Theoretical Computer Science, 8 conf., ICTCS 2003

Lecture Notes in Computer Science Edited by G. Goos, J. Hartmanis, and J. van Leeuwen 2841 3 Berlin Heidelberg New Y...

Author: Carlo Blundo | Cosimo Laneve

11 downloads 1161 Views 3MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

Lecture Notes in Computer Science Edited by G. Goos, J. Hartmanis, and J. van Leeuwen

2841

3

Berlin Heidelberg New York Hong Kong London Milan Paris Tokyo

Carlo Blundo Cosimo Laneve (Eds.)

Theoretical Computer Science 8th Italian Conference, ICTCS 2003 Bertinoro, Italy, October 13-15, 2003 Proceedings

13

Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands Volume Editors Carlo Blundo Università degli Studi di Salerno Dipartimento di Informatica ed Applicazioni Via. S. Allende, 43, 84081 Baronissi (SA), Italy E-mail: [email protected] Cosimo Laneve Università degli Studi di Bologna Dipartimento di Scienze dell’Informazione Mura Anteo Zamboni 7, 40127 Bologna, Italy E-mail: [email protected] Cataloging-in-Publication Data applied for A catalog record for this book is available from the Library of Congress. Bibliographic information published by Die Deutsche Bibliothek Die Deutsche Bibliothek lists this publication in the Deutsche Nationalbibliografie; detailed bibliographic data is available in the Internet at .

CR Subject Classification (1998): F, E.1, G.1-2 ISSN 0302-9743 ISBN 3-540-20216-1 Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer-Verlag Berlin Heidelberg New York a member of BertelsmannSpringer Science+Business Media GmbH http://www.springer.de © Springer-Verlag Berlin Heidelberg 2003 Printed in Germany Typesetting: Camera-ready by author, data conversion by Olgun Computergrafik Printed on acid-free paper SPIN: 10958179 06/3142 543210

Preface

The Eighth Italian Conference on Theoretical Computer Science (ICTCS 2003) was held at the University Residential Center of Bertinoro, Italy, on October 13–15 2003. The center is composed of three large historical and monumental buildings not far from one another, forming a united complex on the top of the built up area of the ancient town of Bertinoro. Previous conferences took place in Pisa (1972), Mantova (1974 and 1989), L’Aquila (1992), Ravello (1995), Prato (1998), and Torino (2001). The conference aims at bringing together computer scientists, expecially young researchers, to foster cooperation and exchange ideas and results. Its main topics include: analysis and design of algorithms, data types and data structures, theory of logical design and layout, computability, complexity, automata, symbolic and algebraic computation, security, cryptography, specification and verification, formal languages, foundations of functional programming, foundations of logic programming, term-rewriting, semantics, type theory, new computing paradigms, parallel and distributed computation, theory of concurrency, theory of databases, theory of knowledge bases, theory of robotics. The program committee, consisting of 14 members, considered 65 papers and selected 27 for presentation. These papers were selected on the basis of originality, quality, and relevance to theoretical computer science. These proceedings include the revised versions of the 27 accepted papers and the invited talks by Marios Mavronicolas (Extreme Nash Equilibria), Martin Hofmann (Certification of Memory Usage), and Gérard Boudol (On Programming Models for Mobility). Paper selection was a difficult and challenging task, and many good submissions had to be rejected. Each submission was refereed by at least three reviewers and some had four reports or more. We are very grateful to all the program committee members, who devoted much effort and valuable time to reading and selecting the papers. In addition, we gratefully acknowledge the help of a large number of colleagues who reviewed submissions in their area of expertise. They are all listed on page VII. We apologize for any inadvertent omissions. Following the example of ICTCS 2001, we encouraged authors to submit their contributions in electronic format. We handled the submissions with CyberChair (http://www.CyberChair.org) a free Web-based paper submission and reviewing system. With reference to this, we would like to thank Luca Padovani who helped us a lot at various stages of the whole process. His computer skills and the time and effort he invested were crucial ingredients of our ability to run the program committee. Finally, we would like to thank all the authors that submitted their papers for making this conference possible, the program committee members, as well as all the conference participants. October 2003

C. Blundo C. Laneve

ICTCS 2003 October 13–15 2003, Bertinoro, Italy

Program Co-chairs Carlo Blundo Cosimo Laneve

Universit` a di Salerno, Italy Università di Bologna, Italy

General Chair Roberto Gorrieri

Universit` a di Bologna, Italy

Program Committee Carlo Blundo Flavio Corradini Mariangiola Dezani Raffaele Giancarlo Cosimo Laneve Stefano Levialdi Fabrizio Luccio Maurizio Martelli Simone Martini Ugo Montanari Andrea Pietracaprina Giovanni Pighizzini Roberto Segala Nicoletta Sabadini

Universit` a Universit` a Universit` a Universit` a Università Universit` a Universit` a Universit` a Universit` a Universit` a Universit` a Universit` a Universit` a Universit` a

di Salerno (Co-chair) dell’Aquila di Torino di Palermo di Bologna (Co-chair) di Roma di Pisa di Genova di Bologna di Pisa di Padova di Milano di Verona di Milano

Organizing Committee Andrea Asperti (Chair), Luca Padovani, Claudio Sacerdoti Coen, Lucian Wishick Universit` a di Bologna

Sponsoring Institutions The European Association of Theoretical Computer Science (EATCS) BICI: Bertinoro International Center for Informatics Department of Computer Science, University of Bologna Dipartimento di Informatica ed Applicazioni “R. M. Capocelli” Facolt` a di Scienze MM., FF. e NN. dell’Universit` a di Salerno Microsoft Research

Preface

VII

Referees Alessandro Aldini Vincenzo Ambriola Christoph Amb¨ uhl Marcella Anselmo Andrea Asperti Paolo Baldan Martin Berger Anna Bernasconi Elisa Bertino Daniela Besozzi Claudio Bettini Gianfranco Bilardi Chiara Bodei Paolo Boldi Diego Bonura Pierre Boudes Nadia Busi Elena Camossi Daniela Cancila Felice Cardone Walter Castelnovo Barbara Catania Franco Cazzaniga Andrea Clementi Gennaro Costagliola Stefania Costantini Rosario Culmone Ugo Dal Lago Ferruccio Damiani Vincent Danos Clelia De Felice Pierpaolo Degano Giuseppe della Penna Giorgio Delzanno Roberto De Prisco Vincenzo Deufemia

Roberto Di Cosmo Alessandra Di Pierro Sophia Drossopoulou Gianluigi Ferrari Mauro Ferrari Camillo Fiorentini Riccardo Focardi Maurizio Gabbrielli Vincenzo Gervasi Giorgio Ghelli Roberto Gorrieri Concettina Guerra Stefano Guerrini Min-Shiang Hwang Bengt Jonsson Dogan Kesdogan Aggelos Kiayias Kenji Kono Lars Kristiansen Sophie Laplante Salvatore La Torre Leonardo Lesmo Luigi Liquori Michele Loreti Roberto Lucchi Gerald Luettgen Elena Machkasova Fabio Mancinelli Leonardo Mariano Fabio Martinelli Viviana Mascardi Hernan Melgratti Greg Meredieth Carlo Mereghetti Emanuela Merelli G. Michele Pinna

Marino Miculan Eugenio Moggi Angelo Montanari Karl-Heinz Niggl Mario Ornaghi Carles Padro Elena Pagani Linda Pagli Beatrice Palano Giuseppe Persiano Alfonso Pierantonio Lucia Pomello Giuseppe Prencipe Geppino Pucci Gabriele Puppis D. Romana Cacciagrano Giuseppe Rosolini Luca Roversi Antonino Salibra Davide Sangiorgi Vladimir Sazonov Ivan Scagnetto Monica Sebillo Matteo Slanina Jeremy Sproston Simone Tini Paolo Torroni Emilio Tuosto Paola Velardi Rorbert F.C. Walters Herbert Wiklicky Lucian Wishick Gianluigi Zavattaro Elena Zucca

Table of Contents

Invited Talks Extreme Nash Equilibria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Martin Gairing, Thomas L¨ ucking, Marios Mavronicolas, Burkhard Monien, and Paul Spirakis

1

Certification of Memory Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Martin Hofmann On Programming Models for Mobility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Gérard Boudol

Program Design, Models and Analysis On the Computational Complexity of Cut-Elimination in Linear Logic . . . . 23 Harry G. Mairson and Kazushige Terui A Constructive Proof of the Soundness of the Encoding of Random Access Machines in a Linda Calculus with Ordered Semantics . . . . . . . . . . . . . . . . . . 37 Claudio Sacerdoti Coen Finite Horizon Analysis of Stochastic Systems with the Murϕ Verifier . . . . 58 Giuseppe Della Penna, Benedetto Intrigila, Igor Melatti, Enrico Tronci, and Marisa Venturini Zilli Towards Compact and Tractable Automaton-Based Representations of Time Granularities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Ugo Dal Lago, Angelo Montanari, and Gabriele Puppis Lower Bounds on the Size of Quantum Automata Accepting Unary Languages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Alberto Bertoni, Carlo Mereghetti, and Beatrice Palano Refined Effects for Unanticipated Object Re-classification: Fickle 3 . . . . . . . 97 Ferruccio Damiani, Sophia Drossopoulou, and Paola Giannini

Algorithms and Complexity Cost Constrained Fixed Job Scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Qiwei Huang and Errol Lloyd A Work-Optimal Coarse-Grained PRAM Algorithm for Lexicographically First Maximal Independent Set . . . . . . . . . . . . . . . . . . . 125 Jens Gustedt and Jan Arne Telle

X

Table of Contents

An Approximation Algorithm for the Minimum Weight Vertex-Connectivity Problem in Complete Graphs with Sharpened Triangle Inequality . . . . . . . . . . . . . . . 137 Alessandro Ferrante and Mimmo Parente Channel Assignment in Honeycomb Networks . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Alan A. Bertossi, Cristina M. Pinotti, Romea Rizzi, and Anil M. Shende Exact Solution of a Class of Frequency Assignment Problems in Cellular Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Tiziana Calamoneri The Complexity of Checking Consistency of Pedigree Information and Related Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 Luca Aceto, Jens A. Hansen, Anna Ing´ olfsd´ ottir, Jacob Johnsen, and John Knudsen On Clausal Equivalence and Hull Inclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 K. Subramani

Semantics and Formal Languages Logical Semantics for the First Order ς-Calculus . . . . . . . . . . . . . . . . . . . . . . . 202 Steffen van Bakel and Ugo de’Liguoro On the Expressive Power of Light Affine Logic . . . . . . . . . . . . . . . . . . . . . . . . . 216 Ugo Dal Lago Reasoning about Self and Others: Communicating Agents in a Modal Action Logic . . . . . . . . . . . . . . . . . . . . . . . 228 Matteo Baldoni, Cristina Baroglio, Alberto Martelli, and Viviana Patti Decidability Properties of Recursive Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 Felice Cardone and Mario Coppo Algebraic Theories for Contextual Pre-nets . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 Roberto Bruni, José Meseguer, Ugo Montanari, and Vladimiro Sassone A Coalgebraic Description of Web Interactions . . . . . . . . . . . . . . . . . . . . . . . . . 271 Daniela Cancila and Furio Honsell A Calculus for Dynamic Linking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284 Davide Ancona, Sonia Fagorzi, and Elena Zucca Towards a Smart Compilation Manager for Java . . . . . . . . . . . . . . . . . . . . . . . 302 Giovanni Lagorio

Table of Contents

XI

Security and Cryptography Anonymous Group Communication in Mobile Networks . . . . . . . . . . . . . . . . . 316 Stelvio Cimato, Paolo D’Arco, and Ivan Visconti Aspects of Pseudorandomness in Nonlinear Generators of Binary Sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 Amparo F´ uster-Sabater An Information-Theoretic Approach to the Access Control Problem . . . . . . 342 Anna Lisa Ferrara and Barbara Masucci Security-Aware Program Transformations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355 Massimo Bartoletti, Pierpaolo Degano, and Gian Luigi Ferrari Information Flow Security and Recursive Systems . . . . . . . . . . . . . . . . . . . . . . 369 Annalisa Bossi, Damiano Macedonio, Carla Piazza, and Sabina Rossi Compositional Verification of Secure Streamed Data: A Case Study with EMSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383 Fabio Martinelli, Marinella Petrocchi, and Anna Vaccarelli

Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397

Extreme Nash Equilibria Martin Gairing1 , Thomas L¨ ucking1 , Marios Mavronicolas2 , Burkhard Monien1 , and Paul Spirakis3 1

2

Faculty of Computer Science, Electrical Engineering and Mathematics, University of Paderborn, F¨ urstenallee 11, 33102 Paderborn, Germany {gairing,luck,bm}@uni-paderborn.de Department of Computer Science, University of Cyprus, 1678 Nicosia, Cyprus [email protected] 3 Computer Technology Institute, P. O. Box 1122, 261 10 Patras, Greece, & Department of Computer Engineering and Informatics, University of Patras, Rion, 265 00 Patras, Greece [email protected] Abstract. We study the combinatorial structure and computational complexity of extreme Nash equilibria, ones that maximize or minimize a certain objective function, in the context of a selfish routing game. Specifically, we assume a collection of n users, each employing a mixed strategy, which is a probability distribution over m parallel links, to control the routing of its own assigned traffic. In a Nash equilibrium, each user routes its traffic on links that minimize its expected latency cost. Our structural results provide substantial evidence for the Fully Mixed Nash Equilibrium Conjecture, which states that the worst Nash equilibrium is the fully mixed Nash equilibrium, where each user chooses each link with positive probability. Specifically, we prove that the Fully Mixed Nash Equilibrium Conjecture is valid for pure Nash equilibria and that under a certain condition, the social cost of any Nash equilibrium is within a factor of 6 + ε, of that of the fully mixed Nash equilibrium, assuming that link capacities are identical. Our complexity results include hardness, approximability and inapproximability ones. Here we show, that for identical link capacities and under a certain condition, there is a randomized, polynomial-time algorithm to approximate the worst social cost within a factor arbitrarily close to 6 + ε. Furthermore, we prove that for any arbitrary integer k > 0, it is N P-hard to decide whether or not any given allocation of users to links can be transformed into a pure Nash equilibrium using at most k selfish steps. Assuming identical link capacities, we give a polynomial-time approximation scheme (PTAS) to approximate the best social cost over all pure Nash equilibria. Finally we prove, that it is N P-hard to approxi2 mate the worst social cost within a multiplicative factor 2 − − ε. m+1 2 The quantity 2− is the tight upper bound on the ratio of the worst m+1 social cost and the optimal cost in the model of identical capacities.

This work has been partially supported by the IST Program of the European Union under contract numbers IST-1999-14186 (ALCOM-FT) and IST-2001-33116 (FLAGS), by funds from the Joint Program of Scientific and Technological Collaboration between Greece and Cyprus, and by research funds from the University of Cyprus.

C. Blundo and C. Laneve (Eds.): ICTCS 2003, LNCS 2841, pp. 1–20, 2003. c Springer-Verlag Berlin Heidelberg 2003

2

1

Martin Gairing et al.

