This reserch ws supported in prt by the Europen Reserch Council (ERC) Advnced Investigtor Grnt QUAREM nd by the Austrin Science Fund (FWF) project S11402-N23. Synthesis from Quntittive Specifictions Arjun Rdhkrishn Institute of Science nd Technology, Austri Mrch 11, 2012 Joint work with Pvol Černý, Thoms A. Henzinger, Sivknth Gopi, nd Nishnth Totl
Boolen Specifictions vs. Quntittive Specifictions Boolen Specifictions Bd Good
Boolen Specifictions vs. Quntittive Specifictions Boolen Specifictions Quntittive Specifictions Bd Good Preference
Boolen Specifictions vs. Quntittive Specifictions Boolen Specifictions Quntittive Specifictions Bd Good Preference Yes/No vs. Preference Order
Boolen Specifictions vs. Quntittive Specifictions Boolen Specifictions Quntittive Specifictions Bd Good Yes/No vs. Preference Order Preference Mny formlisms: Weighted Automt, Quntittive logics, Cost-Register Automt, Softwre Metrics, etc
Boolen Specifictions vs. Quntittive Specifictions Boolen Specifictions Quntittive Specifictions Bd Good Yes/No vs. Preference Order Preference Mny formlisms: Weighted Automt, Quntittive logics, Cost-Register Automt, Softwre Metrics, etc In this tlk: Rective systems + Behviourl metrics
Our formlism: Simultion distnces Specifiction: Idel boolen specifiction 1 [R. Milner. 1971]
Our formlism: Simultion distnces Specifiction: Idel boolen specifiction + Error Model 1 [R. Milner. 1971]
Our formlism: Simultion distnces Specifiction: Idel boolen specifiction + Error Model Extend the clssicl Simultion reltion 1 to Simultion distnces 1 [R. Milner. 1971]
Our formlism: Simultion distnces Specifiction: Idel boolen specifiction + Error Model Extend the clssicl Simultion reltion 1 to Simultion distnces Written s d E (I, S) if d E (I 1, S) < d E (I 2, S), then I 1 is preferred over I 2 1 [R. Milner. 1971]
Our formlism: Simultion distnces Idel Specifiction b b 0 1 2 Implementtion Specifiction Error Penlty b (1) Error Model (0) 0 b b (0) b (1) Implementtion b b b 0 1 2 3
Our formlism: Simultion distnces Idel Specifiction b b 0 1 2 b (1) Error Model (0) 0 b b (0) b (1) Implementtion b b b 0 1 2 3 Implementtion Specifiction Error Penlty b
Our formlism: Simultion distnces Idel Specifiction b b 0 1 2 Implementtion b Specifiction b Error Penlty 0 b (1) Error Model (0) 0 b b (0) b (1) Implementtion b b b 0 1 2 3
Our formlism: Simultion distnces Idel Specifiction b b 0 1 2 b (1) Error Model (0) 0 b b (0) b (1) Implementtion b b b 0 1 2 3 Implementtion b b Specifiction b b Error Penlty 0 0
Our formlism: Simultion distnces Idel Specifiction b b 0 1 2 b (1) Error Model (0) 0 b b (0) b (1) Implementtion b b b 0 1 2 3 Implementtion b b b Specifiction b b Error Penlty 0 0 1
Our formlism: Simultion distnces Idel Specifiction b b 0 1 2 b (1) Error Model (0) 0 b b (0) b (1) Implementtion b b b 0 1 2 3 Implementtion b b b Specifiction b b Error Penlty 0 0 1 0
Our formlism: Simultion distnces Idel Specifiction b b 0 1 2 b (1) Error Model (0) 0 b b (0) b (1) Implementtion b b b 0 1 2 3 Implementtion b b b... Specifiction b b... Error Penlty 0 0 1 0... Limit-Averge Simultion Distnce = 1 / 4 = 0.25
Error Models nd Properties Boolen Error Model (0) b ( ) 0 b b (0) b ( )
Error Models nd Properties Delyed Grnt Model penlizes dely in grnt g/g(0) g/ g(0) g/g(1) g/ (0) g/ (1)
Error Models nd Properties Grnt Efficiency Error Model penlizes spurious grnts g g (1) g (0) 0 g g (0)
Why use quntittive specifictions? Exmple Every request req to be eventully grnted with gr. Φ = G(req = Fgr). 2 Tken from [I. Pill, S. Semprini, R. Cvd, M. Roveri, R. Bloem, nd A. Cimtti. FMCAD 2009] Arjun Rdhkrishn (IST Austri) Synthesis from Quntittive Specifictions Mrch 2014 6 / 13
