for whch the problem of realzablty has been shown to be undecdable, usng LTL formulae wth nested untl operators (n [4]). Here we show that the problem remans undecdable for A 0 and specfcatons n the restrcted fragment of LTL. Ths s obtaned through a reducton from the haltng problem of M, by constructng a specfcaton 2 LTL whch s realzable ff M halts on the empty nput. Proof dea. The archtecture A 0 conssts of the envronment p e and two processes p 1 and p 2. The processes act as I/O streams, outputtng confguratons of M; the envronment sends separately to each process next and stall sgnals, ndcatng that the correspondng process should output the next letter from {0, 1, t, #}[Q of the current confguraton of M, or t should output?. Constructon of '. Frst, we wll provde a regular safety property ' whch specfes that f the envronment satsfes an alternaton assumpton,.e., every stall sgnal s followed by a next sgnal, then p 1 and p 2 conform wth a seres of guarantees. The property ' does not belong to the LTL fragment, but we wll show how t can be expressed by a safety automaton A safe. Then, we wll prove that f ' s realzable, and the envronment conforms wth the alternaton assumpton, then the processes output a legal sequence of confguratons of M, scattered wth the? symbol. Converson to LTL. Next, we wll provde the specfcaton for the synthess problem 2 LTL, such that s realzable ff ' s realzable and M halts on the empty nput. Formula does not express ' drectly, but t asserts that the envronment smulates a run of A safe fathfully, and fnally one of the processes outputs a haltng confguraton of M. More precsely, the envronment smulates a run of A safe storng the current state of A safe n a set of hdden varables {q 1,...,q m } 2 E(p e,p e ), and encodes that eventually ether () the envronment cheats n the smulaton of A safe, or () one of the processes outputs a haltng state q of M, whle the current state of A safe s not rejectng (.e., q was reached legally wth respect to M). We wll conclude that s realzable ff M halts on the empty nput. 20 q 1,...,q m p e x 1 x 2 p 1 p 2 y 1 y 2 Fg. 1: The archtecture A 0 whch conssts an nformaton fork. Formal proof. A safety automaton cannot express a scattered confguraton that s fnte. Thus, we defne a scattered preconfguraton C (of M) as a (possbly nfnte) word whose every fnte prefx can be extended to a scattered confguraton of M. A scattered preconfguraton s formally defned as a fnte or nfnte word over that begns wth #, there s at most one symbol from Q, there are no symbols after the second # and the t symbol s followed by the # symbol. Let C 1,C 2 be scattered preconfguratons. We denote wth?(c) the set of postons n C where? occurs, and wrte C 1 k C 2 f the symmetrc dfference of?(c 1 ) and?(c 2 ) has at most one element,.e.,?(c 1 )4?(C 2 ) apple1. We defne as C 1 ` C 2 f C 1 k C 2 and ()? (C 2 ) follows legally from? (C 1 ) accordng to M, or () both C 1,C 2 are nfnte preconfguratons such that every fnte prefx can be extended to fnte preconfguratons C 0 1,C 0 2 such that? (C 0 2) follows legally from? (C 0 1). For nfnte words w 1,w 2, we defne w 1 w 2 as a word over such that the -th letter of w 1 w 2 s a par of the -th letters of w 1,w 2. Observe that there are safety automata workng over that recognze the languages {C 1 C 2 : C 1 k C 2 } and {C 1 C 2 : C 1 ` C 2 }. Constructon of '. We frst construct the regular safety property ' = L! V 0appleapple4 Cond, where L (the alternaton assumpton) and Cond are defned as follows: L: for every process, every stall sgnal s followed by a next sgnal. Cond 0 : each process outputs? when ts nput s stall, otherwse t outputs a letter from \ {?}, Cond 1 : each process produces a sequence of scattered preconfguratons, Cond 2 : ntally, each process produces two scattered confguratons of M, whose projectons are the frst two vald confguratons of M, Cond 3 : f startng from some poston, p 1 outputs consecutvely C 1,C 2 and p 2 outputs consecutvely C1,C 0 2, 0 then C1 0 ` C 1 mples C2 0 ` C 2 or C2 0, C 2, Cond 4 : f D, D 0 are outputs of p 1,p 2 up to some postons such that D k D 0 and? (D) =? (D 0 ), then? (D) =? (D 0 ). We provde a hgh-level descrpton of the constructon of an alternatng safety automaton A safe (see [18] for the defnton of alternatng automata) whch verfes that every executon satsfes '. Note that A safe can be transformed to a nondetermnstc automaton by a standard power-set constructon. Clearly, condtons L, Cond 0 and Cond 1 can be expressed by a safety automaton. For the condton Cond 2, observe 3