Introduction

Motivation and Framework. A Nash equilibrium [21,22] represents a stable state of the play of a strategic game, in which each player holds an accurate opinion about the (expected) behavior of other players and acts rationally. An issue that arises naturally in this context concerns the computational complexity of Nash equilibria of any given strategic game. Due to the ultimate significance of Nash equilibrium as a prime solution concept in contemporary Game Theory [23], this issue has become a fundamental algorithmic problem that is being intensively studied in the Theory of Computing community today (see, e.g., [3,6,29]); in fact, it is arguably one of the few, most important algorithmic problems for which no general polynomial-time algorithms are known today (cf. [24]). The problem of computing arbitrary Nash equilibria becomes even more challenging when one considers extreme Nash equilibria, ones that maximize or minimize a certain objective function. So, understanding the combinatorial structure of extreme Nash equilibria is a necessary prerequisite to either designing efficient algorithms to compute them or establishing corresponding hardness and thereby designing efficient approximation algorithms. In this work, we embark on a systematic study of the combinatorial structure and the computational complexity of extreme Nash equilibria; our study is carried out within the context of a simple selfish routing game, originally introduced in a pioneering work by Koutsoupias and Papadimitriou [15], that we describe next. We assume a collection of n users, each employing a mixed strategy, which is a probability distribution over m parallel links, to control the shipping of its own assigned traffic. For each link, a capacity specifies the rate at which the link processes traffic. In a Nash equilibrium, each user selfishly routes its traffic on those links that minimize its expected latency cost, given the network congestion caused by the other users. A user’s support is the set of those links on which it may ship its traffic with non-zero probability. The social cost of a Nash equilibrium is the expectation, over all random choices of the users, of the maximum, over all links, latency through a link. Our study distinguishes between pure Nash equilibria, where each user chooses exactly one link (with probability one), and mixed Nash equilibria, where the choices of each user are modeled by a probability distribution over links. We also distinguish in some cases between models of identical capacities, where all link capacities are equal, and of arbitrary capacities. The Fully Mixed Nash Equilibrium Conjecture. In this work, we formulate and study a natural conjecture asserting that the fully mixed Nash equilibrium F is the worst Nash equilibrium with respect to social cost. Formally, we conjecture: Conjecture 1 (Fully Mixed Nash Equilibrium Conjecture). For any traffic vector w such that the fully mixed Nash equilibrium F exists, and for any Nash equilibrium P, SC (w, P) ≤ SC (w, F). Clearly, the Fully Mixed Nash Equilibrium Conjecture is intuitive and natural: the fully mixed Nash equilibrium favors “collisions” between different users (since each user assigns its traffic with positive probability to every link); thus,

Extreme Nash Equilibria

3

this increased probability of “collisions” favors a corresponding increase to the (expected) maximum total traffic through a link, which is, precisely, the social cost. More importantly, the Fully Mixed Nash Equilibrium Conjecture is also significant since it precisely identifies the worst possible Nash equilibrium for the selfish routing game we consider; this will enable designers of Internet protocols not only to avoid choosing the worst-case Nash equilibrium, but also to calculate the worst-case loss to the system at any Nash equilibrium due to its deliberate lack of coordination, and to evaluate the Nash equilibrium of choice against the (provably) worst-case one. Contribution and Significance. Our study provides quite strong evidence in support of the Fully Mixed Nash Equilibrium Conjecture by either establishing or near establishing the conjecture in a number of interesting instances of the problem. We start with the model of arbitrary capacities, where traffics are allowed to vary arbitrarily. There we prove that the Fully Mixed Nash Equilibrium Conjecture holds for pure Nash equilibria. We next turn to the case of identical capacities. Through a delicate probabilistic analysis, we establish that in the special case, that the number of links is equal to the number of users and for a suitable large number of users, the social cost of any Nash equilibrium is less than 6 + ε (for any ε > 0) times the social cost of the fully mixed Nash equilibrium. Our proof employs concepts and techniques from majorization theory [17] and stochastic orders [28], such as comparing two random variables according to their stochastic variability (cf. [26, Section 9.5]). For pure Nash equilibria we show that it is N P-hard to decide whether or not any given allocation of users to links can be transformed into a pure Nash equilibrium using at most k selfish steps, even if the number of links is 2. Furthermore, we prove that there exists a polynomial-time approximation scheme (PTAS) to approximate the social cost of the best pure Nash equilibrium to any arbitrary accuracy. The proof involves an algorithm that transforms any pure strategy profile into a pure Nash equilibrium with at most the same social cost, using at most n reassignments of users. We call this technique Nashification, and it may apply to other instances of the problem as well. Still for pure Nash equilibria, we give a tight upper bound on the ratio between SC(w, L) and OPT(w) for any Nash equilibrium L. Then we show that it is N P-hard to approximate the worst-case Nash equilibrium with a ratio that is better than this upper bound. We close our section about pure Nash equilibria with a pseudopolynomial algorithm for computing the worst-case Nash equilibrium for any fixed number of links. Related Work and Comparison. The selfish routing game considered in this paper was first introduced by Koutsoupias and Papadimitriou [15] as a vehicle for the study of the price of selfishness for routing over non-cooperative networks, like the Internet. This game was subsequently studied in the work of Mavronicolas and Spirakis [18], where fully mixed Nash equilibria were introduced and analyzed. In both works, the aim had been to quantify the amount of performance loss in routing due to selfish behavior of the users. (Later studies

4


of the selfish routing game from the same point of view, that of performance, include the works by Koutsoupias et al. [14], and by Czumaj and V¨ ocking [2].) The closest to our work is the one by Fotakis et al. [6], which focuses on the combinatorial structure and the computational complexity of Nash equilibria for the selfish routing game we consider. The Fully Mixed Nash Equilibrium Conjecture formulated and systematically studied in this paper has been inspired by two results due to Fotakis et al. [6] that confirm or support the conjecture. First, Fotakis et al. [6, Theorem 4.2] establish the Fully Mixed Nash Equilibrium Conjecture for the model of identical capacities and assuming that n = 2. Second, Fotakis et al. [6, Theorem 4.3] establish that, for the model of identical traffics and arbitrary capacities, the social cost of any Nash equilibrium is no more than 49.02 times the social cost of the (generalized) fully mixed Nash equilibrium; Note that Theorem 3 is incomparable to this result, since it assumes identical links and arbitrary traffics. The routing problem considered in this paper is equivalent to the multiprocessor scheduling problem. Here, pure Nash equilibria and Nashification translate to local optima and sequences of local improvements. A schedule is said to be jump optimal if no job on a processor with maximum load can improve by moving to another processor [27]. Obviously, the set of pure Nash equilibria is a subset of the set of jump optimal schedules. Moreover, in the model of identical processors every jump optimal schedule can be transformed into a pure Nash equilibrium without altering the makespan. Thus, for this model the strict upper bound 2 − 2/(m + 1) on the ratio between best and worst makespan of jump optimal schedules [5,27] also holds for pure Nash equilibria. Algorithms for computing a jump optimal schedule from any given schedule have been proposed in [1,5,27]. The fastest algorithm is given by Schuurman and Vredeveld [27]. It always moves the job with maximum weight from a makespan processor to a processor with minimum load, using O(n) moves. However, in all algorithms the resulting jump optimal schedule is not necessarily a Nash equilibrium. Road Map. The rest of this paper is organized as follows. Section 2 presents some preliminaries. Stochastic orders are treated in Section 3. Pure Nash equilibria are contrasted to the fully mixed Nash equilibrium in Section 4. Worst mixed Nash equilibria are contrasted to the fully mixed Nash equilibrium in Section 5. Sections 6 and 7 consider best and worst pure Nash equilibria, respectively. We conclude, in Section 8, with a discussion of our results and some open problems.

2

Framework

Most of our definitions are patterned after those in [18, Section 2] and [6, Section 2], which, in turn, were based on those in [15, Sections 1 & 2]. Mathematical Preliminaries and Notation. For any integer m ≥ 1, denote [m] = {1, . . . , m}. Denote Γ the Gamma function; that is, for any natural number ∞ N , Γ (N + 1) = N !, while for any arbitrary real number x > 0, Γ (x) = 0 tx−1 e−t dt. The Gamma function is invertible; both Γ and its in-


5

verse Γ −1 are increasing. It is well known that Γ −1 (N ) = lglglgNN (1 + o(1)) (see, e.g., [9]). For our purposes, we shall use the fact that for any α pair of an arbitrary real number α and an arbitrary natural number N , αe = N if and only if α = Γ −1 (N ) + Θ(1). For an event E in a sample space, denote Pr(E) the probability of event E happening. For a random variable X, denote E(X) the expectation of X. In the balls-andbins problem, m balls are thrown into m bins uniformly at random. (See [13] for a classical introduction to this problem.) It is known that the expected maximum number of balls thrown over a bin equals the quantity R(m) = Γ −1 (m) − 32 + o(1) [9]. In the paper, we make use of the following Hoeffding inequality: Theorem 1 ([19], Theorem 2.3.). Let the random variables X1 , X2 , ..., Xn be independent, with 0 ≤ Xk ≤ 1 for each k and let Sn = Xk . Then, for any β > 0, Pr(Sn ≥ (1 + β)E(Sn )) ≤ e−((1+β) ln(1+β)−β)E(Sn ) . Note that Theorem 1 also holds if 0 ≤ Xk ≤ κ for some constant κ > 0. General. We consider a network consisting of a set of m parallel links 1, 2, . . . , m from a source node to a destination node. Each of n network users 1, 2, . . . , n, or users for short, wishes to route a particular amount of traffic along a (non-fixed) link from source to destination. Denote wi the traffic of user i ∈ [n]. Define the n × 1 traffic vector w in the natural way. Assume throughout that m > 1 and n > 1. Assume also, without loss n of generality, that w1 ≥ w2 ≥ . . . ≥ wn . For a traffic vector w, denote W = 1 wi . A pure strategy for user i ∈ [n] is some specific link. A mixed strategy for user i ∈ [n] is a probability distribution over pure strategies; thus, a mixed strategy is a probability distribution over the set of links. The support of the mixed strategy for user i ∈ [n], denoted support(i), is the set of those pure strategies (links) to which i assigns positive probability. A pure strategy profile is represented by an n-tuple 1 , 2 , . . . , n ∈ [m]n ; a mixed strategy profile is represented by an n × m probability matrix P of nm probabilities pji , i ∈ [n] and j ∈ [m], where pji is the probability that user i chooses link j. For a probability matrix P, define indicator variables Ii ∈ {0, 1}, i ∈ [n] and ∈ [m], such that Ii = 1 if and only if pi > 0. Thus, the support of the mixed strategy for user i ∈ [n] is the set { ∈ [m] | Ii = 1}. For each link ∈ [m], define the view of link , denoted view (), as the set of users i ∈ [n] that may assign their traffics to link ; so, view () = {i ∈ [n] | Ii = 1}. For each link ∈ [m], denote V = |view ()|. A mixed strategy profile P is fully mixed [18, Section 2.2] if for all users i ∈ [n] and links j ∈ [m], Iij = 1 1 . System, Models and Cost Measures. Denote c > 0 the capacity of link ∈ [m], representing the rate at which the link processes traffic. So, the latency for traffic w through link equals w/c . In the model of identical capacities, all link capacities are equal to 1; link capacities may vary arbitrarily in the model of 1

An earlier treatment of fully mixed strategies in the context of bimatrix games has been found in [25], called there completely mixed strategies. See also [20] for a subsequent treatment in the context of strategically zero-sum games.

6


arbitrary capacities. For a pure strategy profile 1 , 2 , . . . , n , the latency cost for user i, denoted λi , is ( k:k =i wk )/ci ; that is, the latency cost for user i is the latency of the link it chooses. For a mixed strategy profile P, denote δ the actual traffic on link ∈ [m]; so, δ is a random variable for each link n ∈ [m], denote θ the expected traffic on link ∈ [m]; thus, θ = E(δ ) = i=1 pi wi . Given P, define the m × 1 expected traffic vector Θ induced by P in the natural way. Given P, denote Λ the expected latency on link ∈ [m]; clearly, Λ = θc . Define the m × 1 expected latency vector Λ in the natural way. For a mixed strategy profile P, the expected latency cost for user i ∈ [n] on link ∈ [m], denoted λi , is the expectation, over all random choices of the remaining users, of the latency cost for user i had its traffic been assigned to link ; thus, λi = wi +

pk wk

(1−p )w +θ

i i = . For each user i ∈ [n], the minimum expected c latency cost, denoted λi , is the minimum, over all links ∈ [m], of the expected latency cost for user i on link ; thus, λi = min∈[m] λi . For a probability matrix P, define the n × 1 minimum expected latency cost vector λ induced by P in the natural way. Associated with a traffic vector w and a mixed strategy profile P is the social cost [15, Section 2], denoted SC(w, P), which is the expectation, over all random choices of the users, of the maximum (over all links) latency of traffic through wk n k:k = k a link; thus, SC(w, P) = . p · max ∈[m] k=1 k 1 ,2 ,...,n ∈[m]n c k=1,k=i c

Note that SC (w, P) reduces to the maximum latency through a link in the case of pure strategies. On the other hand, the social optimum [15, Section 2] associated with a traffic vector w, denoted OPT(w), is the least possible maximum (over all links) latency of traffic through a link; thus, OPT(w) = min1 ,2 ,...,n ∈[m]n max∈[m]

k:k = c

wk

.

Nash Equilibria. We are interested in a special class of mixed strategies called Nash equilibria [21,22] that we describe below. Say that a user i ∈ [n] is satisfied for the probability matrix P if for all links ∈ [m], λi = λi if Ii = 1, and λi > λi if Ii = 0; thus, a satisfied user has no incentive to unilaterally deviate from its mixed strategy. A user i ∈ [n] is unsatisfied for the probability matrix P if i is not satisfied for the probability matrix P. The probability matrix P is a Nash equilibrium [15, Section 2] if for all users i ∈ [n] and links ∈ [m], λi = λi if Ii = 1, and λi > λi if Ii = 0. Thus, each user assigns its traffic with positive probability only on links (possibly more than one of them) for which its expected latency cost is minimized. The fully mixed Nash equilibrium [18], denoted F, is a Nash equilibrium that is a fully mixed strategy. Mavronicolas and Spirakis [18, Lemma 15] show that all links are equiprobable in a fully mixed Nash equilibrium, which is unique (for the model of identical capacities). Fix any traffic vector w. The worst Nash equilibrium is the Nash equilibrium P that maximizes SC (w, P); the best Nash equilibrium is the Nash equilibrium that minimizes SC (w, P). The worst social cost, denoted WC (w), is the social cost of the worst Nash equilibrium; correspondingly, the best social cost, denoted BC (w), is the social cost of the best Nash equilibrium.


7

Fotakis et al. [6, Theorem 1] consider starting from any arbitrary pure strategy profile and following a particular sequence of selfish steps, where in a selfish step, exactly one unsatisfied user is allowed to change its pure strategy. A selfish step is a greedy selfish step if the unsatisfied user chooses its best link. A (greedy) selfish step does not increase the social cost of the initial pure strategy profile. Fotakis et al. [6, Theorem 1] show that this sequence of selfish steps eventually converges to a Nash equilibrium, which proves its existence; however, it may take a large number of steps. It follows that if the initial pure strategy profile has minimum social cost, then the resulting (pure) Nash equilibrium will have minimum social cost as well. This implies that there exists a pure Nash equilibrium with minimum social cost. Thus, we have BC (w) = OPT (w). Algorithmic Problems. We list a few algorithmic problems related to Nash equilibria that will be considered in this work. The definitions are given in the style of Garey and Johnson [8]. A problem instance is a tuple (n, m, w, c) where n is the number of users, m is the number of links, w = (wi ) is a vector of n user traffics and c = (cj ) is a vector of m link capacities. Π1 : NASH EQUILIBRIUM SUPPORTS Instance: A problem instance (n, m, w, c). Output: Indicator variables Iij ∈ {0, 1}, where i ∈ [n] and j ∈ [m], that support a Nash equilibrium for the system of the users and the links. Fotakis et al. [6, Theorem 2] establish that NASH EQUILIBRIUM SUPPORTS is in P when restricted to pure equilibria. We continue with two complementary to each other optimization problems (with respect to social cost). Π2 : BEST NASH EQUILIBRIUM SUPPORTS Instance: A problem instance (n, m, w, c). Output: Indicator variables Iij ∈ {0, 1}, where i ∈ [n] and j ∈ [m], that support the best Nash equilibrium for the system of the users and the links. Π3 : WORST NASH EQUILIBRIUM SUPPORTS Instance: A problem instance (n, m, w, c). Output: Indicator variables Iij ∈ {0, 1}, where i ∈ [n] and j ∈ [m], that support the worst Nash equilibrium for the system of the users and the links. Fotakis et al. [6, Theorems 3 and 4] establish that both BEST NASH EQUILIBRIUM SUPPORTS and WORST NASH EQUILIBRIUM SUPPORTS are N P-hard. Since both problems can be formulated as an integer program, it follows that they are N P-complete. Π4 : NASH EQUILIBRIUM SOCIAL COST Instance: A problem instance (n, m, w, c); a Nash equilibrium P for the system of the users and the links. Output: The social cost of the Nash equilibrium P. Fotakis et al. [6, Theorem 8] establish that NASH EQUILIBRIUM SOCIAL COST is #P-complete. Furthermore, Fotakis et al. [6, Theorem 9] show that there exists a fully polynomial, randomized approximation scheme for NASH EQUILIBRIUM SOCIAL COST. The following two problems, inspired by NASH EQUILIBRIUM SOCIAL COST are introduced for the first time in this work.

