Environment Assumptions for Synthesis

Abstract

The synthesis problem asks to construct a reactive finite-state system from an ω-regular specification. Initial specifications are often unrealizable, which means that there is no system that implements the specification. A common reason for unrealizability is that assumptions on the environment of the system are incomplete. We study the problem of correcting an unrealizable specification ϕ by computing an environment assumption ψ such that the new specification ψ → ϕ is realizable. Our aim is to construct an assumption ψ that constrains only the environment and is as weak as possible. We present a two-step algorithm for computing assumptions. The algorithm operates on the game graph that is used to answer the realizability question. First, we compute a safety assumption that removes a minimal set of environment edges from the graph. Second, we compute a liveness assumption that puts fairness conditions on some of the remaining environment edges. We show that the problem of finding a minimal set of fair edges is computationally hard, and we use probabilistic games to compute a locally minimal fairness assumption.without constraining the inputs. The key idea of our approach is that given a specification, if it is not realizable, cannot be complete and has to be weakened by introducing assumptions on the environment of the system. Formally, given an ω-regular specification ϕ which is not realizable, we compute a condition ψ such that the new specification ψ → ϕ is realizable. Our aim is to construct a condition ψ that does not constrain the system and is as weak as possible. The notion that ψ must constrain only the environment can be captured by requiring that ψ itself is realizable for the environment -i.e., there exists an environment that satisfies ψ without constraining the outputs of the system (in general, in a closed loop around system and environment -or controller and plant-both ψ and ϕ refer to inputs as well as outputs).The notion that ψ be as weak as possible is more difficult to capture. We will show that in certain situations, there is no unique weakest environment-realizable assumption ψ, and in other situations, it is NP-hard to compute such an assumption.Example. During our efforts of formally specifying certain hardware designs [4,5], several unrealizable specifications were produced. One specification was particular difficult to analyze. Its structure can be simplified to the following example. Consider a reactive system with the signals req, cancel, and grant, where grant is the only output signal. The specification requires that (i) every request is eventually granted starting from the next time step, written in linear temporal logic as G(req → X F grant); and (ii) whenever the input cancel is received or grant is high, then grant has to stay low in the next time step, written G((cancel∨grant) → X ¬grant). This specification is not realizable because the environment can force, by sending cancel all the time, that the grant signal has to stay low forever (Part (ii)). If grant has to stay low, t...

Synthesis for Human-in-the-Loop Control Systems

“…end if human operator and an advisory controller, that is monitoring, prescient (with parameter T ), minimally intervening, and conditionally correct. 4 Proof: (Sketch) When ψ is realizable, a fully autonomous controller is synthesized that unconditionally satisfies ψ.…”

“…In the area of assumption mining, Chatterjee et al [4] construct a minimal environment assumption based on removing edges from the game graph to ensure safety assumptions and then compute liveness assumptions to put additional fairness constraints on the remaining edges. Finding this minimal set can be shown to be NP-Hard.…”

Recent Challenges and Ideas in Temporal Synthesis

“…Dually, allowing all possible systems is perhaps not demanding enough. This issue is traditionally approached by adding assumptions on the system and/or the environment, which are modeled as part of the specification (c.f., [11]). …”

Pattern-Based Refinement of Assume-Guarantee Specifications in Reactive Synthesis

“…The problem of refining the environment assumptions is also considered in [5,6]. Synthesizing distributed systems from global specification is a hard problem [7].…”