SOFSEM 2009: Theory and Practice of Computer Science, 35 conf

Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris ...

Author: Mogens Nielsen | Antonin Kucera | Peter Bro Miltersen | Catuscia Palamidessi | Petr Tuma | Frank Valencia

11 downloads 902 Views 11MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen

Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Alfred Kobsa University of California, Irvine, CA, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen University of Dortmund, Germany Madhu Sudan Massachusetts Institute of Technology, MA, USA Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany

5404

Mogens Nielsen Antonín Kuˇcera Peter Bro Miltersen Catuscia Palamidessi Petr T˚uma Frank Valencia (Eds.)

SOFSEM 2009: Theory and Practice of Computer Science 35th Conference on Current Trends in Theory and Practice of Computer Science Špindler˚uv Mlýn, Czech Republic, January 24-30, 2009 Proceedings

13

Volume Editors Mogens Nielsen University of Aarhus, Aarhus Graduate School of Science Ny Munkegade Bldg 1521-110, DK-8000 Aarhus C, Denmark E-mail: [email protected] Antonín Kuˇcera Masaryk University, Faculty of Informatics Botanická 68a, 60200 Brno, Czech Republic E-mail: [email protected] Peter Bro Miltersen University of Aarhus, Department of Computer Science IT-parken, Aabogade 34, DK-8200 Aarhus N, Denmark E-mail: [email protected] Catuscia Palamidessi Frank Valencia Ecole Polytechnique Rue de Saclay, 91128 Palaiseau Cedex, France E-mail: {catuscia,frank.valencia}@lix.polytechnique.fr Petr T˚uma Charles University, Faculty of Mathematics and Physics Malostranské námˇestí 25, 118 00 Prague 1 Malá Strana, Czech Republic E-mail: [email protected] Library of Congress Control Number: Applied for CR Subject Classification (1998): F.2, F.1, D.2, H.3, H.2.8, H.4, F.3-4 LNCS Sublibrary: SL 1 – Theoretical Computer Science and General Issues ISSN ISBN-10 ISBN-13

0302-9743 3-540-95890-8 Springer Berlin Heidelberg New York 978-3-540-95890-1 Springer Berlin Heidelberg New York

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. springer.com © Springer-Verlag Berlin Heidelberg 2009 Printed in Germany Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper SPIN: 12601028 06/3180 543210

A New Analysis of Expected Revenue Combinatorial and Simultaneous Auctions Arne Andersson and Jim Wilenius Computing Science Division Dept. of Information Technology Uppsala University Box 337, SE-75105 Uppsala, Sweden {arnea,jim.wilenius}@it.uu.se

Abstract. We address the fundamental issue of revenue and efficiency in the combinatorial and simultaneous auction using a novel approach. Specifically, upper and lower bounds are constructed for the first-price sealed-bid setting of these two auctions. The question of revenue is important yet very few results can be found in the literature. Only for very small instances with 2 items have comparisons been made. Krishna et al. find that allowing combinatorial bids result in lower revenue compared to a second price simultaneous auction. We formulate a lower bound on the first-price combinatorial auction and an upper bound on the first-price simultaneous auction in a model where bidders have synergies from winning a specific set of items. With these bounds, we can (i) prove that asymptotically as the number of bidders increase, the combinatorial auction will be revenue-superior, and (ii) present a number of concrete examples where combinatorial auctions give higher expected revenue.

1

Introduction

It is a common belief that combinatorial auctions provide good solutions to resource-allocation in multi-commodity markets. The idea is that if a bidder has some synergy from winning a specific combination of items, he should be able to express this with one all-or-nothing bid (commonly combinatorial bid) for the entire combination. With such bids, and with a proper method for winner determination, it seems reasonable that the resulting allocation should be more efficient and give higher revenue to the auctioneer than if such bids were not allowed. However, although these properties seem to be fundamental, no real theoretical evidence with regards to revenue has so far been provided in the literature. In fact, the only known theoretical analysis, for the case of two items for sale [1,2], indicates an opposite result; the combinatorial auction gives a lower revenue. However, the case of two items is very far from most real cases. In the general case, we have many items and bidders, and some bidders have synergies from winning some specific combination(s) of items; for each combination the synergy is realized only when the entire combination is won. M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 1–2, 2009. c Springer-Verlag Berlin Heidelberg 2009

2

A. Andersson and J. Wilenius

Table 1. Bidding scenario where bidders A-C have synergies on specific combinations, and bidder E bids independently on all items Bidders: item 1 item 2 item 3 item 4 item 5 item 6 Value per item: Synergy per item: Total Combination Value:

A B C • • • • • • • • • 0.8 0.5 0.6 1.0 1.0 1.0 5.4 4.5 4.8

E • • • • • • 0.7 -

An example of such a more realistic setting is illustrated in Table 1. In this example, bidders A through C each have an interest in a specific combination of items, and if they win all items in their combination they receive an extra value, a synergy. Bidder E bids on every item but has no synergy, and is indifferent to which items and the number of items he wins. The fundamental question is: if the auctioneer wishes to maximize his revenue, should he allow bids on combinations or not? In this article, we provide some new answers to these questions, by providing novel theoretical analysis of two natural and frequently used protocols: the first-price sealed-bid simultaneous auction and the first-price, sealed-bid combinatorial auction. The use of standard game theoretic tools unfortunately limits analysis to the smallest possible instances. As we will show below, these pitfalls can be avoided by formulating upper and lower bounds on the two auctions instead of deriving equilibrium strategies. This approach requires only the use of standard combinatorics and probability theory. With these bounds, we can (i) prove that asymptotically as the number of bidders increase, the combinatorial auction will be revenue-superior, and (ii) present a number of concrete examples where combinatorial auctions give higher expected revenue. We believe that our result contributes valuable new insights as well as theoretical support for the use of combinatorial auctions.

References 1. Gian, F.G., Albano, L., Lovo, S.: A comparison of standard multi-unit auctions with synergies. Economics Letters 71(1), 55–60 (2001) 2. Krishna, V., Rosenthal, R.W.: Simultaneous auctions with synergies. Games and Economic Behavior 17(1), 1–31 (1996)

Can Component/Service-Based Systems Be Proved Correct? Christian Attiogbé LINA, UMR CNRS 6241, University of Nantes, France [email protected]

Abstract. Component-oriented and service-oriented approaches have gained a strong enthusiasm in industries and academia with a particular interest for service-oriented approaches. A component is a software entity with given functionalities, made available by a provider, and used to build other application within which it is integrated. The service concept and its use in web-based application development have a huge impact on reuse practices. Accordingly a considerable part of software architectures is influenced; these architectures are moving towards service-oriented architectures. Therefore applications (re)use services that are available elsewhere and many applications interact, without knowing each other, using services available via service servers and their published interfaces and functionalities. Industries propose, through various consortium, languages, technologies and standards. More academic works are also undertaken concerning semantics and formalisation of components and service-based systems. We consider here both streams of works in order to raise research concerns that will help in building quality software. Are there new challenging problems with respect to service-based software construction, to service construction, an especially to software verification? Besides, what are the links and the advances compared to distributed systems? A specific emphasis should be put on correctness properties of services and on service-based systems in order to ensure their quality and therefrom the durability of information systems and applications. Therefore an important research issue is to reason on the correctness of software applications that will dynamically use or embed existing services. For example, additionally to the formal specification of its functionalities, a service may embed its specific properties and the certificate/proof that guarantees these properties.

1

Introduction

Component-oriented and service-oriented approaches have gained a strong enthusiasm in industries and academia with a particular interest for service-oriented ones. A component is a software entity with given functionalities, made available by a provider, and used to build other application within which it is integrated. The M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 3–18, 2009. c Springer-Verlag Berlin Heidelberg 2009

4

C. Attiogbé

concept of service as a specific software entity which is delivered upon request via a network is not a new idea; think about telecommunication services, IP network services, etc. A service is a software entity that is designed for a given functionality, is made available through a network via a provider, and is linked and used on demand. An example is a calendar service used within a flight booking application in order to help the user in defining its flight departing and returning dates. The calendar service is a service integrated in the booking application; it may be replaced by another one or may even be disconnected, in which case the user may for example enter manually her/his dates. The service concept and its use in web-based application development have a huge impact on reuse practices. Accordingly a considerable part of software architectures is influenced; these architectures are moving towards service-oriented architectures (SOA). Applications (re)use services that are available elsewhere and several applications interact, without knowing each other, using the services available via service servers and their published interfaces and functionalities. The application designers are confident in the used services and their (unknown) providers; they are also confident in the used communication protocols, even if the services may have misleading semantics. Important issues at this stage are the description, the storage, the management and the retrieval of appropriate services from large certified libraries. Standardisation effort is therefore unavoidable to ensure certification. Software service descriptions take various forms; services are described either inside a software component which role is to provide a computation, or inside a software component which provides several other services as functionalities; services may be described using software components. When an external service is considered within a more general software application, one should think about the meaning of the interaction between the application and the external service and, consequently, the meaning of the application with or without the links with these external services. It is worth mentioning a few key features: service description, service discovery, service interaction, service-oriented applications and their architectures. In [15] Fiadeiro advocates for the emerging of a new discipline concerning software services. Papazoglou and van den Heuvel propose a general panel in [25] of the technology around service-oriented architecture. An accompanying work can be found in [24]. Are there new challenging problems with respect to service-based software construction, to service construction, to software verification? Besides, what are the links and the advances compared to distributed systems? Do the technical proposals meet the industry expectations? what are the current trends and the perspectives of service-oriented approaches? Considering the ubiquitous aspect of large scale distributed applications, the way software services are impacting software construction or the way they are being used or researched requires special care. The standardisation of service description languages constitutes an important step but is not yet sufficient.

Can Component/Service-Based Systems Be Proved Correct?

5

The meaning of services, their constraints and their properties are unavoidable to guarantee the well-functioning of global distributed applications that use them. The main message stressed here, is that there is a real need to think about services and components as software building units that should last several years or decades and that require for this purpose technical specifications and the guarantee of well-functioning. Indeed today Information Systems and Applications, due to the Internet, are inter-penetrated in such a way that failures or defects of some components or services may drastically impact users and their activities in the future. Then, a specific emphasis should be put on correctness properties of services and on service-based systems in order to ensure their quality. An important research issue is to reason on the correctness of software applications that will dynamically use or embed existing services provided by a third party. For example, additionally to the formal specification of its functionalities, a service may embed its specific properties and the certificate or the proof that guarantees these properties. From the methodological point of view, any given ”α-oriented” development method requires a clear description of what α is or supposed to be; therefore helping to differentiate an α-oriented approach from a β-oriented one. An α-oriented approach should make it explicit some concepts, laws, rules, guidance or method to apply it distinctly from β-oriented approach even if an α-oriented approach may be based on β-oriented ones with respect to methodological purpose. From this point of view, it should be clear how to situate service-oriented development relatively to distributed-system development. In the object-oriented approach for example, one considers the encapsulation of data and the methods that manipulate the data as elementary units (classes) which are related through inheritance, extension and client-ship. From this point of view, service-oriented approaches require a clear positioning that is currently disseminated through various existing works. However a systematic view that will favour the emergence of mature seamless development process and integrated tools and also academic courses is recommendable. According to a given business application a software functionality is a specific need which occurs time being, then an access and a link to the corresponding service is achieved on demand. The service should be first identified and the located before being used. A current widely admitted practice of service-based approaches is that services are available somewhere in the Internet; they are accessed on request and a given application may perform, during its execution access to the available services. Therefore it is worth underlying the issue on service correctness and interoperability. All these are challenging concerns. The standardisation of service descriptions including their specifications (interfaces, behaviour and semantics), their properties and their quality is the only way to overcome these challenges. The remaining of this article is structured around four sections. Section 2 is devoted to the introduction of the well-admitted notion of components and services. In Section 3 we deal with the analysis of component or services based

6

C. Attiogbé

systems. Section 4 is devoted to research issues and related directions. Finally in Section 5 we give some concluding remarks.

2 2.1

Components and Services in Software Construction Reuse of Software

The reuse principle has always been present as a fundamental support for software construction. Functions, Modules and Classes have been the concrete entities that enforce reuse. In the same stream, Components and Services follow on, and are just the adaptation of the reuse practices to the environment of software construction. Indeed one may observe the evolution of the reuse entities from the point of view of centralised or decentralised environment. Functions, Modules and Classes are well-adapted to centralised environment. Libraries of these entities are available in situ for the software developers. With the maturity of network technologies and mainly the Internet protocols (via the TCP/IP facilities) the abstraction level of reuse entities changes: Component-based development appears in this context in the 90’s. Clearly as the software technological environment changes, abstraction level of reuse entities changes. Services are now, the most widely highlighted reuse entities. 2.2

Comparing Components and Services

Components are viewed as the abstraction of a part or a subsystem of an application. The notion of component is widely used in many disciplines and industries. For example the Hardware in a computer is made of several linked components (the CPU, input-output devices, storage units, etc). A computer is made of several components that interact at different levels (within the Hardware, the operating system and in the applications). Therefore a component is an independent building block that can be independently integrated in one application or within several applications. In a component-based approach the functionalities of a software are considered completely independent and designed as separate entities (the components) that can be composed afterthought in building a applications. The components can be designed and offered by a tier. Services are software building blocks used in building distributed applications. They are also used to integrate existing functionalities into new applications, or used to make different distributed applications communicate. A service is provided by a service provider and required by a consumer or a service client; it can be dynamically located and invoked. Therefore the network of computers, more specifically the Internet, is the support and the vehicle of services and consequently one of the main characteristics of service-based systems. Web-Services. Web-services are a specific implementation of services; they are now very popular through the industrial offers. They use XML and the Internet TCP/IP popular protocol.


7

According to the W3C1 , A (web)service is a software system designed to support interoperable machine to machine interaction over a network. Components and Services share many commonalities; they are both independent entities used as building blocks in the construction of software applications. They provide interfaces to enable usage and interactions. However, a component is a packaging unit of one or several services; therefore it provides one or several services. A service can be built using components but a service is not necessarily built from components. Services are clearly located at the functionalities abstraction level. Services correspond to offered functionalities. Components are known and assembled in order to enable the usage of services. Components are integrated and compiled within new applications that use them. They become a specific part of the new application. Services are not compiled; they are dynamically linked at runtime within the applications that use them. Sharing aspect also particularise components and services. A priori a component is not shared between applications as the component is integrated within the application. One service may be shared by several clients. However there are variations on components and services that do not fit this distinction, components or their services may also be shared with specifically defined policies. From the service-based approach, interactions are not statically predefined. The services do not know their caller; service clients and the called services are bound upon request where clients behave like if services are always available. 2.3

Service-Based Systems

A service-based system is one that (re)uses services available elsewhere in the Internet to achieve its own functionalities. Note that a service-based system may be partially or totally architectured with components. The components of the system request some functionalities that are described as services outside the system. According to a user, the system is completely independent and autonomous; the user does not see the interactions on the background network. Service-based systems are distributed systems: they are systems made of collection of components (computers, software applications, devices, etc); they are perceived by a user as a single system. Their sub-systems are linked by a network equipped with communication protocols, and cooperate to share resources and to perform their assigned tasks. From the interaction point of view, services are facilities used by software applications to make communicate various sub-systems connected via the Internet in order to achieve given tasks. Compared with classical distributed systems, service-based systems have the main features but are rather impredictible for that their parts may be unknown at a given time. Indeed services are volatile distributed entities; they may be searched, dynamically linked with the rest of the system environment, and unlinked at another moment. Web-Services based applications are service-based systems that use the Internet and its protocols as the distribution platform. They are the widely used specialisation of service-based systems. 1

The World Wide Web Consortium.

8

C. Attiogbé

2.4

Event-Based Style of Interaction

An event-based style of communication is well-adapted to the construction of service-based systems. In an event-based style of interaction, the components of a distributed application communicate via events which are generated by ones components and received by others. This kind of interaction facilitates the decoupling of components. Indeed an event notification system or an event management middleware handles the interaction between the components of the application. The components which are source or target of events are not specific components. Therefore an event-based style favours the integration of heterogeneous components and services in global applications. 2.5

Towards Standards for Service-Oriented Technology

Languages Web-Services Description Language (WSDL). The Web-Services Description Language is one of today de facto standard languages to define any kind of services. It is a markup language based on the XML. It is imposed by the industry. Business Process Execution Language (BPEL). The (Web-Service) Business Process Execution Language2 is an orchestration language for web-services; it is used to describe the interactions between web-services. BPEL can be simply viewed as a language to compose services at abstract or execution levels. Protocols Simple Object Access Protocol (SOAP). The Simple Object Access Protocol is an XML-based protocol to exchange information (or messages) in a distributed environment. It can be used in combination with a variety of other (Internet) protocols such as the HTTP protocol. It is also a protocol from the W3C consortium. Technically, the SOAP consists of three layers: – an external layer that defines a framework for describing message contents and how to process them, – a layer dedicated to data encoding; it describes a set of rules for expressing instances of application data, and – a layer dedicated to the representation convention for remote procedure calls and responses. WSDL is used to describe services based on the SOAP. Universal Description, Discovery and Integration (UDDI). The Universal Description, Discovery and Integration (UDDI) is a protocol over the HTTP protocol used to describe, locate and discover services. Web-Services conform to these standards (WSDL, SOAP, UDDI). 2

www-128.ibm.com/developerworks/library/specification/ws-bpel/


2.6

9

Service-Oriented Approach and Architecture

An architecture involving web-services uses three entities and four relationships between them. The involved entities are: – a service (developer/provider), – a service registry or server (service library), – a client. The relationship are: – Service Registration, a service is registered on a server (service registry); the XML and HTTP protocol are used for that purpose; – Service Discovery: a client looks for a service by consulting a service registry which in turn sends back the located service to the client; the Universal Description, Discovery Integration (UDDI) protocol is used for this purpose. – Service Binding. A client is (dynamically) bound to the discovered service. Here, the Web-Service Description Language (WSDL) is used. – Service Invocation. A client invokes a service to which it is previously bounded. The offered service interacts with its client using the SOAP protocol. Service Oriented Architecture (SOA), originated from SUN company in the 90’s. It is an architectural style to build applications that use the services available on the Internet. The principle is that the services are loosely coupled since they are not originally known but discovered and bind upon demand; by the way, the components of an application are also loosely coupled since the services to link them are used upon demand. The SOA promotes the find, bind, use (services) method. It favours the integration of heterogeneous distributed systems. More details on SOA can be found in [11,12].

3

Formal Analysis of Component/Service-Based Systems

In the previous section we have considered the technologies of services as imposed by industries. Note that, considering problems to be solved, industrial time and delays are different from academic ones. Industrial constraints are also different; they often have to produce solutions with restricted delays. In this section, we consider the academic point of view with respect of software development features, methods and constraints. From this point of view, some stated properties need to be verified for software entities and applications. Verification is still a hard activity that consumes a lot of time and resources (and expertise on formal methods and tools). Ongoing research efforts in the context of service-oriented applications is for example the Sensoria FET European projet[13]. Related works and results on formalisation and semantics of services, reasoning on web-services, and their coordination can be found in [1,9,13,14,17].

10

3.1

C. Attiogbé

Properties to Be Verified

First of all software service construction requires formal specifications in order to permit formal analysis. Expressive specification languages with formal semantics and tools are needed. The range of properties to be verified is very wide. To cite a few: – – – – – – – – – –

availability of service (reliability of servers), functional properties of services, reachability properties related to a given service or a functionality, side-effect functional properties, for example a called service does not take the control forever, correct interaction between a service an its clients; for example, the client is not blocked due to bad interaction with a requested service, correct interaction between the services of an application, heterogeneity and interoperability questions; services may come from various sources and have different semantic models; how do they interact, correctness of message exchange protocols, preservation of time-constraints, · · ·.

There are a real need for component/service models to face specification and verification aspects. 3.2

The Kmelia Model Proposal

We are experimenting on an abstract and formal component model named Kmelia. It is a multi-service component model formally defined [2,5]. In the Kmelia model a component has an interface made of provided services and required services. Services are used as composition units. The provided services have an interface made not only with usage information related to the signatures but also with pre and post conditions in order to ensure at least formal analysis. One strong idea of the model is that the development of component and their services may follow a formal construction (from abstract model to concrete code) in order to enable property verification at different layers. Service Specification. A Kmelia service has the following shape: service <serviceName(parameters)> interface <dependencies with other (sub)services> properties <specific property references> pre post behaviour end


11

A service s of a component C is defined with an interface Is and a (dynamic) behaviour Bs : Is , Bs . Usually a required service does not have the same level of detail as a provided service since a part of these details is already in the (provided) service that calls it. The interface Is of a service s is defined by a 5-tuple σ, P, Q, Vs , Ss where σ is the service signature (name, arguments, result). P is a precondition, Q is a postcondition, Vs is a set of local declarations and the service dependency Ss is a 4-tuple Ss = subs , cals , reqs , ints of disjoint sets where subs (resp. cals , reqs , ints ) contains the provided services names (resp. the services required from the caller, the services required from any component, the internal services) in the s scope. Using a required service r in calp of a service p (as opposed to a component interface) implies r to be provided by the component which calls p. Using a provided service p in the subr of a service r but not in the component interface, means that p is accessible only during an interaction with r. The behaviour Bs of a service s is an extended labelled transition system (eLTS) defined by a 6-tuple S, L, δ, Φ, S0 , SF with S the set of the states of s; L is the set of transition labels and δ is the transition relation (δ ∈ S × L → S). S0 is the initial state (S0 ∈ S), SF is the finite set of final states (SF ⊆ S), Φ is a state annotation function (Φ ∈ S → subs ). An eLTS is obtained when we allow nested states and transitions. This provides a means to reduce the LTS size and a flexible description with optional behaviours which take the form of sub-service names annotating some states. Transitions: The elements ((ss, label), ts) of δ have the concrete Kmelia syntax

ss--label-->ts where the labels are (possibly guarded) combinations of actions: [guard] action*. The actions may be elementary actions or communication

actions. An elementary action (an assignment for example) does not involve other services; it does not use a communication channel. A communication action is either a service call/response or a message communication. Therefore communications are matching pairs: send message(!)-receive message(?), call service(!!)-wait service start(??), emit service result(!!)-wait service result(??). The Kmelia syntax of a communication action (inspired by the Hoare’s CSP) is: channel(!|?|!!|??) message(param*). Channels: A communication channel is established between the interacting services when assembling components. A channel defines a context for the communication actions. At the moment one writes a behaviour, one does not know which components will communicate, but one has to know which channels will be used. A channel is usually named after the required service that represents the context. The placeholder keyword CALLER is a special channel that stands for the channel opened for a service call. From the point of view of a provided service p, CALLER is the channel that is open when p is called. From the point of view of the service that calls p, this channel is named after one of its required service, which is probably named p. The placeholder keyword SELF is a special channel that stands for the channel opened for an internal service call. In this case, the required service is also the provided service.

12

4 4.1

C. Attiogbé

Research Issues for Service-Based Systems The Basic Context

The fundamental context of component or service-based system is that of distributed, asynchronous models. In an asynchronous model a set of processes cooperate to perform a task by exchanging messages over communication support. In some extent the context is that of distributed system with some specificities due to services such as volatility, discovery and dynamic binding. Service-based may be studied as distributed ones [8]. Correctness of component or service-based systems should be studied in this context. The good news are that distributed systems have been well researched, the bad news are that there are still challenging problems that are now exacerbated by the popularisation of web-services and applications. Numerous works have embraced formal verification of concurrent (distributed) systems [10,20,29,30]. The work in [19] focus for example on hardware but with asynchronous mode. In [26,27] the authors use the π-calculi to reason about services and systems. These are works that can support rigorous analysis of service-oriented systems. 4.2

Service Construction

First of all, as a service is a software entity that implements a given functionality, its construction should follows the development lifecycle of any software entity. It may be constructed by refinement from an abstract and formal model. However the specificities of distributed environment and particularly those of services may be taken into consideration: An event-based modelling for example is well-adapted to asynchronous systems. According to service features, the good abstraction level that favours reuse, the appropriate interface for service description and the specific characteristics of the current service should be the parameters of the service construction. The extension of service standard languages such as WSDL and BPEL is proposed. WSDL may integrate property description features in order to embed the properties inside the service interfaces. The extension may be good at addressing required working conditions description, functional and non-functional properties description and, interaction properties to make them easier. According to BPEL, the needed extensions may enable an easy checking of composition after extracting/discovering the interaction features. Also an eventbased interaction may facilitate loose composition. There is a need of expressive formally defined languages an tools. 4.3

Service Composition

As service-based systems are basically distributed systems, the classical problems studied in the scope of distributed systems should be considered again. The composition of services to build larger applications may cause deadlocks, access conflict to shared resources, race conditions, starvation, etc.


13

Moreover, as services should be discovered before being used, planning the composition of services is a challenging question. To find the right services to be composed is a challenging issue that raises again the question of specification matching. Indeed one has to search for a service (which is unknown) with given criteria. The (partial) specification of the needed service is one of these criteria. The desired properties of the searched service are also candidates for the searching criteria. The searching activities are then becoming very tedious. Today searching systems are based on a database of published services which are known and explored by clients which retrieve the needed services. Correctness of service-based systems requires the proof of global properties by considering hypothesis on the future services that will be found and bound. That means, an analysis of a global system may be performed by considering assumptions on what the required services will be. Therefore, it remains to check that the concrete services satisfy the assumptions. As far as service composition is concerned, the interconnection between services may be loose since service-based systems have dynamically evolving architecture; this can be modelled and analysed using event-based approaches [3,4]. The extension of the languages like BPEL is a pragmatic way to undertake the process of improving service composition. An extension enabling one to check the ordering of events and also the temporal properties of service interaction is of real interest. 4.4

Service Certification

In order to ensure the quality of a published service which is devoted to be used in building quality software, the certification of the service quality is required. This may be achieved with respect to desired, functional and non-functional properties. A service may be certified as fulfilling given properties. That means the service implementation satisfies its formal specification that states its goals and properties. This is the standard correctness issue required for software entities or applications. However for the convenience of service context, we propose that the services embed their properties so that they can be verified by a third party entities, checked or considered for the integration of the services in other environments. Property-carrying services are therefore a solution towards the insurance of quality. A service may at least incorporate its functional specification, the properties that it guaranties and the properties that it assumes for a good functioning. The client of a provided service which carries its properties may be confident to the provided service. Consequently an application that integrates several services can coordinate and manage the properties required by ones and provided by others. From this setting, reasoning on the entire system my be undertaken. It is not straightforward to establish the correctness in this context of the composition of asynchronous (sub)systems. Works on Assume/Guarantee [16,18,22,31] may be beneficially reused in the component or service-based systems.

14

C. Attiogbé

A service should also be certified by a certifier according to the features it has declared. That means the certifier checks the properties embedded in the service and in case of success certifies the service. But the certifier should in turn be a sure one. This matter may be managed by considering well-known provers, efficient proof-checkers and specialised proof centers with experts that perform the proof on demand for the certification purpose. Therefore only the certificates coming from the adopted proof centers may be the confident ones. We develop this idea of property-carrying services from the works on Proof-Carrying Code originally elaborated by Necula [21]. 4.5

Service-Based Application and Maintenance

Service registries may change; services also may change due to upgrades and evolution. Therefore clients of registries may be aware of the modifications and should be able to discover incompatibilities if there are any. How one can be sure that a new version of a service is still correct with its initial objectives. Here again, the certification approach may be used. A service of a system may be replaced by another one without breaking the initial objectives of the system. The formal analysis with respect to hypothesis on services should greatly help in doing this. Service registries should be efficient and adaptable to any form of service descriptions. They should offer the best retrieval features and reasonable response time. Results from database management systems should be exploited. An important research direction is that of substitutability between services or components. A service could be replaced by another one without breaking the chain of functionalities. The service binding should be elaborated to permit such changes. Again, services equipped with properties and certificates will favour this practice. 4.6

Interoperability of Service-Based Systems

Abstraction is a cornerstone for interoperability. When various systems are based on the same abstract view of the used entities and use predefined rules to exchange and reason about entities of interest, ensuring interoperability becomes easier. Consider for example the well-known Open System Interconnection model of the ISO; it is the reference model that ensures the interoperability between network protocols, operating systems and applications. Rules are defined at different levels of the model, and standards are defined and respected by developers of devices, protocols and software. Few examples are the widely used Transport Control Protocol (TCP), Simple Mail Transfer Protocol (SMTP) or Hyper Text Transfer Protocol (HTTP). The notions of services and service servers are already present there. Each network service is clearly and uniformly identified by a number that is used by all its clients. When a server is active, its clients requests and accesses the desired services by using the predefined usage manual of this service. According to service-based systems, exploiting the know-how in the networking, the experiment, methods and techniques of programming distributed system


15

are the main ingredients to ensure quality. Practically, a multi-layered eventbased design and development approach is recommended. 4.7

Reliability

Correctness of services as software entities are not sufficient for reliability. For a service-based system to be reliable, its environment should be taken into account: global correctness, i.e. system level correctness should be considered. The availability of network level services is then an important parameter of the reliability. Permanent availability and good functioning of all the components of the global system is required; obviously this cannot be stated and systematically proved but assumptions may be made to ensure the acceptable reliability according to the considered application. For example, failures of some components may be acceptable, provided that the global system continues to offer a part of its functionalities or to offer its functionalities with more delays. How to check or detect failures of components/services of the system at hand? When a fixed number of interacting entities is considered, failure can be detected by considering the monitoring of the entities. In case of service-based systems which evolve dynamically as entities are found and bound and unbound, the monitoring is not straightforward. Hence a challenging issue. Works on dynamically evolving systems, considering group membership and distributed middleware systems may be beneficially used here. Ensemble [6,7] for example is a well-researched system that can be used for service-based systems. The QuickSilver3 [23] system is also a candidate to ensuring or studying reliability of web-service based systems. We also advocate for a server of service servers in order to facilitate access and updates. Indeed for a client of services, instead of looking for several service registries for example, it may always contact only one server of the registries which in turn redirects the requests or accesses to the right registries. It will be the role of the server of registries to manage and maintain up-to-date the information concerning the registries. This approach is more flexible and efficient than the former where the clients should know and maintain their information about several registries. 4.8

Security

Several problems and solutions have been studied with respect to Internet network applications. As service-based systems is based on this support, the same problems impact these systems and the adopted solutions are also available. Service registries need specific care as they should be continuously available. Technically a cluster of registries may fulfill the objectives. For example, false service registries may be avoided by considering friend service registries. Inaccurate service publishing may be avoided by considering well authenticated service publishers. 3

QuickSilver Scalable Multicast project website at Cornell: www.cs.cornell.edu/projects/quicksilver/QSM/

16

5

C. Attiogbé

Concluding Remarks

The dissemination of software services through information systems and applications require now and quickly components and services of high quality. Providing verifiable correct services is one solution but it is only partial; more generally, the reliability of component or service-based systems is the true challenge. It goes beyond the components and services correctness; it deals with the environment of the used services, components and developed applications. Layers of properties and correctness proofs are required (services, service registries, components, client applications, certifiers, etc). To follow the objectives of correctness and reliability, it is worth considering the integration of correctness threats in the design and the development of the building blocks which are services. Current languages and techniques can be extended in this direction and they may also exploit existing results on formal analysis of concurrent distributed systems. We have indicated some research issues and work directions. The magnitude of the task is important. But there are already a considerable amount of foundation works that can be beneficially exploited. Results in the field of distributed asynchronous systems modelling and verification are of main interest. Works on property-carrying services certification will provide interesting assessments according to quality. However, efficient property verification techniques, tools and verification centers will be a major part of the effort. Language expressiveness and appropriate modelling techniques, based on specific domains, will help to manage verification complexity, by defining repeatable proof scenario that will accelerate verification and diminish analysis and development cost. Last, efficient simulation environments will be of great help in tuning service construction and service-based applications construction.

References 1. Abreu, J., Bocchi, L., Fiadeiro, J.L., Lopes, A.: Specifying and composing interaction protocols for service-oriented system modelling. In: Derrick, J., Vain, J. (eds.) FORTE 2007. LNCS, vol. 4574, pp. 358–373. Springer, Heidelberg (2007) 2. André, P., Ardourel, G., Attiogbé, C.: Composing Components with Shared Ser´ (eds.) SC 2008. LNCS, vices in the Kmelia Model. In: Pautasso, C., Tanter, E. vol. 4954, pp. 125–140. Springer, Heidelberg (2008) 3. Attiogbé, C.: Multi-process Systems Analysis using Event B: Application to Group Communication Systems. In: Liu, Z., He, J. (eds.) ICFEM 2006. LNCS, vol. 4260, pp. 660–677. Springer, Heidelberg (2006) 4. Attiogbé, C.: Event-Based Approach to Modeling Dynamic Architecture: Application to Mobile Adhoc Network. In: Margaria, T., Steffen, B. (eds.) ISOLA 2008. CCIS, vol. 17, pp. 769–781 (2008) 5. Attiogbé, C., André, P., Ardourel, G.: Checking Component Composability. In: L¨ owe, W., S¨ udholt, M. (eds.) SC 2006. LNCS, vol. 4089, pp. 18–33. Springer, Heidelberg (2006) 6. Birman, K., Hillman, R., Pleisch, S.: Building Network-centric Military Applications over Service Oriented Architectures. In: SPIE Defense and Security Symposium 2005 (2005)


17

7. Birman, K.P., Chen, J., Hopkinson, K.M., Thomas, R.J., Thorp, J.S., van Renesse, R., Vogels, W.: Overcoming Communications Challenges in Software for Monitoring and Controlling Power Systems. Proceedings of the IEEE 9 (2005) 8. Birman, K.P.: Like it or not, Web Services are Distributed Objects! Comm. of the ACM, Viewpoints Column (2004) 9. Bocchi, L., Hong, Y., Lopes, A., Fiadeiro, J.: From BPEL to SRML: a Formal Transformational Approach. In: Dumas, M., Heckel, R. (eds.) WS-FM 2007. LNCS, vol. 4937, pp. 92–107. Springer, Heidelberg (2008) 10. Chockler, H., Farchi, E., Glazberg, Z., Godlin, B., Nir-Buchbinder, Y., Rabinovitz, I.: Formal Verification of Concurrent Software: two Case Studies. In: Ur, Farchi (eds.) [28], pp. 11–22. 11. Pulier, H.T.E. (ed.): Understanding Enterprise SOA. Wiley India Pvt. ltd., Chichester (2006) 12. Erl, T. (ed.): Service Oriented Architecture Concepts Technology and Desgin. Prentice-Hall, Englewood Cliffs (2005) 13. Fiadeiro, J.L., Lopes, A., Bocchi, L.: A formal approach to service-oriented architecture. In: Bravetti, M., N´ un ˜ ez, M., Zavattaro, G. (eds.) WS-FM 2006. LNCS, vol. 4184, pp. 193–213. Springer, Heidelberg (2006) 14. Fiadeiro, J.L., Lopes, A., Bocchi, L.: Algebraic Semantics of Service Component Modules. In: Fiadeiro, J.L., Schobbens, P.-Y. (eds.) WADT 2006. LNCS, vol. 4409, pp. 37–55. Springer, Heidelberg (2007) 15. Fiadeiro, J.L.: Software services: Scientific challenge or industrial hype? In: Liu, Z., Araki, K. (eds.) ICTAC 2004. LNCS, vol. 3407, pp. 1–13. Springer, Heidelberg (2005) 16. Giannakopoulou, D., Pasareanu, C.S., Cobleigh, J.M.: Assume-guarantee Verification of Source Code with Design-level Assumptions. In: International Conference on Software Engineering (ICSE 2004), pp. 211–220 (2004) 17. Abreu, J., Fiadeiro, J.: A Coordination Model for Service-oriented Interactions. In: Lea, D., Zavattaro, G. (eds.) COORDINATION 2008. LNCS, vol. 5052, pp. 1–16. Springer, Heidelberg (2008) 18. Mooij, A.J., Wesselink, J.W.: A Formal Analysis of a Dynamic Distributed Spanning Tree Algorithm. Technical Report No. 03-16, Technische Universiteit Eindhoven (2003) 19. Morin-Allory, K., Fesquet, L., Borrione, D.: Asynchronous Assertion Monitors for multi-Clock Domain System Verification. In: IEEE International Workshop on Rapid System Prototyping, pp. 98–102 (2006) 20. M¨ uhl, G., Fiege, L., Pietzuch, P.R.: Distributed Event-Based Systems. Springer, Heidelberg (2006) 21. Necula, G.C.: Proof-Carrying Code. In: 24th ACM Symposium on Principles of Programming Languages (POPL 1997) (1997) 22. Nipkow, T., Nieto, L.P.: Owicki/Gries in isabelle/HOL. In: Finance, J.-P. (ed.) FASE 1999. LNCS, vol. 1577, pp. 188–203. Springer, Heidelberg (1999) 23. Ostrowski, K., Birman, K.P.: Scalable Group Communication System for Scalable Trust. In: STC 2006: Proceedings of the first ACM workshop on Scalable trusted computing, pp. 3–6. ACM Press, New York (2006) 24. Papazoglou, M.P., Traverso, P., Dustdar, S., Leymann, F.: Service-Oriented Computing: a Research Roadmap. Cooperative Inf. Syst. 17(2), 223–255 (2008) 25. Papazoglou, M.P., van den Heuvel, W.-J.: Service Oriented Architectures: Approaches, Technologies and Research Issues. VLDB 16(3), 389–415 (2007)

18

C. Attiogbé

26. Rychl´ y, M.: Towards Verification of Systems of Asynchronous Concurrent Processes. In: Proceedings of 9th International Conference ISIM 2006, pp. 123–130 (2006) 27. Rychl´ y, M.: Behavioural Modeling of Services: from Service-Oriented Architecture to Component-Based System. In: Software Engineering Techniques in Progress, pp. 13–27. Wroclaw University of Technology (2008) 28. Ur, S., Farchi, E. (eds.): Proceedings of the 4th Workshop on Parallel and Distributed Systems: Testing, Analysis, and Debugging, held in conjunction with the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2006), PADTAD 2006. ACM, New York (2006) 29. Wesselink, J.W., Romijn, J.M.T., Mooij, A.J.: Assertion-based Proof Checking of Chang-Roberts Leader Election in PVS. In: Namjoshi, K.S., Yoneda, T., Higashino, T., Okamura, Y. (eds.) ATVA 2007. LNCS, vol. 4762, pp. 341–361. Springer, Heidelberg (2007) 30. Wojcicki, M.A., Strooper, P.A.: A state-of-practice Questionnaire on Verification and Validation for Concurrent Programs. In: Ur, Farchi (eds.) [28], pp. 1–10. 31. Xu, Q., Swarup, M.: Compositional Reasoning Using the Assumption-Commitment Paradigm. In: de Roever, W.-P., Langmaack, H., Pnueli, A. (eds.) COMPOS 1997. LNCS, vol. 1536, pp. 565–583. Springer, Heidelberg (1998)

Probabilistic Acceptors for Languages over Infinite Words Christel Baier1 , Nathalie Bertrand2 , and Marcus Größer1 1

Technical University Dresden, Faculty Computer Science, Germany 2 INRIA Rennes Bretagne Atlantique, France

Abstract. Probabilistic ω-automata are variants of nondeterministic automata for infinite words where all choices are resolved by probabilistic distributions. Acceptance of an infinite input word requires that the probability for the accepting runs is positive. In this paper, we provide a summary of the fundamental properties of probabilistic ω-automata concerning expressiveness, efficiency, compositionality and decision problems.

While classical finite automata can serve to recognize languages over finite words or tree-like structures, ω-automata are acceptors for languages consisting of infinite objects. ω-automata play a central role for verification purposes, reasoning about infinite games and logics that specify nondeterministic behaviors. Many variants of ω-automata have been studied in the literature that can be classified according to their inputs (e.g., words or trees), their acceptance conditions (e.g., Büchi, Rabin, Streett, Muller or parity acceptance) and their semantics of the branching structure (e.g., deterministic, nondeterministic, or alternating). See, e.g., [Tho97, GTW02] for an overview of automata over infinite objects. In this paper, we study probabilistic variants of ω-automata for languages over infinite words. Although probabilistic finite automata (PFA) have attracted many researchers, see e.g. [Rab63, Paz66, Fre81, MHC03, DS90, BC03], probabilistic language acceptors for infinite words just have recently been studied. The formal definition of probabilistic ω-automata is roughly the same as for nondeterministic ω-automata, except that all choices are resolved by probabilistic distributions. Acceptance of an infinite word σ = a1 a2 a3 . . . requires that the generated sample run for σ (i.e., sequence of states that are passed in the automaton while reading σ letter by letter) meets the acceptance condition with positive probability. For instance, in the case of a probabilistic Büchi automaton (PBA), certain states are declared to be accepting and the acceptance condition requires to visit some accepting state infinitely often with positive probability. As this definition of the accepted language via the criterion “the probability for the accepting runs is > 0” appears to be the natural adaption of the definition of the accepted language of a nondeterministic automaton which relies on the criterion “there is at least one accepting run”, one might expect that probabilistic and nondeterministic ω-automata are rather close and enjoy similar properties. This, however, is not the case. The first surprising result is that PBA are more expressive than nondeterministic Büchi automata (NBA). Second, concerning the sizes of smallest automata for a given language, probabilistic and nondeterministic ω-automata are not comparable. That is, M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 19–33, 2009. c Springer-Verlag Berlin Heidelberg 2009

20

C. Baier, N. Bertrand, and M. Größer

there are languages that can be accepted by PBA of polynomial size, while all NBA for these languages have at least exponentially many states, and vice versa. Another interesting observation is that in the probabilistic setting the Büchi condition is somehow more powerful than in the nondeterministic case, as there exists a polynomial transformation from PBA to probabilistic automata with Streett acceptance. This is known to be impossible in the nondeterministic case [SV89]. On the other hand, the price we have to pay for this extra power of PBA is that we lose decidability of algorithmic problems, such as the emptiness, universality or equivalence problem. The undecidability results for PBA have several important consequences. First, the concept of PBA is not adequate for solving algorithmic problems that are related to the emptiness or universality problems. This, e.g., applies to the verification of nondeterministic systems against PBA-specifications. Second, PBA can be viewed as a special instance of partially-observable Markov decision processes (POMDPs) which are widely used in various areas, including robotics and stochastic planning (see, e.g., [Son71, PT87, Lov91]) and the negative results established for PBA yield the undecidability of various verification problems for POMDPs. Organization. Section 1 recalls the definition of nondeterministic ω-automata with Büchi, Rabin or Streett acceptance conditions and introduces their probabilistic variants. Results on the expressiveness and efficiency of probabilistic Büchi, Rabin and Streett automata are summarized in Section 2. Composition operators for PBA are addressed in Section 3. Decision problems for PBA and the relation to POMDPs will be discussed in Section 4. Finally, Section 5 contains some concluding remarks. The material of this paper is a summary of the results presented in the papers [BG05, BBG08]. Further details can be found there and in the thesis by Marcus Größer [Grö08].

1 From Nondeterministic to Probabilistic ω-Automata We assume some familarity with classical nondeterministic automata over finite or infinite words; see e.g. [Tho97, GTW02]. We just recall some basic concepts of nondeterministic ω-automata. Later we will adapt these concepts to the probabilistic setting. Definition 1 (Nondeterministic ω-automata). A nondeterministic ω-automaton is a tuple N = (Q, Σ, δ, Q0 , Acc), where – Q is a finite nonempty set of states, – Σ is a finite nonempty input alphabet, – δ : Q × Σ → 2Q is a transition function that assigns to each state q and letter a ∈ Σ a (possibly empty) set δ(q, a) of states, – Q0 ⊆ Q is the set of initial states, – Acc is an acceptance condition (which will be explained later).

N is called deterministic if |Q0 | = 1 and |δ(q, a)| = 1 for all q ∈ Q and a ∈ Σ. The intuitive operational behavior of a nondeterministic ω-automaton N for some infinite input word σ = a1 a2 a3 . . . ∈ Σω is as follows. The automaton selects nondeterministically an initial state q0 ∈ Q0 . Then, it attempts to read the first letter a1 in

Probabilistic Acceptors for Languages over Infinite Words

21

/ then the austate q0 . If q0 does not have an outgoing a1 -transition (i.e., δ(q0 , a1 ) = 0) tomaton rejects. Otherwise, the automaton reads the first letter a1 and moves to some a1 -successor q1 of q0 (i.e., some state q1 ∈ δ(q0 , a1 )) and attempts to read the remaining / Otherwise word a2 a3 . . . from state q1 . That is, the automaton rejects if δ(q1 , a2 ) = 0. the automaton reads letter a2 and moves to some state q2 ∈ δ(q1 , a2 ) which is chosen nondeterministically, and so on. Any maximal state-sequence π = q0 q1 q2 . . . that can be obtained in this way is called a run for σ. We write inf(π) for the set of states p ∈ Q such that p = qi for infinitely many indices i ≥ 0. Each finite run q0 q1 . . . qi (where N fails to read letter ai+1 in the last state qi because δ(qi , ai+1 ) is empty) is said to be rejecting. The acceptance condition Acc imposes a condition on infinite runs and declares which of the infinite runs are accepting. Several acceptance conditions are known for nondeterministic ω-automata. We will consider three types of acceptance conditions: Büchi: A Büchi acceptance condition Acc is a subset F of Q. The elements in F are called final or accepting states. An infinite run π = q0 q1 q2 . . . is called (Büchi) / accepting if π visits F infinitely often, i.e., inf(π) ∩ F = 0. Streett: A Streett acceptance condition Acc is a finite set of pairs (Hl , Kl ) consisting of subsets Hl , Kl of Q, i.e., Acc = {(H1 , K1 ), . . . , (H , K )}. An infinite run π = q0 q1 q2 . . . is called (Streett) accepting if for each l ∈ {1, . . . , } we have: / inf(π) ∩ Hl = 0/ or inf(π) ∩ Kl = 0. Rabin: A Rabin acceptance condition Acc is syntactically the same as a Streett acceptance condition, i.e., a finite set Acc = {(H1 , K1 ), . . . , (H , K )} where Hl , Kl ⊆ Q for 1 ≤ l ≤ . An infinite run π = q0 q1 q2 . . . is called (Rabin) accepting if there is some l ∈ {1, . . ., } such that / inf(π) ∩ Hl = 0/ and inf(π) ∩ Kl = 0. Note that the semantics of Streett and Rabin acceptance conditions are duals of each other, i.e., for each infinite run π we have: π is accepting according to the Rabin condition Acc iff π is rejecting (i.e., not accepting) according to the Streett condition Acc. Furthermore, a Büchi acceptance condition F can be viewed as a special case of a Streett and Rabin condition with a single acceptance pair, namely {(F, Q)} for the Streett con/ F)} for the Rabin condition. dition and {(0, The accepted language of a nondeterministic ω-automaton N with the alphabet Σ, denoted L (N ), is defined as the set of infinite words σ ∈ Σω that have at least one accepting run in N . L (N ) = σ ∈ Σω : there exists an accepting run for σ in N In what follows, we write NBA to denote a nondeterministic Büchi automaton, NRA for nondeterministic Rabin automata and NSA for nondeterministic Streett automata. Similarly, the notations DBA, DRA and DSA are used to denote deterministic ω-automata with a Büchi, Rabin or Streett acceptance condition.

22


It is well-known that the classes of languages that can be accepted by NBA, DRA, NRA, DSA or NSA are the same. These languages are often called ω-regular and represented by ω-regular expressions, i.e., finite sums of expressions of the form α.βω where α and β are ordinary regular expressions (representing regular languages over finite words) and the language associated with β is nonempty and does not contain the empty word. In the sequel, we will identify ω-regular expressions with the induced ω-regular language. While deterministic ω-automata with Rabin and Streett acceptance (DRA and DSA) cover the full class of ω-regular languages, DBA are less powerful as, e.g., the language (a + b)∗ aω cannot be recognized by a DBA. Hence, the class of DBA-recognizable languages is a proper subclass of the class of ω-regular languages. Probabilistic ω-automata can be viewed as nondeterministic ω-automata where all nondeterministic choices are resolved probabilistically. That is, for any state p and letter a ∈ Σ either p does not have any a-successor or there is a probability distribution for the a-successors of p. Definition 2 (Probabilistic ω-automata). A probabilistic ω-automaton is a tuple P = (Q, Σ, δ, µ0 , Acc), where – Q is a finite nonempty set of states, – Σ is a finite nonempty input alphabet, – δ : Q × Σ × Q → [0, 1] is a transition probability function such that for all p ∈ Q and a ∈ Σ either ∑q∈Q δ(p, a, q) = 1 or δ(p, a, .) is the null-function (i.e. δ(p, a, q) = 0 for all q ∈ Q), – µ0 is the initial distribution, i.e., a function µ0 : Q → [0, 1] such that ∑q∈Q µ0 (q) = 1, – Acc is an acceptance condition (as for nondeterministic ω-automata). We refer to the states q0 ∈ Q where µ0 (q0 ) > 0 as initial states. If p is a state such that δ(q, a, p) > 0 then we say that q has an outgoing a-transition to state p. Acceptance conditions can be defined as in the nondeterministic case. In this paper, we just regard Büchi, Rabin and Streett acceptance and use the abbreviations PBA, PRA and PSA for probabilistic Büchi automata, probabilistic Rabin automata, and probabilistic Streett automata, respectively. The intuitive operational behavior of a probabilistic ω-automaton P for a given input word σ = a1 a2 . . . ∈ Σω is similar to the nondeterministic setting, except that the nondeterminism is resolved internally by the probabilistic distributions µ0 in the initial configuration and δ(q, a, ·) if the current state is q and the next letter to consume is a. That is, initially P chooses at random an initial state p0 according to the initial distribution µ0 . If P has consumed the first i input symbols a1 , . . . , ai and the current state is pi then P moves with probability δ(pi , ai+1 , p) to state p and tries to read the next input symbol ai+2 in state p = pi+1 . If there is no outgoing ai+1 -transition from the current state pi , then P rejects. As in the nondeterministic case, the resulting state-sequence π = p0 p1 p2 . . . ∈ Q∗ ∪ Qω is called a run for σ in P . If P rejects in state pi , i.e., δ(pi , ai+1 , ·) is the null function, then the obtained run is finite (and ends in state pi ). If the automaton never rejects while reading the letters ai of the input word σ = a1 a2 a3 . . . ∈ Σω , the generated


23

run is an infinite state-sequence π = p0 p1 p2 . . . ∈ Qω . Acceptance of a run according to a Büchi, Rabin or Streett acceptance condition is defined as in the nondeterministic setting. Semantics of probabilistic ω-automata. While acceptance of an infinite word in a nondeterministic ω-automata requires the existence of an accepting run, a probabilistic ωautomaton accepts an infinite input word σ if the acceptance probability PrP (σ) is > 0. The formal definition of the acceptance probability relies on the view of an input word σ ∈ Σω as a scheduler when P is treated as a Markov decision process, i.e., an operational model for a probabilistic system where in each state q the letters that can be consumed in q are treated as actions that are enabled in q. Given a word/scheduler σ = a1 a2 a3 . . . ∈ Σω , the behavior of P under σ is given by a Markov chain Mσ where the states are pairs (q, i) where q ∈ Q stands for the current state and i is a natural number ≥ 1 that denotes the current word position. Stated differently, state (q, i) in the Markov chain Mσ stands for the configuration that P might have reached after having consumed the first i−1 letters a1 , . . . , ai−1 of the input word σ. Assuming that δ(q, ai+1 , ·) is not the null function, the transition probabilities from state (q, i) are given by the distribution δ(q, ai+1 , ·), i.e., from state (q, i) the Markov chain Mσ moves with probability δ(q, ai+1 , p) to state (p, i + 1). In case that δ(q, ai+1 , ·) = 0 then (q, i) is an absorbing state, i.e., a state without any outgoing transition. The runs for σ in P correspond to the paths in Mσ . We can now apply the standard concepts for Markov chains to reason about the probabilities of infinite paths and define the acceptance probability for the infinite word σ in P , denoted PrP (σ) or briefly Pr(σ), as the probability measure of the accepting runs for σ in the Markov chain Mσ . The formal definition of the accepted language of P is L (P ) = σ ∈ Σω : PrP (σ) > 0 Sometimes we will add the subscript “Büchi”, “Streett’ or “Rabin” to make clear which type of acceptance condition is assumed and write LBüchi (P ), LRabin (P ) or LStreett (P ), respectively. Example 1 (Probabilistic Büchi automata). Let us have a look at a few examples of probabilistic ω-automata. In the pictures, if δ(q, a, ·) = 0 then the probability δ(q, a, p) is attached to the a-transition from q to p. If δ(q, a, p) = 1 then the edge is simply labeled with a. Similarly, if there is a single initial state q0 (i.e., µ0 (q0 ) = 1, while µ0 (q) = 0 for all other states q) we simply depict an incoming arrow to q0 . For PBA, we depict the accepting states (i.e., the states q ∈ F) by squares, non-accepting states by circles. Consider the PBA P over the alphabet Σ = {a, b} in the left part of Figure 1. State q0 is initial, while state q1 is accepting. More precisely, the initial distribution is given by µ0 (q0 ) = 1 and µ0 (q1 ) = 0, while the Büchi acceptance condition is given by the singleton F = {q1 }. The accepted language L (P ) = LBüchi (P ) is (a + b)∗aω . If we feed P with an infinite input word σ ∈ (a + b)∗ aω , then P stays with positive probability in the initial state q0 until the last b in σ has been read. From then on, P moves almost surely to the accepting state q1 and stays there forever when reading the infinite suffix aω . Thus, the acceptance probability for all words in (a + b)∗aω is positive. This yields that (a + b)∗ aω ⊆ L (P ).

24


p0 a, 12

q0

a

a, 12 b PBA P for (a + b)∗ aω

b, c

b

q1

a, 12

a, 12

p1

p2 PBA P for (ab + ac)∗ (ab)ω

Fig. 1. Examples for PBA P (left) and P (right)

It remains to show that L (P ) is contained in (a + b)∗ aω . In fact, all words in L (P ) contain only finitely many b’s because only state q1 is accepting and only letter a can be read in state q1 . Hence, each accepted word σ ∈ L (P ) must have the suffix aω . For another example, regard the PBA P over the alphabet Σ = {a, b, c} shown in the right part of Figure 1. Let us first observe that the underlying nondeterministic Büchi automaton (NBA) that we obtain by ignoring the probabilities has an accepting run for each infinite word in (ab + ac)ω with infinitely many b’s, no matter whether there are only finitely ω c’s or infinitely many c’s. Thus, the accepted language of the NBA is (ac)∗ ab . This language is different from the accepted language of the PBA P which is L (P ) = (ab + ac)∗(ab)ω . Given an input word σ ∈ (ab + ac)∗ (ab)ω , say σ = x(ab)ω where x ∈ (ab + ac)∗ , then with positive probability P generates the run fragment p0 p2 p0 p2 . . . p0 p2 p0 when reading x. For the remaining suffix (ab)ω , P can always consume the next letter and almost surely P will visit p1 and p2 infinitely often. This yields PrP (σ) > 0 and σ ∈ L (P ). Vice versa, we have to show that L (P ) is a subset of (ab + ac)∗ (ab)ω . It is obvious that all accepted words σ ∈ L (P ) belong to ((ac)∗ ab)ω .3 The intuitive argument why any word σ in (ab + ac)ω with infinitely many c’s is rejected by P relies on the observation that almost all runs for σ are finite and end in state p1 , where the next input symbol is c and cannot be consumed in state p1 . (The formulation “almost all runs have property X” means that the probability measure of the runs where property X does not hold is 0.) Note that each DBA can be viewed as a PBA (we just have to assign probability 1 to all edges in the DBA and deal with the initial distribution that assigns probability 1 to the unique initial state). As shown in Example 1 there is a PBA for the language (a + b)∗ aω which cannot be accepted by DBA. As a consequence we obtain that the class of DBArecognizable languages is a proper subclass of the class of languages L (P ) for some PBA P . 3

In fact, for each PBA P all words in L (P ) have at least one accepting run. Thus, L (P ) is always contained in the accepted language of the NBA that results by ignoring the transition probabilities.


p0 a, 12 a, c

p1

25

b, c a, 12 a, b, c

b

p2

Fig. 2. PSA PS with acceptance condition Acc = {({p2 }, {p1 })}

Example 2 (Probabilistic Streett automaton). The PSA PS shown in Figure 2 accepts the language of all infinite words σ over Σ = {a, b, c} such that either σ contains only finitely many a’s or σ contains infinitely many b’s (or both). That is,

LStreett (PS ) = (a + b + c)∗(b + c)ω + ((a + b + c)∗b)ω . Note that each word in (a + b + c)∗(b + c)ω has an accepting run π which never leaves state p0 . This run π = pω 0 is accepting (as inf(π) = {p0 } and therefore inf(π) ∩ {p1 } = / and has positive measure. More precisely, the acceptance probability PrPS (σ) for a 0) word σ = xy with x ∈ {a, b, c}∗ and y ∈ {b, c}ω is ≥ 1/2k where k is the number of a’s in x. Hence, σ = xy ∈ LStreett (PS ). For the infinite words σ with infinitely many b’s all runs are accepting, since they either visit p1 , p2 only finitely many times (in which case / or they visit p2 infinitely often (as σ contains infinitely many b’s). inf(π) ∩ {p1 } = 0) Hence, PrPS (σ) = 1 which yields σ ∈ LStreett (PS ). Vice versa, for each word in LStreett (PS ) which contains infinitely many a’s, almost all runs will enter state p1 infinitely often. But then an accepting run must also visit state p2 infinitely often, which is only possible by reading letter b. Thus, all words accepted by PS either contain only finitely many a’s or infinitely many b’s. Equivalence of ω-automata means that their accepted languages agree. The notion of the size, denoted |P |, of an ω-automaton P is used here as follows. The size of a PBA is simply the number of states. The size of a probabilistic Rabin or Streett automaton denotes the number of states plus the number of acceptance pairs.

2 Expressiveness of Probabilistic ω-Automata The three types of probabilistic ω-automata (Büchi, Rabin, Streett) are equally expressive. As the Büchi acceptance condition can be rewritten as a Rabin or Streett acceptance condition, each PBA can be viewed as a PRA or as a PSA with the same accepted language. Vice versa, there are polynomial transformations from PRA and PSA to PBA: Theorem 1 (Equivalence of PBA, PRA and PSA [BG05]) (a) For each PBA there is an equivalent PRA and an equivalent PSA of the same size. (b) Given a PRA PR with acceptance pairs there exists an equivalent PBA of size O (|PR |).

26


(c) Given a PSA PS with acceptance pairs there exists an equivalent PBA of size O (2 |PS |). The transformation from PRA to PBA is roughly the same as in the nondeterministic case. The construction of a PBA of size O (2 |PS |) from a given PSA PS , however, crucially relies on the probabilistic semantics. In fact, it is worth noting that in the nonprobabilistic case it is known (see [SV89]) that there are families (Ln )n≥0 of languages Ln ⊆ Σω that are recognizable by nondeterministic Streett automata of size O (n), while each nondeterministic Büchi automaton for Ln has 2n or more states. Thus, the polynomial transformation from Streett to Büchi acceptance is specific for the probabilistic case. Let us now discuss the expressiveness of probabilistic ω-automata compared to their nondeterministic counterparts. The first observation is that each NBA can be transformed into an equivalent PBA. Hence, the class of languages that is recognizable by a PBA subsumes the class of ω-regular languages. A transformation from NBA into an equivalent PBA is obtained by using NBA that are deterministic-in-limit. These are NBA such that for each state p that is reachable from some accepting state q ∈ F and each letter a ∈ Σ state p has at most one outgoing a-transition. That is, as soon as an accepting state has been reached the behavior from then on is deterministic. [CY95] presented some kind of powerset construction which turns a given NBA N into an equivalent NBA Ndet that is deterministic-in-limit. If we now resolve the nondeterminsitic choices in Ndet by uniform distributions4 then Ndet becomes a PBA that accepts the same language as N (and Ndet ). This yields: Lemma 1 (see [BG05]). For each ω-regular language L ⊆ Σω there exists a PBA P with the alphabet Σ such that L (P ) = L. The powerset construction used in the transformation from N to Ndet can cause an exponential blow-up. In fact, the worst-case exponential blow-up cannot be avoided for the transformation from NBA to PBA since there are examples for families (Ln )n≥1 of ω-regular languages that are accepted by NBA of linear size, while each PBA for Ln has Ω(2n ) states [BG05]. An example for such a family of languages is ((a + b)∗a(a + b)n c)ω . Vice versa, there are languages Ln that can be recognized by PBA of size O (n), while any NSA for Ln has Ω(2n /n) states [BG05]. We now address the question whether each PBA can be transformed into an equivalent NBA. Surprisingly, this is not the case, as there are PBA where the accepted language is not ω-regular. An example is given in Figure 3 which shows a PBA Pλ where λ is an arbitrary real number in the open interval ]0, 1[. The PBA Pλ accepts the language

L (Pλ ) =

∞ ak1 bak2 bak3 b . . . : ∏ 1 − λki > 0 i=1

4

If q is a state in Ndet and a ∈ Σ such that q has k a-successors q1 , . . . , qk then we define / {q1 , . . . , qk }. Similarly, if Q0 δ(q, a, qi ) = 1k for 1 ≤ i ≤ k and δ(q, a, p) = 0 for all states p ∈ is the set of initial states in Ndet and Q0 is nonempty then we deal with the initial distribution µ0 that assigns probability 1/|Q0 | to each state in Q0 .


27

b q0 a,λ

q1 a,1 − λ a

Fig. 3. PBA Pλ accepts a non-ω-regular language

To see this, let us first observe that all words in L (Pλ ) must contain infinitely many b’s. As Pλ cannot consume two consecutive b’s, all words in L (Pλ ) have the form ak1 bak2 bak3 b . . . where k1 , k2 , . . . is a sequence of positive natural numbers. We now show that ∞ PrPλ (ak1 bak2 bak3 b . . .) = ∏ 1 − λki i=1

The factors 1 − λki stand for the probability to move from state q0 to q1 when reading the subword aki . With the remaining probability λki , the automaton Pλ stays in state q0 , but then letter b at position k1 + . . . + ki + i of the input word ak1 bak2 bak3 b . . . cannot be consumed and Pλ rejects. Hence, the probability for run fragments of the form q0 . . . q0 q1 . . . q1 q0 that are generated while reading the subword aki b is precisely 1 − λki . This yields that the infinite product of these values agrees with the acceptance probability for the input word ak1 bak2 bak3 b . . .. The convergence condition which requires the infinite product over the values 1 − λki to be positive can easily be shown to be non-ω-regular, i.e., L (Pλ ) cannot be recognized by an NBA. Together with Lemma 1 we get: Theorem 2 (Expressiveness of PBA, [BG05]). The class of languages that are accepted by a PBA strictly subsumes the class of ω-regular languages. This stands in contrast to the fact that probabilistic finite automata (PFA) with the acceptance criterion “the accepting runs have a positive probability measure” can be viewed as nondeterministic finite automata, and hence, have exactly the power of regular languages. The PBA Pλ can also serve to illustrate another interesting property of PBA. Consider two values λ and ν ∈]0, 1[ with λ < ν. For any sequence (ki )i≥1 of natural numbers ki where the infinite product over the values 1 − νki converges to some positive value, also the infinite product over the values 1 − λki is positive, as we have 1 − νki < 1 − λki . Thus, L (Pν ) ⊆ L (Pλ ). In fact, whenever λ < ν then there are sequences (ki )i≥1 such that the product of the values 1 − λki converges to some positive real number, while the product of the values 1 − νki has value 0 [BBG08]. Hence: Lemma 2 (see [BBG08]). If λ < ν then L (Pν ) is a proper sublanguage of L (Pλ ). Thus, the languages of PBA are sensitive to the distributions for the successor states. That is, if we are given a PBA and modify the nonzero transition probabilities then also the accepted language might change. This property is surprising since the definition of

28


the accepted language just relies on a qualitative criterion: the acceptance probability must be positive, but might be arbitrarily small. This should be opposed to the verification of finite-state Markov decision processes where it is known that whether or not a given linear time property holds with positive probability just depends on the underlying graph, but not on the concrete transition probabilities.

3 Composition Operators for PBA The most important composition operators for any class of languages over infinite words are the standard set operations union, intersection and complementation. In fact, the class of PBA-recognizable languages is closed under all three operations. Theorem 3 (see [BBG08]). The class of languages L (P ) for some PBA P is closed under union, intersection and complementation. For union, this is obvious since given two PBA P1 and P2 over the same alphabet with initial distributions µ1 and µ2 , respectively, we consider the PBA that arises from the disjoint union of P1 and P2 with the initial distribution µ(q) = 12 µi (q) if q is a state in Pi . If F1 and F2 are the sets of accepting states in P1 and P2 , respectively, then P requires to visit F1 ∪ F2 infinitely often. For intersection, we can reuse the ideas of an intersection operator on NBA. Given two PBA P1 and P2 over the same alphabet, we use a product construction P1 × P2 (which runs P1 and P2 in parallel) and equip P1 × P2 with the Streett condition consisting of two acceptance pairs. One of the acceptance pairs requires that an accepting state of P1 is visited infinitely often, the other one stands for the acceptance condition of P2 . This PSA P1 × P2 can then be transformed into an equivalent PBA (part (c) of Theorem 1). The most interesting operator is complementation. Given a PBA P with L = L (P ) ⊆ Σω , the idea for the construction of a PBA P for the language L = Σω \ L is somehow similar to the complementation of NBA via Safra’s determinisation operator [Saf88] and relies on the transformations sketched in Figure 4. Here, by a 0/1-PRA we mean a PRA PR where the acceptance probabilities for all words are 0 or 1, i.e., PrPR (σ) ∈ {0, 1} for each word σ ∈ Σω . Similarly, a 0/1-PSA is a PSA PS with PrPS (σ) ∈ {0, 1} for each word σ ∈ Σω . Given a 0/1-PRA PR , the duality of Rabin and Streett acceptance yields that LRabin (PR ) and LStreett (PR ) are complements of each other. Thus, in the second step of Figure 4 we may deal with the PSA PS which is syntactically the same as PR (but PS is viewed as a Streett and PR as a Rabin automaton). The last step of Figure 4 relies on the transformation from PSA to PBA (part (c) of Theorem 1). The interesting step is the first one in Figure 4 where we have to construct a 0/1PRA from a given PBA. The idea for this transformation is to design a 0/1-PRA PR that PBA P for L

0/1-PRA PR for L

0/1-PSA PS for L

Fig. 4. Complementation of a PBA

PBA P for L


29

generates up to n sample runs of P and checks whether at least one of them is accepting, where n is the number of states in P . If so then PR accepts, otherwise it rejects. For the details of this construction we refer to [BBG08, Grö08]. Lemma 3 (From PBA to 0/1-PRA, [BBG08]). For each PBA there exists an equivalent 0/1-PRA.

4 Decision Problems for PBA For many applications of automata-like models, it is important to have (efficient) decision algorithms for some fundamental problems, like checking emptiness or language inclusion. For instance, the automata-based approach [VW86] for verifying ω-regular properties of a nondeterministic finite-state system relies on a reduction to the emptiness problem for NBA. Unfortunately, the emptiness problem and various other classical decision problems for automata cannot be solved algorithmically for PBA: Theorem 4 (Undecidability of PBA [BBG08]). The following problems are undecidable: – emptiness: given a PBA P , does L (P ) = 0/ hold? – universality: given a PBA P with the alphabet Σ, does L (P ) = Σω hold? – equivalence: given two PBA P1 and P2 , does L (P1 ) = L (P2 ) hold? To prove undecidability of the emptiness problem, we provided in [BBG08] a reduction from a variant of the emptiness problem for probabilistic finite automata (PFA) which has been shown to be undecidable [MHC03]. Undecidability of the universality problem then follows by the effectiveness of complementation for PBA. Undecidability of the PBA-equivalence problem is an immediate consequence of the undecidability of the emptiness problem (just consider P1 = P and P2 a PBA for the empty language). A consequence of Theorem 4 is that PBA are not appropriate for verification algorithms. Consider, e.g., a finite-state transition system T and suppose that a linear-time property p to be verified for T is specified by a PBA P in the sense that L (P ) represents all infinite behaviors where property p holds. (Typically p is a language over some alphabet Σ = 2AP where AP is a set of atomic propositions and the states in T are labeled with subsets of AP.) Then, the question whether all traces of T have property p is reducible to the universality problem for PBA and therefore undecidable. Similarly, the question whether T has at least one trace where p holds is reducible to the emptiness problem for PBA and therefore undecidable too. Another important consequence of Theorem 4 is that it yields the undecidability of the verification problem for partially observable Markov decision processes (POMDPs) against ω-regular properties. POMDPs provide an operational model for stochastic systems with non-observable behaviors. They play a central role in many application areas such as mobile robot navigation, probabilistic planning task, elevator control, and so on. See, e.g., [Son71, Mon82, PT87, Lov91]. The syntax of a POMDP can be defined as for probabilistic ω-automata, except that the acceptance condition has to be replaced with an equivalence relation ∼ on the states which formalizes which states cannot be

30


distinguished from outside. The elements in the alphabet Σ are viewed as action names. The goal is then to design a scheduler S that chooses the actions for the current state and ensures that a certain condition X holds when the choices between different enabled actions in the POMDP M are resolved by S. For his choice the scheduler may use the sequence of equivalence classes that have been passed to reach the equivalence class of the current state. That is, the scheduler is supposed to observe the equivalence classes, but not the specific states. (Such schedulers are sometimes called “partial-information schedulers” or “observation-based schedulers”.) The emptiness problem for PBA is a special instance for the scheduler-synthesis problem for POMDPs. Given a PBA P = (Q, Σ, δ, µ0 , F), we regard the POMDP M = (Q, Σ, δ, µ0 , ∼) where ∼ identifies all states and ask for the existence of a scheduler that ensures that F will be visited infinitely often with positive probability. We first observe that the infinite words over Σ can be viewed as schedulers for M , and vice versa. Hence, L (P ) is nonempty if and only if there is a scheduler S such that PrM S (♦F) > 0, where PrM (♦F) denotes the probability that M visits F infinitely often when S is used to S schedule the actions in M . Similarly, the universality problem for PBA can be viewed as a special instance of the problem where we are given a POMDP M and a set F of states and ask for the existence of a scheduler S such that PrM S (♦F) = 1 where M PrS (♦F) denotes the probability that M under scheduler S eventually enters F and never leaves F from this moment on. Thus: Theorem 5 (Undecidability results for POMDPs, [BBG08]). The following problems are undecidable: – given a POMDP M and a set F of states, decide whether ∃S. PrM S (♦F) > 0 – given a POMDP M and a set F of states, decide whether ∃S. PrM S (♦F) = 1 The result of Theorem 5 is remarkable since the corresponding questions for fully observable Markov decision processes (i.e., POMDPs where the ∼-equivalence classes are singletons) are decidable in polynomial time. However, there some other instances of the verification problem for POMDPs which are decidable. This includes the following questions (for further details see [dA99, BBG08, Grö08]): ∃S. PrM S (F) > 0 ∃S. PrM S (♦F) > 0 ∃S. PrM S (F) = 1 ∃S. PrM S (♦F) = 1 ∃S. PrM S (♦F) = 1 ∃S. PrM S (♦F) > 0 From the decidability of the question whether a given POMDP M and set F of states in M has a scheduler S such that PrM S (♦F) = 1 we can derive the decidability of the emptiness problem for PBA under an alternative semantics that requires that almost all runs are accepting. Formally, this almost-sure semantics for PBA assigns the language L =1 (P ) = σ ∈ Σω : PrP (σ) = 1


31

to each PBA P . Thus, the switch from the standard semantics L (P ) to the almost-sure semantics simplifies algorithmic problems, but the almost-sure semantics has several other disadvantages. PBA with the almost-sure semantics are less expressive. They even do not cover the full class of ω-regular languages. For instance, the ω-regular language (a + b)∗aω cannot be recognized by a PBA with the almost-sure semantics. Since the complement (a∗ b)ω of this language is recognizable by a deterministic Büchi automaton (and therefore also by a PBA with the almost-sure semantics), PBA with the almost-sure semantics are not closed under complementation. Furthermore, there are PBA where the almost-sure semantics yields a non-ω-regular language. An example is the complement of the language L (Pλ ) which is recognizable by a PBA with the almost-sure semantics, while L (Pλ ) is not. We finally mention that the differences between the standard semantics L (P ) and the almost-sure semantics L =1 (P ) for PBA do not hold when switching to Rabin or Streett acceptance. Recall that by the results established in Lemma 3 and Theorem 1, PRA with the almost-sure semantics are as expressive as ordinary PRA (and PBA), and checking emptiness, universality or equivalence of PRA with the almost-sure semantics are undecidable.

5 Conclusion We gave a summary of the fundamental properties of probabilistic acceptors for infinite words formalized by probabilistic ω-automata with Büchi, Rabin or Streett aceptance conditions. The results show some major differences to nondeterministic (or alternating) ω-automata concerning the expressiveness, efficiency and decidability, which makes PBA interesting at least from a theoretical point of view. So far, just the basic principles of probabilistic ω-automata have been studied and many interesting problems still have to be addressed, such as characterizations of the class of PBA-recognizable languages (e.g., by some temporal or modal logic or some extension of monadic second-order logic or by an extension of ω-regular expressions), or alternative semantics for PBA where checking emptiness is decidable and the full class of ω-regular languages is covered. The undecidability of the emptiness problem and related problems shows that PBA with the standard semantics are not adequate for algorithmic purposes, e.g., the verification of systems with nondeterministic behaviors. The situation changes if the system to be verified is purely probabilistic (i.e., modelled by a Markov chain). In this case some decidability results for the verification problem against PBA-specifications can be established [BG05]. Being a special instance of POMDPs all negative results for PBA (undecidability) carry over from PBA to POMDP. Vice versa, for many algorithmic problems for POMDPs, algorithmic solutions for PBA can be combined with standard algorithms for (fully observable) Markov decision processes to obtain an algorithm that solves the analogous problem for POMDPs. Another application of probabilistic ω-automata is run-time verification where special types of PBA can serve as probabilistic monitors [CSV08]. Given the wide range of application areas of probabilistic finite automata, there might be various other applications of probabilistic ω-automata. For instance, the concept of probabilistic

32


ω-automata is also related to partial-information games with ω-regular winning objectives [CDHR06] or could serve as starting point for studying quantum automata over infinite inputs, in the same way as PFA yield the basis for the definition of quantum finite automata [KW97, AF98]. For these reasons, we argue that the concept of probabilistic ω-automata is an interesting new research field with plenty of open questions that might lead to interesting applications.