8


Π5 : WORST NASH EQUILIBRIUM SOCIAL COST Instance: A problem instance (n, m, w, c). Output: The worst social cost WSC(w). Π6 : BEST NASH EQUILIBRIUM SOCIAL COST Instance: A problem instance (n, m, w, c). Output: The best social cost BSC(w). Π7 : k-NASHIFY Instance: A problem instance (n, m, w, c); a pure strategy profile L for the system of the users and the links. Question: Is there a sequence of at most k selfish steps that transform L to a (pure) Nash equilibrium? The following problem is a variant of k-NASHIFY in which k is part of the input. Π8 : NASHIFY Instance: A problem instance (n, m, w, c); a pure strategy profile L for the system of the users and the links; an integer k > 0. Question: Is there a sequence of at most k selfish steps that transform L to a (pure) Nash equilibrium? In our hardness and completeness proofs, we will employ the following N Pcomplete problems [12]: Π9 : BIN PACKING Instance: A finite set U of items, a size s(u) ∈ N for each u ∈ U, a positive integer bin capacity B, and a positive integer K. Question: Is there a partition of U into disjoint sets U1 , . . . , UK such that for each set Ui , 1 ≤ i ≤ K, u∈Ui s(u) ≤ B? Π10 : PARTITION Instance: A finite set U and a size s(u) ∈ N for each elementu ∈ U. Question: Is there a subset U ⊆ U such that u∈U s(u) = u∈U \U s(u)? We note that BIN PACKING is strongly N P-complete [7] 2 .

3

Stochastic Order Relations

In this section, we treat stochastic order relations; we establish a certain stochastic order relation for the expected maxima of certain sums of Bernoulli random variables. Recall that a function f : → is convex if for all numbers λ such that 0 < λ < 1, f (λx1 + (1 − λ)x2 ) ≤ λf (x1 ) + (1 − λ)f (x2 ). We proceed to describe a stochastic order relation between two random variables. Definition 1. For any pair of arbitrary random variables X and Y , say that X is stochastically more variable than Y if for all increasing and convex functions f : → , E(f (X)) ≥ E(f (Y )). 2

A problem is strongly N P-complete if it remains N P-complete even if any instance of length n is restricted to contain integers of size polynomial in n. So, strongly N Pcomplete problems admit no pseudopolynomial-time algorithms unless P = N P.


9

Call stochastically more variability the corresponding stochastic order relation on the set of random variables. (See [26, Section 9.5] for a more complete treatment of the notion of stochastically more variable and [17,28] for more on majorization theory and stochastic orders.) The following lemma [26, Proposition 9.5.1] provides an alternative, analytic characterization of stochastically more variability. Lemma 1. Consider any pair of non-negative random variables X and X. Then, X ∞is stochastically more ∞variable than X if and only if for all numbers > x)dx. α ≥ 0, x=α Pr(X > x)dx ≥ x=α Pr(X Consider now a setting of the balls-and-bins problem where n balls 1, . . . , n with traffics w1 , . . . , wn are allocated into m bins 1, . . . , m uniformly at random. So, for each pair of a ball i ∈ [n] and a link j ∈ [m], define Bernoulli random 1 1 variables Yij = wi with probability m and 0 with probability 1− m , and Yij = W n 1 1 with probability m and 0 with probability 1 − m . For each link j ∈ [m], define the random variables δ j = Y j and δ j = Y j ; thus, each of δ j i∈[n]

i

i∈[n]

i

and δ j , j ∈ [m], is a sum of Bernoulli random variables; denote θj = E(δ j )

j

j expectations of δ j and δ j , respectively. Note that θj = and θ = E( δ ) the 1 j 1

j E = i∈[n] E Yij = i∈[n] wi m = W +0 1− m i∈[n] Yi m , while θ = j 1 1 E(δ j ) = E = i∈[n] E Yij = i∈[n] W = W i∈[n] Yi n m +0 1− m m. So, θj = θ j for each bin j ∈ [m]. For two numbers x, y ∈ + define [x − y] =

x−y

:

if x > y

0 : else. We can then show the following preliminary lemma: n Lemma 2. Let bi ∈ + for i ∈ [n] and let d = n1 i=1 bi . Then for all x ≥ 0, n i=1 [bi − x] ≥ n · [d − x]. Proof. Without loss of generality, assume ≤ . . . ≤ bn . The claim is nthat b1 ≤ b2 n true if x > d. If x ≤ b1 , then x ≤ d and i=1 [bi − x] = = n · (d − x). i=1 (bi − n x) n Now let bj < x ≤ bj+1 and d > x. It follows that i=1 [bi −x] = i=j+1 (bi −x) = n n j n bi − (n − j)x = i=j+1 bi − n · x + j · x ≥ i=j+1 bi − n · x + i=1 bi = i=j+1 n

i=1 bi − n · x = n · (d − x) We finally prove: Lemma 3 (Stochastically More Variability Lemma). For any traffic vec 1 m m . tor w, max δ , . . . , δ is stochastically more variable than max δ 1 , . . . , δ

= Proof. Define the discrete random variables X = max{δ 1 , . . . , δ m } and X ∞

1 m . . . , δ }. By Lemma 1, it suffices to show that x=α Pr (X > x) dx ≥ max{δ , ∞

> x dx for all α ≥ 0. Let Sk be the collection of all pure strategy Pr X x=α

10


profiles, where the maximum number oftraffics on any link j ∈ [m] is exactly k. n If i = j, then Si ∩ Sj = ∅. Furthermore i= n Si = [m]n . For any pure strategy m profile L ∈ Sk , define Link(L) to be the smallest index of a link, holding k traffics. Furthermore, for any pure strategy profile L, let I(L) be the collection of users that are assigned to Link(L). Every set of k traffics is equal to some I(L), L ∈ Sk with the same probability, say pk . Define the actual traffic on Link(L) as b(L) = i∈I(L) wi . If all traffics are identical the actual traffic on Link(L) for a pure strategy profile L ∈ Sk is simply b(L) = k · W . n

Every pure strategy profile L ∈ [m]n occurs with the same probability m1n and defines together with b(L) a discrete random variable Z. Z is a discrete random variable that can take every possible value b(L), L ∈ [m]n . It is easy to see, that X is stochastically more variable than Z, since for any pure strategy profile L, Z refers to the actual traffic on Link(L), whereas X refers to the maximum actual traffic over all links. We will complete our proof by

Since Z and X

are disshowing, that Z is stochastically more variablethan X. ∞ n crete random variables x=α Pr(Z > x)dx = k= n (pk · Ak ) , where Ak = m ∞ k =

> x)dx = n n pk · A k , where A [b(L) − α] and Pr( X k= L∈Sk x=α m

|Sk | · [k · W n − α] Since for a fixed k each traffic contributes with the same proba bility to b(L), L∈Sk b(L) = |Sk | · k · W n . It follows from Lemma 2 that Ak ≥ Ak

which completes for each k. Therefore Z is stochastically more variable than X, the proof of the lemma.

By definition of stochastically more variability, Lemma 3 implies: Corollary 1. For any traffic vector w, 1 m m E max δ , . . . , δ . ≥ E max δ 1 , . . . , δ

In the balls-and-bins game in which m balls are thrown uniformly at random into m bins, Corollary 1 shows that, if the sum of the ball weights is the same, the expected maximum load over all bins is larger when the balls have different weights in comparison to all balls having the same weight.

4

Pure versus Fully Mixed Nash Equilibria

In this section, we establish the Fully Mixed Nash Equilibrium Conjecture for the case of pure Nash equilibria. This result holds also for the model of arbitrary capacities. We start by proving: Lemma 4. Fix any traffic vector w, mixed Nash equilibrium P and user i. Then, λi (w, P) ≤ λi (w, F). Proof. Let P = pjk , F = fkj for k ∈ [n] and j ∈ [m]. We can then state, that j j = p w w p k k j∈[m] k∈[n],k =i j∈[m] k = k∈[n],k =i wk , and k∈[n],k =i k j j = = j∈[m] k∈[n],k =i fk wk k∈[n],k =i wk j∈[m] fk k∈[n],k =i wk . It


11

j j = p w f w j∈[m] k∈[n],k =i k k j∈[m] k∈[n],k =i k k . Therefore there exists some link j0 ∈ [m] such that k∈[n],k =i pjk0 wk ≤ k∈[n],k =i fkj0 wk .

follows that

j Then, ≤ λji 0 (w, λi (w, P) P) (since j0λi is the minimum of all λi , j ∈ [n]) = j0 wi + p wk wi + f wk k∈[n],k=i k k∈[n],k=i k ≤ = λji 0 (w, F) = λi (w, F) (since fij0 > cj0 cj0 0 and F is a Nash equilibrium).

We now prove: Theorem 2. Fix any traffic vector w and pure Nash equilibrium L. Then, SC (w, L) ≤ SC (w, F). Proof. For each user i ∈ [n], λi (w, P) is the minimum, over all links j ∈ [m], of the expected latency cost for user i on link j, and SC (w, P) is the expectation of the maximum (over all links) latency of traffic through a link. This implies that λi (w, P) ≤ SC (w, P) for every mixed Nash equilibrium P. Hence, by Lemma 4: λi (w, P) ≤ λi (w, F) ≤ SC (w, F) The claim follows now since SC(w, L) = maxi∈[n] λi (w, L) holds for every pure Nash equilibrium L.

5

Worst Mixed Nash Equilibria

In this section we show that if n = m and m is suitable large then the social cost of any Nash equilibrium is at most 6 + ε times the social cost of the fully mixed Nash equilibrium. Theorem 3. Consider the model of identical capacities. Let n = m, m suitable large. Then, for any traffic vector w and Nash equilibrium P, SC (w, P) < (6 + ε) SC (w, F), for any ε > 0. Proof. Fix any traffic vector w and Nash equilibrium P. We start by showing a simple technical fact. Lemma 5. Fix any pair of a link ∈ [m] and a user i ∈ view (). Then, pi wi ≥ θ − W m. j j Proof. Clearly, j∈[m] θj = j∈[m] = i∈[n] = i∈[n] pi wi j∈[m] pi wi j = W . This implies that there exists some link ∈ [m] i∈[n] wi j∈[m] pi

such that θ ≤ W m . Note that by definition of social cost, λi = (1 − pi )wi + θ . W It follows that λi ≤ wi + m . On the other hand, λi = (1 − pi )wi + θ . Since i ∈ view (), we have, by definition of Nash equilibria, that λi ≤ λi W (with equality holding when i ∈ view ( )). It follows that (1−pi )wi +θ ≤ wi + m , or that pi wi ≥ θ − W

m , as needed.

As an immediate consequence of Lemma 5, we obtain: Corollary 2. Fix any link ∈ [m]. Then, θ ≤

V W . V −1 m

12


Proof. Clearly, by Lemma 5 it follows, θ = i∈[n] pi wi = i∈view () pi wi ≥ W W

θ − m , or θ ≤ V V −1 W i∈view () θ − m = V m , as needed. Since V ≥ 2,

V V −1

≤ 2. Thus, by Corollary 2:

Lemma 6. Fix any link ∈ [m] with V ≥ 2. Then, θ ≤ 2 W m. We now prove a complementary lemma. Fix any link ∈ [m] with V = 1. Let view(l) = {i}. Then θl = wi ≤ maxi wi ≤ OPT(w) ≤ SC (w, F). Thus: Lemma 7. Fix any link ∈ [m] with V = 1. Then, θ ≤ SC (w, F).

with all entries equal to W Use w to define the vector w n . By definition W

F) is the load m of each ball times the expected maxiof social cost, SC (w, mum number of balls thrown uniformly at random into m bins. Since n = m, SC(w

,F) W

F) = R(m) · W we can state SC (w, m , or m = R(m) . Fix now any link 2

j ∈ [n] with V j ≥ 2. Then, θj ≤ 2 W m (by Lemma 6) = R(m) SC (w, F) ≤ 2 R(m) SC (w, F) (by Corollary 1) . j Thus, for any constant ε > 0, Pr δ > 4 (1 + ε) SC (w, F) 2 ≤ Pr δ j > 4 (1 + ε) R(m) θj (since θj ≤ R(m) SC (w, F)) 2 j j j = Pr δ > 2 (1 + ε) R(m) θ = Pr δ > 2 (1 + ε) R(m) E δ j . ¿From Theorem 1 it follows that for any β > 0, Pr δ j ≥ (1 + β)E(δ j ) ≤ (1+β)E(δj ) j j eβE(δ ) e < . e−((1+β)ln(1+β)−β)E(δ ) = (1+β) j (1+β)E(δ ) 1+β

With (1 + β) = 2(1 + ε)R(m) we get: 2(1+ε)R(m) E (δj ) j e Pr δ > 4 (1 + ε) SC (w, F) < 2(1+ε)R(m) . Note that by definition of R(m), e 2Γ −1 (m)−3

e 2(1+ε)R(m)

e 2R(m) −1

e < 2 (Γ −1 (m)− 32 +o(1)) e+3 2 , which holds for

2(1+ε)R(m) e e Thus, for all such integers 2(1+ε)R(m) < 1 and 2(1+ε)R(m) 4 (1 + ε) SC (w, F) < 2(1+ε)R(m) . Note, how 2(1+ε)R(m) (1+ε)R(m) 2 2(1+ε)R(m) e e ever, that 2(1+ε)R(m) = 12 · < (1+ε)R(m) (1+ε)R(m) 2 2(1+ε)R(m) e , since 12 < 1. Define now α > 0 so that (1+ε)R(m) α α = m. Then, clearly, α = Γ −1 (m) + Θ(1). Note that (1 + ε)R(m) e = (1 + ε)Γ −1 (m) − (1 + ε) 32 + o(1) = (1 + ε)Γ −1 (m) + Θ(1) > α , for suitable x large m, since ε > 0. Since xe is an increasing function of x, this implies that


13

(1+ε)R(m) 2 e = m . Thus < m12 . It e (1+ε)R(m) j 1 follows that Pr δ > 4(1 + ε) SC (w, F) < m2 . Hence Pr max∈[m] | |V |≥2 δ > 4(1 + ε)SC (w, F) = Pr ∈[m] | |V |≥2 δ > 4(1 + ε)SC (w, F) ≤ 1 1 F) < ∈[m] | |V |≥2 Pr δ > 4(1 + ε)SC (w, ∈[m] | |V |≥2 m2 ≤ m · m2 = 1 m . Now, clearly, max∈[m] δ = max max∈[m] | |V |≥2 δ , max∈[m] | |V |=1 δ ≤ max∈[m] | |V |≥2 δ + max∈[m] | |V |=1 δ ≤ max∈[m] | |V |≥2 δ + maxi∈[n] wi ≤ max∈[m] | |V |≥2 δ j + OPT(w) , so that E max∈[m] δ ≤ E max∈[m] | |V |≥2 δ j + OPT(w) = E max∈[m] | |V |≥2 δ j + OPT(w) . Note, however, that E max∈[m] | |V |=1 δ j = 0≤δ≤W δ Pr max∈[m] ||V |≥2 δ = δ = 0≤δ≤4(1+ε)SC(w,F) δ Pr max∈[m] ||V |≥2 δ = δ + 4(1+ε)SC(w,F)

α α

Recall that there is a randomized, polynomial-time approximation scheme (RPTAS) to approximate the social cost of any Nash equilibrium (in particular, the fully mixed) within any arbitrary ε > 0 [6, Theorem 9]. Thus, since, by Theorem 3, the worst social cost is bounded by 6 + ε times the social cost of the fully mixed Nash equilibrium, this yields: Theorem 4. Consider the model of identical capacities. Let n = m, m suitable large. Then, there exists a randomized, polynomial-time algorithm with approximation factor 6 + ε, for any ε > 0, for WORST NASH EQUILIBRIUM SOCIAL COST. We significantly improve Theorem 3 under a certain assumption on the traffics. Theorem 5. Consider any traffic vector w such that w1 ≥ w2 + . . . + wn . Then, for any Nash equilibrium P, SC (w, P) ≤ SC (w, F). Proof. Since w1 ≥ w2 + . . . + wn , it follows that the link with maximum latency has user 1 assigned to it in any pure strategy profile. Thus, in particular, SC (w, P) = λ1 (w, P) and SC (w, F) = λ1 (w, F). By Lemma 4, λ1 (w, P) ≤ λ1 (w, F). It follows that SC (w, P) ≤ SC (w, F), as needed.