Why use quntittive specifictions? Exmple Every request req to be eventully grnted with gr. Φ = G(req = Fgr). Additionl desire D 1 : We wnt to minimize spurious grnts 2. D 1 = gr W req G(gr = X( gr W req)). Simple requirement, but complicted to specify. 2 Tken from [I. Pill, S. Semprini, R. Cvd, M. Roveri, R. Bloem, nd A. Cimtti. FMCAD 2009] Arjun Rdhkrishn (IST Austri) Synthesis from Quntittive Specifictions Mrch 2014 6 / 13
Why use quntittive specifictions? Exmple Every request req to be eventully grnted with gr. Φ = G(req = Fgr). Additionl desire D 1 : We wnt to minimize spurious grnts 2. D 1 = gr W req G(gr = X( gr W req)). Simple requirement, but complicted to specify. Chnging requirement Φ to Φ GF (gr) full rewriting of D 1. 2 Tken from [I. Pill, S. Semprini, R. Cvd, M. Roveri, R. Bloem, nd A. Cimtti. FMCAD 2009] Arjun Rdhkrishn (IST Austri) Synthesis from Quntittive Specifictions Mrch 2014 6 / 13
Why use quntittive specifictions? Exmple Every request req to be eventully grnted with gr. Φ = G(req = Fgr). Additionl desire D 1 : We wnt to minimize spurious grnts 2. D 1 = gr W req G(gr = X( gr W req)). Simple requirement, but complicted to specify. Chnging requirement Φ to Φ GF (gr) full rewriting of D 1. Quntittive cse: dd one idel specifiction sying no grnts, nd error model penlizing ech grnt. No chnge is Φ chnges Specifying Wht insted of How 2 Tken from [I. Pill, S. Semprini, R. Cvd, M. Roveri, R. Bloem, nd A. Cimtti. FMCAD 2009] Arjun Rdhkrishn (IST Austri) Synthesis from Quntittive Specifictions Mrch 2014 6 / 13
Composing Requirements Synthesis on the Preto Curve Given specifiction-error model pirs (S i, E i ) nd weights µ i (0, 1), find (ɛ-)optiml implementtion I such tht mx i {µ i d Ei (I, S i )} is minimized.
Composing Requirements Synthesis on the Preto Curve Given specifiction-error model pirs (S i, E i ) nd weights µ i (0, 1), find (ɛ-)optiml implementtion I such tht mx i {µ i d Ei (I, S i )} is minimized. µ 1 = µ 2 S 2 µ 2 I µ 1 S 1
Composing Requirements Synthesis on the Preto Curve Given specifiction-error model pirs (S i, E i ) nd weights µ i (0, 1), find (ɛ-)optiml implementtion I such tht mx i {µ i d Ei (I, S i )} is minimized. µ 1 < µ 2 S 2 µ 2 I µ 1 S 1
Composing Requirements Synthesis on the Preto Curve Given specifiction-error model pirs (S i, E i ) nd weights µ i (0, 1), find (ɛ-)optiml implementtion I such tht mx i {µ i d Ei (I, S i )} is minimized. µ 1 > µ 2 µ 2 S 2 I µ 1 S 1
Composing Requirements Synthesis on the Preto Curve Given specifiction-error model pirs (S i, E i ) nd weights µ i (0, 1), find (ɛ-)optiml implementtion I such tht mx i {µ i d Ei (I, S i )} is minimized. S 2 µ 2 µ 1 S 1 I µ 3 S 3
Composing Requirements Synthesis on the Preto Curve Given specifiction-error model pirs (S i, E i ) nd weights µ i (0, 1), find (ɛ-)optiml implementtion I such tht mx i {µ i d Ei (I, S i )} is minimized. S 2 µ 2 µ 1 S 1 I µ 3 S 3 Solution: I is the (ɛ-)optiml finite memory strtegy in multi-dimensionl men-pyoff gme [K. Chtterjee. 30 minutes go.]
Protocol Trde-offs: Forwrd Error Correcting Codes FECs re protocols for error control in noisy chnnels. Our problem Send 3 bit integers over network Sy one bit-flip during trnsmission. Additionl complexity: Error in the MSB is worse thn n error in LSB.
Protocol Trde-offs: Forwrd Error Correcting Codes FECs re protocols for error control in noisy chnnels. Our problem Send 3 bit integers over network Sy one bit-flip during trnsmission. Additionl complexity: Error in the MSB is worse thn n error in LSB. Two conflicting quntittive requirements: Efficiency: Use lest bndwidth. Idel Specifiction: Only 3 bits trnsferred. Error model: Penlty 1 per dditionl bit.