References [AF98]

[BBG08]

[BC03] [BG05]

[CDHR06]

[CSV08]

[CY95] [dA99]

[DS90] [Fre81] [Grö08] [GTW02] [KW97]

[Lov91]

Ambainis, A., Freivalds, R.: 1-way quantum finite automata: strengths, weaknesses and generalizations. In: Proc. of the 39th Symposium on Foundations of Computer Science (FOCS 1998). IEEE Computer Society Press, Los Alamitos (1998) Baier, C., Bertrand, N., Grösser, M.: On decision problems for probabilistic Büchi automata. In: Amadio, R. (ed.) FOSSACS 2008. LNCS, vol. 4962, pp. 287–301. Springer, Heidelberg (2008) Blondel, V., Canterini, V.: Undecidable problems for probabilistic finite automata. Theory of Computer Systems 36, 231–245 (2003) Baier, C., Grösser, M.: Recognizing ω-regular languages with probabilistic automata. In: Proc. of the 20th IEEE Symposium on Logic in Computer Science (LICS 2005), pp. 137–146. IEEE Computer Society Press, Los Alamitos (2005) Chatterjee, K., Doyen, L., Henzinger, T.A., Raskin, J.-F.: Algorithms for ωregular games with imperfect information. In: Ésik, Z. (ed.) CSL 2006. LNCS, vol. 4207, pp. 287–302. Springer, Heidelberg (2006) Chadha, R., Sistla, A.P., Viswanathan, M.: On the expressiveness and complexity of randomization in finite state monitors. In: Proc. of the 23rd IEEE Symposium on Logic in Computer Science (LICS 2008), pp. 18–29. IEEE Computer Society Press, Los Alamitos (2008) Courcoubetis, C., Yannakakis, M.: The complexity of probabilistic verification. Journal of the ACM 42(4), 857–907 (1995) de Alfaro, L.: The verification of probabilistic systems under memoryless partialinformation policies is hard. In: Proc. of the 2nd International Workshop on Probabilistic Methods in Verification (ProbMiV 1999), vol. 9, pp. 19–32. Birmingham University, Research Report CSR-99-9 (1999) Dwork, C., Stockmeyer, L.: A time-complexity gap for two-way probabilistic finite state automata. SIAM Journal of Computing 19, 1011–1023 (1990) Freivalds, R.: Probabilistic two-way machines. In: Gruska, J., Chytil, M.P. (eds.) MFCS 1981. LNCS, vol. 118, pp. 33–45. Springer, Heidelberg (1981) Größer, M.: Reduction Methods for Probabilistic Model Checking. PhD thesis, Technical University Dresden, Faculty for Computer Science (2008) Grädel, E., Thomas, W., Wilke, T. (eds.): Automata, Logics, and Infinite Games. LNCS, vol. 2500. Springer, Heidelberg (2002) Kondacs, A., Watrous, J.: On the power of quantum finite state automata. In: Proc. of the 38th Symposium on Foundations of Computer Science (FOCS 1997), pp. 66–75. IEEE Computer Society Press, Los Alamitos (1997) Lovejoy, W.: A survey of algorithmic methods for partially observable Markov decision processes. Annals of Operations Research 28(1), 47–65 (1991)

Probabilistic Acceptors for Languages over Infinite Words [MHC03]

[Mon82] [Paz66] [PT87] [Rab63] [Saf88]

[Son71] [SV89]

[Tho97] [VW86]

33

Madani, O., Hanks, S., Condon, A.: On the undecidability of probabilistic planning and related stochastic optimization problems. Artificial Intelligence 147(12), 5–34 (2003) Monahan, G.: A survey of partially observable Markov decision processes: Theory, models, and algorithms. Management Science 28(1), 1–16 (1982) Paz, A.: Some aspects of probabilistic automata. Information and Control 9 (1966) Papadimitriou, C., Tsitsiklis, J.: The comlexity of Markov decision processes. Mathematics of Operations Research 12(3) (1987) Rabin, M.O.: Probabilistic automata. Information and Control 6(3), 230–245 (1963) Safra, S.: On the complexity of ω-automata. In: Proc. of the 29th Symposium on Foundations of Computer Science (FOCS 1988), pp. 319–327. IEEE Computer Society Press, Los Alamitos (1988) Sondik, E.J.: The Optimal Control of Partially Observable Markov Processes. PhD thesis, Stanford University (1971) Safra, S., Vardi, M.Y.: On ω-automata and temporal logic. In: Proc. of the 21st ACM Symposium on Theory of Computing (STOC 1989), pp. 127–137. ACM Press, New York (1989) Thomas, W.: Languages, automata, and logic. Handbook of formal languages 3, 389–455 (1997) Vardi, M.Y., Wolper, P.: An automata-theoretic approach to automatic program verification. In: Proc. of the 1st IEEE Symposium on Logic in Computer Science (LICS 1986), pp. 332–345. IEEE Computer Society Press, Los Alamitos (1986)

Automatic Verification of Heap Manipulation Using Separation Logic Josh Berdine Microsoft Research

Accurately representing the structure and manipulation of heap-allocated data structures is a key challenge for automatic verification of nontrivial code. Capturing this information is central to proving properties such as the absence of invalid memory accesses (for instance, deallocating memory twice or dereferencing dangling or NULL pointers), the absence of memory leaks, and data-structure integrity properties (for instance, that a doubly-linked list structure is properly linked in both directions). Significant advances in this area have recently been made by using separation logic for the abstract representation of program states and semantics of commands. Here we explain the core of the approach that has enabled these advances in the automatic verification of deep heap properties, without requiring programs to be annotated by the developer. Additionally, starting from this core for verification of partial correctness properties, we present new techniques for termination analysis of heap manipulating code that are based on generating an abstraction for termination from a proof of partial correctness. This results in a purely arithmetic abstraction of heap manipulating code, which enables recent advances in termination proving to be applied to code that operates not only on integer data, but also on heap-allocated data structures.

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, p. 34, 2009. c Springer-Verlag Berlin Heidelberg 2009

Technology Diffusion in Social Networks The Role of Compatibility Nicole Immorlica Northwestern University, Evanston, IL, USA [email protected]

Abstract. Social networks form the basic structure for the diffusion of technologies throughout a society. We present a simple model of Morris [8] for this diffusion based on myopic best-response behavior of the agents and derive necessary and sufficient conditions for a new technology to inflitrate a network in which all agents are intially using an incumbant technology. We then discuss an extention of this model based on joint work with Kleinberg, Mahdian, and Wexler [6] which incorporates compatibility between technologies and discuss how this effects the diffusion. We find some surprising results: in some cases, for one technology to survive the introduction of another, the cost of adopting both technologies must be balanced within a narrow, intermediate range. We also extend our framework to the case of multiple technologies, where we find that a simple model captures the phenomenon of two firms adopting a limited “strategic alliance” to defend against a new, third technology.

1

Extended Abstract

A social network is a graph representing entities and relationships between them. A graph of people and their friendships, a graph of webpages and hyperlinks, or a graph of countries and trading relations are all examples of social networks. Social networks play a fundamental role in the diffusion of information or behaviors. Perhaps the most immediate example of such diffusion processes is technology adoption.1 In this case, agents in a social network face decisions regarding which, of a competing set of technologies, they wish to adopt. Various factors affect this decision, including the quality of the technology, the cost of adoption, and the externality derived from using the technology in the context of the social network. For example, in a friendship network, agents must decide what cell-phone plan to choose. Each plan has a quality related to the coverage of the cell company’s network for example, and a cost. Additionally, two friends have larger benefits if they share the same cell-phone plan as phone calls within the same cell network are typically cheaper. Thus the structure of the social network clearly has implications regarding technology adoption, as we see in the work of several computer scientists and economists [1,2,3,4,5,6,7,8]. 1

The term technology is used in a loose sense; similar stories can be told about any sort of information or signal.

M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 35–36, 2009. c Springer-Verlag Berlin Heidelberg 2009

36

N. Immorlica

Such phenomena can be modeled by a coordination game played on the edges of the social network. For the case of two competing technologies, the payoffs can be represented by a bimatrix game M . Entry Mab (r) for r = {0, 1} is the payoff to player r when r plays strategy a and the opponent (1 − r) plays strategy b. Each node in the social network selects a single strategy and plays that strategy in the coordination game M on each adjacent edge. The payoff to a node is then the aggregate of the payoffs in each of these games. In this talk, we study diffusion under myopic best-response dynamics in which, in each round, an arbitrary agent chooses a strategy which is a best response to the aggregate of her or his neighbors’ strategies [6,8]. That is, an agent assumes that she or he will be playing bimatrix game M with a random neighbor in subsequent rounds and chooses the strategy which achieves the highest expected value assuming the neighbors’ strategies will not change. We first discuss a class result of Morris [8] which characterizes conditions under which a new superior technology can inflitrate a network in which everyone is initially using an inferior incumbant technology. We then discuss a joint work with Kleinberg, Mahdian, and Wexler [6] which extends this model to the case where technologies have limited compatibilites. We observe that limited compatibility may help an inferior incumbant technology to survive the invasion of a superior technology. We further provide a characterization of the conditions under which this happens and observe that it is related to the existence of so-called bi-lingual buffers, or nodes which adopt both technologies. We then discuss extensions of this model to the case of multiple technologies.

References 1. Anderlini, L., Ianni, A.: Path dependence and learning from neighbours. Games and Economic Behavior 13, 141–177 (1996) 2. Blume, L.: The statistical mechanics of strategic interaction. Games and Economic Behavior 4, 387–424 (1993) 3. Blume, L.: The statistical mechanics of best-response strategy revision. Games and Economic Behavior 11, 111–145 (1995) 4. Ellison, G.: Learning, local interaction, and coordination. Econometrica 61, 1047– 1071 (1993) 5. Goyal, S., Janssen, M.: Non-exclusive conventions and social coordination. Journal of Economic Theory 77, 34–57 (1997) 6. Immorlica, N., Kleinberg, J., Mahdian, M., Wexler, T.: The role of compatibility in the diffusion of technologies in social networks. In: ACM Conference on Electronic Commerce (EC) (2007) 7. Mobius, M.: Death through success - telephone competition at the turn of the century. mimeo, Harvard University (2007) 8. Morris, S.: Contagion. The Review of Economic Studies 67, 57–78 (2000)

Service Oriented Architecture Pitfalls Radovan Janeˇcek Director of Service Portfolio Management R&D HP Software, Hewlett-Packard [email protected]

Abstract. The distributed software systems theory is comprehensively described and also deeply understood in academic community. The domain has its own interesting history of research and application. Almost every computer science graduate has some knowledge of distributed algorithms or fundamental properties and goals of such systems. And almost every software product nowadays is relying on some sort of a distributed system. It is therefore surprising that we are witnessing repeated failures of enterprise application integration middlewares, one of the most promising incarnations of the theory. The enterprise software industry is aligning behind new attempt to deliver so called Service Oriented Architecture (SOA), which is supposed to fix the existing middleware problems and finally deliver an ecosystem of applications talking to each other seamlessly. Despite all the promises and rightful expectations, there is very high risk of yet another failure though. The goal of this paper is to suggest how to give SOA a chance.

Personal Note I feel very lucky I had the opportunity to study and research distributed systems as a member of the Distributed Systems Research Group at Charles University in Prague. Even after ten years, I keep my best memories of the seminars, writing papers, and attending conferences. The experience and knowledge I had gathered during that time was indeed an invaluable asset for me when I co-founded the web services (later SOA) company called Systinet back in March 2000. Eventually, Systinet became a very successful SOA vendor and I have got involved in many large SOA projects in various industries in the past eight years. Systinet’s technology has also become an essential part of large middleware stacks from vendors such as Oracle, BEA, or TIBCO. I have continued leading SOA strategy and R&D management after Systinet was acquired by Mercury Interactive (2006) and later by Hewlett-Packard (2007). Today, the HP SOA product suite builds on the Systinet platform and its footprint on the market has increased dramatically. HP SOA Systinet is part of one of the largest enterprise software portfolios called Business Technology Optimization (BTO). I spent this year as the chief architect of BTO, focusing on defining and executing integration strategy for this giant portfolio of heterogeneous products. No surprise I chose SOA as the architecture and methodology framework for this non-trivial task. M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 37–45, 2009. c Springer-Verlag Berlin Heidelberg 2009

38

R. Janeˇcek

When writing this paper, I have been trying to provide an industrial perspective, based on my experience from the SOA projects I have participated in. Trying to document every single position presented throughout the paper would, unfortunately, be a futile endeavor, since many of the experiences are not published in detail separately. I have therefore decided to take the liberty of adopting a stance that is unusual in academic circles, and present my statements without rigorous proof in references, hoping that the short justification presented here will make enough sense to underscore my points.

1

Transparency Issue

One of the main characteristics of distributed systems is that they provide various types of transparency [3]. Or, more precisely, they are supposed to provide. Let’s look at some of them: – Location transparency – an entity accessing distributed resources shouldn’t have to care about physical location of these resources. For example, an application accessing a file should see no difference whether the file resides on a local machine or on the other side of the globe. – Invocation transparency – as an implication of location transparency, it should be also transparent whether an application invokes its business logic locally or remotely. There are many technologies and approaches how to do Remote Procedure Calls (RPC), Remote Method Invocation (RMI), or Message Oriented Middlewares (MOM). – Transactional transparency – one of the very interesting goals for good middleware is to support distributed transactions. In theory, it should be possible to group multiple Invocations into a single transaction regardless of whether they are local or remote. – Technology and ’vendor’ transparency (also known as Interoperability) – applications are supposed to seamlessly exchange data independently of what programming language they are written in, what platform they run on, or what vendor they are produced by. All the above transparency requirements make a lot of sense. Unfortunately, there are at least three real world issues with relying on them. First, nothing is perfect and the more the application logic relies on the presence of the transparency features the more bad side-effects we get from those ’imperfections’. Second, even if we assume perfect functionality on the system level, there is always the need to ’configure’ the environment in order to make the transparency work well from the application point of view. The more elements we have (applications, orchestration engines, content level routers, transformation engines, security intermediaries, etc.), the more configuration activities have to be done to keep the overall system consistent. And because - unlike with IDE environments - there are usually no good tools, standards, and best practices, the configuration of such environments quickly becomes an unmanageable problem – also known as configuration hell.

Service Oriented Architecture Pitfalls

39

The third issue relates to people skills. Good object oriented design, evolutionready API definitions, wise use of transactions, and similar advanced topics are difficult to do well even within one single application. Bringing questionably designed APIs or transactions into distributed environment makes the resulting system very fragile, not performing, not scalable, or not usable at all. All in all, what started as a powerful theory bringing exciting products to the market is ending up as myriads of failed integration projects. Will SOA solve this integration pain?

2


SOA is based on the concept of a Service as the entity providing certain business functionality. In addition to this, SOA puts a lot of emphasis on Contracts between the services and their consumers. Contracts go beyond just an API definition, specifying other technical aspects such as security policies, as well as non-technical aspects such as operation hours or expected number of transactions per day. Moreover, SOA insists on loose coupling, which implies many additional requirements on how to design the contracts to keep maximum independency of services from each other. SOA also insists on absolute adherence to industry standards. And SOA is also admitting that distribution has to be taken into account because it is not transparent. However, even after eight years of SOA being the hot topic on the market, we are still witnessing many failing SOA projects. Why? Because enterprise architects tend to look at SOA as yet another EAI middleware. I am often using terms “EAI in angle brackets” or “Snake-Oil Architecture” when describing SOA pitfalls. The ’transparency assumption’ and the ’EAI approach’ are the most significant technical reasons why SOA projects are failing. In simplified terms, EAI teaches us that we can keep weak underperforming endpoints and integrate them together using the middleware infrastructure that will remove the problems (scalability, versioning, reliability, etc.), while SOA encourages building strong services that will solve these problems on their own. Pitfall #1: SOA is seen as a better version of EAI that finally improves middleware weaknesses by providing better interoperability, more reliability, wider adopted standards, etc. Reality: SOA is an architecture on higher-level than EAI. It is architecture of loosely coupled independent services communicating to each other. EAI is appropriate for small scale integration projects. 2.1

Tight Coupling Versus Loose Coupling

A vast majority of integrated applications is tightly coupled. This means that changes in one of them necessitate changes on the consuming counterparts. Often, the tight coupling is desirable. Especially when dealing with exposing legacy

40

R. Janeˇcek

systems. For example, it is important to tightly couple database schema of a legacy system with newly created application logic to ensure data integrity and alignment with the application. In other words, the tight coupling is useful on the backend/frontend boundary. Unfortunately, having the transparency assumptions in mind, integration middlewares encourage developers to introduce tight coupling even among applications (i.e. frontend/frontend boundary). In this case, tight coupling is very undesirable because it brings unwanted dependencies to otherwise independent applications. That is why the recent Service Oriented Architecture practices brought the loose coupling idea. Loose coupling insists on keeping independence of collaborating endpoints (services). Building loosely coupled services requires architects not to rely on the invocation, location, or transactional transparency and rather explicitly redesign legacy APIs to respect the fact messages can be lost, network bandwidth can be limited, and so on. Pitfall #2: Architects expect loose coupling comes for free with using web services toolkits or with using standards like SOAP, WSDL, XML Schema, and so on. Reality: Loose coupling is a result of very careful API design. Standards and tools might (or might not) contribute to loose coupling. 2.2

Sameness Versus Application “Arbitrary” Behavior

Successful implementations of distributed systems share one characteristic: they expose endpoint APIs with very limited variability. We can point to distributed file systems, LDAP-based directories, email infrastructure, and similar. We can also say that the HTTP-based web infrastructure is a good example of oneAPI-for-all. And obviously, we can say it is also a hugely successful distributed system. On the other hand, application developers design service APIs in completely arbitrary way. They think in object orientation, where data is encapsulated by methods and where no commonality is required beyond the object or application they are designing. Why should this be an issue? In a constrained system, like the web, it is possible to make general assumptions about every communicating endpoint (because it has the same API). For example, it is possible to assume that certain operations are always idempotent. This assumption then allows for caching mechanisms or implementing much simpler reliable or transactional data exchanges. Having no constraints brings the ultimate flexibility but also the ultimate complexity. Pitfall #3: Services APIs are often designed only from particular application perspective. Reality: Service APIs should conform to constraints defined by central body. This process is usually called SOA Governance.


2.3

41

Web Services Architecture Versus Web Architecture

There is an intensive discussion in the software community whether SOA should be based on Web Services Architecture (WSA) [1] or Representational State Transfer (REST) [2]. It’s important to keep in mind that REST is an architectural style of World Wide Web while WSA can be seen as evolutionary successor of CORBA. From the architecture perspective, REST represents the constrained architecture approach, where services must comply with several constraints such as uniformity of APIs, addressable resources, statelessness of client-service communication, and so on. WSA does not impose any limits over services. The reason why this discussion exists is that the REST style has been proven on the Web, as HTTP implements a RESTful distributed system. It has proven its scalability, whether with number of endpoints, users, or otherwise. From certain perspective, we can say that HTTP is turning web services (or web applications) into ’system-level’ components that expose the same behavior to the external world. And that’s why HTTP works well even on such a massive scale. Pitfall #4: RESTful services are considered insufficient for enterprise use cases because there is no standard way how to describe all kinds of application-level protocols. This makes design, development, management, and monitoring of such services more difficult. Reality: Design and development of RESTful services is indeed more difficult, especially for architects that are used to working with the traditional API model. At the same time, it is much easier to integrate such services together. Exposing WSA services is practical if they directly expose legacy business logic (with legacy API) and turning such API into a RESTful one would be very expensive. 2.4

Introducing New Business Logic

Let’s look at multi-tiered application architecture approach. While breaking one single application into two or more tiers is very often a desirable practice (because the breakdown again happens on frontend/backend boundary), applying the same principle among applications themselves is at least very questionable. Again, unfortunately, this is a common EAI practice based on the transparency assumptions. The simplest example consists of two independent applications A and B that we want to integrate together to implement specific use case. Let’s assume the use case analysis shows there is additional business logic that has to be implemented because none of the existing applications provide it – for example, a purchase order needs to be transformed and enriched before it is processed. Instead of putting this additional business logic into one of these applications, many architects tend to ’outsource’ this logic into the EAI middleware M (orchestration engines, business process engines, and so on). The architects feel

42

R. Janeˇcek

justified - isn’t it the case that the middleware will take care about reliability, security, and also host the new logic? But, at the same time, instead of having two stronger endpoints we suddenly have four: A, A2M, M2B, and B. Two more to configure, maintain, and pay for... Pitfall #5: It is easier to implement new business logic in the middle tier because it does not require changes in existing products. Reality: Any additional business logic should be pushed out to the endpoints as much as possible. This might be more difficult to develop but it keeps the overall SOA system simpler (i.e. cheaper). If there is still ’remaining’ business logic then it should be implemented as a new service and likely as a new application too. Pitfall #6: Introducing more intermediaries and middle tiers helps to decouple communicating services. Reality: In most cases, introducing new intermediate steps creates twice as many tightly coupled endpoints. 2.5

HUB Versus Point-to-Point

There is a common perception that direct point-to-point relationships among services should be eliminated because putting good middleware infrastructure in between the services helps getting more control and visibility over their communication. There is also a strong complexity argument. While services connected mutually to each other result in O(n2 ) problem, the hub-based solution has only O(n) complexity. This comparison speaks clearly for the hub, especially in large scale systems. At the same time, the above advantages are rather hypothetical, while the disadvantages are very real. Even if there are thousands of services deployed within an enterprise, only fractions of them are mutually interconnected. Also, it is very likely that there are multiple hubs (in the world of SOA, these hubs are called Enterprise Service Buses) from multiple vendors. It is a big challenge for many large companies to integrate different ESBs. This selfinflicted problem is even more difficult to solve than to just integrate individual services. Pitfall #7: Enterprise Service Bus improves visibility and control over the service communications as well as reduces complexity of service relationships. Reality: None of the promised benefits materialize. Providing visibility and control has to be a non-functional part of the service contract. In other words, the service is responsible for it. Service relationships are not complex compared to the complexity of setting up the service bus infrastructure.


2.6

43

Common Data Model

Because EAI projects are usually smaller scale projects, it is often a reasonable idea to align on details of the shared data model among applications. It is often unreasonable to try defining a shared data model on enterprise level because it is difficult to demonstrate clear return on investment. What is very important though is to set up guidelines for how to align behind key metadata such as identifiers, versions, or business taxonomies, and how to externalize such metadata into standard protocols such as SOAP or Atom. In the world of SOA, the data model is purely driven by service contract. So it is very much acceptable to have two services offering two types of purchase order data entity. Pitfall #8: In order to implement good SOA, it is necessary to align on enterprise-wide common data model. Reality: Trying to align on the data model will only slow down the SOA projects. There is no strong reason to do so as long as service contracts are well defined and governed. 2.7

Enterprise Readiness

All the listed (and many other) fallacies and pitfalls that enterprise architects can fall into when implementing SOA are related to a common goal called the enterprise readiness. Software is enterprise ready when it exhibits many desired characteristics needed for large scale deployments: high availability, failover, strong security, openness, standard compliance, reliability, scalability, accessibility, localizability, and many others. Although enterprise readiness is only vaguely defined, there is a wide agreement on validity of this goal. However, there are many wrong ways how to achieve enterprise readiness for SOA. The pitfalls I mentioned earlier represent these wrong approaches: – It is indeed easier to control the data model and the object model in tightly coupled applications. Although tightly coupled applications are more fragile from the evolution perspective, they are more robust (easy to back up, replicate, and so on). Introducing loose coupling often requires giving up on enterprise requirements provided out of the box by middleware platforms. This is the step many architects are afraid to take. – It is definitely easier to describe application specific APIs without uniformity constraints. It is easier to directly expose legacy system APIs to the SOA level with web services toolkits rather than redesigning them along the REST lines. From the enterprise readiness perspective, fine grained arbitrary APIs are not considered problematic because middleware platforms will make sure the interactions among services and applications will be secure and reliable. Therefore, the industry prefers this higher flexibility in APIs definition even if such an approach is repeatedly failing in large scale environments. This flexibility is less enterprise ready!

44

R. Janeˇcek

– There are many middleware products taking care of the enterprise readiness – or at least promising so. It is therefore very tempting to use these middlewares without better thinking about unwanted consequences. These unwanted consequences include the configuration hell, overly fragmented business logic, higher deployment and maintenance costs, and the necessity of another integration layer (integration of multiple middlewares). In many small scale projects, the enterprise middleware is able to demonstrate return on investment despite the aforementioned issues. Unfortunately, SOA initiatives are enterprise-wide large scale projects requiring a different approach. This different approach suggests to invest into building strong (enterprise ready) services that are self sufficient. This also means that many enterprise features need to be addressed on the business logic level, as opposed to the system level. Pitfall #9: Enterprise readiness requirements seem to justify the use of middlewares and discourage the use of lighter-weight systems such as HTTP because they are not ’enterprise ready’. Reality: In large scale systems, the enterprise readiness requirements can only be practically met when the system entities (in our case SOA services) are enterprise ready themselves. 2.8

Organizational Impact of SOA

This paper warns of a danger of blind application of EAI technologies and methodologies when implementing SOA. There is, however, one more, and probably the most important, pitfall: assuming SOA does not require organizational changes in IT because it is ’just software architecture’. How can the potential users even know what SOA services are available for enterprise-wide use? Why should anybody be interested in sharing services he or she has developed with others? Why should anybody use somebody else’s services and expose his or her business to an unknown risk of failures of these services? Pitfall #10: SOA projects are defined purely as integration software projects without understanding the need of proper involvement of top IT and business stakeholders. Reality: SOA requires rather significant investments. If there are insufficient processes establishing visibility, trust, and control into the emerging ecosystem of services and their consumers, then the return on investment will not occur.

3

Summary

Building distributed systems is a very difficult task, where the software industry has developed a very good track record over the past few decades. We are


45

using many distributed systems without even noticing. However, successful implementations of such systems are usually at very low-level – we say system level. Attempts to elevate all the powerful characteristics of the distributed systems onto an application (business logic) level often fail. This is a serious warning sign for the Service Oriented Architectures, which suggest turning the enterprise applications into composable services that are then being used to implement new distributed business logic. In order to succeed, enterprise architects must not rely on traditional promises of integration middlewares such as reliability, transparency, transactional integrity, and similar. Instead, whenever these characteristics are needed, they have to be implemented on the application level. In order to efficiently do so, it is extremely important to follow practices such as loose coupling or REST and to avoid pitfalls such as Enterprise Service Bus, Common Data Model, or middleware-hosted business logic.

References 1. Web Services Architecture, http://www.w3.org/TR/2004/NOTE-ws-arch-20040211 2. Fielding, R. T.: Architectural Styles and the Design of Network-Based Software Architectures, http://www.ics.uci.edu/∼ fielding/pubs/dissertation/top.htm 3. Reference Model of Open Distributed Processing, ITU-T Rec. X.901-X.904, ISO/IEC 10746

Algorithms for Solving Infinite Games Marcin Jurdzi´ nski Department of Computer Science University of Warwick [email protected]

Solving parity games is an algorithmic problem which is polynomial-time equivalent to the modal mu-calculus model checking problem [5], and hence of fundamental importance for the automated verification of computational systems [8]. Establishing its exact computational complexity is an intriguing long-standing open problem. The problem is known to be in UP (unambiguous NP) and coUP [9], but no polynomial time algorithm or complexity-theoretic evidence of hardness have been found, since almost two decades ago when its membership to NP and co-NP was exhibited [5]. This talk surveys recent algorithmic ideas which yield improved running time bounds for the problem. A modification of a classical recursive algorithm for solving parity games, that originates from the work of McNaughton and Zielonka, leads to a first subexponential deterministic algorithm [11]. A refinement of the above modification of the classical recursive algorithm, due to Schewe, in which another classical algorithm for solving parity games [10] is used as a subroutine, results in an algorithm with the best currently known provable time complexity [15]. A number of other two-player infinite games on graphs—including meanpayoff games [19], simple stochastic games [3], and discounted games [16]—share the intriguing complexity-theoretic status of parity games, and are of significant independent interest. They originate from the theory of stochastic games, and have been studied for over five decades within a number of communities, including artificial intelligence and planning, mathematical programming, and algorithms and computational complexity. Since solving parity games can be reduced in polynomial time to solving those games, the rich theory of the latter [6,19] is a fertile ground for exploring new algorithmic techniques for the former [1,18]. The second part of this talk outlines a research direction, in the quest for establishing the exact computational complexity of solving parity games, based on a branch of mathematical programming and combinatorial optimization that has attracted relatively little attention in theoretical computer science. Linear complementarity problem (LCP) is a fundamental algorithmic problem in the theory of mathematical programming [4], that both linear and quadratic programming can be reduced to. In general the problem is NP-hard, but for some classes of matrices (the input to an LCP is a matrix and a vector) the exact computational complexity is open. For the class of P-matrices, which is all-important M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 46–48, 2009. c Springer-Verlag Berlin Heidelberg 2009

Algorithms for Solving Infinite Games

47

in the theory of LCP, the LCP problem is known to be in the PPAD, an important class of search problems [13]. P-matrix LCP is not, however, known to be PPAD-complete, and it is even conjectured to be solvable in polynomial time. On the other hand, the class of LCPs that arise from the fundamental problem of computing Nash equilibria in bimatrix games has been shown to be PPAD-complete [2]. LCP formulations for mean-payoff, simple stochastic games, and discounted games have been considered in literature [7,17]. We discuss a particularly natural P-matrix LCP formulation for discounted games [12]. Its transparent nature facilitates derivation and study of novel algorithmic approaches to discounted games, and hence also for parity games, from existing algorithmic results for the P-matrix LCP. One immediate corollary is membership of the problem of solving discounted and parity games in PPAD. We argue that natural pivoting algorithms for LCP correspond to previously known and new variations of strategy-improvement algorithms for discounted and parity games. This implies membership of the game problems in PLS, another important and natural class of search problems. The celebrated Cottle-Danzig and Lemke algorithms for LCP [4] yield new algorithms for solving discounted and parity games which deserve closer scrutiny. For example, prior to the discovery of PPAD-hardness of finding Nash equilibria, Savani and von Stengel have exhibited families of bimatrix games for which the Lemke-Howson algorithm runs in exponential time [14]. As such examples remain elusive for strategy-improvement algorithms on discounted or parity games [18], an alternative goal could be finding hard examples for the Lemke algorithm run on the associated P-matrix LCP.

References 1. Bj¨ orklund, H., Sandberg, S., Vorobyov, S.: A discrete subexponential algorithm for parity games. In: Alt, H., Habib, M. (eds.) STACS 2003. LNCS, vol. 2607, pp. 663–674. Springer, Heidelberg (2003) 2. Chen, X., Deng, X.: Settling the complexity of two-player Nash equilibrium. In: Foundations of Computer Science (FOCS), pp. 261–272. IEEE Computer Society Press, Los Alamitos (2006) 3. Condon, A.: The complexity of stochastic games. Information and Computation 96, 203–224 (1992) 4. Cottle, R.W., Pang, J.-S., Stone, R.E.: The Linear Complementarity Problem. Academic Press, London (1992) 5. Emerson, E.A., Jutla, C.S., Sistla, A.P.: On model-checking for fragments of µcalculus. In: Courcoubetis, C. (ed.) CAV 1993. LNCS, vol. 697, pp. 385–396. Springer, Heidelberg (1993) 6. Filar, J., Vrieze, K.: Competitive Markov Decision Processes. Springer, Heidelberg (1997) 7. G¨ artner, B., R¨ ust, L.: Simple stochastic games and P-matrix generalized linear complementarity problems. In: Li´skiewicz, M., Reischuk, R. (eds.) FCT 2005. LNCS, vol. 3623, pp. 209–220. Springer, Heidelberg (2005) 8. Gr¨ adel, E., Thomas, W., Wilke, T. (eds.): Automata, Logics, and Infinite Games. LNCS, vol. 2500. Springer, Heidelberg (2002)

48

M. Jurdzi´ nski

9. Jurdzi´ nski, M.: Deciding the winner in parity games is in UP ∩ co-UP. Information Processing Letters 68(3), 119–124 (1998) 10. Jurdzi´ nski, M.: Small progress measures for solving parity games. In: Reichel, H., Tison, S. (eds.) STACS 2000. LNCS, vol. 1770, pp. 290–301. Springer, Heidelberg (2000) 11. Jurdzi´ nski, M., Paterson, M., Zwick, U.: A deterministic subexponential algorithm for solving parity games. SIAM Journal on Computing (to appear, 2008) 12. Jurdzi´ nski, M., Savani, R.: A simple P-matrix linear complementarity problem for discounted games. In: Beckmann, A., Dimitracopoulos, C., L¨ owe, B. (eds.) CiE 2008. LNCS, vol. 5028, pp. 283–293. Springer, Heidelberg (2008) 13. Papadimitriou, C.H.: On the complexity of the parity argument and other inefficient proofs of existence. J. Comput. Syst. Sci. 48(3), 498–532 (1994) 14. Savani, R., von Stengel, B.: Hard-to-solve bimatrix games. Econometrica 74, 397– 429 (2006) 15. Schewe, S.: Solving parity games in big steps. In: Arvind, V., Prasad, S. (eds.) FSTTCS 2007. LNCS, vol. 4855, pp. 449–460. Springer, Heidelberg (2007) 16. Shapley, L.S.: Stochastic games. Proc. Nat. Acad. Sci. U.S.A. 39, 1095–1100 (1953) 17. Svensson, O., Vorobyov, S.: Linear complementarity and P-matrices for stochastic games. In: Virbitskaite, I., Voronkov, A. (eds.) PSI 2006. LNCS, vol. 4378, pp. 409–423. Springer, Heidelberg (2007) 18. V¨ oge, J., Jurdzi´ nski, M.: A discrete strategy improvement algorithm for solving parity games (Extended abstract). In: Emerson, E.A., Sistla, A.P. (eds.) CAV 2000. LNCS, vol. 1855, pp. 202–215. Springer, Heidelberg (2000) 19. Zwick, U., Paterson, M.: The complexity of mean payoff games on graphs. Theoretical Computer Science 158, 343–359 (1996)

Randomness and Determination, from Physics and Computing towards Biology Giuseppe Longo CNRS, Dépt. Informatique – ENS, and CREA, Polytechnique, Paris http://www.di.ens.fr/users/longo

Abstract. In this text we will discuss different forms of randomness in Natural Sciences and present some recent results relating them. In finite processes, randomness differs in various theoretical context, or, to put it otherwise, there is no unifying notion of finite time randomness. In particular, we will introduce, classical (dynamical), quantum and algorithmic randomness. In physics, differing probabilities, as a measure of randomness, evidentiate the differences between the various notions. Yet, asymptotically, one is universal: Martin-Löf randomness provides a clearly defined and robust notion of randomness for infinite sequences of numbers. And this is based on recursion theory, that is the theory of effective computability. As a recurring issue, the question will be raised of what randomenss means in biology, phylogenesis in particular. Finally, hints will be given towards a thesis, relating finite time randomness and time irreversibility in physical processes.

1

Introduction

In classical physical systems (and by this we mean also relativistic ones) randomness may be defined as ‘deterministic unpredictability’. That is, since Poincaré’s results and his invention of the geometry of dynamical systems, deterministic systems include various forms of chaotic ones, from weak (mixing) systems to highly sensitive ones to border conditions. Randomness can then be viewed as a property of trajectories within these systems, namely as unpredictability in finite time, [3], [15], [7]. Moreover, ergodicity (à la Birkhoff) provides a relevant and purely mahematical way to define randomness asymptotically, that is for infinite trajectories, still in deterministic systems inspired from physics but independently of finite time predictability of physical processes, [13]. Also recursion theory gave us a proper form of asymptotic randomness, for infinite sequences, in terms of Martin-Löf randomness, [31], [36]. This has been extensively developped by Chaitin, Schnorr, Calude and many others, [10], also in relation to physics. A third form of randomness must be mentioned: the randomness proper to quantum theories. This randomness is intrinsic to quantum measure and indetermination, two principial issues in quantum mechanics, as, according to the standard interpretation, it cannot be viewed as a form of (hidden or incomplete) M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 49–61, 2009. c Springer-Verlag Berlin Heidelberg 2009

50

G. Longo

determination, [16], [1]. Technically, it differs from classical randomness in view of Bell inequalities and their role in probability measures, [5], [7]. It may be shown that these three forms of randomness differ in finite space and time. Yet, by hinting to some recent results by M. Hoyrup and C. Rojas in the team of the author and by T. Paul, we will see that they merge, asymptotically. This poses several open questions as for the correlations in finite time of classical, quantum and algorithmic radomness, an issue extensively studied by many, as these asymptotic analyses may propose a new perspective. The infinity of this sequences is essential, as we shall see. Yet, before jumping into infinity, let’s see how to randomness differs in the various theoretical frames, at finite time, in reference also to computer networks and concurrency, [4]. Later, we will correlate finite time randomness in different frames, by a conjecture on its relation (equivalence?) to time irreversibility. Finally, the question will be posed concerning the kind of randomness we may need of in theories of the living state of matter, where complex interactions between different levels of organization, in phylogenesis in particular, seem to give even stronger forms of unpredictability than the ones analyzed by physical or algorithmic theories.

2

A Few Structures of Physical Determination

In physics, the dynamics and “structures of determination” are very rich and vary from one theory to another (classical, relativistic, quantum, critical state physics. . .). They propose the theoretical frameworks, the causal relationships (when the notion of causality is meaningful) or, more generally, the correlations between objects or even the objects of a theory themselves. A great principle unifies the various theoretical frameworks: the geodesic principle, a consequence of the symmetries and of the symmetry breakings at the center of all physical theories, [17], [6]. As for computability theory, we are all aware of the new and very relevant role of computing in Natural Sciences. Yet, the reference to computer science in the analysis of natural phenomena is not neutral; it organizes the world by analogy to a formidable conceptual and practical tool, the digital machine, of which the strength resides also (and mainly) in identical iteration. This takes the form of primitive recursion (Herbrand’s and Gödel’s foundation of computability), which is iteration plus “increment a register”. Iteration is at the center of the reliability and portability of the software: it iterates or it does what it is expected to, a thousand or a million times, even in computational environments which differ, logically, a bitï£¡but not too much though. Recursion and portability constitute and require iteratability. This is what leads Turing, its inventor, to say that his “discrete state machine” is Laplacian1 , [37] (see also the reflections in [27], [28]). By the analysis of programs, or by iterating computations, its evolution can be predicted. Unpredictability is practical, says he; it is not by principle, whereas it is the interesting principle in the continuous dynamics of the physics of chaotic 1

That is, (equational or functional) determination implies predictability.

Randomness and Determination, from Physics and Computing

51

determinism (Turing’s other pioneering exploration, [38]) as well as in quantum mechanics, albeit for other reasons. The situation is radically changing in computer networks and the related theoretical frames for concurrency: the complexity of physical space and time steps in along computations. And randomness pops out.

3

Randomness

“Random” is not the opposite of “deterministic”, in spite of the opposition of these concepts that is commonly made in computing and biology. As a matter of fact, the analysis of randomness is part of the proposal for a structure of determination of physical processes, in particular in classical dynamics, where randomness is deterministic unpredictability. But it is so also when it is related the very precise and specific notion of quantum indetermination and quantum measure of “deterministic evolutions of the state function” (determined by Schrödinger equation). 3.1

Classical

What would a dice say if we were to ask it: “Where will you go?” It would answer: “I will follow a geodesic, an optimal trajectory, from my initial conditions; a course which will minimize the Lagrangian action (energy×time). My trajectory is perfectly determined by Hamilton’s principle, otherwise known as the principle of least action. If you are unable to measure exactly my position-momentum or the boundary conditions, that’s your problem: my unpredictability, this randomness you make into a paradigm, is purely epistemic. As a classical object, my evolution is totally deterministic”. Now, classical (and relativistic) physical measurement is an interval, by principle (there is at least thermal fluctuation). So the processes which, all the while being deterministic, are “sensitive to the boundary conditions”, hence to perturbations or fluctuations below measure, escape prediction, and give us randomness as deterministic unpredictability, within deterministic chaotic systems, [24], [15]. The epistemic nature of classical randomness is also given by the co-existence of two complementary approaches to its analysis. One can understand the properties of dice throwing or coin tossing also by statistics. And probabilities, as measure, may be given a priori on the ground, say, of the symmetries of dice or coins. Thus, the same processes can be analyzed both in terms of deterministic unpredictability and of probabilities or statistical analyses. This a further reason to call classical randomness epistemic, one may easily change perspective. And the phenomenon is rather general. Since Poincaré (1890) we know of the unpredictibility of one of the simplest or dearest deterministic systems: the fragment of the Solar system made out of three celestial bodies in theri gravitational field. On a plane, nine equations, Newton-Laplace style, suffice to deermine it, yet. . . chaos pops out and today we can quantify its unpredictability, in (astronomically short) finite time, [26]. Of course, it is better to analyse coin tossing

52

G. Longo

in statistical terms (too many equations and rather useless) and the Solar system in equational ones (however,... we could bet on whether the Earth will still be on a “viable” orbit around the Sun in 100 milions years, since this is provably unpredictable, [26]). Yet, they belong to the same conceptual frame, as for determination. 3.2

Quantum

And if we asked the same question to a quanton, an elementary component of Quantum Physics? Firstly, and this is very important, the quanton must be produced and measured for it to be possible to hear or see its response – it is necessary to prepare the experiment and to choose a measuring instrument. If, for example, we were to throw it towards a Young’s double slit and if we were to place an interferometer behind the slits, the quanton would say that it is a wave which will pass through the two slits (hence the interference); if we were to rather place a particle counter behind the slits, it would say that it is a particle which will randomly select which slit to go through (50-50). Funny trajectory. . . its evolution is indeed determined by a wave equation, Schrödinger’s equation, but defined in a Hilbert space, a function space, outside of the world, beyond physical space-time. The measurement which brings us back to space-time in both cases, gives us a ‘trajectory’ which is not a trajectory, a paradigm of intrinsic randomness which is specific to quantum mechanics, [16], [1]. From a mathematical and experimental standpoint, Bell inequalities and Aspect’s experiment ([5]) demonstrate that this randomness is different than that of dynamical systems: the phenomena of entanglement give way to probability correlations that are incompatible with classical probabilistic “laws”. As a matter of fact, if two classical bodies (two coins) interact and then separate in space and time, their evolution is statistically independent. In contrast to this, the result of the probability measures of two quanta, which first interact and then travel away in space, are correlated (this is “quantum entanglement”). In short, if Bob in Paris and Alice in Rome, toss two “entangled quantum coins” (or measure the spin up-down of entangled quantons) at the same (relativistic) moment, they always obtain the same, random, result (or, more generally, the results are correlated). There is no way to act on the result, and thus to transmit instantaneously information, yet. . . something incompatible with classical (and relativistic) theories happens and this has been extensively checked, by experiments. Moreover, entanglement is the core idea in quantum computing. In summary, it is fair to call quantum randomness intrinsic or objective, in the sense that randomness is intrinsic to the theory (no ontological commitment is necessary!), [7]. In other words, for the standard interpretation (no hidden variables nor hidden determination), the theory is “complete”: there is no way to avoid probabilities in measure and entanglement forces non-locality of phenomena as probability correlations. The difference should be clear w.r. to classical randomness, where one can both use a deterministic analysis and an analysis in terms of statistical theories. Once more, in classical physics, in principle, the underlying process are fully determined: there are just non-observable


53

(hidden) fluctuations or perturbations, in border or initial conditions, that may cause massive (observable) changes in finite time (randomness as deterministic unpredictability). Classical physics computes (determines) over approximated measures and produces approximated results. In quantum physics what is determined and computed (by Schrödinger equation), is not what is measured, an exact but random value, whose probability value is the real projection of a complex number (a vector). 3.3

Computational

And what would the pixel on your computer screen say, as a discrete image of a physical trajectory? For it to move, there needs to be a program which describes a trajectory starting at this pixel’s location. This program could consist in the discretization of the mathematical representation of the most complex (or chaotic, § 3.1) of physical evolutions, that of a turbulence, for instance. Once discretized, this representation (equational, or directly given by an evolution function) affects a discrete database, within a discrete computational environment, made up of pixels, 0s or 1s, quite distinguishable from one another. The natural framework for its geometric description is discrete topology. Within the machine, the measurement of the initial conditions and that made at the boundary will be exact. That is, contrary to the physical (classical) framework with its interval-based metric and topology, the measurement of the initial situation and at the boundary is exact in the case of a digital machine, in the sense that we access digits, one by one. Moreover, in the isolated machine (not part of a network), the measurement (the access to the data) is also absolute, in the absoluteness of its time and space. If the trajectory of your dice, well simulated by means of very realistic images, is reinitialized using the same initial and boundary digital conditions, which can be done exactly, it will be identical, be it twice or a thousand times. . . Identical iteration, we insist, is the constitutive principle of the discrete state machine and of its computer programming. There is no randomness in the sequential machine: the pseudo-generators of random sequences are just that, pseudo and, if they are launched again in identical initial conditions (the discrete state machine can do this), they will identically iterate their sequences, well distributed for statistical measurement. They are random in the sole sense of having a “good” distribution of 0s and 1s, without regularities. Randomness is an hardware mistake or, more generally, must be introduced from outside (the theory). In networks, instead, with the existence of concurrency (different machines, distributed in space, “concurrently” allocated to the same calculation), the situation gets more complicated: the space-time of physics, even relativistic, introduces new challenges; in it, there is randomness, even of human or social origin (a computer is switched on/of in the net, by a human). So far, the new randomness which presents itself is manageable and relatively well managed; it is possible to make networks do, in general, what they were programmed to. So, to iterate: network software is globally reliable, portable. . . owing to the remarkable efforts

54

G. Longo

on the part of computer scientists. The fact that the databases remain discrete, with their well-separated topology, is of course at the basis of these successes. Yet, we believe, the blend of many forms of randomness in concurrent computer networks deserves an ad hoc analysisï£¡and major clarification: a plan for future work (see below). 3.4

Biological

And if we were to ask a species what will be its fate in the next ecosystem, in one year, in a million years? What “structure of determination” can enable us to speak of this randomness in a rigorous fashion, if randomness there is? And concerning the determination of the phenotype on the basis of the genotype, in ontogenesis? Is it possible to speak about this in the terms of classical physics or should quantum physics be preferred? A common characteristic in the various forms of physical randomness is due to the predetermination of the spaces of possibilities: random results or trajectories are given among already known possibilities (the six sides of a dice, the spinup/spin-down of a quanton. . .). In fact, in quantum physics, even in cases where particles can be “created”, sufficiently broad spaces are provided upstream (the Fock spaces of which Hilbert spaces are “foliations”), spaces which capture all the possible states, infinitely many in general. In biology, however, phase or reference spaces (or spaces of possible evolutions) are far from being predetermined. The possible and proper biological observables, phenotypes and species, are not pre-given or there is no way to give them, in a sound theory and in advance. An issue here is that species (and phenotypes) are co-constituted with their environment. To make an analogy with the reasons for chaos in planetry systems, some sort of “resonance effect” takes place in this co-consitutive process. The difference is that in the physical deterministic case, the resonance happens at one (and conceptually simple) level: the gravitational ineractions between a few planets, fully determined by Newton-Laplace equations. In evolution (but also in ontogenesis), the resonance takes place between different levels of organization, each deserving an analysis on terms of an appropiate structure of detemination. That is, between species, individuals, physical landscapes, but also organs and tissues and, very importantly, by two ways interactions between these levels and molecular activities, starting with DNA expression. Moreover, molecular events belong to microphysics, thus possibly subject to quantum analysis, thus, quantum probabilities. By this, one would need a theory encompassing both classical randomness, which may better fit the description of macroscopic interactions, and quantum randomness, as they may be retroacting one on top of the other. We are far form having such a theory, even in physics (we will mention a recent merging, but. . . at infinite time). While waiting for some sort of “unified” determination and probabilities, in biology and for this epistemic analysis (there is no ontology in the above: we are all made just of molecules), it would be good to have a sort of biological indetermination, comparable to the quantum indetermination of the conjugate dimensions of position/momentum. That is, to analyse the (in-)determination


55

at the level of the passage from one reference space (ecosystem), at a particular moment, to that of the “next” moment. And this passage would “contain” or express the biological (phylogenetic, ontogenetic) trajectories, which are just possibilities in a forthcoming, co-constituted ecosystem. For instance, when, over the course of evolution, a “latent potential” ([22]) manifests in the appearance of a new organ, an highly unpredictable phenomenon, it is the phenotypes and the interaction between individuals which change (the biological observables), and so the whole relevant space of analysis changes. Is this unpredictability to be analysed within a frame of chaotic determination or is it proper indetermination, like quantum randomness? A combination of the two? Once more, like in quantum physics, there is no ontological commitment here: the reader and the bacteria around/in him/her are all made of molecules and quanta. Yet, the question is: which theory is a good one for dealing with these strange bags of molecules we are? Darwin proposed a very relevant theory of species and organisms, totally disregarding molecules, but looking at the proper observables. Then, one day, perhaps, we will have a unification: we will be able to grasp at once molecule and species. So far, the so called “synthetic theory”, which pretends to understand evolution in molecular terms, has been shown to be incomplete: no way to understand the phylogenetic drift in terms of random mutations only, [22], [23]. In short, this is (also) because massive retroactive effects, from the ecosystem to the phenotype down to the genotype intervene even at the molecular level (e.g. mutations under stress) or make the expression even of identical DNA radically differ. A global analysis of some aspects of the phylogentic drift (its complexification as symmetry breaking) may be found in [8], by an analysis of “anti-entropy” as biologically organized lowering of disorder. I insist on the issue of randomness in biology, as it is amazing to observe that leading biologists, still now and along the lines of Crick and Monod ([32]), contrappose determination and randomness according to Laplace’s split: determined means predictable (in general, as Laplace knew that isolated critical points exist, where “des nuances insensibles” may lead to unpredictable trajectories), and radomness is its opposit (non-determination), to be analyzed by statistics and probabilities (to which Laplace greatly contributed). Along these laplacian lines, determinism, as it is predictable, yields “programmable”, which leads to the the idea that the “DNA is a program” (see [18] for an history, [30] for a critique from the point of view of physics and Theory of Programming). Yet, since Poincaré (1890), we know that classical randomness is deterministic unpredictability and that unpredictability pops out almost everywhere in non-linear systems. In conclusion, determination as necessity in life phenomena, understood in a laplacian way, is far removed from the frameworks of modern determination in physics, classical or quantum, even if it is supplemented by a few speckles of randomness. Crick’s “central dogma2 ” and the “one gene – one enzyme” hypothesis in Molecular Biology are good example of this. They guided research for decades and, the first, is still now believed by many, modulo the addition of a few 2

“Genetic Information” goes one-way, from DNA to RNA to proteins (and to the phenotype).

56

G. Longo

“epigenetic factors” and “norms of reaction” (for an alternative view, see [9]; more discussions and references are in [30]). By their linear causality, these asumptions are the opposite of the views on the interplay of interactions in XXth century physics. In these modern physical frames, causes become interactions and these interactions themselves dynamicaly constitute the fabric of the universe and of their manifestations; reshaping this fabric modifies the interactions, intervening upon the interactions appears to reshape the fabric, [6]. 3.5

More on Randomness in Computing

Physics has been able to propose two different notions of randomness in finite time: classical deterministic unpredictability and quantum randomness. As we shall mention, they merge in infinite time. Biology badly needs its own notion, while in search, of course, for unification with physical (molecular?) structures of determination. Computing generated its own very robust notion for infinite sequence, MartinLöf randomness, our next topic, yet it has no internal notion of randomness at finite time. Following Kolmogorof, Chaitin, Levin, Calude and many others deeply analysed sequence incompressiblity and showed that for infinite sequences, under suitable conditions, the incompressibility of initial segments yields Martin-Löf randomness. But, unless the physical generating process is spelled out, a finite sequence whose length coincides with its shortest generating program, is not random, it is just algorithmically incompressible. In other words, it is pseudorandom in the strongest wayï£¡and it is impossible to see in it any regularity what so ever. Yet, if one stays within theory of computation and no physical process is mentioned, there is no other way to give/conceive it but by a program, a formal/linguistic matter, as long as we stay in the finite. Some may see this as a terminological nuance, yet too much confusion in computing deserves clarification. Consider, say, a so called “non-deterministic” Turing Machine. This is just a formal, deterministic device, associating a set of numbers to a number. Its evolution is determined by an ill-typed input-output function. Indeed, it is a useful device as it allows to speed up computations by a form of basic parallelism. Yet, as long a physical process, chosing, at each step, one or a few of the elements in the output set, is not proposed, one cannot discuss about “determination” nor “randomness”: is it classical? quantum? Similarly for a finite sequence. Of course, a physical random sequence is incompressible, in principle, but the converse is false or ill defined. Similarly, the very difficult issue of non-determinism in concurrency deserves a closer attention and comparison with physics. As we said, classical (and relativistic) frames are deterministic, from our chaotic planetary system to coin tossing. Often, non determinism in networks is a “do not care” non determinism: the process works anyway, disregarding the specific underlying computational/determination structure (software and hardware). Other notions are known, and all handle the very difficult situation where, somewhat like in biology, various notions of randomness interact in a network (classical randomness, ‘humans’ whim switching on a computer, as we observed, a quantum experiment


57

guiding a computer action in a physics laboratory...). A large area of research deals with these processes by statistical tools, independently of the different causal structures. This is possible as the issue may be considered epistemic: like in classical systems, dice throwing and planetary systems may be analyzed also in purely statistical terms and by probabilities measures, independently of a fine analysis of determination. Yet, the question remains whether a closer analysis of randomness in concurrency may lead to a better understanding, in particular in relation with the rich structures of determination in physics. 3.6

Towards Infinity: Merging with Physics

Dynamical unpredictability is a finite time issue: the mathematical determination of an intended physical process, by a set of equations or by an evolution function, does not allow to predict the process beyond a certain finite amount of time. Today, we can compute the upper bound of predictability for the solar system and a lot more. Of course, as for dice or coins, the beginning of randomness, as unpredictability, is... immediate. Note that this forces to relate pure mathematics (the formal determination) and physical processes by the only form of access we have to them: physical measure. It is approximated measure, a physical (classical) principle, jointly to the (non-linear typically) structure of mathematical determination that produce unpredictability: by looking at the equations, say, one understands that, and sometimes even compute (by using Lyapounov exponents for example) when fluctuations below measure give diverging evolutions. However, we can stay within the purely mathematical realm and give a notion of randomness just by looking at the mathematical determination. The price to pay is the passage to (actual) infinity: these internal notions of randomness are necessarely asymptotic. Many forms of deterministic chaos allow different abstractions of this kind. A weak one, “mixing systems”, is sufficient to define Birkhoff ergodicity. In short, a trajectory (or, even a point generating it) is Birkhoff random when, w.r. to any observable (a continuous function taking values on the points of the trajectory), the temporal mean coincide with the spatial one. More formally: given a dynamical system (D, T, μ), a point x is (Birkhoff) random (or typical, in the ergodic sense) if, for any observable f , 1 n lim (f (x) + f (T (x)) + . . . + f (T (x))) = f dμ n n That is, the average value of the observable f along the trajectory {x, T (x), T 2 (x), . . . T n (x), . . .} (its time average) is asymptotically equal to the space average of f (i.e. f dμ). As already announced, also computability theory may generate randomness. Algorithmic randomness (Martin-Löf, ’65, Chaitin and Schnorr) for infinite sequences was originally defined in Cantor Space D =: 2 given μ, a measure on D, an effective statistical test is an (effective) sequence {Un }n , with μ(Un ) ≤ 2n . That is, a statistical test is an infinite decreasing sequence of effective open sets in Cantor’s space (thus, it is given in recursion theory). By this, one can define x

58

G. Longo

to be ML-random if, for any statistical test {Un }n , x is not in ∩n Un (x passes all tests). In short, algorithmically random means not being contained in any effective intersection or to stay “eventually outside” any effective statistical test (to pass all tests). Now, by non obvious work, M. Hoyrup and C. Rojas, in their thesis under this author’s and S. Galatolo’s supervision, have reconstructed a fully general frame for computable dynamics. That is, they have given an effective structure to physically interesting dynamical systmes where Birkhoff ergodicity applies. By this, they could generalize Martin-Löf randomness to these spaces (under the weaker form of Schnorr’s randomness) and show that it coincides with ergodicity (Birkhoff randomness). Next building, in the same institution, T. Paul recently proved that the peculiar role of “infinite time” is somehow strenghtened by the comparison between quantum (intrinsic) indeterminism and classical (chaotic but deterministic) unpredictability [33], [34]. In a very syntethic way, he showed that, at the limit of small values of the Planck constant (semiclassical limit) and related long time behaviour, the two notions merge. If the analogy is not too audacious, these asymptotic unifications have a wellknown predecessor. Boltzmann “unified” thermodynamics and classical physics, asymptotically. In particular, he derived the second principle of thermodynamics, by an analysis of (or “as if there were”) infinitely many particles in a finite volume. That is, the “reduction” is performed at the limit, by the (thermodynamic) integral over infinitely many trajectories. More than a reduction, thus, to classical physics, it is a matter of unification by the invention of a new unifying frame. In short, in order to understand the abstract thermodynamic principles in terms of particles’ trajectories, Boltzmann had to redesign classical trajectories in the novel terms of statistical mechanics, he had to assume molecular chaos and perform a limit transition, an extremely original step, far away from Newton’s system.

4

A Thesis on Randomness and Irreversible Time

The ‘thesis’ I want to hint here (just a thesis so far, to be enriched by proofs or arguments we work at) is that finite time randomness is ‘related’ to irreversible time, in all the main physico-mathematical contexts. That is, one has irreversible time exactly “in presence” of randomness (and viceversa) in all the theoretical frames mentioned below (and above). Of course this thesis, yet to be ‘proved’, is worth per se, as it commits our understanding of randomness, a not so clearly defined notion in full generality, to irreversibility of time. Let’s hint to a few arguments for it. 4.1

Classical

In Euler-Lagrange or Newton-Laplace equations, typically, time is reversible. The same should be said, of course, for Einstein equations. Time appears squared,


59

so its sign has no influence on the evolution of the intended systems. But also a linear field (time is not squared) may be reversed: reverse the sign of the field and the particle goes backwords, in space and time. Reversibility corresponds to the mathematical invertibility of the function describing the trajectory. Poincaré, as recalled above, proved for us that non-linear (field) equations generate chaos, to put in modern terms. Diverging trajectories, whose divergence may be measured in various way (Lyapounov exponents, entropy growth. . .), imply finite time unpredictability of generic trajectories. That is, arbitrarely close points may rapidely diverge or fluctuations below observability, thus not knowable, lead to observably different (unpredictable) evolutions. This is exactly classical randomness, from dice to the solar system, both determinsitic (see above, and) chaotic systems, and many others. Of course, the finite time of unpredictability is very different in the two cases: from fractions of seconds to milions of years. But unpredictability puts an arrow on time: you need a future w.r. to a present to define it. Mathematically, non-linearity implies noninvertibility of functions and, thus, of the related trajectories: this is another way to impose a direction on time. 4.2

Thermodynamics

Thermodynamics is the realm of oriented time: the second principle, for increasing entropy, is the paradigm of time irreversible processes. But, what is entropy growth in general? It is downgrading of energy, by a diffusion process. And each diffusion, in physics, is given by random paths. Again then, irreversibility of time ‘goes toghether’ with randomness. Note that the divergence of trajectories in the non-linear dynamics mentioned above may also be measured in terms of proper notions of entropy growth. 4.3

Quantum

Schrödinger equation is linear, yet it is ‘reversible’, its own way, by the peculiar role of the imaginary ‘i’: the inversion of time, −t, yields a −i whose behaviour, squared, is the same as that of i. Yet, what is computed, the evolution of the state function by Schrödinger equation, is not what is measured. And measure, in quantum mechanics is a highly time irreversible process: no way to reconstruct the proper complex values after their projection over the real numbers (their modules) is given. Observe finally, that measure is a probability value of a random process. Once more, than, randomness pops out exactly when one deals with a time irreversible process. How can algorithmic randomness help in this? As hinted above, the (algorithmic) notion of randomness for finite strings (that is, generated in finite time, in principle) is purely formal: it is just a (very relevant) matter of algorithmic uncompressibility. The sentence, in theories of algorithms, “given a random finite sequence”, has no contextual meaning, as for the analysis of physico-mathematical determination, unless a physical agent producing the sequence is provided: will it be a series of quantum measure? or a series of coin tossing? the result of networks activity? their randomness differ, as we know.

60

G. Longo

Yet, computability theory provides a very robust, infinite time, notion of randomness, which may be unified (asymptotically) to the two forms of physical randomness mentioned above, both given also in finite time. One more indirect fall-out of these digital devices that are changing the world, are a rather extraodinary invention of ours, comparable to and as important as the invention of the alphabet, an early far from neutral discretization of language and knowledge, [25]; in particular, the sequential machines are alpha-numeric discrete state divices of incredible logical and physical stability. And, as for their use in the simulation of all sorts of physical processes, Turing’s insightful distinction between “model” and “imitation” helps to understand their effectiveness and pertinence w.r. to intelligibility of natural processes ([37], [27], [28]). In [29] further elements are given concerning these final remarks, including an analysis of the limits of the (classical) computational language in (quantum) physics. The point is not “super-computing”, that is the search for physical processes which would compute non-Turing-computable functions, but the varying meaning of equational and functional approaches in very different contexts. Quantum computing, typically, requires a truely novel insigth.

References 1. Causality, A.J.: Symmetries and Quantum Mechanics. Foundations of Physics Letters 15(5), 415–438 (2002) 2. Adler, R.L.: Topological entropy and equivalence of dynamical systems. American Mathematical Society (1979) 3. Alligood, K., Sauer, T., Yorke, J.: Chaos: an introduction to Dynamical Systems. Springer, New York (2000) 4. Aceto, L., Longo, G., Victor, B. (eds.): The difference between Sequential and Concurrent Computations, vol. (4-5). Cambridge University Press, Cambridge (2003) 5. Aspect, A., Grangier, P., Roger, G.: Experimental Realization of the EinsteinPodolsky-Rosen-Bohm Gedankenexperiment: A New Violation of Bell’s Inequalities. Phys. Rev. Let. 49, 91 (1982) 6. Bailly, F., Longo, G.: Mathématiques et sciences de la nature. La singularité physique du vivant. Hermann, Paris (English introduction, downloadable; ongoing translation) (2006) 7. Bailly, F., Longo, G.: Randomness and Determination in the interplay between the Continuum and the Discrete. Mathematical Structures in Computer Science 17(2) (2007) 8. Bailly, F., Longo, G.: Biological Organization and Anti-Entropy. Journal of Biological Systems (to appear, 2008) 9. Brett, D., Pospisil, H., Valcárcel, J., Reich, L., Bork, P.: Alternative splicing and genome complexity. Nature Genetics 30 (2001) 10. Calude, C.: Information and Randomness: An Algorithmic Perspective. Springer, New York (1994) 11. Calude, C., Stay, M.: From Heisemberg to Gödel via Chaitin. International J. Theor. Phys 44(7) (2005) 12. Connes, A.: A. Non-commutative Geometry. Academic Press, London (1994) 13. Cornfeld, I., Fomin, S., Sinai, Y.G.: Ergodic Theory. Springer, New York (1982)


61

14. Dahan Delmedico, A., Chabert, J.-L., Chemla, K.: Chaos et déterminisme, Seuil (1992) 15. Devaney, R.L.: An introduction to Chaotic Dynamical Systems. Addison-Wesley, Reading (1989) 16. Feynman, R.: Lectures in Physics. Addison-Wesley, Reading (1966) 17. van Frassen, B.: Lois et symetries, Vrin, Paris (1994) 18. Fox Keller, E.: The Century of the Gene, Gallimard (2000) 19. Galatolo, S., Hoyrup, M., Rojas, C.: Effective symbolic dynamics, random points, statistical behavior, complexity and entropy (submitted, 2008) 20. Galatolo, S., Hoyrup, M., Rojas, C.: A Constructive Borel-Cantelli lemma. Constructing orbits with required statistical properties (submitted, 2008) 21. Gandy, R.: Church’s Thesis and the principles for Mechanisms. In: Barwise, et al. (eds.) The Kleene Symposium. North Holland, Amsterdam (1980) 22. Gould, S.J.: Wonderful Life, WW. Norton (1989) 23. Lecointre, G., Le Guyader, H.: Classification phylogénétique du vivant, Paris, Belin (2001) 24. Lighthill, J.: The recent recognized failure of predictability in Newtonian dynamics. Proc. R. Soc. Lond. A 407, 35–50 (1986) 25. Herrenschmidt, C.: Les trois écritures, Gallimard (2007) 26. Laskar, J.: Large scale chaos in the Solar System. Astron. Astrophysics 287, L9–L12 (1994) 27. Longo, G.: Laplace, Turing and the ‘imitation game’ impossible geometry: randomness, determinism and programs in Turing’s test. In: Epstein, R., Roberts, G., Beber, G. (eds.) The Turing Test Sourcebook. Kluwer, Dordrecht (2007) 28. Longo, G.: Critique of Computational Reason in the Natural Sciences. In: Gelenbe, E., Kahane, J.-P. (eds.) Fundamental Concepts in Computer Science. Imperial College Press/World Scientific (2008) 29. Longo, G., Paul, T.: The Mathematics of Computing between Logic and Physics. In: Cooper, Sorbi (eds.) Computability in Context: Computation and Logic in the Real World. Imperial College Press/World Scientific (2008) 30. Longo, G., Tendero, P.-E.: The differential method and the causal incompleteness of Programming Theory in Molecular Biology. Foundations of Science (12), 337– 366 (2007); preliminary version in French in Evolution des concepts fondateurs de la biologie du XXIe siècle, DeBoeck, Paris (2007) 31. Martin-Loef, P.: The definition of random sequences. Information and Control 9, 602–619 (1966) 32. Monod, J.: Le Hasard et la Nécessité, PUF (1973) 33. Paul, T.: Échelles de temps pour l’évolution quantique à petite constante de Planck. Séminaire X-EDP, École Polytechnique, Palaiseau (2008) 34. Paul, T.: Semiclassical analysis and sensitivity to initial conditions. Information and Computation (to appear, 2008a) 35. Pour-El, M.B., Richards, J.I.: Computability in analysis and physics. Perspectives in mathematical logic. Springer, Berlin (1989) 36. Rojas, C.: Computability and Information in models of Randomness and Chaos. Math. Struct. in Computer Science 18, 291–307 (2008) 37. Turing, A.M.: Computing Machines and Intelligence. Mind LIX(236), 433–460 (1950) 38. Turing, A.M.: The Chemical Basis of Morphogenesis. Philo. Trans. Royal Soc. B237, 37–72 (1952) 39. V’yugin, V.V.: Ergodic Theorems for Individual Random Sequences. Theoretical Computer Science 207, 343–361 (1998)

When Analysis Fails: Heuristic Mechanism Design via Self-correcting Procedures David C. Parkes School of Engineering and Applied Sciences Harvard University [email protected]

Abstract. Computational mechanism design (CMD) seeks to understand how to design game forms that induce desirable outcomes in multiagent systems despite private information, self-interest and limited computational resources. CMD finds application in many settings, in the public sector for wireless spectrum and airport landing rights, to Internet advertising, to expressive sourcing in the supply chain, to allocating computational resources. In meeting the demands for CMD in these rich domains, we often need to bridge from the theory of economic mechanism design to the practice of deployable, computational mechanisms. A compelling example of this need arises in dynamic combinatorial environments, where classic analytic approaches fail and heuristic, computational approaches are required. In this talk I outline the direction of self-correcting mechanisms, which dynamically modify decisions via “output ironing” to ensure truthfulness and provide a fully computational approach to mechanism design. For an application, I suggest heuristic mechanisms for dynamic auctions in which bids arrive over time and supply may also be uncertain.

1

Introduction

Mechanism design theory from microeconomics holds appeal within computer science as providing a principled method to develop optimized mechanisms for resource and task allocation problems of all kinds, ranging from problems in electronic commerce such as sponsored search to problems in networked systems such as allocation of wireless bandwidth and compute time on shared computational grids.1 The essential problem addressed in mechanism design theory is that of implementation: given a set of N = {1, . . . , n} agents each with private information vi : X → R on their value for outcomes X, with vi ∈ V , design a game form

1

This abstract is for an invited talk given at the 35th International Conference on Current trends in theory and practice of computer science (SOFSEM’09), January 24-30, 2009, Czech Republic. See Jackson [1], Nisan [2] and Parkes [3, chapter2] for introductory surveys.


When Analysis Fails: Heuristic Mechanism Design

63

in which agents send messages that represent reports about their valuations, so that the outcome selected in the equilibrium of the game satisfies some desired social choice function f : V n → X. For example, perhaps the goal is to allocate a resource to the agent with the highest value, in which case a second-price sealedbid [4] auction will implement the outcome in a dominant-strategy equilibrium. See Varian [5] for a simple exposition of this result and its generalization to the celebrated Vickrey-Clarke-Groves [4,6,7] mechanism. It is often useful in mechanism design to focus on direct-revelation mechanisms, simultaneous-move games in which each agent sends a message that corresponds to a report about its valuation. A direct-revelation mechanism is defined by a pair (g, t) of an outcome rule g : V n → X and payment rule t : V n → Rn , where ti (v) for v ∈ V n is the payment by agent i to the mechanism. The standard analytical approach is to impose constraints on (g, t) and find the mechanism that best-satisfies a set of desiderata (e.g., efficiency, revenue optimality, fairness, budget balance, and so forth) across the space of incentivecompatible (= non-manipulable) mechanisms. This is best illustrated by Myerson’s derivation of the revenue-optimal mechanism for selling a resource when the seller has a distribution function Fi to characterize the valuation of each buyer i ∈ N . Myerson was able to show an equivalence between the problem of finding the optimal incentive-compatible mechanism and the comparatively simple problem of maximizing expected “virtual surplus” subject to monotonicity constraints,2 and further reduce this to the problem of maximizing “ironed” virtual surplus. Ironing, for Myerson, is a process by which the virtual valuation functions are transformed into (weakly) non-decreasing functions of reported value by to “iron out” any such failure of monotonicity of virtual valuation as a function of valuation. But in many problems of practical interest, the rules of a mechanism must be specified by a computational procedure rather than an analytic formula because no tractable procedure exists to implement the “ideal” mechanism, and these problems present a need to address two kinds of bottlenecks: – The scalability bottleneck: mechanism rules must be realized by computationally tractable procedures. – The analytic bottleneck: analytic methods to derive useful mechanisms fail in discrete, multidimensional and combinatorial problems. Indeed, it is notable that very little progress has been made on extending Myerson’s analysis of revenue optimizing auctions to selling more than two goods. Computational mechanism design seeks to combine economic and computational thinking, and has made good progress on addressing the scalability bottleneck. Early progress came by working with existing mechanisms, while making 2

The virtual valuation of agent i given value vi is φi (vi ) = vi − [1 − Fi (vi )]/Fi (vi ), the virtual surplus of an allocation is the virtual valuation of the winner if the resource is allocated or the value of the seller for the resource otherwise, and monotonicity requires that the probability that an agent is allocated is (weakly) non-decreasing in its reported value, for all values of other agents.

64

D.C. Parkes

significant advances through concise and expressive bidding languages, methods for efficient preference elicitation, and with fast algorithms for determining the outcome of a mechanism given reports. Much of this progress was made in the important domain of combinatorial auctions, i.e. auctions in which agents have non-linear valuations on bundles of items [8]. A second wave of progress involved reconciling tensions between computational and economic constraints, and developing novel mechanisms, for instance through “prior-free” mechanisms [9], approximate mechanisms [10,11] and often working in problem domains that are particular to computer science such as those of network routing and job scheduling. But progress here was limited to addressing the scalability bottleneck and not the analytic bottleneck, in that where new mechanisms were derived the incentive-compatibility analysis was still performed by hand through mathematical analysis and this has limited progress. A new, third wave of progress in computational mechanism design must seek to address both the scalability and the analytic bottlenecks by leveraging computational methods also for the design of mechanisms. This includes automated mechanism design [12] and parameterized mechanism design [13]. But I do not find these approaches entirely satisfactory, and argue in this talk the following point, that a problem of computational mechanism design can be considered solved when we can take a state-of-the-art computational procedure for solving a centralized, cooperative problem and apply “with small modification” to solve the mechanism design problem. Clearly a lot is buried in the meaning of “with small modification,” but I will offer an illustrative example in the form of self-correcting mechanisms for dynamic auctions [14,15]. One of the underlying observations that drives work on self-correcting mechanisms is that rather than have a complete description of the rules of a mechanism, it is sufficient that mechanism properties be guaranteed only to the extent necessary to ensure equilibrium properties, so that selfinterested participants know how to best represent their own interests. Given this observation, the basic idea in self-correcting mechanisms is to achieve these sufficient properties through a computational procedure that acts as a “wrapper” to augment an underlying (possibly heuristic) computational method. A good example of a problem that exhibits both the scalability and analytic bottlenecks is that of dynamic multi-item auctions where bids arrive over time for multiple units of a resource, that may itself be in uncertain supply. Given a probabilistic model of bid dynamics, the underlying decision problem is one for which compelling computational methodologies exist but for which there are no closedform solutions. Moreover, a complete characterization of truthful mechanisms is available that requires that the mechanism policy is monotonic, in the sense that if an agent is allocated for some bid then it is allocated for all “higher” bids (= larger value, smaller quantity, more relaxed time constraints) [16]. In the absence of a computational methodology for mechanism design, mechanisms are

When Analysis Fails: Heuristic Mechanism Design

65

available for this problem only in the case of simple probabilistic environments for which the underlying decision problem has an analytic solution [17,18,19,20,21,22]. In illustrating the idea of self-correcting mechanisms I will show how the computational procedure of online stochastic combinatorial optimization [23] can be combined with a procedure to automatically perform sensitivity analysis of the decision policy “on the fly,” in order to modify allocation decisions as necessary to ensure monotonicity properties and thus truthfulness. The result is a scalable, dynamic auction for buyers with multi-unit demand that is demonstrated for both expiring goods (e.g. time on a compute server) non-expiring goods with a deadline (e.g. theater tickets). The sensitivity analysis procedure is a form of “ironing” in the sense of Myerson, except that it irons away failure of monotonicity in the outcome of the mechanism rather than in the inputs to a mechanism, but to the same end of providing a truthful equilibrium. Thus I think of this as output ironing, whereas Myerson’s procedure is one of input ironing. In summary, the main message of this talk is that there exists a need to couple characterizations of truthful (or “incentive-compatible”) mechanisms with a fully computational methodology in which state-of-the-art computational procedures for decision making and optimization are modified in order to achieve these properties and without needing to resort to analytic methods to design mechanisms. I refer to these mechanisms as “self-correcting” mechanisms and offer applications to dynamic auctions to illustrate the approach.