14

6


Best Pure Nash Equilibria and Nashification

We start by establishing N P-hardness for NASHIFY: Theorem 6. NASHIFY is N P-hard, even if m = 2. Proof. By reduction from PARTITION. Consider any arbitrary instance of PARTITION consisting of a set A of k items a1 , . . . , ak with sizes s(a1 ), . . . , s(ak ) ∈ N, for any integer k. Construct from it an instance of NASHIFY as follows: Set 1 n = 3k and m = 2. Set wi = s(ai ) for 1 ≤ i ≤ k, and wi = 2k for k + 1 ≤ i ≤ 3k. Take the pure strategy profile that assigns users 1, 2, . . . , 2k to link 1 and users 2k + 1, . . . , 3k to link 2. We establish that this yields a reduction from PARTITION to NASHIFY. Assume first that the instance is positive; that is, there exists a of PARTITION subset A ⊆ A such that a∈A s(a) = a∈A\A s(a). Since either |A | ≤ k2 or |A \ A | ≤ k2 , assume, without loss of generality, that |A | ≤ k2 . Note that each user assigned to link 1 is unsatisfied pure strategy profile in the constructed 1 since its latency cost on link 1 is a∈A s(a) + k · 2k = a∈A s(a) + 12 , while 1 its latency cost on link 2 is k · 2k = 12 , which is less. Thus, each step that transfers an unsatisfied user that corresponds to an element a ∈ A from link 1 to link 2 is a selfish step, and the sequence of steps that transfer all users that correspond to elements of A from link 1 to link 2 is a sequence of at most k k steps. As a result of this sequence of selfish steps, the latency of link 1 will 2 < be a∈A\A s(a) + 12 , while the latency of link 2 will be a∈A s(a) + 12 . Since a∈A s(a) = a∈A\A s(a), these two latencies are equal and the resulting pure strategy profile is therefore a Nash equilibrium which implies that NASHIFY is positive. Assume now that the instance of NASHIFY is positive; that is, there exists a sequence of at most k selfish steps that transforms the pure strategy profile in the constructed instance of NASHIFY to a Nash equilibrium. Assume that in the resulting pure strategy profile users corresponding to a subset A ⊆ A remain in link 1, users corresponding to the subset A \ A ⊆ A are transfered 1 to link 2, while the sums of traffics of users with traffic 2k that reside in link 1 and link 2 are x and 1 − x, respectively; thus, the latencies of links 1 and 2 are s(a) + x and s(a) + 1 − x, respectively. We consider two cases: a∈A a∈A\A Assume first that A = A. Then after at most k selfish steps the latency on link 2 is at most 1 whereas the latency on link 1 is at least a∈A s(a) ≥ k. So there exists an unsatisfied user a ∈ A, a contradiction to the fact that NASHIFY is positive. So let A = A. We show that this implies a∈A s(a) − a∈A\A s(a) = 0. Assume | a∈A s(a) − a∈A\A s(a)| = 0. Since the traffics of users in A are integer, this implies | a∈A s(a) − a∈A\A s(a)| ≥ 1. The fact that A = A shows that at least one user with large traffic was transformed to link 2. So we can make at most k − 1 selfish steps with the small traffics. However, transforming k − 1 small traffics to the link with smaller latency leaves one user with small a contradiction to the fact that NASHIFY is traffic unsatisfied, positive. So | a∈A s(a) − a∈A\A s(a)| = 0 which implies that PARTITION is positive.


15

Algorithm Anashif y : Input: A pure strategy profile L of n users with traffics w1 , . . . , wn . Output: A pure strategy profile L that is a Nash equilibrium. – Sort the user traffics in non-increasing order so that w1 ≥ . . . ≥ wn . – For each user i := 1 to n, do • remove user i from the link it is currently assigned; • find the link with the minimum latency; • reassign user i to the link . od – Return the resulting pure strategy profile L . Fig. 1. The algorithm Anashif y

We remark that NASHIFY is N P-complete in the strong sense (cf. [8, Section 4.2]) if m is part of the input. Thus, there is no pseudopolynomial-time algorithm for NASHIFY (unless P = N P). In contrast, there is a natural pseudopolynomialtime algorithm Ak−nashif y for k-NASHIFY, which exhaustively searches all sequences of k selfish steps; since a selfish step involves a (unsatisfied) user and a link for a total of mn choices, the running time of Ak−nashif y is Θ((mn)k ). We continue to present an algorithm Anashif y that solves NASHIFY when n selfish steps are allowed. The algorithm Anashif y sorts the user traffics in non-increasing order so that w1 ≥ . . . ≥ wn . Then for each user i := 1 to n, it removes user i from the link it is currently assigned, it finds the link with the minimum latency, and it reassigns user i to the link . We prove: Lemma 8. A greedy selfish step of an unsatisfied user i with traffic wi makes no user k with traffic wk ≥ wi unsatisfied. Proof. Let L = l1 , . . . , ln be a pure strategy profile. Furthermore, let p = li , j the latency of and let q be the link with minimum latency. Denote λj and λ link j ∈ [m] before and after user i changed its strategy, respectively. Assume that user k becomes unsatisfied due to the move of user i. Since only the latency on link p and q changed, we have to distinguish between two cases. Either lk = q and user k wants to change its strategy to p, or lk = q and user k becomes unsatisfied due to the additional traffic wi on link q. First, assume that lk = q, and that user k wants to change its strategy to p. p and therefore Since user i changed its strategy from p to q we know that λq < λ q p wk + λ < wk + λ . So if user k wants to change its strategy to p, then user k was already unsatisfied before user i changed its strategy, a contradiction.

q = λq − wk . We have For the case that the strategy of user k is q we define λ j j q

q + wk + wi . Therefore k stays ∀j ∈ [m] : λ + wk ≥ λ + wi ≥ λ + wi = λ satisfied.

16


Theorem 7. Let L = l1 , . . . , ln be a pure strategy profile for n users with traffics w1 , ..., wn on m links with social cost SC(w, L). Then algorithm Anashif y computes a Nash equilibrium from L with social cost ≤ SC(w, L) using O(n lg n) time. Proof. In order to complete the proof of Theorem 7, we have to show that algorithm Anashif y returns a pure strategy profile L that is a Nash equilibrium and has social cost SC(w, L ) ≤ SC(w, L). It is easy to see that SC(w, L ) ≤ SC(w, L), since for user j we always choose the link with lowest latency as its strategy. After every iteration the user that changed its strategy is satisfied. Since we go through the list of users in descending order of their traffic and because of Lemma 8, all users that changed their strategy in earlier iterations stay satisfied. Therefore after we went through the complete list of users, all users are satisfied and thus L is a Nash equilibrium. The running time of algorithm Anashif y is O(n lg n) for sorting the n user traffics, O(m lg m) for constructing a heap with all latencies in the input pure strategy profile L, and O(n lg m) for finding the minimum element of the heap in each of the n iterations of the algorithm. Thus, the total running time is O(n lg n+m lg m+n lg m). The interesting case is when m ≤ n (since otherwise, a single user can be assigned to each link, achieving an optimal Nash equilibrium). Thus, in the interesting case, the total running time of Anashif y is O(n lg n).

Running the PTAS of Hochbaum and Shmoys [10] for scheduling n jobs on m identical machines yields a pure strategy profile L such that SC (w, L) ≤ (1 + ε) OPT(w). On the other hand, applying the algorithm Anashif y on L yields a Nash equilibrium L such that SC (w, L ) ≤ SC (w, L). Thus, SC (w, L ) ≤ (1 + ε)OPT (w). Since also OPT (w) ≤ SC (w, L ), it follows that: Theorem 8. There exists a PTAS for BEST PURE NASH EQUILIBRIUM, for the model of identical capacities.

7

Worst Pure Nash Equilibria

Denote with m-WCpNE the decision problem corresponding to the problem to compute the worst-case pure Nash equilibrium for n users with traffics w1 , . . . , wn on m links. If m is part of the input, then we call the problem WCpNE. We first show: Theorem 9. Fix any traffic vector w and pure Nash equilibrium L. Then, SC(w,L) 2 OPT(w) ≤ 2 − m+1 . Furthermore, this upper bound is tight. Proof. Schuurman and Vredeveld [27] showed the tightness of the upper bound for jump optimal schedules proved by Finn and Horowitz [5]. Since every pure Nash equilibrium is also jump optimal, the upper bound follows directly. Greedy selfish steps on identical links can only increase the minimum load over all links. Thus, we can transform every jump optimal schedule into a Nash equilibrium without altering the makespan, proving tightness.


17

WC(w) Theorem 10. It is N P-hard to find a pure Nash equilibrium L with SC(w,L) < 2 2 − m+1 − ε, for any ε > 0. It is N P-hard in the strong sense if the number of links m is part of the input.

Proof. We show that for a certain class of instances we have to solve BIN PACKING in order to find a Nash equilibrium with desired property. BIN PACKING is N P-complete in the strong sense [8]. Consider an arbitrary instance of BIN PACKING consisting of a set of items U = {u1 , . . . , u|U | } with sizes s(uj ) ≤ δ, uj ∈U = m − 1, and K = m − 1 bins of capacity B = 1. From this instance we construct an instance for the stated problem as follows: Set ε = 2δ. There are n − 2 = |U| users with traffic wi = s(ui ) and two users with traffic wn−1 = wn = 1. Note that the social cost of a Nash Equilibrium is either 2 when the users with traffic 1 are on the same link, or at most m+1 m + δ otherwise. If BIN PACKING is negative, then there exists no Nash equilibrium with both users with traffic 1 on the same link. Thus every Nash equilibrium has the desired property. If BIN PACKING is positive, then there exists a Nash equilibrium with both users with traffic 1 on the same link. The social cost of this Nash equilibrium is WC(w) = 2. For any other Nash Equilibrium L where the users with traffic 1 use different links, SC(w, L) ≤ m+1 m + δ. This yields WC(w) ≥ SC(w, L)

2 m+1 m

=2−

+δ

=

2 m+1+

2m m + 1 + εm 2 εm 2 − ε. − >2− m + 1 + εm m +1 2

2 m+1 m εm 2

+

ε 2

=

So, to find a Nash equilibrium with desired property, we have to find a distribution of the small traffics w1 , . . . , wn−2 to m − 1 links which solves BIN PACKING. Since BIN PACKING is N P-hard in the strong sense, if the number of bins is part of the input, it follows that computing a pure Nash equilibrium L with WC(w) 2 SC(w,L) < 2 − m+1 − ε is also N P-hard in the strong sense, if m is part of the input.

Since WCpNE is N P-hard in the strong sense [6], there exists no pseudopolynomial algorithm to solve WCpNE. However, we can give such an algorithm for m-WCpNE. Theorem 11. There exists a pseudopolynomial-time algorithm for m-WCpNE. Proof. We start with the state set S0 in which all links are empty. After inserting the first i traffics the state set Si consists of all (2m)-tuples (λ1 , w ˜1 , . . . , λm , w ˜m ) describing a possible placement of the largest i traffics with λj being the latency on link j and w ˜j the smallest traffic placed on link j. We need at most m · |Si | i steps to create Si+1 from Si , and |Si | ≤ (Wi )m · (w1 )m , where Wi = j=1 wj . Therefore the overall computation time is bounded by O(n·m·W m ·(w1 )m ). The best-case Nash equilibrium and the worst-case Nash equilibrium can be found by exhaustive search over the state set Sn using O(n · m · W m · (w1 )m ) time.

Remark 1. Theorem 11 also holds for the case of arbitrary link capacities.

18

8


Conclusions and Discussion

In this work, we have studied the combinatorial structure and the computational complexity of the extreme (either worst or best) Nash equilibria for the selfish routing game introduced in the pioneering work of Koutsoupias and Papadimitriou [15]. Our study of the combinatorial structure has revealed an interesting, highly non-trivial, combinatorial conjecture about the worst such Nash equilibrium, namely the Fully Mixed Nash Equilibrium Conjecture, abbreviated as FMNE Conjecture; the conjecture states that the fully mixed Nash equilibrium [18] is the worst Nash equilibrium in the setting we consider. We have established that the FMNE Conjecture is valid when restricted to pure Nash equilibria. Furthermore, we have come close to establishing the FMNE Conjecture in its full generality by proving that the social cost of any (pure or mixed) Nash equilibrium is within a factor of 6 + ε, for any ε > 0, of that of the fully mixed Nash equilibrium, under the assumptions that all link capacities are identical, the number of users is equal to the number of links and the number of links is suitable large. The proof of this result has relied very heavily on applying and extending techniques from the theory of stochastic orders and majorization [17,28]; such techniques are imported for the first time into the context of selfish routing, and their application and extension are both of independent interest. We hope that the application and extension of techniques from the theory of stochastic orders and majorization will be valuable to further studies of the selfish routing game considered in this paper and for the analysis and evaluation of mixed Nash equilibria for other games as well. Our study of the computational complexity of extreme Nash equilibria has resulted in both positive and negative results. On the positive side, we have devised, for the case of identical link capacities, equal number of users and links and a suitable large number of links, a randomized, polynomial-time algorithm to approximate the worst social cost within a factor arbitrarily close to 6 + ε, for any ε > 0. The approximation factor 6 + ε of this randomized algorithm will immediately improve upon reducing 6 further down in our combinatorial result described above, relating the social cost of any Nash equilibrium to that of the fully mixed. We have also introduced the technique of Nashification as a tool for converging to a Nash equilibrium starting with any assignment of users to links in a way that does not increase the social cost; coupling this technique with a polynomial-time approximation scheme for the optimal assignment of users to links [10] has yielded a polynomial-time approximation scheme for the social cost of the best Nash equilibrium. In sharp contrast, we have established a tight limit on the approximation factor of any polynomial-time algorithm that approximates the social cost of the worst Nash equilibrium (assuming P = N P). Our approximability and inapproximability results for the best and worst Nash equilibria, respectively, establish an essential difference between the approximation properties of the two types of extreme Nash equilibria. The most obvious problem left open by our work is to establish the FMNE Conjecture. Some progress on this problem has been already reported by L¨ ucking et al. [16], where the conjecture is proved in various special cases of the model of


19

selfish routing introduced by Koutsoupias and Papadimitriou [15] and considered in this work; furthermore, L¨ ucking et al. disprove the FMNE Conjecture in a different model for selfish routing that borrows from the model of unrelated machines [11] studied in the scheduling literature. The technique of Nashification, as an algorithmic tool for the computation of Nash equilibria, deserves also further study. Some steps in this direction have been taken already by Feldmann et al. [4].