Protocol Trde-offs: Forwrd Error Correcting Codes FECs re protocols for error control in noisy chnnels. Our problem Send 3 bit integers over network Sy one bit-flip during trnsmission. Additionl complexity: Error in the MSB is worse thn n error in LSB. Two conflicting quntittive requirements: Efficiency: Use lest bndwidth. Idel Specifiction: Only 3 bits trnsferred. Error model: Penlty 1 per dditionl bit. Robustness: Decode the integer right. Idel Specifiction: All bits re decoded properly Error model: Penlty of 4, 2 nd 1 for getting first, second nd third bits wrong.
Protocol Trde-offs: Forwrd Error Correcting Codes FECs re protocols for error control in noisy chnnels. Our problem Send 3 bit integers over network Sy one bit-flip during trnsmission. Additionl complexity: Error in the MSB is worse thn n error in LSB. Two conflicting quntittive requirements: Efficiency: Use lest bndwidth. Idel Specifiction: Only 3 bits trnsferred. Error model: Penlty 1 per dditionl bit. Robustness: Decode the integer right. Idel Specifiction: All bits re decoded properly Error model: Penlty of 4, 2 nd 1 for getting first, second nd third bits wrong. Additionl boolen specifictions for ensuring soundness
Synthesis of FECs: Results Vrying efficiency weight µ eff nd robustness weight µ rob.
Synthesis of FECs: Results Vrying efficiency weight µ eff nd robustness weight µ rob. Cse µrob >>> µ eff. Inefficient, but fully robust.
Synthesis of FECs: Results Vrying efficiency weight µ eff nd robustness weight µ rob. Cse µrob >>> µ eff. Inefficient, but fully robust. Cse µeff >>> µ rob. Fully efficient, but non-robust.
Synthesis of FECs: Results Vrying efficiency weight µ eff nd robustness weight µ rob. Cse µrob >>> µ eff. Inefficient, but fully robust. Cse µeff >>> µ rob. Fully efficient, but non-robust. Cse µ eff µ rob. In-between efficiency, nd gets MSB correct. Domin Generted protocol Correctness gurntee Overhed µ rob >> µ eff Hmming code full error correction 4 bits µ rob << µ eff Plin no error correction 0 bits µ rob µ eff TMR for MSB MSB is correct 2 bits Completely different protocols just by vrying weights. Key properties: Requirements re kept seprte. Bsic functionlity specified exctly. Advnced functionlity through preferences.
Incomptible Specifictions Specifictions rrely monolithic. Designer reconciles multiple requirements. Writes more detiled specifictions resolving corner cses nd contrdictions whole field of requirements engineering nd trcbility
Incomptible Specifictions... Continued Every request req 1 must be immeditely grnted with gr 1. Every request req 2 must be immeditely grnted with gr 2. Grnts gr 1 nd gr 2 cnnot occur t the sme time.
Incomptible Specifictions... Continued Every request req 1 must be immeditely grnted with gr 1. Every request req 2 must be immeditely grnted with gr 2. Grnts gr 1 nd gr 2 cnnot occur t the sme time. Designer resolution = (sy) by lternting between requests. G(r 1 r 2 = (g 1 g 2 )) G(r 1 r 2 g 1 = ( r 1 r 2 g 1 W r 1 r 2 g 2 )) G(r1 r 2 g 2 = ( r 1 r 2 g 2 W r 1 r 2 g 1 )).
Incomptible Specifictions... Continued Every request req 1 must be immeditely grnted with gr 1. Every request req 2 must be immeditely grnted with gr 2. Grnts gr 1 nd gr 2 cnnot occur t the sme time. Designer resolution = (sy) by lternting between requests. G(r 1 r 2 = (g 1 g 2 )) G(r 1 r 2 g 1 = ( r 1 r 2 g 1 W r 1 r 2 g 2 )) G(r1 r 2 g 2 = ( r 1 r 2 g 2 W r 1 r 2 g 1 )). How insted of Wht
Continued... Requirements now entngled. Chnging G(req 1 = gr 1 ) to G(req 1 = (gr 1 Xgr 1 )) Lots of rewriting.
Continued... Requirements now entngled. Chnging G(req 1 = gr 1 ) to G(req 1 = (gr 1 Xgr 1 )) Lots of rewriting. In quntittive cse, dd error models with equl penlties. Cn chnge one independently without chnging nything else.
Continued... Requirements now entngled. Chnging G(req 1 = gr 1 ) to G(req 1 = (gr 1 Xgr 1 )) Lots of rewriting. In quntittive cse, dd error models with equl penlties. Cn chnge one independently without chnging nything else. Chnging request priorities = vry specifiction weights
Conclusion Quntittive specifiction formlism Simultion Distnces Cn led to more compct specifictions specifying functionlity through preferences Synthesis from multiple quntittive specifictions Trde-offs in protocol synthesis Resolving corner-cse incomptibilities