Acknowledgments Much of the content of this talk comes from collaborations with Ruggiero Cavallo, Satinder Singh and especially Florin Constantin and Quang Duong. This work is also supported in part by a Microsoft Fellowship and a Yahoo! Fellowship.

References 1. Jackson, M.O.: Mechanism theory. In: Derigs, U. (ed.) The Encyclopedia of Life Support Systems, EOLSS Publishers (2003) 2. Nisan, N.: Introduction to mechanism design (for computer scientists). In: Nisan, N., Roughgarden, T., Tardos, E., Vazirani, V. (eds.) Algorithmic Game Theory, Cambridge University Press, Cambridge (2007) 3. Parkes, D.C.: Iterative Combinatorial Auctions: Achieving Economic and Computational Efficiency. PhD thesis, Department of Computer and Information Science, University of Pennsylvania (May 2001) 4. Vickrey, W.: Counterspeculation, auctions, and competitive sealed tenders. Journal of Finance 16, 8–37 (1961) 5. Varian, H., MacKie-Mason, J.K.: Generalized Vickrey auctions. Technical report, University of Michigan (1995) 6. Clarke, E.H.: Multipart pricing of public goods. Public Choice 11, 17–33 (1971) 7. Groves, T.: Incentives in teams. Econometrica 41, 617–631 (1973) 8. Cramton, P., Shoham, Y., Steinberg, R. (eds.): Combinatorial Auctions. MIT Press, Cambridge (2006)

66

D.C. Parkes

9. Goldberg, A., Hartline, J., Karlin, A., Saks, M., Wright, A.: Competitive auctions. Games and Economic Behavior 55, 242–269 (2006) 10. Nisan, N., Ronen, A.: Algorithmic mechanism design. Games and Economic Behavior 35, 166–196 (2001) 11. Lehmann, D., O’Callaghan, L.I., Shoham, Y.: Truth revelation in approximately efficient combinatorial auctions. Journal of the ACM 49(5), 577–602 (2002) 12. Conitzer, V., Sandholm, T.: Applications of automated mechanism design. In: Proc. UAI Bayesian Modeling Applications Workshop, Acapulco, Mexico (2003) 13. Likhodedov, A., Sandholm, T.: Approximating revenue-maximizing combinatorial auctions. In: Proc. of the National Conference on Artificial Intelligence (AAAI) (2005) 14. Parkes, D.C., Duong, Q.: An ironing-based approach to adaptive online mechanism design in single-valued domains. In: Proc. 22nd National Conference on Artificial Intelligence (AAAI 2007) (2007) 15. Constantin, F., Parkes, D.C.: Self-correcting sampling-based dynamic multi-unit auctions. Technical report, Harvard University (2008) 16. Hajiaghayi, M.T., Kleinberg, R., Mahdian, M., Parkes, D.C.: Online auctions with re-usable goods. In: Proc. ACM Conf. on Electronic Commerce, pp. 165–174 (2005) 17. Hajiaghayi, M.T., Kleinberg, R., Parkes, D.C.: Adaptive limited-supply online auctions. In: Proc. ACM Conf. on Electronic Commerce, pp. 71–80 (2004) 18. Pai, M., Vohra, R.: Optimal dynamic auctions. Technical report, Kellogg School of Management (2008) 19. Lavi, R., Nisan, N.: Competitive analysis of incentive compatible on-line auctions. In: Proc. 2nd ACM Conf. on Electronic Commerce (EC 2000), pp. 233–241 (2000) 20. Gallien, J.: Dynamic mechanism design for online commerce. Operations Research (2006) 21. Gershkov, A., Moldovanu, B.: Dynamic revenue maximization with heterogeneous objects: A mechanism design approach. Technical report, University of Bonn (2008) 22. Pavan, A., Segal, I., Toikka, J.: Dynamic mechanism design: Revenue equivalence, profit maximization, and information disclosure. Technical report, Stanford University (2008) 23. Hentenryck, P.V., Bent, R.: Online Stochastic Combinatorial Optimization. MIT Press, Cambridge (2006)

On Compositionality, Efficiency, and Applicability of Abstraction in Probabilistic Systems Suzana Andova and Sonja Georgievska Department of Mathematics and Computer Science, Eindhoven University of Technology, P.O. Box 513, 5600 MB Eindhoven, The Netherlands {s.andova,s.georgievska}@tue.nl

Abstract. A branching bisimulation for probabilistic systems that is preserved under parallel composition has been defined recently for the alternating model. We show that besides being compositional, it is decidable in polynomial time and it preserves the properties expressible in probabilistic Computation Tree Logic (pCTL). In the ground-complete axiomatization, only a single axiom is added to the axioms for strong bisimulation. We show that the Concurrent Alternating Bit protocol can be verified using the process algebra and a set of recursive rules.

1

Introduction

Branching bisimulation is often used to reduce a model of a system to a smaller one, in which details, unimportant to the purposes at hand, can be abstracted away. For the compositionality of the analysis, it is particularly useful to be able to reduce the system components before they interact. The whole state space is then generated from the reduced components. Depending on the properties branching bisimulation preserves, the original model can be analyzed by looking at the smaller one. Thus, ideally, the bisimulation should preserve all properties of interest. Moreover, for this method to be useful in practice, it is crucial that the bisimulation reduction is performed efficiently. In the non-probabilistic setting branching bisimulation [16], has all these, and a number of other advantageous properties over other equivalences. The introduction of abstraction, and definition of branching bisimulation, into a framework that features probabilities, non-determinism and parallel composition, remains challenging. In the alternating model for probabilistic systems [18] that we use here, equivalences that abstract away from internal behavior have been defined in [21], [5], and [25]. The first two turn out not to be preserved by parallel composition, cf. [2]. It is shown that the branching bisimulation defined in [25] is the coarsest congruence for parallel composition included in the equivalence relation of [5]. In this paper we investigate whether the branching bisimulation of [25] fulfills the other feasibility criteria. We give an algorithm for deciding branching bisimilarity in polynomial time. We present a probabilistic extension of CTL logic, M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 67–78, 2009. c Springer-Verlag Berlin Heidelberg 2009

68

S. Andova and S. Georgievska

without the next operator, and show that branching bisimulation preserves all properties expressible in this logic. In addition, we give an algebraic characterization of branching bisimulation, which puts it in another, model-independent, perspective. The set of algebraic laws, that ground-completely axiomatizes the relation, together with a set of recursive verification rules permit equivalence of two processes to be established by means of simple syntactic manipulation. We investigate the verification power of the new process algebra by verifying compositionally the Concurrent Alternating Bit Protocol (CABP). As channels are lossy, sending a continuous stream of data through the channels is a method to overcome the possible loss of data. This continuous sending of messages gives rise to a considerable level of parallelism, which, we believe, makes the verification of CABP an interesting example. We show that, after abstraction of internal activities, CABP behaves as a buffer. The paper is organized as follows. Sec. 2 gives a brief overview of branching bisimulation of [25]. In Sec. 3 we present the algorithm, and in Sec. 4 we treat pCTL and the preservation of the logical properties. In Sec. 5 we introduce the process algebra pACPτ , give the complete axiomatization and a set of sound verification rules. In Sec. 6 we employ our process algebra in the verification of the CABP. Sec. 7 ends with conclusions and related work. For an extended version of the paper with more details see [4].

2

Preliminaries: Model and Branching Bisimulation

We use probabilistic transition systems (PTS) to model systems that exhibit probabilistic as well as non-deterministic behavior. PTSs follow the strictly alternating regime of the alternating model of Hansson [18]. They consist of two types of states: probabilistic states with outgoing probabilistic transitions, that model the probabilistic behavior of a system, and non-deterministic states with outgoing action transitions. The latter are labeled with actions from a set of action labels, representing atomic activities of a system, or with the unobservable event, which is denoted τ . We postulate special states nil, denoting successful termination, and d, denoting the (deadlock) state without outgoing transitions. Let A be a set of actions including τ . Definition 1. A PTS is a tuple (Sn , Sp , r, →, ), where Sn and Sp are disjoint sets of nondeterministic and probabilistic states, resp., r ∈ Sp is the initial node, also called root, → ⊆ Sn × A × (Sp ∪ {nil}) is an action transition relation, and ⊆Sp × (0, 1] × Sn is a probabilistic transition relation such that, for all s ∈ Sp , (s,π,t)∈ π = 1 and for all t ∈ Sn , if (s, π1 , t) ∈ and (s, π2 , t) ∈ then π1 = π2 . We require that all nodes are reachable from the root. π

a

→ t rather than (s, a, t) ∈ →, and s t (or s t if the value of We write s − τ π is irrelevant in the context) rather than (s, π, t) ∈ . s t denotes s − →t (a)

a

or s t; s −−→ t denotes s − → t, or s = t and a = τ . By S we usually denote Sn ∪ Sp ∪ {nil} ∪ {d}. The root of a PTS x is denoted r(x). For a given PTS x = (Sn , Sp , r, →, ), the function P : S × S → [0, 1] which extends to a probability measure over all states is defined in the following way:

On Compositionality, Efficiency, and Applicability of Abstraction

69

⎧ π ⎨π, if s t P (s, t) = 1, if s = t and s ∈ Sn ∪ {nil, d} ⎩0, otherwise. For a set D ⊆ S, P (s, D) denotes t∈D P (s, t). Given an equivalence relation R ⊆ S × S and a state s ∈ S, S/R denotes the partitioning of S induced by R, and [s]R denotes the R−equivalence class of s. Definition 2 (Branching bisimulation and rooted version). Let x and y be PTSs, and let S all states of x and y. An equivalence relation R ⊆ S × S is a branching bisimulation iff for every (s, t) ∈ R the following hold: a

1. if s − → s for some a ∈ A and s ∈ S, then there exist t0 , . . . , tn , t ∈ S such (a)

that t0 = t, t0 t1 . . . tn −−→ t , (s, ti ) ∈ R for all 0 ≤ i ≤ n, and (s , t ) ∈ R; 2. for all D ∈ S/R , P (s, D) = P (t, D); 3. [nil]R = {nil}. The PTSs x and y are branching bisimilar, x ∼ b y, if (r(x), r(y)) ∈ R for some branching bisimulation relation R. PTSs x and y are rooted branching bisimilar, x ∼ rb y, iff there exists a branching bisimulation R with (r(x), r(y)) ∈ R, such that, if r(x) x and a → x for some x , x ∈ S and a ∈ A, then there exist y , y ∈ S such that x − a r(y) y , y − → y , (x , y ) ∈ R, and (x , y ) ∈ R; vice versa for y. Relation R is called rooted branching bisimulation for PTSs x and y. The condition 1. requires that, as usual, when an action transition is simulated, it may be preceded by a sequence of unobservable transitions that connect equivalent states. Condition 2. requires that all related states must have the same total probability to reach an equivalence class in one P -step, including its own equivalence class. It is easy to conclude that for a probabilistic state to be related to a non-deterministic one, it must reach its own class with probability 1 (the effect is that a τ -step that is immediately followed by a non-trivial probability distribution cannot be removed). This property turns out to be essential for preserving congruence of the branching bisimulation for parallel composition [25]. Condition 3. is necessary to distinguish successful (nil) from unsuccessful (d) termination, and also to guarantee compositionality for the sequential composition. ∼ b and ∼ rb are equivalence relations [25].

3

Deciding Branching Bisimilarity

In this section we define an algorithm that decides ∼ b in polynomial time. It is rather natural to base our algorithm on the one for the non-probabilistic branching bisimulation, , defined in [17], as the first condition of Def. 2 coincides with the definition of , if PTSs are turned into ordinary labeled transition systems τ by replacing probabilistic transitions with silent − → transitions. For a given partition Π on a labeled transition system with a set of states S, the algorithm

70


of [17], GV-standard-bb, refines Π to the maximal branching bisimulation equivalence contained in Π. However, due to the second condition of Def. 2, we have to refine output partitions of GV-standard-bb, by means of a P-splitter. Definition 3. Let Π be a partition of S and B, B ∈ Π. B is P-splitter of B if there are s, t ∈ B for which P (s, B ) = P (t, B ). Ref ineΠ (B, B ) = {B1 , . . . , Bk }, k ≥ 2 is a partition of B such that B is not a P-splitter of Bi for all i, 1 ≤ i ≤ k. Ref ine(Π, B, B ) = Π \ {B} ∪ Ref ineΠ (B, B ). The algorithm is given below. P robBB(x = (S, r(x), − →, ), Π) Π := {S}; Πf := ∅; while Π = Πf do Πf := GV-standard-bb(Π, x); if exists (B, B ) := FindP-Split(Πf ) then Π := Refine(Πf , B, B ) od return Π Lemma 1. For an input PTS x with a set of states S, the ProbBB algorithm outputs S/∼ b . The “while loop” can be executed at most |S| − 1 times. GV-standard-bb is polynomial on the number of states and the number of transitions of x [17]. The procedure FindP-Split, which finds a pair (B, B ) with B being a P-splitter of B, is polynomial, as it boils down to comparing elements (rows) in the matrix representation of P. Thus, Proposition 1. ∼ b is decidable in polynomial time.

4

Branching Bisimulation and pCTL

In this section we present the logic that we use to express properties of probabilistic systems. The logic we consider is a variant of the pCTL logic of [11] and a simplification of the logic of [9]. However, we need to add semantics in the setting with τ steps. We follow the approach in [13], where it is shown that CTL is in full agreement with the non-probabilistic branching bisimulation of [16], by extending transition systems to doubly-labeled Kripke structures. In the latter, relations defined on transition systems and on Kripke structures can be easily compared. We also interpret the logic over a similar straightforward extension in the probabilistic setting. Definition 4 (PTS to Extended PTS). Let x = (Sn , Sp , r, →, ) be a PTS. EPTS(x) is defined as (Sn , Sp , r, − → , , L), where a

– Sn = Sn ∪ {(s, a, t) | a ∈ A \ {τ } and s − → t}; τ a a – − → = {(s, τ, s) | s − → s} ∪ {(s, a, (s, a, t)) | s − → t} ∪ {((s, a, t), a, t) | s − → t}; – L: S → A ∪ {⊥} such that L(s) =⊥ and L((s, a, t)) = a for any s ∈ Sn and for any (s, a, t) ∈ Sn , where ⊥ is a new constant, ⊥ ∈ A.


71

Intuitively, in EPTS(x) all states of PTS x are labeled with ⊥ and all transitions a a a s− → t where a = τ are ”split” into two transitions s − → (s, a, t) and (s, a, t) − → t. The added states (s, a, t) are labeled with a. On the other hand, an EPTS can be seen as a PTS if the labeling function L is ignored. In such a way, Def. 2 defines straightforwardly a branching bisimulation equivalence on EPTS. Proposition 2. Two states in a PTS x are branching bisimilar if and only if they are branching bisimilar in EPTS(x). To interpret the logic we need the standard notions of schedulers and paths on EPTSs. A scheduler resolves the non-deterministic choice by selecting one of possibly many action transitions, each time the execution reaches a nondeterministic node. This yields a fully probabilistic system, also called computation tree, which has the structure of probability space on paths associated to it. For a detailed description and definitions we refer to [5, 25]. The syntax of pCTL is generated by the following grammar: ψ := ⊥ | a | ¬ψ | ψ ∧ ψ | ∃Pp (ψU ψ ) where ∈ {, ≤, ≥}, p ∈ [0, 1], a ∈ A \ {τ }. Note that we neither include the usual CTL quantifiers A and E that range over paths like in [11], nor the next operator like in [9], since we consider branching bisimulation. Definition 5 (pCTL Semantics). For a given EPTS (Sn , Sp , r, − → , , L), satisfaction of a formula ψ in a state s, s ψ, is defined inductively: s ⊥ iff L(s) = ⊥; s a iff L(s) = a; s ¬ψ iff s ψ; s ψ ∧ ψ iff s ψ and s ψ ; s ∃Pp (ψU ψ ) iff there exists a scheduler σ such that the probability measure of the set of all paths in the computation tree induced by σ that start in s and satisfy formula ψU ψ is p, where a path ρ = s0 l1 s1 . . . satisfies formula ψU ψ , ρ ψU ψ , iff there exists n ≥ 0 such that sn ψ and, for all i < n, si ψ. Theorem 1. Branching bisimilar states in an EPTS satisfy the same pCTL formulas.

5

Probabilistic Process Algebra pACPτ

In this section we define a probabilistic process algebra pACPτ and give a ground-complete axiomatization for ∼ rb . In addition, we review the recursive verification rules of [3] in the new setting. pACPτ is an Extension of the Process Algebra ACP with operators that can specify probabilistic behavior and abstraction. The parallel composition operator is inherited from ACP, of course, with extended semantics. Let A again denote a set of atomic actions including the unobservable action τ . Let γ : A\{τ }×A\{τ } → A be a partial commutative and associative communication function [7]. The syntax of pACPτ is given by the following grammar: E ::= δ | a | E·E | E+E | E π E | EE | E E | E|E | ∂H (E) | τI (E) | x

72


for a ∈ A, π∈(0, 1), I, H ⊆ A \ {τ } and x ∈ V , where V is a set of recursion variables. pACPτ expressions that do not contain any variables are called closed expressions; otherwise, they are called open expressions. A guarded recursive specification, used to model infinite processes, is a finite set of equations of the form x = sx (V ), where x ∈ V and s is a pACPτ expression in which all occurrences of variables from V are guarded [7]. Moreover, the only operators allowed in s are: a, for a ∈ Aτ , +, π and · , and the latter one only in a form t · s for a closed pACPτ expression t. Thus, we restrict ourself to finitely definable processes, for the reasons explained in [6, 14]. We assume the following binding strengths: · > > +, i.e. · binds strongest. Operators and | bind equally as , and binds equally as +. Each pACPτ expression is interpreted as a PTS. We explain the semantic of the parallel composition and related to it operators only, for the other operators we refer to [3]. The parallel composition assumes that the probabilistic processes are mutually independent. Informally, if process p behaves as process p with probability π and q behaves as q with probability ρ, then the parallel composition, pq, behaves as p q with probability πρ, where the “subprocess” p q can perform an action from p or from q or can perform an action that is a result of communication (as in ACP). The left merge, communication and encapsulation operator have similar meanings as their counter-parts in ACP. The probability distribution of PTS p q (at the outermost level) is determined only by the distribution of p. The probability distribution of PTS p | q is the product of the distributions of p and q. Theorem 2 (Congruence theorem [25]). Rooted branching bisimulation is a congruence with respect to the operators in pACPτ . Axiomatization. The ground-complete axiomatization of rooted branching bisimulation is given in Table 1. Note that a condition of type x = x + x appears several times in the axioms. It describes processes that are not initially probabilistic in nature. For example, it does not hold for x ≡ a 1/2 b, since x + x in this case is represented by (a 1/2 b) 1/2 (a+b), but it applies if x ≡ a+b. It can be checked that if x ∼ rb x+x, then there exists a rooted branching bisimulation R such that (r(x), r(x+x)) ∈ R, and if x s and x t then (s, t) ∈ R. We briefly discuss the most important axioms of Table 1. Axiom PrB characterizes the rooted branching bisimulation. It is a counterpart of the branching axiom in the nonprobabilistic setting [16]: x·(y + τ·(y + z)) = x·(y + z). Due to the conditions y = y + y and z = z + z, it removes only a τ step that is followed by a process with a trivial (Dirac) outermost distribution, namely y + z. Moreover, process y + τ ·(y + z) may be an alternative of some probabilistic choice. The other alternatives of the probabilistic choice are captured by w, and, clearly, this part does not change when τ is removed. An interesting observation is that there is no axiom of type x·τ = x, because, as stated in Section 2, not all τ steps preceded by a process are inert. Actually, the variant x·τ ·y = x·y if y = y + y holds and can be derived from PrB. There are three main laws that axiomatize the parallel composition operator: PM1 and PM2 which describe the interplay of and , and the conditional


73

Table 1. Axioms of pACPτ . a, b ∈ A ∪ {δ}, I, H ⊆ A \ {τ }, w, x, y, z ∈ V A1 A2 AA3 A4 A5 A6 A7 TI1 TI1’ TI2 TI3 TI4

x+y = y+x (x + y) + z = x + (y + z) a+a=a (x + y)·z = x·z + y·z x·(y·z) = (x·y)·z x+δ = x δ·x = δ τI (a) = a if a∈I τI (a) = τ if a∈I τI (x + y) = τI (x) + τI (y) τI (x·y) = τI (x)·τI (y) τI (x π y) = τI (x) π τI (y)

PA1 PA2 PA3 PA4 PA5

x π y = y 1−π x π y) π+ρ−πρ z x π (y ρ z) = (x π+ρ−πρ x π x = x (x π y)·z = x·z π y·z (x π y) + z = (x + z) π (y + z)

D1 D2 D3 D4 D5

∂H (a) = a if a∈H ∂H (a) = δ if a ∈ H ∂H (x + y) = ∂H (x) + ∂H (y) ∂H (x·y) = ∂H (x)·∂H (y) ∂H (x π y) = ∂H (x) π ∂H (y)

M

x y = x y + y x + x | y if CF

PM1 PM2 LM2 LM3 LM4

x (y π z) = (x y) π (x z) (x π y) z = (x z) π (y z) a x = a·x a·x y = a·(x y) (x + y) z = x z + y z

CM1 CM2 CM3 CM4 CM5

x = x + x and y = y + y a | b = γ(a, b), if γ(a, b) defined a | b = δ, otherwise x | (y + z) = x | y + x | z (x + y) | z = x | z + y | z a | b·x = (a | b)·x a·x | b = (a | b)·x a·x | b·y = (a | b)(x y)

PrB x·((y + τ ·(y + z)) π w) = x·((y + z) π w) if y = y + y and z = z + z

axiom M which states on which processes the interleaving can be performed. PM1 and PM2 express that distributes (left and right) over . As long as at least one of the two parallel processes starts with a non-trivial probability distribution, these laws will be applied. Theorem 3 (Elimination theorem). Let p be a pACPτ closed expression. Then there is a pACPτ expression q without operators , , |, τI , and ∂H , such that pACPτ p = q. Theorem 4 (Soundness and ground completeness). Let p and q be pACPτ expressions represented by processes x and y, respectively. Then pACPτ p = q implies x ∼ rb y. If p and q are closed pACPτ expressions, then x ∼ rb y implies pACPτ p = q. Theorem 5. pACPτ is an equationally conservative extension of ACP with abstraction as defined in [7]. Recursive Verification Rules. These rules are needed to reason about systems in which (infinite) internal activity, non-determinism and/or probability distributions over observable events are involved. They capture the idea that, when abstracting from a set of internal events, eventually an observable event

74


will be chosen. They mainly describe the effect τ -loops may have on certain combinations of probabilistic and non-deterministic choices. Assuming i, j ∈ I ⊆ A \ {τ }, we formulate the following rules (see also [3]) x = y+i · x, y = y + y x = z π (u+i · x), z = z+u, z = z+z , VR2 , and τ · τI (x) = τ · τI (y) τ · τI (x) = τ · τI (z) x = z+i · y, y = z π (u+j · x), z = z + z, z = z + u, VR3 . τ · τI (x) = τ · τI (y ) for y = z π (u+i · y ) VR1

Due to the presence of non-deterministic choice, the fairness rules from the nonprobabilistic setting such as KFARs [7] appear in our setting as well, and VR1 is the simplest one. Rules VR2 and VR3 have a condition of the form z = z + u. Informally, it states that every process which can be reached from z in one step with a positive P -probability can mimic all activities of u. Proposition 3. Let z and u be PTSs such that z ∼ rb z + z and z ∼ rb z + u. There exists a rooted branching bisimulation R such that (r(z), r(z + z)), a → t (r(z), r(z + u)) ∈ R and, for all n, n , t such that r(z) n, u n and n − a for a ∈ A, there exists a transition n − → t for some t, such that (t, t ) ∈ R. VR2 expresses a situation in which, due to a τ -loop, a summand u of probabilistic process x can be dropped without affecting the behavior of x. The two conditions: z = z + z and z = z + u guarantee that every subprocess reachable from r(x), can perform the same set of actions that z can perform, and continue with the equivalent behavior to the one of z afterwards. These actions can be performed either directly in one step or after performing a τ -step back to the initial state of x. Under these conditions, the root of x and all nodes reachable from it in one probabilistic transition, are equivalent. Similarly for VR3 . Theorem 6. VR1 , VR2 and VR3 are sound w.r.t. ∼ rb .

6

Verification of the CAB Protocol

The main purpose of this section is to investigate whether the process algebra and the verification rules of Section 5 are effective in verification of transmission protocols. We do so by verifying the Concurrent Alternating Bit Protocol(CABP). CABP is used to reliably deliver data via an unreliable channel, using a system of acknowledgements. In order to overcome a possible loss of data, CABP continuously (re)sends the same datum until it receives an acknowledgement, confirming its correct delivery. Specification of CABP. CABP is described by six separate processes that communicate with each other: sender S and receiver R of data, sender AS and receiver AR of acknowledgments, and two channels, one carrying data (K), and the other one carrying acknowledgements (L). Probabilities are used to model the unreliable behavior of the channels. All six processes together model the entire protocol. A sketch of the system is provided in Fig. 1. Numbers 1 through 8 represent the gates at which actions are communicated.

On Compositionality, Efficiency, and Applicability of Abstraction M1

75

M1 1

S

3

K

4

L

6

8

AR

2

R

1

5 7

2

8

5

AS

M2

M2

Fig. 1. a.) Layout of the CABP. b.) External behavior of the two modules. Table 2. Specification of the sender, the receiver and the channel. π, ρ and 1−π−ρ model the probability that a message is sent correctly, corrupted or lost. Sender:

S = RM(0) P RM(b∈Bit) = d∈D r1 (d) · SF(d, b) SF((d, b)∈D×Bit) = s3 (d, b) · SF(d, b) + r8 (ac) · RM(1 − b)

Receiver: R RF(b∈Bit)

= = + RS((d, b)∈D×Bit) =

RF(0) P Pd∈D r4 (d, b) · RS(d, b) d∈D r4 (d, 1 − b) · RF(b) + r4 (⊥) · RF(b) s2 (d) · s5 (ac) · RF(1 − b)

P Channel: K = (d,b)∈D×Bit r3 (d, b) · Ks (d, b) Ks ((d, b)∈D×Bit) = (s4 (d, b) π s4 (⊥) ρ k) · K

We group these processes in two logical modules: module M1 is responsible for transmitting data and contains processes S, K, and R, while module M2 is responsible for transmitting acknowledgements and contains AS, L and AR. CABP is described by the parallel composition of these two modules. Thespecifications of the components of module M1 are given in Table 2, where is a short-hand notation for a non-deterministic choice of finitely many processes. We briefly sketch the intuition behind the processes of module M1 . The set D denotes a finite set of data elements. The sender, modeled by process S, uses action r1 to receive a datum from its environment. This datum, augmented with a bit (for acknowledgement purposes), is then repeatedly sent using action s3 . Alternatively, an acknowledgement is received using action r8 . The receiver reads data from the communication channel K using action r4 . A corrupted datum is represented by ⊥ (a mechanism for detecting faulty data is assumed). If a noncorrupted, expected datum is received (i.e. it carries the expected acknowledgement bit), it is sent to the environment via action s2 and the acknowledgement sender is triggered via action s5 . Finally, the unreliable channel uses action r3 for receiving a datum, action s4 for sending a (possibly corrupted) datum and action k for losing a datum. We distinguish between the external and the internal behavior of module M1 . The communications between the actions of module M1 are defined using a function γ, given by γ(rj (d, b), sj (d, b)) = cj (d, b), j = 3, 4 and γ(r4 (⊥), s4 (⊥)) = c4 (⊥) for all data (d, b)∈D×Bit. Process ∂H (S K R) then describes the

76


internal behavior of M1 , where H = {s3 (d, b), r3 (d, b), s4 (d, b), r4 (d, b), s4 (⊥), r4 (⊥) | (d, b)∈D×Bit} contains all actions that need to be blocked to enforce communication. The external behavior of module M1 is the behavior of module M1 after abstracting from the communications between the components in M1 , viz. the actions in the set I = {c3 (d, b), c4 (d, b), c4 (⊥), k | (d, b)∈D×Bit}. The external behavior of module M1 , thus, can be represented by τI (∂H (S K R)). Verification of the CABP. Our aim is to rewrite the process representing the external behavior of module M1 to a simpler process, for which it is easier to check that it behaves the way it is meant to behave. Similarly for M2 . From these simple specifications of the external behaviors of both modules, we can easily derive the process that represents the behavior of the entire protocol. The result for M1 is formulated in the following lemma. A similar statement holds for module M2 . NA is a special new constant, such that, every subprocess that is not of any interest to the overall behavior of the system is replaced by NA. Lemma 2. In pACPτ +V R1 + V R2 + V R3 it holds τI (∂H (S K R)) = M1 , where M1 (the external behavior of M1 ) is specified by: M1 = V1 (0), V1 (b∈Bit) = d∈D r1 (b) · V2 (b, d), V2 (b∈Bit, d∈D) = r8 (ac)·NA + s2 (d)·V3 (b, d), V3 (b∈Bit, d∈D) = r8 (ac)·NA+s5 (ac)·V4 (b, d), V4 (b∈Bit, d∈D) = r8 (ac)·V1 (1−b). Theorem 7. In pACPτ +V R1 +V R2 +V R3 it holds: τ · τI∪J (∂H∪G (SKRASLAR)) P r1 (d) · s2 (d) · τI∪J (∂H∪G (SKRASLAR)). =τ· d∈D

From Theorems 1, 4, 6 and 7 we obtain that the CABP has the same pCTL properties as a one-place buffer.

7

Conclusion and Related Work

We showed that the branching bisimulation of [25] that is congruence for parallel composition has several desirable properties. It is decidable in polynomial time and it preserves probabilistic CTL formulas. Moreover, by giving a groundcomplete axiomatization and supporting recursive abstraction rules, we showed that, although restrictive at first sight, it can fruitfully be used to verify protocols such as the CAB protocol. To our knowledge, this is the first weak equivalence on probabilistic systems enjoying all three of these properties. Related work. Combining probabilistic and nondeterministic choices has turned out to be rather cumbersome to be captured within a general framework [24]. Many different approaches from axiomatic perspective have been taken, depending on the interpretation of the two types of choices and their interoperability (e.g. [1, 3, 14, 18, 19, 20]). To our knowledge, process algebra with probability, nondeterminism, abstraction, parallel composition and recursion has been previously considered only


77

in [14]. The underlying semantical model are simple probabilistic automata (automata in short) [22]. This model is shown to be comparable to the alternating model [10, 23, 24], but when abstraction is not considered. When weak relations are defined, to achieve transitivity, it should be allowed for a single transition to be simulated by a convex combination of several transitions. A side-effect of this property is that weak equivalences in the automata model are not decidable in polynomial time [12]. On the other hand, the branching bisimulation that we consider in this paper, and the branching bisimulation for the automata model, both do not relate the processes a·τ ·(x π y) and a·(x π y), for x = y. The axioms that characterize the rooted branching bisimulation studied here can be compared with those given in [3] that characterize the rooted version of the weaker branching bisimulation of [5]. In [3] there are two additional axioms: x · τ = x and x · (τ · z π z) = x · z. The absence of the first equation here is discussed in Section 5, while the latter equation with a restriction z + z can be easily derived from PrB by taking δ for y and z for w. Logical characterization of various equivalences for Markov chains is treated in details in [8]. In [15] the semantics of pCTL* of [11] is extended to treat internal steps. Behaviors, on which path formulas are interpreted, ignore states with τ steps, together with the τ steps. With this semantic they show that the weak bisimulation of [21] is sound and complete for the presented logic. However, this semantics implies that two non-probabilistic systems that satisfy the same formulas are not necessary branching bisimilar. Our idea, on the other hand, was to extend the semantics in such a way, that it immediately follows that if two non-probabilistic systems satisfy the same formulas, then they are branching bisimilar. For these reasons, we built on [13], rather than on [15] or [22]. Acknowledgements. We would like to thank Jos Baeten, Erik de Vink and the anonymous reviewers for the useful remarks.

References ´ 1. Aceto, L., Esik, Z., Ing´ olfsd´ ottir, A.: Equational axioms for probabilistic bisimilarity. In: Kirchner, H., Ringeissen, C. (eds.) AMAST 2002. LNCS, vol. 2422, pp. 239–253. Springer, Heidelberg (2002) 2. Andova, S., Baeten, J.C.M., D’Argenio, P.R., Willemse, T.A.C.: A compositional merge of probabilistic processes in the alternating model. In: NWPT 2006 (2006) 3. Andova, S., Baeten, J.C.M., Willemse, T.A.C.: A complete axiomatisation of branching bisimulation for probabilistic systems with an application in protocol verification. In: Baier, C., Hermanns, H. (eds.) CONCUR 2006. LNCS, vol. 4137, pp. 327–342. Springer, Heidelberg (2006) 4. Andova, S., Georgievska, S., Trˇcka, N.: On compositionality, efficiency, and applicability of abstraction in probabilistic systems (2008), http://www.win.tue.nl/∼ sgeorgie/processalgebra.pdf 5. Andova, S., Willemse, T.A.C.: Branching bisimulation for probabilistic systems: characteristics and decidability. Theor. Comput. Sci. 356(3), 325–355 (2006) 6. Baeten, J.C.M., Bravetti, M.: A ground-complete axiomatization of finite state processes in process algebra. In: Abadi, M., de Alfaro, L. (eds.) CONCUR 2005. LNCS, vol. 3653, pp. 248–262. Springer, Heidelberg (2005)

78


7. Baeten, J.C.M., Weijland, W.P.: Process Algebra. Cambridge Tracts in Theoretical Computer Science, vol. 18. Cambridge University Press, Cambridge (1990) 8. Baier, C., Katoen, J.-P., Hermanns, H., Wolf, V.: Comparative branching-time semantics for Markov chains. Inf. Comput. 200(2), 149–214 (2005) 9. Baier, C., Kwiatkowska, M.: Model checking for a probabilistic branching time logic with fairness. Distrib. Comput. 11(3), 125–155 (1998) 10. Bandini, E., Segala, R.: Axiomatizations for probabilistic bisimulation. In: Orejas, F., Spirakis, P.G., van Leeuwen, J. (eds.) ICALP 2001. LNCS, vol. 2076, pp. 370– 381. Springer, Heidelberg (2001) 11. Bianco, A., de Alfaro, L.: Model checking of probabalistic and nondeterministic systems. In: Thiagarajan, P.S. (ed.) FSTTCS 1995. LNCS, vol. 1026, pp. 499–513. Springer, Heidelberg (1995) 12. Cattani, S., Segala, R.: Decision algorithms for probabilistic bisimulation. In: Brim, L., Janˇcar, P., Kˇret´ınsk´ y, M., Kucera, A. (eds.) CONCUR 2002. LNCS, vol. 2421, pp. 371–385. Springer, Heidelberg (2002) 13. De Nicola, R., Vaandrager, F.W.: Three logics for branching bisimulation. JACM 42(2), 458–487 (1995) 14. Deng, Y., Palamidessi, C., Pang, J.: Compositional reasoning for probabilistic finite-state behaviors. In: Middeldorp, A., van Oostrom, V., van Raamsdonk, F., de Vrijer, R. (eds.) Processes, Terms and Cycles: Steps on the Road to Infinity. LNCS, vol. 3838, pp. 309–337. Springer, Heidelberg (2005) 15. Desharnais, J., Gupta, V., Jagadeesan, R., Panangaden, P.: Weak bisimulation is sound and complete for PCTL*. In: Brim, L., Janˇcar, P., Kˇret´ınsk´ y, M., Kucera, A. (eds.) CONCUR 2002. LNCS, vol. 2421, pp. 355–370. Springer, Heidelberg (2002) 16. van Glabbeek, R.J., Weijland, P.: Branching time and abstraction in bisimulation semantics. JACM 43(3), 555–600 (1996) 17. Groote, J.F., Vaandrager, F.: An efficient algorithm for branching bisimulation and stuttering equivalence. In: Paterson, M. (ed.) ICALP 1990. LNCS, vol. 443, pp. 626–638. Springer, Heidelberg (1990) 18. Hansson, H.A.: Time and Probability in Formal Design of Distributed Systems. Elsevier, Amsterdam (1994) 19. Mislove, M.W., Ouaknine, J., Worrell, J.: Axioms for probability and nondeterminism. ENTCS 96, 7–28 (2004) 20. Morgan, C., McIver, A., Seidel, K., Sanders, J.W.: Refinement-oriented probability for CSP. Formal Aspects of Computing 8(6), 617–647 (1996) 21. Philippou, A., Lee, I., Sokolsky, O.: Weak bisimulation for probabilistic systems. In: Palamidessi, C. (ed.) CONCUR 2000. LNCS, vol. 1877, pp. 334–349. Springer, Heidelberg (2000) 22. Segala, R., Lynch, N.: Probabilistic simulations for probabilistic processes. Nordic J. of Computing 2(2), 250–273 (1995) 23. Segala, R., Turrini, A.: Comparative analysis of bisimulation relations on alternating and non-alternating probabilistic models. In: QEST 2005, pp. 44–53. IEEE Computer Society Press, Los Alamitos (2005) 24. Sokolova, A., de Vink, E.P.: Probabilistic automata: system types, parallel composition and comparison. In: Baier, C., Haverkort, B.R., Hermanns, H., Katoen, J.-P., Siegle, M. (eds.) Validation of Stochastic Systems. LNCS, vol. 2925, pp. 1–43. Springer, Heidelberg (2004) 25. Trˇcka, N., Georgievska, S.: Branching bisimulation congruence for probabilistic systems. In: QAPL 2008, ENTCS (to appear, 2008), http://www.win.tue.nl/∼ sgeorgie/TG08report.pdf

Framed Versus Unframed Two-Dimensional Languages Marcella Anselmo1 , Natasha Jonoska2 , and Maria Madonia3 1

3

Dipartimento di Informatica ed Applicazioni, Universit` a di Salerno I-84084 Fisciano (SA), Italy [email protected] 2 Department of Mathematics and Statistics, University of South Florida, Tampa FL 33620, USA [email protected] Dip. Matematica e Informatica, Universit` a di Catania, Viale Andrea Doria 6/a, 95125 Catania, Italy [email protected]

Abstract. In this paper we study a class of factor-closed tiling recognizable languages (FREC) that corresponds to certain symbolic dynamical systems called sofic subshifts. This class of languages is a subclass of the two-dimensional class of tiling recognizable languages, denoted REC. Differently from REC, languages in FREC can be recognized without framing pictures with a special boundary symbol. We study (un)ambiguity properties of FREC in comparison to the ones in REC. We show that a frame surrounding each block provides additional memory that can enforce the size and the content of pictures and can change (un)ambiguity properties. Consequently, we propose several variations of “unambiguity” for languages in FREC which may be better suited to understand this class.

1

Introduction

Two-dimensional languages are sets of two-dimensional arrays of symbols over a finite alphabet, also called blocks or pictures. Recognizable two-dimensional languages (REC) were introduced in [11] as a natural extension of one-dimensional regular languages. The definition that is extended to two dimensions is a characterization of a one-dimensional regular language as a projection of a local language [9]. A language is called local if it consists of all strings whose factors inside a sliding window of size 1 × 2 are part of a given finite set of two-symbol words called “dominoes”. In this definition a special boundary symbol inserted in the dominoes indicates the beginning and the end of the string. A language is regular if it is a symbol-to-symbol projection of a local language. In finite

N.J. is partially supported by the NSF grants CCF #0523928 and CCF #0726396. M.A. and M.M. by MIUR Project “Automi e Linguaggi Formali: aspetti matematici e applicativi” (2005), by ESF Project AutoMathA” (2005-2010), by 60% Projects of University of Catania and Salerno (2006, 2007).


80

M. Anselmo, N. Jonoska, and M. Madonia

automata, the states of an automaton can be considered as symbols of the local language while the boundary symbol specifies “initial” and “final” states. Similarly, in two dimensions, each rectangular block of a recognizable picture language is surrounded by a frame made of a special boundary symbol. In two dimensions, testing whether a picture belongs to a local language is obtained by verifying whether every subblock inside a sliding window of size 2 × 2 belongs to a given finite set of 2 × 2 “tiles”. The REC family can be characterized in terms of automata, logic, grammars and regular expressions [12]. On the other side, tilings of the plane with Wang tiles have been extensively studied since early 1960s (for example [6,14,22]) and they are closely related to two-dimensional symbolic dynamical systems ([8,15,16,17,18]). Roughly speaking, two-dimensional symbolic dynamical systems, called subshifts of finite type are sets of tilings of the plane with Wang tiles invariant under translations. A subshift obtained as a symbol-to-symbol projection of a subshift of finite type is called sofic. A two-dimensional subshift uniquely determines the set of rectangular (finite) blocks (or pictures) that can be excised out of the tilings [18]. Such languages of pictures are in fact factor-closed and extendable (ultimately to a tiling of the plane). Languages that correspond to subshifts of finite type are a subclass of local two dimensional languages, whereas those that correspond to the sofic subshifts, are a subclass of REC. Due to being factor-closed and extendable, it seems natural to define such local and recognizable languages without frames surrounding the blocks. In this paper we consider picture languages without frames surrounding the pictures (called here FREC) and compare the change in a variety of properties under the framed vs unframed approaches. More specifically the paper focuses on determinism and unambiguity. In any computational model, determinism means unique choice of the next step in an allowed computation, while an unambiguous model requires that each accepted object admits only one successful computation. Both determinism and unambiguity correspond to some sort of uniqueness in the process of computation, but while determinism seems to be a “local” notion, unambiguity could be considered to be a “global” one. Normally determinism implies unambiguity. In [3], deterministic recognizable languages (DREC) were defined in the context of framed two-dimensional languages, while unambiguous ones (UREC) have been introduced in [11]. Some questions related to ambiguity in connection with determinism of framed recognizable picture languages has been studied in [1,2,3,4]. Ambiguity is also central to many open questions in two-dimensional symbolic dynamics; for example some related to entropy questions that are solved in one dimension [18], remain open in the two-dimensional case (see for example [20,21]). A natural question arises: to what extent the determinism and unambiguity properties of framed recognizable languages (REC) can be transferred to the unframed ones (FREC) and vice versa. As FREC is a subclass of REC, it is natural to expect that analogous determinism and unambiguity properties of languages in REC naturally hold in FREC. However, we show that this is not necessarily

Framed Versus Unframed Two-Dimensional Languages

81

the case. In fact, it turns out that the frame surrounding the blocks provides additional memory that, besides enforcing size and content of the recognized pictures, can also reduce the ambiguity of a language (Remark 5). The paper is organized as follows. In Section 2, we define FREC family and characterize it as a subset of REC. In Section 3, we recall definitions and results on determinism and unambiguity in REC. The same notions are introduced for FREC in Section 4; note that in this case we need to introduce a variety of new notions of ambiguity. Some results about finite and infinite ambiguity in FREC are presented in Section 5, while decidability properties are contained in Section 6. In the last section we point out similarities and differences between framed and unframed languages.

2

REC and FREC

In this section we briefly recall the definitions of two-dimensional local and recognizable languages introduced in [11,12] utilizing a special boundary symbol used to frame the rectangular arrays. We also introduce the class FREC of factorial recognizable languages that corresponds to the class of languages that define symbolic dynamical systems called sofic shifts [8,19]. Languages in this class are always factorial (also known as factor-closed) and extendable to a full tiling of the plane, consequently framing the arrays with a special boundary symbol is not needed. A block or picture over a finite alphabet Σ is a two-dimensional rectangular array of elements of Σ. Given a picture p, let r(p) = m, denote the number of rows and c(p) = n the number of columns of p; the pair (m, n) is called the size of p. The set of all pictures over Σ of size (m, n) is denoted by Σ m,n . The set of all pictures over Σ is denoted by Σ ∗∗ . A two-dimensional language (or a picture language) over Σ is a subset of Σ ∗∗ . The first recognition method, following the definition in [11,12], consists in surrounding the pictures with a boundary symbol and looking for allowed subpictures inside a window 2 × 2. Hence, for any picture (or block) p of size (m, n), we consider the framed picture p of size (m + 2, n + 2) obtained by surrounding p with a special boundary symbol # ∈ Σ. A tile is a picture of dimension (2, 2) and Bm,n (p) is the set of all sub-pictures, also called here factors, of size (m, n) x y then of a picture p. In particular, if t is a tile t = w z z # # w # # # # w z y # # x # # ˆ B2,2 (t) = t, , , , , , , , . # # # # y # # x # # z # # w x y Given an alphabet Γ , a two-dimensional language L ⊆ Γ ∗∗ is local if there exists a finite set Θ of tiles over Γ ∪ {#} such that L = {p ∈ Γ ∗∗ |B2,2 ( p) ⊆ Θ} and we write L = L(Θ). We denote by LOC(Γ ) the family of all local picture languages over Γ . When the alphabet is understood from the context we simply write LOC, and the same convention is used for all other classes of languages in the sequel.

82


A tiling system is a quadruple (Σ, Γ, Θ, π) where Σ and Γ are finite alphabets, Θ is a finite set of tiles over Γ ∪ {#} and π : Γ → Σ is a projection. A two-dimensional language L ⊆ Σ ∗∗ is tiling recognizable if there exists a tiling system (Σ, Γ, Θ, π) such that L = π(L(Θ)) (extending π on the arrays). We denote by REC(Σ) (or simply REC) the family of all tiling recognizable two-dimensional languages over Σ. Example 1. Let Γ = {0, 1} and Lsq ⊆ Γ ∗∗ be the language of square pictures (i.e. pictures with as many rows as columns) with 1 on the main diagonal and 0 elsewhere. Lsq is local; Lsq = L(Θ) where Θ = B2,2 (tˆ) and t is the square of side 4 in Lsq . Let now Σ = {a} and L be the language of square pictures on Σ. L ∈ REC since L = π(Lsq ) where π is the projection mapping 0 and 1 to a. Let us introduce factorial recognizable languages. For a language L, denote by F (L) the set of all factors of L. We say that L is factor-closed if L = F (L). Definition 1. Given an alphabet Γ , a two-dimensional language L ⊆ Γ ∗∗ is factorial local if there exists a finite set Θ of tiles over Γ such that L = F ({p ∈ Γ ∗∗ |B2,2 (p) ⊆ Θ}), and we write L = Lu (Θ). We denote by FLOC(Γ ) the family of all factorial local two-dimensional languages over Γ . Definition 2. An unbordered tiling system is a quadruple (Σ, Γ, Θ, π) where Σ and Γ are finite alphabets, Θ is a finite set of tiles over Γ and π : Γ → Σ is a projection. A two-dimensional language L ⊆ Σ ∗∗ is factorial tiling recognizable if there exists an unbordered tiling system (Σ, Γ, Θ, π) such that L = π(Lu (Θ)) (extending π on the arrays). We denote by FREC(Σ) the family of all factorial tiling recognizable picture languages over Σ. Definition 3. A tiling system (Σ, Γ, Θ, π) for L ⊆ Σ ∗∗ is trim if for any Θ Θ, π(L(Θ )) π(L(Θ)). Remark 1. (a) If L ∈ FLOC then L ∈ LOC. Indeed, if L ∈ FLOC, then L = t). Lu (Θ) for some set of tiles Θ. Consider the set of tiles Θ# = Θ ∪ t∈Θ B2,2 ( It follows that L = L(Θ# ) and, therefore, L ∈ LOC. (b) Note that for a local language L, L ∈ FLOC if and only if L = F (L); therefore, L ∈FLOC if and only if F (L) ∈ FLOC. (c) If L ∈ FREC then L ∈ REC. The vice versa does not hold. Indeed if L ∈ FREC then L is factor-closed, while REC (and similarly LOC) also contains not factor-closed languages (e.g. the languages of square pictures in Example 1). Following Remark 1 (a), FRECREC. The following proposition provides a way to characterize FREC as a subset of REC. Proposition 1. L ∈ F REC if and only if L ∈ REC and L = π(K) where K is a factor-closed local language.


83

Proof. Suppose L ∈ F REC. Then L ∈ REC (see Remark 1). Moreover, the language L(Θ# ), where Θ# is defined as in Remark 1, is local and factor-closed by construction, and L = π(L(Θ# )). Suppose L ∈ REC and L = π(K) for some factor-closed local language K i.e. there exists a tiling system T = (Σ, Γ, Θ, π) for L such that L(Θ) = K is factor-closed. Without loss of generality we assume that T is trim. Note that, if t) ⊆ Θ: since T is trim, any tile t must occur as a factor a tile t ∈ Θ, then B2,2 ( of some p ∈ K = L(Θ) and, since K is factor-closed, t ∈ K = L(Θ) too. Now, consider the set of tiles Θno# = Θ ∩ Γ 2,2 . We observe that L = π(Lu (Θno# )), i.e., L ∈ FREC. If p ∈ π(Lu (Θno# )) then p = π(p ) for some t) ⊆ Θ, we p ∈ Lu (Θno# ). Consider the picture p : since for any t ∈ Θ, B2,2 ( have that all factors of size (2, 2) of pˆ lying along the first two and the last two rows, as well as the leftmost two columns and the rightmost two columns of p are in Θ. Therefore B2,2 (p ) ⊆ Θ and p ∈ π(L(Θ)) = L. The other inclusion, L ⊆ π(Lu (Θno# )), follows directly from the definitions. Proposition 2. There exists a language L ∈ LOC such that F (L) ∈ LOC. Proof. Let Lsq be the set of squares with 1 on the main diagonal and 0 elsewhere, as in Example 1. We have that Lsq ∈ LOC and F (Lsq ) ∈ / LOC. Otherwise, if # # , F (Lsq ) ∈ LOC and F (Lsq ) = L(Θ), then Θ would also contain tiles 0 1 # # . Then some pictures with more than one 1 in the first row would belong 1 0 to L(Θ), but not to F (Lsq ).

3

Determinism and Unambiguity in REC

The definition of determinism for two-dimensional recognizable languages is discussed and introduced in [3], where deterministic recognizable languages (DREC) are defined according to some direction from corner to corner of pictures. Determinism is in fact an “oriented” notion, even in the one dimensional case. Unambiguous recognizable languages (UREC) have been introduced in [11]. A language belongs to UREC when every picture has a unique pre-image in its corresponding local language; and this is an “orientation-free” notion. Ambiguity for framed recognizable picture languages has been studied in connection with determinism in [1,2,3,4]. Deterministic recognizable languages are defined according to one of the four corner-to-corner directions: from top-left corner towards the bottom-right corner (denoted tl-br for short), and all the others corner-to-corner directions in the set Cor-Cor= { tl-br, tr-bl, bl-tr, br-tl } using a similar notation. A tiling system (Σ, Γ, Θ, π) is tl-br-deterministic if for any γ1 , γ2 , γ3 ∈ Γ ∪ {#} γ γ and σ ∈ Σ there is at most one tile 1 2 ∈ Θ, with π(γ4 ) = σ. Similarly dγ3 γ4 deterministic tiling systems are defined, for any d ∈Cor-Cor. A recognizable twodimensional language L is deterministic, if it is recognized by a d-deterministic

84


tiling system for some corner-to-corner direction d. Denote by DREC(Σ) the class of deterministic recognizable two-dimensional languages over the alphabet Σ. A tiling system (Σ, Γ, Θ, π) for L ⊆ Σ ∗∗ is unambiguous if for any picture p ∈ L there exists a unique local picture p ∈ L(Θ) such that p = π(p ) (p is said a pre-image of p). L is unambiguous if it is recognized by an unambiguous tiling system and UREC(Σ) denotes the family of all unambiguous two-dimensional languages over Σ. As one may expect, in REC, determinism implies unambiguity. Furthermore in [3] it is shown that DREC is strictly included in UREC and UREC in REC; the strict inclusions hold even if the alphabet is unary [2]. Let us now introduce the definitions of k-ambiguity, finite and infinite ambiguity for languages in REC. A similar definition of k-ambiguity for languages in REC is contained in [10]. Definition 4. A tiling system T = (Σ, Γ, Θ, π) recognizing L is said to be kambiguous if every picture p ∈ L has at most k pre-images. We say that a recognizable language L is k-ambiguous if k = min{s | T is s-ambiguous tiling system and T recognizes L }. We say that L is finitely ambiguous if it is k-ambiguous for some k and that L is infinitely-ambiguous if it is not finitely ambiguous. Example 2. Consider the language, denoted here L01 , of pictures on Σ = {0, 1} with at most one occurrence of 1. It is clear that L01 is factor-closed. We observe that L01 is in UREC: indeed we can consider a local alphabet {1, a, b, c, d, e, f, g, h} and a projection that maps all symbols to 0 except 1 which is mapped onto itself. Below it is an example of a picture p ∈ L01 with its corresponding pre-image p . # # # p = # # #

# 0 0 0 0 #

# 0 0 0 0 #

# 0 1 0 0 #

# 0 0 0 0 #

# # # # # #

# # # p = # # #

# e a g g #

# e a g g #

# c 1 d d #

# f b h h #

# # # # # #

The boundary constraints on the local symbols are such that only one of the symbols, say g can be surrounded by the boundary symbol, whereas for all other symbols there is at least one direction in which the boundary symbol cannot appear (for example a# is not allowed to appear in any tile). Therefore the only picture in the local language made of symbols other than 1 is a picture of all g, ensuring that pictures of all 0’s in L01 have unique pre-images. If by the contrary we allow symbols e, f , g, h be surrounded by # then the tiling system would be 4-ambiguous. In REC one sometimes considers some intermediate notions between determinism and unambiguity: the column- and the row-unambiguity. The resulting classes Col-UREC and Row-UREC strictly separate DREC from UREC (see [3]).


4

85

Determinism and Unambiguity in FREC

All the definitions of determinism, unambiguity and k-ambiguity in REC (see Section 3) extend to languages in FREC as well by taking unbordered tiling systems. Moreover, let us denote by DFREC(Σ) and UFREC(Σ), respectively, the families of all deterministic and unambiguous factorial recognizable twodimensional languages over Σ. Let us now introduce column- and row-unambiguous factorial recognizable languages, in an analogous way as for REC ([3]). With a notation similar to the one used for Cor-Cor, consider the set Side-Side of four side-to-side directions, i.e., Side-Side= { l-r, r-l, t-b, b-t }. Definition 5. An unbordered tiling system (Σ, Γ, Θ, π) is l-r-unambiguous if for any column col ∈ Γ m,1 , and column p ∈ Σ m,1 , there exists at most one column col ∈ Γ m,1 , such that π(col ) = p and col col ∈ L(Θ). Similar properties define d-unambiguous unbordered tiling systems, for any side-to-side direction d ∈ Side-Side. We say that a factorial recognizable language is column-unambiguous if it is recognized by a d-unambiguous unbordered tiling system for some d ∈ { l-r, r-l} and it is row-unambiguous if it is recognized by a d-unambiguous unbordered tiling system for some d ∈ { t-b, b-t}. Finally, we denote by Col-UFREC(Σ) the class of column-unambiguous factorial recognizable languages over the alphabet Σ and by Row-UFREC(Σ) the class of row-unambiguous factorial recognizable languages over the alphabet Σ. Consider the following examples. Example 3. The language L01 of pictures on Σ = {0, 1} with at most one occurrence of 1, as in Example 2, is in FREC. It can be recognized with the unbordered tiling system obtained from the tiling system in Example 2, by removing all of the tiles that contain the boundary symbol. Observe that L01 is in DFREC and it is infinitely ambiguous. For every tiling system recognizing L01 the symbol 0 must have at least two pre-images, say A, B. This is necessary in order to mark the appearance of 1 in the picture. Then every picture sliding along the boundaries of these two regions (without containing the symbol(s) that maps onto 1) projects on a block of all 0’s. Therefore pictures of all 0’s have a number of pre-images proportional to their size. Example 4. Consider the language L1 of all the pictures with exactly one column of b’s and a elsewhere, together with all their factors. Note that L1 is in FREC. Indeed, it can be recognized by an unbordered tiling system T in which symbol a has two different pre-images, one to mark “left” of column b and the other to mark “right” of column b. Further L1 is in Row-UFREC and Col-UFREC (T is column- and rowunambiguous) and it is 2-factorial-ambiguous (for any trim unbordered tiling system, a must have at least two pre-images. Furthermore T is an unbordered tiling system in which any picture has at most 2 pre-images).

86


Example 5. Consider language Labc consisting of pictures in L1 with some rows of c’s (eventually) concatened above and below them, together with all their factors. Labc is 2-factorial ambiguous (analogous as in Example 4). On the other hand it is not in Row-UFREC: for any unbordered tiling system for Labc , symbol a has two pre-images at least; and we cannot decide which is the local symbol to choose above (or below) a local symbol for c. Unambiguous languages in FREC coincide with factorial local languages. Whereas, there are unambiguous languages in REC that are not local (for example language L in Example 1). Proposition 3. F LOC = U F REC. Proof. If L ∈ F LOC then π is the identity and then L ∈ U F REC. If L ∈ U F REC then any symbol in Σ (viewed as a picture of size (1, 1)) has a unique pre-image. Then π is a one-to-one mapping and L ∈ F LOC. We consider several variations of ambiguity. The classes of languages in FREC, as introduced so far, can be inserted in a scenario where they are classified according to the growth of the number of pre-images of pictures, as a function of the size of the picture. Observe that, in general, if L ∈ F REC is recognized by an unbordered tiling system T with γ symbols in Γ and p is a picture of size (m, n) then, trivially, p can have at most γ m×n pre-images. But we can have different situations corresponding to different levels of ambiguity. In the following, L is a language recognized by a tiling system T = (Σ, Γ, Θ, π) with γ symbols in Γ . 1) Any picture p ∈ L has at most one pre-image in Lu (Θ). These are languages in UFREC. 2) Any picture p ∈ L has at most one pre-image p in Lu (Θ), once a symbol in a corner of p is fixed. This class contains languages in Col-UFREC∩RowUFREC (the unambiguity on the next column/row, is required for columns/rows of any length: 1, 2, ... ). They are finitely ambiguous (any picture has at most γ pre-images, see Proposition 6). 3) Any picture p ∈ L has at most one pre-image p in Lu (Θ), once the first column (resp. the first row) of p is fixed. This class contains languages in ColUFREC (resp. Row-UFREC). They may be infinitely ambiguous, but any picture has at most γ m (resp. γ n ) pre-images. 4) Any picture p ∈ L has at most one pre-image p in Lu (Θ), once two consecutive sides on the perimeter of p are fixed. This class contains languages in DFREC. They may be infinitely ambiguous, but any picture has at most γ m+n−1 pre-images (if T is tl-br-deterministic, once the symbols for the first row and the first column of p are fixed, then p has at most one pre-image; there are at most γ m+n−1 such choices). Extending on the above classification it is natural to introduce a class of languages where for every block p ∈ L there is a unique pre-image p in Lu (Θ) once we fix the whole perimeter of p .


87

Definition 6. Let T be an unbordered tiling system (Σ, Γ, Θ, π) recognizing L. Let p ∈ L and f be an inverse image of a frame that consists of first and last row of p and first and last column of p. We say that T is frame-unambiguous at p if there is at most one p ∈ Lu (Θ) with π(p ) = p such that the first and last row of p and the first and last column of p form the frame f . The tiling system T is frame-unambiguous if it is frame-unambiguous at p for every p ∈ L. A language L is frame-unambiguous if it is recognized by a frame-unambiguous unbordered tiling system. Example 6. Consider again language L01 . The unbordered tiling system sketched in Example 2 is frame-unambiguous. The definition of frame-unambiguity has several meanings and motivations. Factorial recognizable languages in two dimensions generalize factor-closed regular languages in one dimension. Such string languages can be represented by automata where every state is both initial and terminal. Unambiguity for such automata is generally defined (cf. [5]) as the existence of a unique path with fixed label, once an initial and a terminal state are fixed. In a two-dimensional case, the role of initial and terminal states is played by the symbols along the perimeter of the rectangle, i.e., the frame. Hence in two dimensions such condition translates into fixing a frame of symbols in a picture of the local language. Furthermore, the definition of frame-unambiguity can be viewed as the generalization of the unambiguity in REC. The role played by the frame of the special boundary symbols is replaced by the one of frames of symbols in the local alphabet. Finally this definition is more consistent with the one of determinism as shown in the following proposition. Note that, in FREC, determinism does not imply unambiguity (see Example 3). Proposition 4. If L ∈ DF REC then L is frame-unambiguous. Proof. Suppose that L is recognized by a tl-br-deterministic unbordered tiling system T (the proof goes analogously in the other cases). Then, in T, any picture has at most one pre-image, once the symbols on the first row and on the first column are fixed in the pre-image, and, therefore, T is frame-unambiguous.

5

Finite and Infinite Ambiguity in FREC

In this section we show that there is a rich variety of ambiguity degrees in FREC according to the definitions in Section 4. First we show that there is a hierarchy of finitely factorial-ambiguous languages. Proposition 5. For any k ≥ 1, there exists a k-factorial-ambiguous language. Proof. (sketch) Consider the language Lh (h ≥ 1) of all the pictures that are factors of blocks with exactly h columns of b’s and a’s elsewhere (generalizing Example 4). Then in every tiling system recognizing Lh , the blocks of all a’s have at least h + 1 pre-images under the projection map.

88


The following proposition shows the relationships among the classes of finitely ambiguous languages considered so far. Proposition 6. The class of unambiguous FREC is strictly included in (ColUFREC ∩ Row-UFREC) which on the other side is strictly included in the class of finitely ambiguous FREC. Proof. (sketch) U F REC ⊆(Col-UFREC∩Row-UFREC) since unambiguity holds in particular on pictures with two columns and on pictures with two rows. The inclusion is strict: consider language L1 in Example 4. For the second inclusion note that if L ∈ (Col-UFREC∩Row-UFREC) then it is possible to construct an unbordered tiling system recognizing L, say T, that is column-unambiguous and row-unambiguous, at the same time. Suppose T has γ symbols in Γ : then every picture has at most γ pre-images, as there are at most γ possible choices for the local symbol in the top-left corner. This inclusion is also strict: consider language Labc in Example 5. The next proposition shows the relationships among the classes of languages that contain infinitely factorial ambiguous languages. Proposition 7. The class DFREC properly contains the class (Col-UFREC ∪ Row-UFREC) and is included in the class of frame unambiguous FREC. Proof. (sketch) We show that if an unbordered tiling system is l-r-column unambiguous then it is tl-br-deterministic. Otherwise there exist γ1 , γ2 , γ3 , γ4 , γ4 ∈ Γ , with γ4 = γ4 and π(γ4 ) = π(γ4 ), such that the two different tiles γ1 γ2 γ1 γ2 γ , ∈ Θ. The contradiction holds for column 1 and row γ1 γ2 . γ3 γ4 γ3 γ4 γ3 The inclusion is strict. Consider language L01 in Example 3: any unbordered tiling system recognizing L01 cannot be either column- or row-unambiguous. The inclusion of DFREC in frame-unambiguous FREC is Proposition 4.

6

Decidability Properties

In this section we present some decidability observations. Recall that in REC, it is decidable whether a tiling system is deterministic, column- (row-) unambiguous, but it is undecidable whether it is unambiguous. Similarly, analogous results hold for unbordered tiling systems in FREC. Proposition 8. It is decidable whether a given unbordered tiling system is unambiguous, column-unambiguous, row-unambiguous and deterministic, respectively. The proof of the next (undecidability) result can be obtained by reduction from the following undecidable problem (see [7] for all details). Let Σ be a finite alphabet and S = {(u1 , v1 ), . . . , (uk , vk )} be a system where ui , vi ∈ Σ ∗ for all i = 1, . . . , k. The system S is uniquely decipherable (u.d.,


89

for short) if and only if the equalities ui1 . . . uip = uj1 . . . ujq and vi1 . . . vip = vj1 . . . vjq imply both p = q, and (i1 , . . . , ip ) = (j1 , . . . , jp ). The 2-dimensional Unique Decipherability Problem is the question whether a given system S is u.d. Proposition 9. It is undecidable whether a given unbordered tiling system is frame unambiguous. Proof. (sketch) The proof is similar to the proof of the undecidability of the unambiguity of a tiling system in REC as in [4]. We show that the 2-dimensional Unique Decipherability Problem reduces to the problem of deciding whether a given unbordered tiling system is frame unambiguous. Let S = {(u1 , v1 ), . . . , (uk , vk )} be a system where ui , vi ∈ Σ ∗ for all i = 1, . . . , k and let c ∈ / Σ. We define a picture language L(S) over the alphabet Σ ∪ {c} as the set of pictures p as below, together with all their factors. c

c ui1 vi1

. p = ..

..

... ... .

.. .

.. ...

c

.. .

c

vip c

uip

c0

. p = ..

.

c0 ui1

... ...

vi1 ci1

c0

c0

.. .

.. . vip

c

uip

cip ...

c0

Then L(S) ∈ F REC. An unbordered tiling system (Σ, Γ, Θ, π) recognizing L(S) can be constructed as follows. The local alphabet is Γ = Σ ∪{c0 , c1 , . . . , ck } where Σ is a local alphabet for recognizing the strings ui , vj , for all i, j = 1, . . . , k, and ui , vj are the pre-images of ui , vj , respectively. The pre-image of the generic picture p is p as sketched above. It follows that the unbordered tiling system (Σ, Γ, Θ, π) is frame unambiguous if and only if the system S is u.d. Indeed S is not u.d. if and only if when fixing a frame of c0 ’s around some picture as p, then it has two pre-images at least. Moreover if S is u.d. then, fixing a frame of local symbols, not all c0 ’s, around some proper factor q of p, means fixing symbols ci , and hence the pre-image of q is uniquely determined.

7

Ambiguity in REC vs Ambiguity in FREC

In this section we compare results about recognizability and ambiguity of the languages in REC with the corresponding results for the class FREC. The following remarks highlight the differences between the two types of definitions. Remark 2. If L ∈ FLOC then L ∈ LOC. If L ∈ FREC then L ∈ REC. If L ∈ UFREC then L ∈ UREC. Vice versa: L factor-closed and L ∈ U REC do not imply that L ∈ U F REC, as shown in Examples 2 and 3 for language L01 .

90


Remark 3. In REC the following (strict) inclusions hold (see [3]): DREC (Col-UREC ∪ Row-UREC ) UREC. On the other hand, in FREC the inclusions among the analogous classes hold in the opposite direction (see Propositions 6, 7): UFREC ⊆ ( Col-UFREC ∪ Row-UFREC ) ⊆ DFREC. Remark 4. Consider the relationship between determinism and unambiguity in REC compared to the one in FREC. In REC, determinism implies unambiguity. On the other hand in FREC, determinism does not imply unambiguity, not even finite ambiguity (see Example 2), however, it does imply frame unambiguity, as shown in Proposition 4. Remark 5. The introduction of boundaries in recognition of pictures can remarkably reduce the ambiguity of a language. Indeed, there exist k-factorial ambiguous languages, with k > 1, that are unambiguous in REC (consider L1 in Example 4). Furthermore, there exist infinitely factorial ambiguous languages, that are unambiguous in REC (consider L01 in Examples 2 and 3). Remark 6. Consider now the different degrees of ambiguity in REC and FREC respectively. In FREC, there are examples of languages that are unambiguous, as well as finitely ambiguous for any k ≥ 1, and infinitely ambiguous. On the other hand, in REC we only have examples of languages that are either unambiguous or infinitely ambiguous. The question whether this is always the case is still open.

8

Conclusions and Open Questions

In this paper we have introduced a class of two-dimensional languages (FREC) motivated by symbolic dynamics. The results obtained within this paper have indeed interesting analogies and interpretations in symbolic dynamics most of which we omit them due to lack of space. For example, Proposition 3, while not valid for framed languages, is not surprising for unframed ones. Shifts of finite type are defined with factorial local languages. Unambiguity of the projection of a tiling system, in fact, defines a conjugacy from the shift of finite type onto its image (see [18]). Consequently, every image of a factorial and extendable local language under an unambiguous projection defines a shift of finite type as well, and therefore it must be a local language. Furthermore, the examples and the observations presented with this exposition show existence of languages with different degrees of ambiguity in REC and FREC. It is still an open question whether there exists a non frame-unambiguous language in FREC. An example of such language which is extendable and also


91

has the uniform mixing property (see [13]) would provide another contrast between one and two dimensional symbolic dynamical systems, because in one dimension, every sofic shift is a factor of an equal entropy shift of finite type [18]. A similar question for REC is also open.

Acknowledgments Authors would like to thank Jarkko Kari for initiating the discussion about differences between framed and unframed languages during the workshop “Advanced in Two-Dimensional Language Theory” in Salerno, Italy, in May 2005.

References 1. Anselmo, M., Madonia, M.: Deterministic two-dimensional languages over oneletter alphabet. In: Bozapalidis, S., Rahonis, G. (eds.) CAI 2007. LNCS, vol. 4728, pp. 147–159. Springer, Heidelberg (2007) 2. Anselmo, M., Madonia, M.: Deterministic and unambiguous two-dimensional languages over one-letter alphabet. In: TCS (to appear, 2008) 3. Anselmo, M., Giammarresi, D., Madonia, M.: From determinism to nondeterminism in recognizable two-dimensional languages. In: Harju, T., Karhum¨ aki, J., Lepist¨ o, A. (eds.) DLT 2007. LNCS, vol. 4588, pp. 36–47. Springer, Heidelberg (2007) 4. Anselmo, M., Giammarresi, D., Madonia, M., Restivo, A.: Unambiguous Recognizable two-dimensional languages. RAIRO: Theoretical Informatics and Applications 2, 227–294 (2006) 5. Béal, M.P., Perrin, D.: Symbolic Dynamics and Finite Automata. In: Rozenberg, G., Salomaa, A. (eds.) Handbook of Formal Languages, ch. 10, vol. 2. Springer, Heidelberg (1997) 6. Berger, R.: The undecidability of the Domino Problem, Memoirs AMS n. 66 (1966) 7. Chrobak, M., Rytter, W.: Unique decipherability for partially commutative alphabets. In: Fundamenta Informaticae, vol. X, pp. 323–336. North-Holland, Amsterdam (1987) 8. Coven, E., Johnson, A., Jonoska, N., Madden, K.: The Symbolic Dynamics of Multidimensional Tiling Systems. Ergodic Theory and Dynamical Systems 23, 447– 460 (2003) 9. Eilenberg, S.: Automata, Languages and Machines, vol. A. Academic Press, London (1974) 10. Fichtner, I.: Characterizations of Recognizable Picture Series. Ph.D Thesis Universit¨ at Leipzig, Institut f¨ ur Informatik, Abteilung Automaten und Sprachen (2007), http://www.informatik.uni-leipzig.de/∼ maeurer/diss.pdf 11. Giammarresi, D., Restivo, A.: Recognizable picture languages. In: Nivat, M., Saoudi, A., Wang, P.S.P. (eds.) Proc. 1st Internat. Colloq. on Parallel Image Processing; Internat. J. Pattern Recognition Artif. Intell. 6, 231–256 (1992) 12. Giammarresi, D., Restivo, A.: Two-dimensional languages. In: Rozenberg, G., Salomaa, A. (eds.) Handbook of Formal Languages, vol. III, pp. 215–268. Springer, Berlin (1997) 13. Jonoska, N., Pirnot, J.B.: Transitivity in two-dimensional local languages defined by dot systems. International Journal of Foundations of Computer Science 17(2), 435–464 (2006)

92


14. Kari, J.: A small aperiodic set of Wang tiles. Discrete Mathematics 160(1-3), 259– 264 (1996) 2 15. Kitchens, B., Schmidt, K.: Markov subgroups of (Z/2Z)Z . In: Walters, P. (ed.) Symbolic Dynamics and its Applications. Contemporary Mathematics, vol. 135, pp. 265–283 (1992) 16. Kitchens, B., Schmidt, K.: Automorphisms of compact groups. Ergod. Th. & Dynam. Sys. 9, 691–735 (1989) 17. Kitchens, B.: Symbolic Dynamics. Springer, New York (1998) 18. Lind, D., Marcus, B.: An Introduction to Symbolic Dynamics and Coding. Cambridge University Press, Cambridge (1995) 19. Madden, K., Johnson, A.: Factoring Higher Dimensional Shifts of Finite Type onto the Full Shift. Ergodic Theory and Dynamical Systems 25, 811–822 (2005) 20. Meester, R., Steif, J.E.: Higher-dimensional subshifts of finite type, factor maps and measures of maximal entropy. Pacific J. Math. 200(2), 497–510 (2001) 21. Quas, A., Trow, P.: Subshifts of multi-dimensional shifts of finite type. Ergodic Theory Dynam. Systems 20, 859–874 (2000) 22. Robinson, R.: Undecidability and Nonperiodicity of Tilings of the Plane. Inventiones Math. 12, 177–209 (1971)

Approximating Tree Edit Distance through String Edit Distance for Binary Tree Codes Taku Aratsu1 , Kouichi Hirata1 , and Tetsuji Kuboyama2 1

Department of Artificial Intelligence, Kyushu Institute of Technology Kawazu 680-4, Iizuka 820-8502, Japan {aratsu,hirata}@dumbo.ai.kyutech.ac.jp 2 Computer Center, Gakushuin University Mejiro 1-5-1, Toshima, Tokyo 171-8588, Japan [email protected]

Abstract. In this paper, we give an approximation of the tree edit distance through the string edit distance for binary tree codes, instead of one for Euler strings introduced by Akutsu (2006). Here, a binary tree code is a string obtained by traversing a binary tree representation with two kinds of dummy nodes of a tree in preorder. Then, we show that σ/2 ≤ τ ≤ (h + 1)σ + h, where τ is the tree edit distance between trees, σ is the string edit distance between their binary tree codes and h is the minimum height of the trees.