Acknowledgments We would like to thank Rainer Feldmann and Manuel Rode for many fruitful discussions. We are also very grateful to Petra Berenbrink and Tasos Christophides for many helpful discussions on stochastic orders.

References 1. P. Brucker, J. Hurink and F. Werner, “Improving Local Search Heuristics for Some Scheduling Problems. Part II,” Discrete Applied Mathematics, Vol. 72, No.1-2, pp. 47–69, 1997. 2. A. Czumaj and B. V¨ ocking, “Tight Bounds for Worst-Case Equilibria,” Proceedings of the 13th Annual ACM Symposium on Discrete Algorithms, pp. 413–420, January 2002. 3. X. Deng, C. Papadimitriou and S. Safra, “On the Complexity of Equilibria,” Proceedings of the 34th Annual ACM Symposium on Theory of Computing, pp. 67–71, May 2002. 4. R. Feldmann, M. Gairing, T. L¨ ucking, B. Monien and M. Rode, “Nashification and the Coordination Ratio for a Selfish Routing Game,” Proceedings of the 30th International Colloquium on Automata, Languages and Programming, pp. 514–526, Vol. 2719, Lecture Notes in Computer Science, Springer-Verlag, Eindhoven, The Netherlands, June/July 2003. 5. G. Finn and E. Horowitz, “A linear time approximation algorithm for multiprocessor scheduling,” BIT, Vol. 19, pp. 312–320, 1979. 6. D. Fotakis, S. Kontogiannis, E. Koutsoupias, M. Mavronicolas and P. Spirakis, “The Structure and Complexity of Nash Equilibria for a Selfish Routing Game,’ Proceedings of the 29th International Colloquium on Automata, Languages and Programming, pp. 123–134, Vol. 2380, Lecture Notes in Computer Science, Springer-Verlag, M´ alaga, Spain, July 2002. 7. M. R. Garey and D. S. Johnson, “Complexity Results for Multiprocessor Scheduling Under Resoiurce Constraints,” SIAM Journal on Computing, Vol. 4, pp. 397– 411, 1975. 8. M. R. Garey and D. S. Johnson, Computers and intractability: A Guide to the Theory of NP-Completeness, W. H. Freeman and Company, 1979. 9. G. H. Gonnet, “Expected Length of the Longest Probe Sequence in Hash Code Searching,” Journal of the ACM, Vol. 28, No. 2, pp. 289–304, April 1981. 10. D. S. Hochbaum and D. Shmoys, “Using Dual Approximation Algorithms for Scheduling Problems: Theoretical and Practical Results,” Journal of the ACM, Vol. 34, No. 1, pp. 144–162, 1987.

20


11. E. Horowitz and S. Sahni, “Exact and Approximate Algorithms for Scheduling Non-Identical Processors,” Journal of the ACM, Vol. 23, No. 2, pp. 317–327, 1976. 12. R. M. Karp, “Reducibility among Combinatorial Problems,” in R. E. Miller and J. W. Thatcher eds., Complexity of Computer Computations, pp. 85–103, Plenum Press, New York, 1972. 13. V. F. Kolchin, V. P. Chistiakov and B. A. Sevastianov, Random Allocations, V. H. Winston, New York, 1978. 14. E. Koutsoupias, M. Mavronicolas and P. Spirakis, “Approximate Equilibria and Ball Fusion,” Proceedings of the 9th International Colloquium on Structural Information and Communication Complexity, Andros, Greece, June 2002. Accepted to Theory of Computing Systems. Earlier version appeared as “A Tight Bound on Coordination Ratio,” Technical Report 0100229, Department of Computer Science, University of California at Los Angeles, April 2001. 15. E. Koutsoupias and C. H. Papadimitriou, “Worst-case Equilibria,” Proceedings of the 16th Annual Symposium on Theoretical Aspects of Computer Science, G. Meinel and S. Tison eds., pp. 404–413, Vol. 1563, Lecture Notes in Computer Science, Springer-Verlag, Trier, Germany, March 1999. 16. T. L¨ ucking, M. Mavronicolas, B. Monien, M. Rode, P. Spirakis and I. Vrto, “Which is the Worst-case Nash Equilibrium?” 26th International Symposium on Mathematical Foundations of Computer Science, August 2003, to appear. 17. A. Marshall and I. Olkin, Theory of Majorization and Its Applications, Academic Press, Orlando, FL, 1979. 18. M. Mavronicolas and P. Spirakis, “The Price of Selfish Routing,” Proceedings of the 33rd Annual ACM Symposium on Theory of Computing, pp. 510–519, July 2001. 19. C. McDiarmid, “Concentration,” Chapter 9 in Probabilistic Methods for Algorithmic Discrete Mathematics, M. Habib, C. McDiarmidt, J. Ramires-Alfonsin and B. Reed eds., Springer, 1998. 20. H. Moulin and L. Vial, “Strategically Zero-Sum Games: The Class of Games whose Completely Mixed Equilibria Cannot be Improved Upon,” International Journal of Game Theory, Vol. 7, Nos. 3/4, pp. 201–221, 1978. 21. J. F. Nash, “Equilibrium Points in N -Person Games,” Proceedings of the National Academy of Sciences, Vol. 36, pp. 48–49, 1950. 22. J. F. Nash, “Non-cooperative Games,” Annals of Mathematics, Vol. 54, No. 2, pp. 286–295, 1951. 23. M. J. Osborne and A. Rubinstein, A Course in Game Theory, The MIT Press, 1994. 24. C. H. Papadimitriou, “Algorithms, Games and the Internet,” Proceedings of the 33rd Annual ACM Symposium on Theory of Computing, pp. 749–753, July 2001. 25. T. E. S. Raghavan, “Completely Mixed Strategies in Bimatrix Games,” Journal of London Mathematical Society, Vol. 2, No. 2, pp. 709–712, 1970. 26. S. M. Ross, Stochastic Processes, Second Edition, John Wiley & Sons, Inc., 1996. 27. P. Schuurman and T. Vredeveld, “Performance Guarantees of Load Search for Multiprocessor Scheduling,” Proceedings of the 8th Conference on Integer Programming and Combinatorial Optimization, pp. 370–382, June 2001. 28. M. Shaked and J. G. Shanthikumar, Stochastic Orders and Their Applications, Academic Press, San Diego, CA, 1994. 29. A. Vetta, “Nash Equilibria in Competitive Societies, with Applications to Facility Location, Traffic Routing and Auctions,” Proceedings of the 43rd Annual IEEE Symposium on Foundations of Computer Science, October 2002, pp. 416–425.

Certification of Memory Usage Martin Hofmann Institut f¨ ur Informatik Ludwig-Maximilians-Universit¨ at M¨ unchen Oettingenstrasse 67 D-80538 M¨ unchen, Germany

Abstract. We describe a type-based approach for inferring heap space usage of certain functional programs and a mechanism for generating certificates as to the thus inferred memory consumption in the form of proofs in a VDM-style program logic fore Java bytecode (Java bytecode being the target of compilation). This gives a current snapshot of our work in the EU-funded project ‘Mobile Resource Guarantees’ http://www.dcs.ed.ac.uk/home/mrg/ between LMU-Munich and LFCS Edinburgh.

C. Blundo and C. Laneve (Eds.): ICTCS 2003, LNCS 2841, p. 21, 2003. c Springer-Verlag Berlin Heidelberg 2003

On Programming Models for Mobility Gérard Boudol INRIA 2004, Route des Lucioles B.P. 93 06902 Sophia Antipolis Cedex, France

Abstract. In this talk I will discuss some models for mobile code from a programming perspective. I will first present some requirements for this style of programming, arising from the features of the “global computing” context. Then I will discuss some of the models and programming languages that have been proposed - Obliq, pi-based and Linda-based models, Ambients. I will then present a model based on the ideas of “synchronous” programming, that is based on suspension and preemption primitives associated with locally broadcast events.

C. Blundo and C. Laneve (Eds.): ICTCS 2003, LNCS 2841, p. 22, 2003. c Springer-Verlag Berlin Heidelberg 2003

On the Computational Complexity of Cut-Elimination in Linear Logic Harry G. Mairson1 and Kazushige Terui2, 1

2

Computer Science Department, Brandeis University, Waltham, Massachusetts 02454, USA [email protected] National Institute of Informatics, 2-1-2 Hitotsubashi, Chiyoda-ku, 101-8430 Tokyo, Japan [email protected]

Abstract. Given two proofs in a logical system with a confluent cutelimination procedure, the cut-elimination problem (CEP) is to decide whether these proofs reduce to the same normal form. This decision problem has been shown to be ptime-complete for Multiplicative Linear Logic (Mairson 2003). The latter result depends upon a restricted simulation of weakening and contraction for boolean values in MLL; in this paper, we analyze how and when this technique can be generalized to other MLL formulas, and then consider CEP for other subsystems of Linear Logic. We also show that while additives play the role of nondeterminism in cut-elimination, they are not needed to express deterministic ptime computation. As a consequence, affine features are irrelevant to expressing ptime computation. In particular, Multiplicative Light Linear Logic (MLLL) and Multiplicative Soft Linear Logic (MSLL) capture ptime even without additives nor unrestricted weakening. We establish hierarchical results on the cut-elimination problem for MLL (ptime-complete), MALL (coNP-complete), MLLL (EXPTIMEcomplete), and for MLLL (2EXPTIME-complete).

1

Introduction

Cut-elimination is naturally seen as a function from proofs to their normal form, and we can derive from it an equally natural decision problem: if L is a logical system with a confluent cut-elimination procedure, and we are given two proofs in L, do they reduce to the same normal form? Call this the cut elimination problem (CEP). When L has reasonable representations of boolean values as proofs, an even simpler decision problem is to ask: given a proof, does it reduce to the representation for “true”? Through the Curry-Howard correspondence, we know that proofs in linear logics represent programs, typically in a functional programming language with

Supported by “Software Evolution for Declarative Programming” project in Grantin-Aid of Scientific Research on Priority Area “Informatics Studies for the Foundation of IT Evolution,” MEXT, JAPAN.


24

Harry G. Mairson and Kazushige Terui

highly specified forms of copying, where cut-elimination serves as an interpreter: normalization is evaluation. The cut-elimination problem is then a fundamental question about program equivalence, and how hard it is to decide. Moreover, the correspondence facilitates our identification of particular logics with associated complexity classes, where our goal is to link the expressive power of proofs with a suitably powerful interpreter that can “run” representations of programs in that complexity class. The cut-elimination problem is known to be non-elementary for simply typed λ-calculus [Sta79], and hence for linear logic. Several low order fragments of simply typed λ-calculus are investigated in [Sch01]. In this paper, we consider the decision problem for various weak subsystems of linear logic that have no exponentials, or have very weak forms of them (i.e., the so-called “light” linear logics). Such an investigation suggests another way to characterize the complexity of linear logics: not only by the complexity of theorem proving (proof search)—see, for example, [Lin95]—but also by the complexity of theorem simplification (proof normalization). Even in intuitionistic multiplicative linear logic (IMLL), which has no exponentials, it is possible to simulate weakening and contraction for a restricted set of formulas, including a formula whose proofs code boolean values. As a consequence, we derive ptime-completeness for CEP in IMLL; see Section 2. This result contradicts folkloric intuitions that MLL proofnets could be normalized in logarithmic space—that is, with only a finite number of pointers into the proofnet, presumably following paths in the style of the geometry of interaction. Similar to the results for IMLL, in Section 3 we derive conp-completeness results for IMALL, where we also have additives. An alternative way to represent a complexity class by some logic is to consider the functions realizable (say, by a Turing machine) in the class, and show how each can be coded as a fixed proof (program) in the logic. For example, Light Linear Logic has been shown to so represent ptime computations [Gir98], and the use of additives in that proof was replaced by unrestricted weakening in Light Affine Logic [Asp98,AR02]. We improve these results to show that such weakening is also unnecessary: Multiplicative Light Linear Logic is sufficient to capture ptime (see Section 4), where we also prove that deciding CEP is complete for doubly-exponential time. Finally, in Section 5 we show similar characterizations of exponential time in Multiplicative Soft Linear Logic [Laf01].

2 2.1

Expressivity of Multiplicatives Weakening in MLL

We restrict our attention to the intuitionistic (−◦, ∀) fragment IMLL of MLL, although all the results in this section carry over to the full classical MLL with no difficulty. Moreover, we omit type annotation from the proof syntax, and identify proofs of IMLL with type-free terms of linear λ-calculus. A term (proof) of IMLL is either a variable x, or an application (tu) where t and u are terms such that F V (t) ∩ F V (u) = ∅, or an abstraction (λx.t) where

On the Computational Complexity of Cut-Elimination in Linear Logic

25

t is a term and x ∈ F V (t). Terms are considered up to α-equivalence, and the variable convention is adopted. The substitution operation t[u/x] and the β reduction relation are defined as usual. The size |t| of a term t is the number of nodes in its syntax tree. The type assignment rules are as follows1 : Γ u : A x : A, ∆ t : C Γ, ∆ t[u/x] : C

x:A x:A

Γ u : A x : B, ∆ t : C Γ, y : A −◦ B, ∆ t[yu/x] : C

Γ t : A α ∈ F V (Γ ) Γ t : ∀α.A

x : A, Γ t : B Γ λx.t : A −◦ B x : A[B/α], Γ t : C x : ∀α.A, Γ t : C

Here, Γ, ∆ . . . stand for finite multisets of declarations x : A and F V (Γ ) denotes the set of all free type variables in Γ . We say that a term t is of type A (or t is a proof of A) if t : A is derivable by the above rules. A type A is inhabited if there is a term of type A. Unit 1 and tensor product ⊗ are introduced by means of the second order definitions: 1 ≡ ∀α.α −◦ α I ≡ λx.x let t be I in u ≡ tu

A ⊗ B ≡ ∀α.(A −◦ B −◦ α) −◦ α t ⊗ u ≡ λx.xtu let t be x ⊗ y in u ≡ t(λxy.u)

Tensor product is naturally extended to n-ary ones: t1 ⊗. . .⊗tn and let u be x1 ⊗ · · ·⊗xn in t. The expression λx1 ⊗· · ·⊗xn .t stands for λz.let z be x1 ⊗· · ·⊗xn in t. We also use shorthand notations such as id ≡ λx.x, t ◦ u ≡ λx.t(u(x)), An ≡ A ⊗ · · · ⊗ A, A(n) −◦ B ≡ A −◦ · · · A−◦ B. n times

n times

Our first observation is that a version of weakening rule can be constructed for a certain restricted class of IMLL formulas. Definition 1 (Π1 , Σ1 , eΠ1 , eΣ1 ). A type A is Π1 (Σ1 ) if it is built from type variables by −◦, 1, ⊗ and positive (negative) occurrences of ∀. An eΠ1 (eΣ1 ) type is like a Π1 (Σ1 ) type, but it may additionally contain negative (positive) occurrences of inhabited ∀-types. The above definition of Π1 and eΠ1 involves 1 and ⊗ as primitives, but we may ignore them in practice, because negative occurrences of ⊗ and 1 can be removed by isomorphisms ((A ⊗ B) −◦ C) ◦−◦ (A −◦ B −◦ C) and (1 −◦ C) ◦−◦ C, while positive occurrences can be replaced with their Π1 definitions. Finite data types are naturally represented by closed inhabited Π1 types. A typical example is the boolean type: B ≡ ∀α.α −◦ α −◦ α ⊗ α. Meanwhile, functional types over those finite data types, such as (B −◦ B) −◦ B, are all included in the class eΠ1 . 1

Note that any term of linear λ-calculus has a propositional type [Hin89]; the role of second order quantifiers here is not to increase the number of typable terms, but to classify them by assigning a uniform type to structurally related terms.