4 that the frst two confguratons of M have at most 9 letters #q 0 t ##q 1 a t #, wth a 2 {0, 1, }. To show that the rest of condtons can be expressed by a safety automaton, we assume that L s satsfed; otherwse those condtons do not have to be checked (note that f L s volated, A safe accepts uncondtonally). Because of L, A safe can verfy that p 1 and p 2 conform wth Cond 2 by checkng the frst 18 output letters. For the condton Cond 3, A safe operates as follows: whenever t encounters a # symbol markng the begnnng of a confguraton, t splts unversally. One copy looks for the next confguraton, and the second copy, denoted by A 3, verfes that Cond 3 holds at the current poston, as follows. It gnores? symbols and compares whether C 1 k C 0 1, confguratons? (C 1 ) and? (C 0 1) are equal everywhere except for postons adjunct to the head of M, and the letters adjunct to the head are consstent wth the transton of M. If one of these condtons s volated, C 0 1 6` C 1, therefore A 3 accepts the word regardless of what follows. Otherwse, f those condtons hold,.e., C 0 1 ` C 1, A 3 non-determnstcally verfes one of the followng condtons: C 0 2 6k C 2 or C 0 2 ` C 2. Both condtons can be verfed by safety automata, snce C 2 and C 0 2 ether start concurrently, or C 2 s delayed by 1 step from C 0 2. For the condton Cond 4 observe that f D k D 0 and? (D) =? (D 0 ), then D D 0 apple 1 and the automaton needs to remember at most one symbol to compare? (D) and? (D 0 ). We can now prove the followng lemma. Lemma 1. If ' s realzable, then for every k 2N, n all executons where L holds, both p 1 and p 2 output sequences of scattered confguratons whose? projectons are sequences of at least k consecutve vald confguratons of M, startng wth the ntal confguraton on the empty nput. Proof: Frst note that there exst executons where the envronment ndeed satsfes L, and thus p 1 and p 2 satsfy condtons Cond 0 -Cond 4. The lemma clearly holds for k =1, 2, due to condtons Cond 0 Cond 2. For the nductve step, assume that the lemma holds for k 2. Consder a sequence of nputs to p 1 consstng of next sgnals only. Then, there s a sequence of nputs to p 2 consstng of some number of next sgnals and exactly? (C k ) stall sgnals placed n a such way that p 1 outputs C 1...C k C k+1, p 2 outputs C1 0...Ck 0 1 C0 k, and C kc k+1, Ck 0 1 C0 k are synchronzed,.e. they start at the same poston and C k k Ck 0 1, C k+1 k Ck 0. By the nducton assumpton? (Ck 0 1 ) and?(c k )=? (Ck 0 ) are, respectvely, (k 1)-th and k-th confguratons of M. Therefore, Ck 0 1 ` C k and, by Cond 3, Ck 0 ` C k+1. Ths mples that C k+1 s a fnte scattered preconfguraton and? (C k+1 ) s the (k + 1)-th confguraton of M. Gven that for an nput consstng of next sgnals only, p 1 outputs C 1...C k C k+1 satsfyng the statement, we can show that regardless of the number of stall sgnals, under condton L, p 1,p 2 output k +1 scattered confguratons satsfyng the statement. Frst, the condton Cond 4 mples that f p 2 also has an nput sequence consstng of next sgnals alone, t wll output the same sequence, that s, C 1...C k C k+1. By a smple nducton on the number of stall sgnals each process receves, and condton Cond 4, we conclude that for any number of stall sgnals, as long as L s satsfed by the envronment, p 1,p 2 output k +1 scattered confguratons whose projectons are the frst k +1 consecutve confguratons of