1

Introduction

It is one of the important tasks for data mining from tree-structured data such as HTML and XML data in web mining or RNA and glycan data in bioinformatics to introduce a similarity measure between two rooted ordered labeled trees (trees, for short), and compare them based on the similarity measure. The most famous similarity measure between trees is the tree edit distance [4,12]. While the tree edit distance is a metric, computing the tree edit distance is inefficient; The tree edit distance can be computed in O(n3 ) time [5]. In order to overcome such inefficiency and approximate the tree edit distance, many similarity measures between trees have been developed. In particular, the leaf histogram, the degree histogram and the label histogram [7], the binary branch (under the binary tree representation) [11] and the sibling distance [3] have been formulated as the similarly measures with constant factor lower bounds on the tree edit distance. Since it is sufficient to traverse a tree just once and not necessary to use dynamic programming, all of them can be computed in O(n) time. However, since none of them is a metric, they cannot have any upper bounds on the tree edit distance. Furthermore, Garofalakis and Kumar [6] have developed an algorithm for efficient embedding trees and, given both lower and

This work is partially supported by Grand-in-Aid for Scientific Research 19300046 and 20500126 from the Ministry of Education, Culture, Sports, Science and Technology, Japan.


94

T. Aratsu, K. Hirata, and T. Kuboyama

upper bounds on the tree edit distance with move, which is different from the standard tree edit distance. Recently, Akutsu [1] has first introduced an approximation of the (standard) tree edit distance through the string edit distance, which can be computed in O(n2 ) time, between Euler strings of trees. Also Akutsu et al. [2] have developed this work by using a modified Euler string. Both of them have given not only a constant factor lower bound but also an upper bound on the tree edit distance. Let τ (T1 , T2 ) denote the tree edit distance between trees T1 and T2 and σ(s1 , s2 ) the string edit distance between strings s1 and s2 . For a tree T , let s(T ) and s (T ) be an Euler string and a modified Euler string of T , respectively. Then, the following two sequences hold, where h is the minimum height and n is the minimum number of nodes of T1 and T2 . σ(s(T1 ), s(T2 )) ≤ τ (T1 , T2 ) ≤ (2h + 1)σ(s(T1 ), s(T2 )) [1], 2 σ(s (T1 ), s (T2 )) ≤ τ (T1 , T2 ) ≤ O(n0.75 )σ(s (T1 ), s (T2 )) [2]. 6 In this paper, we give another approximation of the tree edit distance through the string edit distance. Instead of an Euler string or a modified Euler string, we adopt a binary tree code based on the modified version of binary tree representations [8,9,11]. For a tree T and a node v ∈ T , the binary tree representation b(T ) of T is a binary tree constructed by setting the first child of v in T as the left child of v in b(T ) and the next sibling of v in T as the right child of v in b(T ). In this paper, we introduce two kinds of dummy nodes, ⊥ and ; ⊥ is the left child of v in b(T ) if v in T has no children, and is the right child of v in b(T ) if v in T has no right siblings. For such a binary tree representation b(T ) of T , we define the binary tree code bc(T ) of T as the string of labels obtained by traversing b(T ) in preorder. Then, we show the following approximation result of the tree edit distance τ (T1 , T2 ) through the string edit distance σ(bc(T1 ), bc(T2 )). σ(bc(T1 ), bc(T2 )) ≤ τ (T1 , T2 ) ≤ (h + 1)σ(bc(T1 ), bc(T2 )) + h. 2 This paper is organized as follows. In Section 2, we prepare the notions necessary for the later discussion. In Section 3, we introduce a binary tree representation with two dummy nodes ⊥ and and a binary tree code, and then show several properties of the binary tree code. In Section 4, we show the lower and upper bounds on the tree edit distance between trees through the string edit distance between their binary tree codes as stated above. The proof of the upper bound is motivated by Akutsu [1]. Finally, in Section 5, we discuss the difference between our result and Akutsu’s one [1] in more detail.

2

String Edit Distance and Tree Edit Distance

In this section, we introduce both string edit distance and tree edit distance.

Approximating Tree Edit Distance through String Edit Distance

95

Let Σ be a finite set as an alphabet. For string s ∈ Σ and an integer i, s[i] denotes the i-th character of s and |s| denotes the length of s. An edit operation on strings is one of a deletion, a insertion or a substitution of a character of s. The edit distance between two strings, s1 and s2 and is defined as the minimum number of operations to transform s1 to s2 and denoted by σ(s1 , s2 ). We also define an alignment of two strings. An alignment between s1 and s2 is obtained by inserting gap symbol (denoted by ‘−’ where − ∈ Σ) into or at either end of s1 and s2 such that the resulting strings s1 and s2 are of the same length l, where it is not allowed for each i (1 ≤ i ≤ l) that both s1 [i] and l f (s1 [i], s2 [i]), where s2 [i] are gap symbols. The cost of alignment is given as i=1

f (x, y) = 0 if x = y = −; f (x, y) = 1 otherwise. Then, an optimal alignment is an alignment with the minimum cost. It is straightforward that the cost of an optimal alignment is equal to the edit distance. Next, we define edit distance between trees, where we deal with just unit cost case. See [4] in more detail. A tree is a connected graph without cycles. A rooted tree is a tree with one node r chosen as its root . A tree T is ordered if a left-to-right order among siblings in T is given. A tree T is labeled if each node is assigned a symbol from Σ. In this paper, we call a rooted ordered labeled tree a tree simply. For a tree T = (V, E), we sometimes denote v ∈ T instead of v ∈ V , |T | instead of |V |, and V (T ) instead of V . Also we sometimes identify a node with its label. Furthermore, for v ∈ T , T (v) is a subtree of T of which root is v and that contains all descendants of v. An edit operations on trees is one of a deletion, an insertion or a substitution, where each operation is defined as follows. (See Figure 1.) 1. Substitution: Change the label of the node v in T . 2. Deletion: Delete a non-rooted node v in T with parent v , making the children of v become the children of v . The children are inserted in the place of v as a subsequence in the left-to-right order of the children of v . 3. Insertion: The complement of deletion. Insert a node v as a child of v in T making v the parent of a consecutive subsequence of the children of v . The edit distance between two trees T1 and T2 is defined as the minimum number of operations to transform T1 to T2 , and denoted by τ (T1 , T2 ). It is known that there exists a close relationship between the edit distance and the ordered edit distance mapping (mapping, for simply) [4]. An M ⊆ V (T1 ) × V (T2 ) is called a mapping if the following conditions are satisfied for every pair (v1 , w1 ), (v2 , w2 ) ∈ M . (i) v1 = v2 iff w1 = w2 ; (ii) v1 is an ancestor of v2 iff w1 is an ancestor of w2 ; (iii) v1 is to the left of v2 iff w1 is to the left of w2 . It is well known that the mapping M maximizing id (M ) corresponds to the edit distance, for which τ (T1 , T2 ) = |T1 | + |T2 | − |M | − id (M ). Finally, a mapping M ⊆ V (T1 ) × V (T2 ) is a bottom-up mapping [10] if, for every pair (v, w) ∈ M , (i) for every v ∈ T1 (v), there exists w ∈ T2 (w) such

96


v

w

→

Substitution v v

v

→

Deletion

v v

v

→

Insertion

Fig. 1. Edit operations on trees

that (v , w ) ∈ M and (ii) for every w ∈ T2 (w), there exists v ∈ T1 (v) such that (v , w ) ∈ M . The bottom-up mapping between two trees is the common complete subforest between two trees if labels are ignored.

3

Binary Tree Code

In this section, we formulate the modified version of a binary tree representation of a tree [8,9,11] with two kinds of dummy nodes. Then, we introduce a binary tree code of a tree as a string obtained by traversing the binary tree representation of a tree in preorder. Definition 1 (binary tree representation). Let T be a tree with the root r. Then, a binary tree representation b(T ) of T is a binary tree obtained by setting, for v ∈ T − {r}, the first child of v in T (or ⊥ if there does not exist) as the left child of v in b(T ) and the next sibling of v in T (or if there does not exist) as the right child of v in b(T ). In particular, if v is the root r of T , then r is also the root of b(T ) and has just a left child. For a tree T , the string of nodes in T obtained by traversing in preorder denotes c(T ). Definition 2 (binary tree code). Let T be a tree. Then, the binary tree code of T is the string c(b(T )), and we denote it by bc(T ). Example 1. Consider trees T1 and T2 in Figure 2 (upper). Then, the binary tree representation of Ti is described as Figure 2 (lower). Hence, we obtain the binary tree code bc(Ti ) of Ti as follows. bc(T1 ) = aba⊥b⊥a⊥cbba⊥b⊥a⊥, bc(T2 ) = aaba⊥b⊥ca⊥bba⊥b⊥a⊥.

Approximating Tree Edit Distance through String Edit Distance a

a

a

a

b b

c

a a

b

a

c a

b a

b

⊥

b a

b

a

b

a a

⊥

b

⊥

⊥

a

b ⊥

a

b a

c

b c

⊥

b

T2

a

b

a

b

b

T1

a

97

⊥

a

b

⊥

⊥

⊥

b(T1 )

b a

b a

⊥

b ⊥

b(T2 )

Fig. 2. A tree Ti (upper) and a binary tree representation b(Ti ) of Ti (lower) for i = 1, 2 in Example 1

Lemma 1. It holds that |b(T )| = |bc(T )| = 2|T |. Proof. It is sufficient to show that the number of dummy nodes in b(T ) is |T |. If |T | = 1, that is, T is a tree consisting of just a root r, then the statement is obvious, because the root r in b(T ) has just a left child ⊥. Suppose that the statement holds for |T | < n and consider the case that |T | = n. Let T be a tree with the root r, and suppose that r has children v1 , . . . , vm in T . By induction hypothesis, the number of dummy nodes in b(T (vi )) is |T (vi )| for 1 ≤ i ≤ m. Since vi is the root of b(T (vi )), vi in b(T (vi )) has just left child called a vi (which is the first child of vi in T (vi )). Then, by the definition of b(T ), the left child of vi in b(T ) is vi for 1 ≤ i ≤ m, the right child of vi in b(T ) is vi+1 for 1 ≤ i ≤ m − 1, and the right child of vm in b(T ) is . Also the root r in b(T ) has just the left child v1 and no dummy node. Then, the number of dummy nodes in b(T ) is |T (v1 )| + · · · + |T (vm )| + 1 = |T |, so the statement holds. Lemma 2. The binary tree code bc(T ) can be constructed from a tree T in O(|T |) time. Conversely, the tree T can be constructed from a binary tree code bc(T ) in O(|T |) time.

98


Proof. The first statement is obvious because b(T ) and bc(T ) can be constructed in O(|T |) time from T and b(T ), respectively. Then, we show the second statement. Let Σ be the set of all labels of nodes, where ⊥, ∈ Σ. Then, for a binary tree code c, we can construct the tree S by scanning c from left to right as follows. Let a be a current word in c and p a current node in S, where an initial tree of S is empty. 1. First, we set a to the root of S and p to a. 2. If a ∈ Σ, then we set a to the rightmost child of p in S and update p to a. 3. If a ∈ {⊥, }, then we update p to the parent of p in S. Since c is a preorder traversal of b(T ), it is obvious that, if c = bc(T ), then it holds that S = T . Furthermore, the above construction runs in O(|T |) time. Lemma 3. For trees T1 and T2 , it holds that τ (T1 , T2 ) = 0 iff bc(T1 ) = bc(T2 ). Proof. By the definition of bc(T ) and by the proof of Lemma 2, it holds that bc(T1 ) = bc(T2 ) iff T1 = T2 , so the statement holds. Lemma 4. Let be a substring relation. For a binary tree code bc(T ), we can decode a subtree of T from bc(T ) inductively as follows. 1. a⊥ bc(T ) is a subtree of T . In this case, a is a leaf of T . 2. If s1 , . . . , sk bc(T ) are subtrees in T , then as1 · · · sk bc(T ) is a subtree of T . Proof. Let T be a tree and bc(T ) a binary tree code of T . Also let Σ be the set of all labels of nodes in T . By Definition 2, ⊥ represents some node v in T has no children. Since bc(T ) is the preorder traversal of b(T ), v is corresponding to the previous symbol in Σ to ⊥ in bc(T ), so the statement 1 holds. On the other hand, by Definition 2, represents some node v in T has no right siblings, so the parent v of v in T is the root of some subtree of T . Since bc(T ) is the preorder traversal of b(T ), v is corresponding to the nearest left symbol in Σ except subtrees of T to in bc(T ), so the statement 2 holds. Example 2. Consider the binary tree codes bc(T1 ) and bc(T2 ) in Example 1. Then, the underlined substring in bc(Ti ) is a subtree of Ti according to the decoding in Lemma 4. bc(T1 ) = a b a⊥ b⊥ a⊥ c b b a⊥ b⊥ a⊥, bc(T2 ) = a a b a⊥ b⊥ c a⊥ b b a⊥ b⊥ a⊥.

4

Lower and Upper Bounds on Tree Edit Distance

In this section, we investigate the approximation of the tree edit distance between trees through the string edit distance between their binary tree codes. Throughout of this section, let T1 and T2 be trees. First, we show the lower bound on τ (T1 , T2 ) for σ(bc(T1 ), bc(T2 )).


99

r v0

r v0

vl

vr

v v1

vn

vl

v1

T1

vn

vr

T2

r

r

r r

s1

s1

vl

s3

vl u

v

v1

u s2

s3

v

v1

v1

v1

vr

vr

v2

s2

v2

v2

v2

c(B1 (vr ))

c(B1 (vr ))

vn

vn

vn

vr

vn

vr

c(B1 (vr ))

c(B1 (vr ))

b(T1 )

b(T1 )

b(T2 )

b(T2 ) (vl exists)

(vl does not exist)

Fig. 3. T1 and T2 (upper) and b(T1 ) and b(T2 ) (lower) in the proof of Theorem 1

Theorem 1. It holds that σ(bc(T1 ), bc(T2 )) ≤ 2τ (T1 , T2 ). Proof. It is sufficient to show that σ(bc(T1 ), bc(T2 )) changes at most 2 when an edit operation is applied. (1) Substitution: Suppose that T2 is obtained from T1 by changing a label u ∈ T1 into a label v ∈ T2 . Then, it is obvious that σ(bc(T1 ), bc(T2 )) = 1. (2) Deletion: Suppose that T2 is obtained from T1 by deleting a node v ∈ T1 , where the root of T1 is r. Let v0 be the parent of v in T1 and v1 , . . . , vn the children of v in T1 . See Figure 3 (upper). Also let B1 denote b(T1 ). Note that the right child of vn in B1 is . Then, the last element of c(B1 (v1 )) is , so we denote the string by deleting in the last of c(B1 (v1 )) by c− (B1 (v1 )). Also let “·” denote the string concatenation. Suppose that the left sibling vl of v exists in T1 . Then, b(T1 ) and b(T2 ) are described as Figure 3 (lower left), so bc(T1 ) and bc(T2 ) are of the following forms, where s1 is a binary tree code from r to vl , that is, the string obtained by deleting

100


c(B1 (vl )) from c(B1 )(= bc(T1 )) and s2 is c(B(u)) for the first child u of vl in T1 (or an empty string if such an u does not exist). bc(T1 ) = s1 vl s2 v · c(B1 (v1 )) · c(B1 (vr )), bc(T2 ) = s1 vl s2 · c− (B1 (v1 )) · c(B1 (vr )). Suppose that no left sibling (vl ) of v exists in T1 . Then, b(T1 ) and b(T2 ) are described as Figure 3 (lower right), so bc(T1 ) and bc(T2 ) are of the following forms, where s3 is a binary tree code from r to v, that is, the string obtained by deleting c(B1 (v)) from c(B1 ). bc(T1 ) = s3 v · c(B1 (v1 )) · c(B1 (vr )), bc(T2 ) = s3 · c− (B1 (v1 )) · c(B1 (vr )). In both cases, if no right sibling (vr ) of v exists in T1 , then c(B1 (vr )) in bc(Ti ) is . Hence, it holds that σ(bc(T1 ), bc(T2 )) = 2 when a deletion is applied. Next, we show the upper bound on τ (T1 , T2 ) for σ(bc(T1 ), bc(T2 )). In the following, we use the similar notions given by Akutsu [1]. Let (bc(T1 ) , bc(T2 ) ) be an alignment giving from σ(bc(T1 ), bc(T2 )). Also let MSP and MSSP be the following sets of pairs obtained from the alignment (bc(T1 ) , bc(T2 ) ). 1. MSP is the set {(p11 , p12 ), . . . , (pd1 , pd2 )} of maximal substring pairs, each of which is corresponding to a maximal consecutive region in (bc(T1 ) , bc(T2 ) ) without insertions, deletions or substitutions. 2. MSSP is the set {(t11 , t12 ), . . . , (tb1 , tb2 )} of maximal subtree string pairs, each of which is corresponding to a maximal subtree of Ti by decoding bc(Ti ) in Lemma 4. Example 3. Consider binary tree codes bc(T1 ) and bc(T2 ) in Example 1 (and also Example 2). Then, we obtain MSP = {(pi1 , pi2 ) | i = 1, 2, 3} and MSSP = {(ti1 , ti2 ) | i = 1, 2, 3, 4} as follows.

p11

t11

p21

t21

p31

t31

t41

a⊥ c bba⊥b⊥ a⊥ , bc(T1 ) = a ba⊥b⊥ a⊥ bba⊥b⊥ a⊥ . bc(T2 ) = a a ba⊥b⊥ c

t12

p12

t22

p22

t32

t42

p32

Note that MSSP is determined uniquely from the alignment (bc(T1 ) , bc(T2 ) ). For an MSSP , we construct the mapping M from the nodes in ti1 to ones in ti2 (with ignoring ⊥ and ). Lemma 5. M is a bottom-up mapping between T1 and T2 . Proof. It is straightforward.


101

Lemma 6. If |MSP | = d, then it holds that d ≤ σ(bc(T1 ), bc(T2 )) + 1. Proof. Let MSP be {(p11 , p12 ), . . . , (pd1 , pd2 )}. Then, there exist at least d − 1 gaps in the alignment (bc(T1 ) , bc(T2 ) ). Hence, it holds that d−1 ≤ σ(bc(T1 ), bc(T2 )), so the statement holds. Let REST (pji ) be the total number of positions in substring pji that do not appear in MSSP . Also let h be the minimum height of T1 and T2 . Lemma 7. For every pji , it holds that REST (pji ) ≤ h. Proof. Let Ph+1 be a path a0 · · · ah with hight h (h + 1 nodes), where the root is a0 . Then, it holds that bc(Ph+1 ) = a0 · · · ah ⊥ · · · . Consider the case that pji = a0 · · · ah ⊥ and tli = ah ⊥ (for some 1 ≤ l ≤ b). Then, no substring of pji except tli is decoded as a subtree of Ph+1 , so it holds that REST (pji ) = h, which is the worst case for REST (pji ). Lemma 8. Let k be σ(bc(T1 ), bc(T2 )). Then, it holds that

d j=1

|pji | ≥ 2|Ti | − k.

Proof. By Lemma 1, it holds that |bc(Ti )| = 2|Ti | and the length of bc(Ti ) is the sum of |bc(Ti )| and the number of gaps. Since k(= σ(bc(T1 ), bc(T2 ))) is greater d than the number of gaps, which is 2|Ti | − |pji |, the statement holds. j=1

Theorem 2. Let h be the minimum height of T1 and T2 . Then, it holds that τ (T1 , T2 ) ≤ (h + 1)σ(bc(T1 ), bc(T2 )) + h. Proof. Let M be a bottom-up mapping as Lemma 5. Then, M is corresponding to the elements of tl1 and tl2 . Also let k be σ(bc(T1 ), bc(T2 )). For pji (1 ≤ j ≤ d), the number of positions assigned by M is at least |pji | − REST (pji ), and also at least |pji | − h by Lemma 7. Then, the following sequence holds for i = 1, 2. |M| ≥

d d (|pji | − h) = |pji | − dh j=1

≥

d j=1

j=1

|pji | − h(k + 1)

(by Lemma 6)

≥ 2|Ti | − k − h(k + 1) (by Lemma 8) = 2|Ti | − k(h + 1) − h. Hence, the following sequence holds. τ (T1 , T2 ) ≤ |T1 | + |T2 | − |M| − id (M) = |T1 | + |T2 | − 2|M| ≤ |T1 | + |T2 | − (2|T1 | + 2|T2 | − 2k(h + 1) − 2h) = −|T1 | − |T2 | + 2k(h + 1) + 2h. Since τ (T1 , T2 ) ≤ |T1 | + |T2 |, it holds that 2τ (T1 , T2 ) ≤ 2k(h + 1) + 2h, which implies that τ (T1 , T2 ) ≤ (h + 1)k + h.

102

T. Aratsu, K. Hirata, and T. Kuboyama a

a c

b a

b a

d c

b a

b

a

d

a

d c

b

c

a

d

c

b

d

d

c

T1

T2 a a

b

b a

c

b

d

a

d

b

d

a ⊥

c d

⊥

⊥

⊥

⊥

⊥

⊥

d

⊥

c

a

c

b

a

⊥

d d

⊥

⊥

⊥

c ⊥

b(T1 )

b

⊥

a

b(T2 )

Fig. 4. Trees Ti (upper) and binary tree representations b(Ti ) of Ti (lower) for i = 1, 2 in Example 4, where h = 6 and m = 3

Example 4. Consider trees T1 and T2 in Figure 4 (upper), where we assume that the hight h is 2m for simplicity. Then, b(T1 ) and b(T2 ) are described as Figure 4 (lower), so it holds that: bc(T1 ) = (ab)m a⊥(d⊥c⊥)m = (ab)m a⊥d⊥(c⊥d⊥)m−1 c⊥, m m−1 c⊥ = (ab)m a⊥d⊥ (c⊥d⊥)m−1 c⊥. bc(T2 ) = (ab) a⊥d⊥(c⊥d⊥)

Then, it holds that σ(bc(T1 ), bc(T2 )) = 2. On the other hand, it holds that τ (T1 , T2 ) = h = Θ(h). Hence, the upper bound of Theorem 2 is tight. By incorporating Theorem 1 with Theorem 2, we obtain the following main theorem of this paper. Theorem 3. Let h be the minimum height of T1 and T2 . Then, it holds that: σ(bc(T1 ), bc(T2 )) ≤ τ (T1 , T2 ) ≤ (h + 1)σ(bc(T1 ), bc(T2 )) + h. 2

5

Discussion

The approximation shown in Theorem 3 is slightly tighter than the following approximation of the tree edit distance through the string edit distance for Euler strings [1], where s(T ) is an Euler string of a tree T .


103

a a

a

b b

b

b

b

T1

b

b

T2

b b

e(T1 ) = e(T2 )

Fig. 5. Trees Ti (left) and the extended 2-ranked tree e(Ti ) of Ti (right) for i = 1, 2

σ(s(T1 ), s(T2 )) ≤ τ (T1 , T2 ) ≤ (2h + 1)σ(s(T1 ), s(T2 )). 2 It is obvious that we can rewrite (h + 1)σ(bc(T1 ), bc(T2 )) + h in Theorem 3 as (2h + 1)σ(bc(T1 ), bc(T2 )). On the other hand, we cannot improve (2h + 1)σ(s(T1 ), s(T2 )) to (h + 1)σ(s(T1 ), s(T2 )) + h, because of the upper bound on REST (pji ); It holds that REST (pji ) ≤ h for binary tree codes (Lemma 7), while it holds that REST (pji ) ≤ 2h for Euler strings [1]. This also implies a simpler tight example of the upper bound on the tree edit distance (Example 4) than one given in [1]. On the other hand, by using two dummy nodes and ⊥ in binary tree codes, we can determine the subtrees as substrings of the binary tree code (Lemma 4). The dummy nodes and ⊥ work as traversing down a and up a for a label a in Euler strings, respectively. Hence, we can construct bottom-up mapping from the binary tree codes (Lemma 5), and then give the approximation result according to the similar proof of [1]. The researches of tree similarity based on binary tree representation have been developed as [9,11]. In particular, Magniez and de Rougemont [9] have introduced a binary tree representation e(T ) without dummy nodes ⊥ and in this paper, called an extended 2-ranked tree, and shown that τmv (e(T1 ), e(T2 )) ≤ 3τmv (T1 , T2 ), where τmv is a tree edit distance with moves. They also have pointed out that τmv (T1 , T2 ) ≤ 3τmv (e(T1 ), e(T2 )), but we can give trees T1 and T2 as a counterexample such that τmv (T1 , T2 ) = 1 > 0 but τmv (e(T1 ), e(T2 )) = 0 as Figure 5. Then, it is necessary for dummy nodes to give the upper bound on the tree edit distance with moves. It is a future work to investigate the relation between the tree edit distance with moves and the string edit distance for binary tree codes.

References 1. Akutsu, T.: A relationship between edit distance for ordered trees and edit distance for Euler strings. Inform. Proc. Let. 100, 105–109 (2006) 2. Akutsu, T., Fukagawa, D., Takasu, A.: Approximating tree edit distance through string edit distance. In: Asano, T. (ed.) ISAAC 2006. LNCS, vol. 4288, pp. 90–99. Springer, Heidelberg (2006)

104


3. Aratsu, T., Hirata, K., Kuboyama, T.: Sibling distance for rooted ordered trees. In: Proc. ALSIP 2008, Working Notes of PAKDD Workshops, pp. 101–112 (2008) 4. Bille, P.: A survey on tree edit distance and related problems. Theoret. Comput. Sci. 337, 217–239 (2005) 5. Demaine, E.D., Mozes, S., Rossman, B., Weimann, O.: An optimal decomposition algorithm for tree edit distance. In: Arge, L., Cachin, C., Jurdzi´ nski, T., Tarlecki, A. (eds.) ICALP 2007. LNCS, vol. 4596, pp. 146–157. Springer, Heidelberg (2007) 6. Garofalakis, M., Kumar, A.: XML stream processing using tree-edit distance embedding. ACM Trans. Database System 30, 279–332 (2006) 7. Kailing, K., Kriegel, H.-P., Sch¨ onauer, S., Seidl, T.: Efficient similarity search for hierarchical data in large databases. In: Bertino, E., Christodoulakis, S., Plexousakis, D., Christophides, V., Koubarakis, M., B¨ ohm, K., Ferrari, E. (eds.) EDBT 2004. LNCS, vol. 2992, pp. 676–693. Springer, Heidelberg (2004) 8. Knuth, D.E.: The art of computer programing, 3rd edn. Fundamental algorithms, vol. 1. Addison-Wesley, Reading (1997) 9. Magniez, F., de Rougemont, M.: Property testing of regular tree languages. Algorithmica 42, 127–146 (2007) 10. Valiente, G.: An efficient bottom-up distance between trees. In: Proc. SPIRE 2001, pp. 212–219 (2001) 11. Yang, R., Kalnis, P., Tung, A.K.H.: Similarity evaluation on tree-structed data. In: Proc. SIGMOD 2005, pp. 754–765 (2005) 12. Zhang, K., Shasha, D.: Simple fast algorithms for the editing distance between trees and related problems. SIAM J. Comput. 18, 1245–1262 (1989)

The Shortcut Problem – Complexity and Approximation Reinhard Bauer1 , Gianlorenzo D’Angelo2, Daniel Delling1 , and Dorothea Wagner1 1

2

Faculty of Informatics, Universität Karlsruhe (TH) {rbauer,delling,wagner}@informatik.uni-karlsruhe.de Department of Electrical and Information Engineering, University of L’Aquila [email protected]

Abstract. During the last years, speed-up techniques for D IJKSTRA’s algorithm have been developed that make the computation of shortest paths a matter of microseconds even on huge road networks. The most sophisticated methods enhance the graph by inserting shortcuts, i.e. additional edges, that represent shortest paths in the graph. Until now, all existing shortcut-insertion strategies are heuristics and no theoretical results on the topic are known. In this work, we formalize the problem of adding shortcuts as a graph augmentation problem, study the algorithmic complexity of the problem, give approximation algorithms and show how to stochastically evaluate a given shortcut assignment on graphs that are too big to evaluate it exactly.

1 Introduction Computing shortest paths in graphs is used in many real-world applications like routeplanning in road networks or for finding good connections in railway timetable information systems. In general, D IJKSTRA’s algorithm computes a shortest path between a given source and a given target. Unfortunately, the algorithm is slow on huge datasets. Therefore, it cannot be directly used for applications like car navigation systems or online working route-planners that require an instant answer of a source-target query. Often, this problem is coped with by dividing the computation of the shortest paths into two stages. In the offline stage, some data is precomputed that is used in the online stage to answer a query heuristically faster than D IJKSTRA’s algorithm. Such an algorithm is called a speed-up technique. During the last years, speed-up techniques have been developed for road networks (see [17,21] for an overview), that make the shortest path computation a matter of microseconds [5] even on huge road networks consisting of millions of nodes and edges. One core part of many of these speed-up techniques is the insertion of shortcuts [4,6,9,10,11,13,16,18,19,20], i.e. additional edges (u, v) whose length is the distance from u to v and that represent shortest u-v-paths in the graph. The strategies of assigning the shortcuts and of exploiting them during the query differ depending on the speed-up technique. Until now, all existing shortcut insertion strategies are heuristics and no theoretical worst-case or average case results are known.

Partially supported by the Future and Emerging Technologies Unit of EC (IST priority – 6th FP), under contract no. FP6-021235-2 (project ARRIVAL) and the DFG (project WAG54/16-1).


106

R. Bauer et al.

All speed-up techniques that use shortcuts have one point in common. The shortcuts reduce the search space which corresponds to reducing the number of edges in a shortest path in the graph. Therefore, it seems reasonable to insert shortcuts in a manner that minimizes the average number of edges of a shortest path in the graph but keeps the space occupancy low. In this work we formalize this idea by defining the S HORTCUT P ROBLEM (SP) and give a theoretical study of the complexity of the problem. In particular, the arc-flag method [14] can easily be enriched by externally computed shortcuts. Therefore, considering SP independent from a specific speed-up technique can lead to a reversed process: first compute shortcuts according to SP and then apply a speed-up technique on the resulting graph. SHARC-Routing, a sophisticated variant of arc-flags, already uses externally computed shortcuts. Therefore, we consider it as a strong candidate to benefit from that approach (details in [4]). Finally, besides its relevance as a first step at all towards theoretical results on speed-up techniques, we consider the problem to be interesting on its own. To the best of our knowledge, the problem of finding shortcuts as stated in this work has never been treated before. Speed-up techniques that incorporate the usage of shortcuts are the following. Given a graph G = (V, E) the multi-level overlay graph technique [6,13,18,19,20] uses some centrality measures or separation strategies to choose a set of important nodes V on the graph and sets the shortcuts S such that the graph (V , S) is edge minimal among all graphs (V , E ) for which the distances between nodes in V are the same in (V, E) and (V , E ). Highway hierarchies [16] and reach based pruning [10,11] iteratively sparsificate the graph according to the importance of the nodes. After each sparsification step, nodes v with small in- and out-degree are deleted and for (nearly) each pair of edges (u, v), (v, w) a shortcut (u, w) is inserted. SHARC-Routing [4] and Contraction Hierarchies [9] use a similar strategy. This paper is organized as follows. Section 2 introduces basic definitions. The S HORTCUT P ROBLEM and the R EVERSE S HORTCUT P ROBLEM are stated in Section 3. Furthermore results concerning complexity and non-approximability of the problems are given. Two approximation algorithms of SP that work on a special graph class and the corresponding worst-case bounds are reported in Section 4. A stochastical approach to evaluate a given solution of SP is introduced in Chapter 5. Our work is concluded by a summary and possible future work in Section 6. Some proofs in the paper have been omitted due to space restrictions. The full version containing all proofs can be found here [3].

2 Preliminaries Throughout the work G = (V, E, len) denotes a directed, weighted, graph with n nodes, m edges and positive length function len : E → + . Given a node v, N(v) denotes the set of neighbors of v, that is the set of nodes u ∈ V such that (u, v) ∈ E or (v, u) ∈ E. Given a set S of nodes, the neighborhood of S is the set S ∪ u∈S N(u). A path P from x1 to xn in G is a finite sequence x1 , x2 , . . . , xn of nodes such that (xi , xi+1 ) ∈ E, i = 1, . . . , n − 1. The length of a path P in G is the sum of the length of all edges in P. A shortest path between nodes s and t is a path from s to t with minimum length. By P(s,t) we denote the set of all shortest s-t-paths. The hop-length |P| of a path P in G is the number of

The Shortcut Problem – Complexity and Approximation

107

edges in P. Given two nodes s,t the distance dist(s,t) from s to t is the length of a shortest path between s and t, while the hop-distance h(s,t) from s to t is the hop-length of a hop-minimal shortest path between s and t. The diameter of a graph is the length of the longest distance in G. The reverse graph G = (V, E, len) is the one obtained from G by substituting each (u, v) ∈ E by (v, u) and by defining len(v, u) = len(u, v). The eccentricity εG (v) of a node v is the maximum distance between v and any other node u of G. A shortcut is an edge (u, v) such that len(u, v) = dist(u, v). The notation G = (V, E ∪ E , len ) indicates a supergraph of G with shortcuts E whereas len : E ∪ E → + is such that len (u, v) equals dist(u, v) if (u, v) ∈ E and equals len(u, v) otherwise. Further, h (s,t) denotes the hop-distance from s to t in G .

3 Problem Complexity In this section, we introduce the S HORTCUT P ROBLEM and the R EVERSE S HORTCUT P ROBLEM. We show that both problems are NP-hard. Moreover, there exists no polynomial time constant factor approximation algorithm for the R EVERSE S HORTCUT P ROBLEM and no polynomial time algorithm that approximates the S HORTCUT P ROB LEM up to an additive constant unless P = NP. Finally, we identify a critical parameter of the S HORTCUT P ROBLEM and discuss some monotonicity properties of the problem. The S HORTCUT P ROBLEM consists of adding a number c of shortcuts to a graph, such that the sum of the hop lengths of hop-minimal shortest paths on the graph becomes minimal. Definition 1 (S HORTCUT P ROBLEM (SP)). Given a graph G = (V, E, len), a positive integer c ∈ , find a graph G = (V, E ∪ E , len ) such that |E | ≤ c and

w(E ) :=

∑

h(s,t) −

s,t∈V

∑

h (s,t)

s,t∈V

is maximal, whereas len : E ∪ E → + equals dist(u, v) if (u, v) ∈ E , equals len(u, v) otherwise, h(s,t) denotes the hop distance in (V, E) and h (s,t) denotes the hop distance in (V, E ∪ E ). We call w(E ) the decrease in overall hop length. The R EVERSE S HORTCUT P ROBLEM (RSP) is the variant of Definition 1 for which the decrease in overall hop length w(E ) must be at least a given value k and the objective is to minimize |E |. Definition 2 (R EVERSE S HORTCUT P ROBLEM (RSP)). Given a graph G = (V, E, len), a positive integer k ∈ , find a graph G = (V, E ∪ E , len ) such that

w(E ) :=

∑

s,t∈V

h(s,t) −

∑

h (s,t) ≥ k

s,t∈V

and |E | is minimal, whereas len : E ∪ E → + equals dist(u, v) if (u, v) ∈ E , equals len(u, v) otherwise, h(s,t) denotes the hop distance in (V, E) and h (s,t) denotes the hop distance in (V, E ∪ E ).

108

R. Bauer et al.

In order to show the complexity of the problems we make a transformation from M IN S ET C OVER. Definition 3 (M IN S ET C OVER). Given a collection C of subsets of a finite set U find a minimum cardinality set cover of U, i.e. a subset C of C such that every element in U belongs to at least one member of C and that |C | is minimal. Given an instance I = (C,U) of M IN S ET C OVER we construct an instance I = (G, k) of RSP the following way (see Figure 1 for a visualization): we denote by Δ the value 2|C| + 1. We introduce a node s to G. For each ui ∈ U, we introduce a set of nodes Ui = {ui1 , . . . , uiΔ } to G. For each Ci in C, we introduce nodes Ci− , Ci+ and edges (Ci− ,Ci+ ), (Ci+ , s) to G. The graph furthermore contains, for each ui ∈ U and each C j ∈ C with ui ∈ C j , the edges (uir ,C− j ), r = 1, . . . , Δ . All edges are directed and have length 1. Finally we set k to be Δ · |U|. The transformation is polynomial. u1r

u2r

| u|U r

u3r ...

C1−

C2−

C3−

...

C1+

C2+

C3+

...

− C|C| + C|C|

s

Fig. 1. Instance I after the transformation from M IN S ET C OVER (edges of the form (ur ,C− j ) are not drawn as they depend on the instance I)

Lemma 1. Let C be a solution of I, then there exists a solution E of I with |E | = |C |. It directly follows that an optimal solution E of the instance I satisfies |E | ≤ |C|. Lemma 2. There is an optimal solution E of I that only consists of shortcuts of the form (Ci− , s) for some i ∈ .

Proof. Let E be an optimal solution of I . We decompose E = EA ∪· EB such that EA only contains shortcuts of the form (Ci− , s) for some i and EB contains all other shortcuts. If EB is not empty there exists an ∈ such that for every j, r ∈ for which (ur ,C− j )∈E − the shortcut (C j , s) is not contained in EA . Otherwise EA would be a feasible solution in contradiction to the optimality of E. and |EA | < |E| We fix such an . Let i ∈ be such that there is an edge (u1 ,Ci− ) ∈ E. Further, let p denote the number of nodes in U = {ur ∈ V | r = 1 . . . Δ } such that a shortcut (ur , s) or (ur ,C+ . Assume that p > 1. Then, we could delete all j ) is in EB for some j ∈ shortcuts outgoing from a node in U from EB (this increases the overall hop length by at maximum 2|C|) and introduce the shortcut (Ci− , s) in EA (this decreases the overall hop length by at least Δ + 1 = 2|C| + 2). This solution would be better than the old one in contradiction to the optimality of EA ∪· EB . Hence, p is at most 1.


109

We now state a polynomial time algorithm that computes a desired solution out of We repeatedly proceed as follows until EB is empty. First, we find the given solution E. an as defined above and a j such that (u1 ,C− j ) ∈ E. If no such exists, EA is the desired solution. In case p = 1 we delete the shortcut with source node in U . In case p = 0 still is we delete an arbitrary shortcut with source node in an Ui , i = 1, . . . , |U|. If w(E) − high enough we do nothing. Otherwise we insert the shortcut (C j , s). Obviously, the algorithm runs in polynomial time and computes a desired solution. Lemma 3. Let E be an optimal solution of I . Then, there exists a solution C of I with |E | = |C |. Proof. Let E be an optimal solution of I . By Lemma 2, we know that there exists an optimal solution E with |E | = |E | and shortcuts of the form (Ci , s) for some i ∈ . We denote by U the collection of sets Ui for which there is a shortcut (C− j , s) in E and edges (uir ,C− j ) in E. As E is a feasible solution, we know that w(E ) = |E | + Δ |U | ≥ k = Δ |U|. Because of |E | ≤ |C| < Δ we know that |U | = |U| which means that for every node in uir , there is a shortcut on a path to s. Therefore, the set {Ci | (Ci− , s) ∈ E } is a solution of I.

Theorem 1. Unless P = NP, no polynomial-time constant factor approximation algorithm exists for RSP. The S HORTCUT D ECISION P ROBLEM (SDP) is the variant of Definition 1 where the aim is to decide for a given c ∈ and a given k ∈ whether there exists a shortcut assignment E with |E | = c and w(E ) ≥ k. The proof of the non-approximability of RSP directly transfers to a proof for the NP-completeness of SDP.

Corollary 1. SP and RSP are NP-hard, SDP is NP-complete. Theorem 2. Unless P = NP, no polynomial-time algorithm exists that approximates SP up to an additive constant. Proof. Assume there exists a polynomial-time algorithm A that approximates SP within a fixed bound of Δ . Then we can solve SDP in polynomial time as follows. = Let (G = (V, E, len), c, k) be an instance of SDP. We create a new instance (G 2 (V , E, len), c) of SP by adding, for each node v in G, χ := Δ + 1 + n nodes v1 , . . . , vχ i , v) = 1, i = 1 . . . χ . This can be done in polyand directed edges (vi , v) such that len(v nomial time. by A will be We will first prove, that the endpoints of all shortcuts inserted in G in V : Let E be the set of all shortcuts inserted by A in G. Assume there is a shortcut ( u, v) ∈ (V \V )×V in E . This shortcut only decreases the overall hop length on shortest paths by at most n2 . W.l.o.g we assume that it is possible to insert c shortcuts into G. Therefore there must be a shortcut (x, y) ∈ V × V that is not contained in E . This shortcut will result in a decrease of overall hop length of at least χ . Therefore, deleting ( u, v) and inserting (x, y) would decrease the overall hop length on shortest path by more than Δ which is a contradiction to the approximation bound of A . With Δ := 0 it directly follows that an optimal solution of I only consists of shortcuts in V × V . Given a set of shortcuts E ⊆ V × V we denote the overall decrease of hop

110

R. Bauer et al.

with w(E length in G with w(E ) and in G ). It is w(E ) = (1 + χ )w(E ). Given an ∗ optimal solution E for I and I , it follows (1 + χ ) (w(E ∗ ) − w(E)) = w(E ∗ ) − w(E) ≤ Δ ∗ ∗ Δ . Hence, w(E ) − w(E) ≤ 1+χ < 1 which implies w(E ) = w(E ) as both w(E ∗ ) and w(E ) are integer values. Therefore, we have a polynomial time, exact algorithm for solving SP. We can use this algorithm to decide SDP in polynomial time. Bounded number of shortcuts. If the number of shortcuts we are allowed to insert is bounded by a constant kmax , the number of possible solutions of SP is polynomial in the size of the graph: 2 n (n2 )! ≤ n2kmax . = 2 kmax (n − kmax )!kmax ! Evaluating a given solution means solving the APSP, hence this can be done in time O(n(n log n + m)). For this reason, the whole problem can be solved in polynomial time by a brute-force algorithm. Monotonicity. In order to show the hardness of working with the problem beyond the complexity results, Figure 2 gives an example that, given a shortcut assignment S and a shortcut s, s ∈ S, the following two inequalities do not hold in general: w(S ∪ {s}) ≥ w(S) + w(s) w(S ∪ {s}) ≤ w(S) + w(s).

(1) (2)

It is easy to verify that in Figure 2 the inequalities w({s1 , s2 }) > w(s1 ) + w(s2 ) and w({s1 , s2 , s3 }) < w({s1 , s2 }) + w(s3 ) hold. Note that Inequality 2 holds if for any pair of nodes (s,t) of graph G, there is at most one, unique shortest s-t-path in G. We prove that in the following lemma and corollary. Lemma 4. Given a graph G = (V, E) having unique shortest paths, a set of shortcuts S and a shortcut s. Then, w(S ∪ {s}) ≤ w(S) + w(s). Corollary 2. Given a graph G = (V, E) having unique shortest paths and a set of shortcuts S = {s1 , s2 , . . . , sk }. Then, w(S) ≤ ∑ki=1 w(si ). In the next section we use these results to present approximation algorithms which work in the case of graphs where shortest paths are unique for each pair of nodes. s3 3

s1

s2

Fig. 2. Example Graph G with shortcuts s1 , s2 , s3 , all edges for which no weight is given in the picture have weight 1


111

4 Approximation Algorithms In this section, we propose two polynomial time algorithms for approximatively solving SP in the special case that, for each pair s,t of nodes on the underlying graph, the shortest s-t-path is unique. It turns out that this class is highly relevant as in road networks, most shortest paths are unique and only little modifications have to be made to obtain a graph having unique shortest paths. The first algorithm is a greedy strategy that consists of iteratively solving the problem where the number of shortcuts allowed is one. This algorithm finds a c-approximation of the optimal solution. The second algorithm works with bounded degree and is based on a partition of the nodes. It for graphs finds an O λ · max 1, n2 /(λ 2 c) approximation of the optimal solution, where λ is the number of subsets of the underlying partition. 4.1 The Greedy Strategy Given a weighted directed graph G = (V, E, len), the G REEDY approximation scheme consists of iteratively constructing a sequence G = G0 , G1 , . . . , Gc of graphs where Gi+1 is the graph that results from solving SP on Gi for which the number of shortcuts allowed to insert is one. G REEDY is a polynomial time c-approximation of SP. The approximation bound follows directly from Lemma 4. In detail, our scheme works as follows. The value of w(s) in Gi can be computed by performing an all pairs shortest paths computation in Gi . Hence, each iteration step of G REEDY can be solved by evaluating every of the O(n2 ) possible shortcuts. This gives an overall time complexity of O(cn2 · n(n log n + m)). The following theorem shows the approximation ratio for G REEDY. Theorem 3. Given is a weighted directed graph G = (V, E, len) with unique shortest paths and a positive integer c ∈ . If S∗ is the set of shortcuts in an optimal solution for SP instance (G, c), then the solution G = (V, E ∪ E , len ) computed by G REEDY is a factor c-approximation.

Proof. Let us consider s1 , that is the shortcut computed by the first iteration of G REEDY. Then, w(s) ≤ w(s1 ) for each s ∈ V ×V . Moreover, for any S ⊆ V ×V and for each s ∈ S, w(s) ≤ w(S) and, by Corollary 2, w(S) ≤ ∑s∈S w(s). If we write S∗ = {s∗1 , s∗2 , . . . s∗c }, it follows that c

c

i=1

i=1

w(S∗ )/w(E )

≤ c holds.

w(S∗ ) ≤ ∑ w(s∗i ) ≤ ∑ w(s1 ) = cw(s1 ) ≤ cw(E ). Hence, the inequality

4.2 Approximation via Partitioning Given a weighted, directed graph G = (V, E, len) with bounded degree B, our approximation scheme works as follows. It partitions V into small subsets, solves SP restricted to each subset and then chooses the best solution among all subsets as an approximated solution. If the subsets are small enough, then SP restricted to each set can be solved

112

R. Bauer et al.

in polynomial time. Furthermore, the approximation ratio depends on the number of subsets. In fact, if each optimal shortcut has both of its endpoints contained in one of the subsets, then the worst case approximation ratio is given by the number of subsets. Otherwise, we use the following lemma to bound the decrease in overall hop length on shortest paths of the shortcuts which cross more than one subset. Lemma 5. Let G = (V, E, len) be a weighted directed graph with unique shortest paths and s = (v1 , v ) be a shortcut in G. Let p = (v1 , v2 , . . . , v ) be the shortest path shortcut by s. If we divide s into a set of shortcuts s1 , s2 , . . . , sk such that s1 = (v j0 = v1 , v j1 ), s2 = (v j1 , v j2 ), . . . ,sk = (v jk−1 , v jk ), ji − ji−1 ≥ 2, for each i = 1, 2, . . . , k and − 1 ≤ jk ≤ then, w(s) ≤ 2 ∑ki=1 w(si ). Corollary 3. Let G = (V, E, len) be a weighted directed graph where the shortest paths are unique and let S = {s1 , s2 , . . . , sk } be a set of shortcuts in G. For each si ∈ S, let Si be a set of shortcuts that fullfills the condition of Lemma 5 with respect to si . Then, w(S) ≤ 2 ∑ki=1 w(Si ). In detail, our scheme works as follows. First,√we partition the set V into sets P = {P1 , . . . , Pλ }, where each Pi has size size = c nε /B (i.e. λ = n/size ) for an arbitrary ε > 0. Then, for each cell Pi ∈ P, we compute the neighborhood Ci := Pi ∪ {u ∈ N(v) | v ∈ Pi } of Pi and solve the shortcut problem on G restricted to shortcuts in Ci . That is, we compute Si = argmax{w(S) | S ⊆ Ci ×Ci and |S| ≤ c}. Finally, we determine the set Ci , for which the shortcuts gain the most overall decrease in hop length and set the len ) solution to be the according shortcuts. More formally, we compute G = (V, E ∪ S, where S = argmax{w(Si ) | i = 1, 2, . . . , λ } and len : E ∪ S → + is defined such that len (u, v) equals √ dist(u, v) if (u, v) ∈ S and equals len(u, v) otherwise. √ Since size = c nε /B and G has bounded degree B, √ |Ci | ≤ c nε holds. Hence, each solution Si can be computed by performing at most ( c nε )√2c = n2ε all pairs shortest λ = n/size = nB/ c nε partitions, the overall paths computations in G. As there are√ c ε 2 ε computation time is O( f (n) · n · n/ n ) = O( f (n) · (n/λ )2c · λ ), where f (n) is the time needed for computing all pairs shortest paths in G. The following theorem shows the approximation ratio for PARTITION. Theorem 4. Given a weighted directed graph G = (V, E, len) with bounded degree and unique shortest paths

integer c ∈ , then, the solution computed by and a positive n2 PARTITION is an O λ · max 1, λ 2 c approximation for the optimal solution of the

SP instance (G, c) where λ denotes the number of cells used by PARTITION.

5 Approximative Evaluation of the Measure Function To evaluate the overall decrease in hop length for a given shortcut assignment, we require computing all pairs shortest paths in a graph. Since this computation requires O(n(n log n + m)) time, we provide a stochastical method to quickly evaluate the overall decrease in hop length in this section. This approach can be used for big networks, where APSP is prohibitive. Such networks often arise in the context of timetabling or


113

Algorithm 1. PARTITION

1 2 3 4 5 6

7

input : graph G = (V, E, len), number of shortcuts c, parameter ε > 0 len ) with shortcuts added output: graph G = (V, E ∪ S, √ Partition the set V into sets P = {P1 , . . . , Pλ } each of size size = c nε /B. forall Pi ∈ P do Ci := Pi ∪ {u ∈ N(v) | v ∈ Pi } Si := argmax{w(S) | S ⊆ Ci ×Ci and |S| ≤ c} S := argmax{w(Si ) | i = 1, 2, . . . , λ } otherwise len : E ∪ S → + is such that as len (u, v) = dist(u, v) if (u, v) ∈ S, len (u, v) = len(u, v). len ) Output G = (V, E ∪ S,

Ê

shortest-paths computation on road networks (see [8] for a prominent example). For the sake of simplicity we state the approach for the evaluation of μ := ∑s∈V ∑t∈V h (s,t), the adaption to SP is straightforward. More precisely, we apply the sampling technique to evaluate the measure function μ in an approximative way. We exploit Hoeffding’s Bound [12] to get a confidence intervall of the following unbiased estimation: If X1 , X2 , . . . , XK are real valued independent random variables with ai ≤ Xi ≤ bi and expected mean μ = [∑ Xi /K], then for ξ > 0 K ∑i=1 Xi 2 −2K 2 ξ 2 / ∑K i=1 (bi −ai ) . K − μ ≥ ξ ≤ 2e

Let X1 , X2 , . . . , XK be a family of random variables. For i = 1, 2, . . . , K, Xi equals |V | · ∑t∈V h (si ,t) where si is a node which is chosen uniformly at random. We estimate μ by μˆ := ∑Ki=1 Xi /K. Because of ( μˆ ) = μ we can apply Hoeffding’s Bound if we know an upper bound for the Xi . The value |V |3 is a trivial upper bound.

Definition 4. The shortest path diameter spDiam(G) of a graph G = (V, E, len) is the maximal hop length of a shortest path (shortest with respect to len) on G. If we know the shortest path diameter of a graph we obtain |V |2 spDiam(G) as upper bound for Xi . If we insert this into Hoeffdings Bound, we gain

{|μˆ − μ | ≥ ξ } ≤ 2e−2Kξ /(|V | ·spDiam(G) ) 2

and

4

2

μˆ − μ ≥ lrel ≤ 2e−2K(μˆ ·lrel )2 /(|V |4 ·spDiam(G)2 ) μˆ

for a parameter lrel . In [12] it is stated that Hoeffdings Bound stays correct if, when sampling from a finite population, the samples are being chosen without replacement. Algorithm 2 is an approximation algorithm that exploits the above inequality and that samples without replacement. To compute the exact shortest path diameter of a graph we have to compute APSP. We obtain an upper bound for the shortest path diameter the following way: first we

114

R. Bauer et al.

Algorithm 2. STOCH. EVALUATE OVERALL HOP LENGTH input : graph G = (V, E, len), size of confidence intervall lrel , significance level α output: approximation for the overall hop length on shortest paths 2

compute random order v1 , v2 , . . . , vn of V compute upper bound spDiam for shortest path diameter

3

i := 1; sum := 0; μˆ = −∞

1

4 5 6 7 8 9

while not (i = |V | or 2 · exp(−2i(μˆ · lrel /(|V |4 spDiam(G)2 )) ≤ α ) do T := grow hop minimal SP-Tree rooted at vi sum := sum + |V | · ∑t∈V h (vi ,t) μˆ := sum/i i := i + 1 output μˆ

compute an upper bound diam(G) for the diameter of G. To do that we choose a set of nodes s1 , s2 , . . . , sl uniformly at random. For each node si the value εG (si ) + εG (si ) is an upper bound for the diameter of G. We set diam(G) to be the minimum of these values over all si . Afterwards, we grow, for every node s on G, a shortest paths tree whose construction is stopped as soon as one vertex with distance of more than diam(G)/η is visited where η is a tuning parameter. We denote by τ the maximum hop-length of the shortest paths on any of the trees grown. Then spDiam = τ · η is an upper bound for the shortest path diameter of G. The pseudocode of that algorithm is given in Algorithm 3.

Algorithm 3. COMPUTE UPPER BOUND FOR SP-DIAMETER input : graph G = (V, E, len), tuning parameter l, tuning parameter η output: upper bound spDiam for shortest path diameter 1

diam(G) := ∞; τ := 0;

8

forall i = 1, . . . , l do s := choose node uniformly at random grow shortest paths tree rooted at s grow shortest paths tree rooted at s on the reverted graph diam(G) := min{diam(G), maxv∈V {dist(s, v)} + maxv∈V {dist(v, s)}} forall s ∈ V do T := grow partial shortest paths tree rooted at s. stop growing when first node with dist(s, v) ≥ diam(G)/η is visited. τ := max{τ , maximal number of edges of a path in T }

9

output τ · η

2 3 4 5 6 7

Obviously, the whole proceeding only makes sense for graphs for which the shortest path diameter is much smaller than the number of nodes. This holds for a wide range of real-world graphs, in particular for road networks. For example, the street network of Luxembourg provided by the PTV AG [1] consists of 30733 nodes and has a shortest path diameter of only 429.


115

6 Conclusion In this work we studied two problems. The S HORTCUT P ROBLEM (SP) is the problem of how to add a given number of edges to a weighted graph, such that distances do not change and the average number of hops on hop minimal shortest paths in the graph becomes minimal. The R EVERSE S HORTCUT P ROBLEM (RSP) is the variant of SP where the desired decrease in the average number of hops is fixed and the number of inserted edges has to be minimized. We want to stress out, that this is the first approach towards a theoretical foundation for inserting shortcuts, which is heuristically used by many speed-up techniques for D IJKSTRA’s algorithm. We proved that both problems are NP-hard and that there is no polynomial time constant factor approximation algorithm for RSP, unless P = NP. Furthermore, no polynomial time algorithm exists that approximates SP up to an additive constant, unless P = NP and that problem is solvable in polynomial time if the number of shortcuts to insert is bounded. Moreover, we gave two polynomial time approximation algorithms for SP that work for the case that shortest paths on the underlying graph are unique. Finally, we proposed a stochastical method to evaluate the measure function of SP very fast. This can be used for large input networks where an exact evaluation is prohibitive. There exists a wide range of possible future work on the problem. From the theoretical point of view the probably most interesting open question is that of the approximability of SP. It is still not known if it is in APX. Furthermore, it would be helpful to identify graph-classes for which SP or RSP become tractable. From the practical point of view, it is important to develop heuristics that find good shortcuts for real-world input. In particular, evolutionary algorithms and local search algorithms (similar to the greedy strategy) seem to be promising. The output of these algorithms should be experimentally tested on their benefit for different speed-up techniques. Further, it is interesting to evaluate the output of the currently used shortcut insertion strategies in the problem’s measure function.

References 1. PTV AG - Planung Transport Verkehr (1979), http://www.ptv.de 2. Proceedings of the 8th Workshop on Algorithm Engineering and Experiments (ALENEX 2006). SIAM, Philadelphia (2006) 3. Bauer, R., D’Angelo, G., Delling, D., Wagner, D.: The Shortcut Problem – Complexity and Approximation (Full Version), http://i11www.iti.uni-karlsruhe.de/members/ rbauer/pdf/bddw-SOFSEM09 FULL.pdf 4. Bauer, R., Delling, D.: SHARC: Fast and Robust Unidirectional Routing. In: Proceedings of the 10th Workshop on Algorithm Engineering and Experiments (ALENEX 2008), pp. 13–26. SIAM, Philadelphia (2008) 5. Bauer, R., Delling, D., Sanders, P., Schieferdecker, D., Schultes, D., Wagner, D.: Combining Hierarchical and Goal-Directed Speed-Up Techniques for Dijkstra’s Algorithm. In: McGeoch (ed.) [15], pp. 303–318 6. Bruera, F., Cicerone, S., D’Angelo, G., Stefano, G.D., Frigioni, D.: Dynamic Multi-level Overlay Graphs for Shortest Paths. Mathematics in Computer Science 1(4) (2008) 7. Demetrescu, C. (ed.): WEA 2007. LNCS, vol. 4525. Springer, Heidelberg (2007)

116

R. Bauer et al.

8. Demetrescu, C., Goldberg, A.V., Johnson, D.S. (eds.): 9th DIMACS Implementation Challenge - Shortest Paths (November 2006) 9. Geisberger, R., Sanders, P., Schultes, D., Delling, D.: Contraction Hierarchies: Faster and Simpler Hierarchical Routing in Road Networks. In: McGeoch (ed.) [15], pp. 319–333 10. Goldberg, A.V., Kaplan, H., Werneck, R.F.: Reach for A*: Efficient Point-to-Point Shortest Path Algorithms. In: ALENEX 2006 [2], pp. 129–143 (2006) 11. Goldberg, A.V., Kaplan, H., Werneck, R.F.: Better Landmarks Within Reach. In: Demetrescu (ed.) [7], pp. 38–51 12. Hoeffding, W.: Probability inequalities for sums of bounded random variables. Journal of the American Statistical Association 58(301), 713–721 (1963) 13. Holzer, M., Schulz, F., Wagner, D.: Engineering Multi-Level Overlay Graphs for ShortestPath Queries. In: ALENEX 2006 [2] (2006) 14. Lauther, U.: An Extremely Fast, Exact Algorithm for Finding Shortest Paths in Static Networks with Geographical Background. In: Geoinformation und Mobilität - von der Forschung zur praktischen Anwendung, vol. 22, pp. 219–230. IfGI prints (2004) 15. McGeoch, C.C. (ed.): WEA 2008. LNCS, vol. 5038. Springer, Heidelberg (2008) 16. Sanders, P., Schultes, D.: Engineering Highway Hierarchies. In: Azar, Y., Erlebach, T. (eds.) ESA 2006. LNCS, vol. 4168, pp. 804–816. Springer, Heidelberg (2006) 17. Sanders, P., Schultes, D.: Engineering Fast Route Planning Algorithms. In: Demetrescu (ed.) [7], pp. 23–36 18. Schultes, D., Sanders, P.: Dynamic Highway-Node Routing. In: Demetrescu (ed.) [7], pp. 66–79 19. Schulz, F., Wagner, D., Weihe, K.: Dijkstra’s Algorithm On-Line: An Empirical Case Study from Public Railroad Transport. ACM Journal of Experimental Algorithmics, 5 (2000) 20. Schulz, F., Wagner, D., Zaroliagis, C.: Using Multi-Level Graphs for Timetable Information in Railway Systems. In: Mount, D.M., Stein, C. (eds.) ALENEX 2002. LNCS, vol. 2409, pp. 43–59. Springer, Heidelberg (2002) 21. Wagner, D., Willhalm, T.: Speed-Up Techniques for Shortest-Path Computations. In: Thomas, W., Weil, P. (eds.) STACS 2007. LNCS, vol. 4393, pp. 23–36. Springer, Heidelberg (2007)

Green Computing: Energy Consumption Optimized Service Hosting Walter Binder1 and Niranjan Suri2 1

2

Faculty of Informatics, University of Lugano Lugano, Switzerland [email protected] Institute for Human and Machine Cognition (IHMC) Florida, USA [email protected]

Abstract. Green Computing is a recent trend towards designing, building, and operating computer systems to be energy efficient. While programs such as Energy Star have been around since the early 1990s, recent concerns regarding global climate change and the energy crisis have led to renewed interest in Green Computing. Data centers are a significant consumers of energy - both to power the computers as well as to provide the necessary cooling. This paper proposes a new approach to reduce energy utilization in data centers. In particular, our approach relies on consolidating services dynamically onto a subset of the available servers and temporarily shutting down servers in order to conserve energy. We present initial work on a probabilistic service dispatch algorithm that aims at minimizing the number of running servers such that they suffice for meeting the quality of service required by service-level agreements. Given the estimated energy consumption and projected growth in data centers, the proposed effort has the potential to positively impact energy consumption. Keywords: Green computing, energy conservation, energy efficiency, data centers, service hosting, service dispatch, service-level agreements.

1 Introduction Computer systems are becoming increasingly ubiquitous and a part of the national infrastructure of every country, resulting in large installations of computer systems to provide critical services. These installations, normally referred to as data centers, have grown to require significant levels of electrical power, thereby contributing to the consumption of fossil fuels and generation of green house gases. In the United States alone, it is estimated that 61 billion kilowatt-hours (kWh) were utilized to power data centers in the year 2006, which equates to approximately US$ 4,5 billion. The projected growth by the year 2011 exceeds 100 billion kWh, with an estimated cost of US$ 7,4 billion. Moreover, it is estimated that 10 additional electrical power generation plants would need to be constructed in order to support this growth in the demand for data centers [1]. One of the reasons for the high levels of power consumption is that computers in these data centers tend to be continuously operating, regardless of the load being placed M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 117–128, 2009. c Springer-Verlag Berlin Heidelberg 2009

118

W. Binder and N. Suri

on them. As long as computers are running, they produce heat which requires cooling mechanisms, another significant consumer of electricity. One possible approach to solving this problem is to shutdown computers that are idle and restart them when necessary. The notion of Green Computing has become popular given recent concerns about global climate change and the energy crisis. This paper proposes a new effort to achieve Green Computing in data centers. Our approach dynamically consolidates executing services, such as Web services or services used in Web 2.0 mashups, on a subset of the servers in a data center. The scientific contributions of this paper are energy consumption-optimized service dispatch algorithms to keep the number of running servers as small as possible, but sufficient to meet the current service demand. The service dispatch algorithms not only select the server to execute an incoming request, but they also manage the pool of running servers by respectively issuing shutdown and restart commands, according to the overall load. Monitoring techniques provide information on the average response time for service requests and on the idle time for each server. According to these parameters and to the quality of service (QoS) requirements described in service-level agreements (SLAs)1 , the service dispatch algorithms decide on which servers need to be running. We project that such an approach can significantly reduce the number of computers that need to be continuously operating and thereby reduce the overall power consumption by data centers. The rest of this paper is organized as follows. Section 2 gives an overview of our service hosting environment and describes the assumptions underlying our approach. Section 3 explains the mechanics of server shutdown and restart. Section 4 discusses two different approaches to energy-conserving service dispatch, an optimization algorithm and a probabilistic control algorithm. As the optimization algorithm requires careful modelling of the hosting environment, the services, and the expected service requests, which is difficult in practice, we emphasize our probabilistic control algorithm, which we present in more detail. Section 5 discusses related work, Section 6 outlines our ongoing research, and finally Section 7 concludes this paper.

2 Service Hosting Environment The hosting environment includes dedicated machines for three different purposes: Dispatchers, file servers, and compute servers. A Dispatcher receives service requests and chooses the compute servers to handle them. It also decides when to shutdown and restart compute servers. File servers provide all data sources. Compute servers host the services. Dispatchers and file servers are permanently running, whereas compute servers are running only if needed. The approach presented in this paper aims at minimizing the number of running compute servers while offering the required QoS to the clients. Each compute server hosts a Node Manager component. The Node Manager is responsible for monitoring idle time and average service response time. It communicates 1

Languages such as Web Service Level Agreements (WSLA) [2] or WS-Agreement [3] may be used to specify the conditions of service delivery and the QoS.

Green Computing: Energy Consumption Optimized Service Hosting

119

the measurements to a Dispatcher. Moreover, the Node Manager handles server shutdown upon request from a Dispatcher; for details, see Section 3. Each compute server may offer different computing resources and may have different energy consumption. Even though the hosting environment may consist of homogeneous hardware in the beginning, it is unlikely to maintain a homogeneous environment in the long term. E.g., individual cores on a multicore machine may fail, reducing the resources of a compute server. Moreover, additional compute servers (new models) may be installed in order to cope with an increasing service demand. Consequently, our service dispatch algorithm needs to take the different resources and energy consumption of the compute servers into account. The hosting environment may offer several different service types (ST). Each ST is uniquely identified by a service interface and a service-level agreement (SLA) that defines QoS parameters. The QoS parameters are specified according to a common ontology such as [4] or [5]. Currently, we focus on a single QoS parameter, service response time. Compute servers may be turned off only if the remaining compute servers can meet the required service response time for all STs in the hosting environment. Each ST represents either a stateless service or a stateful service. Stateful services provide sessions; within the same session, a client may send multiple requests that operate on the state resulting from previous requests within the session. A session may be explicitly terminated by the client, or automatically terminated by the compute server after some period of inactivity. For a stateless service, each request is independent of previous requests. After completing all accepted requests, the stateless service may be stopped. In contrast, a stateful service cannot be stopped while a session is active. We assume that the overall duration of a session is limited (which can be enforced with a timeout mechanism) in order to prevent sessions from arbitrarily delaying the termination of a stateful service. Alternatively, in order to avoid the aforementioned restriction regarding the total session duration, sessions may be migrated from one compute server to another. However, that requires additional dedicated middleware support. Each compute server can host any ST (and any combination of STs). That is, there are no dedicated machines for particular STs. This assumption will simplify the description of our service dispatch algorithm in Section 4.

3 Shutdown and Restart of Compute Servers In this section we discuss the mechanics of shutting down and restarting a compute server. When the Dispatcher decides to shut down a compute server, it sends a shutdown request to the Node Manager of the corresponding compute server, which prepares its shutdown. New service requests are no longer dispatched to that compute server. If the compute server is currently processing service requests or maintaining active sessions of stateful services, it is first necessary to make the compute server idle, which can be accomplished in two different ways. The first approach is to simply wait until existing service requests complete and all active sessions terminate. The second approach is to migrate the execution of service requests and active sessions onto another compute server. Although the latter appoach requires dedicated middleware support, it is

120


attractive for services that are stateful or long-running, which otherwise may significantly delay the effective shutdown of the compute server. Once a compute server is idle, the Node Manager requests the operating system to shut down the server in order to conserve energy. There are three possibilities to shutdown a compute server: (1) Shutdown the system completely (this approach will require that upon powerup, the system reboots from scratch, loads the operating system, and resumes execution); (2) Hibernate the system (the memory contents are saved onto secondary storage so that the system may be resumed by reloading the memory snapshot); (3) Suspend the system (the memory contents remain in memory, but the processor stops executing). Options 1 and 2 both result in the system being completely turned off, thereby requiring minimal power after shutdown (except for the Wake On LAN feature described below). In some situations, a shutdown and clean reboot may be preferred, as a means to clean out any resources held by the operating system. However, the hibernate and resume option is usually faster. Option 3 requires that the system maintain some power to keep the contents of memory from being lost. This option results in the fastest restart time at the expense of some power utilization while being suspended. The Dispatcher may also choose from one of the three options based on the circumstances. For example, short shutdown and restart cycles may cause the Dispatcher to choose option 3, whereas longer cycles may accommodate options 1 or 2. Also, policy may dictate that option 1 should be performed periodically to “clean” the system (e.g., to get rid of memory leaks). The restart mechanism utilizes the Wake On LAN [6] capability that is supported by most computers and LAN interfaces. Wake On LAN depends on a special magic packet that signals the Ethernet interface on a host to power on the host. The magic packet consists of the bytes 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF followed by the Ethernet MAC address of the host repeated 16 times. Therefore, the Dispatcher maintains a table of each compute server’s MAC address. When the Dispatcher wishes to wake up a compute server, a UDP packet is broadcast to the LAN with the appropriate MAC address of the compute server that should be started. The Dispatcher then awaits the Node Manager on the compute server to contact the Dispatcher indicating that the server is up before allocating service requests to it.

4 Energy Conserving Service Dispatch Dispatchers play two important roles in our architecture; they select the compute server to handle an incoming service request and they manage the pool of compute servers so as to minimize the overall energy consumption while respecting existing SLAs. In the following we concentrate on the latter issue, aiming at consolidating the offered services on a subset of the compute servers that suffices to meet the current service demand. We have considered two approaches, (1) an optimization algorithm based on a mathematical model of the hosting environment and the computational load, and (2) a probabilistic control algorithm that reacts to changes in the idle CPU time on compute servers and in the average service response time for each ST.


121

4.1 Optimization Algorithm The goal of the optimization algorithm, which we assume will execute periodically after a given time interval, can be informally described as follows: Choose a subset of the compute servers such that the overall energy consumption is minimized, while the expected load for the next time interval will not violate the SLA of any ST. As we do not know the load of the next time interval in advance, we can use monitoring information from the previous time interval or longer term statistics to predict the expected load for the next time interval. For each compute server, the energy consumption must be known. Since we are dealing with different STs and with heterogeneous compute servers, we introduce the notion of a Standardized Service Request (SSR) and express the resources of each compute server using the metric SSR/s (the number of SSRs that can be processed per second). For each ST, we define a factor fST such that one request for ST corresponds to fST SSRs. Assume a subset of the available compute servers and an expected number of service requests for each ST. Considering all possible schedules for the given number of service requests, we can estimate the expected total execution time for each ST under the simplifying assumptions that the selected compute servers operate in parallel and there are no dependencies between the individual service requests. This estimation is performed using the SSR metric. A schedule determines the number of service requests for each ST to be performed on each compute server, as well as the order of the service requests on each compute server. The estimated total execution time for all service requests of each ST allows us to compute the expected average service response time and we determine whether it meets or violates the SLA of the corresponding ST. Schedules that violate the SLA of at least one ST are invalid. Consequently, the optimization algorithm yields the set of compute servers with minimum overall energy consumption such that there is a valid schedule meeting the SLAs of all STs. There are many different techniques to implement the optimization algorithm, such as constraint optimization techniques, genetic algorithms, etc. While this approach gives a reference model, it is not well suited in practice, for the following four reasons: 1. The simplifying assumption that service requests are independent does not meet many practical situations. For example, it does not apply for stateful services. Moreover, each possible schedule may result in different resource contention, e.g., on the file servers. 2. The search space can be large and consequently the runtime of the optimization algorithm can be high. 3. An appropriate definition of the factors fST is difficult, as well as the specification of the resources of each compute server in terms of SSR/s. 4. Having found a valid schedule for a chosen set of compute servers based on estimated load does not guarantee that the actual executed schedule will be valid as well. First, the load estimation may be wrong, and, second, the service requests may arrive in a different order, resulting in a distinct schedule. For these reasons, we do not discuss the optimization algorithm in more detail, but instead we consider a second approach, a probabilistic control algorithm.

122


4.2 Probabilistic Control Algorithm In our probabilistic control algorithm, a Dispatcher distributes service requests to the most energy-efficient compute servers in a probabilistic manner. The algorithm aims at keeping as many compute servers turned off as possible without violating any SLAs. It relies on two principles: 1. If a running compute server si has idle time, the probability that service requests are dispatched to si is increased. Conversely, the probability that service requests are dispatched to the least energy-efficient compute server currently running sr is decreased by the same amount. If the probability that service requests are dispatched to sr becomes zero, the shutdown of sr is initiated. 2. In an overload situation, the algorithm first tries to better distribute the load amongst the running compute servers, and restarts an extra machine only as a last remedy. Having outlined the principles of our probabilistic control algorithm, we describe it now in more detail. We assume n compute servers represented by the n-tuple < s1 , ..., sn >, sorted according to their energy efficiency. If on average s j consumes more energy per service request than si , then i < j. In each configuration of the overall system, the first r ≥ 1 compute servers in the tuple are running, whereas the following n − r compute servers are switched off (or are in the process of switching themselves off). For each ST, there is a n-tuple pST of dispatch probabilities; pST (i) is the probability that a request for ST will be dispatched to compute server si . (∀ri=1 )(0 ≤ pST (i) ≤ 1); (∀ni=r+1 )(pST (i) = 0); ∑ni=1 pST (i) = 1. In an overload situation, if r < n, the control algorithm will turn on sr+1 (r will be incremented afterwards). Conversely, if for each ST, pST (r) = 0 (and r > 1, which is implied by the previous condition), the algorithm will turn off sr (r will be decremented afterwards). That is, before a compute server can be turned off, its dispatch probabilities must be zero for each ST. Periodically, the control algorithm adjusts the dispatch probabilities for each ST according to the compute servers’ recent activities. To this end, the control algorithm polls (from each compute server’s Node Manager) the average response time for each ST in the last time period, as well as the server’s idle time in the last time period. The pseudo-code in Fig. 1 illustrates our probabilistic control algorithm. It first checks for an overload situation of a running compute server for a service type X. We consider an overload if the idle time is below a given threshold Tbusy and if the average response time for service type X exceeds the corresponding SLA’s limit L reduced by a given ε . That is, we consider L − ε a “high-watermark” that should not be exceeded. If an overload situation of compute server si for service type X is detected, we look for another compute server sk where the idle time exceeds a given threshold Tidle and the average response time for all service types is below the respective “high-watermark”. If such a compute server sk is found, we reduce the dispatch probability of service type X on compute server si by the value Δ p and increment the dispatch probability of service type X on compute server sk by the same Δ p. The value Δ p is computed by the customizable function π (ST, src, dst), which returns the fraction of the dispatch probability of a given service type ST on compute server ssrc to be reallocated to server sdst ; 0 ≤ Δ p ≤ pST (src). Note that the control algorithm favors incrementing the dispatch


123

1. overload ← f alse; 2. For each running compute server si (1 ≤ i ≤ r): If the idle time of si is below a given threshold Tbusy and there is a service type X such that the average response time of si exceeds the corresponding SLA’s response time parameter reduced by a constant ε (i.e., overload of si ): (a) overload ← true; (b) restart ← true; (c) For 1 ≤ k ≤ r; k = i: If the idle time of compute server sk exceeds a given threshold Tidle and for each service type the average response time of sk does not exceed the corresponding SLA’s response time parameter reduced by ε : – Δ p := π (X, i, k); – pX (i) := pX (i) − Δ p; – pX (k) := pX (k) + Δ p; – restart ← f alse; – break; (d) If restart = true and r < n: – Initiate restart of sr+1 ; – r := r + 1; 3. If overload = f alse and r > 1: (a) For each running compute server si (1 ≤ i < r): If the idle time of si exceeds a given threshold Tidle and for each service type the average response time of si does not exceed the corresponding SLA’s response time parameter reduced by ε : – Select a service type X such that pX (r) ≥ pY (r) for all service types Y . – Δ p := π (X, r, i); – pX (r) := pX (r) − Δ p; – pX (i) := pX (i) + Δ p; (b) If for all service types X, pX (r) = 0, and sr has been running for a given minimum running time Trunning : – Initiate shutdown of sr ; – r := r − 1;

Fig. 1. Probabilistic control algorithm. The algorithm is periodically executed by the Dispatcher using recent monitoring data (average service response time, idle time) from the compute servers. r is the number of compute servers currently running.

probability of the most energy-efficient compute server that appears to have enough idle resources. If no overload situation is detected, the algorithm searches for idle resources on the running compute servers. If possible, the dispatch probability of compute server sr (which is the least energy-efficient compute server running) is reduced, while increasing the dispatch probability of a found compute server with enough idle resources. If the dispatch probabilities pX (r) for all service types X are zero, compute server sr is eligible to be shut down. However, we require each compute server to run for at least Trunning time units, so as to avoid continuously turning on and off the same compute server in case of workload fluctuations.