26


Theorem 1 (eΠ1 -Weakening). For any closed eΠ1 type A, there is a term wA of type A −◦ 1. Proof. Without loss of generality, we may assume that A does not contain ⊗ and 1. Let B[1] be the type B with all free variables replaced with 1. By simultaneous induction, we prove: (i) for any eΠ1 type B, B[1] 1 is provable; and (ii) for any eΣ1 type B, B[1] is provable. When B is a variable, the claims are obvious. When B is C −◦ D, for (i) we derive (C −◦ D)[1] 1 from C[1] and D[1] 1, and for (ii) we derive (C −◦ D)[1] from C[1] 1 and D[1]. Let B be ∀α.C. If B is eΠ1 , we derive (∀α.C)[1] 1 from C[1] 1. If B is eΣ1 , B is provable by definition, and so is B[1]. 2.2

Encoding Boolean Circuits

Let A be an arbitrary type, and B be a type that supports weakening in the sense we have just described; we can then define a projection function fstB : A⊗B−◦A, given by fstB ≡ λx.let x be y⊗z in (let wB (z) be I in y). By using this coding, we can then specify boolean values, weakening, and operations (including duplication) as: true ≡ λxy.x ⊗ y :B false ≡ λxy.y ⊗ x :B wB ≡ λz.let zII be x ⊗ y in (let y be I in x) : B −◦ 1 not ≡ λP xy.P yx : B −◦ B or ≡ λP Q.fstB (P true Q) : B −◦ B −◦ B cntr ≡ λP.fstB⊗B (P (true ⊗ true)(false ⊗ false)) : B −◦ B ⊗ B Recall that a language X ⊆ {0, 1}∗ is logspace reducible to Y ⊆ {0, 1}∗ if there exists a logspace function f : {0, 1}∗ −→ {0, 1}∗ such that w ∈ X iff f (w) ∈ Y . Language X is ptime-complete if X ∈ ptime and each language L ∈ ptime is logspace reducible to X; a decision problem is said to be ptimecomplete when the language defined by that problem is ptime-complete. The canonical ptime-complete decision problem is the following: Circuit Value Problem: Given a boolean circuit C with n inputs and 1 output, and truth values x = x1 , . . . , xn , is x accepted by C? [Lad75] Using the above coding of boolean operations, the problem is logspace reducible to CEP for IMLL: Theorem 2 (ptime-completeness of IMLL, [Mai03]). There is a logspace algorithm which transforms a boolean circuit C with n inputs and m outputs into a term tC of type Bn −◦ Bm , where the size of tC is O(|C|). As a consequence, the cut-elimination problem for IMLL is ptime-complete. Since binary words of length n can be represented by Bn , the theorem implies that any finite function f : {0, 1}n −→ {0, 1}m can be represented by a term tf : Bn −◦ Bm . In this sense, MLL captures all the finite functions.


2.3

27

Contraction in MLL

One of the key observations in proving Theorem 2 is that contraction is available for B. We now generalize this observation, and show that the same holds for all closed inhabited Π1 types (i.e. finite data types). First we show that conditional is available in IMLL: Lemma 1 (Conditional). Let t1 and t2 be terms such that x1 : C1 , . . . , xn : Cn ti : D for i = 1, 2, and the type A ≡ C1 −◦ · · · Cn −◦ D is eΠ1 (not necessarily closed). Then there is a term if b then t1 else t2 such that b : B, x1 : C1 , . . . , xn : Cn if b then t1 else t2 : D, where (if true then t1 else t2 ) −→ t1 and (if false then t1 else t2 ) −→ t2 . Proof. Define if b then t else u ≡ fst∀α.A (b(λx.t)(λx.u))x, where x abbreviates x1 , . . . , xn and ∀α.A is the universal closure of A. This term can be typed as required; λx.t and λx.u have type ∀α.A, thus b(λx.t)(λx.u) has type ∀α.A ⊗ ∀α.A, to which the projection fst∀α.A applies. The rest is obvious. Fix a quantifier-free type A of size k, built from a single type variable α. A long normal form of type A is a term t in β-normal form such that t : A has a derivation in which all identity axioms are atomic, i.e., of the form x : α x : α. It is clear that every long normal form t of type A has size bounded by k, and we may assume that all variables occurring in it are from a fixed set of variables {x1 , . . . , xk } (due to α-equivalence). Therefore, t can be written as a word in {0, 1}n , where n = O(k log k). Since {0, 1}n can in turn be represented by Bn , there must be a function which maps a given term u of size bounded by k into a term u of type Bn . Furthermore, as a consequence of Theorem 2, we can associate to this coding two terms abs, app : Bn −◦ Bn −◦ Bn which satisfy abs y t −→∗ λy.t , if |λy.t| ≤ k and y ∈ {x1 , . . . , xk }; app t u −→∗ tu , if |tu| ≤ k. We now show that the coding function can be internalized in IMLL, as far as the long normal forms of a fixed type A is concerned. For each subtype B of A, define σB (t) and τB (t) as follows: σα (t) ≡ t τα (t) ≡ t

σB−◦C (t) ≡ abs y σC (t τB ( y )) τB−◦C (t) ≡ λz.τC (appt σB (z))

Here y is from {x1 , . . . , xk } and fresh , in the sense that y does not occur in t. The term σB (t) has type Bn whenever t has type B[Bn /α], and τB (t) has type B[Bn /α] whenever t has type Bn . Finally, let codeA ≡ λx.σA (x) : A[Bn /α] −◦ Bn . Lemma 2 (Internal Coding). Let A be as above. For each closed long normal form t of type A, codeA (t) −→∗ t .

28


For example, let A1 be ((α −◦ α) −◦ α) −◦ (α −◦ α) −◦ α, which has two long normal forms t1 ≡ λF f.f (F (λy.y)) and t2 ≡ λF f.F (λy.f y)). The term codeA1 is defined as follows: τα−◦α ( f ) ≡ λx.app f x τ(α−◦α)−◦α ( F ) ≡ λg.app F (abs y (g y )) codeA1 ≡ λz.abs F (abs f (zτ(α−◦α)−◦α ( F )τα−◦α ( f ))) It is then easy to check that codeF (ti ) reduces to ti for i = 1, 2. Theorem 3 (Π1 -Contraction). Let A be a closed Π1 type which is inhabited. Then there is a contraction map cntrA : A −◦ A ⊗ A such that for any normal form t of type A, cntrA (t) reduces to t ⊗ t , where t is a long normal form η-equivalent to t. Proof. Without loss of generality, we may assume that A is free from ⊗ and 1. Let A− be obtained from A by replacing all subtypes ∀β.C by C[α/β] for a fixed variable α. Then, there is a canonical map isoA : A −◦ A− [D/α] for any D which preserves the structure of terms up to η-equivalence. By applying Lemma 2 to the type A− we obtain a coding map codeA− : A− [Bn /α] −◦ Bn . Let t1 , . . . , tl be the long normal forms of type A. By using the conditional in Lemma 1 several times, we can build a term copyA : Bn −◦ A ⊗ A which satisfies copyA (u) −→∗ ti ⊗ ti , −→∗ t1 ⊗ t1 ,

if u ≡ ti ; otherwise.

Finally, define cntrA ≡ copyA ◦ codeA− ◦ isoA .

3

Additives as Nondeterminism

3.1

Additive Slices and Nondeterministic Cut-Elimination

We now move on to the multiplicative additive fragment of Linear Logic. We again confine ourselves to the intuitionistic fragment IMALL, and furthermore, we only consider & as the additive connective, although ⊕ could be added harmlessly2 . The terms of IMALL are defined analogously to the terms of IMLL, but we have in addition: (i) if t and u are terms and F V (t) = F V (u), then so is t, u; (ii) if t is a term, then so are π1 (t) and π2 (t). The type assignment rules are extended with Γ t1 : A1 Γ t2 : A2 Γ t1 , t2 : A1 & A2 2

x : Ai , Γ t : C i = 1, 2 y : A1 & A2 , Γ t[πi (y)/x] : C

However, we have to be careful when considering the classical system, which is not confluent as it stands [Gir87]. It could be overcome by adopting Tortora’s proofnet syntax with generalized & boxes, which enjoys confluence [dF03]; see also [MR02].


29

and the reduction rules are extended with πi t1 , t2 −→ ti , for i = 1, 2. Note that some reductions such as (λx.x, x)t −→ t, t cause duplication, hence the straightforward cut-elimination procedure costs exponential time in general3 . Our idea is to avoid duplication by computing each component of t1 , t2 separately. To formalize this idea, we recall the notion of slice [Gir87]. Definition 2 (Slices). A slice of a term t is obtained by applying the following operation to t as much as possible: u, v → u1 , or u, v → v2 . We say that two slices t and u (of possibly different terms) are compatible if there is no context (i.e. a term with a hole) Φ such that t ≡ Φ[t i ], u ≡ Φ[u j ], and i = j. Lemma 3 (Slicewise checking). Two terms t and u are equivalent if and only if for every compatible pair (t , u ) of slices of t and u, we have t ≡ u . The reduction rules are naturally adapted for slices: sl

(λx.t)u −→ t[u/x]

sl

πi ti −→ t

sl

πi tj −→ fail, if i = j.

Lemma 4 (Pullback). Let t −→∗ u and u be a slice of u. Then there is a sl

unique slice t of t such that t −→∗ u . Proof. See the following diagrams: - s[v/x] (λx.s)v pp 6 6 pp slice of slice of pp p sl p p s [v /x] (λx.s )v p p p p p-

- s π1 s, v pp 6 6 pp slice of pp slice of pp p sl p p π1 s 1 p p p p ps

Note that there are exponentially many slices for a given term, but once a slice has been chosen, the computation afterwards can be done in linear steps, thus in quadratic time, since each slice is entirely a linear term. We therefore have a nondeterministic polynomial time cut-elimination procedure, viewing the slicing operation in Definition 2 as a nondeterministic reduction rule. Lemma 3 states that the equivalence of two normal forms can be checked slicewise, and Lemma 4 assures that every slice of a normal form can be obtained by the above nondeterministic procedure. Hence we may conclude that the cut-elimination problem for IMALL is in conp. 3.2

Encoding a coNP-Complete Problem

Now we show that the following conp-complete problem is logspace reducible to CEP for IMALL: 3

There is, however, a linear step cut-elimination procedure for terms (proofnets) of lazy types, i.e., those which do not contain positive occurrences of & and negative occurrences of ∀.

30


Logical Equivalence Problem: Given two boolean formulas, are they logically equivalent? (cf. [GJ78]) By Theorem 2, every boolean formula C with n variables can be translated into a term tC of type B(n) −◦ B in O(log |C|) space. For each 1 ≤ k ≤ n, let tak ≡ λf.λx1 · · · xk−1 .f true x1 · · · xk−1 , f false x1 · · · xk−1 , which is of type ∀α.(B(k) −◦ α) −◦ (B(k−1) −◦ α & α), and define ta(tC ) by ta(tC ) ≡ ta1 (· · · (tan tC ) · · · ) : B · · & B . & · 2n times

It is clear that the term ta(tC ) can be built from tC with the help of a counter of size O(log n). The normal form of ta(tC ) consists of 2n boolean values, each of which corresponds to a “truth assignment” to the formula C. For example, ta(or) reduces to or true true, or true false, or false true, or false false, and thus to true, true, true, false. Therefore, two formulas C and D with n variables are logically equivalent if and only if ta(tC ) and ta(tD ) reduce to the same normal form. Theorem 4 (conp-completeness of IMALL). The cut-elimination problem for IMALL is conp-complete. Remark 1. We do not claim that the complexity of MALL is conp. What we have shown is that a specific problem, CEP for MALL, is complete for conp. If we had considered the complement of CEP, then the result would have been np-completeness. Likewise, we could obtain a C-completeness result for any class C in the polynomial time hierarchy by complicating the problem more and more. However, we do claim that additives have something to do with nondeterminism, as they provide a notion of nondeterministic cut-elimination, as well as a very natural coding of nondeterministic Turing machine computation.

4

Multiplicative Light Linear Logic and 2EXPTIME

In this section, we show that the intuitionistic multiplicative fragment IMLLL of Light Linear Logic is already expressive enough to represent all polynomial time functions; it needs neither additives (as in [Gir98]) nor unrestricted weakening (as in [Asp98]). Since our concern is not normalization but representation, we do not need to introduce a proper term calculus with the polynomial time normalization property (see [Asp98] and [Ter01] for such term calculi). We rather use the standard λ-calculus and think of IMLLL as a typing system for it. The type assignment rules of IMLLL are those of IMLL with the following:


x:B t:A x :!B t :!A

Γ t:C x :!B, Γ t : C

x :!A, y :!A, Γ t : C z :!A, Γ t[z/x, z/y] : C

31

x : A, y : B t : C x : !A, y : §B t : §C

where x : B may be absent in the first rule. Define W to be ∀α.!(B −◦ α −◦ α) −◦ §(α −◦ α). Then each word w = i1 · · · in , where n ≥ 0 and ik ∈ {0, 1}, is represented by w ≡ λcx.ci1 ◦ · · · ◦ cin (x) : W, where ik is false if ik = 0, and is true if ik = 1. A function f : {0, 1}∗ −→ {0, 1}∗ is represented by a term t if f (w) = v ⇐⇒ tw −→∗ v for every w ∈ {0, 1}∗ . Simulation of polynomial time Turing machines in Light Linear Logic (see [Gir98,AR02]) consists of two parts; one for coding of polynomials and the other for simulation of one-step transition (as well as initialization and output extraction). Since the former is already additive-free in [Gir98], we focus on the latter here. Let M be a Turing machine with two symbols4 and 2n states, and let δ : Symbols × States −→ Symbols × States × {left, right} be the associated instruction function. A configuration of M can be specified by a triple w1 , w2 , q, where the stack w1 ∈ {0, 1}∗ describes the non-blank part of the tape to the left of the head, the stack w2 ∈ {0, 1}∗ describes the non-blank part of the tape to the right of the head, and q ∈ States denotes the current state. By convention, w1 is written in the reverse order, and w1 includes the content of the cell currently scanned. The configurations are represented by terms of type ID[Bn ], where ID[A] is defined by ID[A] ≡ ∀α.!(B−◦α−◦α)−◦§(α−◦α−◦(α⊗α⊗A)). Note that ID[A] is a generalization of W, which allows to encode two words and an additional datum of type A into one term. For example, the configuration 010, 11, q is represented by 010, 11, q ≡ λc.λx1 x2 .(c0 ◦ c1 ◦ c0(x1 )) ⊗ (c1 ◦ c1(x2 )) ⊗ q, where q is a term of type Bn coding q ∈ States. To simulate one-step transition, it is convenient to divide it into two parts: the decomposition part and the combination part. Lemma 5 (Decomposition). There is a term dec : ID[Bn ]−◦ID[B⊗B⊗Bn ] such that for any configuration i1 · · · in , j1 · · · jm , q, deci1 · · · in , j1 · · · jm , q −→∗ i2 · · · in 0, j2 · · · jm 0, i1 , j1 , q. 4

Although more than two symbols are required in general, we describe the two symbols version here for simplicity. The extension is straightforward.