M. Converson to LTL. Gven the safety automaton A safe whch verfes that ' s satsfed, we can construct a specfcaton 2 LTL, such that s realzable f and only f the Turng machne M does not halt on the empty nput. The envronment uses the hdden (not vsble to p 1,p 2 ) varables q 1,...,q k 2 E(p e,p e ) to smulate the automaton A safe. We provde a hgh level descrpton of the followng formulae: Q specfes that the frst state of A safe accordng to the output varables {q 1,...q m } s compatble wth the ntal values of x 1, x 2, y 1 and y 2 (.e. {q 1,...q m } represent the state of A safe reached from the ntal state after readng the ntal values of x 1, x 2, y 1 and y 2 ; Q s propostonal) 1 specfes that A safe has a transton from the current state to the next state, encoded by the values of {q 1,...q m } n the current and the next round, accordng to the value of varables x 1, x 2, y 1 and y 2 n the next round (.e., p e smulates A safe fathfully; 1 contans only propostonals and non-nested X operators). 2 specfes that the current state of A safe s not rejectng, and p 1 or p 2 outputs a haltng state of M (.e., some process reached a haltng confguraton of M, and both processes behaved accordng to A safe ; 2 s propostonal). Fnally, we construct = Q! ( 1 _ 2 ), wth 2 LTL. If s realzable, the processes satsfy 2 n all runs where the envronment fathfully smulates A safe and conforms wth condton L(.e., Q and 1 are true). Then p 1, p 2 output a haltng state of M and satsfy ', whch by Lemma 1, guarantees that the haltng state was reached by a legal sequence of confguratons of M. In the nverse drecton, f M halts, then s realzable by (fnte) local strateges whch output a fnte, legal sequence of confguratons of M and conform wth condton Cond 0. Hence, we obtan the followng theorem. Theorem 1. The realzablty of specfcatons from LTL n A 0 s undecdable. Smlarly as n [10], the above argument can be carred out to any archtecture whch contans an nformaton fork, by ntroducng addtonal safety condtons n ', whch requre that all processes propagate the nputs of the envronment to the two processes consttutng the nformaton fork. It has also been shown n [10] that n archtectures wthout nformaton forks, the realzablty of every LTL specfcaton s decdable. Hence, Theorem 1 together wth the results from [10] lead to the followng corollary. Corollary 1. For every archtecture A, the realzablty of specfcatons from LTL n A s decdable ff A does not contan an nformaton fork. IV. SYNTHESIS FOR SAFETY SPECIFICATIONS In the current secton we consder safety specfcatons where the safety condton conssts of propostonal formulae connected wth Boolean operators, and the X temporal operator. Frst, we show that the synthess problem s undecdable 4 21

5 for archtectures contanng an nformaton fork-meet (see Fgure 3), by a smlar constructon as n the case of LTL. Then we show that the problem s decdable for a famly of star archtectures, despte the exstence of nformaton forks. Fragment LTL. We consder LTL that conssts of formulae from the followng LTL fragment: = P 1 ^ 2 1 _ 2 X = Q ^ where P, Q are propostonal formulae, and s the globally operator. We consder the standard semantcs of LTL. The part of specfes a safety condton, and we nterpret Q as the ntal condtons. The fragment LTL can express safety specfcatons, one of the most basc specfcatons n verfcaton. Whle the nformaton fork crteron s decsve for the undecdablty of reachablty specfcatons, here we extend ths crteron to the famly of star archtectures of n +1 processes, denoted as S n (.e., p e s the central process, and S I(p ) = O(p e )) (Fgure 2) and show that: () the realzablty of some 2 LTL n S n s decdable f all processes receve parwse dsjont nputs, () t s undecdable f n 3 and we allow overlappng nputs. The latter can be generalzed to all archtectures whch contan such a structure, whch we call an nformaton fork-meet. O(p n ) p n I(p n ) I(p 1 ) O(p 1 ) p e p 1 I(p 2 ) p 2 O(p 2 ) Fg. 2: The famly of start