124


In summary, our control algorithm consolidates services on the most energy-efficient compute servers. In a single run of the presented control algorithm, at most one compute server is shutdown or restarted. The algorithm can be easily adapted to allow for the shutdown or restart of multiple compute servers in a single run.

5 Related Work Related work in this area falls into a few different categories. Here we consider various techniques for conserving energy, process and job scheduling, and the monitoring of SLAs. The issue of power consumption in data centers has gained the attention of many professionals in the IT industry. The Green Grid consortium2 has been established to advocate data center design and management to support energy efficiency and several white papers have been published, including ways to conserve power [7] and metrics for data centers [8]. Interfaces that allow managers to monitor power consumption and productivity have also been proposed [9]. These efforts address topics including rightsizing a data center during design time, enabling processor power saving, and powering down servers when not in use. However, their efforts to powering down servers is rather coarse grained. For example, they suggest turning off certain servers with dedicated roles, such as performing backups, when they are not scheduled to perform any activity. The approach proposed in this paper is dynamic and fine-grained and operates based on the active load as opposed to assuming fixed schedules. In [10], the author presents a holistic approach to green computing, including topics such as recycling, which is not the focus of this effort. In terms of power conservation, the author primarily highlights energy-efficient approaches to cooling. Another approach to conserving power is through server virtualization, which reduces the number of physical servers necessary, and hence, the power consumed. In our approach, the goal is to dynamically reduce the number of active server nodes, which will also reduce the heat generated and hence the power necessary to cool the systems. This can be combined with more energy efficient approaches to cooling, such as liquid cooling, to achieve even more power conservation. Finally, while virtualization is an effective technique to reducing power consumption, it addresses a different problem than the one in this paper. Virtualization is suitable in situations where multiple “computers” are necessary (for example, for ownership, isolation, or other reasons) within the data center but each of these computers does not need all the resources of a full server to be dedicated to them. Our approach is different and does not attempt to solve the virtualization problem. Instead, we are concerned with dynamically controlling the number of physical servers that are on or off in order to match energy consumption with real processing demand. Significant work has also been done on individual system or processor level control in order to reduce power consumption. Many modern CPUs can dynamically vary their power consumption based on load. For example, in [11] and [12], the authors are focused on dynamically monitoring and controlling the clock frequency and power consumption of a processor in order to provide just the required performance level. 2

http://www.thegreengrid.org/


125

However, they do not focus on turning off or suspending systems entirely, unlike this effort. Processor-level power control can certainly be combined with an approach such as the one described in this paper. Our service dispatch algorithms can be related to process scheduling and load balancing algorithms in operating systems, as well as to job scheduling in Grid computing. However, whereas existing algorithms typically focus only on performance goals, such as CPU utilization, throughput, response time, turnaround time, or fairness, our approach considers also energy consumption in the hosting environment (in addition to response time). Service dispatch in our probabilistic approach is closely related to lottery scheduling [13]. In lottery scheduling, each operating system process receives a number of lottery tickets proportional to its importance. The scheduler randomly selects a ticket and schedules the process corresponding to the ticket. Hence, in a probabilistic manner, important processes receive more CPU than less important processes. In lottery scheduling, tickets are not numbered; it is sufficient to maintain the number of tickets per process and hence the total number of tickets in the system. Tickets can be transferred between processes so as to reflect changes in process priorities. The ideas of lottery scheduling are directly applicable to service dispatch in our approach. For each service type X, we can replace the n-tuple pX of scheduling probabilities with a n-tuple of lottery tickets for service type X. The function π that decides on the reallocation of scheduling probabilities then determines the number of tickets to transfer. Dealing with lottery tickets is more efficient than handling probabilities, because only integer arithmetic is needed. However, it is important to properly choose the granularity of tickets, i.e., the total number of tickets for each service type. There is a large body of research addressing infrastructural facilities for SLA monitoring [2,14,15,16,17]. Some of these approaches integrate the monitoring mechanisms into the service middleware and help the server provider allocate resources so as to meet the conditions of service delivery stated in SLAs, while other approaches rely on a trusted monitor or on a reputation mechanism to provide reliable service rankings for clients. Our approach leverages monitoring information provided by the Node Manager; while we are also concerned with SLA-aware resource allocation, the main focus of our work in on reducing energy consumption in the hosting environment.

6 Ongoing Research In this section we summarize the direction of our ongoing research. Testbed and evaluation: The algorithms presented in this paper need to be evaluated, where the primary metric is the amount of energy conserved for a given workload with respect to the usual setting where all servers are continuously running. Ideally, the potential for energy savings will be examined using traces of service execution in data centers. Furthermore, we are working on a testbed that allows us to simulate different hosting environments, workloads, and service types. Regarding service types, we are not considering service functionality, but only performance models (e.g., response time). Concerning our probabilistic control algorithm, the testbed will be used to determine various algorithm parameters, such as the length of the time interval between

126


successive runs of the algorithm, or the function π that determines to which extend dispatch probabilities are reallocated. Migration: In order to improve energy utilization by reducing the time needed to prepare a compute server for shutdown, we are investigating techniques for service migration, either with the service state (for stateful services) or even with execution state (strong mobility [18]). Migration of services that are currently servicing clients must be done transparently. We will explore the Mockets3 communication library to achieve this capability. Optimization criteria: Currently, our service dispatch algorithms only consider energy consumption and average service response time as optimization goals. Several other optimization criteria should be considered as well. For instance, we would prefer to minimize the number of service types with non-zero dispatch probability on each compute server, in order to reduce the amount of active code (and possibly improve locality, cache hit rate, and therefore performance). Moreover, the selection of the next compute server to be shut down should not only be based on the energy-efficiency of the server (there may be many servers of the same model, i.e., with identical energy efficiency), but should also involve considerations regarding the effort required to prepare the shutdown (e.g., the number of active sessions). Distribution and replication: The service dispatch algorithms presented in this paper are centralized and may become performance bottlenecks. We are considering different ways to distribute our probabilistic control algorithm. One approach is to use a different Dispatcher for each service type. It is also possible to replicate the tuples of dispatch probabilities on multiple Dispatchers, while one particular Dispatcher is responsible of periodically updating these tuples, communicating them to the other Dispatchers, and handling the shutdown and restart of compute servers. Fault tolerance: The Dispatcher has to properly address the failure of compute servers; the dispatch probabilities of all service types for a failed compute server should be set to zero. Moreover, failures of the Dispatcher must be considered as well. Sudden fluctuations: A sudden and significant increase in service requests may cause temporary overload situations, possibly leading to the violation of SLAs until the needed machines are restarted. This could also increase the vulnerability in case of denial-of-service attacks. Both of these issues need to be considered.

7 Conclusion This paper has presented an approach to improving the energy efficiency of data centers that support execution of services. Unlike other approaches that rely on processor power control or improved cooling efficiency, our approach relies on trying to shut down server nodes that are under utilized. The Dispatcher component monitors the server response time in comparison with SLAs and consolidates services onto as few servers as possible. Idle servers are then shut down and restarted using Wake On LAN when necessary. 3

http://mockets.ihmc.us/


127

The work described here is preliminary and still in progress. The next steps have been outlined in the previous section. However, we anticipate that an approach such as the one presented in this paper can significantly reduce the energy requirements of data centers, which also helps reduce the costs incurred by data centers.

Acknowledgements The work presented in this paper has been supported by the Swiss National Science Foundation.

References 1. EPA: ENERGY STAR Program. Report to Congress on Server and Data Center Energy Efficiency. Technical report, United States Environmental Protection Agency (2007) 2. Dan, A., Davis, D., Kearney, R., Keller, A., King, R.P., Kuebler, D., Ludwig, H., Polan, M., Spreitzer, M., Youssef, A.: Web services on demand: WSLA-driven automated management. IBM Systems Journal 43(1), 136–158 (2004) 3. Andrieux, A., Czajkowski, K., Dan, A., Keahey, K., Ludwig, H., Nakata, T., Pruyne, J., Rofrano, J., Tuecke, S., Xu, M.: Web Services Agreement Specification (WS-Agreement), GFD-R-P.107 (March 2007), http://www.ogf.org/documents/GFD.107.pdf 4. Maximilien, M., Singh, M.: A Framework and Ontology for Dynamic Web Services Selection. IEEE Internet Computing 8(5), 84–93 (2004) 5. Ran, S.: A Model for Web Service Discovery with QoS. ACM SIGecom Exchanges 4(1), 1–10 (2003) 6. AMD: Magic Packet Technology (November 1995), http://www.amd.com/us-en/ assets/content type/white papers and tech docs/20213.pdf 7. Blackburn, M.: Five Ways to Reduce Data Center Server Power Consumption. The Green Grid (2008) 8. Belady, C., Patterson, M.: The Green Grid Productivity Indicator. The Green Grid (2008) 9. Verdun, G., Azevedo, D., Barrass, H., Berard, S., Bramfitt, M., Cader, T., Darby, T., Long, C., Gruendler, N., Macarthur, B., Morris, P., Rawson, A., Simonelli, J., Singh, H., Wallerich, J.: The Green Grid Metrics: Data Center Infrastructure Efficiency (DCIE) Detailed Analysis. The Green Grid (2008) 10. Murugesan, S.: Harnessing green IT: Principles and practices. IT Professional 10(1), 24–33 (2008) 11. Ge, R., Feng, X., Feng, W., Cameron, K.W.: CPU MISER: A performance-directed, run-time system for power-aware clusters. In: Proceedings of the 2007 International Conference on Parallel Processing (ICPP 2007), pp. 18–25. IEEE Computer Society, Los Alamitos (2007) 12. Hsu, C., Feng, W.: A power-aware run-time system for high-performance computing. In: Proceedings of the 2005 ACM/IEEE Supercomputing Conference (SC 2005). IEEE Computer Society, Los Alamitos (2005) 13. Waldspurger, C.A., Weihl, W.E.: Lottery scheduling: flexible proportional-share resource management. In: OSDI 1994: Proceedings of the 1st USENIX conference on Operating Systems Design and Implementation, Berkeley, CA, USA. USENIX Association (1994) 14. Sahai, A., Machiraju, V., Sayal, M., van Moorsel, A.P.A., Casati, F.: Automated SLA monitoring for web services. In: Feridun, M., Kropf, P.G., Babin, G. (eds.) DSOM 2002. LNCS, vol. 2506, pp. 28–41. Springer, Heidelberg (2002)

128


15. Ludwig, H., Dan, A., Kearney, R.: Cremona: An architecture and library for creation and monitoring of WS-Agreements. In: ICSOC 2004: Proceedings of the 2nd international conference on Service oriented computing, pp. 65–74. ACM Press, New York (2004) 16. Barbon, F., Traverso, P., Pistore, M., Trainotti, M.: Run-Time Monitoring of Instances and Classes of Web-Service Compositions. In: Proceedings of ICWS 2006 (2006) 17. Jurca, R., Binder, W., Faltings, B.: Reliable QoS monitoring based on client feedback. In: 16th International World Wide Web Conference (WWW 2007), Banff, Alberta, Canada, pp. 1003–1012. ACM, New York (2007) 18. Fuggetta, A., Picco, G.P., Vigna, G.: Understanding Code Mobility. IEEE Transactions on Software Engineering 24(5), 342–361 (1998)

On the OBDD Complexity of Threshold Functions and the Variable Ordering Problem (Extended Abstract) Beate Bollig LS2 Informatik, TU Dortmund, 44221 Dortmund, Germany [email protected]

Abstract. Ordered binary decision diagrams (OBDDs) are one of the most common dynamic data structures for Boolean functions. Among the many areas of application are verification, model checking, computer aided design, relational algebra, and symbolic graph algorithms. Threshold functions are the basic functions for discrete neural networks and are used as building blocks in the design of symbolic graph algorithms. In this paper the first exponential lower bound on the size of a more general model than OBDDs and the first nontrivial asymptotically optimal bound on the OBDD size for a threshold function are presented. Furthermore, if the number of different weights is a constant it is shown that computing an optimal variable order for multiple output threshold functions is NP-hard whereas for single output function the problem is solvable in deterministic polynomial time. Keywords: Computational complexity, ordered binary decision diagrams, threshold functions, variable ordering problem.

1 1.1

Introduction and Results Ordered Binary Decision Diagrams and Threshold Functions

When working with Boolean functions as in circuit verification, synthesis, and model checking, ordered binary decision diagrams, denoted OBDDs, introduced by Bryant [6], are one of the most often used data structures supporting all fundamental operations on Boolean functions. Furthermore, in the last years a research branch has emerged which is concerned with the theoretical design and analysis of so-called symbolic algorithms which solve graph problems on OBDD-represented graph instances (see, e.g., [9,10], [23]). Definition 1. Let Xn = {x1 , . . . , xn } be a set of Boolean variables. A variable order π on Xn is a permutation on {1, . . . , n} leading to the ordered list xπ(1) , . . . , xπ(n) of the variables. In the following a variable order π is sometimes identified with the corresponding order xπ(1) , . . . , xπ(n) of the variables if the meaning in clear from the context. M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 129–140, 2009. c Springer-Verlag Berlin Heidelberg 2009

130

B. Bollig

Definition 2. A π-OBDD on Xn is a directed acyclic graph G = (V, E) whose sinks are labeled by Boolean constants and whose non sink (or inner ) nodes are labeled by Boolean variables from Xn . Each inner node has two outgoing edges one labeled by 0 and the other by 1. The edges between inner nodes have to respect the variable order π, i.e., if an edge leads from an xi -node to an xj -node, π −1 (i) ≤ π −1 (j) (xi precedes xj in xπ(1) , . . . , xπ(n) ). Each node v represents a Boolean function fv : {0, 1}n → {0, 1} defined in the following way. In order to evaluate fv (b), b ∈ {0, 1}n , start at v. After reaching an xi -node choose the outgoing edge with label bi until a sink is reached. The label of this sink defines fv (b). The size of a π-OBDD G is equal to the number of its nodes and the π-OBDD size of a function f , denoted by π-OBDD(f ), is the size of the minimal π-OBDD representing f . SBDDs (shared binary decision diagrams) are an extension of OBDDs that can express multiple functions. An SBDD represents a Boolean function f ∈ Bn,m : {0, 1}n → {0, 1}m by representing simultaneously the output functions f1 , f2 , . . . , fm of f , where the representations for the different coordinate functions f1 , f2 , . . . , fm may share nodes. The size of the the reduced π-SBDD representing f is described by the following structure theorem [18]. Theorem 1. The number of xπ(i) -nodes of the π-SBDD for f = (f1 , . . . , fm ) is the number si of different subfunctions fj|xπ(1) =a1 ,...,xπ(i−1) =ai−1 , 1 ≤ j ≤ m and a1 , . . . , ai−1 ∈ {0, 1}, essentially depending on xπ(i) (a function g depends essentially on a Boolean variable z if g|z=0 = g|z=1 ). It is well known that the size of an OBDD or an SBDD representing a function f depends on the chosen variable order and may vary between linear and exponential size. Since in applications the variable order π is not given in advance we have the freedom (and the problem) to choose a good order for the representation of f . Definition 3. The OBDD size or OBDD complexity of f (denoted by OBDD(f )) is the minimum of all π-OBDD(f ). Analogously the SBDD size or SBDD complexity of a multiple output function is defined. A variable order π is called optimal for a Boolean function f if π-OBDD(f ) (π-SBDD(f )) is equal to OBDD(f ) (SBDD(f )). Read-once branching programs, denoted BP1s, also sometimes called free binary decision diagrams, are a more general model where the variable orders on different paths may be different. Threshold functions are the basic functions for discrete neural networks. Definition 4. The threshold function Tw1 ,...,wn ,t ∈ Bn with integer weights w1 , . . . , wnand threshold value t computes 1 on input b iff b1 w1 + · · · + bn wn ≥ t. The sum ni=1 bi wi is called the weight of the input b. Obviously, the output of a threshold function depends on a partial input (b1 , . . . , bi ) only via the partial sum b1 w1 + · · · + bi wi and O(n(w1 + · · · + wn )) is

On the OBDD Complexity of Threshold Functions

131

an upper bound on the OBDD size for the representation of fw1 ,...,wn ,t according to an arbitrary variable order. Because of the importance of threshold functions several questions like the number of different threshold functions, the maximum weight of threshold functions, and the realization of general Boolean functions by a network of threshold functions have been investigated (see, e.g., [15]). Furthermore, for the analysis of the runtime of an OBDD-based algorithm for topological sorting generalized threshold functions called multivariate threshold functions have been defined in [22,23]. Later on multivariate threshold functions have been used to design and analyze symbolic graph algorithms (see, e.g., [16,17]). Another motivation for the investigation of threshold functions represented by BDDs is the following one. Many combinatorial problems can be formulated as 0/1 integer programs (0/1 IPs). Obviously, a linear constraint can be seen as a threshold function. In [1] a new approach is presented how to solve combinatorial problems using BDDs. An SBDD is used to represent a set of inequalities, afterwards the single output functions represented in the SBDD are combined by conjunction such that the final OBDD represents all 0/1 solutions of a linear program. Obviously, one aim is to find an SBDD of small size for the representation of all inequalities. 1.2

Results and Related Work

Although many exponential lower bounds on the OBDD size of Boolean functions are known and the method how to obtain such bounds is simple, there are only few functions where the OBDD size is asymptotically known exactly (see, e.g., [3,5].) In Section 2 we prove a nontrivial asymptotically optimal bound of Θ(n3 ) on the size of OBDDs representing a threshold function. 1/2 In [11] the first exponential lower bound of Ω(n2n /2 ) on the OBDD size of a threshold function is proved. Later on this lower bound has been improved up to 1−ε Ω(n2cn ), where c is a constant and ε is an arbitrary small constant (see [19]). Section 3 contains (to the best of our knowledge) the first exponential lower 1/2 bound of Ω(n−1/4 2n ) on the size of read-once branching programs (BP1s) for a threshold function on n variables. For this result, we use the fact that threshold functions with nonnegative weights are monotone functions and some of the smallest 1-inputs of our function correspond to the 1-inputs of a function with large read-once branching program size called permutation function PERM (see [13,14]). (The smallest 1-inputs b = (b1 , . . . , bn ) of a monotone function are 1-inputs for which the function value for each input b = (b1 , . . . , bn ), b = b and bi ≤ bi , is 0.) Since Boolean functions like the greater than function GT can be represented by a threshold function with exponential weights it is not difficult to see that also for threshold functions the choice of the variable order is essential to obtain OBDDs of small size. In [11,19] the relation between the variable order and the size of OBDDs representing threshold functions is investigated. In [11] it has been shown that the descending order of weights can lead to exponentially larger OBDDs than the optimal variable order. Moreover, it has been proved that the reversed variable order can only lead to an increase of n − 1 nodes.

132

B. Bollig

For general Boolean functions this property is not fulfilled. Furthermore, it is impossible to find a good variable order for threshold functions only from the total order of weights [19]. It is unknown whether there exists a polynomial deterministic algorithm for the computation of an optimal variable order for a threshold function with arbitrary weights. In [1] a 0/1 IP for finding an optimal variable order has been presented whose worst case runtime is exponential. The task to compute the optimal variable order for a general Boolean function f ∈ Bn,m given by an SBDD is NP-hard [20]. The result has been strengthened in [4] for single output functions f ∈ Bn given by an OBDD. For monotone functions the task is still NP-hard [12]. As has been expressed in [12] the next important goal seems to (dis)prove that computing an optimal variable order is NP-hard for threshold functions. In Section 4 we prove that for functions f = (f1 , . . . , fm ), where fi , 1 ≤ i ≤ m, are threshold functions represented by an SBDD, the problem to compute an optimal variable order is already NP-hard if there are only two different weights of linear size. For single output functions the situation is different. We show that there is an algorithm for the computation of an optimal variable order for a threshold function which has polynomial runtime if the number of different weights is a constant.

2

An Asymptotically Optimal Bound on the OBDD Complexity of a Threshold Function

In this section we prove an asymptotically optimal lower bound of Ω(n3 ) on the size of a threshold function. The corresponding upper bound follows from the observation that there can be at most as many nodes labeled by the same variable as the sum of the weights. The following lemma will be crucial for our lower bound proof. Lemma 1. Let i1 , i2 , . . . , ik be different integers in N and S := {s | s = k j=1 aj ij , aj ∈ {0, 1} for 1 ≤ j ≤ k}. The size of S is at least k(k + 1)/2 + 1. Proof. We prove by induction that the cardinality of S is at least k(k + 1)/2 + 1. For k = 1 there are two elements in S: 0 and i1 . Since N does not contain 0 and 2 = 2/2 + 1 we are done. Now, w.l.o.g. let i1 < i2 < . . . < ik−1 < ik . The size of S := {s | s = k−1 j=1 aj ij , aj ∈ {0, 1} for 1 ≤ j ≤ k − 1} is at least (k − 1)k/2 + 1. We consider k−1 the k different elements s1 < s2 . . . < sk in S , where s := j=1 aj ij and k−1 k−1 j=1 aj = k − 2 or j=1 aj = k − 1. S contains all elements in S and also s1 + ik , s2 + ik , . . . , sk + ik which are different and cannot be in S since sk is the largest element in S and s1 + ik > sk . Therefore, there are at least (k − 1)k/2 + 1 + k = k(k + 1)/2 + 1 elements in S. 2 Theorem 2. The OBDD complexity of the threshold function fn := T1,2,...,n,n(n+1)/4 is Θ(n3 ).


133

In the following for the sake of simplicity we do not apply floor or ceiling functions to numbers even when they need to be integers whenever this is clear from the context and has no bearing on the essence of the proof. Proof. The upper bound on the OBDD complexity of fn is n · t = O(n3 ) for t = n(n + 1)/4. In the rest of the proof let π be an arbitrary but fixed variable order and j be an arbitrary but fixed integer in {0, 1, 2, . . . , n/8}. Our aim is to prove that there are at least j(j+1)/2+1 different subfunctions fn|xπ(1) =a1 ,...,xπ(j) =aj , a1 , . . . , aj ∈ {0, 1}, that essentially depend on xπ(j+1) . Therefore, we can conclude that the OBDD complexity of fn is at least Ω(n3 ). We call (xi , xn−i+1 ) an x-pair, 1 ≤ i ≤ n/2. The sum of an x-pair is n + 1. Let U be the set of variables {xπ(1) , . . . , xπ(j) } and L be Xn \ U . The x-variables (x2i−1 , xn−(2i−1)+1 , x2i , xn−2i+1 ), 1 ≤ i ≤ n/4, are called 1tuples. Note, that by setting two variables of a 1-tuple to 1 it is possible to obtain the sum 2i + n − (2i − 1) + 1 = n + 2 and the sum 2i − 1 + n − 2i + 1 = n. A 1-tuple is called destroyed with respect to U and L if one of its variables is in U . There are at least n/4 − j ≥ n/8 1-tuples that are not destroyed in L. Using Lemma 1 we know that there are at least j(j + 1)/2 + 1 different assignments to the variables in U that lead to different partial sums s1 , . . . , sj(j+1)/2+1 . It is not difficult to see that partial sums s and s , where |s − s | ≥ n + 1, correspond to different subfunctions. Therefore, we consider partial sums s and s where |s − s | < n + 1. Moreover, let s = p(n + 1) + r1 , s = p(n + 1) + r2 , and r1 < r2 < n + 1. If there exists an integer , where r1 ≤ ≤ r2 − 1 and xn− ∈ L, it is easy to see that s and s correspond to different subfunctions. Since |U | = j, there exists a variable xn− ∈ L, r1 ≤ ≤ r2 − 1, if the difference between r2 and r1 is greater than j. Therefore, we assume that r2 − r1 ≤ j. Because there are only j variables in U , there exists a variable xn−r2 −j +1 or a variable xn−r1 +j +1 , 0 ≤ j ≤ j/2 ≤ n/16, in L. Assume that there is a variable xn−r2 −j +1 ∈ L (the other case can be handled similarly). Our aim is to construct an assignment to the variables in L whose partial sum is n(n + 1)/4 − s = n(n + 1)/4 − (p + 1)(n + 1) + n + 1 − r2 , in order to prove that the assignments with the partial sums s and s correspond to different subfunctions. Since j ≤ n/8 we know that p is less than n/8. We choose a variable xn−r2 −j +1 ∈ L, where j ≤ n/16. Since there are at least n/8 not destroyed 1-tuples in L, we can choose j not destroyed 1-tuples and furthermore, (n/4−p−1−j ) x-pairs in R. The variable xn−r2 −j +1 and the chosen x-variables that do not belong to the chosen 1-tuples are set to 1. For each chosen 1-tuple we replace two of the corresponding variables by 1 such that their partial sum is n + 2, the other 2 variables are set to 0. The remaining variables in L are set to 0. Altogether the partial sum of the considered assignment is (n/4−p−1−j )(n+1)+n−r2 −j +1+j (n+2) = (n/4−p−1)(n+1)+n−r2 +1 and we are done.

134

B. Bollig

Until now we have proved that there are at least j(j + 1)/2 + 1 different subfunctions obtained by replacing the variables in U by constants. In order to prove that there are at least j(j + 1)/2 + 1 nodes labeled by the variable xπ(j+1) , we have to show that the considered subfunctions essentially depend on the variable xπ(j+1) . Therefore, we consider an arbitrary partial sum s1 (n + 1) + s2 , 0 ≤ s1 < n/8 and 0 ≤ s2 < n + 1. Case 1: π(j + 1) + s2 ≥ n + 1 We consider the following assignment to the variables in L \ {xπ(j+1) }. Variables of (n/4 − s1 − 1) x-pairs are set to 1, the remaining variables are set to 0. Iff xπ(j+1) = 1 the functions value of fn is 1. Case 2: π(j + 1) + s2 < n + 1 We know that n + 1 − (π(j + 1) + s2) ≤ n/8 or there is at least one variable x in L where n + 1 − (π(j + 1) + s2 ) − n/8 ≤ < n + 1 − (π(j + 1) + s2 ). We consider the following assignment to the variables in L \ {xπ(j+1) }. - The variable x is set to 1. - Half of the variables of (n + 1) − (π(j + 1) + s2 ) − 1-tuples are set to 1 such that their corresponding sum is (n + 2)(n + 1 − (π(j + 1) + s2 ) − ). The remaining variables of the 1-tuples are set to 0. - Moreover, exactly n/4 − s1 − (n + 1 − (π(j + 1) + s2 ) − ) − 1 x-pairs are set to 1. The function value of fn is 1 iff xπ(j+1) is set to 1. Altogether we have shown that there are at least n/8

j(j + 1)/2 + 1 = Θ(n3 )

j=0

different subfunctions that have to be represented in an OBDD for fn .

2

Note, that we have shown that π-OBDD(fn ) = Θ(n3 ) for every variable order π.

3

An Exponential Lower Bound on the BP1 Complexity of a Threshold Function

In this section we present to the best of our knowledge the first exponential lower bound on the size of read-once branching programs for a threshold function. Definition 5. The threshold function Tn is defined on n2 variables xij , 0 ≤ i, j ≤ n − 1, for n ∈ N. The threshold value t is 22n − 1 and the weights wij are defined as 2i + 2n+j . Theorem 3. The read-once branching program complexity of the function Tn is at least Ω(n−1/2 2n ).


135

Proof. In [13,14] exponential lower bounds on the size of so-called nondeterministic BP1s representing the function PERMn , the test, whether a Boolean matrix contains exactly one 1-entry in each row and in each column, are presented. Here for the choice of the considered subpaths and for the estimation of the number of different chosen subpaths some of their ideas are used. Let G be a read-once branching program for the threshold function Tn . We consider 1-inputs of the function Tn with weight t and exactly n variables set to 1. It is easy to see that these 1-inputs have the property that for each index i or j, 0 ≤ i, j ≤ n − 1, there is exactly one variable xi∗ or x∗j set to 1. Next, we investigate the computation paths for these inputs, i.e., the corresponding paths to the 1-sink in G. The number of these paths is n!. Note, that there are exactly n 1-edges, i.e., variables set to 1, on these paths but there can be less than n2 edges altogether because variables may be left out. Now, we separate each investigated computation path p into its initial path until there are n/2 1-edge on the subpath for the first time and into the rest. Let Rp (Cp ) be the set of indices i for which a variable xi∗ (x∗i ) is set to 1 on p. If n/2 rows and columns have been chosen, there are n/2! possibilities to map the indices of the rows to the indices of the columns. Therefore, n there is a set P , such that for of different initial paths from the source to the cut, |P | ≥ n/2 two different paths p and p we know that Rp = Rp or Cp = Cp . Since the weight of the inputs corresponding to the investigated computation paths is t we can conclude that two different initial paths p and p in P cannot lead to the same node in G. The reason is the following one. The weight of a path p is the sum of the weights of the variables set to 1 on p. Let wp be the weight of p and wp be the weight of p , w.l.o.g. wp < wp . Due to our construction we know that there is an extension of p with weight t − wp and an extension of p with weight t − wp leading to the 1-sink. Since wp + t − wp < t the subfunctions of Tn corresponding to p and p are different and the paths cannot lead to the same node in G. Hence, the size of the set P is a lower bound on the size of G. 2 Using Stirling’s formula we obtain a lower bound of Ω(n−1/2 2n ).

4

On the Variable Ordering Problem for SBDDs

In [19] it has been shown that it is not always possible to find a good variable order only from the total order of weights. In this section we investigate the problem OPTIMAL THRESHOLD SBDD (OTS for short). Input: An SBDD G for a threshold function f = (f1 , f2 , . . . , fn ) and a size bound s. Output: Yes, if the function f represented by G can be represented by an SBDD with at most s nodes. No, otherwise.

136

B. Bollig

Theorem 4. The problem OTS is NP-complete. Sketch of proof. The problem OTS is in NP. The SBDD can be guessed. The equivalence of OBDDs with respect to different variable orders can be verified in deterministic polynomial time [7]. Since each coordinate function fi , 1 ≤ i ≤ n , can be checked separately, we are done. As in [4,20] our NP-hardness proof uses a polynomial time reduction from the problem OPTIMAL LINEAR ARRANGEMENT (OLA for short) that is defined in the following way. Input: An undirected graph H = (V = {1, 2, . . . , n}, E) and a bound b. Output: Yes, if there is a permutation π on {1, 2, . . . , n} such that |π(u) − π(v)| ≤ b. cost(π) := {u,v}∈E

No, otherwise. The cost of π measures the length of all edges if the vertices of H are arranged in linear order with respect to π. We present a polynomial time reduction from OLA to OTS. Let H = (V, E) and b be given and m := |E|. Since isolated vertices in H cannot influence the cost of a linear arrangement we assume in the following that there are no isolated vertices in H. We have to transform the input (H, b) for OLA into an input (G, s) for OTS such that the minimal SBDD size of the function represented by G is at most s iff the cost of an optimal linear arrangement for H is at most b. For the ith edge {j, k}, 1 ≤ i ≤ m and j, k ∈ {1, 2, . . . , n}, we introduce similar to the proof in [12] an edge-function xi . fi (x1i , x2i , . . . , xni ) = (xji ∨ xki ) ∧ 1≤≤n ∈{j,k} /

The function fi can be encoded as a threshold function Tfi in the following way. The weights wji and wki are 1, the other weights wi are set to m, and tfi := m(n − 2) + 1. (Here we use the weight wi because our aim is to use only 2 different weights for our input for OTS.) It is easy to see that the size for an OBDD representing Tfi with respect to a variable order xπ(1)i , xπ(2)i , . . . , xπ(n)i is n + |π −1 (j) − π −1 (k)| − 1. Different edge functions are defined on disjoint sets of variables. Next, we introduce so called glue functions in order to relate the size of an optimal linear arrangement and the size of an optimal SBDD. The glue function gj , 1 ≤ j ≤ n, is defined on n · m variables x11 , x12 , . . . , xnm . gj (x11 , x12 , . . . , xnm ) = (xj1 ∨ . . . ∨ xjm ) ∧ xi . 1≤≤n, =j 1≤i≤m


137

The function gj can be encoded as a threshold function Tgj in the following way. The weights wji , 1 ≤ i ≤ m, are 1, all other weights wi are set to m, and tgj := m2 (n − 1) + 1. A blockwise variable order is a variable order where the variables of each block Bj := {xj1 , xj2 , . . . , xjm }, 1 ≤ j ≤ n, are tested one after another. The following lemma is easy to prove. Lemma 2. The SBDD size of T = (f1 , . . . , fm , g1 , . . . , gn ) with respect to a blockwise variable order Bπ(1) , . . . , Bπ(n) is n · m + cost(π) − m + mn(n + 1)/2 − 1. Representations of different glue functions gj and gj can only share nodes if all but the last one of the Bj - and Bj - variables have been tested. The representations of the edge functions cannot share nodes because they are defined on disjoint sets of variables. If a subfunction of a glue function depends on some Bi -variable it depends on all Bi -variables not yet tested. Therefore, an edge function only shares nodes with a glue function for variables that are the last variables of their corresponding blocks. In the situation of Lemma 2 only the last node in the SBDD can be shared. Altogether we are now able to define the size bound s in our reduction: s := n · m + cost(π) − m + mn(n + 1)/2 − 1. In order to prove the correctness of our reduction it remains to prove that some optimal variable order of T = (f1 , . . . , fm , g1 , . . . , gn ) is a blockwise variable order. Lemma 3. There exists a blockwise variable order that is optimal for T = (f1 , . . . , fm , g1 , . . . , gn ). Lemma 3 holds since the glue functions g1 , . . . , gn cannot share many nodes if the variables are not tested blockwise. Sketch of proof. We change a given (optimal) variable order π in at most (n − 1) phases until it is a blockwise variable order. If no phase increase the SBDD size we are done. First, we ensure that the last m variables build a block, then we do the same for the variables at positions (n − 2)m + 1, . . . , (n − 1)m, afterwards for the variables at positions (n − 3)m + 1, . . . , (n − 2)m and so on. Since our glue functions are very simple we have to count the nodes in the investigated SBDD very carefully. This can be done by case inspection and solving some combinatorial problems. As we have seen the problem OTS is already NP-complete if we uses only two different weights in all coordinate functions. In the next section we will see that in this case the situation for single output functions is easier.

138

5

B. Bollig

On the Variable Ordering Problem for OBDDs

In this section we show that for threshold functions, where the number of different weights is a constant, an optimal variable order and the size of an optimal OBDD can be computed in polynomial time with respect to the number of variables of the considered function. Moreover, for this computation it is unnecessary to create the corresponding OBDD. Due to the lack of space we only sketch the ideas. The following well-known fact is crucial for the correctness of our algorithm. Let Π be the set of variable orders π, where X 1 , xi , X 2 is a partition of the variable set Xn = {x1 , x2 , . . . , xn } and the X 1 -variables are situated before xi in π and the X 2 -variables after xi . The number of xi -nodes in a minimal π-OBDD representing a function f ∈ Bn is the same for all π ∈ Π. Our case is easier than the general one because we can summarize sets of variable orders. We only need the information how many variables of the given weights are situated before or after a variable xi . As a result we do not have to consider every variable order but only representatives of sets of variable orders. Therefore, at any time there can be only a polynomial number of information of polynomial length that we have to compute. In the following we use ideas of the dynamic programming approach of Friedman and Supowit [8] adapted for the special case of threshold functions. Let Tw1 ,w2 ,...,wn ,t be a threshold function on the variables x1 , x2 , . . . , xn , where |{wi | 1 ≤ i ≤ n}| = c for a constant c. W.l.o.g. let w1 , w2 , . . . , wc be different. A wi -variable is a variable of weight wi . In the following we identify sometimes subsets of variables with subsets of their corresponding weights if the meaning is clear from the context. We call two subsets of variables different if their cardinalities are different or there exists a weight wi , 1 ≤ i ≤ c, such that there are more wi -variables in one of the sets as in the other one. If two subsets are not different they are called identical. Identical subsets can be summarized into classes and for each class we can identify one representative with the corresponding class of subsets. It is not difficult to find the corresponding representative for a subset of variables. The number of representatives is at most O(nc+1 ). In a preprocessing step we compute for each representative S := {xi1 , xi2 , . . . , xik }, 1 ≤ k ≤ n, the set of corresponding possible sums of weights WS := {wS | ws = bi1 wi1 + · · · + bik wik , bij ∈ {0, 1} for 1 ≤ j ≤ k}. We process the chosen representatives in ascending order of their cardinalities k, 1 ≤ k ≤ n. At the beginning of a phase we know for each representative S of cardinality k − 1 the minimal number size(S) of nodes labeled by variables corresponding to S in an OBDD, where the S-variables are situated at the end of the corresponding variable order, and the corresponding partial variable order on the S-variables. Let S be the representative of the set Xn \ S. For each wi , 1 ≤ i ≤ c, for which not all variables with weight wi are in S, we compute the following: 1) Let xj be a variable with weight wi that is not contained in S and Swi be the representative of the subset Xn \ S ∪ {xj } and Swi be the representative of the subset S ∪ {xj }.


139

2) For each element wSw in WSw we determine whether the following property i i Pd is fulfilled: there exists an element wS in WS , where wSw + wi + wS ≥ t i and wSw + wS < t. Let WS be the subset of the elements in WSw that i

wi

i

fulfill property Pd . 3) Let s1 , s2 , . . . , sl be the elements of WS and w.l.o.g. s1 < s2 < . . . < sl . For wi all sm , sm+1 , 1 ≤ m ≤ l − 1, we determine whether the property Pm is fulfilled: there exists an element w in WSwi , where sm +w < t and sm+1 +w ≥ t. Let WS be the subset of the elements in WS that fulfill property Pm . wi

wi

4) The number of Swi -nodes in a π-OBDD where the Swi -variables are situated at the end of π and a wi -variable at the beginning of the Swi -variables is size(S) + |WSw | + 1. i

5) For the computation of the minimal number size(Swi ) of nodes labeled by variables corresponding to Swi in an OBDD where the Swi -variables are situated at the end of the corresponding variable order, we have to take into consideration that for every weight wi , 1 ≤ i ≤ c, for which there is a wi -variable in Swi , a wi -variable can be the first variable of the Swi variables. Therefore, size(Swi ) is computed as the minimum number of at most c numbers. The number of necessary nodes and the corresponding partial variable order of the Swi -variables is stored. At the end of the nth phase we know an optimal variable order and the OBDD complexity of the function Tw1 ,w2 ,...,wn ,t .

Acknowledgment The author would like to thank S´ andor Fekete for discussions on the subject of the paper and an easier proof of Lemma 1.

References 1. Behle, M.: On threshold BDDs and the optimal variable ordering problem. In: Dress, A.W.M., Xu, Y., Zhu, B. (eds.) COCOA 2007. LNCS, vol. 4616, pp. 124– 135. Springer, Heidelberg (2007) 2. Bollig, B.: On the OBDD complexity of the most significant bit of integer multiplication. In: Agrawal, M., Du, D.-Z., Duan, Z., Li, A. (eds.) TAMC 2008. LNCS, vol. 4978, pp. 306–317. Springer, Heidelberg (2008) 3. Bollig, B., Range, N., Wegener, I.: Exact OBDD bounds for some fundamental functions. In: Geffert, V., Karhum¨ aki, J., Bertoni, A., Preneel, B., N´ avrat, P., Bielikov´ a, M. (eds.) SOFSEM 2008. LNCS, vol. 4910, pp. 174–185. Springer, Heidelberg (2008) 4. Bollig, B., Wegener, I.: Improving the variable ordering of OBDDs is NP-complete. IEEE Trans. on Computers 45(9), 993–1002 (1996)

140

B. Bollig

5. Bollig, B., Wegener, I.: Asymptotically optimal bounds for OBDDs and the solution of some basic OBDD problems. Journal of Computer and System Sciences 61, 558– 579 (2000) 6. Bryant, R.E.: Graph-based algorithms for Boolean function manipulation. IEEE Trans. on Computers 35, 677–691 (1986) 7. Fortune, F., Hopcroft, J.E., Schmidt, E.M.: The complexity of equivalence and containment for free single variable program schemes. In: Ausiello, G., B¨ ohm, C. (eds.) ICALP 1978. LNCS, vol. 62, pp. 227–240. Springer, Heidelberg (1978) 8. Friedman, S., Supowit, K.: Finding the optimal variable ordering for binary decision diagrams. IEEE Trans. on Computers 39(5), 710–713 (1990) 9. Gentilini, R., Piazza, C., Policriti, A.: Computing strongly connected components in a linear number of symbolic steps. In: Proc. of SODA, pp. 573–582. ACM Press, New York (2003) 10. Gentilini, R., Piazza, C., Policriti, A.: Symbolic graphs: linear solutions to connectivity related problems. Algorithmica 50, 120–158 (2008) 11. Hosaka, K., Takenaga, Y., Kaneda, T., Yajima, S.: Size of ordered binary decision diagrams representing threshold functions. Theoretical Computer Science 180, 47– 60 (1997) 12. Iwama, K., Nozoe, M., Yajima, S.: Optimizing OBDDs is still intractable for monotone functions. In: Brim, L., Gruska, J., Zlatuˇska, J. (eds.) MFCS 1998. LNCS, vol. 1450, pp. 625–635. Springer, Heidelberg (1998) 13. Jukna, S.: The effect of null-chains on the complexity of contact schemes. In: Csirik, J.A., Demetrovics, J., Gecseg, F. (eds.) FCT 1989. LNCS, vol. 380, pp. 246–256. Springer, Heidelberg (1989) 14. Krause, M., Meinel, C., Waack, S.: Separating the eraser Turing machine classes Le , N Le , co-N Le and Pe . Theoretical Computer Science 86, 267–275 (1991) 15. Muroga, S.: Threshold logic and its application. Wiley, New York (1971) 16. Sawitzki, D.: Experimental studies of symbolic shortest-path algorithms. In: Ribeiro, C.C., Martins, S.L. (eds.) WEA 2004. LNCS, vol. 3059, pp. 482–497. Springer, Heidelberg (2004) 17. Sawitzki, D.: On symbolic scheduling independent tasks with restricted execution times. In: Nikoletseas, S.E. (ed.) WEA 2005. LNCS, vol. 3503, pp. 277–289. Springer, Heidelberg (2005) 18. Sieling, D., Wegener, I.: NC-algorithms for operations on binary decision diagrams. Parallel Processing Letters 48, 139–144 (1993) 19. Takenaga, Y., Nozoe, M., Yajima, S.: Size and variable ordering of OBDDs representing threshold functions. In: Jiang, T., Lee, D.T. (eds.) COCOON 1997. LNCS, vol. 1276, pp. 91–100. Springer, Heidelberg (1997) 20. Tani, S., Hamagushi, K., Yajima, S.: The complexity of the optimal variable ordering problems of a shared binary decision diagram. In: Ng, K.W., Balasubramanian, N.V., Raghavan, P., Chin, F.Y.L. (eds.) ISAAC 1993. LNCS, vol. 762, pp. 389–396. Springer, Heidelberg (1993) 21. Wegener, I.: Branching Programs and Binary Decision Diagrams - Theory and Applications. SIAM Monographs on Discrete Mathematics and Applications (2000) 22. Woelfel, P.: Symbolic topological sorting with OBDDs. In: Rovan, B., Vojt´ aˇs, P. (eds.) MFCS 2003. LNCS, vol. 2747, pp. 671–680. Springer, Heidelberg (2003) 23. Woelfel, P.: Symbolic topological sorting with OBDDs. Journal of Discrete Algorithms 4(1), 51–71 (2006)

Natural Specifications Yield Decidability for Distributed Synthesis of Asynchronous Systems Thomas Chatain, Paul Gastin, and Nathalie Sznajder LSV, ENS de Cachan, CNRS 61, Av. du Prés. Wilson, F-94230 Cachan, France {Thomas.Chatain,Paul.Gastin,Nathalie.Sznajder}@lsv.ens-cachan.fr

Abstract. We study the synthesis problem in an asynchronous distributed setting: a finite set of processes interact locally with an uncontrollable environment and communicate with each other by sending signals – actions that are immediately received by the target process. The synthesis problem is to come up with a local strategy for each process such that the resulting behaviours of the system meet a given specification. We consider external specifications over partial orders. External means that specifications only relate input and output actions from and to the environment and not signals exchanged by processes. We also ask for some closure properties of the specification. We present this new setting for studying the distributed synthesis problem, and give decidability results: the non-distributed case, and the subclass of networks where communication happens through a strongly connected graph. We believe that this framework for distributed synthesis yields decidability results for many more architectures. Keywords: Distributed synthesis, Asynchronous systems.

1

Introduction

The synthesis problem consists in, given a high-level description of a system, automatically producing a program that behaves according to this specification. This can be parametrized by the specification language and the target model. In this work, we address this problem for open, distributed, asynchronous systems, with specifications over partial orders. In open reactive systems, the process interacts with an uncontrollable environment and its behavior depends on this interaction. The goal is then to synthesize strategies that control the actions of the system and not those of the environment (see for instance [1,7,8,15]). The distributed case (that is, considering a set of processes that can cooperate against an environment, each process having only a local view of the system) is more involved, and the main hardness result is due to [17]. They proved that, when all processes and the environment evolve synchronously, the general problem is undecidable for LTL specifications, and that LTL synthesis for pipelines is decidable

Partially supported by projects ARCUS Île de France–Inde, DOTS (ANR-06-SETIN003), and P2R MODISTE-COVER/Timed-DISCOVERI.


142

T. Chatain, P. Gastin, and N. Sznajder

(though non elementary). Some other classes of architectures have been proved decidable: 2-ways pipelines for CTL∗ specifications [9], doubly-flanked pipelines for local specifications [11], uniformly well-connected architecture for CTL∗ specifications [5]. Synthesis in an asynchronous communication framework has first been studied in [16]. They considered single-process implementations and lineartime specifications. Later, [12] considered the problem in a distributed setting and exhibited a specific class of controllers for which distributed synthesis is decidable for trace-closed specifications. They strenghtened this result in [13], where restrictions on communication patterns of controllers have been reduced. Considering controllers with causal memories yields decidability results for another subclass of systems in [4]. To reason about distributed synthesis in a more abstract framework, both with synchronous and asynchronous semantics, [14] proposed the framework of distributed games – a specialized version of multiplayer games. Recently, the synthesis of asynchronous distributed systems in the general case of μ-calculus specifications was studied in [3]. Here we study a new model, different from the one of [12] in two ways: when there, processes evolve asynchronously only with respect to each other, in our model they also evolve locally asynchronously with respect to the environment. A second difference is in the communication mechanism: whereas in [12] the synchronization of processes is done by rendez-vous (handshaking), we use signals and define for each action an owner that can trigger it, the signal being immediately received by the other process regardless of whether it is willing to receive it or not. This communication mechanism is more convenient than shared variables communication, and more realistic than rendez-vous. As in [5], we do not allow our specifications to constrain the internal behaviour of the system: communications between processes are only restricted by the communication architecture, not by the specification. This assumption is more natural from a practical point of view – when describing the way a system is expected to work, one is only concerned with its external behaviour, the way it interacts with the environment and not by internal communications processes may set up in order to achieve the specified global behaviour. In the framework of asynchronous distributed systems, executions are partial orders of actions. Our specifications will then be formulae whose models are partial orders of external actions. In addition, in order to rule out unnatural constraints between actions, specifications considered in this paper will have some closure properties, ensuring that we do not prevent causalities between events (this would restrain communication abilities of processes) or impose causalities between others when it would make no sense. With this model, we prove decidability for the synthesis problem for the class of architectures whose communication graph is strongly connected. We believe that the synthesis problem will be decidable for many more architectures with these hypotheses.

2

The Model

An architecture defines how a set of processes may communicate with each other and with an (uncontrollable) external environment. An important parameter of the problem is the type of communications allowed between processes. We are

Natural Specifications Yield Decidability for Distributed Synthesis

143

interested in asynchronous distributed systems, hence it would be natural to use unbounded fifo channels. However, this leads to infinite state systems, making decidability results more uncertain to obtain. A finite model can be obtained by using shared variables: processes can write on variables that can be read by other processes. But in an asynchronous system, communication is difficult to achieve with shared variables. Assume that process i wants to transmit to process j a sequence m1 , m2 , . . . of messages. First, i writes m1 to some shared variable x. But since processes evolve asynchronously, i does not know when m1 will be read by j. Hence, some acknowledgement is required from j to i before i may write m2 to x. Depending on the architecture, this may not be possible. In any cases, it makes synthesis of distributed programs satisfying a given specification harder. Hence, we will use point to point communication by signals in the vein of [10]. Sending a signal is an action but receiving a signal is not. Instead, all signals sent to some process j are automatically added to its local history, without requiring actions from j. The system is still asynchronous, meaning that processes evolve at different speeds. We are interested in synthesizing local programs, also called strategies. By local we mean that to decide which action it should execute next, a process j only knows its current local history, which automatically includes all signals sent to j in addition to the signals sent by j. Formally, an architecture is a tuple A = (Proc, E, (Ini )i∈Proc , (Outi )i∈Proc ) where (Proc, E) is the directed communication graph whose nodes are processes and there is an edge (i, j) ∈ E if process i may send signals to process j. For each process i ∈ Proc, the sets Ini and Outi define input and output signals that i may receive from or send to the environment. We assume that all these sets are pairwise disjoint. We let In = i∈Proc Ini and Out = i∈Proc Outi be the sets of input and output signals of the whole system. Let also Γ = In ∪ Out. In order to realize a specification, the processes may choose for each communication link (i, j) ∈ E a set Σi,j of signals that i could send to j. Again, we assume that these sets are pairwise disjoint and disjoint from Γ . The complete alphabet (of signals) is then Σ = Γ ∪ (i,j)∈E Σi,j . The actions in Γ are called external signals whereas the actions in Σ \ Γ are called internal signals. For each a ∈ Σ we let process(a) be the set of processes taking part in the execution of a: process(a) = {i} if a ∈ Ini ∪ Outi and process(a) = {i, j} if a ∈ Σi,j . It should be no surprise now that the concrete executions of our asynchronous distributed systems will be Mazurkiewicz traces. We consider the trace alphabet (Σ, D) where the dependence relation D ⊆ Σ × Σ is defined by: (a, b) ∈ D if process(a) ∩ process(b) = ∅. We recall that a Mazurkiewicz trace t over (Σ, D) is (an equivalence class of) a finite or infinite Σ-labelled poset t = (V, ≤, λ) such that for all x, y ∈ V , ↓x = {y ∈ V | y ≤ x} is finite, (λ(x), λ(y)) ∈ D implies x ≤ y or y ≤ x, and x y implies (λ(x), λ(y)) ∈ D where x y means that x < y and there is no z ∈ V such that x < z < y. We denote by R(Σ, D) the set of traces over (Σ, D) and by M(Σ, D) the set of finite traces. For i ∈ Proc, we denote by Σi = {a∈ Σ | i ∈ process(a)} the set of actions visible to process i and by Σic = Outi ∪ j|(i,j)∈E Σi,j the set of actions

144


controlled by process i. A local strategy for process i is a mapping fi : Σi∗ → Σic . After a sequence of actions w ∈ Σi∗ visible to i (but not necessarily all initiated by i) fi (w) says which action in Σic the process i is willing to play. Observe that another action in Σi \ Σic can be executed by another process before process i had time to play according to its strategy. This would modify its local history, and thus may modify its strategy: processes are then reactive to signals sent to them by other processes and by the environment. A distributed strategy (or program) is a tuple F = (fi )i∈P roc of local strategies. Let t = (V, ≤, λ) be a run of the system and let v ∈ V . By definition of the dependence relation, the sets of events ↓i v = {x ∈ λ−1 (Σi ) | x ≤ v} and ⇓i v = ↓i v \{v} are totally ordered. We denote by λ(⇓i v) the word λ(x1 ) · · · λ(xn ) where {x1 , · · · , xn } = ⇓i v with x1 < · · · < xn . Let us fix a distributed strategy F . We say that a run t = (V, ≤, λ) is an F -run (or is compatible with strategy F ) if all controllable events are played according to F , i.e., for all v ∈ V such that λ(v) ∈ Σic , we have λ(v) = fi (λ(⇓i v)). Observe that, for a fixed distributed strategy F , even if inputs from the environment follow the same pattern, there are multiple F -runs depending on the scheduling of internal signals. A run t = (V, ≤, λ) is F -maximal if for any process i, either Vi = λ−1 (Σi ) is infinite, or fi is undefined on λ(Vi ).

3

The Specification

The specifications we consider only constrain external actions from Γ , i.e., actions that reflect communications with the environment. We want the processes to collaborate freely in order to achieve the specification, hence we do not constrain internal signals. Moreover, our specifications will be on partial orders, and not linearizations of executions. Indeed, specifying over interleavings allows to differentiate between equivalent linearizations, which is not desirable for distributed systems. For a concrete run t = (V, ≤, λ) we define the abstract (observable) run as the projection πΓ (t) = (λ−1 (Γ ), ≤ ∩ (λ−1 (Γ ))2 , λ). Specifications will then be formulae in some logical formalism whose models are Γ -labelled partial orders. We say that a concrete run t satisfies a specification ϕ if its projection πΓ (t) satisfies ϕ. Distributed synthesis: Given an architecture (Proc, E, (Ini )i∈Proc , (Outi )i∈Proc ) and a specification ϕ over Γ -labelled posest in an appropriate logic, decide whether there exist internal signal sets (Σi,j )(i,j)∈E and a distributed strategy F such that every F -maximal concrete F -run satisfies the specification ϕ. Acceptable Specifications. We explain now with some examples that not all specifications are acceptable in our framework. We start with an example showing that specifications must be closed under extensions of partial orders. Consider a distributed system with Proc = {p, q, r} and E = {(p, q), (q, r)}. Note that p cannot directly send signals to r. A natural specification could


145

a

p

b

q

c r (a) Specification: A desired behavior p q

a

a

b

a b

c

r

b c

c

(b) Implementation: Three concrete runs p q r

a

a

b

a b

c

b c

c

(c) Corresponding observable (abstract) behaviors Fig. 1. Specifications must be closed under extensions

be that q must output b and that if p receives input a from the environment then r must later output c. This corresponds to the partial order represented in Figure 1(a). In order to implement this specification, when process p receives a it must send a signal to q and q should forward this signal to r so that r knows it should output c. But these internal signals will induce some additional ordering between a and b or between b and c as can be seen in Figure 1(b). None of the corresponding abstract runs in Figure 1(c) correspond to the partial order of the specification, though they are all extensions of it. Hence, we need to extend this specification so that it can be implemented. Formally, an (order) extension of a labelled partial order t = (V, ≤t , λ) is any partial order s = (V, ≤s , λ) with ≤t ⊆ ≤s . We will require our specifications to be closed under extensions. Next, we show that the specification should also be closed under some weakenings of the partial order. This is due to the fact that inputs from the environment are uncontrollable events. Hence, it seems unrealistic to try to impose a direct causality between any action on some process and an input event from the environment on another process. For instance, consider an architecture with two processes, one receiving service requests from a client and the other granting the service: Inc = {request} and Outs = {grant}. A naive specification could be an alternation of request and grant as presented in Figure 2(a). A possible implementation is presented in Figure 2(b) using two internal signals forward ∈ Σc,s and ready ∈ Σs,c . Since inputs from the environment are uncontrollable, we cannot enforce that the second request comes after the internal signal ready. Hence, the specification should also include the behavior of Figure 2(c) corresponding to the concrete run of Figure 2(d). Formally, if a partial order t = (V, ≤t , λ) satisfies a specification and if z t z where z is an input event from the environment and z, z are not on the same

146

T. Chatain, P. Gastin, and N. Sznajder c s

c s

req

req

grant grant (a) Naive specification req

req

grant grant (c) Weakened specification

c s

c s

req fwd

req fwd

req ready ready fwd grant grant (b) Implementation req ready fwd ready grant grant (d) Implementation

Fig. 2. Client–Server

process, then the weakening s = (V, ≤s , λ) with ≤s = ≤t \ {(z, z )} should also satisfy the specification (≤s is still an order relation since z is a successor of z). We will define the weakest partial order induced by t. Recall that actions in Γ are either inputs from the environment or outputs to the environment: Γ = In ∪ Out with In = i∈Proc Ini and Out = i∈Proc Outi . Consider now a Γ -labelled partial order t = (V, ≤, λ) and define / Σi ∧ λ(z ) ∈ Ini ∧ z < z Wt = {(z, z ) ∈ V 2 | ∃i ∈ Proc, λ(z) ∈ ∧ (¬∃y, λ(y) ∈ Outi ∧ z < y < z )} . The set Wt consists of all those pairs (z, z ) for which the ordering in t is fortuitous. This happens when z, z are on different processes and z is an uncontrollable input from the environment, except if we find an output event y between z and z which is on the same process as z . Indeed, output y may have been triggered by z so we do not remove orderings to output events. We are now ready to define acceptable specifications. Definition 1. A specification is acceptable if it is closed under extension and weakening. Formally, a specification ϕ is acceptable if for all t = (V, ≤t , λ) such that λ−1 (Σi ) is totally ordered for all i ∈ Proc, if t |= ϕ, then – r |= ϕ for all r = (V, ≤r , λ) with ≤t ⊆ ≤r (extension), – s |= ϕ where s = (V, ≤s , λ) with ≤s = ≤t \ Wt (weakening). Observe that this definition of weakening removes all fortuitous orderings at once, but, since the specification is also closed under extension, all intermediary partial orders can also be obtained. AlocTL. Among different logics available to express specifications over partial orders, we will focus on local temporal logics (locTL), for they allow easy and intuitive specifications for distributed system, and they have a reasonable complexity. However, not all local temporal logic formulae are acceptable: the formula EM(a ∧ ¬ F b) meaning that there is a minimal a-event with no b-events in its future is not closed under extension (see e.g. [2] for a formal semantics of locTL). Also, the formula EM(a ∧ EX c) meaning that there is a minimal a-event


147

immediately followed by a c-event is not closed under extension. In fact, in order to stay in the class of specifications closed under extensions, we have to rule out any modality that requires some concurrency between two events. For the closure by weakening, we restrict the use of the order relation between events on different processes so that the greater event is not an input. We introduce a syntactic restriction of a process based local temporal logic for which all formulae will be acceptable. The syntax of AlocTL(Γ, Proc) (or simply AlocTL if Γ and Proc are clear from the context) is given by: ϕ ::= a | ¬a | ¬ Xi | ¬ Yi | ϕ ∨ ϕ | ϕ ∧ ϕ | Xi ϕ | ϕ Ui ϕ | Gi ϕ | Fi,j (Out ∧ ϕ) | Y i ϕ | ϕ Si ϕ | Out ∧ Hi,j ϕ with a ∈ Γ and i, j ∈ Proc. The modalities Xi , Yi , Ui and Si are the usual next, yesterday, until and since restricted to the totally ordered events of process i. We can also express in our logic release (dual of until ): ϕRi ψ = (Gi ψ)∨(ψUi (ϕ∧ψ)). When restricted to the events of some process i, our logic has the full expressive power of LTL or FO. We only restrict how one can switch from one process to another so that closure under extensions and weakenings will be obtained. To switch from process i to process j, we use Fi,j or Hi,j . The first one allows to specify a response property triggered on process i for which the output is delivered on process j, e.g., G(request −→ Fi,j (Out ∧ grant)). The second modality may be used to specify that outputs should have a cause, e.g., G(grant −→ (Out ∧ Hj,i request)). We do not include negations or modalities of the form Xi,j since they lead out of acceptable specifications. We did not investigate the expressive power of our logic, but we believe it can express lots of interesting properties since it has the expressive power of FO when restricted to local events of each process, and allows response and cause properties between processes. The semantics defines when t, x |= ϕ where t = (V, ≤, λ) is a Γ -labelled partial order with Vi = λ−1 (Σi ) totally ordered for each i ∈ Proc, and x ∈ V : – t, x |= a ∈ Γ if λ(x) = a – t, x |= Xi ϕ if x ∈ Vi and t, y |= ϕ for some y ∈ Vi such that x < y and for all z ∈ Vi , z ≤ x or y ≤ z. – t, x |= Gi ϕ if x ∈ Vi and t, y |= ϕ for all y ∈ Vi such that x ≤ y. – t, x |= ϕ Ui ψ if x ∈ Vi and t, y |= ψ for some y ∈ Vi such that x ≤ y and for all z ∈ Vi , x ≤ z < y implies t, z |= ϕ. – t, x |= Fi,j (ϕ ∧ Out) if x ∈ Vi and t, y |= ϕ for some y ∈ Vj such that x ≤ y and λ(y) ∈ Out. The other modalities are defined similarly. As in [2], we have chosen to introduce initial formulae to address the problem of starting the evaluation of a formula. Those are defined by the syntax α ::= ⊥ | | ¬ EMi | EMi ϕ | α ∨ α | α ∧ α where ϕ is a formula of AlocTL. The semantics is given by t |= EMi ϕ if t, x |= ϕ where x is the minimal vertex of Vi .

148


Proposition 1. The logic AlocTL is closed under extension and weakening. Observe that AlocTL is a natural fragment of FO( 1 then we let f1 (σ) = (Ord1 , a) to transmit to Process i the order to output a. The order is forwarded by each intermediary Process 1 < j < i only if j received no inputs since the last time it has sent a signal to j + 1. Then output a is performed by i and an acknowledgement is sent to Process 1. This acknowledgement will also collect inputs received by remaining processes. Formally, for 1 < i ≤ n, σ ∈ Σi∗ ·Σic ∪{ε}, τ ∈ In∗ and τ1 , τ2 ∈ In∗i , we let fi (σ · (Ordi−1 , a)) = (Ordi , a) fi (σ · (Ordi−1 , a)) = a fi (σ · (Ordi−1 , a) · a · τ2 ) = (Acki , τ2 )

if a ∈ / Outi if a ∈ Outi if a ∈ Outi

fi (σ · τ1 · (Acki−1 , τ ) · τ2 ) = (Acki , τ · τ1 · τ2 ) Now, if an intermediary process received some inputs from the environment before it could forward the order to Process i, then the basis on which Process 1 took is decision is no longer valid. Hence, we have to abort the order and signal this fact with a Nack. We also need to abort if i received the order but has also received inputs from the environment before it could execute the order. As above, Nack also collects inputs received by the remaining processes. Formally, for 1 < i ≤ n, σ ∈ Σi∗ · Σic ∪ {ε}, τ ∈ In∗ and τ1 , τ2 ∈ In∗i , we let fi (σ · τ1 · (Ordi−1 , a) · τ2 ) = (Nacki , τ1 · τ2 )

if τ1 · τ2 = ε

fi (σ · τ1 · (Nacki−1 , τ ) · τ2 ) = (Nacki , τ · τ1 · τ2 ) The sets of internal signals are implicitely defined by the strategies above: Σ1,2 = ({Ord1 } × Out) ∪ {(Msg1 , ε)} and for 1 < i ≤ n and j = 1 + (i mod n), Σi,j = ({Msgi , Acki , Nacki } × In∗ ) ∪ ({Ordi } × Out). Due to In∗ , the sets Σi,j are infinite. We explain in Remark 1 how to reduce to finite sets of signals, and strategies with finite-memories. To conclude the construction, we define the map ψ : Σ1∗ → Γ ∗ by induction. First, ψ(ε) = ε. Next, ψ(σ · b) = ψ(σ) · b for σ ∈ Σ1∗ and b ∈ Σ1 ∩ Γ . Finally, for σ ∈ Σ1∗ , a ∈ Out \ Out1 , τ ∈ In∗1 and τ ∈ In∗ , let: ψ(σ · (Msg1 , ε) · τ · (Msgn , τ )) = ψ(σ) · τ · τ ψ(σ · (Ord1 , a) · τ · (Ackn , τ )) = ψ(σ) · a · τ · τ ψ(σ · (Ord1 , a) · τ · (Nackn , τ )) = ψ(σ) · τ · τ Note that, after sending Msg1 or Ord1 , ψ is undefined until the corresponding Msgn , Ackn or Nackn has been received by Process 1. When ψ is undefined then


151

f1 is also undefined so that Process 1 waits for the end of the round. Note also that inputs in τ may have been received before those in τ . Let t = (V, ≤t , λ) be an F -maximal F -run. We can easily check that all output events in λ−1 (Out) are totally ordered. We can also show that the history t computed by ψ is an f -maximal f -run which is a linear extension of πΓ (t). To conclude the proof, it remains to show that πΓ (t) is an extension of the weakening of t : ≤t \ Wt ⊆ ≤t ⊆ ≤t . For this, we will use the following claim whose proof is omitted for lack of space. Claim. For all x, y ∈ λ−1 (Γ ) such that x t y, if x m, where norm(p) denotes the length of the shortest completed trace of p. Since t ≡WIF u, by Lem. 5, u u⇒ → u with var (u ) ⊆ var (t ). Hence, for any x ∈ var (u ), either |σ(x)| = 0 or / CT (σ(u )). It follows from CT (σ(u)) ⊆ norm(σ(x)) > m. Since |u | < m, am ∈ τ τ m 2m 2m {a , a } that CT (σ(u )) = {a }. And u ⇒→ u implies σ(u) ⇒→ σ(u ).

On Finite Bases for Weak Semantics: Failures Versus Impossible Futures

179

Lemma 7. Assume that, for E an axiomatization sound for WIF , closed terms p, q, closed substitution σ, action a and integer m: 1. 2. 3. 4.

E p ≈ q; m > max{|u| | t ≈ u ∈ E}; CT (q) ⊆ {am , a2m }; and τ there is a closed term p such that p ⇒→ p and CT (p ) = {a2m }. τ

Then there is a closed term q such that q ⇒→ q and CT (q ) = {a2m }. Proof. By induction on the derivation of E p ≈ q. – Suppose E p ≈ q because σ(t) = p and σ(u) = q for some t ≈ u ∈ E or u ≈ t ∈ E and closed substitution σ. The claim then follows by Lem. 6. – Suppose E p ≈ q because E p ≈ r and E r ≈ q for some r. Since r ≡WIF q, by proviso (3) of the lemma and Lem. 4, CT (r) ⊆ {am , a2m }. Since τ there is a p such that p ⇒→ p with CT (p ) = {a2m }, by induction, there is an r τ such that r ⇒→ r and CT (r ) = {a2m }. Hence, again by induction, there is a q τ such that q ⇒→ q and CT (q ) = {a2m }. – Suppose E p ≈ q because p = p1 + p2 and q = q1 + q2 with E p1 ≈ q1 and τ E p2 ≈ q2 . Since there is a p such that p ⇒→ p and CT (p ) = {a2m }, either τ τ τ p1 ⇒→ p or p2 ⇒→ p . Assume, without loss of generality, that p1 ⇒→ p . By τ τ 2m induction, there is a q such that q1 ⇒→ q and CT (q ) = {a }. Now q ⇒→ q . – Suppose E p ≈ q because p = cp1 and q = cq1 with c ∈ A and E p1 ≈ q1 . In this case, proviso (4) of the lemma can not be met. – Suppose E p ≈ q because p = τ p1 and q = τ q1 with E p1 ≈ q1 . By proviso τ (4) of the lemma, either CT (p1 ) = {a2m } or there is a p such that p1 ⇒→ p and τ CT (p ) = {a2m }. In the first case, q ⇒→ q1 and CT (q1 ) = {a2m } by Lem. 4. In τ the second, by induction, there is a q such that q1 ⇒→ q and CT (q ) = {a2m }. τ Again q ⇒→ q . Theorem 7. There is no finite, sound, ground-complete axiomatization for BCCS(A) modulo ≡WIF . Proof. Let E be a finite axiomatization over BCCS(A) that is sound modulo ≡WIF . Let m be greater than the depth of any term in E. Clearly, there is no term r such that τ τ (am 0 + a2m 0) ⇒→ r and CT (r) = {a2m }. So according to Lem. 7, the closed equation τ a2m 0 + τ (am 0 + a2m 0) ≈ τ (am 0 + a2m 0) cannot be derived from E. Nevertheless, it is valid modulo ≡WIF . In the same way as above, one can establish the nonderivability of the equations a2m+1 0 + a(am 0 + a2m 0) ≈ a(am 0 + a2m 0) from any given finite equational axiomatization sound for ≡WIF . As these equations are valid modulo (strong) 2-nested simulation equivalence, this negative result applies to all BCCS-congruences that are at least as fine as weak impossible futures equivalence and at least as coarse as strong 2nested simulation equivalence. Note that the corresponding result of [1] can be inferred.

180

T. Chen, W. Fokkink, and R. van Glabbeek

References 1. Aceto, L., Fokkink, W.J., van Glabbeek, R.J., Ingólfsdóttir, A.: Nested semantics over finite trees are equationally hard. Information and Computation 191(2), 203–232 (2004) 2. Aceto, L., Fokkink, W.J., Ingólfsdóttir, A.: Ready to preorder: Get your BCCSP axiomatization for free! In: Mossakowski, T., Montanari, U., Haveraaen, M. (eds.) CALCO 2007. LNCS, vol. 4624, pp. 65–79. Springer, Heidelberg (2007) 3. Brookes, S.D., Hoare, C.A.R., Roscoe, A.W.: A theory of communicating sequential processes. Journal of the ACM 31(3), 560–599 (1984) 4. Chen, T., Fokkink, W.J.: On the axiomatizability of impossible futures: Preorder versus equivalence. In: Proc. LICS 2008, pp. 156–165. IEEE, Los Alamitos (2008) 5. Chen, T., Fokkink, W.J., van Glabbeek, R.J.: On finite bases for weak semantics: Failures versus Impossible futures (2008), http://arxiv.org/abs/0810.4904 6. Chen, T., Fokkink, W.J., van Glabbeek, R.J.: Ready to preorder: The case of weak process semantics. Information Processing Letters (to appear, 2008), http://www.cwi.nl/∼chen/Papers/equational.pdf 7. Chen, T., Fokkink, W.J., Luttik, B., Nain, S.: On finite alphabets and infinite bases. Information and Computation 206(5), 492–519 (2008) 8. De Nicola, R., Hennessy, M.: Testing equivalences for processes. Theoretical Computer Science 34, 83–133 (1984) 9. Fokkink, W.J., Nain, S.: A finite basis for failure semantics. In: Caires, L., Italiano, G.F., Monteiro, L., Palamidessi, C., Yung, M. (eds.) ICALP 2005. LNCS, vol. 3580, pp. 755–765. Springer, Heidelberg (2005) 10. de Frutos-Escrig, D., Gregorio-Rodriguez, C., Palomino, M.: Ready to preorder: an algebraic and general proof. Journal of Logic and Algebraic Programming (to appear, 2008), http://maude.sip.ucm.es/∼miguelpt/ 11. van Glabbeek, R.J.: A complete axiomatization for branching bisimulation congruence of finite-state behaviours. In: Borzyszkowski, A.M., Sokolowski, S. (eds.) MFCS 1993. LNCS, vol. 711, pp. 473–484. Springer, Heidelberg (1993) 12. van Glabbeek, R.J.: The linear time – branching time spectrum II. The semantics of sequential systems with silent moves. In: Best, E. (ed.) CONCUR 1993. LNCS, vol. 715, pp. 66–81. Springer, Heidelberg (1993) 13. van Glabbeek, R.J.: Notes on the methodology of CCS and CSP. Theoretical Computer Science 177(2), 329–349 (1997) 14. van Glabbeek, R.J.: The linear time – branching time spectrum I. The semantics of concrete, sequential processes. In: Handbook of Process Algebra, pp. 3–99. Elsevier, Amsterdam (2001) 15. van Glabbeek, R.J., Voorhoeve, M.: Liveness, fairness and impossible futures. In: Baier, C., Hermanns, H. (eds.) CONCUR 2006. LNCS, vol. 4137, pp. 126–141. Springer, Heidelberg (2006) 16. Groote, J.F.: A new strategy for proving ω-completeness with applications in process algebra. In: Baeten, J.C.M., Klop, J.W. (eds.) CONCUR 1990. LNCS, vol. 458, pp. 314–331. Springer, Heidelberg (1990) 17. Hennessy, M.: Algebraic Theory of Processes. MIT Press, Cambridge (1988) 18. Milner, R.: A complete axiomatisation for observational congruence of finite-state behaviours. Information and Computation 81, 227–247 (1989) 19. Rensink, A., Vogler, W.: Fair testing. Information and Computation 205(2), 125–198 (2007) 20. Rounds, W.C., Brookes, S.D.: Possible futures, acceptances, refusals and communicating processes. In: Proc. FOCS 1981, pp. 140–149. IEEE, Los Alamitos (1981) 21. Vogler, W.: Modular Construction and Partial Order Semantics of Petri Nets. LNCS, vol. 625. Springer, Heidelberg (1992) 22. Voorhoeve, M., Mauw, S.: Impossible futures and determinism. In: Information Processing Letters, pp. 51–58 (2001)

On Generating All Maximal Acyclic Subhypergraphs with Polynomial Delay Taishin Daigo1 and Kouichi Hirata2 1

Graduate School of Computer Science and Systems Engineering 2 Department of Artificial Intelligence Kyushu Institute of Technology Kawazu 680-4, Iizuka 820-8502, Japan {daigo,hirata}@dumbo.ai.kyutech.ac.jp

Abstract. An acyclic subhypergraph of a hypergraph is maximal if there exists no acyclic subhypergraph containing it. In this paper, first we show that, unless P=NP, there is no polynomial delay algorithm for generating all maximal acyclic subhypergraphs in lexicographic order . Next, by ignoring the order of outputs, we design a polynomial delay algorithm for generating all maximal acyclic subhypergraphs.