32


Proof. We largely follow [NM02]. Define dec to be λz.λc.G(z F (c)), where the “step” function F and the “basis” function G are defined as follows: F (c) ≡ λb1 .λb2 ⊗ w.(b1 ⊗ (cb2 w)) G(y) ≡ λx1 x2 .let (y(0 ⊗ x1 )(0 ⊗ x2 )) be (i1 ⊗ w1 ) ⊗ (j1 ⊗ w2 ) ⊗ q in (w1 ⊗ w2 ⊗ i1 ⊗ j1 ⊗ q) c : B −◦ α −◦ α F (c) : B −◦ D −◦ D y : D −◦ D −◦ D ⊗ D ⊗ Bn G(y) : α −◦ α −◦ (α ⊗ α ⊗ B ⊗ B ⊗ Bn ) Here, D stands for B ⊗ α. The behavior of F may be illustrated by (F (c)i1 ) ◦ · · · ◦ (F (c)in )(0 ⊗ x) −→∗ i1 ⊗ (ci2 ◦ · · · ◦ cin ◦ c0(x)) : D, while G plays the roles of initialization and rearrangement of the output. Lemma 6 (Combination). There is a term com : ID[B ⊗ B ⊗ Bn ] −◦ ID[Bn ] such that for any w1 , w2 , i1 , i2 , q with δ(i1 , q) = (s, q , m), comw1 , w2 , i1 , i2 , q −→∗ w1 , si2 w2 , q , if m = left; −→∗ i2 sw1 , w2 , q , if m = right. Proof. Let left ≡ true and right ≡ false. By Theorem 2, there is a term delta such that delta i1 q reduces to s ⊗ q ⊗ m when δ(i1 , q) = (s, q , m). Now the key trick is to use the boolean value m as “switcher.” Observe that msi2 reduces to s ⊗ i2 (i2 ⊗ s) and mw1 w2 reduces to w1 ⊗ w2 (w2 ⊗ w1 ) when m is left (right)—thus m can be used to determine on which side of the tape we push symbols, and in what order they are pushed. Formally, let cntr3 : B −◦ B3 be a generalized contraction which produces three copies of a given boolean value, and define G(m, w1 , w2 , i2 , s, c1 , c2 ) to be let cntr3 (m) be m1 ⊗ m2 ⊗ m3 in (let m1 si2 be j1 ⊗ j2 in (let m2 w1 w2 be v1 ⊗ v2 in m3 v1 (c1 j1 ◦ c2 j2 (v2 )))), which is of type m : B, w1 : α, w2 : α, i2 : B, s : B, c1 : B −◦ α −◦ α, c2 : B −◦ α −◦ α G(m, w1 , w2 , i2 , s, c1 , c2 ) : α ⊗ α. Then, depending on the value of m, we have G(true, w1 , w2 , i2 , s, c, c) −→∗ w1 ⊗ (cs ◦ ci2 (w2 )); G(false, w1 , w2 , i2 , s, c, c) −→∗ (ci2 ◦ cs(w1 )) ⊗ w2 . Finally, the term com is defined to be λz.λcx1 x2 .let zcx1 x2 be w1 ⊗ w2 ⊗ i1 ⊗ i2 ⊗ q in (let delta i1 q be s ⊗ q ⊗ m in G(m, w1 , w2 , i2 , s, c, c) ⊗ q ). Although the “cons” variable c is used three times in com, it does not matter since it is assigned a type !(B −◦ α −◦ α). The desired one-step transition function is obtained by composing dec and com.


33

Theorem 5 (IMLLL represents ptime functions). A function f : {0, 1}∗ −→ {0, 1}∗ is computable in dtime[nk ] if and only if it is represented by an IMLLL term t of type W −◦ §d W, where d = O(log k). In general, cut-elimination in Light Affine Logic, hence in IMLLL, requires d+1 of time O(s2 ), where s is the size of a proof and d is its depth, which counts the nesting of ! and § inferences. The reason why we have a characterization of ptime above is that we consider a fixed program t, so all the terms tw to be evaluated have a fixed depth. On the other hand, CEP allows the depth to vary, thus it results in a characterization of doubly-exponential time as in [NM02]. Theorem 6 (2exptime-completeness of IMLLL). The cut-elimination nk problem for IMLLL is complete for 2exptime = k dtime[22 ].

5

Multiplicative Soft Linear Logic and EXPTIME

In this section, we show that the intuitionistic multiplicative fragment IMSLL of Soft Linear Logic is expressive enough to represent all polynomial time functions, as conjectured by Lafont [Laf01]. As before, we do not introduce a term calculus for IMSLL, thinking of it as a type assignment system for the standard λcalculus. The type assignment rules of IMSLL are those of IMLL with the following: x1 : B1 , . . . , xm : Bm t : A m≥0 x1 :!B1 , . . . , xm :!Bm t :!A

x1 : A, . . . , xn : A, Γ t : C n≥0 z :!A, Γ t[z/x1 , . . . , z/xn ] : C

The former is called soft promotion and the latter is called multiplexing. A term which can be typed without multiplexing is called generic. Note that every generic term is a linear λ-term. The policy of MSLL programming is to write each program in a generic way; multiplexing (i.e. duplication) is used only in data. Due to this restriction, simulation of Turing machines is more sophisticated than before. Let M and δ be as before. Define IDk [A] to be ∀α.!(B −◦ α −◦ α) −◦ ((α −◦ α)k ⊗ A). Then each term of type IDk [A] encodes k words as well as an element of type A. For instance, the configuration 010, 11, q is represented by 010, 11, q ≡ λc.(c0 ◦ c1 ◦ c0) ⊗ (c1 ◦ c1) ⊗ q : ID2 [Bn ]. Lemma 7 (Decomposition). For every k ≥ 1, there exists a generic term dec of type IDk [Bn ] −◦ ID2k [B ⊗ Bn ] such that for any i1 w1 , . . . , ik wk , q ∈ ({0, 1}+ )k × States, deci1 w1 , . . . , ik wk , q −→∗ w1 , . . . , wk , i1 , . . . , ik , i1 , q. Note that the output contains two occurrences of i1 ; the first is a word of length 1 which will be thrown away, while the second is a boolean value which will be used as input to the δ function in the next combination part.

34

Harry G. Mairson and Kazushige Terui left tape w1

↓ i1

stocks of 0 w3

0

garbages w5

i5

i2

right tape w2

1

stocks of 1 w4

=⇒

left tape w1

↓ 1 i2

right tape w2

stocks of 0 w3

0

stocks of 1 w4

garbages w5

i5 i1

Fig. 1. “Write 1 and move right” (↓ indicates the head position)

Proof. The idea is essentially the same as the ψ function of [Laf01]. Consider the case k = 1. The term dec is defined to be λz.λc.λz ⊗ q.(zF (c)(id ⊗ id ⊗ 0)) ⊗ q, where the step function F is defined by F (c) ≡ λb.let cntr(b) be b1 ⊗ b2 in (λg ⊗ h ⊗ e.fst(((h ◦ g) ⊗ cb1 ⊗ b2 ) ⊗ e)) c : B −◦ α −◦ α F (c) : B −◦ ((α −◦ α)2 ⊗ B) −◦ ((α −◦ α)2 ⊗ B). The behavior of F is illustrated as follows; (F (c)i1 ) ◦ · · · ◦ (F (c)in )(id ⊗ id ⊗ 0) −→∗ (ci2 ◦ · · · ◦ cin ) ⊗ ci1 ⊗ i1 . The case k ≥ 2 is similar, except that we remove all redundant boolean values i2 , . . . , ik by weakening for B. Now let us move on to the combination part. Due to the genericity restriction, we face two difficulties: (i) we cannot create a new tape cell, since the “cons” variable c of type !(B −◦ α −◦ α) cannot be used twice; (ii) we cannot simply remove an unnecessary tape cell of type α −◦ α, since we do not have weakening for the open type α −◦ α. To resolve the first difficulty, we prepare two additional stacks which are filled with 0’s and 1’s respectively, and instead of creating a new cell, we pick one from these two stacks according to the instruction δ. To resolve the second difficulty, we further prepare a ‘garbage’ stack where unnecessary tape cells are collected. Thus we associate five stacks in total with a configuration. The transition corresponding to “write 1 and move right” is illustrated in Figure 1. Lemma 8 (Combination). There is a generic term com of type ID10 [B ⊗ Bn ] −◦ ID5 [Bn ] such that for any w1 , . . . , w5 , i1 , . . . , i5 , b, q ∈ ({0, 1}+ )5 × {0, 1}5 × {0, 1} × States with δ(b, q) = (s, q , m), comw1 , . . . , w5 , i1 , i2 , 0, 1, i5 , b, q −→∗ w1 , 0i2 w2 , w3 , 1w4 , i1 i5 w5 , q −→∗ w1 , 1i2 w2 , 0w3 , w4 , i1 i5 w5 , q −→∗ i2 0w1 , w2 , w3 , 1w4 , i1 i5 w5 , q −→∗ i2 1w1 , w2 , 0w3 , w4 , i1 i5 w5 , q

if if if if

s=0 s=1 s=0 s=1

and and and and

m = left; m = left; m = right; m = right.


35

Keep in mind that the third and the fourth stacks are to be filled with 0’s and 1’s, so that we always find 0 and 1 at positions i3 and i4 , respectively. Proof. As before, there is a term delta such that delta bq reduces to s ⊗ q ⊗ m when δ(b, q) = (s, q , m). Define 1Right by 1Right ≡ (i2 ◦ i4 ◦ w1 ) ⊗ w2 ⊗ (i3 ◦ w3 ) ⊗ w4 ⊗ (i1 ◦ i5 ◦ w5 ) w1 : α −◦ α, . . . , w5 : α −◦ α, i1 : α −◦ α, . . . , i5 : α −◦ α 1Right : (α −◦ α)5 , which corresponds to the case s = 1 and m = right (see Figure 1) and gives five stacks as output. 0Left, 1Left and 0Right are defined analogously. By using conditionals in Lemma 1 three times, we obtain if m then if s then 0Left else 1Left G(m, s, w1 , . . . , w5 , i1 , . . . , i5 ) ≡ else if s then 0Right else 1Right com ≡ λz.λc.let zc be w1 ⊗ · · · ⊗ w5 ⊗ i1 ⊗ · · · ⊗ i5 ⊗ b ⊗ q in (let delta bq be s ⊗ q ⊗ m in G(m, s, w1 , . . . , w5 , i1 , . . . , i5 ) ⊗ q ). The rest of coding is basically the same as in [Laf01] except the initialization part, where we need to fill two stacks with 0’s and 1’s. As in [Laf01], we have no idea how to extract a single word as output from the final configuration consisting of five stacks. Instead, we can extract the boolean value which tells us whether the final configuration is accepting or not. Thus the representation theorem below is stated in terms of languages rather than functions in general. Furthermore, due to the genericity restriction, we need to relax the definition of representation slightly. Define WS to be ∀α.!(B −◦ α −◦ α) −◦ α −◦ α. We say that a language X ⊆ {0, 1}∗ is represented by a term t : WlS −◦B if w ∈ X ⇐⇒ t w · · · w −→∗ true for every w ∈ {0, 1}∗ .

l times

Theorem 7 (IMSLL captures ptime). A language X ⊆ {0, 1}∗ is accepted in dtime[nk ] if and only if it is represented by a generic term t of type WlS −◦B, where l = O(k). As in the case of IMLLL, the complexity of CEP exceeds polynomial time. A difference is that cut-elimination in IMSLL only requires exponential time O(sd+2 ) [Laf01]. Hence we have: Theorem 8 (exptime-completeness of IMSLL). The cut-elimination problem for IMSLL is complete for exptime under logspace reducibility. Proof (sketch). Suppose that a language X be accepted by a Turing machine M k in time O(2n ). For each word w of length n, the following terms (of suitable types) can be constructed in O(k log n) space: (1) the Church representation w of w; (2) the term exp(nk ) of size and depth O(nk ), which reduces to the tally k integer 2n ; (3) the term Mn,k (w, x) with two variables w and x, which outputs

36


the result of x-steps computation on the input w, when w is of length n and x is of the same type as exp(nk ). By putting them together, we obtain a term Mn,k (w, exp(nk )) which normalizes to true if and only if w ∈ X.

Acknowledgments We wish to thank Patrick Baillot and Marco Pedicini for very stimulating discussions, and Jean-Yves Girard, Stefano Guerrini, Yves Lafont, Satoshi Matsuoka, Peter Neergaard, Peter Selinger, Izumi Takeuti, Rene Vestergaard and the anonymous referees for a lot of useful comments.

References Asp98. AR02. dF03. Gir87. Gir98. GJ78. Hin89. Lad75. Laf01. Lin95. MR02. Mai03. NM02. Sch01. Sta79. Ter01.

A. Asperti. Light affine logic. In Proceedings of the Thirteenth Annual IEEE Symposium on Logic in Computer Science, pages 300–308, 1998. A. Asperti and L. Roversi. Intuitionistic light affine logic (proof-nets, normalization complexity, expressive power, programming notation). ACM Transactions on Computational Logic, 3(1):1–39, 2002. L. Tortora de Falco. The additive multiboxes. Annals of Pure and Applied Logic, 120(1):65–102, 2003. J.-Y. Girard. Linear logic. Theoretical Computer Science, 50:1–102, 1987. J.-Y. Girard. Light linear logic. Information and Computation, 14(3):175–204, 1998. M. Garey and D. Johnson. Computers and Intractability: A Guide to the Theory of NP-completeness. Freeman, San Francisco, 1978. J. R. Hindley. BCK-combinators and linear λ-terms have types. Theoretical Computer Science, 64:97–105, 1989. R. E. Ladner. The circuit value problem is logspace complete for P. SIGACT News, 7(1):18–20, 1975. Y. Lafont. Soft linear logic and polynomial time. Theoretical Computer Science, to appear. P. D. Lincoln. Deciding provability of linear logic formulas. In Advances in Linear Logic, London Mathematical Society Lecture Notes Series, Volume 222, Cambridge University Press, 1995, 109–122. H. G. Mairson and X. Rival. Proofnets and context semantics for the additives. Computer Science Logic (CSL) 2002, 151–166. H. G. Mairson. Linear lambda calculus and polynomial time. Journal of Functional Programming, to appear. P. M. Neergaard and H. G. Mairson. LAL is square: representation and expressiveness in light affine logic. Presented at the Fourth International Workshop on Implicit Computational Complexity, 2002. A. Schubert. The Complexity of β-Reduction in Low Orders. Typed Lambda Calculi and Applications (TLCA) 2001, 400–414. R. Statman. The typed λ-calculus is not elementary recursive. Theoretical Computer Science, 9:73–81, 1979. K. Terui. Light affine lambda calculus and polytime strong normalization. In Proceedings of the sixteenth annual IEEE symposium on Logic in Computer Science, pages 209–220, 2001. The full version is available at http://research.nii.ac.jp/∼terui.

A Constructive Proof of the Soundness of the Encoding of Random Access Machines in a Linda Calculus with Ordered Semantics Claudio Sacerdoti Coen Department of Computer Science Via di Mura Anteo Zamboni 7, 40127 Bologna, ITALY. [email protected]

Abstract. Random Access Machines (RAMs) are a deterministic Turing-complete formalism especially well suited for being encoded in other formalisms. This is due to the fact that RAMs can be defined starting from very primitive concepts and operations, which are unbounded natural numbers, tuples, successor, predecessor and test for equality to zero. Since these concepts are easily available also in theorem-provers and proof-assistants, RAMs are good candidates for proving Turingcompleteness of formalisms using a proof-assistant. In this paper we describe an encoding in Coq of RAMs into a Linda Calculus endowed with the Ordered Semantics. We discuss the main difficulties that must be faced and the techniques we adopted to solve them.