archtectures S n. A. Overlappng nputs Here we demonstrate undecdablty of realzablty of specfcatons 2 LTL for star archtectures wth overlappng nputs, and wth havng X -depth 1 (.e., belongs to a subclass of LTL where X operators are not nested). We frst consder the star archtecture A 1 (Fgure 3), and obtan the undecdablty of realzablty of such specfcatons va a reducton from the (non) haltng problem. p e x 1 x 1 x 2 p 1 y 1 p 3 q 1,...,q m Fg. 3: The archtecture A 1 conssts an nformaton fork-meet. Gven a Turng machne M, recall the specfcaton ' (from Secton 3 for LTL ) encodng condtons L and Cond 0 Cond 4 through the safety automaton A safe. In contrast wth 22 x 2 p 2 y 2 the prevous secton, here we requre that process p 3 (nstead of p e ) fathfully smulates the safety automaton A safe usng the output varables q 1,...q m 2 E(p 3,p e ). Note that A safe operates on the varables x 1,x 2,y 1,y 2, whle p 3 does not have access to y 1 and y 2. However, t can nfer these values by smulatng p 1 and p 2 nternally, snce p 3 receves both x 1 and x 2 (overlappng nputs). Formal proof. We provde a hgh level descrpton of the followng formulae: Q specfes that the frst state of A safe accordng to the output varables {q 1,...q m } s compatble wth the ntal values of x 1, x 2, y 1 and y 2 (.e. {q 1,...q m } represent the state of A safe reached from the ntal state after readng the ntal values of x 1, x 2, y 1 and y 2 ; Q s propostonal) 1 specfes that A safe has a transton from the current state to the next state, encoded by the values of {q 1,...q m } n the current and the next round, accordng to the value of varables x 1, x 2, y 1 and y 2 n the next round (.e., p e smulates A safe fathfully; 1 contans only propostonals and non-nested X operators). 2 specfes that p 1 and p 2 do not output a haltng state of M (.e., M does not termnate; 2 s propostonal). 3 specfes that A safe does not reach a rejectng state (.e., the processes conform to condtons Cond 0 -Cond 4 or the envronment volates L; 3 s propostonal). We construct = Q ^ ( 1 ^ 2 ^ 3 ). Smlarly as n the case of LTL, f s realzable, p 3 fathfully smulates A safe (Q and 1 are true), and p 1, p 2 satsfy ' n all runs where the envronment conforms wth condton L ( 3 s true). By Lemma 1, p 1 and p 2 output a legal sequence of confguratons of M, and 2 guarantees that M does not halt. In the nverse drecton, f M does not halt, s realzable by local strateges where () p 1, p 2 output a legal sequence of confguratons of M and conform wth condton Cond 0, and () p 3 fathfully smulates A safe. Hence we have the followng result. Theorem 2. The realzablty of specfcatons from LTL n A 1 s undecdable. Remark 1. We remark that our proof of undecdablty n Theorem 2 makes use of nfnte-memory strateges, snce the processes p 1 and p 2 are requred to output an nfnte, non-haltng computaton. However, the realzablty problem for LTL n A 1 remans undecdable even f we restrct the strateges to be fnte-memory. We refer to the longer verson of ths paper n [19] for the proof. Informaton fork-meet. We say that an archtecture A = (P,p e,v,e) has an nformaton fork-meet f there are three processes p 1,p 2,p 3 2P and paths 1, 2 n the underlyng graph such that 1) the frst edges n 1, 2 are labeled by output varables of p e, 2) the last edge of 1 s an nput varable of p 1, but not p 2 3) the last edge of 2 s an nput varable of p 2, but not p 1 4) the last edges of 1, 2 are nput varables of p 3 Observe that an nformaton fork-meet s a specal case of nformaton fork, wth a thrd process that collects all nformaton that s dvded between p 1 and p 2. 5