1

Introduction

Hypergraphs [2,3] have been developed as one of the mathematical tools for characterizing the queries in Database Theory [1,16] in 1980’s. Today, it is known that the hypergraphs are related to the several problems for Artificial Intelligence, for example, constraint satisfaction, clause subsumption, theory revision, abductive explanation, machine learning, data mining, and so on (cf., [9]). An acyclic hypergraph in hypergraphs is the extended concept of a tree in graphs, and the acyclicity is known to make some intractable problems for hypergraphs and several related problems tractable [4,9]. In this paper, we pay our attention to the problem of generating all acyclic subhypergraphs from a possibly cyclic hypergraph. As related works from the viewpoint of data mining, Horv´ ath et al. [11] recently have investigated the problem of generating all frequent subhypergraphs. We deal with this problem as an extended problem of generating all spanning trees from a graph. For such a problem, Gabow and Myers [7] have designed an algorithm in O(|V | + |E| + τ |V |) time and in O(|V | + |E|) space, where τ is the number of all spanning trees in a graph G = (V, E). This time complexity is optimal if we require to output all spanning trees explicitly. Without such requirement, Kapoor and Ramesh [13] have designed an algorithm for scanning all spanning trees in O(|V | + |E| + τ ) time and in O(|V | · |E|) space. Shioura et al. [15] have improved the space complexity to O(|V | + |E|) space.

This work is partially supported by Grand-in-Aid for Scientific Research 19300046 from the Ministry of Education, Culture, Sports, Science and Technology, Japan.


182

T. Daigo and K. Hirata

In contrast to spanning trees, for acyclic subhypergraphs, Hirata et al. [10] have shown it is NP-complete to determine whether or not a hypergraph has an acyclic subhypergraph containing all vertices and, for a given integer K > 0, one with K or more hyperedges. On the other hand, they have designed a linear time algorithm to find a maximal acyclic subhypergraph of a hypergraph. Here, an acyclic subhypergraph is maximal if there exists no acyclic subhypergraph containing it. Hence, in this paper, as an extended problem of generating all spanning trees from a graph, we pay our attention to the problem of generating all maximal acyclic subhypergraphs from a hypergraph. First, we show the intractability for this problem in lexicographic order with polynomial delay. Johnson et al. [12] have shown that it is coNP-complete to determine whether or not a maximal independent set is the lexicographically last one. Hence, unless P=NP, there exists no polynomial delay algorithm for generating all maximal independent sets in inverse lexicographic order . On the other hand, we show that it is coNP-complete to determine whether or not a maximal acyclic subhypergraph is the lexicographically first one. Hence, unless P=NP, there exists no polynomial delay algorithm for generating all maximal acyclic subhypergraphs in lexicographic order . Also we show that it is coNPcomplete to determine whether or not a maximal acyclic subhypergraph is the lexicographically last one containing another subhypergraph. Next, by ignoring the order of outputs, we design a polynomial delay algorithm GenMAS for generating all maximal acyclic subhypergraphs. The algorithm GenMAS adopts the same strategy of the algorithm for generating all spanning trees designed by Kapoor and Ramesh [13]. Also the algorithm GenMAS uses the algorithm FindMAS that, for given hypergraphs H and H1 , outputs a maximal acyclic subhypergraph of H containing H1 if H1 is acyclic. It can be realized by incorporating the algorithms RMCS and test designed by Tarjan and Yannakakis [16] with the algorithm MAS designed by Hirata et al. [10]. Then, the algorithm GenMAS controls for generating maximal acyclic subhypergraphs without duplication by using two sets In and Out as same as [13] and an additional set Sec of hyperedges. Here, In is the set of hyperedges that must be contained by a current hypergraph and Out is the set of hyperedges that must not be contained by it. For a current acyclic subhypergraph H1 of H, the algorithm GenMAS selects a hyperedge E ∈ H − (H1 ∪ In ∪ Out) and then finds a maximal acyclic subhypergraph H2 of H − Out containing In ∪ {E} by calling the algorithm FindMAS(H − Out, In ∪ {E}). Note that the found H2 is not guaranteed to be a maximal acyclic subhypergraph of H. If H2 is a maximal acyclic subhypergraph of H, that is, if H2 is equal to the result of FindMAS(H, H2 ), then the algorithm GenMAS outputs H2 and repeats the recursive call as same as [13]. Otherwise, in order to find another possible maximal acyclic subhypergraph of H, the algorithm GenMAS constructs a maximal acyclic subhypergraph containing In ∪ {E} but not containing Out , by repeating to update the monotonically increasing set Sec of hyperedges and to apply the algorithm FindMAS.

On Generating All Maximal Acyclic Subhypergraphs

183

For a hypergraph H = (V, E), the algorithm FindMAS runs in O(|V | + ||E||) time, where ||E|| is the sum of the number of vertices in every hyperedge. Hence, we show that the algorithm GenMAS generates all maximal acyclic subhypergraphs of H in O(|E|2 (|V | + ||E||)) delay and O(|E|) space.

2

Preliminaries

In this section, we prepare some notions for hypergraphs necessary to the later sections. A graph G = (V, E) consists of a set V of vertices and a set E ⊆ V × V of edges. Two vertices are adjacent if they are contained in an edge. A path in G is a sequence v0 , . . . , vn of distinct vertices such that vi and vi+1 are adjacent for 0 ≤ i < n. A cycle is a path such that n ≥ 2 and v0 and vn are adjacent. A chord of a cycle is an edge joining two vertices that are not adjacent in the cycle. We say that a graph G is chordal [16] if every cycle of G with four or more vertices has a chord. A clique of a graph is a set of pairwise adjacent vertices. A hypergraph [1,2,3] consists of a set V of vertices anda set E ⊆ 2V of hyperedges. For E, we denote the total size of E, that is, E∈E |E| by ||E||. We denote {v ∈ V | v ∈ E, E ∈ E} by v(E). For hypergraphs H = (V, E) and H = (V , E , we denote (V ∪V , E ∪E ) by H ∪H and (V −V , E −E ) by H −H . Furthermore, by regarding H as E, H ∪ {E} is a hypergraph (V ∪ v(E), E ∪ {E}). The graph representation [1,16] (primal graph or 2-section graph [2,3]) G(H) of a hypergraph H is defined as follows: G(H) = (V, {(v, w) | v, w ∈ E, E ∈ E}). It is obvious that H is connected if and only if so is G(H). We say that a hypergraph H = (V, E) is conformal [1,16] if every clique of G(H) is contained in some hyperedge E ∈ E. Then, we introduce an acyclic hypergraph as follows. Note here that Beeri et al. [1] have given another equivalent conditions of the acyclicity of hypergraphs. Definition 1 (cf., Beeri et al. [1]). A hypergraph H = (V, E) is acyclic if G(H) is chordal and H is conformal. Example 1. Consider the hypergraphs H1 and H2 in Figure 1. In this case, it holds that G(H1 ) = G(H2 ), and G(H1 ) is chordal. Since there exists no hyperedge of H1 containing a clique {1, 5, 7}, H1 is not conformal, that is, H1 is cyclic. On the other hand, since every clique of G(H2 ) is contained in a hyperedge of H2 , H2 is conformal. Hence, H2 is acyclic. Let H = (V, E) and H = (V , E ) be hypergraphs. We say that H is a subhypergraph of H, denote it by H ⊆ H, if E ⊆ E and V = v(E ). Also we say that H is an acyclic subhypergraph of H if H ⊆ H and H is acyclic. For the problem of finding acyclic subhypergraphs, Hirata et al. have shown the following theorem [10].

184


6 *

+

1 5 0

/

2 , 4

3 .

6 * 1 5 0

+

2 , 3 -

/ 4 . 7

H1

H2

+

*

1 0

,

-

/ .

G(H1 ) = G(H2 )

Fig. 1. Hypergraphs H1 and H2 in Example 1 and their graph representation

Theorem 1 (Hirata et al. [10]). Let K > 0 be an integer. Then, it is NPcomplete to determine whether or not a hypergraph has an acyclic subhypergraph with K or more hyperedges. By Theorem 1, it is intractable to find the maximum acyclic subhypergraph. Instead of the maximum acyclic subhypergraph, we deal with a maximal acyclic subhypergraph. Definition 2 (Hirata et al. [10]). Let H be a hypergraph (V, E) and H an acyclic subhypergraph (V , E ) of H. Then, we say that H is maximal if there exists no acyclic subhypergraph H of H such that H ⊂ H . We can rewrite this definition as follow: Let E be E − E . Then, H is maximal if there exists no F ⊂ E such that H ∪ F is acyclic. Tarjan and Yannakakis [16] have designed the algorithms RMCS and test to check whether or not a hypergraph H = (V, E) is acyclic in O(|V |+||E||) time. As a combination of these algorithms, Hirata et al. [10] have designed the algorithm MAS to find a maximal acyclic subhypergraph of a hypergraph H = (V, E) in O(|V | + ||E||) time. We will explain all of the algorithms in Section 4 below. Example 2. The hypergraph H1 in Example 1 (Figure 1) has the maximal acyclic subhypergraphs as {a, b, c, e}, {a, b, d, e}, {a, c, d} and {b, c, d}.

3

Intractability for Generating All Maximal Acyclic Subhypergraphs in Lexicographic Order with Polynomial Delay

In this section, we show the intractability for generating all maximal acyclic subhypergraphs of a hypergraph in lexicographic order with polynomial delay. First, we formulate the following problem LexFirstMas(H, H1 ). LexFirstMas(H, H1 ) Instance: Hypergraph H and H1 such that H1 ⊆ H. Question: Is H1 the lexicographically first maximal acyclic subhypergraph of H?

On Generating All Maximal Acyclic Subhypergraphs VX VZ V Ema E xb i

= = = = =

{x01 , x11 , x21 , . . . , x0q , x1q , x2q }, VY = {y10 , y11 , y12 , . . . , yq0 , yq1 , yq2 }, {z10 , z11 , z12 , . . . , zq0 , zq1 , zq2 }, VM = {0, 1, . . . , l}, VX ∪ VY ∪ VZ ∪ VM , {xbi , yjb , zkb | ma = (xi , yj , zk ), b = 0, 1, 2} ∪ {a} (1 ≤ a ≤ l), (b+1)mod 3 {xbi , xi } (1 ≤ i ≤ q, b = 0, 1, 2), (b+1)mod 3

Ey b = {yib , yi i

185

} (1 ≤ i ≤ q, b = 0, 1, 2),

(b+1)mod 3 {zib , zi }

Ez b = (1 ≤ i ≤ q, b = 0, 1, 2), i EM = VM , E = VX ∪ VY ∪ VZ ∪ {0}, E = {EM , E} ∪ {Ema | 1 ≤ a ≤ l} ∪ {Exb , Ey b , Ez b | 1 ≤ i ≤ q, b = 0, 1, 2}. i

i

i

Fig. 2. The transformation in the proof of Theorem 2

Theorem 2. The problem LexFirstMas(H, H1 ) is coNP-complete. Proof. If H1 is not the lexicographically first maximal acyclic subhypergraph of H, then we can select a subhypergraph of H previous from H1 nondeterministically and then check it is maximal and acyclic, by using the algorithms RMCS and test designed by Tarjan and Yannakakis [16] (see the next section). Then, the problem belongs to coNP. In order to show coNP-hardness, we transform from the following NP-complete problem. 3DimensionalMatching (3DM) [8] Instance: Mutually distinct three sets X, Y and Z containing just q elements, and a set M ⊆ X × Y × Z of triples. Question: Is there a perfect matching M1 ⊆ M of X × Y × Z that each element of X, Y and Z is contained in exactly one triple in M1 ? Let X = {x1 , . . . , xq }, Y = {y1 , . . . , yq } and Z = {z1 , . . . , zq }. Also let M = {m1 , . . . , ml }. Then, we construct a hypergraph H = (V, E) as Figure 2. For example, for an instance M of 3DM described as Figure 3 (left), where a hyperedge {x, y, z} denotes (x, y, z) ∈ M , H is constructed as Figure 3 (right). Also we give an order < on hyperedges as follows. EM < Exbi < Eyib < Ezib < Ema < E, where 1 ≤ i ≤ q, 1 ≤ a ≤ l, and b = 0, 1, 2. Also suppose that Ewib < Ewjc if either i < j, or i = j and b < c (w ∈ {x, y, z}) and Ema < Emb if a < b. Furthermore, let H1 be the following subhypergraph of H (corresponding to shadowed hyperedges in Figure 3(right)). H1 = {EM } ∪ {Exbi , Eyib , Ezib | 1 ≤ i ≤ q, b = 0, 1, 2} ∪ {E} = H − {Ema | 1 ≤ a ≤ l}. It is obvious that H1 is a maximal acyclic subhypergraph of H. Suppose that there exists a perfect matching M1 ⊆ M of X × Y × Z. Then, let H2 be the following subhypergraph of H. H2 = (H1 − {E}) ∪ {Ema | ma ∈ M1 }.

186


,

*

+

, *+

*

M

H

Fig. 3. An example for the transformation in the proof of Theorem 2

Since {Ema | ma ∈ M1 } contains hyperedges Exbi , Eyib , Ezib just once for every i (1 ≤ i ≤ q) and b (b = 0, 1, 2), H2 is the maximal acyclic subhypergraph of H previous from H1 under lexicographic order 0}| ∃v ∈ E such that β(v) = 0, s(E) = −1 ∀v ∈ E, β(v) > 0. On the other hand, after labeling by the algorithm RMCS, the algorithm test checks whether or not, for each E ∈ E and F ∈ E such that γ(E) = β(F ), it holds that {v ∈ E | β(v) < γ(E)} ⊆ F , that is, for each v ∈ E, if β(v) < γ(E) then v ∈ F . If there exist E and F not satisfying this, then test returns ‘cyclic’ and halts. Otherwise, test returns ‘acyclic.’ Furthermore, the algorithm MAS is the modified version of the algorithm RMCS containing the algorithm test for every i-th step (i ≥ 3). Let Hi be a current hypergraph and E be a selected hyperedge, that is, Hi = Hi−1 ∪ {E}. Then, the algorithm MAS calls the algorithm test for Hi and if it returns that Hi is cyclic, then the algorithm MAS sets a hypergraph Hi to Hi−1 , and initializes the β-value of v ∈ E such that β(v) = i to 0 and the β-value of E to −1. Then, E is never contained in a current maximal acyclic subhypergraph. Then, we give the following outline of the algorithm FindMAS(H, H1). 1. Apply the algorithm RMCS to H1 , and then apply the algorithm test to H1 . If test returns “cyclic,” then the algorithm FindMAS returns ⊥ and halts. 2. Otherwise, preserve s-, β- and γ-values of hyperedges and β-value of vertices of H1 . Then, by using the β-values of vertices of H1 , assign an appropriate s-value to the hyperedges in H − H1 according to the above formula. 3. Apply the algorithm MAS to H under the s-, β- and γ-values of hyperedges and β-value of vertices obtained from the procedures 1 and 2. For H = (V, E), the algorithm FindMAS(H, H1) is correct and runs in O(|V | + ||E||) time [10,16]. Then, we design the algorithm GenMAS for generating all maximal acyclic subhypergraphs described as Algorithm 1. The algorithm GenMAS uses two sets In and Out , and a current maximal acyclic subhypergraph contains the hyperedges stored in the set In and never contains the hyperedges stored in the set Out . Note here that FindMAS(H, ∅) in line 1 means the original MAS(H) [10]. Example 3. Consider the hypergraph H described as Figure 4 (left). Consider the case that GenMAS first finds {a, b, c, e} in line 1 as H1 . In this case, the search tree of the algorithm GenMAS is described as Figure 4 (center).


1 2 3 4

5 6 7 8 9 10 11 12 13 14 15 16 17

189

procedure GenMAS(H) /* H : hypergraph */ H1 ← FindMAS(H, ∅); output H1 ; if H = H1 then Search(H, H1 , ∅, ∅); procedure Search(H, H1 , In, Out ) /* H, H1 : hypergraphs, In,Out,Sec: the set of hyperedges */ foreach E ∈ H − (H1 ∪ In ∪ Out) do H2 ← FindMAS(H − Out , In ∪ {E}); if H2 = ⊥ then Sec ← H2 − (In ∪ {E}); H3 ← FindMAS(H − (Out ∪ Sec), In ∪ {E}); while H2 = FindMAS(H, H2 ) or H3 = In ∪ {E} do H2 ← FindMAS(H − Out, H3 ); Sec ← Sec ∪ (H3 − (In ∪ {E})); H3 ← FindMAS(H − (Out ∪ Sec), In ∪ {E}); if H2 = FindMAS(H, H2 ) then /* H2 is a maximal acyclic subhypergraph of H */ output H2 ; Search(H, H2 , In ∪ {E}, Out); Out ← Out ∪ {E};

Algorithm 1. GenMAS

Here, the label H1 with the label (In, Out) of its connected edge represents the application of Seach(H, H1 , In, Out). Hence, the algorithm GenMAS outputs {a, b, c, e}, {a, d, e}, {b, d, e} and {c, d, e} in this order. On the other hand, consider the case that GenMAS first finds {c, d, e} in line 1 as H1 . In this case, the search tree of the algorithm GenMAS is described as Figure 4 (right). Note that, when backtracking the procedure to the branch of the root, H2 , H3 and Sec in the while loop in lines from 10 to 13 are updated as follows: H2 Sec H3 H2

← FindMAS(H − {a}, {b}) H2 = {b, c, e} ← {b, c, e} − {b}(= {c, e}) ← FindMAS(H − ({a} ∪ {c, e}), {b}) H3 = {b, d} ← FindMAS(H − {a}, {b, d}) H2 = {b, d, e}

Since H2 = {b, d, e} is a maximal acyclic subhypergraph of H, the algorithm GenMAS outputs H2 at the line 15. Hence, the algorithm GenMAS outputs {c, d, e}, {a, b, c, e}, {a, d, e} and {b, d, e} in this order. Lemma 1. No maximal acyclic subhypergraph of H occurs more than twice in the search tree of the algorithm GenMAS(H).

190

T. Daigo and K. Hirata {c, d, e}

{a, b, c, e} ({a}, ∅)

4*

2

+ ,

-

3 0

{a, d, e}

/ .

1

({b, d}, ∅)

({c, d}, {b})

{b, d, e}

{c, d, e}

({a}, ∅)

({b}, {a})

{a, b, c, e}

{b, d, e}

({a, d}, ∅) {a, d, e}

Fig. 4. The hypergraph H in Example 3 (left) and its search trees of the algorithm GenMAS starting from {a, b, c, e} (center) and {c, d, e} (right)

Proof. Let T be a search tree of the algorithm GenMAS(H). We call a path from the root to a leaf in T a branch of T . First, we show that no maximal acyclic subhypergraph of H occurs more than twice in some branch B of T . Let H1 be a maximal acyclic subhypergraph of H occurring in B output by the procedure Search(H, H , In, Out). For a hyperedge E ∈ H − (H1 ∪ Out), let H2 be a maximal acyclic subhypergraph of H − Out containing {E} ∪ In. Then, H2 is a child of H1 in B (or T ) and H1 satisfies that In ⊆ H1 and H1 ∩ Out = ∅. Since the set In is set to In ∪ {E} when calling the procedure Search(H, H1 , In, Out) in order to obtain H2 in B, H2 satisfies that In ∪ {E} ⊆ H2 and H2 ∩ Out = ∅. Hence, H2 is different from H1 . Since this argument also holds for every descendant of H1 in B, the statement holds. Next, we show that no maximal acyclic subhypergraph of H occurring in some branch B of T occurs in B − B for a different branch B of T from B. For the same H1 and H2 as above and for a hyperedge E ∈ H −(H1 ∪In ∪Out ∪{E}), let H3 be a maximal acyclic subhypergraph of H − Out containing {E } ∪ In. Then, H2 and H3 are siblings in T and assume that H3 is in the branch B . Since H1 satisfies that In ⊆ H1 and H1 ∩ Out = ∅, the set Out is set to Out ∪ {E} when backtracking Search(H, H1 , In, Out) after searching for the branch B, that is, the descendant of H2 in T . Then, H3 satisfies that In ∪ {E } ⊆ H3 and H3 ∩ (Out ∪{E}) = ∅, which implies that, while H2 and its descendant contains E, H3 and its descendant of H3 does not contain E. Hence, every hypergraph occurring in B − (B ∩ B ) is different from one occurring in B − B. By incorporating with the above statement, the statement holds. Theorem 3. For a hypergraph H = (V, E), the algorithm GenMAS(H) generates all maximal acyclic subhypergraphs of H in O(|E |2 (|V | + ||E||)) delay and in O(|E|) space. Proof. First, we show the correctness of the algorithm GenMAS. By Lemma 1, it is sufficient to show that every maximal acyclic subhypergraph of H occurs in the search tree T of the algorithm GenMAS(H). Then, suppose that a maximal acyclic subhypergraph H of H does not occur in the search tree T . Without loss of generality, we can suppose that H contains In ∪{E} and does not contain Out for some hyperedge E selected from the foreach loop (line 5). Also suppose that H2 is a maximal acyclic subhypergraph of H − Out at the end


191

of the while loop (lines from 10 to 13) in the foreach loop such that H = H2 . Then, there exists a hyperedge F such that F ∈ H but F ∈ H2 , and it holds that In ∪{E}∪{F } is acyclic, because In ∪{E} ⊆ H2 ∩H , so F ∈ In ∪{E}. Since Sec is set to either H2 − (In ∪ {E}) (line 8) or Sec ∪ (H3 − (In ∪ {E})) (line 12) and the set Sec in the while loop increases monotonically from H2 − (In ∪ {E}), it holds that F ∈ H − (Out ∪ Sec) for the set Sec at the end of the while loop. When H does not occur in the search tree at the end of the while loop, then it holds that H3 = In ∪ {E} at the end of the while loop. Since H3 is set to FindMAS(H −(Out ∪Sec), In ∪{E}) (lines 9 and 13), there exists no hyperedge F such that (H −(Out ∪Sec))∪(In ∪{E})∪{F } is acyclic, which is a contradiction of the existence of the above F . Hence, every maximal acyclic hypergraph occurs in the search tree T just once. Next, we discuss the complexity of the algorithm GenMAS. Since the algorithm FindMAS(H, H ) runs in O(|V |+||E||) time and the number of the while loop (lines from 9 to 12) is at most 2|E|, the running time of the while loop is O(|E|(|V | + ||E||)), which implies that the delay of the algorithm GenMAS(H) is O(|E|2 (|V | + ||E||)). It is obvious that the extra space of the algorithm GenMAS(H) is O(|E|). Hence, the statement holds.

5

Conclusion

In this paper, first we have shown that, unless P=NP, there exists no algorithm for generating all maximal acyclic subhypergraphs in lexicographic order with polynomial delay, that is, it is coNP-complete to determine whether or not a maximal acyclic subhypergraph is the lexicographically first one. We have shown that it is coNP-complete to determine whether or not a maximal acyclic subhypergraph is the lexicographically last one containing another subhypergraph. Next, we have designed the polynomial delay algorithm GenMAS for generating all maximal acyclic subhypergraphs of a given hypergraph. Since it is essential for the proof of Theorem 2 that an order of hyperedges is given arbitrarily, it is a future work to discuss whether or not there exists a specified order of hyperedges to generate all maximal acyclic subhypergraphs in lexicographic order with polynomial delay. Also it is a future work to discuss a remained open problem whether or not LexLastMas(H, H1 , ∅) in Corollary 3 is tractable, because, if so, then we can generate all maximal acyclic subhypergraphs in inverse lexicographic order with polynomial delay. In the proof of Theorem 2, we use the property that a cyclic hypergraph becomes acyclic by adding an hyperedge containing all vertices. On the other hand, it is known a totally balanced [5,14] or β-acyclic hypergraph [5,6] as a hypergraph of which subhypergraph is always acyclic [6], so we cannot apply the proof of Theorem 2 to totally balanced hypergraphs. Then, it is a future work to discuss whether or not we can generate all maximal totally balanced subhypergraphs in lexicographic order with polynomial delay. Finally, the algorithm GenMAS can be applied to frequent acyclic hypergraph mining [11]. Hence, it is a future work to implement the algorithms and then apply them to the research field of data mining.

192


References 1. Beeri, C., Fagin, R., Maier, D., Yannakakis, M.: On the desirability of acyclic database schemes. J. ACM 30, 479–513 (1983) 2. Berge, C.: Graphs and hypergraphs. North-Holland, Amsterdam (1973) 3. Berge, C.: Hypergraphs. North-Holland, Amsterdam (1989) 4. Chekuri, C., Rajaraman, A.: Conjunctive query containment revisited. Theoret. Comput. Sci. 239, 211–229 (2000) 5. D’Atri, A., Moscarini, M.: On hypergraph acyclicity and graph chordality. Inform. Proc. Lett. 29, 271–274 (1988) 6. Fagin, R.: Degrees of acyclicity for hypergraphs and relational database schemes. JACM 30, 514–550 (1983) 7. Gabow, H.N., Myers, E.W.: Finding all spanning trees of directed and undirected graphs. SIAM J. Comput. 7, 280–287 (1978) 8. Garey, M.R., Johnson, D.S.: Computers and intractability: A guide to the theory of NP-completeness. W. H. Freeman and Company, New York (1979) 9. Gottlob, G., Leone, N., Scarcello, F.: The complexity of acyclic conjunctive queries. J. ACM 43, 431–498 (2001) 10. Hirata, K., Kuwabara, M., Harao, M.: On finding acyclic subhypergraphs. In: Li´skiewicz, M., Reischuk, R. (eds.) FCT 2005. LNCS, vol. 3623, pp. 491–503. Springer, Heidelberg (2005) 11. Horv´ ath, T., Bringmann, B., de Raedt, L.: Frequent hypergraph mining. In: Muggleton, S., Otero, R., Tamaddoni-Nezhad, A. (eds.) ILP 2006. LNCS (LNAI), vol. 4455, pp. 244–259. Springer, Heidelberg (2007) 12. Johnson, D.S., Yannakakis, M., Papadimitriou, C.H.: On generating all maximal independent sets. Inform. Proc. Let. 27, 119–123 (1988) 13. Kapoor, S., Ramesh, H.: Algorithms for generating all spanning trees of undirected and weighted graphs. SIAM J. Comput. 24, 247–265 (1995) 14. Lov´ asz, L.: Combinatorial problems and exercises. North-Holland, Amsterdam (1979) 15. Shioura, A., Tamura, A., Uno, T.: An optimal algorithm for scanning all spanning trees of undirected graphs. SIAM J. Comput. 26, 678–692 (1997) 16. Tarjan, R.E., Yannakakis, M.: Simple linear-time algorithms to test chordality of graphs, test acyclicity of hypergraphs, and selectively reduce acyclic hypergraphs. SIAM J. Comput. 13, 566–579 (1984)

Time and Fairness in a Process Algebra with Non-blocking Reading Flavio Corradini1, Maria Rita Di Berardini1 , and Walter Vogler2 1

Dipartimento di Matematica e Informatica, Universit` a di Camerino {flavio.corradini, mariarita.diberardini}@unicam.it 2 Institut f¨ ur Informatik, Universit¨ at Augsburg [email protected]

Abstract. We introduce the first process algebra with non-blocking reading actions for modelling concurrent asynchronous systems. We study the impact this new kind of actions has on fairness, liveness and the timing of systems, using as application Dekker’s mutual exclusion algorithm we already considered in [4]. Regarding some actions as reading, this algorithm satisfies MUTEX liveness already under the assumption of fairness of actions. We demonstrate an interesting correspondence between liveness and the catastrophic cycles that we introduced in [6] when studying the performance of pipelining. Finally, our previous result on the correspondence between timing and fairness [4] scales up to the extended language.

1

Introduction

Read arcs are an extension of classical Petri nets to model non-destructive reading operations; they allow multiple concurrent reading of the same resource, a quite frequent situation in many distributed systems. Read-arcs represent positive context conditions, i.e. elements which are needed for an event to occur, but are not affected by it. As argued in [11], the importance of such elements is twofold. Firstly, they allow a faithful representation of systems where the notion of “reading without consuming” is commonly used, like database systems, concurrent constraint programming, or any computation framework based on shared memory. Secondly, they allow to specify directly and naturally a level of concurrency greater than in classical nets: two transitions reading the same place may occur in any order and also simultaneously; in classical nets, the transitions would be connected to the place by loops such that they cannot occur simultaneously. Read arcs have been used to model a variety of applications such as transaction serialisability in databases [14], concurrent constraint programming [12], asynchronous systems [15], and cryptographic protocols [9]. Semantics and expressivity of read arcs have been studied e.g. in the following: [2] discusses a step semantics. [1] discusses the expressiveness of timed Petri nets and timed automata and shows that timed Petri nets with read-arcs unify timed Petri nets and timed automata. Finally, [15] shows that read arcs add relevant expressivity; the MUTEX problem can be solved with nets having read arcs but not with ordinary nets having no read arcs. M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 193–204, 2009. c Springer-Verlag Berlin Heidelberg 2009

194

F. Corradini, M.R. Di Berardini, and W. Vogler

In this paper we introduce the first process algebra with non-blocking reading; we add reading in the form of a read-action-prefix to PAFAS [7], a process algebra for modelling timed concurrent asynchronous systems. In [5] we provide two different ways to enhance our process algebra with such non-blocking actions: one is more flexible, but needs a two-level transition relation; here, due to lack of space, we only present the other, simpler one. Further details can be found in [5] where we also prove that each so-called read-proper process (cf. Section 2) in our setting can be translated to a process in the alternative approach with isomorphic behaviour. Non-blocking actions have a direct impact on timed behaviour. Consider a system composed of two processes that read the same variable to prepare an output they produce together, modelled as (r.o.nil {o} r.o.nil) {r,w} rec x. (r.x + w.x) in PAFAS: rec x. (r.x + w.x) models the variable that can repeatedly be read with r or written with w (abstracting from values; r.o.nil models one process that performs r (together with the variable) and then o, synchronising with the other process. According to the PAFAS semantics, enabled actions are performed immediately or become urgent after one time unit and must occur then; thus, after at most one time unit, the first r occurs. Every time the variable performs action r, a new instance of r is generated that can let one time unit pass; thus, a second time unit might pass before the second r, and the output is produced within three time units in the worst-case. If the read action r were modelled as a non-blocking action, written rec x.{r} w.x, then the worst-case efficiency for producing the output would be two time units. In this case, after one time unit and the occurrence of the first r, the variable offers the same non-blocking action r, which is still urgent and has to be performed before the second time step. In previous work, we have shown that our notion of time is in strong correspondence to (weak) fairness [4], which requires that an action (or a component) has to be performed whenever it is enabled continuously in a run. We have proven that each everlasting (or non-Zeno) timed process execution is fair and vice versa, where fairness is defined in an intuitive but complicated way in the spirit of [8]. We used these characterizations in [3] to study the liveness property for Dekker’s mutual exclusion algorithm, and proved that Dekker is live under the assumption of fairness of components but not under the assumption of fairness of actions. One important result is that the extension with non-blocking actions preserves the above correspondence result between fairness of actions and timing. Another main result is that, in the new setting, Dekker’s algorithm is live when assuming fairness of actions, provided we regard as non-blocking the reading of a variable (as r in rec x.{r} w.x above) as well as its writing in the case that the written value equals the current value. This kind of re-write does not change the state of the variable and, hence, can be thought of as a non-destructive or non-consuming operation (allowing potential concurrent behaviour). This way of accessing a variable is not new and Remark 1 in Section 3 describes how it is implemented in the area of databases. Finally, we develop an interesting connection between liveness of MUTEX algorithms and catastrophic cycles: we considered the latter in [6] studying the

Time and Fairness in a Process Algebra with Non-blocking Reading

195

very different problem of asymptotic performance for the specific, but often occurring class of request-response processes (having only actions in and out). A cycle in a transition system is catastrophic if it only contains internal actions and at least one time step, and we showed that a process can refuse to serve some request within finite time if and only if a reduced transition system of the process contains a catastrophic cycle. We also pointed out that the existence of catastrophic cycles in a reduced transition system can be determined in polynomial time. In the present paper, we show how to modify the process Dekker such that Dekker satisfies liveness assuming fairness of actions if and only if the modified process does not have a catastrophic cycle. This opens the way to check automatically the liveness property for MUTEX algorithms and, indeed, we have developed a tool for verifying this property. The rest of the paper is organized as follows. The next section introduces PAFAS with read-prefixes, and its functional and temporal operational semantics. Section 3 introduces fairness of actions and relates it to timing. Finally, Section 4 investigates the liveness of Dekker’s algorithm under the assumption of fairness of actions and presents the interesting connection between liveness and catastrophic cycles.

2

A Process Algebra for Describing Read Behaviours

PAFAS [7] is a CCS-like process description language [10] (with a TCSP-like parallel composition), where basic actions are atomic and instantaneous but have associated an upper time bound (either 0 or 1, for simplicity); this can be used for evaluating the performance of asynchronous systems (but does not influence functionality, i.e. which actions are performed). Here, we extend PAFAS with the new operator to represent non-blocking behaviour of processes. Intuitively, {α1 , . . . , αn }P models a process like a variable or a more complex data structure that behaves as P but can additionally be read with α1 , . . . , αn : since being read does not change the state, actions α1 , . . . , αn can be performed repeatedly without blocking a synchronization partner as described below. We use the following notation: A is an infinite set of basic actions; the additional action τ represents internal activity, unobservable for other components, and Aτ = A ∪ {τ }. Elements of A are denoted by a, b, c, . . . and those of Aτ by α, β, . . . . Actions in Aτ can let time 1 pass before their execution, i.e. 1 is their maximal delay. After that time, they become urgent actions written a or τ ; these have maximal delay 0. The set of urgent actions is denoted by Aτ = {a | a ∈ A} ∪ {τ } and is ranged over by α, β, . . . . Elements of Aτ ∪ Aτ are ranged over by μ and ν. We also assume that, for any α ∈ Aτ , α = α. X (ranged over by x, y, z, . . .) is the set of process variables, used for recursive definitions. Φ : Aτ → Aτ is a general relabelling function if the set {α ∈ Aτ | ∅ = Φ−1 (α) = {α}} is finite and Φ(τ ) = τ . Such a function can also be used to define hiding: P/A, where the actions in A are made internal, is the same as P [ΦA ], where the relabelling function ΦA is defined by ΦA (α) = τ if α ∈ A and / A. ΦA (α) = α if α ∈

196


In the following definition, initial processes are just processes of a standard process algebra extended with . General processes are those reachable from the initial ones according to the operational semantics. ˜ 1 of initial (timed) process terms Definition 1. (timed process terms) The set P is generated by the following grammar P ::= nil x α.P {α1 , . . . , αn } P P + P P A P P [Φ] rec x.P where nil is a constant, x ∈ X , α ∈ Aτ , {α1 , . . . , αn } is a finite, nonempty subset of Aτ , Φ is a general relabelling function and A ⊆ A possibly infinite. We assume ˜ that recursion is both action-guarded and read-guarded (see below). The set P of (general) (timed) process terms is generated by the following grammar: Q ::= P α.P {μ1 , . . . , μn } Q Q + Q Q A Q Q[Φ] rec x.Q ˜ 1 and {μ1 , . . . , μn } ⊆ Aτ ∪A (finite and nonempty) is a read-set, i.e. where P ∈ P τ it does not contain α and α for any α ∈ Aτ . Terms not satisfying this property are not reachable from initial ones anyway (see Section 2.2). A variable x ∈ X is action-guarded in Q if it only appears in Q within the scope of a prefix μ.() with μ ∈ Aτ ∪ Aτ . A term Q is action-guarded if each occurrence of a variable is guarded in this sense. Moreover, a variable x ∈ X is said to be read-guarded in Q if, for each subterm of Q of the form {μ1 , . . . , μn } Q1 , x is action-guarded in Q1 . We assume that recursion is action- and read-guarded, i.e. for each term rec x.Q, the variable x is both action-guarded and read-guarded in Q. A process term is closed if every variable x is bound by the corresponding rec x-operator; ˜ and P ˜ 1 , simply called processes and the set of closed timed process terms in P initial processes resp., is denoted by P and P1 resp. The operators have their usual intuition, e.g. Q1 and Q2 run in parallel in Q1 A Q2 and have to synchronize on all actions from A; we also use equations to define recursive processes. The essential point about the read-set operator is that {μ1 , . . . , μn } Q can perform the actions from {μ1 , . . . , μn } without changing state (including urgencies and, hence, the syntax of the term itself), and the actions of Q in the same way as Q, i.e. the read-set is removed after such an action. In the following, we will focus on the so-called read-proper terms, which do have a reasonable semantics. Read-proper terms only have “properly” nested reading behaviour, i.e. we want to avoid terms like {a}{b}Q or {a}Q +{b}Q; these terms violate the intuition for reading, see below. More formally, a term ˜ is read-guarded if every subterm of Q of the form {μ1 , . . . , μn }Q is in the Q∈P ˜ is read-proper if each scope of some μ (i.e. in some subterm μ.()). A term Q ∈ P subterm Q1 + Q2 is read-guarded and, for each subterm {μ1 , . . . , μn } Q1 , Q1 is read-guarded. With this definition, neither {a} {b} Q nor {a} Q + {b} Q are read-proper, since the subterm {b} Q is not in the scope of some μ and, thus, also not read-guarded. In the following preliminary definitions, set A represents the actions restricted by the environment (i.e. in a parallel context); U({μ1 , . . . , μn }) denotes the set of urgent actions in {μ1 , . . . , μn }.


197

˜ and A ⊆ Aτ . The set U(Q, A) Definition 2. (urgent basic actions) Let Q ∈ P is defined by induction on Q. The urgent actions of Q are defined as U(Q, ∅) which we abbreviate to U(Q). Nil, Var: U(nil, A) = U(x, A) = ∅ {α} if μ = α and α ∈ /A Pref: U(μ.P, A) = ∅ otherwise Read: U({μ1 , . . . , μn } Q, A) = U({μ1 , . . . , μn }) \ A ∪ U(Q, A) Sum: U(Q1 + Q2 , A) = U(Q 1 , A) ∪ U(Q2 , A) Par: U(Q1 B Q2 , A) = i=1,2 U(Qi , A ∪ B) ∪ (U(Q1 , A) ∩ U(Q2 , A) ∩ B) Rel : U(Q[Φ], A) = Φ(U(Q, Φ−1 (A))) Rec: U(rec x.Q, A) = U(Q, A) Since the environment restricts the actions in A, U(μ.P, A) = {α} only if μ = α and α ∈ / A; otherwise U(μ.P, A) = ∅; observe that an initial process P cannot have any urgent actions. The essential idea for parallel composition is that a synchronised action can be delayed if at least one component can delay it: U(Q1 B Q2 , A) includes the actions that are urgent in Q1 or Q2 when the actions in A and in B (the synchronising ones) are prevented, and the actions in B, but not in A, that are urgent both in Q1 and in Q2 . The other rules are as expected. To keep the definition more intuitive, please note that U(Q, A) = U(Q)\A. The operational semantics exploits two functions on process terms: clean( ) and unmark( ). Function unmark( ) simply removes all urgencies (inactive or not) ˜ Function clean( ) removes all inactive urgencies in a in a process term Q ∈ P. ˜ process term Q ∈ P; when a process evolves and a synchronised action is no longer urgent or enabled in some synchronisation partner, then it should also lose its urgency in the other. Below, A in clean(Q, A) denotes the set of actions that are not enabled or urgent due to restrictions of the environment. For a readset {μ1 , . . . , μn } ⊆ Aτ ∪ Aτ , clean({μ1 , . . . , μn }, A) denotes the set we obtain by replacing α in {μ1 , . . . , μn } by α whenever α ∈ A. ˜ we define clean(Q) Definition 3. (cleaning inactive urgencies) For any Q ∈ P as clean(Q, ∅) where, for A ⊆ A, clean(Q, A) is defined below. Nil, Var: clean(nil, A) = nil, Pref: Read: Sum: Par: Rel: Rec: 2.1

clean(x, A) = x α.P if μ = α and α ∈ A clean(μ.P, A) = μ.P otherwise clean({μ1 , . . . , μn } Q, A) = clean({μ1 , . . . , μn }, A) clean(Q, A) clean(Q1 + Q2 , A) = clean(Q1 , A) + clean(Q2 , A) clean(Q1 B Q2 , A) = clean(Q1 , A1 ) B clean(Q2 , A2 ) where A1 = A ∪ (B\U(Q2 )) and A2 = A ∪ (B\U(Q1 )) clean(Q[Φ], A) = clean(Q, Φ−1 (A))[Φ] clean(rec x.Q, A) = rec x. clean(Q, A)

The Functional Behaviour of PAFASs Processes

The transitional semantics describing the functional behaviour of PAFASs processes indicates which basic actions they can perform.

198

F. Corradini, M.R. Di Berardini, and W. Vogler Table 1. Functional behaviour of PAFASs processes Pref

α

μ ∈ {α, α}

Sum

α

α

{α, α} ∩ {μ1 , . . . , μn } = ∅ α

{μ1 , . . . , μn } Q − → {μ1 , . . . , μn } Q α

Par1

α

Q1 A Q2 − → clean(Q1 A Q2 ) α

→ Q Q− Φ(α)

Q[Φ] −−−→ Q [Φ]

Q− → Q

Read2

α

{μ1 , . . . , μn } Q − → Q α

α∈ / A, Q1 − → Q1

Rel

α

Q1 + Q2 − → Q

μ.P − →P Read1

→ Q Q1 −

Par2

α

α ∈ A, Q1 − → Q1 , Q2 − → Q2 α

Q1 A Q2 − → clean(Q1 A Q2 ) α

Rec

Q{rec x.unmark(Q)/x} − → Q α

rec x.Q − → Q

˜ and α ∈ Aτ . The Definition 4. (Functional operational semantics) Let Q ∈ P α ˜ ˜ →⊆ (P × P) are given in Table 1. As SOS-rules defining the transition relation − α α α ˜ such usual, we write Q − → Q if (Q, Q ) ∈− → and Q − → if there exists a Q ∈ P α that (Q, Q ) ∈− →. Similar conventions are applied for Definition 6. Rules in Table 1 are quite standard (apart from using clean in the Par-rules as explained above). Notice that timing can be disregarded in Pref: when an action α is performed, one cannot see whether it was urgent or not, and thus α.P − → P ; furthermore, component α.P has to act within time 1, i.e. it can also act α → P . Rules Read1 and Read2 say that {μ1 , . . . , μn } immediately, giving α.P − Q can either repeatedly perform one of its non-blocking actions or evolve as Q. The use of the unmark in rule Rec has no effects for an initial process, where Rec is the standard SOS rule. For non-initial Q, we will explain this rule in Example 1. Symmetric rules have been omitted. An essential idea of reading is that it does not change the state of a process and therefore does not block other actions. With the above operational semantics, b b → {b} Q as well as {a} Q + {b} Q − → {b} Q, violating we have {a} {b} Q − this idea; therefore, we exclude such processes. α

Definition 5. (activated basic actions) A(Q) = {α | Q − →} is the set of acti˜ A(Q, A) = A(Q)\A is the set of activated vated (or enabled) actions of Q ∈ P. actions of Q when the environment prevents the actions in A ⊆ Aτ . 2.2

The Temporal Behaviour of PAFASs Processes

Our definition of timed behaviour is based on what we call (timed) refusal traces. Such a trace records, along a computation, which actions process Q performs α → Q , α ∈ Aτ ) and which actions Q can refuse to perform when time (Q − X X elapses (Q −→r Q , X ⊆ A). A transition like Q −→r Q is called a (partial) time-step. The actions listed in X are not urgent; hence Q is justified in not performing them, but performing a time step instead. If X = A then Q is fully


199

Table 2. Refusal transitional semantics of PAFASs processes Nilt

X

nil −→r nil

Preft1

X

α.P −→r α.P

Preft2

U({μ1 , . . . , μn }) ∩ (X ∪ {τ }) = ∅, Q −→r Q X

{μ1 , . . . , μn } Q −→r {μ1 , . . . , μn } Q Φ−1 (X∪{τ })\{τ }

Relt

Q −−−−−−−−−−−→r Q X

Q[Φ] −→r Q [Φ]

X

α.P −→r α.P X

X

Readt

α∈ / X ∪ {τ }

Sumt

Qi −→r Qi for i = 1, 2 X

Q1 + Q2 −→r Q1 + Q2

X

Rect

Q −→r Q X

rec x.Q −→r rec x.Q

X

Part

i Qi −−→ r Qi for i = 1, 2, X ⊆ (A ∩ (X1 ∪ X2 )) ∪ ((X1 ∩ X2 )\A)

X

Q1 A Q2 −→r clean(Q1 A Q2 )

justified in performing this time-step; i.e., Q can perform it independently of the environment. In such a case, we say that Q performs a full time-step and write 1 → Q ; moreover, we often write Q for Q . Our real interest is in runs where Q− all time steps are full. X ˜×P ˜ with Definition 6. (refusal transitional semantics) The relations −→r ⊆ P X ⊆ A are defined by the inference rules in Table 2.

Rule Preft1 says that a process α.P can let time pass and refuse to perform any action while rule Preft2 says that a process α.P can let time pass but cannot refuse the action α. Process τ .P cannot let time pass and cannot refuse any action; in any context, τ .P has to perform τ before time can pass further. Rule Part defines which actions a parallel composition can refuse during a time/ A (Q1 step. The intuition is that Q1 A Q2 can refuse an action α if either α ∈ and Q2 can do α independently) and both Q1 and Q2 can refuse α, or α ∈ A (Q1 and Q2 are forced to synchronise on α) and at least one of Q1 and Q2 can refuse α, i.e. can delay it. Thus, an action in a parallel composition is urgent (cannot be further delayed) only when all synchronising ‘local’ actions are urgent (also in this case we unmark the inactive urgencies). The other rules are as expected. Example 1. Consider P = (R ∅ W ) {r,w} V , where V = rec x.(r.x + w.x), R = rec x. r.x and W = rec x.w.x model a variable (with values abstracted away), and the activities of repeatedly reading and writing such a variable, 1 r resp. By our operational rules, V − → V = rec x. (r.x + w.x) − → V (each occurrence of x is replaced by V before the second transition by using unmark); 1 → hence, x is replaced by the original V as one would expect. Furthermore: P − r ((rec x. r.x) ∅ (rec x. w.x)) {r,w} rec x. (r.x + w.x) − → P . Here, the second transition models the execution of action r by synchronising R and V . These processes evolve into R and V , resp. and, as a side effect, the urgent w in W loses its urgency (due to function clean), since its synchronisation partner V

200


offers a new, non-urgent synchronisation. The above behaviour can be repeated, demonstrating that readings can repeatedly delay and thus block w indefinitely. Alternatively, we can model the action r as non-blocking with V = recx.{r} r 1 → V = rec x.({r} (w.x)) − → rec x.({r} (w.x). By our operational rules, V − w r 1 (w.x)) − → V . Hence: P − → Q = (R∅ W ){r,w} V − → Q = (R∅ recx.w.x){r,w} r w rec x.({r} (w.x)) − → Q − → (R ∅ W ) {r,w} V = P . After the first occurrence of r (corresponding to a synchronisation between R and V ), R becomes R and offers a new, non-urgent, instance of r to its partner; this causes the unmarking of the urgent r in V . Once in Q , we can either perform an r-action, evolving again into Q , or perform an action w and come back to P . But we cannot perform 1, i.e. w is not delayed by r in contrast to P above. Moreover, from Q we can also perform w evolving directly to P . In this step, the urgent r in R loses its urgency as above due to a new, non-urgent, synchronisation offered by V . Therefore, repeated writes can delay the action r arbitrarily long, i.e. writing can still block reading.

3

Fairness and Timing

In [5] we have defined fair traces in an intuitive, but very complex fashion in the spirit of [8] such that an action has to occur in an untimed run if it is enabled in every process of the run from some stage onward; then, we have characterised fair traces with transition sequences having infinitely many full time steps, so called non-Zeno timed execution sequences, generalising [4]. Here, due to lack of space, we omit the definition; the following characterisation will serve as definition of fair traces for the remainder of this paper. Theorem 1. (fair traces) Let P0 ∈ P1 be read-proper and α0 , α1 , α2 , . . . ∈ Aτ . A trace of P0 (i.e. a sequence of actions) is fair (w.r.t. actions) if it is the sequence of actions in a non-Zeno timed execution sequence. In detail: 1. A finite trace α0 α1 . . . αn is fair if and only if there exists a timed execution vm−1 v0 v1 1 1 1 → Qi0 −→ Pi1 − → Qi1 −→ Pi2 . . . Pim−1 − → Qim−1 −−−→ sequence Pi0 − 1

1

Pim − → Qim − → Qim . . ., where Pi0 = P0 and v0 v1 . . . vm−1 = α0 α1 . . . αn ; 2. an infinite trace α0 α1 α2 . . . is fair if and only if there exists a timed execution v0 v1 v 1 1 1 → Qi0 −→ Pi1 − → Qi1 −→ Pi2 · · · Pim − → Qim −−m → Pim+1 · · · , sequence Pi0 − where Pi0 = P0 and v0 v1 . . . vm . . . = α0 α1 . . . αi . . .. Example 2. Consider again P = (R ∅ W ) {r,w} V from Example 1 and the trace consisting of infinitely many r’s. This is fair, also when considering w because, at each transition, process V offers a “fresh” action w for synchronisation – each time an action r is performed, a new instance of w is produced. We can use timing to see this formally. As we noted in Example 1: 1 r → ((rec x. r.x) ∅ (rec x. w.x)) {r,w} rec x. (r.x + w.x) − → P . If we repeat P − this infinitely often, we get a non-Zeno timed execution sequence related to the trace of infinitely many r’s. Thus, fairness of actions allows computations along


201

which repeated reading of a variable indefinitely blocks another process trying to write to it (and vice versa for repeated writing). This is the reason why some fair runs of Dekker’s algorithm violate liveness (see below) when using standard PAFAS [3]. This problem is not specific to our setting or to our notion of fairness. In [13], Raynal writes about this algorithm that possibly, “ if Pi is a very fast repetitive process which ... keeps entering its critical section, ... Pj cannot set f lag[j] to true, being prevented from doing so by Pi ’s reading of the variable.” He observes that liveness of the algorithm therefore depends on the liveness of the hardware. This is exactly the sort of consideration for which we have a formal treatment: read prefixes say that the hardware guarantees that at least infinite reading cannot block writing. We can prevent this kind of unwanted behaviour by modelling the action r as reading (see Example 1). Indeed, a run from P = (R ∅ W ) {r,w} V consisting of infinitely many r’s is not fair, since we can have at most one time step along r r 1 r → (R ∅ W ) {r,w} V = Q − → Q − → ... − → Q . . ., where Q such a run: e.g. P − does not allow a full time step. Now, fairness of actions ensures that a process trying to write the variable will eventually do so. On the contrary, a run from P w 1 consisting of infinitely many w only is still fair (by Example 1, P − →Q− → P ) and, hence, repeated writing of a variable can block another process trying to read it. This kind of behaviour can be prevented if the variable is modelled as V = {r, w} nil, which only makes sense if the same value is written, not changing the system state. Remark 1. To see that re-writing the same value can indeed be non-blocking in practice, consider the two-phase locking protocol implementing a lock system where each transaction may only access a data item if it holds a lock on that item. There are two possible modes of locks: shared and exclusive. If a transaction T holds a shared mode lock (an S-lock) on data item q, then T may read – but not write – q. On the other hand, a transaction with an exclusive mode lock (an X-lock) on q can both read and write it. Multiple S-locks are allowed on a single data item, but only one X-lock can be acquired for it. This allows multiple reads (which do not create serialisability conflicts) as in our modelling of variables, but writing prevents reading or another writing (which would create conflicts). A transaction acquires new locks only during the so-called growing phase. All the locks acquired in the growing phase can be released only during a subsequent phase, called shrinking phase. Furthermore, an S-lock can be upgraded to X during the growing phase and, similarly, an X-lock can be downgraded to S during the shrinking phase. The idea here is that – during the growing phase – a transaction, instead of holding an X-lock on an item that it does not need to write yet, can hold an S-lock until the point where modifications to the old value begin, in order to allow other transactions to read the old value for longer. This can be used for a “reading first” implementation of writing: each write operation first reads the old value (this read requires an S-lock for the variable and can be done concurrently with other read operations) and then only writes a value only if it is really a new one (in this latter case, the S-lock has to be upgraded to an X-lock). This way, a re-writing of the same value is indeed non-blocking.

202

4


Dekker’s Algorithm and Its Liveness Property

In this section we briefly describe Dekker’s MUTEX algorithm. There are two processes P1 and P2 , two Boolean-valued variables b1 and b2 , whose initial values are false, and a variable k, which may take the values 1 and 2 and whose initial value is arbitrary. Informally, the b variables are “request” variables and k is a “turn” variable: bi is true if Pi is requesting entry to its critical section and k is i if it is Pi ’s turn to enter its critical section. Only Pi writes bi , but both processes read it. The ith process (with i = 1, 2) can be described as follows, where j is the index of the other process: while true do begin

noncritical section; bi = true; while bj do if k = j then begin bi := false; while k = j do skip; end;

critical section; k := j; bi := false; end; 4.1

bi := true;

Translating the Algorithm into PAFASs Processes

In our translation of the algorithm into PAFASs , we use essentially the same coding as Walker in [16]. Each program variable is represented as a family of processes. For instance, the process B1 (false) denotes the variable b1 with value false. The sort of the process B1 (false) (i.e. the set of actions it can ever perform) is the set {b1 rf , b1 rt , b1 wf , b1 wt} where b1 rf and b1 rt represent the actions of reading the values false and true from b1 , b1 wf and b1 wt represent, resp., the writing of the values false and true into b1 . Let B = {false, true} and K = {1, 2}. Definition 7. (the algorithm) Let i ∈ {1, 2}. We define the processes representing program variables as follows: Bi (false) = {bi rf , bi wf } bi wt .Bi (true) Bi (true) = {bi rt , bi wt } bi wf .Bi (false)

K(1) = {kr1 , kw1 } kw2 .K(2) K(2) = {kr2 , kw2 } kw1 .K(1)

Let B = {bi rf , bi rt , bi wf , bi wt | i ∈ {1, 2}} ∪ {kr1 , kr2 , kw1 , kw2 } be the union of the sorts of all variables and ΦB the relabelling function such that ΦB (α) = τ if α ∈ B and ΦB (α) = α if α ∈ / B. Given b1 , b2 ∈ B, k ∈ K, we define PV(b1 , b2 , k) = (B1 (b1 ) ∅ B2 (b2 )) ∅ K(k). Processes P1 and P2 are represented by the following PAFASs processes where the actions reqi and csi indicate the request to enter and the execution of the critical section by the process Pi . P1 = req1 .b1 wt.P11 + τ.P1 P11 = b2 rf .P14 + b2 rt .P12 P12 = kr1 .P11 + kr2 .b1 wf .P13 P13 = kr1 .b1 wt.P11 + kr2 .P13 P14 = cs1 .kw2 .b1 wf .P1

P2 = req2 .b2 wt.P21 + τ.P2 P21 = b1 rf .P24 + b1 rt .P22 P22 = kr2 .P21 + kr1 .b2 wf .P23 P23 = kr2 .b2 wt.P21 + kr1 .P23 P24 = cs2 .kw1 .b2 wf .P2


203

Now, we define the algorithm as Dekker = ((P1 P2 ) B PV(false, false, 1))[ΦB ]. The sort of Dekker is the set Ad = {reqi , csi | i = 1, 2}. A MUTEX algorithm like Dekker’s satisfies liveness if, in every fair trace, each reqi is followed by the respective csi . Since no process should be forced to request by the fairness assumption, Pi has the alternative of an internal move, i.e. staying in its noncritical section. 4.2

Liveness Violations and Catastrophic Cycles

Based on PAFAS, a testing-based faster-than relation has been defined in [7] that compares processes according to their worst-case efficiency. In [6], this testingapproach is adapted to a setting where user behaviour is known to belong to a very specific, but often occurring class of request-response behaviours: processes serving these users receive requests via an action in and provide a response out for each in-action; it is shown how to determine an asymptotic performance measure for finite-state processes of this kind. This result only holds for requestresponse processes that pass certain sanity checks: they must not produce more responses than requests, and they must allow requests and provide responses in finite time. While the first requirement can easily be read off from the transition system, violation of the latter requirement is characterised as the existence of so-called catastrophic cycles in a reduced transition system denoted rRTS(P ). α → Q and The refusal transition system of P consists of all transitions Q − X Q −→r Q , where Q is reachable from P via such transitions. rRTS(P ) is obtained X by removing all time steps except those Q −→r Q where either X = {out} and Q has some pending out-action or X = {in, out}; then, all processes not reachable any more are deleted as well. In the case X = {out}, some in has not received a response and the user is waiting for an out, but the process can still delay this, while being willing to accept another request immediately. The case X = {in, out} corresponds to a full time step. A cycle is catastrophic if it contains a time step but no in- or out-transition, such that time can pass without end but without any useful actions; see [6] for more details. A tool has been developed for automatically checking whether a process of (original) PAFAS has a catastrophic cycle with the algorithm described in [6], and only recently it has been adapted to a setting with reading actions. We will now give a result that allows us to decide whether Dekker is live using this tool. The tool cannot be applied directly: first, Dekker has more than two actions; second, it can perform a full time step followed by the two internal actions of P1 and P2 giving a catastrophic cycle, which is not relevant for the liveness property. Consequently, we modify Dekker to obtain a new process Dekker io as follows: we change the actions req1 and cs1 into τ actions, we delete the τ -summand of P2 (see Definition 7) and, finally, we change the actions req2 and cs2 in in and out, respectively. With this, we get the following result and corollary: Theorem 2. Dekker is live iff Dekker io does not have catastrophic cycles. Corollary 1. Dekker is live.

204


To further stress the impact of introducing non-blocking actions in PAFAS (and in general in modelling concurrent systems), we can obtain Dekker from Dekker by regarding writing the same value as blocking. We prove in [5] that this slight change has a decisive impact on liveness: Theorem 3. Dekker is not live.

References 1. Bouyer, P., Haddad, S., Reynier, P.A.: Timed Petri Nets and Timed Automata: On the Discriminating Power of Zeno Sequences. In: Bugliesi, M., Preneel, B., Sassone, V., Wegener, I. (eds.) ICALP 2006. LNCS, vol. 4052, pp. 420–431. Springer, Heidelberg (2006) 2. Christensen, S., Hansen, N.D.: Coloured Petri nets extended with place capacities, test arcs, and inhibitor arcs. In: Ajmone Marsan, M. (ed.) ICATPN 1993. LNCS, vol. 691, pp. 186–205. Springer, Heidelberg (1993) 3. Corradini, F., Di Berardini, M.R., Vogler, W.: Checking a Mutex Algorithm in a Process Algebra with Fairness. In: Baier, C., Hermanns, H. (eds.) CONCUR 2006. LNCS, vol. 4137, pp. 142–157. Springer, Heidelberg (2006) 4. Corradini, F., Di Berardini, M.R., Vogler, W.: Fairness of Actions in System Computations. Acta Informatica 43, 73–130 (2006) 5. Corradini, F., Di Berardini, M.R., Vogler, W.: Time and Fairness in a Process Algebra with Non-Blocking Reading. Technical Report 2008-13, Institute of Computer Science, University of Augsburg (2008) 6. Corradini, F., Vogler, W.: Measuring the Performance of Asynchronous Systems with PAFAS. Theoretical Computer Science 335, 187–213 (2005) 7. Corradini, F., Vogler, W., Jenner, L.: Comparing the Worst-Case Efficiency of Asynchronous Systems with PAFAS. Acta Informatica 38, 735–792 (2002) 8. Costa, G., Stirling, C.: Weak and Strong Fairness in CCS. Information and Computation 73, 207–244 (1987) 9. Crazzolara, F., Winskel, G.: Events in security protocols. In: Proc. of 8th ACM conference on Computer and Communication Security, CCS 2001, pp. 96–105 (2001) 10. Milner, R.: Communication and Concurrency. International series in computer science, Prentice Hall International (1989) 11. Montanari, U., Rossi, F.: Contextual net. Acta Informatica 32, 545–596 (1995) 12. Montanari, U., Rossi, F.: Contextual occurrence nets and concurrent constraints programming. In: Ehrig, H., Schneider, H.-J. (eds.) Dagstuhl Seminar 1993. LNCS, vol. 776, pp. 280–295. Springer, Heidelberg (1994) 13. Raynal, M.: Algorithms for Mutual Exclusion. North Oxford Academic (1986) 14. Ristori, G.: Modelling Systems with Shared Resources via Petri Nets. PhD thesis, Department of Computer Science, University of Pisa (1994) 15. Vogler, W.: Efficiency of Asynchronous Systems, Read Arcs and the MUTEXproblem. Theoretical Computer Science 275(1-2), 589–631 (2002) 16. Walker, D.J.: Automated Analysis of Mutual Exclusion algorithms using CCS. Formal Aspects of Computing 1, 273–292 (1989)

Expressiveness of Multiple Heads in CHR Cinzia Di Giusto1 , Maurizio Gabbrielli1 , and Maria Chiara Meo2 1

2

Dipartimento di Scienze dell’Informazione, Università di Bologna, Italia Dipartimento di Scienze, Università di Chieti Pescara, Italia

Abstract. Constraint Handling Rules (CHR) is a general purpose, committedchoice declarative language which, differently from other similar languages, uses multi-headed (guarded) rules. In this paper we prove that multiple heads augment the expressive power of the language. In fact, we first show that restricting to single head rules affects the Turing completeness of CHR, provided that the underlying signature (for the constraint theory) does not contain function symbols. Next we show that, also when considering generic constraint theories, under some rather reasonable assumptions it is not possible to encode CHR (with multi-headed rules) into a single-headed CHR language while preserving the semantics of programs. As a corollary we obtain that, under these assumptions, CHR can be encoded neither in (constraint) logic programming nor in pure Prolog.

1 Introduction Constraint Handling Rules (CHR) [7,9] is a committed-choice declarative language which has been originally designed for writing constraint solvers and which is nowadays a general purpose language. A CHR program consists of a set of multi-headed guarded (simplification and propagation) rules which allow one to rewrite constraints into simpler ones until a solved form is reached. The language is parametric w.r.t. an underlying constraint theory CT which defines the meaning of basic built-in constraints. The presence of multiple heads is a crucial feature which differentiates CHR from other existing committed choice (logic) languages. Many examples in the vast literature on CHR provide empirical evidence for the claim that such a feature is needed in order to obtain reasonably expressive constraint solvers in a reasonably simple way (see the discussion in [9]). However this claim was not supported by any formal result, so far. In this paper we prove that multiple heads do indeed augment the expressive power of CHR. Since we know that CHR is Turing powerful [16] we first show that CHR with single heads, called CHR-s in what follows, is also Turing powerful, provided that the underlying constraint theory allows the equality predicate (interpreted as pattern matching) and that the signature contains at least one function symbol (of arity greater than zero). This result is certainly not surprising; however it is worth noting that, as we prove later, when considering an underlying (constraint theory defined over a) signature containing finitely many constant symbols and no function symbol CHR (with multiple heads) is still Turing complete, while this is not the case for CHR-s. This provide a first separation result which is however rather weak, since usual constraint theories used in CHR do allow function symbols. Moreover computability theory M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 205–216, 2009. c Springer-Verlag Berlin Heidelberg 2009

206

C. Di Giusto, M. Gabbrielli, and M.C. Meo

is not always the right framework for comparing the expressive power of concurrent languages, since often one has to compare languages which are Turing powerful (see [4] for one of the first discussions on the subject). Hence in the second part of the paper we compare the expressive power of CHR and CHR-s by using the notion of language encoding, first formalized in [4,15,17]1 . Intuitively, a language L is more expressive than a language L or, equivalently, L can be encoded in L, if each program written in L can be translated into an L program in such a way that: 1) the intended observable behaviour of the original program is preserved (under some suitable decoding); 2) the translation process satisfies some additional restrictions which indicate how easy this process is and how reasonable the decoding of the observables is. For example, typically one requires that the translation is compositional w.r.t. (some of) the syntactic operators of the language [4]. We prove that CHR cannot be encoded into CHR-s under the following three assumptions. First we assume that the observable properties to be preserved are the constraints computed by a program for a goal, more precisely we consider data sufficient answers and qualified answers. Since these are the two typical CHR observables for most CHR reference semantics, assuming their preservation is rather natural. Secondly we require that both the source CHR language and the target CHR-s share the same constraint theory defining built-in constraints. This is also a natural assumption, as CHR programs are usually written to define a new (user-defined) predicate in terms of the existing builtin constraints. Finally we assume that the translation of a goal is compositional w.r.t. conjunction of goals, that is, we assume that A, Bg = Ag , Bg for any conjunctive goal A, B, where g denotes the translation of a goal. We believe this notion of compositionality to be reasonable as well, since essentially it means that the translated program is not specifically designed for a single goal. It is worth noticing that we do not impose any restriction on the translation of the program rules. From this main separation result follows that CHR cannot be encoded in (constraint) logic programs nor in pure Prolog. This does not conflict with the fact that there exist many CHR to Prolog compilers: it simply means that these compilers do not satisfy our assumptions (typically, they do not translate goals in a compositional way). The remainder of the paper is organized as follows. Section 2 introduces the languages under consideration. We then provide the encoding of Minsky machines in CHR-s and discuss the Turing completeness of this language in Section 3. Section 4 contains the main separation results while Section 5 concludes by discussing some related works.

2 Preliminaries In this section we give an overview of CHR syntax and operational semantics following [9]. We first need to distinguish the constraints handled by an existing solver, called built-in (or predefined) constraints, from those defined by the CHR program, called user-defined (or CHR) constraints. Therefore we assume that the signature contains two disjoint sets of predicate symbols for built-in and CHR constraints. A built-in constraint c is defined by: c ::= a | c ∧ c | ∃x c where a is an atomic built-in constraint 1

The original terminology of these papers was “language embedding”.

Expressiveness of Multiple Heads in CHR

207

(an atomic constraint is a first-order atomic formula). For built-in constraints we assume given a (first order) theory CT which describes their meaning. A user-defined constraint is a conjunction of atomic user-defined constraints. We use c, d to denote built-in constraints, h, k to denote CHR constraints and a, b, f, g to denote both built-in and user-defined constraints (we will call these generally constraints). The capital versions of these notations will be used to denote multisets of constraints. We also denote by false any inconsistent conjunction of constraints and with true the empty multiset of built-in constraints. We will use “,” rather than ∧ to denote conjunction and we will often consider a conjunction of atomic constraints as a multiset of atomic constraints2 . In particular, we will use this notation based on multisets in the syntax of CHR. The notation ∃V φ, where V is a set of variables, denotes the existential closure of a formula φ w.r.t. the variables in V , while the notation ∃−V φ denotes the existential closure of a formula φ with the exception of the variables in V which remain unquantified. F v(φ) denotes the free variables appearing in φ. Moreover, if t¯ = t1 , . . . tm and t¯ = t1 , . . . tm are sequences of terms then the notation p(t¯) = p (t¯ ) represents the set of equalities t1 = t1 , . . . , tm = tm if p = p , and it is undefined otherwise. This notation is extended in the obvious way to sequences of constraints. A CHR program is defined as a sequence of two kinds of rules: simplification and propagation3. Intuitively, simplification rewrites constraints into simpler ones, while propagation adds new constraints which are logically redundant but may trigger further simplifications. Definition 1. A CHR simplification rule has the form: r @H ⇔C |B while a CHR propagation rule has the form: r @ H ⇒ C | B, where r is a unique identifier of a rule, H (the head) is a (non-empty) multiset of userdefined constraints, C (the guard) is a possibly empty multiset of built-in constraints and B is a possibly empty multiset of (built-in and user-defined) constraints. A CHR program is a finite set of CHR simplification and propagation rules. In the following when the guard is true we omit true | . Also the names of rules are omitted when not needed. A CHR goal is a multiset of (both user-defined and built-in) constraints. An example of CHR Program is shown in Figure 3. We describe now the operational semantics of CHR by slightly modifying the transition system defined in [9]. We use a transition system T = (Conf , −→) where configurations in Conf are triples of the form G, K, d, where G are the constraints that remain to be solved, K are the user-defined constraints that have been accumulated and d are the built-in constraints that have been simplified. An initial configuration has the form G, ∅, ∅ while a final configuration has either the form G, K, false when it is failed, or the form ∅, K, d when it is successfully terminated because there are no applicable rules. Given a program P , the transition relation −→⊆ Conf × Conf is the least relation satisfying the rules in Table 1 (for the sake of simplicity, we omit indexing the relation with the name of the program). The Solve 2

3

We prefer to use multisets rather than sequences (as in the original CHR papers) because our results do not depend on the order of atoms in the rules. Some papers consider also simpagation rules. Since these are abbreviations for propagation and simplification rules we do not need to introduce them.

208

C. Di Giusto, M. Gabbrielli, and M.C. Meo Table 1. The standard transition system for CHR Solve

CT |= c ∧ d ↔ d and c is a built-in constraint (c, G), K, d −→ G, K, d

Introduce

h is a user-defined constraint (h, G), K, d −→ G, (h, K), d

Simplify

H ⇔ C | B ∈ P x = F v(H) CT |= d → ∃x ((H = H ) ∧ C) G, H ∧ K, d −→ B ∧ G, K, H = H ∧ d

Propagate

H ⇒ C | B ∈ P x = F v(H) CT |= d → ∃x ((H = H ) ∧ C) G, H ∧ K, d −→ B ∧ G, H ∧ K, H = H ∧ d

transition allows to update the constraint store by taking into account a built-in constraint contained in the goal. The Introduce transition is used to move a user-defined constraint from the goal to the CHR constraint store, where it can be handled by applying CHR rules. The transitions Simplify and Propagate allow to rewrite user-defined constraints (which are in the CHR constraint store) by using rules from the program. As usual, in order to avoid variable name clashes, both these transitions assume that all variables appearing in a program clause are fresh ones. Both the Simplify and Propagate transitions are applicable when the current store (d) is strong enough to entail the guard of the rule (C), once the parameter passing has been performed (this is expressed by the equation H = H ). Note that, due to the existential quantification over the variables x appearing in H, in such a parameter passing the information flow is from the actual parameters (in H ) to the formal parameters (in H), that is, it is required that the constraints H which have to be rewritten are an instance of the head H 4 . The difference between Simplify and Propagate lies in the fact that while the former transition removes the constraints H which have been rewritten from the CHR constraint store, this is not the case for the latter. Given a goal G, the operational semantics that we consider observes the final stores of computations terminating with an empty goal and an empty user-defined constraint. Following the terminology of [9], we call such observables data sufficient answers. Definition 2. [Data sufficient answers [9]] Let P be a program and let G be a goal. The set SAP (G) of data sufficient answers for the query G in the program P is defined as: SAP (G) = {∃−F v(G) d | G, ∅, ∅ −→∗ ∅, ∅, d −→}. We also consider the following different notion of answer, obtained by computations terminating with a user-defined constraint which does not need to be empty. Definition 3. [Qualified answers [9]] Let P be a program and let G be a goal. The set QAP (G) of qualified answers for the query G in the program P is defined as: QAP (G) = {∃−F v(G) (K ∧ d) | G, ∅, ∅ −→∗ ∅, K, d −→}. Both previous notions of observables characterize an input/output behavior, since the input constraint is implicitly considered in the goal. Clearly in general SAP (G) ⊆ 4

This means that the equations H = H express pattern matching rather than unification.


209

QAP (G) holds, since data sufficient answers can be obtained by setting K = ∅ in Definition 3. Note that in presence of propagation rules, the abstract (naive) operational semantics that we consider here introduces redundant infinite computations (because propagation rules do not remove user defined constraints). It is possible to define different operational semantics (see [1] and [6]) which avoids these infinite computations by allowing to apply at most once a propagation rule to the same constraints. The results presented in this paper hold also in case these more refined semantics are considered, essentially because the number of applications of propagations rules does not matter. We refer here to the naive operational semantics because it is much simpler than those in [1] and [6].

3 Turing Completeness of CHR-s In this section we discuss the Turing completeness of CHR-s by taking into account also the underlying constraint theory. In order to show the Turing completeness of a language we encode Minsky machines [12] into it, hence we recall some basic notions on this Turing equivalent formalism. A Minsky machine M (v0 , v1 ) is a two-counter machine which consists of two registers r1 and r2 holding arbitrary large natural numbers and initialized with the values v0 and v1 , and a program, i.e. a finite sequence of numbered instructions which modify the two registers. There are three types of instructions: – Succ(Ri ): adds 1 to the content of register Ri and goes to the next instruction; – DecJump(Ri , l): if the content of the register Ri is not zero, then decreases it by 1 and goes to the next instruction, otherwise jumps to instruction l; – Halt: stops computation and returns the value in register R1 . An internal state of the machine is given by a tuple (pi , r1 , r2 ) where the program counter pi indicates the next instruction and r1 , r2 are the current contents of the two registers. Given a program its computation proceeds by executing the instructions as indicated by the program counter. The execution stops when the program counter reaches the Halt instruction. We first show that CHR-s is Turing powerful, provided that the constraint theory allows the built-in = (interpreted as pattern matching) and that the underlying signature contains at least a function symbol (of arity one) and a constant symbol. This result is obtained by providing an encoding : M achines → CHR of a Minsky machine M (v0 , v1 ) in CHR as shown in Figure 1: Every rule takes as input the program counter and the two registers and updates the state according to the instruction in the obvious way. The variable X is used for outputting the result at the end. Note that, due to the pattern matching mechanism, a generic goal i(pi , s, t, X) can fire at most one of the two rules encoding the DecJump instruction (in fact, if s is a free variable no rule in the encoding of DecJump(r1 , pl ) is fired). Without loss of generality we can assume that the counters are initialized with 0, hence the encoding of a machine M with n instructions has the form: M (0, 0) := {Instruction1 , . . . , Instructionn } (note that the initial values of the register are not considered in the encoding of the machine: they will be used in the initial goal, as shown below). The following theorem states the correctness of the encoding. The proof is immediate.

210

C. Di Giusto, M. Gabbrielli, and M.C. Meo pi : Halt :=

i(pi , R1 , R2 , X) ⇔ X = R1

pi : Succ(r1 ) :=

i(pi , R1 , R2 , X) ⇔ i(pi+1 , succ(R1 ), R2 , X)

pi : Succ(r2 ) :=

i(pi , R1 , R2 , X) ⇔ i(pi+1 , R1 , succ(R2 ), X)

pi : DecJump(r1 , pl ) :=

i(pi , 0, R2 , X) ⇔ i(pl , 0, R2 , X)

pi : DecJump(r2 , pl ) :=

i(pi , R1 , 0, X) ⇔ i(pl , R1 , 0, X)

i(pi , succ(R1 ), R2 , X) ⇔ i(pi+1 , R1 , R2 , X) i(pi , R1 , succ(R2 ), X) ⇔ i(pi+1 , R1 , R2 , X) Fig. 1. Minsky machine encoding in CHR-s

Theorem 1. A Minsky machine M (0, 0) halts with output k if and only if the goal i(1, 0, 0, X) in the program M (0, 0) has a data sufficient answer X = k. It is worth noting that the presence of a function symbol (succ() in our case) is crucial in order to encode natural numbers and therefore to obtain the above result. Indeed, as we prove below, when considering a signature containing only a finite number of constant symbols the language CHR-s, differently from the case of CHR, is not Turing powerful. To be more precise, assume that CT defines only the = symbol (to be interpreted as pattern matching, as in the previous case) and assume that such a theory is defined over a signature containing finitely many constant symbols and no function symbol (of arity > 0). Let us call CT∅ the resulting theory. When considering CT∅ , CHR-s is computationally equivalent w.r.t. termination to place/transition nets [14], a formalism where termination is known to be decidable. Hence we have the following result. Theorem 2. CHR-s on CT∅ is not Turing complete. On the other hand, CHR (with multiple heads) is still Turing powerful also when considering the theory CT∅ . Indeed, as we show in Figure 2, we can encode Minsky machines into CHR (defined on CT∅ )5 . The basic idea here is that to encode the values of the registers we use chains (conjunctions) of atomic formulas of the form s(R1 , SuccR1 ), s(SuccR1 , SuccR1 ) . . . (recall that R1 , SuccR1 , SuccR1 are variables and we have countably many variables; moreover recall that the CHR computation mechanism avoid variables capture by using fresh names for variables each time a rule is used). It is also worth noting that for the correctness of the encoding it is essential that pattern matching rather than unification is used when applying rules (this ensures that in the case of the decrement only one of the two instructions can match the goal and therefore can be used). The correctness of the encoding is stated by the following theorem whose proof is immediate. Theorem 3. A Minsky machine M (0, 0) halts with output k > 0 (or k = 0) if and program M (0, 0)2 only if the goal zero(R1 ) ∧ zero(R2 ) ∧ i(1, R1 , R2 , X) in the produces a qualified answer ∃−X,R1 (X = R1 ∧ s(R1 , SuccR11 ) i=1...k−1 (SuccR1i , SuccR1i+1 )) (or ∃−X,R1 (x = R1 ∧ zero(R1 ))). 5

We thank an anonymous reviewer for having suggested this encoding.


211

pi : Halt2 := i(pi , R1 , R2 , X) ⇔ X = R1 pi : Succ(r1 )2 := i(pi , R1 , R2 , X) ⇔ s(R1 , SuccR1 ), i(pi+1 , SuccR1 , R2 , X) pi : Succ(r2 )2 := i(pi , R1 , R2 , X) ⇔ s(R2 , SuccR2 ), i(pi+1 , R1 , SuccR2 , X) pi : DecJump(r1 , pl )2 := i(pi , R1 , R2 , X), s(P reR1 , R1 ) ⇔ i(pi+1 , P reR1 , R2 , X) zero(R1 ), i(pi , R1 , R2 , X) ⇔ i(pl , R1 , R2 , X), zero(R1 ) pi : DecJump(r2 , pl )2 := i(pi , R1 , R2 , X), s(P reR2 , R2 ) ⇔ i(pi+1 , R1 , P reR2 , X) zero(R2 ), i(pi , R1 , R2 , X) ⇔ i(pl , R1 , R2 , X), zero(R2 ) Fig. 2. Minsky machine encoding in CHR on CT∅

Previous theorems state a separation result between CHR and CHR-s, however this is rather weak since the real implementations of CHR usually consider a non-trivial constraint theory which includes function symbols. Therefore we are interested in proving finer separation results which hold for Turing powerful languages. This is the content of the following section.

4 Separating CHR and CHR-s In this section we consider a generic non-trivial constraint theory CT. We have seen that in this case both CHR and CHR-s are Turing powerful, which means that in principle one can always encode CHR into CHR-s. The question is how difficult and how acceptable such an encoding is and this question can have important practical consequences: for example, a distributed algorithm can be implemented in one language in a reasonably simple way and cannot be implemented in another (Turing powerful) language, unless one introduces rather complicated data structures or loses some compositionality properties (see [18]). We prove now that, when considering acceptable encodings and generic goals whose components can share variables, CHR cannot be embedded into CHR-s while preserving data sufficient answers. As a corollary we obtain that also qualified answers cannot be preserved. First we have to formally define what an acceptable encoding is. We define a program encoding as any function : PCHR → PCHR−s which translates a CHR program into a (finite) CHR-s program (PCHR and PCHR−s denote the set of CHR and CHRs programs, respectively). To simplify the treatment we assume that both the source language CHR and the target language CHR-s use the same built-in constraints semantically described by a theory CT (actually this assumption could be relaxed). Note that we do not impose any other restriction on the program translation (which, in particular, could also be non compositional). Next we have to define how the initial goal of the source program has to be translated into the target language. Here we require that the translation is compositional w.r.t. the conjunction of atoms, as mentioned in the introduction. Moreover since both CHR and CHR-s share the same CT we assume that the built-ins present in the goal are left unchanged. These assumptions essentially mean that our encoding respects the structure of the original goal and does not introduce new relations among the variables which appear in the goal. Finally, as mentioned before,

212


we are interested in preserving data sufficient and qualified answers. Hence we have the following definition where we denote by GCHR and GCHR−s the class of CHR and CHR-s goals, respectively (we differentiate these two classes because, for example, a CHR-s goal could use some user defined predicates which are not allowed in the goals of the original program6). Note that the following definition is parametric w.r.t. a class G of goals: clearly considering different classes of goals could affect our encodability results. Such a parameter will be instantiated when the notion of acceptable encoding will be used. Definition 4 (Acceptable encoding). Let G be a class of CHR goals. An acceptable encoding (of CHR into CHR-s, for the class of goals G) is a pair of mappings : PCHR → PCHR−s and g : GCHR → GCHR−s which satisfy the following conditions: – PCHR and PCHR−s share the same CT; – for any goal (A, B) ∈ GCHR , A, Bg = Ag , Bg holds. We also assume that the built-ins present in the goal are left unchanged; – Data sufficient (qualified) answers are preserved for the class of goals G, that is, for all G ∈ G ⊆ GCHR , SAP (G) = SAP (Gg ) (QAP (G) = QAP (Gg )) holds. Note that, since we consider goals as multisets, with the second condition here we are not requiring that the order of atoms in the goals is preserved by the translation: We are only requiring that the translation of A, B is the conjunction of the translation of A and of B. Weakening this condition by requiring that the translation of A, B is some form of composition of the translation of A and of B does not seem reasonable, as conjunction is the only form for goal composition available in these languages. In order to prove our separation result we need the following lemma which states a key property of CHR-s computations. Essentially it says that if the conjunctive G, H with input constraint c produces a data sufficient answer d, then when considering one component, say G, with the input constraint d we obtain the same data sufficient answer. Moreover the same answer can be obtained, either for G or for H, also starting with an input constraint c weaker than d. Lemma 1. Let P be a CHR-s program and let (c, G, H) be a goal, where c is a built-in constraint, G and H are multisets of CHR constraints and V = F v(c, G, H). Assume that (c, G, H) in P has the data sufficient answer d. Then the following holds: – Both the goals (d, G) and (d, H) have the same data sufficient answer d. – If CT |= c → d then there exists a built-in constraint c such that F v(c ) ⊆ V , CT |= c → d and either (c , G) or (c , H) has the data sufficient answer d. Proof. The proof of the first statement is straightforward (since we consider single headed programs). In fact, since the goal (c, G, H) has the data sufficient answer d in P , the goal (d, G) can either answer d or can produce a configuration where the user 6

This means that in principle the signatures of (language of) the original and the translated program are different.


213

defined constraints are waiting for some guards to be satisfied in order to apply a rule r, but since the goal contains all the built-in constraints in the answer all the guards are satisfied letting the program to answer d. We prove the second statement. Let δ = (c, G, H), ∅, ∅ −→∗ ∅, ∅, d −→ be the derivation producing the data sufficient answer d = ∃−V d for the goal (c, G, H). By definition of derivation and since by hypothesis CT |= c → d, δ must be of the form (c, G, H), ∅, ∅ −→∗ (c1 , G1 ), S1 , d1 −→ (c2 , G2 ), S2 , d2 −→∗ ∅, ∅, d , where for i ∈ [1, 2], ci and di are built-in constraints such that CT |= c1 ∧ d1 → d and CT |= c2 ∧ d2 → d. We choose c = ∃−V (c1 ∧ d1 ). By definition of derivation and since P is a CHR-s program, the transition (c1 , G1 ), S1 , d1 −→ (c2 , G2 ), S2 , d2 must be a rule application of a single headed rule r, which must match with a constraint k that was derived (in the obvious sense) by either G or H. Without loss of generality, we can assume that k was derived from G. By construction c suffices to satisfy the guards needed to reproduce k, which can then fire the rule r, after which all the rules needed to let the constraints of G disappear can fire. Therefore we have that (c , G), ∅, ∅ −→∗ ∅, ∅, d , where CT |= ∃−V d ↔ ∃−V d (↔ d) and then the thesis. Note that Lemma 1 is not true anymore if we consider (multiple headed) CHR programs. Indeed if we consider the program P consisting of the single rule rule@H, H ⇔ true | c then goal (H, H) has the data sufficient answer c in P , but for each constraint c the goal (H, c ) has no data sufficient answer in P . With the help of the previous lemma we can now prove our main separation result. The idea of the proof is that any possible encoding of the rule r @ H, G ⇔ true | c into CHR-s would either produce more answers for the goal H (or G), or would not be able to provide the answer c for the goal H, G. Theorem 4. Let G be a class of goals such that if H is an head of a rule then H ∈ G. When considering data sufficient or qualified answers, there exists no acceptable encoding of CHR in CHR-s for the class G. Proof. We first consider data sufficient answers. The proof is by contradiction. Consider the program P consisting of the single rule r @ H, G ⇔ true | c and assume that P is the translation of P in CHR-s. Assume also that c (restricted to the variables in H, G) is not the weakest constraint, i.e. assume that there exist d such that CT |= d → ∃−V c where V = F v(H, G). Note that this assumption does not imply any loss of generality, as we consider non trivial constraint systems containing at least two different constraints. Since the goal (H, G) has the data sufficient answer ∃−V c in the program P and since the encoding preserves data sufficient answers the goal (H, G)g has the data sufficient answer ∃−V c also in the program P . From the compositionality of the translation of goals and the previous Lemma 1 it follows that there exists a constraint c such that F v(c ) ⊆ V , CT |= c → ∃−V c and either the goal (c , H)g , or the goal (c , G)g has the data sufficient answer c in the encoded program P . However

214

C. Di Giusto, M. Gabbrielli, and M.C. Meo reflexivity @ Lessequal(X, Y ) ⇔ X = Y | true antisymmetry @ Lessequal(X, Y ), Lessequal(Y, X) ⇔ X = Y transitivity @ Lessequal(X, Y ), Lessequal(Y, Z) ⇒ Lessequal(X, Z) Fig. 3. A program for defining ≤ in CHR

neither (c , H) nor (c , G) has any data sufficient answer in the original program P . This contradicts the fact that P is an acceptable encoding for P , thus concluding the proof for data sufficient answers. The thesis for qualified answers follows immediately from the previous part, as qualified answers contain the set of data sufficient answers. The hypothesis made on the class of goals G is rather weak, as typically heads of rules have to be used as goals. As an example of the application of the previous theorem consider the program (from [9]) contained in Figure 3 which allows one to define the user-defined constraint Lessequal (to be interpreted as ≤) in terms of the only builtin constraint = (to be interpreted as syntactic equality). For example, given the goal {Lessequal(A, B), Lessequal(B, C), Lessequal(C, A)} after a few computational steps the program will answer A = B, B = C, C = A. Now for obtaining this behaviour it is essential to use multiple heads, as already claimed in [9] and formally proved by previous theorem. In fact, following the lines of the proof of Theorem 4, one can show that if a single headed program P is any translation of the program in Figure 3 which produces the correct answer for the goals above, then there exists a subgoal which has an answer in P but not in the original program. 4.1 A Note on Logic Programs and Prolog (Constraint) Logic programming and Prolog are programming languages quite different from CHR, mainly because they are sequential ones, without any guard mechanism and commit operator. Nevertheless, since many CHR implementations are built on top of a Prolog system, by using a compiler which translates CHR programs to Prolog, it is meaningful to compare these sequential languages with CHR. Note that here, following the general terminology (see for example [2]), a (constraint) logic program is a set of (definite) clauses, to be interpreted operationally in terms of SLD-resolution, thus using a non deterministic computational model. Real logic programming systems eliminate such a non determinism by choosing a specific selection rule (for selecting the atom in the goals to be evaluated) and a specific rule for searching the SLD-tree. Following [2] we call pure Prolog a logic programming language which uses the leftmost selection rule and the depth-first search (this corresponds to consider clauses top-down, according to the textual ordering in the program). Implemented Prolog systems are extensions of pure Prolog obtained by considering specific built-ins for arithmetic, control etc. Some of these built-ins have a non logical nature, which complicates their semantics. All our technical lemmata about CHR-s can be stated also for (constraint) logic programming and pure Prolog (the proofs are similar, modulo some minor adjustments).


215

Hence our separation results hold also when considering these languages rather than CHR-s. These can be summarized as follows. Corollary 1. Let G be a class of goals such that if H is an head of a rule then H ∈ G. When considering data sufficient answers or qualified answers there exists no acceptable encoding of CHR in constraint logic programming nor in pure Prolog for the class G. As mentioned in the introduction, previous result does not conflict with the fact that there exist many CHR to Prolog compilers: it simply means that, when considering pure Prolog, these compilers do not satisfy our assumptions (typically, they do not translate goals in a compositional way). Moreover real Prolog systems use several non logical built-in’s, which are out of the scope of previous results.

5 Conclusions and Related Works In this paper we have studied the expressiveness of CHR. We have proved that multiple heads augment the expressive power of the language, indeed we have shown that CHR cannot be encoded in CHR with single heads under quite reasonable assumptions. These results are then shown to hold also for (constraint) logic programming and pure Prolog. There exists a very large literature on the expressiveness of concurrent languages, however there are only few papers which consider the expressive power of CHR: A recent study is [16], where the authors show that it is possible to implement any algorithm in CHR in an efficient way, i.e. with the best known time and space complexity. This result is obtained by introducing a new model of computation, called the CHR machine, and comparing it with the well-known Turing machine and RAM machine models. Earlier works by Frühwirth [8,10] studied the time complexity of simplification rules for naive implementations of CHR. In this approach an upper bound on the derivation length, combined with a worst-case estimate of (the number and cost of) rule application attempts, allows to obtain an upper bound of the time complexity. The aim of all these works is clearly completely different from ours, even though it would be interesting to compare CHR and CHR-s in terms of complexity. When moving to other languages, somehow related to our paper is the work by Zavattaro [19] where the coordination languages Gamma [3] and Linda [11] are compared in terms of expressive power. Since Gamma allows multiset rewriting it reminds CHR multiple head rules, however the results of [19] are rather different from ours, since a process algebraic view of Gamma and Linda is considered where the actions of processes are atomic and do not contain variables. On the other hand, our results depend directly on the presence of logic variables in the CHR model of computation. Relevant for our approach is also [4] which introduces the original approach to language comparison based on encoding, even though in this paper rather different languages with different properties are considered. We are extending this work along several lines. First in [5] we have considered weaker notion of acceptable encoding obtaining results similar to those of theorem 4. Moreover, in the same paper we have considered the different expressive power of CHRn , the language with at most n atoms in the heads, and CHRn+1 . Preliminary

216


results show that CHRn+1 is strictly more expressive than CHRn . We intend to extend these results by using the techniques described in [13,18] for showing that (under some reasonable hypothesis) some typical distributed problems can be solved in CHRn+1 and not in CHRn . We also plan to investigate what happens when considering translation of CHR into real Prolog systems (with non logical built-ins). Some of the properties that we used in our technical lemma in this case do not hold anymore, however we believe that also in this case we can establish separation results similar to those shown in section 4.1.

References 1. Abdennadher, S.: Operational semantics and confluence of constraint propagation rules. In: Principles and Practice of Constraint Programming, pp. 252–266 (1997) 2. Apt, K.R.: From logic programming to Prolog. Prentice-Hall, Inc., Upper Saddle River (1996) 3. Banâtre, J.-P., Métayer, D.L.: Programming by multiset transformation. Commun. ACM 36(1), 98–111 (1993) 4. de Boer, F.S., Palamidessi, C.: Embedding as a tool for language comparison. Information and Computation 108(1), 128–157 (1994) 5. Di Giusto, C., Gabbrielli, M., Meo, M.C.: On the expressive power of CHR. Technical report (2008) 6. Duck, G.J., Stuckey, P.J., Garc´ıa de la Banda, M., Holzbaur, C.: The refined operational semantics of constraint handling rules. In: Demoen, B., Lifschitz, V. (eds.) ICLP 2004. LNCS, vol. 3132, pp. 90–104. Springer, Heidelberg (2004) 7. Frühwirth, T.: Introducing simplification rules. Technical report (1991) 8. Frühwirth, T.: As time goes by: Automatic complexity analysis of simplification rules. In: KR 2002 (2002) 9. Frühwirth, T.W.: Theory and practice of constraint handling rules. J. Log. Program. 37(1-3), 95–138 (1998) 10. Frühwirth, T.W.: As time goes by II: More automatic complexity analysis of concurrent rule programs. Electr. Notes Theor. Comput. Sci. 59(3) (2001) 11. Gelernter, D., Carriero, N.: Coordination languages and their significance. Commun. ACM 35(2), 96 (1992) 12. Minsky, M.: Computation: finite and infinite machines. Prentice-Hall, Englewood Cliffs (1967) 13. Palamidessi, C.: Comparing the expressive power of the synchronous and asynchronous picalculi. Mathematical. Structures in Comp. Sci. 13(5), 685–719 (2003) 14. Reisig, W.: Petri nets: an introduction. Springer, New York (1985) 15. Shapiro, E.Y.: The family of concurrent logic programming languages. ACM Comput. Surv. 21(3), 413–510 (1989) 16. Sneyers, J., Schrijvers, T., Demoen, B.: The computational power and complexity of Constraint Handling Rules. In: Schrijvers, T., Frühwirth, T. (eds.) CHR 2005, vol. CW 421, pp. 3–17 (2005) 17. Vaandrager, F.W.: Expressive results for process algebras. In: Proceedings of the REX Workshop on Sematics: Foundations and Applications, London, UK, pp. 609–638. Springer, London (1993) 18. Vigliotti, M.G., Phillips, I., Palamidessi, C.: Tutorial on separation results in process calculi via leader election problems. Theor. Comput. Sci. 388(1-3), 267–289 (2007) 19. Zavattaro, G.: On the incomparability of gamma and linda. Technical report, Amsterdam, The Netherlands (1998)

Weaknesses of Cuckoo Hashing with a Simple Universal Hash Class: The Case of Large Universes Martin Dietzfelbinger and Ulf Schellbach Technische Universität Ilmenau, Germany {martin.dietzfelbinger,ulf.schellbach}@tu-ilmenau.de

Abstract. Cuckoo hashing was introduced by Pagh and Rodler in 2001 [12]. A set S of n keys is stored in two tables T1 and T2 each of which has m cells of capacity 1 such that constant access time is guaranteed. For m ≥ (1+ε)n and hash functions h1 , h2 that are c log n-wise independent, Pagh [11] showed that the keys of an arbitrary set S can be stored using h1 and h2 with a probability of 1 − O(1/n). Here we prove that a family of simple hash functions that can be evaluated fast is not sufficient to guarantee this behavior, namely there exists a “bad” set S of size ≈ (7/8) · m for which the probability that the keys of S cannot be stored using h1 and h2 is Ω(1). Experiments indicate that the bad sets cause the cuckoo scheme to fail with a probability much larger than formally proved in our main theorem. Our result shows that care must be taken when using cuckoo hashing in combination with very simple hash classes, if a small failure probability is essential since frequent rehashing cannot be tolerated. Keywords: data structures, randomized algorithms, cuckoo hashing, universal hash classes, lower bounds.

1

Introduction

1.1

Cuckoo Hashing

Given two hash tables T1 , T2 , each of size m, and hash functions h1 , h2 mapping a universe U of keys to [m] = {0, 1, . . . , m − 1}, the two possible positions for a key x are cell h1 (x) of T1 and cell h2 (x) of T2 . For a given set S ⊆ U and hash functions h1 , h2 we say that h1 and h2 are suitable for S if it is possible to store the keys from S in T1 , T2 according to h1 , h2 in such a way that distinct keys are stored in distinct table cells. For a detailed description and the basic analysis of cuckoo hashing, see [14]. In [11] it is shown that if m ≥ (1 + ε)n for some constant ε > 0 and h1 , h2 are chosen at random from a c log n-wise independent class of hash functions, for a suitable constant c, then for each S of size n the probability that h1 and h2 are suitable for S is 1 − O(1/n).

Research supported in part by DFG grant DI 412/10-1.


218

1.2

M. Dietzfelbinger and U. Schellbach

The Hash Function Family

We consider the following hash function family. Let 1 ≤ l ≤ k and U = [2k ]. mult Then Hk,l := {ha : U → [2l ] | a ∈ Ok }, where Ok := {1, 3, 5, . . . , 2k − 1}, and for x ∈ U we let ha (x) := (a · x mod 2k ) div 2k−l ∈ [2l ] = [m]. We refer to this family as the multiplicative class [5]. In [5], the multiplicative class is proved to be 2-universal with respect to the following well known generalization of the original notion of universality, which is due to Carter and Wegman [1]. Definition 1. A family H of hash functions h : U → [m] is called c-universal if for arbitrary keys x = y and h chosen uniformly at random from H, Pr(h(x) = h(y)) ≤ 1.3

c . m

Related Work

Recently, Mitzenmacher and Vadhan [10] approached the question of the behavior of weak hash classes from the other direction: they showed that if the key set S is produced by a random process that satisfies certain requirements then mult ) will produce a distribution of hash values weak hash classes (including Hk,l that is close to uniform. In particular, in such a situation cuckoo hashing will work well. In a related paper [6], the authors show that cuckoo hashing will not work well with a set S chosen randomly if S is very dense in U , in the sense that m ≥ |U |1−γ for some small constant γ. This seems to contradict [10]. However, the hypotheses of the result in [10] lead to the requirement that S is not too dense in U , and hence in [10] no statement is made about the situation investigated in [6]. In [3], Cohen and Kane show that even the property of a hash family to be 5-wise independent is not sufficient to guarantee that cuckoo hashing works well. The hash family constructed there as a counterexample is quite contrived and not suited for being used in practice. 1.4

Our Result

The purpose of the present paper is to show the following: even if U is much larger than [m], when applied to cuckoo hashing the multiplicative class has deficiencies in comparison to Ω(log n)-wise independent classes, in the sense that there are structured key sets S, constructed as a mixture of regular patterns and randomly chosen keys, that will make cuckoo hashing fail with constant probability (in place of the O(1/n), resulting from the analysis in [11]). The construction and proofs are totally different from those in [6]. Here again, our result is no contradiction to [10], as we allow only very restricted randomness in the data. In fact, our result implies the existence of a set without any random elements for which cuckoo hashing with the multiplicative class behaves badly. According to a statement in a recent paper by Mitzenmacher, Kirsch, and Wieder [9], our result shows that even in the case where S is very sparse in U ,

Weaknesses of Cuckoo Hashing with a Simple Universal Hash Class

219

the combination of cuckoo hashing with the multiplicative class will be unsuitable for production systems where a constant failure probability is not tolerable, no matter how small it is. The method proposed in [9] (utilizing a small extra storage, called a stash, to circumvent the effect of few keys that obstruct suitability) will not help in this situation.

2 2.1

Preliminaries and Main Result The Cuckoo Graph and Bad Edge Sets

The cuckoo graph (see e. g. [4]) represents the hash values on a set S of keys in U for hash functions h1 , h2 : U → [m]. Its vertices correspond to the cells in tables T1 and T2 , and an edge connects the two possible locations T1 [h1 (x)] and T2 [h2 (x)] for a key x ∈ S. Formally, the cuckoo graph G(S, h1 , h2 ) is defined as an undirected bipartite multigraph (V1 , V2 , E) with vertex sets V1 = [m] and V2 = [m], and edge (multi)set E = {(h1 (x), h2 (x)) | x ∈ S}. We refer to G(U, h1 , h2 ) as the complete cuckoo graph. If G(S, h1 , h2 ) = (V1 , V2 , E), we call E ⊆ E a bad edge set if |E | is larger than the number of distinct vertices that are incident with edges in E . The following lemma will be useful. Lemma 1. The hash functions h1 and h2 are suitable for S if and only if G(S, h1 , h2 ) does not contain a bad edge set. Proof. In [4] it is shown that h1 and h2 are not suitable for S if and only if G(S, h1 , h2 ) has a connected component that contains two or more different cycles. It is not hard to see that this condition is equivalent to G(S, h1 , h2 ) having a bad edge set. 2.2

The Main Result

For hash functions h1 , h2 and S ⊆ U , all of which may be the result of a random experiment, we denote the probability that h1 and h2 are not suitable for S as failure probability pF = pF (S, h1 , h2 ). As building blocks of our “bad” key sets we define “grid sets”, which are arithmetic progressions in U with step size 2k−l . Let δ = 1/8 and d := (1 − δ)m/3. Define xi (c) := (c + i · 2k−l ) mod 2k , for c ∈ [2k ] and i ∈ [2l ], and the grid sets Gc := {xi (c) | i ∈ [d]} , for c ∈ [2k ] . To get S, we perform the following random experiment: choose c at random from Ok , and choose a random subset Rc of U − (G0 ∪ Gc ) of size d. Then S = S(c, Rc ) = G0 ∪ Gc ∪ Rc . The purpose of this paper is to establish the following theorem.

(1)

220


Theorem 1. If l ≥ 14 and k − log k ≥ 3l + 5, then for the set S = G0 ∪ Gc ∪ Rc of size 3d ≤ (7/8) · m + 2 formed by the random experiment as just described and mult for ha1 , ha2 chosen from Hk,l uniformly at random we have pF = Ω(1). The rest of the paper is devoted to the proof of this theorem, where we assume l ≥ 14 and k − log k ≥ 3l + 5

(2)

throughout, particularly in Lemmas 2, 3, 4, 5, 7, and 11. The constant lower bound we establish for pF is 2−24 . Experiments indicate that the failure probability for the sets S constructed here is much larger.

3

Basic Structure of the Proof

Apart from the grid structure of the set S, a certain property of hash function pairs is vital in our proof: we say that a pair (ha1 , ha2 ) of hash functions from mult Hk,l has an almost uniform distribution of values for the domain D ∈ {U, Ok }, if for x chosen uniformly at random from D we have 1 −2l ·2 ≤ Pr((ha1 (x), ha2 (x)) = (i, j)) ≤ 4 · 2−2l . 4 In Sections 4 and 5 we prove the following two lemmas, respectively. ∀(i, j) ∈ [2l ]2 :

(3)

Lemma 2. If (2) holds, then a fraction of more than 1/7 of all hash function pairs (ha1 , ha2 ) has an almost uniform distribution as in (3) for D ∈ {U, Ok }. Lemma 3. Let (ha1 , ha2 ) be a pair with almost uniform distribution for D ∈ {U, Ok }, assume (2), and let S = S(c, Rc ) be chosen randomly as in (1). Then pF (S) > 2−21 . Once these lemmas are proved, we have proved Theorem 1, because 2−24 < (1/7) · 2−21 < pF = pF (S(c, Rc ), ha1 , ha2 ).

4

Proof of Lemma 2: Many Hash Function Pairs Have an Almost Uniform Distribution

The distribution of hash value pairs for D ∈ {U, Ok } is represented by the cuckoo graph G(D, ha1 , ha2 ). In [6] the following simple observation was made. Observation. The set {G(D, ha1 , ha2 ) | a2 ∈ Ok } of cuckoo graphs for fixed a1 and variable a2 does not depend on a1 . So, we can assume w. l. o. g. that a1 = 1, and it remains to identify a suitable set A2 ⊆ Ok of parameters a2 . Let k−l 2 2k−l k ,..., −1 . (4) A2 := a ∈ Ok | ∃ x ∈ O(k−l)−(l+2) : ax mod 2 ∈ 4 2 We will show (Lemma 4) that each pair (h1 , ha2 ), a2 ∈ A2 , has an almost uniform distribution for D ∈ {U, Ok }, and that |A2 |/|Ok | > 1/7 (Lemma 5), which concludes the proof of Lemma 2.


221

Lemma 4. Each pair (h1 , ha2 ), a2 ∈ A2 , has an almost uniform distribution for D ∈ {U, Ok }. Proof. We define minD and maxD as the minimum cardinality and maximum cardinality of a preimage with respect to (h1 , ha2 ) for the domain D, respectively, i. e. minD := min{|{x ∈ D | (h1 (x), ha2 (x)) = (i, j)}| : i, j ∈ [m]} and maxD accordingly. If x is chosen uniformly at random from D, then for all i, j ∈ [m] we have minD maxD ≤ Pr((h1 (x), ha2 (x)) = (i, j)) ≤ . (5) |D| |D| The cardinality of the preimage of (i, j) with respect to a uniformly distributing hash function pair is avgD := |D|/22l , as m = 2l . Assume that maxD ≤4. minD

(6)

Then we have minD /|D| ≥ maxD /(4|D|) ≥ avgD /(4|D|) = (1/4)·2−2l , and similarly maxD /|D| ≤ 4 · 2−2l , and together with (5) this yields (3). So, it remains to prove (6). Consider the matrix B = (bx,y )x,y∈U that is given by bx,y := 1 if y = a2 x mod 2k , bx,y := 0 otherwise. Let Ui := {i2k−l , . . . , (i + 1)2k−l − 1} for i ∈ [2l ]. Observe that the number of 1s in the submatrix Bi,j := (bx,y )x∈Ui ,y∈Uj is |(h1 , ha2 )−1 (i, j)| for D = U (Fig. 1), as well as for D = Ok if every second row is counted. This follows from the fact that z div 2k−l = i for all z ∈ Ui . Furthermore, observe that the pattern of 1s in all submatrices Bi := (bx,y )x∈Ui ,y∈U is

Fig. 1. The number of 1s in Bi,j is |(h1 , ha2 )−1 (i, j)| for D = U , because the single 1 in row x is in row block i = x div 2k−l = h1 (x) and in column block j = ha2 (x)

222


equal in the sense that Bi is just a shifted version of Bi for arbitrary i, i ∈ [2l ]. This in turn follows from the fact that each row contains exactly one 1, and from the obvious equivalence bx,y = 1 ⇔ b(x+1) mod 2k ,(y+a2 ) mod 2k = 1, which holds for all x, y ∈ U . Thus, for estimating the values of maxD and minD , we can restrict ourselves to considering B0 . We have to show that the number of 1s in arbitrary blocks B0,j and B0,j , j, j ∈ [2l ], differs by no more than a factor four. Fix a2 ∈ A2 and, according to (4), x ∈ O(k−l)−(l+2) with a2 x mod 2k ∈ k−l {2 /4, . . . , 2k−l /2 − 1} arbitrarily. For each t ∈ [x], consider the row sequence (t) (t) (xs )0≤s≤dt , where xs := (s · x + t), and k−l 2 − (t + 1) dt = (7) x (t)

is the maximum natural number with (s · x + t) ∈ U0 . The 1 in row xs resides in (t) (t) column ys := a2 xs mod 2k , and we refer to the sequence of matrix positions (t) (t) (t) (t) (xs , ys )0≤s≤dt which represent the 1s in rows (xs ) as (oness ). Observe that (t) the set of the 1 positions in B0 is the disjoint union of the sets {oness | s ∈ (t) {0, . . . , dt }} over all t ∈ [x]. Now consider a sequence (oness ) for a fixed t ∈ [x]. (t) (If for all j, j ∈ [2l ] the number of 1s in B0,j and B0,j given by (oness ) differs by no more than a factor four, then the same is true if we sum over all t ∈ [x].) (t) Whenever the sequence (oness ) passes a block B0,j , it hits this block with at least two and at most four successive elements, because by the definition of (t) A2 the step size y of the column sequence (ys ) is y = a2 x mod 2k ∈ {2k−l /4, . . . , 2k−l /2 − 1} . (t)

(8)

Furthermore, the sequence (oness ) passes each block B0,j , j ∈ [2l ], at least once, because the sum of dt steps of size y is greater than 2k − 2k−l /2, by (7) and (8). We obtain an upper bound on maxD / minD as follows. Consider an arbitrary (t) block B0,j . The sequence (oness ) might pass this block only once and hit it with two elements or pass it twice and hit it with four elements. Now assume that (t) there exist blocks B0,j and B0,j , j, j ∈ [2l ], such that (oness ) passes B0,j once and hits it with only two elements, whereas B0,j is passed twice and each time (t) hit with four elements. In this worst case, the number of 1s, given by (oness ), differs in the two blocks by a factor four, and hence (6) is proved for D = U (see Fig. 2). For D = Ok , the argument is similar, noticing that every second element of (t) (t) (xs ) is odd: if t is odd, then xs is odd for every even s, and vice versa. Thus, the corresponding sequence of matrix positions which contain the 1s passes every block B0,j at least once, and hits it with one or two elements, whenever it is passed, and so on.


223

(0)

Fig. 2. (oness ) in the worst case with respect to maxD / minD

Lemma 5. |A2 |/|Ok | > 1/7 . Proof. Consider A2 as in (4). For all x ∈ O(k−l)−(l+2) and i ∈ [x] we define 1 k k−l−2 1 k k−l−1 (i · 2 + 2 Qx,i := ), (i · 2 + 2 ) , (9) x x and Qx := i∈[x] Qx,i and Q := x∈O(k−l)−(l+2) Qx . Then A2 = Q ∩ Ok , where for our purposes the obvious subset relation Q ∩ Ok ⊆ A2 is sufficient. Observe that there exist disjoint half-open intervals I1 , . . . , It of the form [a , b ) and of l length ≥ 2 such that Q = 1≤j≤t Ij . This in particular implies that t < |Q|/2l . As |Q| = |I1 | + · · · + |It | and each interval Ij contains at least |Ij | natural numbers, of which at least |Ij |/2 are odd, we have |Ij | |Q| |Q| −1 = − t > (1 − 2−l+1 ) · , |A2 | ≥ |Q ∩ Ok | > 2 2 2 1≤j≤t

and hence |A2 |/|Ok | > (1 − 2−l+1 ) · |Q|/2k . We show that |Q|/2k > 5/25. Then (1 − 2−l+1 ) · |Q|/2k > 1/7 for l ≥ 14 – as desired. A simple inclusion-exclusion bound, Boole’s inequalities, turns out to be helpful to establish a lower bound for |Q|/2k . Lemma 6 (Boole’s inequalities). Let D1 , . . . , Dr , r ∈ IN, be arbitrary events. Then r

r r Pr(Di ) − Pr(Di ∩ Dj ) ≤ Pr Di ≤ Pr(Di ) . i=1

1≤i<j≤r

i=1

i=1

In order to apply it, we normalize all values by shrinking the interval [0, 2k ) to [0, 1) and working in the measure space that is given by [0, 1) with the usual Lebesgue measure λ. Now, in direct correspondence to (9), we define the sets 1 −(l+2) 1 −(l+1) (i + 2 ), (i + 2 ) , (10) Ex,i := x x

224


as well as Ex := i∈[x] Ex,i and E := x∈O(k−l)−(l+2) Ex . Then |Q|/2k = λ(E). The following lemma allows us to apply Boole’s lower bound inequality. Lemma 7. Let x, x ∈ [2(k−l)−(l+2) ] − [2(k−l)−(l+3) ], x < x , be coprime. Then λ(Ex ∩ Ex )
1, and define π(n) as the number of distinct prime numbers less than or equal to n. Then 7n n < π(2n) − π(n) < . 3 ln(2n) 5 ln(n) By Finsler’s inequalities, we know that the set [2(k−l)−(l+2) ] − [2(k−l)−(l+3) ] contains at least 2k−2l−3 /(3 ln(2k−2l−2 )) distinct prime numbers. Of course these prime numbers are odd and pairwise coprime. For k − log k ≥ 3l + 5 we have 2k−2l−3 /(3 ln(2k−2l−2 )) ≥ 2l . So, let PR be a set of exactly 2l distinct prime numbers in [2(k−l)−(l+2) ] − [2(k−l)−(l+3) ]. We complete the proof of Lemma 5 as follows: ⎞ ⎛ |Q| = λ(E) = λ ⎝ Ex ⎠ (see (10)) 2k x∈O(k−l)−(l+2)

Ex (PR ⊆ O(k−l)−(l+2) ) ≥λ x∈PR

>

λ(Ex ) −

x∈PR

>2 ·2 l

>

−(l+2)

λ(Ex ∩ Ex )

(Lemma 6)

x,x ∈PR, x=x

l 3 2 · · 2−2l − 2 16

(Lemma 7)

5 . 25

5

Proof of Lemma 3: pF (S) under the Condition of an Almost Uniform Distribution

For the proof of Lemma 3 we consider the cuckoo graph G = (V1 , V2 , E) = G(S, ha1 , ha2 ) of the set S = S(c, Rc ). We show that if c is suitably chosen then


225

a large subset of the edges corresponding to G0 and Gc in G form a set of simple paths with disjoint vertex sets. The number of these paths is a random variable Δ. Then we prove a lower bound for the probability that we chose a suitable c and that under the condition of a suitable c choosing Rc yields ≥ Δ+1 edges with endpoints on the Δ paths, and hence yields a bad edge set. This will conclude the proof of Lemma 3. In the following we refer to the edge that corresponds to a key xi (c ) ∈ Gc as ei (c ) for arbitrary c ∈ U , and we say that the keys x = y collide under the hash function h if h(x) = h(y). mult maps Gc one-to-one into [m] for Lemma 9. Each hash function ha ∈ Hk,l arbitrary c ∈ U .

Proof. Let x, y ∈ Gc , x = y, be arbitrary. We have to show that ha (x) = ha (y). Let i and j be the unique numbers in [d] with x = (c + i · 2k−l ) mod 2k and y = (c + j · 2k−l ) mod 2k , and assume w. l. o. g. that i < j. Then we have y = (x + t · 2k−l ) mod 2k for the positive integer t := j − i < 2l /3. Now, on the one hand we have ha (x) = (ax mod 2k ) div 2k−l , and on the other hand we derive ha (y) = ((ax mod 2k + at mod 2k · 2k−l ) mod 2k ) div 2k−l . As 0 < t < 2l and a is odd, t := at mod 2k is neither zero nor a multiple of 2l . This implies that t · 2k−l mod 2k ≥ 2k−l , and hence ha (x) = ha (y). Lemma 9 applied for c = 0 and c = c, respectively, yields that the edges corresponding to G0 and the edges corresponding to Gc each form a matching of size d. Imagine each of them as a set of d parallel lines in increasing order w. r. t. the indices i ∈ [d] of the edges ei (0) and ei (c), respectively. Consider e0 (c) = (ha1 (x0 (c)), ha2 (x0 (c))) and assume that xi1 (0) and x0 (c) collide under ha1 , and that xi2 (0) and x0 (c) collide under ha2 , respectively, for i1 = i2 , w. l. o. g. i1 < i2 . The following Lemma, applied for ha = ha1 , α = 0, β = c, i = i1 , and i = 0 as well as for ha = ha2 , α = 0, β = c, i = i2 , and i = 0 says that under this assumption there is a sequence of collisions between keys in G0 and Gc both with respect to ha1 and ha2 . mult Lemma 10. Let ha ∈ Hk,l , as well as offsets α, β ∈ U , and indices i, i ∈ [2l ] be arbitrary. If xi (α) and xi (β) collide under ha then xj (α) and xj (β) collide under ha for all j, j ∈ [2l ] with j − j = i − i .

The proof of Lemma 10 is a straightforward calculation and can be found in the full paper. So we have hat (xj (c)) = hat (xit +j (0)) for 0 ≤ j ≤ d−it −1, t ∈ {1, 2}, and hence the two matchings given by the edges of G0 and Gc can be merged as depicted in Fig. 3. This reveals the existence of Δ := i2 − i1 simple paths P0 , . . . , PΔ−1 in G with disjoint vertex sets. Furthermore, the total number |V1 | and |V2 | of vertices in V1 and in V2 covered by these paths is at least d − i1 , respectively.

226


Fig. 3. The Δ paths in G for e0 (c) = (ha1 (xi1 (0)), ha2 (xi2 (0)))

Let d := d/27 + 1, and Z := {(ha1 (xi1 (0)), ha2 (xi2 (0))) | i1 , i2 ∈ [d ], i1 = i2 } .

(11)

For e0 (c) ∈ Z we have just proven the existence of Δ ≤ d/27 simple paths P0 , . . . , PΔ−1 in G with disjoint vertex sets, which in total cover the vertex set V1 ⊆ V1 and V2 ⊆ V2 of size ≥ d − d/27 , respectively. We assume w. l. o. g. that S is the result of a random experiment where first c ∈ Ok , and then Rc ⊆ U − (G0 ∪ Gc ) is chosen uniformly at random. So, Pr(e0 (c) ∈ Z) =

Pr((ha1 , ha2 )(c) = (i, j))

(i,j)∈Z

1 ≥ |Z| · · 2−2l 4

2 d · 2−2l−2 ≥ 27 (1 − δ)2 ≥ . 9 · 216

(Lemma 2) ((11), Lem. 9) (d = (1 − δ)2l /3) (∗)

If e0 (c) ∈ Z and if the uniform random choice of Rc ⊆ U − (G0 ∪ Gc ) yields ≥ Δ+1 edges in V1 ×V2 , then these edges together with the edges of P0 , . . . , PΔ−1 obviously form a bad edge set. We refer to the event that choosing Rc yields ≥ Δ + 1 edges in V1 × V2 as F .

3 (1−δ) l−9 2 . Lemma 11. Pr(F | e0 (c) ∈ Z) ≥ 1 − exp − 3


227

This is proved by an application of Chernoff bounds. For the details, see the full paper. Now we complete the proof of Lemma 3 as follows. pF (S) ≥ Pr(e0 (c) ∈ Z) · Pr(F | e0 (c) ∈ Z)

3 (1 − δ) (1 − δ)2 l−9 · 1 − exp − 2 ≥ 9 · 216 3

2 3 7 7 −22 l−18 ≥ 2 2 1 − exp − 3 3 > 2−21 .

6

((∗), Lemma 11)

(δ = 1/8) (l ≥ 14)

Experiments

We implemented cuckoo hashing in a straightforward way, using the random number generator class Mersenne Twister from the colt distribution for both hash functions and key sets.1 We carried out experiments that were meant to obtain estimates of the failure probability pF by counting average failure frequencies among 5 independently and uniformly random chosen grid based sets S(c, Rc ), as considered in the proof of Theorem 1, of size (1 − δ)m, each set inserted 10 times with independently and uniformly random chosen hash functions. This was repeated several times for fixed k = 126 and δ = 0.1, and for each l ∈ {1, 2, . . . , 22}. The result is depicted in Fig. 4.

10

failures among 10 attempts

9

h(x) = (ax mod 2k ) div 2k−l ; min-average-max among 5 random grids S(c , Rd ) per l

8 7 6 5 4 3 2 1 0 6

8

10

12

14

16

18

20

22

l (k = 126 and δ = 0.1 fixed)

Fig. 4. Constant failure probability for the multiplicative class 1

http://acs.lbl.gov/˜hoschek/colt/

228


It can be seen from Fig. 4 that for a randomly chosen grid based set S and hash functions h1 , h2 chosen uniformly at random from the multiplicative class pF at least for some l appears to be much larger than the constant from Theorem 1: the bound of Theorem 1 is 2−24 , whereas we see a failure rate of 8 or 9 percent for set sizes of about one million. The deviation from this failure rate for l < 20 may to some extent be due to the small table sizes tested. We do not yet have a good explanation for the variation in the failure rate.

References 1. Carter, L., Wegman, M.N.: Universal Classes of Hash Functions. J. Comput. Syst. Sci. 18, 143–154 (1979) 2. Chor, B., Goldreich, O.: Unbiased Bits from Sources of Weak Randomness and Probabilistic Communication Complexity. SIAM J. Comput. 17, 230–261 (1988) 3. Cohen, J., Kane, D.M.: 6.856 Project: Bounds on the Independence Required for Cuckoo Hashing, http://web.mit.edu/dankane/www/Independence%20Bounds.pdf 4. Devroye, L., Morin, P.: Cuckoo Hashing: Further Analysis. Inf. Process. Lett. 86, 215–219 (2003) 5. Dietzfelbinger, M., Hagerup, T., Katajainen, J., Penttonen, M.: A Reliable Randomized Algorithm for the Closest-pair Problem. J. Algorithms 25, 19–51 (1997) 6. Dietzfelbinger, M., Schellbach, U.: On Risks of Using Cuckoo Hashing with Simple Universal Hash Classes. In: Proc. 20th Annual ACM-SIAM Symp. on Discrete Algorithms. SIAM, Philadelphia (to appear, 2009) 7. Finsler, P.: Über die Primzahlen zwischen n und 2n. Festschrift zum 60. Geburtstag von Prof. Dr. Andreas Speiser, Füssli, Zürich, 118–122 (1945) 8. Hagerup, T., Rüb, C.: A Guided Tour of Chernoff Bounds. Inf. Process. Lett. 33, 305–308 (1990) 9. Kirsch, A., Mitzenmacher, M., Wieder, U.: More Robust Hashing: Cuckoo Hashing with a Stash. In: Halperin, D., Mehlhorn, K. (eds.) Esa 2008. LNCS, vol. 5193, pp. 611–622. Springer, Heidelberg (2008) 10. Mitzenmacher, M., Vadhan, S.: Why Simple Hash Functions Work: Exploiting the Entropy in a Data Stream. In: Proc. 19th Annual ACM-SIAM Symp. on Discrete Algorithms, pp. 746–755. SIAM, Philadelphia (2008) 11. Pagh, R.: On the Cell Probe Complexity of Membership and Perfect Hashing. In: Proc. 33rd Annual Symp. on Theory of Computing, pp. 425–432. ACM Press, New York (2001) 12. Pagh, R., Rodler, F.F.: Cuckoo Hashing. In: Meyer auf der Heide, F. (ed.) ESA 2001. LNCS, vol. 2161, pp. 121–133. Springer, Heidelberg (2001) 13. Pagh, A., Pagh, R., Ruzic, M.: Linear Probing with Constant Independence. In: Proc. 39th Annual ACM Symp. on Theory of Computing, pp. 318–327. ACM Press, New York (2007) 14. Pagh, R., Rodler, F.F.: Cuckoo Hashing. J. Algorithms 51, 122–144 (2004) 15. Zuckerman, D.: Simulating BPP Using a General Weak Random Source. Algorithmica 16, 367–391 (1996)

A Framework for Mutant Genetic Generation for WS-BPEL Juan José Dom´ınguez-Jiménez, Antonia Estero-Botaro, and Inmaculada Medina-Bulo Universidad de Cádiz C/ Chile 1, 11003, Cádiz, Spain {juanjose.dominguez,antonia.estero,inmaculada.medina}@uca.es

Abstract. The rise of Web Services and their WS-BPEL compositions in recent years makes necessary to pay special attention to testing in this context. Mutation testing is a white box testing technique that has been applied successfully to programs written in different languages. In order to apply it we need a set of mutation operators and a system for mutant generation. This paper introduces a set of mutation operators for the WS-BPEL 2.0 language and a framework, based in genetic algorithms, for automatic mutant generation without rendering all possible mutants. This framework can also detect potentially equivalent mutants.

1 Introduction Advances in testing techniques are intimately linked to emerging trends in software development. One of the latest trends is marked by the emergence of so-called web services (WS). These allow rapid application development, characterized by a low cost and an easy distributed application composing [1]. The OASIS WS-BPEL 2.0 standard [2] has become the industry reference for WS compositions. This allows you to specify the logic of the service composition (messaging, synchronization, iteration, treatment of erroneous transactions, etc.) regardless of service implementation. White box testing techniques, and more specifically mutation testing [3,4], depend on the programming language used in software development. This technique can and should play an important role in defining test strategies for WS compositions. In this sense, it is necessary to develop a system that can generate mutants for WS-BPEL. For mutant generation we need a mutation operators set. To the best of our knowledge there is no work dealing with the definition of mutation operators for the WS-BPEL language. Moreover, the specific syntactical and semantical features of this language make necessary to define its own operators. One of the main drawbacks of mutation testing is the high computational cost involved. This is due to we usually generate a large number of mutants. Therefore, we think that can be interesting the application of optimization techniques, such as genetic algorithms (GA) [5], in mutant generation. This paper presents a set of mutation operators and a framework for automatic mutant generation for WS-BPEL service compositions using a GA. Our work shows a novel use of GAs when applied to mutant generation. The algorithm also detects potentially equivalent mutants. The structure of the paper is as follows: Section 2 briefly M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 229–240, 2009. c Springer-Verlag Berlin Heidelberg 2009

230

J.J. Dom´ınguez-Jiménez, A. Estero-Botaro, and I. Medina-Bulo

summarizes the characteristics of mutation testing, GAs, and the WS-BPEL language. Section 3 presents the mutation operators defined for WS-BPEL. Section 4 describes the framework for mutant generation. Section 5 summarizes the current situation regarding automatic mutant generation. Finally, Sect. 6 presents the conclusions and future work.

2 Background This section provides some background on mutation testing (Sect. 2.1), some useful concepts about GAs (Sect. 2.2), and the major characteristics of the WS-BPEL language (Sect. 2.3). 2.1 Mutation Testing Mutation testing is a white box testing technique that introduces simple flaws in the original program by applying mutation operators. The resulting programs are called mutants. Each mutation operator corresponds to an error category that the developer could make. Thus, if a program contains the instruction a > 5000 and we have a relational mutation operator (which consists in the replacement of a relational operator by another), the resulting mutant might contain the instruction a < 5000, for example. If a test case is able to distinguish between the original program and the mutant, i.e. the mutant output and the original program output are different, it is said that this test case kills the mutant. On the contrary, if no test case is able to distinguish between the mutant and the original program, it is said that the mutant keeps alive for all the test cases used. One of the main difficulties of applying mutation testing is the existence of equivalent mutants. These show the same behavior that the original program, namely the mutant output and the original program output is always the same. These mutants should not be confused with stubborn non-equivalent mutants, which are produced because the test suite is just not able to detect them. The general problem of determining if a mutant is equivalent to the original program is undecidable [6]. One of the main drawbacks of mutation testing is the high computational cost involved. This is so because we usually have a large number of mutation operators that generate a large number of mutants, each of which must be executed against the test suite until it dies. There are several strategies to reduce the high computational cost of mutation testing [4]. 2.2 Genetic Algorithms GAs are probabilistic searching techniques based on the theory of evolution and natural selection. GAs have proved to be an effective heuristic optimization strategy for functions with many local optima. Within the scope of software testing, their use has been limited to test case generation [7]. GAs work with a population of solutions, known as individuals, and process the information in parallel. Throughout the different generations of population, GAs perform

A Framework for Mutant Genetic Generation for WS-BPEL

231

a selection process and individual improvement, so they are ideal for optimization. In this sense, GAs favor the best individuals and generate new ones through the recombination and mutation of information from existing ones. The strengths of GAs are their flexibility, simplicity and ability to hybridization. Among their weaknesses are their heuristic nature and their trouble for handling restrictions. There is no single type of GA, but algorithm families that primarily differ in the encoding scheme used (binary, floating point, permutation, . . . ), and how the population is renewed in each generation (generational, permanent state, fine-grained parallelism, . . . ). The encoding scheme used is highly dependant on the problem to solve. Each individual will have a fitness that represents the quality of the solution with respect to the problem to solve. The individual fitness will be maximized along the different generations produced by the algorithm. GAs use two types of operators: selection and reproduction. Selection operators select individuals in a population for reproduction. This selection can be proportionate or not to fitness. Reproduction operators generate the new individuals in the population. We can distinguish two types: crossover and mutation. The crossover operator generates two new individuals, called children, from two pre-selected individuals or parents. The children inherit part of the information stored in both parents. The mutation operator aims to alter the information stored in an individual. The design of these operators heavily depends on the encoding scheme used. 2.3 The WS-BPEL Language WS-BPEL is an XML-based language which allows to specify the behavior of a business process based in its interactions with other WS. The structure of a WS-BPEL process is divided in four sections: 1. Declaration of relationships to external partners, the client invoking the business process and the WS invoked by the process. 2. Declaration of the variables used by the process. 3. Declaration of different types of handlers that the process can use: fault and event handlers. Fault handlers specify the activities to be executed when an internal fault occurs, or when an invoked WS fails. Event handlers specify the activities to be executed when the business process receives a request during its execution. 4. Description of the business process behavior; this can be made by means of the activities provided by the WS-BPEL language. All the elements we have defined above are global if they are declared within the process. Nevertheless, they can be declared in a local way through the scope container. The scope allows to divide up the business process in different portions. The major building blocks of a WS-BPEL process are activities. There are two types: basic and structured activities. Basic activities only perform one purpose (reception of a message from a partner, sending a message to a partner, . . . ). Structured activities define the business logic and can contain another activities. Activities may have both attributes and a set of containers. These containers can include elements with their own attributes also. We can see an example:

232


← Structured activity ← Container ← Element ← Basic activity <sources> ← Container <source linkName="checkFlight-To-BookFlight" ← Attribute /> ← Element ← Container ← Element

WS-BPEL provides concurrency and synchronization between activities. An example is the flow activity which throws a set of activities in parallel and allows to specify the synchronization conditions between them. In the above example we can see a flow activity that invokes three WS in parallel, checkFlight, checkHotel, and checkRentCar, moreover there is another WS, bookFlight, that only will be invoked if checkFlight is completed. This synchronization between activities is achieved by establishing a link, so the target activity of the link will only be executed if the source activity of the link has been completed.

3 Mutation Operators This section describes the mutation operators defined for WS-BPEL. These operators have been classified in four categories on the basis of the type of the WS-BPEL syntactic element with which they are related to. The categories are identified by an upper case letter and they are the following: Identifier replacement operators (I), Expression operators (E), Activity operators (A), and Exception and Event operators (X). Several mutation operators are defined within each category, which are identified by three uppercase letters: the first one is the category identifier, whereas the last two letters identify the operator within the category. Table 1 shows the name and a short description of each proposed operator. A more detailed description of these operators can be seen in [12]. The operators defined model mistakes that programmers can make when implementing a WS-BPEL composition. We have assumed that programmers usually do not write WS-BPEL code directly but with the help of graphical tools. Accordingly, many faults which are common in other languages when writing code by hand will not appear in WS-BPEL programs. For this reason, for example, it has not been defined an operator for inserting the unary minus operator in front of an expression, whereas this is considered for other languages [8,9,10,11]. Some operators are specific for the WS-BPEL language, while others have been adapted from other languages, for example the ISV operator [8,9,10,11]. These operators appear marked with ✩ in Table 1.


233

Table 1. Mutation Operators for WS-BPEL 2.0 OPERATOR ✩

ISV

✩ ✩ ✩ ✩

EAA EEU ERR ELL ECC ECN

✩

EMD EMF

ACI AFP ASF AIS ✩ ✩ ✩

AIE AWR AJC ASI APM APA XMF XRF XMC XMT XTF XER XEE

DESCRIPTION I DENTIFIER M UTATION Replaces a variable identifier by another of the same type E XPRESSION M UTATION Replaces an arithmetic operator (+, -, *, div, mod) by another of the same type Removes the unary minus operator from an expression Replaces a relational operator (, >=, 5000 <elseif> $buy > 2500 <else>

ERR Operator = 2 AIE Operator = 2 ECN Operator = 2

235

4.2 Mutant Generator The mutant generator is based on a GA in which each individual represents a mutant. We turn now to describe several aspects of the algorithm. Representation of an Individual. Each individual encodes one mutation on the original program. An individual has three fields (Fig. 2): one to identify the operator, another for referencing the instruction to it will apply, and a third containing information for applying the mutation operator. The field Operator identifies the mutation operator to be applied. It is encoded by an integer value from 1 to 26, the number of mutation operators defined. The field Instruction represents the instruction number of the original program where the operator will be applied. It is also encoded by an integer value. To make an even distribution among all operators regardless of the number of instructions associated with each one, the field is encoded by an integer value from 1 to I, where I = mcm{mi | 1 ≤ i ≤ 26}, where mi is the number of instructions in the original program to which the i-th mutation operator can be applied. Subsequently, it is necessary to do a translation to obtain the instruction number where the mutation operator is applied. Thus, if Ii is the value of the field Instruction i for an individual, this represents the instruction Ii ·m I . For example, consider that we have two mutation operators, with 2 and 3 instructions to which they can be applied, respectively. The maximum value of this field is I = mcm{2, 3} = 6. If this field has a value of 4, it represents a change in the instruction 4·2 6 = 2 where the mutation operator can be applied. Note that half of the cases, from 1 to 3, applies to the first instruction, and the other half, from 4 to 6, applies to the second instruction. The field Attribute is encoded by an integer. This represents the new value to be taken by the instruction element to be modified by the mutation operator (the field Operator). The range of possible values depends on the mutation operator. Table 2 Operator Instruction Attribute

Fig. 2. Representation of an individual

236

J.J. Dom´ınguez-Jiménez, A. Estero-Botaro, and I. Medina-Bulo Table 2. Values and attributes for WS-BPEL 2.0 mutation operators

Operator Value ISV 1 EAA 2 EEU 3 ERR 4 ELL 5 ECC 6 ECN 7 EMD 8 EMF 9 ACI 10 AFP 11 ASF 12 AIS 13

Max. Value of Attribute N 5 1 6 2 2 4 2 2 1 1 1 1

+, -, *, div, mod , >=, $buy > 2500 <else>

$buy > 5000

<else>


237

Fitness of the Individuals. To calculate the individual fitness (step M2 in Fig. 1), the mutant is executed on the test cases until one kills it. Upon completion of the execution of all mutants, we will have a matrix as follows: ⎛ ⎞ 0 0 1 ... 0 ⎜1 0 0 . . . 0 ⎟ ⎟ (mij )M×T = ⎜ (1) ⎝ . . . . . . . . . .⎠ 0 0 0 ... 0 where mij is 1 or 0, depending on whether the i-th mutant has been killed or not by the j-th test case, M represents the maximum number of mutants and T the maximum number of test cases at our disposal. The following relationships are established: – A mutant can be killed by a test case or continue alive, – A test case can kill zero or more mutants,

M i=1

T j=1

mij ∈ [0, 1], for all i.

mij ∈ [0, M ], for all j.

The individual fitness function will take into account which a mutant is killed or not by a test case, and how many mutants are also killed by the same test case. Thus, the fitness for individual I is given by:

T M mij mIj · (2) Fitness(I) = M − j=1

i=1

This function tries to penalize those mutant groups that are killed by the same test case. On the contrary, the function benefits to those mutants that only are killed by a test case, and therefore, they are difficult to kill. However, when a mutant is not killed by any test case, i.e. it is not detected (its fitness is M ), it will be stored in a memory of the algorithm (step M3 in Fig. 1). Thus, this memory contains the potentially equivalent mutants. Generations. The first population of the GA will be randomly generated (step M1 in Fig. 1). The population size is an input parameter of the algorithm. The generator is based on a generational GA where individuals of the next generations come from: – Individuals from the previous generation. To achieve this, the algorithm will have an input parameter, percentage of repeaters, which determines how many mutants of the previous generation will pass to the new one. This selection is done via elitism, so that those individuals with better fitness are chosen (step M4 in Fig. 1). – Individuals from crossover and mutation operations. The selection of individuals involved in the operations is done through the roulette wheel [13]. The crossover or mutation operations will be done exclusively according to the probabilities of these operations, pc and pm respectively, which keep the following rule pm = 1 − pc , where pm is an input parameter of the algorithm.

238


Genetic Operators. In order to generate new individuals (step M5 in Fig. 1) the GA applies the two genetic operators: crossover and mutation. The crossover operator consists in an exchange of fields of the individuals involved. The crossover point is chosen randomly between the fields of the individuals. Figure 3 represents the different possibilities for a cross between two individual parents to generate two children, according to the crossover point selected. Crossover point Individual 1 Operator1

Instruction1 Attribute1

Individual 2 Operator2

Instruction2 Attributte2

CROSSOVER

Operator1 Instruction2 Attribute2 Child 1

Operator2

Instruction1 Attribute1 Child 2

Operator1

Instruction1 Attributte2 Child 1

Crossover point Individual 1 Operator1

Instruction1 Attribute1

CROSSOVER

Individual 2 Operator2 Instruction2 Attribute2

Operator2 Instruction2 Attribute1 Child 2

Fig. 3. Crossover operator

The mutation operator changes the value of a field of the individual. Thus, there are 3 types of mutation operators, depending on the field where they apply. Since the three mutations change elements encoded as integers, the mutation operation consists in applying a Gaussian perturbation to the value of the individual selected. Thus, if the value α is selected, the resulting mutation β will be: β = α + N (0, θ)

(mod L)

(3)

Note that the perturbation consists in adding a zero mean normal. The magnitude of the perturbation is controlled through the standard deviation θ, whose value remains constant throughout the execution of the algorithm. This magnitude is related to the probability of mutation pm . Thus, if mutations are very frequent, the magnitude decreases, and vice versa. Mathematically, θ = 1 − pm . The operation is carried out module L, where L is the maximum value that the attribute can reach. This guarantees that the resulting values always are within the limits. Termination. The GA will stop when the maximum number of generations, a parameter of the algorithm, is reached.

5 Related Works There are several works in the literature dealing with tool development for automatic mutant generation such as Mothra [9] for Fortran, MuJava [14] for Java, Proteum [15] for C, and SQLMutation [11] for SQL. These papers include the definition of a set of mutation operators for the language. These tools generate all the possible mutants for the mutation operators supplied.


239

The application of GAs to software testing goes back to Bottaci [16]. Since then, numerous applications [7] have arisen, although most of them have been limited to test case generation. Regarding the application of GAs to mutant generation, there are few references. Only Adamopoulos et al. [17] describe a system for generating mutants and test cases using a GA in combination with Mothra. In this system, the individuals of the GA are mutant sets previously generated by Mothra, unlike our work, where mutants are generated automatically with our GA. Our work, like the other also reviewed, defines a set of mutation operators but it is the first dealing with the WS-BPEL language. We also propose a framework for automatic mutant generation for WS-BPEL. This generator, due to the characteristic of GA, does not generate all the possible mutants, but only a subset of them selected by the fitness function. Moreover, previous tools do not detect automatically equivalent mutants, but the tester identifies equivalent mutants by manually comparing the mutated code to the original one, while our generator detects potential equivalent mutants automatically.

6 Conclusions and Future Work Emerging trends in software development, as WS and their compositions, make necessary to develop new tools for testing in this context. In this sense, this paper introduces the use of GAs for mutant generation in WS-BPEL compositions. This paper makes two main contributions. On the one hand, it has been defined a set of mutation operators for WS-BPEL language which models mistakes that programmers can make when implementing a WS-BPEL composition. On the other hand, it has been designed a framework for automatic mutant generation for this language. This framework shows a novel use of GAs when applied to mutant generation. An important feature of the designed framework, related to GAs nature, is it does not render all the possible mutants for a composition. Our GA generates an subset of possible mutants selected by the fitness function. This is an interesting feature because one of the main difficults to apply mutation testing is the high computational cost involved in the execution of all the mutants against the test suite. The secondary objective of the framework is to detect potentially equivalent mutants. Usually, the detection of equivalent mutants has been done manually, unlike our generator, which automatically detects potentially equivalent mutants. Our work is now focused on the first tests with WS-BPEL. A line of future work will complement the framework adding a test case generator. This generator will obtain new test cases for detecting and differentiating between equivalent and stubborn nonequivalent mutants. The new test cases will also allow to enhance the quality of the initial test suite.

Acknowledgments This paper has been funded by the Ministry of Education and Science (Spain) and FEDER (Europe) under the National Program for Research, Development and Innovation, Project SOAQSim (TIN2007-67843-C06-04).

240


References 1. Papazoglou, M.: Web services technologies and standards. Computing Surveys (submitted) 2. OASIS: Web services business process execution language 2.0 (2007), http://docs.oasis-open.org/wsbpel/2.0/OS/wsbpel-v2.0-OS.html 3. Woodward, M.R.: Mutation testing —its origin and evolution. Information and Software Technology 35(3), 163–169 (1993) 4. Offutt, J., Untch, R.H.: Mutation 2000: uniting the orthogonal. In: Mutation testing for the new century, pp. 34–44. Kluwer Academic Publishers, Norwell (2001) 5. Michalewicz, Z.: Genetic algorithms + data structures = Evolution programs. Springer, Heidelberg (1992) 6. Zhu, H., Hall, P., May, J.: Software unit test coverage and adequacy. ACM Computing Surveys 29(4), 366–427 (1997) 7. Mantere, T., Alander, J.T.: Evolutionary software engineering, a review. Applied Soft Computing 5(3), 315–331 (2005) 8. Agrawal, H., Demillo, R., Hathaway, R., Hsu, W., Hsu, W., Krauser, E., Martin, R.J., Mathur, A., Spafford, E.: Design of mutant operators for the C programming language. Tech. Rep. SERC-TR-41-P (1989) 9. King, K.N., Offutt, J.: A Fortran language system for mutation-based software testing. Software - Practice and Experience 21(7), 685–718 (1991) 10. Offutt, J., Voas, J., Payne, J.: Mutation operators for Ada. Tech. Rep. ISSE-TR-96-09 (1996) 11. Tuya, J., Suárez-Cabal, M.J., de la Riva, C.: Mutating database queries. Information and Software Technology 49(4), 398–417 (2007) 12. Estero Botaro, A., Palomo Lozano, F., Medina Bulo, I.: Mutation operators for WS-BPEL 2.0. In: ICSSEA 2008: Proceedings of the 21th International Conference on Software & Systems Engineering and their Applications, Paris, France (to be published) (December 2008) 13. Goldberg, D.E.: Genetic algorithms in search, optimization and machine learning. AddisonWesley, Reading (1989) 14. Ma, Y.S., Offutt, J., Kwon, Y.R.: Mujava: an automated class mutation system. Software Testing, Verification & Reliability 15(2), 97–133 (2005) 15. Delamaro, M., Maldonado, J.: Proteum–a tool for the assessment of test adequacy for C programs. In: Proceedings of the Conference on Performability in Computing System (PCS 1996), pp. 79–95 (1996) 16. Bottaci, L.: Instrumenting programs with flag variables for test data search by genetic algorithms. In: GECCO 2002: Proceedings of the Genetic and Evolutionary Computation Conference, pp. 1337–1342 (2002) 17. Adamopoulos, K., Harman, M., Hierons, R.M.: How to overcome the equivalent mutant problem and achieve tailored selective mutation using co-evolution. In: Deb, K., et al. (eds.) GECCO 2004. LNCS, vol. 3103, pp. 1338–1349. Springer, Heidelberg (2004)

Implementing Services by Partial State Machines Walter Dosch and Annette St¨ umpel Institute of Software Technology and Programming Languages University of L¨ ubeck, L¨ ubeck, Germany {dosch,stuempel}@isp.uni-luebeck.de http://www.isp.uni-luebeck.de

Abstract. In the service-oriented approach to software engineering, interactive components offer contracted services through public interfaces. Over time a component receives a stream of service requests and generates a stream of responses. In general, a component is only prepared to serve a subset of possible requests in each situation — services are partial behaviours. On the specification level, we model services by stream functions defined on a restricted service domain. For the state-based implementation of services we introduce partial state machines. We present a transformation how to systematically implement a service by a partial state machine. The transformation exploits history abstractions to relate service histories with machine states. We illustrate the formal method with three characteristic applications, viz. an interactive stack, a bounded buffer and a server with registration.

1

Introduction

Modern software systems are composed of software components which provide contracted services through public interfaces. The components process in a concurrent way coordinated by service requests and responses. The overall system evolves by an ongoing interaction [19] between the components and the environment. Software architectures like client-server architectures or layered architectures emphasize the static structure of component-based systems [1] . Service-oriented descriptions of software systems [14] center around the functions which are provided by the system’s components through application programming interfaces. The service-oriented approach to software engineering focuses on how to combine a contracted system function from the services provided by the components. Middleware technologies base the implementation of system functions on the services supplied by software infrastructures like object request brokers such as CORBA, DCOM or COM+. Web services [2] employ service request brokers. The connection technology uses, for example, remote method invocation or remote procedure call. A service is often involved in complex conversations rather than closed requestresponse message exchanges. In general, a service will not capture the complete behaviour of a component for all possible requests in all possible situations. Rather a service will characterize the reaction of the component on a subset of possible input histories. Services describe partial behaviours [6] as a service M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 241–254, 2009. c Springer-Verlag Berlin Heidelberg 2009

242

W. Dosch and A. St¨ umpel

guarantees the contracted response only if the input history validates developerspecified assumptions [5,16] . Service components should be endowed with a well documented service domain which characterizes the subset of acceptable requests. For example, a library service can serve the request for an online article only if the customer registered before. A warehouse service cannot accept an order if the sum of the previously selected goods in the cart remains under a minimum value. Service domains support the separation of concerns when specifying and implementing services. In the first step, the software engineer might concentrate on the intended service offered for well-formed input histories. In a second design step, the service domain can be extended making deliberate design decisions about the response to be generated for unexpected input histories. Considering complex systems in reality, the complete input/output behaviour of all components will not be known at a time, since components change dynamically and are often not well documented. In spite of incomplete information, a software engineer needs to infer a system view from the services of the components without having complete information. Given this general background, the paper contributes to an emerging engineering theory of services in the setting of component-based untimed systems with asynchronous communication. We present a formal method how to implement a service by a partial state machine in a correct way. The transformation employs history abstractions which relate service histories to machine states. The present paper generalizes our previous transformations [11,12] to partial behaviours. In the external view [7] , a service relates the input history of requests to the output history of responses. A service is modelled by a partial stream function mapping input streams from the service domain to output streams. This functional model of services abstracts from the component’s internal state. A service is implemented by a partial state machine. In each state, the machine is prepared to handle a subset of possible requests. The machine processes the requests message by message. In each transition, the internal state is updated and output is generated. The implementation of services by partial state machines supports an incremental software development process. In the classical approach, the component’s input/output behaviour has to be specified for all input histories before designing an abstract implementation. Our transformation implements a service as a partial behaviour by a partial state machine. This allows to postpone design decisions about the service provision for unexpected input. The paper is organized as follows. Section 2 summarizes the basic notions about streams, introduces service domains as prefix-closed subsets of input histories, and formalizes services as monotonic stream functions on service domains. Section 3 describes partial state machines whose transition functions are restricted to a readiness set. Then we implement services by partial state machines using history abstractions. Section 4 illustrates the transformation for three characteristic services provided by an interactive stack, an interactive bounded buffer,

Implementing Services by Partial State Machines

243

and a server with registration for clients. The conclusion surveys the approach and outlines future work.

2

Services

First we summarize the basic notions about streams referring to [15] for a survey and to [18] for a comprehensive treatment. Then we introduce services as stream functions defined on a service domain of well-formed request streams. 2.1

Streams

We abstract from the coding of messages such as XML or some proprietary format assuming a basic alphabet A = ∅ of messages not specified further. A stream models the communication history of a directed channel by the sequence of messages transmitted. Given an alphabet A , a (communication) history, for short a stream, X = x1 , . . . , xk of length |X| = k is a finite sequence of messages xi ∈ A (i ∈ [1, k] , k ≥ 0) . A denotes the set of all streams, A+ the subset of all non-empty streams, and ≤k A the subset of all streams up to length k ∈ IN . As a notational convention, messages are denoted by small letters, whereas streams start with capital letters. The concatenation X & Y of a stream X = x1 , . . . , xk with a stream Y = y1 , . . . , yl over the same alphabet yields the stream x1 , . . . , xk , y1 , . . . , yl . Given a composite stream Y = X & R , the subtraction Y X of the initial segment X from its extension Y yields the final segment R . For a subset S ⊆ A , the filter operation X||S forms the substream of X which consists of those elements belonging to S . Operational progress is modelled by the prefix relation on streams — the longer stream forms an extension of the shorter history. A stream X ∈ A is called a prefix of a stream Y ∈ A , denoted X Y , iff there is a stream R ∈ A with X & R = Y . The partial order (A , ) can be completed with infinite streams as limit points [17] . 2.2

Service Domains

A service describes the function offered by an interactive component in a networked computer system. In general, a service is not designed to work in an arbitrary environment. Rather a service delivers the contracted responses only for a subset of possible input streams which validate certain constraints. A service domain ServDom over an alphabet A is a non-empty and prefix closed subset of input histories from A . The empty stream is the least element of each service domain. If an interactive component serves a combined input history X & Y ∈ A , it also serves the initial part X ∈ A of that input history. The set of all service domains over a fixed alphabet A forms a complete lattice under set inclusion with {} as smallest and A as greatest elements. The notion of a ‘service domain’ introduced so far also captures the situation where we have incomplete information about the component’s behaviour.

244

2.3


Services as Stream Functions

An interactive component provides a service to the environment: it accepts messages from its input channel and sends messages on its output channel. The incoming messages are called service requests, the outgoing messages service responses. The syntactic interface of a service is determined by the types of the input and of the output messages. We assume that all service requests are received on a single input channel, and all service responses are provided to a single output channel. A component may serve different processes, if their service requests are merged into a single stream, and the responses are distributed accordingly. Given a service domain ServDom over the input alphabet In , a service serv : ServDom → Out with interface In Out is a strict and prefix monotonic stream function. Formally, we require serv () = and serv (X) serv (X & Y ) whenever X & Y ∈ ServDom . A service provides output only in response to input. Moreover, additional input cannot change, but only prolong the previous output. Services can be combined in a natural way under serial composition, parallel composition and feedback taking the service domains into account. The combination of services into composite services employs functional operations such as function composition, tuple concatenation, and least fixpoints.