6 As n the case of LTL, the undecdablty argument can be carred to any archtecture contanng such a structure, by ntroducng addtonal condtons n ' whch requre the rest of the processes to propagate the nputs of the envronment to p 1, p 2 and p 3 accordngly. Corollary 2. The realzablty of LTL specfcatons n archtectures contanng an nformaton fork-meet s undecdable. B. Parwse dsjont nputs In ths subsecton we dscuss synthess for formulae 2 LTL for the class of star archtectures, wth the addtonal property that all pars of processes receve dsjont nputs (.e., 8 6= j : I(p ) \ I(p j )=;), denoted as S n. Our goal s to prove decdablty of realzablty of such 2 LTL n every archtecture A2S n, by showng that whenever such s realzable, t admts strateges of bounded memory. Consder some archtecture A2S n and an arbtrary = Q ^ 2 LTL, wth the nestng level of X operators n beng k. Assume that s realzable n A by local strateges for every process p. These strateges can be represented by O(p )-labeled I(p )-trees T. We wll show how to construct strateges that also realze, where each tree I(p )-tree T representng s defned from frst 2 2k V +1 levels of T by applyng a foldng functon gven below. We frst defne the noton of some 2N closng n some computaton. Defnton 1. For a computaton `( ) and some 2N we say that closes n `( ) f `( )[ k, 1] =. Remark 2. `( ) = ff no closes n `( ). Let 1,..., n be local strateges and be the collectve strategy nduced by 1,..., n. For every 2{1,...,n}, the local strategy s represented by an O(p )-labeled I(p )-tree T. For every node x 2 T, wth x k, we denote wth x =(x k,x k 1...x 1 ) the k-node suffx of the unque path to x = x 1, and defne the type of x under as t (x) =` ( x ). For every level l k we defne the type of l under as t (l) ={t (x) : 2{1,...,n},x 2 T and x = l},.e., the type of a level l s the set of the types of the nodes of level l of every T, where 2{1,...,n}. Note that there exst at most 2 k V dstnct types of nodes. Consequently, there exst at most 2 2k V dstnct types of levels. We naturally extend the defnton of types to nodes of the (V \ O(p e ))-labeled O(p e )-tree T as t (x) =` ( x ). Consder some computaton ` ( ) n T. Observe that whether some closes n depends only on the ` ( )[].e., the type t ( []) determnes whether closes n. Hence, we have the followng remark: Remark 3. For a formula 2 LTL there exsts a set of types such that for every tree T, a path n T satsfes f ` ( )[1] = Q and for all 2N, we have t ( []) 2,.e., the set of types of nodes n T s a subset of. Foldng functon. Assume that there exst two levels l 1 <l 2 such that t (l 1 )=t (l 2 ). Then for every tree T, for every node x n level l 2 there exsts a node y n level l 1 such that t (x) =t (y),.e., x and y have the same type. For such l 1, l 2, and every process p, we defne the foldng functon f : 2 I(p)! 2 I(p) recursvely as follows: 8 >< x f x <l 2 f (x) = y f x = l 2 where y = l 1 and t (x) =t (y) >: f (f (y)z) f x >l 2 for x = yz wth z 2 2 I(p) and construct local strateges (x) = (f (x)). Hence, every strategy behaves as up to level l 2, whle for nodes further below, t maps them to nodes between levels l 1 and l 2, by recursvely foldng the levels l 1 and l 2 wth respect to the types of ther nodes. Snce the collectve strateges and behave dentcally on the frst l 1 levels, realzes the propostonal Q. The followng analyss focuses on the part of. The strateges preserve the types under of all local nodes up to level l 2, and only those. Because of the parwse dsjont nputs, ths property s mpled for the global nodes of the collectve strategy as well. The set of all such types serves as the set of Remark 3, whch n turn guarantees that the collectve strategy also realzes, as t does not ntroduce new types. We formalze these arguments below. The followng lemma establshes that for all nodes x n all T, the type of x s the same as the type of ts mage under f n the correspondng T. Lemma 2. For every x 2 2 I(p) wth x k, we have that t (x) =t (f (x)). Proof: Our proof proceeds by nducton on x : 1) x <l 2 : For all nodes w n x, we have that (w) = (f (w)) = (w), hence ` ( x )=` ( x ) and thus t (x) =t (f(x)). 2) x = l 2 : The statement holds by defnton. 3) x = m +1: Let x = yz wth y = m. By the nductve hypothess, t (y) =t (f (y)). We dstngush between the followng cases, dependng on whether f (y) extended by z hts the level l 2 (Fgure 4): () f (y) <l 2 1: Then f (x) =f (f (y)z) =f (y)z, that s, f we reach node x by extendng node y by an edge z, the same holds for ther correspondng mages under f. Then (x) = (f (x)) = (f (y)z), thus t (x) =t (f (y)z) =t (f (x)) (.e., the strategy wll label x as labels ts mage f (x), and the types of these two nodes are equal). () f (y) = l 2 1: By constructon, t (f (x)) = t (f (y)z) (.e., f (y) extended by z hts level l 2, and the foldng functon f wll brng x to level l 1, to a node of the same type). Then (x) = (f (x)) = (f (y)z), hence as n (), t (x) =t (f (y)z) =t (x). The desred result follows. The followng remark observes that for every archtecture from S n, every node n the collectve strategy tree corresponds to a unque set of nodes n the local strategy trees and vce versa, and that the collectve strategy on that node equals the unon of the local strateges on the correspondng local nodes. Remark 4. The followng assertons hold: 1) For every global node x = x 1 x 2...x m n T wth every x 2 2 O(pe), for every tree T j, there exsts a (unque) node x j = x 1 j x2 j...xm j such that x j = x \ 2 I(pj), and 6 23

7 l 1 f (y) z f (x) y z x (a) Case () l 2 z f (x) f (y) y z x (b) Case () Fg. 4: The two cases of the nductve step of Lemma 2. 2) for every set of nodes {x j = x 1 j x2 j...xm j } wth one x j from each T j, there exsts a (unque) global node x such that for all we have x = S j x j. Moreover, for every collectve strategy, we have (x) = S j j(x j ). It follows from the above remark and Lemma 2, that for every x 2 T we have that t (x) = t (f(x)), where f(x) = S f (x ). That s, the local foldng functons f result n a unque, global foldng functon f, and the types n the correspondng collectve strategy tree are preserved between the global nodes, and ther mages under f. Ths mples that the set of types occurrng n T s a subset of types of T. Then, by Remark 3 we conclude: Lemma 3. The collectve strategy mplements. Hence, whenever for a realzable 2 LTL exst levels l 1 and l 2 wth the same type under, we can construct a collectve strategy for whch every local strategy uses only the frst l 2 levels of the correspondng, and Lemma 3 guarantees that mplements. By our prevous observaton and the pgeonhole prncple, l 2 s upper bounded by 2 2k V +1, and thus every local strategy operates n the frst 2 2k V +1 levels of the correspondng I(p )-tree. There are a bounded number of local strateges wth ths property, thus the problem of realzablty n ths case reduces to exhaustvely explorng all of them. Moreover, t follows from our analyss that local nodes n the same level and havng the same type can be merged, snce the local strategy that behaves dentcally n both subtrees preserves the set of types appearng n the global tree. Hence, the wdth of each level s bounded by the number of dfferent possble types, 2 k V. Ths leads to Theorem 3 (we refer to [19] for the formal proof). Theorem 3. The realzablty of 2 LTL for the class S n of star archtectures wth parwse dsjont nputs s decdable n EXPSPACE. V. SYNTHESIS WITHOUT THE NEXT OPERATOR In the current secton we consder a fragment of LTL wthout the X operator, for whch the problem of realzablty s decdable n non-determnstc exponental tme n the sze of the specfcaton. Fragment LTL AG. We consder LTL AG that conssts of formulae from the followng LTL fragment: 24 l 1 l 2 = ^ P! ^ P! P! ^ Q ^ ^ R ^ ^! F ^ Q ^ ^ R ^ ^! F Q ^ ^ R ^ ^! F for 2{1,...m}, wth P, Q, R, F propostonal formulae, and P = V P, Q = V Q. We consder the standard semantcs of LTL. The LTL AG can express specfcatons that consst of conjuncton of safety assumptons, and guarantees where each guarantee s a safety, reachablty, or a lveness condton. A propostonal formula Q has the property that can ether be realzed n a sngle step, or s not realzable. Ths mples that realzable formulae Q admt memoryless strateges whch repeat the sngle step realzaton of Q. A smlar argument establshes that