3

Partial State Machines for Services

A specified service can be implemented by an abstract machine which processes the requests message by message. In each step, the machine consumes one input message and emits a (possibly empty) segment of output messages while updating its internal state. 3.1

Partial State Machines

A partial state machine is an abstract device designed for implementing services. Constituents. A partial state machine is prepared to process a subset of possible input histories in each state. A partial state machine M = (State, In, Out, Ready, next, out, init ) consists of a set State of states, an input alphabet In , an output alphabet Out , a readiness set Ready ⊆ State×In , a (single-step) next state function next : Ready → State , a single-step output function out : Ready → Out , and an initial state init ∈ State . Partial state machines generalize classical Mealy machines to meet the particular requirements of services. Comparison. Mealy machines [8] and related machines [3,4] have already been proposed for modelling services. Fig. 1 summarizes the essential differences between classical Mealy machines and partial state machines.


input alphabet output alphabet state space input/output ratio transition functions

245

Mealy machines partial state machines finite arbitrary finite arbitrary finite arbitrary 1 to 1 1 to many total partial

Fig. 1. Comparing Mealy machines and partial state machines

Partial state machines overcome the restrictions of finite sets — the conceptual modelling of services requires infinite alphabets and infinite state spaces. A service may respond to a request with any finite number of outputs, in particular even no outputs at all. Hence partial state machines must overcome the regular input/output ratio. Their output function delivers an entire segment of output messages — not just a single output message. Mealy machines favor total transition functions. Partial state machines implement services with a restricted service domain. Hence their transition functions are defined only on a common subset of pairs (state, input). Processing Domain. The processing domain describes the subset of all input histories which can be processed by the partial state machine starting in a given state. The processing domain ProcDom : State → P(In ) associates with a start state the subset of accepted input streams: ∈ ProcDom(p)

(1)

(p, a) ∈ Ready ∧ X ∈ ProcDom(next(p, a)) ⇒ a & X ∈ ProcDom(p) (2) The empty stream belongs to every processing domain (1) . A non-empty stream belongs to the processing domain, if the first message belongs to the readiness set of the current state and the remainder stream belongs to the processing domain of the successor state (2) . We establish a first relationship between service behaviour and state-based implementation. Proposition. For each state, the processing domain of a partial state machine forms a service domain over the machine’s input alphabet. Processing Input Streams. When processing an input stream from the processing domain, the partial state machine visits a sequence of states and generates an output stream. The multi-step transition functions determine the final state and the accumulated output. The (multi-step) state transition function next : State p → [ProcDom(p) → State] yields the final state reached from a start state p by processing an input stream (a & X ∈ ProcDom(p)) :

246


next (p)() = p next (p)(a & X) = next (next (p, a))(X)

(3) (4)

The (multi-step) output function out : State p → [ProcDom(p) → Out ] concatenates the output segments generated by the messages of the input stream (a & X ∈ ProcDom(p)) : out (p)() = out (p)(a & X) = out(p, a) & out (next(p, a))(X)

(5) (6)

The processing domain and the multi-step transition functions cooperate with concatenation. This establishes the second technical result. Proposition. The multi-step output function of a partial state machine forms a service for all states, in particular for the initial state. The services modelled by partial state machines can be combined by composing their multi-step output functions, compare Subsection 2.3 . 3.2

History Abstractions

We aim at implementing a specified service by a partial state machine in a correctness preserving way. This refinement step requires a design decision about the state space. History abstractions map the input histories of a service domain to the state of a partial state machine reached after processing the input history. We conceive of machine states as congruence classes of input histories which generate the same output streams for all possible prolongations. A function abstr : ServDom → State is called a history abstraction for the service serv : ServDom → Out , if it is service compatible (7) , transition closed (8) , and output compatible (9) . Whenever abstr (X) = abstr (Y ) holds, then we have: X & x ∈ ServDom ⇔ Y & x ∈ ServDom

(7)

X & x ∈ ServDom ⇒ abstr (X & x) = abstr (Y & x) (8) X & x ∈ ServDom ⇒ serv (X &x)serv (X) = serv (Y &x)serv(Y ) (9) These requirements ensure that the identification of input histories as states is compatible with the service domain and with the transition functions of the constructed partial state machine. 3.3

Constructing an Implementation

Given a service domain ServDom over an alphabet In , a service serv : ServDom → Out , and a corresponding history abstraction abstr : ServDom → State , we construct the partial state machine M[serv , abstr ] shown in Fig. 2.

Implementing Services by Partial State Machines M[serv , abstr ]

= init (abstr (X), a) ∈ Ready next (abstr (X), a) out (abstr (X), a)

247

(State, In, Out , Ready , next , out , init) = abstr () (2.1) ⇔ X & a ∈ ServDom (2.2) = abstr (X & a) (2.3) = serv (X & a) serv (X) (2.4)

Fig. 2. Implementing a service by a partial state machine using a history abstraction

The initial state is the abstraction of the empty input history (2.1). The service domain determines the readiness set (2.2). The successor state is the abstraction of the extended input history (2.3). The output function yields the additional output of the service stemming from the extended input history (2.4) . The three conditions of the history abstraction guarantee that the readiness set and the transition functions are well defined on the subset abstr (ServDom) of states reachable from the initial state. We refrain from defining transitions on unreachable states. With this construction we arrived at the main result of this paper. Theorem. Given a service serv : ServDom → Out with service domain ServDom over an alphabet In and a history abstraction abstr : ServDom → State , the partial state machine M[serv , abstr ] from Fig. 2 correctly implements the service: ServDom = ProcDom(init )

(10)

serv = out (init )

(11)

In summary, every service can be implemented by a partial state machine. The major design decision amounts to choosing an appropriate state space. Selecting the identity function on the service domain as history abstraction, we obtain the canonical state machine M[serv , id ] whose states comprise exactly the input histories of the service domain.

4

Applications

In the sequel, we illustrate the formal method with three simple, yet characteristic applications. The first case study exemplifies the basic concepts of service specification and service implementation using an interactive stack. The interactive stack illustrates a class of service components where the underlying abstract data type possesses a partial operation which is undefined for certain arguments [20] . The second case study treats an interactive bounded buffer to illustrate components with internal resource bounds. We introduce a size parameter and use dependent types to specify and implement the buffer service in a fully parameterized way. The third application studies the service of an interactive server in a clientserver interaction. The service domain results from the interleaving of repeatedly

248


executed sequential conversations with client processes. The interactive server illustrates a frequent class of services which process interleaved input streams from different sources. 4.1

Interactive Stack

An interactive stack is a communicating memory component which provides the service of a stack storing elements in a last-in/first-out way. The stack component processes push and pop commands as service requests. A push command stores a datum and produces no output. A pop command requests the datum stored most recently which has not been requested so far. Interface. We assume a data type Data = ∅ of elements to be stored. The input alphabet In = {pop} ∪ push(Data) comprises pop commands and push commands together with the datum to be stored. The output alphabet Out is simply Data . The notation push(Data) denotes the set {push(d) | d ∈ Data} . Service Domain. The service domain of an interactive stack consists of all input histories whose processing leads to no stack underflow. Such an underflow occurs when a pop command meets an empty internal stack. The service domain ServDom ⊆ In is defined as the least subset of input streams with the following two properties (Push ∈ push(Data) ) : push(Data) ⊆ ServDom Push & X ∈ ServDom ⇒ Push & push(d), pop & X ∈ ServDom

(12) (13)

Any sequence of push commands belongs to the service domain (12) . A service history can be extended by inserting a pair of a push and pop command after an initial sequence of push commands (13) . Service. The stream function stack : ServDom → Data describes the stack service (Push ∈ push(Data) ) : stack (Push) = stack (Push & push(d), pop & X) = d & stack (Push & X)

(14) (15)

Equations (14) and (15) form a complete pattern for input histories from the service domain. Implementation. We implement the stack service with a partial state machine holding a sequence of data elements in its state space State = Data . The history abstraction abstr : ServDom → State yields the state after processing the input history from the service domain (Push ∈ push(Data) ) : abstr (push(d1 ), . . . , push(dk )) = d1 , . . . , dk abstr (Push & push(d), pop & X) = abstr (Push & X)

(16) (17)

Service histories with a pop command are successively simplified (17) until the resulting sequence of push commands represents the internal state (16) .

Implementing Services by Partial State Machines State D D & d

In push(d) pop

State D & d D initial state

249

Out d

Fig. 3. Partial state machine M[stack , abstr ] implementing the stack service

Following Subsection 3.3, we construct the partial state machine M[stack , abstr ] implementing the stack service, compare Fig. 3 . The transition table tabulates the state transition function and the output function. The first two columns list the legal combinations of states and inputs. This records the readiness set Ready = Data × push(Data) ∪ Data + × {pop} . Characteristically, neither the service specification (14)-(15) nor the service implementation (Fig. 3) cover the combination of an unexpected pop command. In a subsequent design step, the service can be extended to input histories outside the service domain heading, for example, for a fault-sensitive stack, a faulttolerant stack, or a fault-correcting stack [9] . 4.2

Bounded Buffer

Services are often implemented by components with an internal memory of bounded capacity. The component provides the contracted service as long as there is no storage overflow. In this sequel, we study the service of a bounded buffer as an example how to construct a partial state machine parameterized with resource bounds. Interface. A bounded buffer is an interactive component which stores elements of data type Data = ∅ under the first-in/first-out regime. The input alphabet In = enq(Data) ∪ {deq} comprises enter-queue commands to store a datum, and de-queue commands to retrieve the datum entered earliest, but not requested so far. The output alphabet Out is the data type Data . Service Domain. We specify the service of bounded buffers of different capacities in a uniform way introducing the length n ∈ IP = {1, 2, . . .} of the internal buffer as a parameter. The buffer service assumes that a de-queue command applied to the empty internal buffer shows no effect. The service domain ServDom : IP → P(In ) of an interactive bounded queue with capacity n ∈ IP is the least set with the following properties (Enq k ∈ (enq(Data))≤k ) : Enq n ∈ ServDom(n)

(18)

Enq n−1 &X ∈ ServDom(n) ⇒ enq(d)&Enq n−1 &deq&X ∈ ServDom(n) (19) X ∈ ServDom(n) ⇒ deq & X ∈ ServDom(n) (20) A sequence of enter-queue commands belongs to the service domain if its length does not exceed the buffer capacity (18) . A service history can be extended by inserting a pair of an enter-queue and a de-queue command after an initial

250

W. Dosch and A. St¨ umpel State(n) Dn−1 d & Dn−1

In enq(d) deq deq

State(n) Dn−1 & d Dn−1 initial state

Out d

Fig. 4. Partial state machine M[buffer (n), abstr (n)] implementing the service of a bounded buffer with capacity n ∈ IP (Dk ∈ Data ≤k )

segment of enter-queue commands provided the internal buffer has free capacity (19) . A service history can be prolonged by prefixing a de-queue command (20) . A bounded buffer with a larger capacity allows for a larger service domain. We have m < n iff ServDom(m) ⊂ ServDom(n) . Service. The service buffer : IP n → [ServDom(n) → Data ] of a bounded buffer is specified by the following equations (Enq k ∈ (enq(Data))≤k ) : buffer (n)(Enq n ) =

(21)

buffer (n)(enq(d) & Enq n−1 & deq&X) = d & buffer (n)(Enq n−1 & X) (22) buffer(n)(deq & X) = buffer (n)(X) (23) A sequence of at most n enter-queue commands generates no output (21) . Similarly, an initial de-queue command generates no output (23) . A de-queue command after a non-empty sequence of at most n enter-queue commands outputs the datum entered earliest (22) . Implementation. The buffer service buffer (n) is implemented by a partial state machine whose state space State(n) = Data ≤n stores at most n data elements (n ∈ IP) . The history abstraction abstr : IP n → [ServDom(n) → State(n)] yields the internal buffer after having processed a service history (m ≤ n, Enq k ∈ (enq(Data))≤k ) : abstr (n)(enq (d1 ), . . . , enq(dm )) = d1 , . . . , dm

(24)

abstr (n)(enq (d) & Enq n−1 & deq & X) = abstr (n)(Enq n−1 & X) (25) abstr (n)(deq & X) = abstr (n)(X) (26) An initial de-queue command shows no effect (26) , whereas service histories with a preceding enter-queue command are successively simplified (25) to a resulting enter-queue history which determines the state (24) . Following Subsection 3.3, we implement the service buffer (n) of the bounded buffer by the partial state machine M[buffer (n), abstr (n)] shown in Fig. 4 . The first two columns of the state transition table reflect the readiness set Ready(n) = Data n × {deq} ∪ Data ≤(n−1) × In which depends on the buffer capacity as well. The specification (21)-(23) and the implementation (Fig. 4) of the buffer service do not capture an overflow when an enter-queue commands meets a full


251

internal buffer. In subsequent refinement steps, the regular service of a bounded buffer can be extended to input histories outside the service domain [13] . 4.3

Server with Registration

The final case study models a simplified client-server application to illustrate the paradigm of interleaved service conversations. A server offers its services to a collection of clients. The server receives requests from different clients in an interleaved way. The server processes all requests in the order as they were received. Interface. The collection of clients is described by a non-empty set Client = ∅ . The input alphabet In = register (Client ) ∪ query(Client ) ∪ deregister (Client ) of the server accepts the registration of a client, queries from a client, and the deregistration of a client. The server responds with the output alphabet Out = welcome(Client ) ∪ answer (Client ) to welcome a client and to answer the query of a client. We assume that the clients’ queries do not change the state of the server. Service Domain. In a successful client-server interaction, the client will first register with the server, then repeatedly send queries, and finally deregister with the server. Every client c ∈ Client repeatedly performs an interaction process, also called service conversation: Process(c) = register (c) & query(c) & deregister (c)

(27)

The service domain ServDom of the server comprises all input histories that arise from interleaving the interaction processes of different clients. We have X ∈ ServDom iff for all c ∈ Client : X || {register(c), query(c), deregister (c)} Process(c)

(28)

The subsequence of input messages stemming from one client must be a prefix of the iterated interaction process the client can perform. The service domain excludes many irregular input histories which would complicate the specification of the intended service. Service. The service server : ServDom → Out offered by the server to the collection of clients is specified using an auxiliary function serverAll : In → Out which processes arbitrary input streams message by message: serverAll () = serverAll (register (c) & X) = welcome(c) & serverAll (X) serverAll (query(c) & X) = answer (c) & serverAll (X) serverAll (deregister (c) & X) = serverAll (X)

(29) (30) (31) (32)

The registration of a client is acknowledged with a welcome command (30) , and the query of a client is served with an answer (31) .

252

W. Dosch and A. St¨ umpel Precondition State In State Out c ∈ C C register (c) C ∪ {c} welcome(c) c∈C C query (c) C answer (c) c∈C C deregister (c) C \ {c} ∅ initial state Fig. 5. Partial state machine M[server , active] implementing the server

We employ the generalization server (X) = serverAll (X) , since the service server can handle input histories from the service domain alone, but not their rear parts which may lie outside the service domain. Implementation. We implement the server by a partial state machine whose state space State = {C ⊆ Client | C finite} memorizes the finite set of active clients. The history abstraction active : ServDom → State yields the finite set of registered clients after processing a service history: active() = ∅

(33)

active(X & register (c)) = active(X) ∪ {c} active(X & query(c)) = active(X)

(34) (35)

active(X & deregister (c)) = active(X) \ {c}

(36)

Following Subsection 3.3 , we implement the server by a partial state machine M[server , active] shown in Fig. 5 . The predicates in the precondition document the readiness set of the server. The predicates are continuously satisfied when processing input streams from the service domain. The service domain can be extended to malformed input histories by eliminating the preconditions while making deliberate design decisions for erroneous requests.

5

Conclusion

In general, the readiness of a component to serve certain service requests does not only depend on the current request, but also on the previous service history. Therefore, we propose to model service domains by non-empty and prefix closed subsets of input streams. Services arise as stream functions on the service domain mapping a well-formed service history to the response history generated. Partial state machines inherit many basic features from common state-based models like Statecharts and UML State Diagrams. Their particular design was guided by software engineering requirements, viz. to describe the state-based behaviour of a service in a programming language independent, yet straightforwardly implementable way. The states often consist of control information about the status of the conversation and additional data information [10] . The presented formal method relates the stream-based specification of services to their state-based implementation. We use history abstractions and introduce


253

states as congruence classes of input histories. The state stores information about the previous service history that determines the responses on future service requests. The state also determines the validity of further service requests. This way we transfer the concept of “readiness” from histories to the states of a component. The presented applications cover three major sources of incomplete services: temporary deactivation of particular service requests, bounded resources, and order restrictions from interleaving. The applications each introduce the service interface, the service domain, the service function, and the state-based implementation constructed with a history abstraction. The development explicates the design decisions which lead to a particular realization. In subsequent refinement steps the service domain can systematically be extended in a coherent framework [9,13] . In general, the specification is complicated and inflated when considering unexpected service requests from the very beginning. Therefore, the software engineer should first concentrate on the relevant behaviour while caring about unexpected inputs in later design steps. The developed service can be protected from direct access by a guard component which filters improper requests. Alternatively, the reaction to unexpected input can be integrated into the partial state machine possibly responding with an error message. A fault-tolerant service ignores unexpected requests, an aborting service enters its initial state, and a fault-correcting service repairs the offending request. Well-documented services separating the (static) interface from the provided (dynamic) service and its restrictions are essential for building correct applications out of services. Our paper does not propose a new language for conversations. Rather our proposals can serve as a semantic basis for powerful and save modelling languages. The transformation contributes to the better understanding and a saver usage of service-oriented modelling and design concepts. Future research must clarify how the proposed transformation from streams to machines interferes with other notions of refinement. Moreover, it will be interesting to generalize the proposed transformation from the untimed framework to timed frameworks of different granularity. Finally, a service often integrates different aspects, e.g. the genuine functionality and some continuation pattern how to handle unexpected input. It will be interesting to study in greater detail how the separation of the aspects on the behavioural level manifests itself on the implementation level.

References 1. Allen, R., Garlan, D.: A formal basis for architectural connection. ACM Transactions on Software Engineering and Methodology 6(3), 213–249 (1997) 2. Alonso, G., Casati, F., Kuno, H., Machiraju, V.: Web Services: Concepts, Architectures and Applications. Springer, Heidelberg (2004) 3. Benatallah, B., Casati, F., Toumani, F., Hamadi, R.: Conceptual modeling of web service conversations. In: Eder, J., Missikoff, M. (eds.) CAiSE 2003. LNCS, vol. 2681, pp. 449–467. Springer, Heidelberg (2003)

254


4. Berardi, D., de Rosa, F., de Santis, L., Mecella, M.: Finite state automata as conceptual model for E-services. Journal of Integrated Design & Process Science 8(2), 105–121 (2004) 5. Broy, M.: A functional rephrasing of the assumtion/commitment specification style. Formal Methods in System Design 13(1), 87–119 (1998) 6. Broy, M., Kr¨ uger, I.H., Meisinger, M.: A formal model of services. ACM Transactions on Software Engineering and Methodology 16(1) (2007) 7. Broy, M., Stølen, K.: Specification and Development of Interactive Systems: Focus on Streams, Interfaces, and Refinement. Monographs in Computer Science. Springer, Heidelberg (2001) 8. Bultan, T., Fu, X., Hull, R., Su, J.: Conversation specification: A new approach to design and analysis of E–service composition. In: 12th International Conference on World Wide Web, pp. 403–410. ACM, New York (2003) 9. Dosch, W., Hu, G.: On irregular behaviours of interactive stacks. In: Latifi, S. (ed.) Proceedings of the Fourth International Conference on Information Technology: New Generations (ITNG 2007), pp. 693–700. IEEE Computer Society Press, Los Alamitos (2007) 10. Dosch, W., St¨ umpel, A.: Introducing control states into communication based specifications of interactive components. In: Arabnia, H., Reza, H. (eds.) Proceedings of the International Conference on Software Engineering Research and Practice (SERP 2004), vol. II, pp. 875–881. CSREA Press, Athens, GA (2004) 11. Dosch, W., St¨ umpel, A.: Transforming stream processing functions into state transition machines. In: Dosch, W., Lee, R.Y., Wu, C. (eds.) SERA 2004. LNCS, vol. 3647, pp. 1–18. Springer, Heidelberg (2006) 12. Dosch, W., St¨ umpel, A.: Deriving state–based implementations of interactive components with history abstractions. In: Virbitskaite, I., Voronkov, A. (eds.) PSI 2006. LNCS, vol. 4378, pp. 180–194. Springer, Heidelberg (2007) 13. Dosch, W., St¨ umpel, A.: Extending the service domain of an interactive bounded queue. In: Castillo, O., Xu, L., Ao, S.-I. (eds.) Trends in Intelligent Systems and Computer Engineering, ch. 41. Lecture Notes in Electrical Engineering, vol. 6, pp. 599–618. Springer, Heidelberg (2008) 14. Erl, T.: Service Oriented Architecture: Concepts, Technology, and Design. PrenticeHall, Englewood Cliffs (2005) 15. Stephens, R.: A survey of stream processing. Acta Informatica 34(7), 491–541 (1997) 16. Stølen, K., Dederichs, F., Weber, R.: Specification and refinement of networks of asynchronously communicating agents using the assumption/commitment paradigm. Formal Aspects of Computing 8(2), 127–161 (1996) 17. Stoltenberg-Hansen, V., Lindstr¨ om, I., Griffor, E.R.: Mathematical Theory of Domains. Cambridge Tracts in Theoretical Computer Science, vol. 22. Cambridge University Press, Cambridge (1994) 18. St¨ umpel, A.: Stream Based Design of Distributed Systems through Refinement. Logos Verlag, Berlin (2003) 19. Wegner, P.: Why interaction is more powerful than algorithms. Communications of the ACM 40(5), 80–91 (1997) 20. Wirsing, M., Pepper, P., Partsch, H., Dosch, W., Broy, M.: On hierarchies of abstract data types. Acta Informatica 20(1), 1–33 (1983)

Pattern Matching with Swaps for Short Patterns in Linear Time Domenico Cantone and Simone Faro Universit` a di Catania, Dipartimento di Matematica e Informatica Viale Andrea Doria 6, I-95125 Catania, Italy {cantone,faro}@dmi.unict.it

Abstract. The Pattern Matching problem with Swaps consists in finding all occurrences of a pattern P in a text T , when disjoint local swaps in the pattern are allowed. In the Approximate Pattern Matching problem with Swaps one seeks, for every text location with a swapped match of P , the number of swaps necessary to obtain a match at the location. In this paper, we present a new approach for solving both the Swap Matching problem and the Approximate Swap Matching problem in linear time, in the case of short patterns. In particular, we devise a O(nm) general algorithm, named Cross-Sampling, and show an efficient implementation of it, based on bit-parallelism, which achieves O(n) worst-case time and O(σ)-space complexity, with patterns whose length is comparable to the word-size of the target machine. Keywords: pattern matching with swaps, nonstandard pattern matching, combinatorial algorithms on words, design and analysis of algorithms.

1

Introduction

The Pattern Matching problem with Swaps (Swap Matching problem, for short) is a well-studied variant of the classic Pattern Matching problem. It consists in finding all occurrences of a pattern P of length m in a text T of length n, with P and T sequences of characters drawn from a same finite character set Σ. The pattern is said to match the text at a given location j if adjacent pattern characters can be swapped, if necessary, so as to make the pattern identical to the substring of the text ending (or, equivalently, starting) at location j. All swaps are constrained to be disjoint, i.e., each character can be involved in at most one swap. Moreover, identical adjacent characters are not allowed to be swapped. This problem can be of some relevance in several practical applications such as text and music retrieval, computational biology, data mining, and network security, among many others. The problem was introduced in 1995 as one of the open problems in nonstandard string matching [Mut95]. The first nontrivial result on this problem, obtained by Amir et al. [AAL+ 97] shows that the case in which the size of the alphabet Σ exceeds 2 can be reduced to the case in which it is exactly 2 with M. Nielsen et al. (Eds.): SOFSEM 2009, LNCS 5404, pp. 255–266, 2009. c Springer-Verlag Berlin Heidelberg 2009

256

D. Cantone and S. Faro

a O(log2 σ)-time overhead (subsequently reduced to O(log σ) in the journal version [AAL+ 00]) and that the problem for alphabet sets of size 2 can be solved in 1 time O(nm 3 log m). Amir et al. [ALLL98] studied some rather restrictive cases in which a O(m log2 m)-time algorithm can be obtained. More recently, Amir et al. [ACH+ 03] solved the Swap Matching problem in time O(n log m log σ). All the above solutions to the swap matching problem are based on the fast Fourier transform (FFT) technique. In 2008 the first attempt to provide an efficient solution to the swap matching problem without using the FFT technique has been presented by Iliopoulos and Rahman in [IR08]. They introduced a new graph-theoretic approach to model the problem and devised an efficient algorithm, based on bit parallelism, which runs in O((n + m) log m) if the pattern size is comparable to the word size in the target machine. The Approximate Pattern Matching problem with Swaps seeks to compute, for each text location j, the number of swaps necessary to convert the pattern to the substring of length m ending at text location j (provided there is a swapped matching at j). In [ALP02], Amir et al. presented an algorithm that counts the number of swaps at every location where there is a swapped matching in time O(n log m log σ), thus solving the approximate pattern matching problem with swaps in O(n log m log σ)-time. In this paper, we present a first approach for solving both the Swap Matching problem and the Approximate Swap Matching problem in linear worst-case time for short patterns. More precisely, we devise a new simple algorithm to solve the problem, named Cross-Sampling, with a O(nm) worst-case time complexity. Then we show how to obtain an efficient implementation of the algorithm, based on bit-parallelism, which achieves O(n) worst-case time and O(σ) space complexity for patterns having length similar to the word-size of the target machine. The rest of the paper is organized as follows. In Section 2 we present some preliminary definitions. Section 3 presents the Cross-Sampling algorithm for the swap matching and approximate swap matching problem. In Section 4 we apply the bit-parallelism technique to obtain efficient implementations of the CrossSampling algorithms. Finally, we briefly draw our conclusions in Section 5.

2

Notions and Basic Definitions

A string P of length m ≥ 0 is represented as a finite array P [0 .. m − 1]. In such a case we also write length(P ) = m. In particular, for m = 0 we obtain the empty string, denoted by ε. We denote by P [i] the (i + 1)-st character of P , for 0 ≤ i < length(P ). Likewise, we denote by P [i .. j] the substring of P contained between the (i + 1)-st and the (j + 1)-st characters of P , for 0 ≤ i ≤ j < length(P ). For any two strings P and P , we say that P is a suffix of P if P = P [i .. length(P ) − 1], for some 0 ≤ i < length(P ). Similarly, we say that P is a prefix of P if P = P [0 .. i − 1], for some 0 ≤ i ≤ length(P ). We denote by Pi the nonempty prefix of P of length i + 1, for 0 ≤ i < m. We also let Ph denote the empty string ε, for every negative integer h. In addition, we write P.P to denote the concatenation of P and P .

Pattern Matching with Swaps for Short Patterns in Linear Time

257

Definition 1. A swap permutation for a string P of length m is a permutation π : {0, ..., m − 1} → {0, ..., m − 1} such that: (a) if π(i) = j then π(j) = i (characters are swapped); (b) for all i, π(i) ∈ {i − 1, i, i + 1} (only adjacent characters are swapped); (c) if π(i) = i then P [π(i)] = P [i] (identical characters are not swapped). For a given string P and a swap permutation π for P , we write π(P ) to denote the swapped version of P , namely π(P ) = P [π(0)].P [π(1)]. · · · .P [π(m − 1)]. Definition 2. Given a text T of length n and a pattern P of length m, P is said to swap-match (or to have a swapped occurrence) at location j of T if there exists a swap permutation π of P such that π(P ) matches T at location j, i.e. P [π(i)] = T [j − m + i + 1], for i = 0...m − 1. In such a case we write P ∝ Tj . Observe that if we assume there is a swap match ending at location j of the text T , then the number k of swaps needed to transform P into its swapped version π(P ) = T [j − m + 1 .. j] is equal to half the number of mismatches of P at location i. Thus the value of k lies between 0 and m/2 . Definition 3. Given a text T of length n and a pattern P of length m, P is said to swap-match (or to have a swapped occurrence) at location j of T with k swaps if there exists a swap permutation π of P such that π(P ) matches T at location j and k = |{i : P [i] = P [π(i)]}|/2. In such a case we write P ∝k Tj . Definition 4 (Pattern Matching Problem with Swaps). Given a text T of length n and a pattern P of length m, find all locations j ∈ {m − 1, ..., n − 1} such that P swap-matches with T at location j. Definition 5 (Approximate Pattern Matching Problem with Swaps). Given a text T of length n and a pattern P of length m, find all pairs (j, k), with j ∈ {m − 1...n − 1} and 0 ≤ k ≤ m/2 , such that P has a swapped occurrence in T at location j with k swaps. The following elementary result will be used later. Lemma 1. Let P and R be strings of length m over an alphabet Σ and suppose that there exists a swap permutation π such that π(P ) = R. Then π is unique. Proof. Suppose by way of contradiction that there exist two different swap permutations π and π such that π(P ) = π (P ) = R. Then there must exist an index i such that π(i) = π (i). Without loss of generality, let us assume that π(i) < π (i) and suppose that i be the smallest index such that π(i) = π (i). Since π(i), π (i) ∈ {i − 1, i, i + 1}, by Definition 1(b), it is enough to consider the following three cases: Case 1: π(i) = i − 1 and π (i) = i. Then, by Definition 1(a), we have π(i − 1) = i, so that P [π(i − 1)] = P [i] = P [π (i)] = P [π(i)], thus violating Definition 1(c).

258


Case 2: π(i) = i and π (i) = i + 1. Since by Definition 1(a) we have π (i + 1) = i, then P [π (i + 1)] = P [i] = P [π(i)] = P [π (i)], thus again violating Definition 1(c). Case 3: π(i) = i − 1 and π (i) = i + 1. By Definition 1(c) we have π(i − 1) = π (i + 1) = i. Thus π (i − 1) = i = π(i − 1), contradicting the minimality of i. Corollary 1. Given a text T of length n and a pattern P of length m, if P ∝ Tj , for a given position j ∈ {m − 1...n − 1}, then there exists a unique swapped occurrence of P in T ending at position j.

3

A New Approach to the Swap Matching Problem

In this section we present a new algorithm for solving the swap matching problem. Our algorithm is characterized by a O(mn)-time and a O(m)-space complexity, where m and n are the length of the pattern and text, respectively. We will also show how to extend our algorithm also to the case of the approximate swap matching problem, maintaining the same time and space complexity. As above, let T be a text of length n and P a pattern of length m. Our algorithm solves the swap matching problem by computing the swap occurrences of all prefixes of the pattern in continuously increasing prefixes of the text using a dynamic programming approach. That is, during its (j + 1)-st iteration, for j = 0, 1, . . . , n − 1, our algorithm establishes whether Pi ∝ Tj , for each i = 0, 1, . . . , m − 1, exploiting information gathered during previous iterations. Such information can be conveniently represented as a matrix. For instance, Fig. 1 shows the 7 × 15 matrix of swap occurrences of the prefixes for the pattern P = babaaab of length 7 and text T = abbababaabbabaa of length 15. Each row of the matrix is labeled with a prefix P i of the pattern, whereas columns are labeled with the locations of the text T . A value k in row P i and column j means that P i ∝k T j , whereas a symbol - means that P i ∝ T j . Thus, to look for the swap occurrences of P in T it is enough to inspect the row labelled P 6 , as P = P 6 : by doing so, we find that there is a swapped occurrence of P at location 9 of T . j T P0 P1 P2 P3 P4 P5 P6

0 a -

1 b 0 1 -

2 b 0 1 -

3 a 0 1 1 -

4 b 0 1 0 -

5 a 0 0 -

6 b 0 1 0 2 -

7 a 0 0 2 -

8 a 0 2 -

9 b 0 1 1 2

10 b 0 1 -

11 a 0 1 1 -

12 b 0 1 0 -

13 a 0 0 -

14 a 0 -

Fig. 1. The matrix of swap occurrences of prefixes in the case of the pattern P = babaaab of length 7 and text T = abbababaabbabaa of length 15. A value k in row P i and column j means that P i ∝k T j , whereas the symbol “-” stands for P i ∝ T j .


259

More generally, if we denote by Sj the set of the integral values in the j-th column of the m×n matrix of the swap occurrences of the prefixes for our generic pattern P and text T , where j = 0, 1, . . . , n − 1, we plainly have that P has a swapped occurrence at location j of T if and only if (m − 1) ∈ Sj . In fact, by definition, we have Sj = {0 ≤ i ≤ m − 1 | Pi ∝ Tj } . The sets Sj can be computed efficiently by a dynamic programming algorithm, by exploiting the following very elementary property. Lemma 2. Let T and P be a text of length n and a pattern of length m, respectively. Then, for each 0 ≤ j < n and 0 ≤ i < m, we have that Pi ∝ Tj if and only if one of the following two facts holds – P [i] = T [j] and Pi−1 ∝ Tj−1 ; – P [i] = T [j − 1], P [i − 1] = T [j], and Pi−2 ∝ Tj−2 . To this end, let us denote by Sj , for 0 ≤ j < n − 1, the collection of all values i such that the prefix Pi−1 of P has a swapped occurrence ending at location j − 1 of the text T and P [i] = T [j + 1]. Or, more formally, let Sj = {0 ≤ i < m − 1 | Pi−1 ∝ Tj−1 and P [i] = T [j + 1]} . Also, let us put

λj =

{0} if P [0] = T [j] ∅ otherwise .

Then, the base case is given by S0 = λ0 ,

and S0 = λ1 .

(1)

Additionally, Lemma 2 justifies the following recursive definitions of the sets in terms of Sj and Sj , for 0 ≤ j < n − 1: Sj+1 and Sj+1 Sj+1 = {i ≤ m − 1 | ((i − 1) ∈ Sj and P [i] = T [j + 1]) or ((i − 1) ∈ Sj and P [i] = T [j]) } ∪ λj+1 Sj+1 = {i < m − 1 | (i − 1) ∈ Sj and P [i] = T [j + 2]} ∪ λj+2 .

(2)

Such relations, coupled with the initial conditions (1), allow one to compute the sets Sj and Sj in an iterative fashion, as shown in Fig. 2 (Top). Observe that Sj+1 is computed in terms of both Sj and Sj , whereas Sj+1 needs only Sj for its computation. The resulting dependency graph has a doubly crossed structure, from which the name of the algorithm of Fig. 3, Cross-Sampling, for the swap matching problem. Fig. 2 shows also (on the bottom) the computation of the sets S9 and S9 in terms of sets S8 and S8 for the pattern P = babaaab and a text T = abbababaabbabaa presented in the example of Fig. 1.

260


S0

S1

S2

S3

S4

S5

Sj

Sj+1

S0

S1

S2

S3

S4

S5

Sj

Sj+1

Computation of S9

Computation of S9 4 ∈ S8 5 ∈ S8 0 ∈ S8 2 ∈ S8 P [0] =

but P [5] = T [9] and P [6] = T [9] and P [1] = T [8] and P [3] = T [8] T [9]

→ → → → →

5 ∈ S9 6 ∈ S9 1 ∈ S9 3 ∈ S9 0 ∈ S9

4 ∈ S8 but P [5] = T [10] → 5 ∈ S9 5 ∈ S8 and P [6] = T [10] → 6 ∈ S9 P [0] = T [10] → 0 ∈ S9

S9 = {0, 6}

S9 = {0, 1, 3, 6}

Fig. 2. (Top) A graphic representation of the iterative fashion for computing sets Sj and Sj for increasing values of j. (Bottom) Computation of the sets S9 and S9 in terms of sets S8 and S8 for a pattern P = babaaab of length 7 and a text T = abbababaabbabaa of length 15. We notice that S8 = {4, 5} and S8 = {0, 2}.

To compute the worst case time complexity of the Cross-Sampling algorithm, first observe that the for-cycle of line 4 is executed O(n) times. During the j-th iteration, the for-cycles of line 6 and line 11 are executed |Sj | and |Sj | times, respectively. However, according to Lemma 1, for each position j of the text we can report only a single swapped occurrence of the prefix Pi in Tj , for each 0 ≤ i < m, which implies |Sj | ≤ m and |Sj | < m. Thus the time complexity of the resulting algorithm is O(nm). 3.1

Solving the Approximate Swap Matching Problem

Now we show how to extend the Cross-Sampling algorithm to solve the approximate swap matching problem. To begin with, we extend Lemma 2 as follows. Lemma 3. Let T and P be a text of length n and a pattern of length m, respectively. Then, for each 0 ≤ i < n and 0 ≤ k < m, we have that Pi ∝k Tj if and only if one of the following two facts hold – P [i] = T [j] and either (i = 0 ∧ k = 0) or Pi−1 ∝k Tj−1 ; – P [i] = T [j − 1], P [i − 1] = T [j] and either (i = 1 ∧ k = 1) or Pi−2 ∝k−1 Tj−2 .

Next we define the sets S j and S j which denote, respectively, the collection of all pairs (i, k) such that the prefix Pi of P has a k-swapped occurrence ending at position j of the text and the collection of all pairs (i, k) such that the prefix

Pattern Matching with Swaps for Short Patterns in Linear Time (A) Cross-Sampling (P, m, T, n) 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20.

S0 ← S0 ← ∅ if P [0] = T [0] then S0 ← {0} if P [0] = T [1] then S0 ← {0} for j ← 1 to n − 1 do Sj ← Sj ← ∅ for i ∈ Sj−1 do if i < m − 1 then if P [i + 1] = T [j] then Sj ← Sj ∪ {i + 1} if j < n − 1 and P [i + 1] = T [j + 1] then Sj ← Sj ∪ {i + 1} else Output(j − 1) for i ∈ Sj−1 do if i < m − 1 and P [i + 1] = T [j − 1] then Sj ← Sj ∪ {i + 1} if P [0] = T [j] then Sj ← Sj ∪ {0} if j < n − 1 and P [0] = T [j + 1] then Sj ← Sj ∪ {0} for i ∈ Sj−1 do if i = m − 1 then Output(n − 1)

261

(B) Approximate-Cross-Sampling (P, m, T, n) ¯0 ← S ¯1 ← ∅ 1. S 0 0 ¯0 ← {(0, 0)} 2. if P [0] = T [0] then S 0 ¯1 ← {(0, 0)} 3. if P [0] = T [1] then S 0 4. for j ← 1 to n − 1 do ¯0 ← S ¯1 ← ∅ 5. S j j ¯0 6. for (i, k) ∈ S j−1 do 7. if i < m − 1 then 8. if P [i + 1] = T [j] ¯0 ← S ¯0 ∪ {(i + 1, k)} 9. then S j j 10. if j < n − 1 and P [i + 1] = T [j + 1] ¯1 ← S ¯1 ∪ {(i + 1, k)} 11. then S j j 12. else Output((j − 1, k)) 1 ¯ 13. for (i, k) ∈ Sj−1 do 14. if i < m − 1 and P [i + 1] = T [j − 1] ¯0 ← S ¯0 ∪ {(i + 1, k + 1)} 15. then S j j ¯0 ← S ¯0 ∪ {(0, 0)} 16. if P [0] = T [j] then S j j 17. if j < n − 1 and P [0] = T [j + 1] ¯1 ← S ¯1 ∪ {(0, 0)} 18. then S j j ¯0 19. for (i, k) ∈ S n−1 do 20. if i = m − 1 then Output(n − 1, k)

Fig. 3. (A) The Cross-Sampling algorithm for solving the swap matching problem. (B) The Approximate-Cross-Sampling algorithm for solving the approximate swap matching problem.

Computation of S¯9

Computation of S¯9 (4, 0) ∈ S¯8 but P [5] = T [9] (5, 2) ∈ S¯8 and P [6] = T [9] (0, 0) ∈ S¯8 and P [1] = T [8] (2, 0) ∈ S¯8 and P [3] = T [8] P [0] = T [9]

→ → → → →

(5, 0) ∈ S¯9 (6,2) ∈ S¯9 (1, 1) ∈ S¯9 (3, 1) ∈ S¯9 (0, 0) ∈ S¯9

(4, 0) ∈ S¯8 but P [5] = T [10] → (5, 0) ∈ S¯9 (5, 2) ∈ S¯8 and P [6] = T [10] → (6, 2) ∈ S¯9 P [0] = T [10] → (0, 0) ∈ S¯9

S¯9 = {(0, 0), (1, 1), (3, 1), (6,2)}

S¯9 = {(0, 0), (6, 2)}

Fig. 4. Computation of the sets S¯9 and S¯9 in terms of sets S¯8 and S¯8 for a pattern P = babaaab of length 7 and a text T = abbababaabbabaa of length 15. We notice that S¯8 = {(4, 0), (5, 2)} and S¯8 = {(0, 0), (2, 0)}.

Pi−1 of P has a k-swapped occurrence ending at position j − 1 of the text and P [i] = T [j + 1], for 0 ≤ j ≤ n. More formally, S¯j = {(i, k) | 0 ≤ i ≤ m − 1 and Pi ∝k Tj } S¯j = {(i, k) | 0 ≤ i < m − 1 and (Pi−1 ∝k Tj−1 ∨ i = 0) and P [i] = T [j + 1]}. Then the approximate swap matching problem translates into the problem of finding all pairs (j, k) such that (m − 1, k) ∈ S¯j , where 0 ≤ k < m/2 . Sets S¯0 and S¯0 can be defined as follows

¯j = λ

{(0, 0)} if P [0] = T [j] , ∅ otherwise

¯0 , S¯0 = λ

¯1. and S¯0 = λ

262


Lemma 3 justifies the following recursive definition of the sets S¯j+1 and S¯j+1 in ¯ ¯ terms of Sj and Sj , for j < n:

S¯j+1 = {(i, k) | i ≤ m − 1 and ((i − 1, k) ∈ S¯j and P [i] = T [j + 1]) or ¯ j+1 ((i − 1, k − 1) ∈ S¯j and P [i] = T [j]) } ∪ λ ¯ ¯ ¯ Sj+1 = {(i, k) | i < m − 1 and (i − 1, k) ∈ Sj and P [i] = T [j + 2]} ∪ λj+2 . Fig. 4 shows the computation of the sets S¯9 and S¯9 in terms of sets S¯8 and ¯ S8 for the pattern P = babaaab and text T = abbababaabbabaa presented in the example of Fig. 1. Fig. 3(B) shows the Approximate-Cross-Sampling algorithm for solving the approximate swap matching problem. It can easily be checked that its worstcase time complexity is O(nm).

4

A Linear Algorithm for Short Patterns

In this section we present two efficient algorithms based on the bit-parallelism techique [BYG92] to search for swapped occurrences of short patterns in texts. The bit-parallelism technique takes advantage of the intrinsic parallelism of the bit operations inside a computer word, allowing to cut down the number of operations that an algorithm performs by a factor of at most w, where w is the number of bits in the computer word. The simulation of the Cross-Sampling algorithm with bit-parallelism is performed by representing the sets Sj and Sj as lists of m bits, Dj and Dj1 respectively, where m is the length of the pattern. The i-th bit of Dj is set to 1 if i ∈ Sj , i.e. if Pi ∝ Tj , whereas the i-th bit of Dj is set to 1 if i ∈ Sj , i.e. if Pi−1 ∝ Tj−1 and P [i] = T [j + 1]. All remaining bits in the bit vectors are set to 0. Note that if m ≤ w, the entire list fits in a single computer word, whereas if m > w we need m/w computer words to represent the sets Sj and Sj . For each character c of the alphabet Σ, the algorithm maintains a bit mask M [c] where the i-th bit is set to 1 if P [i] = c.

(A) Bit Vectors

¯0 (B) Computation of D 9

M[a] = 0111010 M[b] = 1000101

(D8 1)|1 : 1100001 M[b] : 1000101 1000001 (D8 1)&M[a] : 0001010 1001011

D8 = 0110000 D8 = 0000101

¯1 (C) Computation of D 9 & = | =

(D8 1)|1 : 1100001 & M[b] : 1000101 = 1000001

Fig. 5. (A) Bit vectors precomputed by the algorithm and (B-C) the computation of the sets S¯9 and S¯9 in terms of sets S¯8 and S¯8 for a pattern P = babaaab of length 7 and a text T = abbababaabbabaa of length 15. We notice that S¯8 = {(4, 0), (5, 2)} and S¯8 = {(0, 0), (2, 0)}.

Pattern Matching with Swaps for Short Patterns in Linear Time (A) BP-Cross-Sampling (P, m, T, n) 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15.

m−1

F ←0 1 for c ∈ Σ do M[c] ← 0m for i ← 0 to m − 1 do M[xi ] ← M[P [i]] | F F ←F 1 F ← 10m−1 D ← D ← 0m for j ← 0 to n − 1 do H ← (D 1) | 1 D ← (H & M[T [j]]) D ← (D 1) & M[T [j − 1]] D ← D | D D ← H & M[T [j + 1]] if (D & F ) = 0m then Output(j)

263

(B)BP-Approximate-Cross-Sampling (P, m, T, n) 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22.

q ← log(m/2 + 1) + 1 F ← 0qm−1 1 G ← 0q(m−1) 1q for c ∈ Σ do M[c] ← 0qm B[c] ← 0qm for i ← 0 to m − 1 do M[P [i]] ← M[P [i]] | F B[P [i]] ← B[P [i]] | G F ← (F q) G ← (G q) F ← 0q−1 10q(m−1) ¯ ←D ¯ ← 0qm D for j ← 0 to n − 1 do ¯ q) | 1 H 0 ← (D ¯ q) | 1) & M[T [j − 1]] H 1 ← ((D ¯ ← (H 0 & B[T [j]]) | H 1 D ¯ ←D ¯ + (H 1 1) D ¯ ← (H 0 & M[T [j + 1]]) & D ¯ D ¯ & F ) = 0qm then if (D ¯ (q(m − 1) + 1)) k ← (D Output(j, k)

Fig. 6. (A) The BP-Cross-Sampling algorithm, which solves the swap matching problem in linear time by using bit-parallelism. (B) The BP-Approximate-CrossSampling algorithm, which solves the approximate swap matching problem in linear time by using bit-parallelism.

The bit vectors are initialized to 0m . Then the algorithm scans the text from the first character to the last one and, for each position j ≥ 0, it computes the , by performing the following bitwise bit vector Dj in terms of Dj−1 and Dj−1 operations: Dj Dj Dj Dj

← Dj−1 1 Sj = {i : (i − 1) ∈ Sj−1 } ← Dj | 1 Sj = Sj ∪ {0} ← Dj & M [T [j]] Sj = Sj \ {i : P [i] = T [j]} ← Dj | H 1 Sj = Sj ∪ {i : (i − 1) ∈ Sj−1 ∧ P [i] = T [j − 1]}, 1) & M [T [j − 1]] . where H 1 = (Dj−1 Similarly, the bit vector Dj is computed during the j-th iteration of the algorithm in terms of Dj−1 , by performing the following bitwise operations: Dj ← Dj−1 1 Dj ← Dj | 1 Dj ← Dj & M [T [j + 1]]

Sj = {i : (i − 1) ∈ Sj−1 } Sj = Sj ∪ {0} Sj = Sj \ {i : P [i] = T [j + 1]}.

During the j-th iteration, if the leftmost bit of Dj is set to 1, i.e., if (Dj & 10m−1 ) = 0m , we report a swap match at position j. Fig. 5 shows the computation of the bit vectors D9 and D9 in terms of the sets D8 and D8 for the pattern P = babaaab and the text T = abbababaabbabaa presented in Fig. 1.

264


In practice, we can use only two vectors to implement sets Dj and Dj . Thus during iteration j of the algorithm vector Dj−1 is transformed into vector Dj , whereas vector Dj−1 is transformed into vector Dj . The resulting BP-CrossSampling algorithm is shown in Fig. 6(A). It achieves a O(mn/w) worstcase time complexity and requires O(σm/w) extra-space. If the length of the pattern is m ≤ w, then the algorithm reports all swapped matches in O(n) time and O(σ) extra space. 4.1

Approximate Pattern Matching with Swaps

Similarly to the algorithm presented above, the simulation of the ApproximateCross-Sampling algorithm can be performed by representing the sets S¯j and ¯ j and D ¯ respectively, where where q = log(m/2 + 1) + 1 S¯j as a list of q bits, D j and m is the length of the pattern. If the pair (i, k) ∈ S¯j , for 0 ≤ i < m and ¯ j is set to 1 and the 0 ≤ k ≤ m/2 , then the rightmost bit of the i-th block of D leftmost q − 1 bits of the i-th block are set so as to contain the value k (we need exactly log(m/2 + 1) to represent a value between 0 and m/2 ). Otherwise if the pair (i, k) does not belong to Sj0 then the rightmost bit of the i-th block of ¯ j is set to 0. In a similar way we can maintain the current configuration of the D set S¯j . If m log(m/2 + 1) + m ≤ w, then the entire list fits in a single computer word, otherwise we need m(log(m/2 + 1)/w computer words to represent the sets S¯j and S¯j . For each character c of the alphabet Σ the algorithm maintains a bit mask M [c], where the rightmost bit of the i-th block is set to 1 if P [i] = c. Moreover the algorithm maintains, for each character c ∈ Σ, a bit mask B[c] whose i-th block have all bits set to 1 if P [i] = c, whereas all remaining bits are set to 0. Consider the example shown in Fig. 1, where the pattern P = babaaab has length 7. Then each block is made up by q bits, with q = log(7/2 + 1) + 1 = 3. The leftmost two bits of each block contain the number of swaps k, which is a value between 0 and 3. Fig. 7(A) shows the bit vectors computed by the algorithm in the preprocessing phase.

¯0 (B) Computation of D 9

(A) Bit Vectors 000 001 000 111

001 000 111 000

001 000 111 000

001 000 111 000

000 001 000 111

001 000 111 000

000 001 000 111

M[a] M[b] B[a] B[b]

= = = =

D8 D8

= 000 101 001 000 000 000 000 = 000 000 000 000 001 000 001

¯ 8 q)|1 : 101 (D B[b] : 111 101 ¯ q)&M[a] : 000 (D 8 101 ¯ (q + 1))&M[a] : 000 (D 8 101

001 000 000 000 000 000 000

000 000 000 000 000 000 000

000 000 000 001 001 010 011

000 111 000 000 000 000 000

000 000 000 001 001 010 011

001 111 001 000 001 000 001

& = | = + =

¯ 9 in terms of sets D ¯ 8 and D ¯ 8 for a pattern P = Fig. 7. Computation of the sets D babaaab of length 7 and a text T = abbababaabbabaa of length 15. We notice that S¯8 = {(4, 0), (5, 2)} and S¯8 = {(0, 0), (2, 0)}.


265

Before entering into details, we observe that if i ∈ Sj and i ∈ Sj then we can conclude that T [j] = T [j + 1]. Moreover, if T [j + 1] = P [i + 1] we have also T [j] = P [i + 1], which would imply a swap between two identical characters of the pattern. Since the latter condition would violate Definition 1(c), during the ¯ we maintain the following invariant ¯ j and D computation of vectors D j ¯ j is set to 1, then the i-th bit of D ¯ is set to 0. if the i-th bit of D j

(3)

Initially, all bit vectors are set to 0qm . Then the algorithm scans the text from the first character to the last one and, for each position j ≥ 0, it computes ¯ j in terms of D ¯ j−1 and D ¯ , by performing the following bitwise the vector D j−1 operations: ¯j D ¯j D ¯j D ¯j D ¯j D

¯ j−1 q ←D ¯j | 1 ←D ¯ j & B[T [j]] ←D ¯j | H1 ←D ¯ j + (H 1 1) ←D

S¯j = {(i, k) : (i − 1, k) ∈ S¯j−1 } S¯j = S¯j ∪ {(0, 0)} S¯j = S¯j \ {(i, k) : P [i] = T [j]} S¯j = S¯j ∪ K ∀ (i, k) ∈ K change (i, k) with (i, k + 1) in S¯j ,

¯ where we have set H 1 = (D j−1 q) & M [T [j − 1]] and K stands for the set ¯ {(i, k) : (i − 1, k) ∈ Sj−1 ∧ P [i] = T [j − 1]}. ¯ is computed during the j-th iteration of the algoSimilarly, the bit vector D j ¯ j−1 , by performing the following bitwise operations: rithm in terms of D ¯ j D ¯ Dj ¯ j D ¯ j D

¯ j−1 q ←D ¯ j | 1 ←D ¯ j & B[T [j + 1]] ←D ¯ j & ∼ D ¯j ←D

S¯j S¯j S¯j S¯j

= {(i, k) : (i − 1, k) ∈ S¯j−1 } = S¯j ∪ {(0, 0)} = S¯j \ {(i, k) : P [i] = T [j + 1]} = S¯j \ {(i, k) : (i, k) ∈ S¯j }.

During the j-th iteration of the algorithm, if the rightmost bit of the (m−1)-st ¯ j is set to 1, i.e. if (D ¯ j & 10q(m−1) ) = 0m , we report a swap match at block of D position j. Additionally, the number of swaps needed to transform the pattern to its swapped occurrence in the text is contained in the q − 1 leftmost bits of ¯ j which can be extracted by performing a bitwise shift the (m − 1)-th block of D of (q(m − 1) + 1) positions to the right. As in the case of the BP-Cross-Sampling algorithm, in practice we can ¯ . Thus, during iteration ¯ j and D use only two vectors to implement the sets D j ¯ j−1 is transformed into vector D ¯ j whereas vector D ¯ j, vector D j−1 is trans ¯ formed into vector Dj . The BP-Approximate-Cross-Sampling algorithm, shown in Fig. 6, achieves O((mn log m)/w) worst-case time complexity and requires O(σm log m/w) extra-space. If the length of the pattern is such that m(log(m/2 + 1) + 1) ≤ w, then the algorithm reports all swapped matches in O(n) time and O(σ) extra space.

5

Conclusions

In this paper, we have presented a new approach for solving both the Swap Matching problem and the Approximate Swap Matching problem. In particular we devised an efficient algorithm, named Cross-Sampling, with a O(nm)

266


worst-case time complexity. Then we have shown how to obtain an efficient implementation of the Cross-Sampling algorithm, based on bit-parallelism, achieving O(n) worst case time and O(σ) space complexity for patterns having length similar to the word-size of the target machine. This is the first algorithm which solves the Swap Matching problem and the Approximate Swap Matching problem in linear time for short patterns.

References [AAL+ 97] [AAL+ 00] [ACH+ 03] [ALLL98]

[ALP02] [BYG92] [IR08]

[Mut95]

Amir, A., Aumann, Y., Landau, G.M., Lewenstein, M., Lewenstein, N.: Pattern matching with swaps. In: IEEE Symposium on Foundations of Computer Science, pp. 144–153 (1997) Amir, A., Aumann, Y., Landau, G.M., Lewenstein, M., Lewenstein, N.: Pattern matching with swaps. Journal of algorithms 37(2), 247–266 (2000) Amir, A., Cole, R., Hariharan, R., Lewenstein, M., Porat, E.: Overlap matching. Inf. Comput. 181(1), 57–74 (2003) Amir, A., Landau, G.M., Lewenstein, M., Lewenstein, N.: Efficient special cases of pattern matching with swaps. Information Processing Letters 68(3), 125–132 (1998) Amir, A., Lewenstein, M., Porat, E.: Approximate swapped matching. Inf. Process. Lett. 83(1), 33–39 (2002) Baeza-Yates, R., Gonnet, G.H.: A new approach to text searching. Commun. ACM 35(10), 74–82 (1992) Iliopoulos, C.S., Rahman, M.S.: A new model to solve the swap matching problem and efficient algorithms for short patterns. In: Geffert, V., Karhum¨ aki, J., Bertoni, A., Preneel, B., N´ avrat, P., Bielikov´ a, M. (eds.) SOFSEM 2008. LNCS, vol. 4910, pp. 316–327. Springer, Heidelberg (2008) Muthukrishnan, S.: New results and open problems related to nonstandard stringology. In: Galil, Z., Ukkonen, E. (eds.) CPM 1995. LNCS, vol. 937, pp. 298–317. Springer, Heidelberg (1995)

Automatic Bug Detection in Microcontroller Software by Static Program Analysis Ansgar Fehnker1 , Ralf Huuck1 , Bastian Schlich2 , and Michael Tapp1 1

2

National ICT Australia Ltd. (NICTA) Locked Bag 6016, University of New South Wales Sydney NSW 1466, Australia RWTH Aachen University , Embedded Software Laboratory Ahornstr. 55, 52074 Aachen, Germany

Abstract. Microcontroller software typically consists of a few hundred lines of code only, but it is rather different from standard application code. The software is highly hardware and platform specific, and bugs are often a consequence of neglecting subtle specifications of the microcontroller architecture. Currently, there are hardly any tools for analyzing such software automatically. In this paper, we outline specifics of microcontroller software that explain why those programs are different to standard C/C++ code. We develop a static program analysis for a specific microcontroller, in our case the ATmega16, to spot code deficiencies, and integrate it into our generic static analyzer Goanna. Finally, we illustrate the results by a case study of an automotive application. The case study highlights that – even without formal proof – the proposed static techniques can be valuable in pinpointing software bugs that are otherwise hard to find.

1

Introduction

Microcontrollers are systems-on-a-chip consisting of a processor, memory, as well as input and output functions. They are mainly used when low-cost and high-reliability is paramount. Such systems can be found in the automotive, entertainment, aerospace and global positioning industry. Since microcontrollers are almost always used in embedded devices, many of them mission critical, a potential re-call is costly. Hence, not only the hardware, but in particular the software running on these microcontrollers has to be reliable, i.e., bug free. There are a number of formal verification techniques to find bugs or even ensure the absence of them. However, the typically short development cycles for microcontroller-based products made it prohibitive to apply proof-based methods. Model checking and static analysis, which are fully automatic, are in principle suitable for such development environments. Software model checkers such

National ICT Australia is funded by the Australian Governments Department of Communications, Information Technology and the Arts and the Australian Research Council through Backing Australia’s Ability and the ICT Research Centre of Excellence programs. This work was carried out while being on leave to NICTA.


268

A. Fehnker et al.

as [1,2,3] operate on a low level semantic, which allows them to be precise at the expense of speed. Static analysis tools [4,5,6,7], in contrast, have been concentrating on a shallower but more scalable and applicable analysis of large code bases [8]. There are a number of obstacles to the application of existing tools to microcontroller software: it is often written in non-standard C, containing assembly statements, direct memory access and custom platform-dependent language extensions [9]. Crucial microcontroller features such as timers and direct memory accesses make model checking in particular challenging, as they require platformspecific hardware models, e.g., for the memory layout, which can result in excessively large state spaces. Common static program analyzers, on the other hand, work on a higher level of abstraction as their main purpose is not to ensure correctness, but to find bugs. If they are able to parse the C dialect, they can easily deal with code base sizes common for microcontrollers. However, commercial static analysis tools typically check for standard deficiencies missing bugs resulting from subtle deviations of the hardware specification. In this work, we use Goanna [10], an industrial-strength static program analyzer that is based on standard model checking technology and can easily be adjusted to include microcontroller-specific checks. Goanna works on syntactic abstractions of C/C++ programs. The checks are specified in temporal logic. We demonstrate the strength of this approach by defining and integrating targeted checks for the analysis of the ATMEL ATmega16 microcontroller in a simple and concise manner. The resulting analysis is fast and precise. This finding is supported by a case study applying Goanna to an automotive application. In more than 400 academic C programs, Goanna finds about 150 deficiencies, either severe bugs or serious compatibility issues. The rate of false alarms is zero in this case study, that is, all alarms were true alarms. The analysis time for a few hundred lines of ATMEL code is typically below 1 second. The paper is structured as follows. The next section briefly discusses the particularities of microcontroller code, and what sets it apart from standard ANSI C. Section 3 introduces the static analysis approach via model checking as it is implemented in the tool Goanna. Section 4 gives a detailed description of three different rules that we implemented for the ATmega16. Section 5 describes the results that we obtained for an automotive case study. Finally, Section 6 concludes the paper, and discusses future work.

2

Why Software for Microcontrollers Is Different

C programs for microcontrollers commonly include – besides standard ANSI C language features – compiler-specific constructs, hardware-dependent features, and embedded assembly language statements. One feature that breaks common analysis frameworks is direct memory access, which is a crucial feature, as certain operations of the microcontroller are controlled by specific registers that are located at fixed memory addresses. An example are I/O registers that are used to communicate with the environment. Most C code model checkers and static

Automatic Bug Detection in Microcontroller Software

269

analyzers consider direct memory access to be an error [9] because it can lead to defects in an environment with dynamic linking and loading. One option is to extended standard C code model checkers to cater for microcontroller specific features. This is, however, not an easy task given that the correctness of a program can depend on the underlying hardware layout. Another option is implemented in the [mc]square tool [11]. It analyzes ATMEL C code by analyzing the compiled assembly and relating it back to the C code. While this captures all the necessary platform particularities, it also requires to track a large state space, which limits the analysis to certain code sizes. In this paper, we follow the alternative option to amend the static analysis tool Goanna, which bases its checks on temporal logic specifications.

3

Static Analysis by Model Checking

In this work, we use an automata-based static analysis framework that is implemented in our tool Goanna. In contrast to typical equation solving approaches to static analysis, the automata based approach [12,13,14] defines properties in terms of temporal logic expressions over annotated graphs. The validity of a property can then be checked automatically by graph exploring techniques such as model checking. Goanna1 itself is a closed source project, but the technical details of the approach can be found in [10]. The basic idea of our approach is to map a C/C++ program to its corresponding control flow graph (CFG), and to label the CFG with occurrences of syntactic constructs of interest. The CFG together with the labels can easily be mapped to the input language of a model checker or directly translated into a Kripke structure for model checking. Consider the simple example program fibonacci in Fig. 1, which is computing Fibonacci numbers. For example, to check whether variables are initialized before their first use, we syntactically identify program locations that declare, read, or write variables. For variable q in Fig. 1 (a) we automatically label the nodes with labels declq , readq and writeq , as shown in Fig. 1 (b). Given this annotated CFG, checking whether q is used initialized then amounts to checking the following CTL formula. AG declq ⇒ (A ¬readq W writeq )

(1)

CTL uses the path quantifiers A and E, and the temporal operators G, F, X, and U. The (state) formula Aφ means that φ has to hold on all paths, while Eφ means that φ has to hold on some path. The (path) formulae Gφ, Fφ and Xφ mean that φ holds globally in all states, in some state, or in the next state of a path, respectively. The until φUψ means that until a state occurs along the path that satisfies ψ, property φ has to hold. We also use the weak until φWψ. It differs from the until in that either φ holds until ψ holds, or φ holds globally along the path. The weak until operator does not require that ψ holds for any state along the paths, as long as φ holds everywhere. It can also be expressed 1

http://nicta.com.au/research/projects/goanna

270

A. Fehnker et al.

1 2 3 4 5 6 7 8 9 10 11

int fibonacci(int n) { int x = 0, y = 1, q, i = 0; do { int oldy = y; y = x; q = x + oldy; x = q; i++; } while(i < n); return q; } (a)

l1 decl_q l2 l5

l4

l3

l8

l9

write_q l6 read_q l7

read_q l10

(b)

Fig. 1. (a) Example C program, and (b) annotated control flow graph (CFG). Each node corresponds to one line-of-code for simplicity.

in terms of the other operators. In CTL a path quantifier is always paired with a temporal operator. For a formal definition of CTL we refer the reader to [15]. CTL formula (1) means that whenever variable q has been declared, it cannot be read until it is written, or it is never read at all. Note, that the annotated CFG in Fig. 1 (b) satisfies CTL formula (1). Once patterns relevant for matching atomic propositions have been defined, the CFG will be annotated automatically, and it is straightforward to translate the annotated graph automatically into a Kripke structure, which can then be analyzed by a model checker. Adding new checks only requires to define the property to be checked and the patterns representing atomic propositions. We implemented this framework in our tool Goanna. Goanna is able to handle full C/C++ including compiler-dependent switches for the GNU gcc compiler and uses the open source model checker NuSMV [15] as its generic analysis engine. The run-times are typically in the order of the compilation, i.e., we experience an average overhead of 2 to 3 times the compilation time.

4

Codifying the Rules

Microcontroller code is different from common C/C++ source code, and the rules that were developed for large code bases, such as Firefox, have limited applicability in this domain. For example, the standard Goanna tool with its predefined properties does not produce any warnings for the microcontrollerspecific case study presented in Section 5. This section describes how to define platform-specific properties that look for common deficiencies in microcontroller code. Three aspects of microcontroller code are especially prone to error: the correct handling of interrupts, the correct call to and the correct use of timers, and the use of special function registers. For this paper, we have chosen to develop rules specific for the ATMEL ATmega16, to illustrate the approach, but the rules can be extended and changed to fit other platforms as well.

Automatic Bug Detection in Microcontroller Software

4.1

271

Incorrect-Interrupt-Handling Check

A common cause of bugs in microcontroller code is the incorrect disabling and enabling of interrupts in interrupt service routines (ISRs). The ATmega16 provides two types of ISRs. The first type disables by default all interrupts at the beginning of the ISR, and enables them by default when it has been handled. The programmer should at no point in the ISR enable or disable any interrupt. The second type of ISRs requires from the programmer to pair enabling and disabling of interrupts. He has to disable them before he can enable them. Unlike other microcontrollers, the ATmega16 does not provide interrupts with priorities, and typically also not that ISRs can be preempted. To deal with interrupt handling we define syntactic patterns for the following labels: - signal

is the label for the entry to an ISR that automatically disables interrupts when entering and enables interrupts when leaving. Interrupts should not be enabled or disabled in this routine. - interrupt is the label for the entry to an ISR that does not disable interrupts when entering and does not enable interrupts when leaving. If someone disables interrupts in this handler, he should enable them afterwards. - cli is the label for register assignments that disable all interrupts. - sei is the label for register assignments that enable all interrupts. - fnend is the label for the end of the routine.

Note, that the preprocessor replaces the commands cli and sei by register assignments, i.e., our patterns work on these assignments. Given the labels defined above, we define the following rules for the scope of the ISR: – The rule that ISRs with the attribute signal should not enable or disable interrupts at all is expressed in CTL formula (2). AG (signal ⇒ (AG¬(cli ∨ sei )))

(2)

– Other ISRs, with the attribute signal, have to disable and enable interrupts themselves. If they do, they have to first disable the interrupts, i.e., they 133 134 135 136 137 138 139 140 141 142 143 144 145

//ISR for Timer0 Overflow SIGNAL (SIG_OVERFLOW0) { cli(); //deactivate all Interrupts outp(0x00,TCCR0); //stop Timer0 mode++; if(mode > 4) mode = 0;

}

outp(0x00,TCNT0); outp(0x04,TCCR0); sei();

//timer0 reset //start Timer0 with prescaler = 256 //activate all Interrupts

Fig. 2. Example of a non-interruptible routine violating the interrupt-handling check

272

A. Fehnker et al.

cannot enable them, unless they have disabled them earlier. This is expressed in CTL formula (3). AG (interrupt ⇒ (A¬sei Wcli ))

(3)

We use the weak until operator W to denote that it is acceptable to never disable interrupts. – If interrupts are disabled, they should always be enabled before the routine leaves the ISR. This is encoded in CTL formula (4) AG (cli ⇒ (A¬fnend Wsei ))

(4)

– And finally, interrupts should not be enabled twice, without being disabled in-between, and vice versa, not disabled twice, without being enabled inbetween. This is encoded in formulae (5) and (6). AG (cli ⇒ AX(A¬cli Wsei )) AG (sei ⇒ AX(A¬sei Wcli ))

(5) (6)

The temporal operator AX is used in the last two CTL formulae because each state labelled cli trivially violates A¬cli Wsei . This operator states that after a state labelled cli there should not follow another state labelled cli , unless a state labelled sei has been encountered earlier along the same path. Example. Figure 2 shows a routine with attribute signal, which means that it is not interruptible. Interrupts are disabled before the routine is entered. Use of sei() in line 144 opens a window for other routines to interfere, and to corrupt the stack. This ISR does not satisfy (2), and this bug will be flagged as an error. 4.2

Incorrect-Timer-Service Check

The ATmega16 has three timers. The programmer can define different ISRs for these timers. It can be syntactically checked which timer a service routine should refer to. Two of the three timers have two configuration registers, and the other one four. When a routine uses one type of timer, the programmer should not change the configuration registers of other timers. For each timer i, we introduce the following labels: - timer i is the label for the entry to a routine that should use timer i. - config i is the label for an assignment to registers that modifies the configuration registers of timer i For instance, timer 0 is used correctly if CTL formula (7) holds. We include analogous checks for timers 1 and 2. AG (timer 0 ⇒ (AG¬(config 1 ∨ config 2 )))

(7)

Example. Figure 3 shows an example of an ISR that violates this check. At line 20, timer 0 is assigned an initial value, but the routine was triggered by timer 2.

Automatic Bug Detection in Microcontroller Software 18 19 20 21 22

273

SIGNAL (SIG_OVERFLOW2) { TCNT0 = START_VALUE; // reload timer with initial value ++g_ticks; }

Fig. 3. Example of a routine violating the interrupt-service check

4.3

Register-to-Reserved-Bits Check

The ATmega16 data sheet defines for each register the use of its bits, but it also defines which bits are reserved and should not be used. The Global Interrupt Control Register (GICR), for example, is a register used to store which interrupts have been enabled. For the ATmega16 five bits are used; the three most significant bits to enable or disable external interrupts, and the two least significant bits are used to handle the so called Interrupt Vector table. The three remaining bits are reserved. Bits in registers may be reserved because they are used internally, by future extensions of the ATMega16, or by other microcontrollers of the same family, such as the ATmega128. If a program modifies reserved bits while running on an ATmega16, it might not cause any unexpected behavior. Such deficiencies may remain undetected by any amount of testing on the ATmega16, but only once the program is deployed to a different or extended platform they cause problems. The data sheet detailing the reserved bits of the ATmega16 can be viewed as a map from addresses to reserved bits. The reserved bits are akin to a mask. For the ATMega16 there are 14 registers that have reserved bits. It is easy to adapt this mapping from registers to reserved bits for other platforms. Given such a mapping from registers to masks, any assignment to a register that matches a mask is a potential deficiency. Checking if an assignment accesses a certain register, say GICR, is a syntactic check. Checking if the assigned value matches the associated mask of reserved bits is also a syntactic check. If this happens it is flagged as a violation of the register-to-reserved-bit check. The check can be formulated as an invariant AG¬assign reservedi , where assign reservedi is a proposition that can be syntactically defined on the AST for a mask i. Example. Figure 4 shows an example microcontroller code that violates the reserved-bit property. At line 66 reserved bit 5 of the Timer/Counter1 Control Register B (TCCR1B) is set to zero. If the programmer had used TCCR1B = TCCR1B | 1

SOFSEM 2009: Theory and Practice of Computer Science, 35 conf

SOFSEM 2005: Theory and Practice of Computer Science, 31 conf

SOFSEM 2006: Theory and Practice of Computer Science, 32 conf

SOFSEM 2007.. Theory and Practice of Computer Science, 33 conf

SOFSEM 2004: Theory and Practice of Computer Science, 30 conf

SOFSEM 2011: Theory and Practice of Computer Science

SOFSEM 2000: Theory and Practice of Informatics, 27 conf

SOFSEM 2001: Theory and Practice of Informatics, 28 conf

SOFSEM 2006: Theory and Practice of Computer Science: 32nd Conference on Current Trends in Theory and Practice of Computer Science, Merin, Czech Republic, ... Computer Science and General Issues)

SOFSEM 2005: Theory and Practice of Computer Science: 31st Conference on Current Trends in Theory and Practice of Computer Science, Liptovský Ján, ... Computer Science and General Issues)

Category Theory and Computer Science, 4 conf

SOFSEM 95: 22 conf

Category Theory and Computer Science, 6 conf., CTCS '95

Computer Aided Verification, 21 conf., CAV 2009

Mathematical Foundations of Computer Science 3 conf

Logical Foundations of Computer Science, LFCS 2009

Replication: Theory and Practice (Lecture Notes in Computer Science Theoretical Computer Science and General Issues)

Computer Aided Molecular Design: Theory and Practice

Computer Network Security. Theory and Practice

Computer Science Logic, 8 conf., CSL '94

Computer Science Logic, 10 conf., CSL '96

Computer Science Logic, 12 conf., CSL '98

CSL '88 Computer Science Logic 2 conf

Computer Science Logic, 17 conf., CSL 2003

Computer Science Logic, 4 conf., CSL '90

Computer Science Logic, 6 conf., CSL '92

Theoretical Computer Science, 7 conf., ICTCS 2001

Computer Science Logic, 19 conf., CSL 2005

Computer Science Logic, 22 conf., CSL 2008

Computer Science Logic, 9 conf., CSL '95

Theoretical Computer Science, 9 conf., ICTCS 2005

SOFSEM 2009: Theory and Practice of Computer Science, 35 conf

SOFSEM 2005: Theory and Practice of Computer Science, 31 conf

SOFSEM 2006: Theory and Practice of Computer Science, 32 conf

SOFSEM 2007.. Theory and Practice of Computer Science, 33 conf

SOFSEM 2004: Theory and Practice of Computer Science, 30 conf

SOFSEM 2011: Theory and Practice of Computer Science

SOFSEM 2000: Theory and Practice of Informatics, 27 conf

SOFSEM 2001: Theory and Practice of Informatics, 28 conf

SOFSEM 2006: Theory and Practice of Computer Science: 32nd Conference on Current Trends in Theory and Practice of Computer Science, Merin, Czech Republic, ... Computer Science and General Issues)

SOFSEM 2005: Theory and Practice of Computer Science: 31st Conference on Current Trends in Theory and Practice of Computer Science, Liptovský Ján, ... Computer Science and General Issues)

Category Theory and Computer Science, 4 conf

SOFSEM 95: 22 conf

Category Theory and Computer Science, 6 conf., CTCS '95

Computer Aided Verification, 21 conf., CAV 2009

Mathematical Foundations of Computer Science 3 conf

Logical Foundations of Computer Science, LFCS 2009

Replication: Theory and Practice (Lecture Notes in Computer Science Theoretical Computer Science and General Issues)

Computer Aided Molecular Design: Theory and Practice

Computer Network Security. Theory and Practice

Computer Science Logic, 8 conf., CSL '94

Computer Science Logic, 10 conf., CSL '96

Computer Science Logic, 12 conf., CSL '98

CSL '88 Computer Science Logic 2 conf

Computer Science Logic, 17 conf., CSL 2003

Computer Science Logic, 4 conf., CSL '90

Computer Science Logic, 6 conf., CSL '92

Theoretical Computer Science, 7 conf., ICTCS 2001

Computer Science Logic, 19 conf., CSL 2005

Computer Science Logic, 22 conf., CSL 2008

Computer Science Logic, 9 conf., CSL '95

Theoretical Computer Science, 9 conf., ICTCS 2005

Recommend Documents