reachablty and safety specfcatons of propostonal formulae are equvalent wth respect to realzablty. We formally state these observatons n Lemmas 4 and 5, and refer to [19] for the proofs. Lemma 4. Let A be any archtecture. Every formula = Q, for some propostonal Q, s realzable n A ff t s realzable by memoryless strateges. Lemma 5. Let A be any archtecture. For every formula = Q for some propostonal Q, s realzable n A ff 0 = Q s realzable n A. Lemma 6 shows that the realzablty of some 2 LTL AG reduces to realzng a set of safety formulae of the form of Lemma 4. Lemma 6. Let A be any archtecture and = P! ( Q ^ V R ^ V F ) 2 LTL AG. The formula s realzable n A ff every R = (P! (Q ^ R )) and every F = (P! (Q ^ F )) s realzable n A. Proof: () For the rght to left drecton, assume that there exst famles of memoryless (by Lemma 4) local strateges ( R j ) and ( F j ) for every process p j, such that the collectve strategy R mplements R, and the collectve strategy F mplements F. Construct local strateges j such that for every x = yz wth z = (1 + x mod 2m), we have j (x) = R z j (z) f z apple m, and j (x) = F z m j (z) f z >m(.e. the local strategy j repeatedly alternates between R all the strateges j n the frst m steps, and between all F the strateges j the next m steps). Let be the collectve strategy of all j and consder an arbtrary path n T. Ether ` ( )[k] = P for some k, or for all k, t holds ` ( )[k] = P, and by constructon, for = 1 + k mod 2m, we have ` ( )[k] = Q ^ R when apple m and ` ( )[k] = Q ^ F m when >m. In both cases, ` ( ) =. () For the left to rght drecton, assume that for some, R s not realzable (the analyss s smlar for F ). By Lemma 5, (P! (Q ^ R ) s not realzable. Hence, for any collectve strategy there exsts some path n T, such that for all 7

8 k, we have ` ( )[k] = P ^ ( Q _ R ), and does not mplement. Hence, Lemma 6 establshes that every formula 2 LTL AG s realzable f and only f t admts local strateges for all the correspondng F, R, by provdng a constructve argument. As a consequence of Lemma 4, decdng whether every F, R s realzable reduces to realzng the propostonal formulae (P! (Q^R ) and (P! (Q^F ). Ths can be done n NEXPTIME, by havng a non-determnstc Turng machne guessng the local strateges of all processes, and verfyng that such strateges satsfy the formula under all the (exponentally many) possble nputs of the envronment. We show that the problem s also NEXPTIME-hard, va a reducton from the Dependency Quantfer Boolean Formula (DQBF) valdty problem ntroduced n [20] to study tme bounded mult-player alternatng machnes. A DQBF s a quantfed Boolean formula wth a succnct descrpton of dependences between the quantfed varables. Every DQBF has an equvalent form n whch all exstentally quantfed varables are substtuted by exstentally quantfed Skolem functons defned over ther dependences, and appearng at the begnnng of the formula (e.g. 8x 1 8x 2 9y 1 (x 1 )9y 2 (x 2 )'(x 1,x 2,y 1,y 2 ) s a DQBF statng that y depends on x, and has a functonal form x 1 8x 2 '(x 1,x 2, 1(x 1 ), 2(x 2 )) wth 1, 2 the Skolem functons). Lemma 7. Gven an archtecture A and a formula 2 LTL AG, decdng whether s realzable n A s NEXPTIME-hard. Proof: Consder any DQBF formula : 8x 1...8x k 9y 1 ( x! 1 )...9y n ( x! n )'(x 1,...x k,y 1...y n ) wth k unversally quantfed varables x and n exstentally quantfed varables y. We assume w.l.o.g. that the dependences of each y are only on some unversally quantfed varables! x. We construct the archtecture A = (P,p e,v,e), where P contans n +1 processes, V = {x 2 }[{y 2 }, process p receves as nputs from the envronment all! x, outputs varable y, whle the envronment uses all remanng x j as hdden varables. We construct the specfcaton = ' 2 LTL AG. Both A and are polynomal n the sze of. Because of Lemma 4, s realzable n A ff ' s realzable n A. In turn, ' s realzable ff s vald, wth local strateges correspondng to the Skolem functons n the functonal form of, and unversal varables correspondng to all possble choces of the envronment n A. Snce DQBF valdty s NEXPTIME-hard [20], the statement follows. Hence, we have the followng result. Theorem 4. Gven an archtecture A and a specfcaton 2 LTL AG, the realzablty of n A s NEXPTIME-complete. Observe that Lemma 6 reduces the problem of realzablty of some ' 2 LTL AG to realzng a set of formulae of the form Q, where Q s propostonal. Ths n turn s reducble to DQBF valdty (because of Lemma 4), and because of Lemma 7, the two problems are equvalent. In consequence, effcent algorthms for solvng DQBF, such as [21], yeld effcent synthess procedures for LTL AG, and vce versa. Moreover, f the DQBF tool outputs the correspondng Skolem functons, then a wtness collectve strategy for realzablty can be obtaned. VI. CONCLUSIONS In ths paper we studed the dstrbuted synthess problem for relevant fragments of LTL. We presented a much fner characterzaton of undecdablty results for dstrbuted synthess n terms of LTL fragments that uses eventually, globally and next operators. In contrast to prevous decdablty results that were non-elementary, we dentfy fragments where the complexty s EXPSPACE (or NEXPTIME-complete). An nterestng drecton of future work would be to develop algorthms for the problems for whch we establsh decdablty, obtan effcent mplementatons of the algorthms for dstrbuted synthess problems, and fnally consder some casestudes of practcal examples. Acknowledgments. The research was supported by Austran Scence Fund (FWF) Grant No P N23, FWF NFN Grant No S N23 (RSE), ERC Start grant (279307: Graph Games), Mcrosoft faculty fellows award, the Austran Scence Fund NFN RSE (Rgorous Systems Engneerng), the ERC Advanced Grant QUAREM (Quanttatve Reactve Modelng). REFERENCES [1] A. Church, Logc, arthmetc and automata, n Proceedngs of the nternatonal congress of mathematcans, pp , [2] P. Ramadge and W. Wonham, Supervsory control of a class of dscrete event processes, SIAM Journal on Control and Optmzaton, vol. 25, no. 1, pp , [3] A. Pnuel and R. Rosner, On the synthess of a reactve module, POPL 89, pp , ACM, [4] A. Pnuel and R. Rosner, Dstrbuted reactve systems are hard to synthesze, SFCS 90, pp vol.2, [5] A. Pnuel, The temporal logc of programs, n FOCS, pp , [6] J. H. Ref, Unversal games of ncomplete nformaton, STOC 79, pp , ACM, [7] G. L. Peterson and J. H. Ref, Multple-person alternaton, n FOCS, pp , [8] O. Kupferman and M. Y. Vard, Syntheszng dstrbuted systems, n LICS, pp , [9] S. Mohalk and I. Walukewcz, Dstrbuted games, n FSTTCS, pp , [10] B. Fnkbener and S. Schewe, Unform dstrbuted synthess, LICS, pp , [11] R. Alur, S. La Torre, and P. Madhusudan, Playng games wth boxes and damonds, n CONCUR, pp , [12] R. Alur and S. La Torre, Determnstc generators and games for LTL fragments, ACM Trans. Comput. Log., vol. 5, no. 1, pp. 1 25, [13] J. Kretínský and J. Esparza, Determnstc automata for the (F, G)- fragment of LTL, n CAV, pp. 7 22, [14] N. Pterman, A. Pnuel, and Y. Sa ar, Synthess of reactve(1) desgns, n VMCAI, LNCS 3855, Sprnger, pp , [15] Y. Godhal, K. Chatterjee, and T. A. Henznger, Synthess of AMBA AHB from formal specfcaton: A case study, STTT, [16] R. Bloem, S. J. Galler, B. Jobstmann, N. Pterman, A. Pnuel, and M. Weglhofer, Interactve presentaton: Automatc hardware synthess from specfcatons: a case study, n DATE, pp , [17] C. Papadmtrou, Computatonal complexty. Addson-Wesley, [18] O. Kupferman, M. Y. Vard, and P. Wolper, An automata-theoretc approach to branchng-tme model checkng, Journal of the ACM (JACM), vol. 47, no. 2, pp , [19] K. Chatterjee, T. A. Henznger, J. Otop, and A. Pavloganns, Dstrbuted synthess for LTL fragments, Techncal Report: IST Synthess.pdf. [20] G. Peterson, J. Ref, and S. Azhar, Lower bounds for multplayer noncooperatve games of ncomplete nformaton, Journal of Computers and Mathematcs wth Applcatons, vol. 41, pp , [21] A. Fröhlch, G. Kovászna, and A. Bere, A DPLL algorthm for solvng DQBF, Pragmatcs of SAT, vol. 2012,