1

Introduction

A Random Access Machine (RAM) [12] is a computational model composed of a finite set of registers and of a program, that is a sequence of simple numbered instructions, like arithmetical operations (on the content of registers) or conditional jumps. A register holds an unbounded natural number. The state of a RAM is the set of values stored in each register plus the program counter (PC), which is the address of the next instruction to execute. The computation starts from an initial state and proceeds iterating the two operations of fetching and executing the next instruction (determined by the PC). The computation ends as soon as the value of the PC is greater than the index of the last instruction. The RAMs formalism is Turing complete and has several characteristics that make it particularly appealing for being encoded into other formalisms to show their Turing completeness. First of all a RAM can be defined using only very primitive concepts and operations, which are unbounded natural numbers, tuples, successor, predecessor and test for equality to zero. These concepts are likely to be already provided in any formalism which we want to show Turing complete. Moreover it is possible to reduce the set of instructions to only two elements, Succ (which increments a register) and DecJump which decrements a

Work partially supported by the European Project IST-33562 MoWGLI


38

Claudio Sacerdoti Coen

register if it is not zero or jumps to a given address otherwise. As a consequence the proofs of completeness of the encodings are very small, having to address only a couple of cases and only three possible transitions. Finally, RAMs are completely deterministic, which prevents the usual difficulties given by the simulation of non-deterministic systems into deterministic ones. Just to mention a couple of examples, RAMs have been successfully encoded into several process algebras, such as asynchronous CCS [13] and the ambient calculus [14]. Even if providing the encoding can be challenging, the soundness and completeness proofs are usually given in just a few lines, and heavily rely on the reader intuition to figure out the details by case reasoning. In the last few years, several process calculi have been formalized, using proof-assistants, in both constructive and classical logics. Surprisingly, to our knowledge nobody tried to reproduce a proof of Turing-completeness of those calculi. Nevertheless, when we started this work, we used to think that giving one of those proofs by means of a sound and complete encoding of RAMs into the calculus would have been completely trivial. The reason of our belief was that the same characteristics that make RAMs so well suited for their encoding in other formalisms also make their definition in a logical framework quite straightforward. Moreover the soundness proof would just be a laborious induction on the derivation. In this paper we present our experience in using the proof-assistant Coq [2] to provide an encoding of RAM into a Turing complete process algebra. We also give a constructive proof of the soundness property of the encoding. As usual, the soundness proof exploits the completeness property. However, we axiomatically assume the completeness of the calculus, that can be proved by induction over the structure of RAMs and that of their derivations. Since the RAM formalism is deterministic, the required induction is almost straightforward and presents no major challenge, even if it is extremely laborious and time consuming. The soundness proof quickly turned out to require a major effort and its proof-script is currently more than 10.000 lines long and it is still under development, since we plan to provide soon also the proof of completeness. The up-to-date set of Coq files are available for download at the following address: http://www.cs.unibo.it/RAMs to Linda.tgz. In section 2 we briefly introduce the Coq proof-assistant and the main features of its expressive logic. In section 3 we review the usual definition of RAMs and we present its formal definition in the Coq system. In section 4 we introduce a minimal process algebra built around the Linda primitives [5], originally proposed in [1]. The formal definition in Coq is also provided. In section 5 we present the encoding of RAMs into the Linda Calculus of section 4 and we outline the formal proof of soundness. Finally, in section 6 we present our conclusions and future work proposal.

2

The Coq Proof Assistant

Coq [2] is one of the most advanced proof-assistants, used in Europe both in academical and industrial settings. It is based on an expressive logical frame-

A Constructive Proof of the Soundness of the Encoding

39

work, the Calculus of (Co)Inductive Constructions (CIC), which allows both constructive and classical proofs and that is particularly suitable for proving the correctness of programs with respect to their specifications, with the additional possibility of automatically extracting a certified program from a constructive proof of the existence of a function that satisfies a given specification. Briefly, a Coq development is made of a list of definitions, inductive definitions and theorems whose correctness is checked by the system. Inductive definitions, which are one of the main features of CIC, can be used to define both inductive data types (lists, trees, natural numbers) and inductive properties (by giving the set of inference rules that define the property). It is possible to define by structural recursion total functions over an inductive data-type (in the style of the system T); in the same way it is also possible to prove by structural induction properties over an inductive data-type. A primitive notion of case analysis over inductive defined terms is also provided. Since the main topic of the paper is the technique used for the encoding of the soundness proof in Coq, the interested reader needs a general expertise in the world of proof-assistants and in the Coq system in particular. Due to lack of space, the required knowledge can not be provided in this paper.

3

Random Access Machines

The following is the usual presentation of a particular class of RAMs with only two-instructions. The proof of their Turing completeness was given in [11]. Definition 1. A Random Access Machine (RAM) is a pair (r, p) where r = (r1 , . . . , rn ) is the set of registers and the program p = (i1 , . . . , im ) is a finite list of instructions. Each instruction can have one of the following two forms: – Succ(rj ): adds 1 to the content of register rj – DecJump(rj , s): if the content of register rj is not zero, then decreases it by 1 and go to the next instruction; otherwise jumps to instruction s Definition 2. Let R be a RAM whose registers are (r1 , . . . , rn ). A configuration of R is a tuple (p, c1 , . . . , cn ) where the program counter (PC) p is the index of the next instruction to be executed and cl is the content of the register rl . Definition 3. Let R be a RAM whose registers are (r1 , . . . , rn ) and whose program is (i1 , . . . , im ). A configuration (p, c1 , . . . , cn ) moves into a configuration (q, c1 , . . . , cn ) (notation: (p, c1 , . . . , cn ) −→R (q, c1 , . . . , cn )) iff: – ip = Succ(rj ) and cj = cj + 1 and ∀l = j. cn = cn and q = p + 1 – ip = DecJump(rj , s) and cj > 0 and cj = cj − 1 and ∀l = j. cn = cn and q =p+1 – ip = DecJump(rj , s) and cj = 0 and ∀l. cn = cn and q = s Definition 4. A configuration (p, c1 , . . . , cn ) is stuck or final when it cannot move. This happens only when p > m, where m is the length of the program. As usual, given a RAM R and an initial configuration C, we say that C reduces to C when C −→∗R C and C is final, where −→∗R is the reflexive and transitive closure of −→R .

40

3.1


RAMs in Coq

The only non-trivial issue on the formalization of RAMs in Coq is the way registers are encoded. In fact the tuple (r1 , . . . , rn ) of registers just plays the role of a finite set of indexes such that no instruction refers to a non-existent index. The only additional constraint we need to impose on the set is that there exists a decidable equality relation over its elements. Since the list of instructions is finite and since registers not referred by any instruction play no role during the reduction, we could have used just the type of natural numbers for register indexes (with no concern about the fact that the set of indexes is actually infinite). In this case it would have been possible in Coq to define a function to compute the greatest used register index. Instead we preferred to stick ourselves to this alternative definition: Definition register := nat. Inductive instruction : Set := Succ : register→instruction | DecJump : register→nat→instruction. Inductive uses at most [r:register] : instruction→Prop := okSucc : ∀r’:register.(r’ −→ 0 a rd(a).P −→ P a inp(a)?P Q −→ P ¬a inp(a)?P Q −→ Q τ P ||Q −→ P |Q α

P −→ P P |Q

a

(13)

α −→

P −→ P P |Q

P |Q

τ −→

α = ¬a

(2) (4) (6) (8) (10) (12)

a

Q −→ Q P |Q

a

in(a).P −→ P a !in(a).P −→ P |!in(a).P a rdp(a)?P Q −→ P ¬a rdp(a)?P Q −→ Q τ out(a).P −→ < a > |P ¬a

P −→ P P |Q a

(14)

¬a −→

P −→ P P |Q

a

Q − → P |Q a

Q −→ Q

τ −→

P |Q

consumption) or the emission of message a, respectively. We also consider the bang operator !in(a) which is a form of replication guarded on input operations. The if-then-else forms are used to model the inp(a) and rdp(a) Linda primitives: inp(a)?P Q (rdp(a)?P Q) is a program which requires the message a to be consumed (or simply read); if a is present, the program P is executed, otherwise Q is chosen. In the following, Agent denotes the set containing all possible agents. To give the Ordered Semantics, we use the labeled transition system (Agent, Label, −→) where Label = {τ } ∪ {a, a, a, ¬a | a ∈ M essages} (ranged over by α, β, . . . ) is the set of possible labels. The labeled transition relation −→ is the smallest one satisfying all the axioms and rules in Table 1 plus the symmetric rules of (11) - (14). Due to lack of space, we can not explain here every rule. The interested reader can find the description of all the rules but (9) in [1]. Rule (9) is missing in the original paper since in it no syntactic distinction is made between the inactive parallel composition || and the active parallel composition | . Particular attention should be given to rule (10), which is the one that characterizes the Ordered Semantics: the continuation P and the message < a > reach the tuple space at the same time. Note that rule (12) uses a negative premise. The authors of [1] claim their operational semantics to be well defined since they can prove that the transition system is strictly stratifiable. To formalize rule (12) in Coq we prefer to substitute the negative premise with an equivalent decidable auxiliary predicate N oM essagea , which is the smallest predicate such that: (A) (B) (C)

N oM essagea (< b >) if a = b N oM essagea (C) N oM essage(P ) N oM essage(Q) N oM essage(P |Q)

In what follows we are interested only in computations consisting of reduction steps, i.e. the internal derivations that a stand-alone agent is able to perform independently of the context. In the Linda Calculus reductions are not only the usual derivations labeled with τ , but also those labeled with ¬a. In fact, a ¬a derivation P −→ P indicates that P can become P if no tuples < a > are avail-

44


able in the external environment, which is always true for stand-alone processes. Formally we define a new transition −→ (called step) in the following way: τ ¬a Definition 5. −→ = ( a −→ ) ∪ −→ Since in process algebras there is no explicit notion of state, the only reasonable form of termination of an agent is the absence of outgoing transitions. Because of the presence of the bang operator, it is senseless to distinguish between properly terminated (i.e. consisting of the parallel composition of agents 0) and deadlocked agents. Thus we say that an agent Q is stuck if Q −→ and we say that an agent P terminates if there exist a computation leading to a deadlock, i.e. there exists a stuck agent Q such that P −→∗ Q. No structural congruence relation is defined in [1] on the agents. Nevertheless many statements given in the paper are true only assuming that processes are identified up to commutativity and associativity of parallel composition and neutrality of 0 with respect to parallel composition. Here we prefer to avoid the definition of a structural congruence relation. Instead in section 5 we will state the soundness theorem using the congruence relation induced by the equivalence relation on RAMs1 . 4.1

The Linda Calculus in Coq

The formalization in Coq of the Linda Calculus syntax and its transition system (where rule (12) is modified as already described) is straightforward. Due to lack of space we do not show here all the constructors of the inductive predicate OStep which formalizes the labeled transition: Definition message := nat. Inductive action : Set := In : message→action | Rd : message→action | Out : message→action | BangIn : message→action. Inductive program : Set := Dead : program | Action : action→program→program | IfThenElseAction : action→program→program→program | Parallel : program→program→program. Inductive agent : Set := Message : message→agent | Program : program→agent | AParallel : agent→agent→agent. 1

The two congruence relations are provably equal, but we do not provide the formal proof neither here nor in Coq.


45

Inductive label : Set := Tau : label | LIn : message→label | LRead : message→label | LOut : message→label | LNot : message→label. (* A step in the ORDERED semantics. *) Inductive OStep : agent→label→agent→Prop := SMessage : ∀m:message.(OStep (Message m) (LOut m) (Program Dead)) | SOut : (* This is the transition that makes the semantics ORDERED *) ∀m:message.∀P:program. (OStep (Program (Action (Out m) P)) Tau (AParallel (Message m) (Program P))) | ...

The formalization of the Linda Calculus can be found in the Linda.v file, which is about 130 lines long.

5

The Encoding

We start by reviewing the encoding of RAMs into Linda Calculus agents given in [1]. To model a RAM in the Linda Calculus we need both an encoding for the configurations and one for the programs. The program counter in the configuration (p, c1 , . . . , cn ) is represented by the program counter tuple < p > while the contents of registers rl is modeled by cl occurrences of the tuple < rl > (for l = 1 . . . n): def

[|(p, c1 , . . . , cn )|] = < p > | < r1 > | . . . | < r1 > | . . . | < rn > | . . . | < rn > c1 times

cn times

To model the program R composed of the sequence of instructions i1 . . . im we consider the parallel composition of m agents, each one modeling an instruction: [|R|] [|Succ(rj )|]i

def

= [|i1 |]1 | . . . |[|im |]m

def

= !in(pi ).out(rj ).out(pi+1 )

i def

[|DecJump(rj , s)|] = !in(pi ).inp(rj )?out(pi+1 ) out(ps ) Each RAM instruction is realized by means of three internal steps: the first one (!in(pi )) consumes the program counter; the second update/tests the contents of

46


the register; the third one introduces the new program counter. The instruction is never consumed because of the replication operator. Finally, the agent modeling the program R that starts its computation from the configuration (1, c1 , . . . , cn ) is [|R|]|[|(1, c1 , . . . , cn )|]. The part of [1] that describes the encoding ends with the following theorem: Theorem 1. Let R be a RAM program, then: – Soundness: if [|R|]|[|(p, c1 , . . . , cn )|] −→3 Q then there exists a unique configuration (p , c1 . . . , cn ) such that: Q = [|R|]|[|(p , c1 , . . . , cn )|] and (p, c1 , . . . , cn ) −→R (p , c1 , . . . , cn ) – Completeness: if (p, c1 , . . . , cn ) −→R (p , c1 , . . . , cn ) then also [|R|]|[|(p, c1 , . . . , cn )|] −→3 [|R|]|[|(p , c1 , . . . , cn )|] Proof. By cases on the possible instructions that can be activated. In the proof of soundness we use the fact that the program counter tuple < pi > in the term [|R|]|[|(pi , c1 , . . . , cn )|] ensures that only the agent corresponding to the ith instruction can move. Note in the soundness statement the usage of the equality = between agents. That equality should be intended up to the undefined structural congruence rule. 5.1

The Encoding in Coq

As already suggested in Sect. 3, we decide to encode both register indexes (i.e. numbers in the interval [0 . . . n)) and program counter values (i.e. unbounded integers) as natural numbers: a register index i is mapped to i; a program counter value p is mapped to n + p. The encoding relation [| |] is straightforwardly formalized in Coq as a set of (recursive) definitions. As an example, we show here only the two functions that map the RAM registers into the corresponding agent: Fixpoint agent of register [r: register ; v:nat] : agent := Cases v of O ⇒ (Program Dead) | (S n) ⇒ (AParallel (Message r) (agent of register r n)) end. Fixpoint agent of registers [f:register→nat ; n:nat] : agent := Cases n of O ⇒ (Program Dead) | (S m) ⇒ (AParallel (agent of register m (f m)) (agent of registers f m)) end.


47

Technical induction/recursion principles in the spirit of [7] are sometimes provided to reason on the recursive definitions. Example: Theorem agent of registers ind : ∀f:(register→nat).∀registers no:nat.∀P: agent→Prop. (P (Program Dead))→ (∀r:nat. (r (representing either registers or program counters), dead processes 0 and processes which are images of a Succ or a DecJump instruction (i.e. have either the shape !in(p1 ).out(r).out(p2 ) or the shape !in(p1 ).?inp(r).out(p2 ) out(p3 ) where r ∈ [0, M ) and pi ≥ M for each i – there is exactly one message < m > such that m ≥ N (which is the encoding of the PC m − N ) – for every m ∈ [M, . . . , M + N ) there is exactly one sub-process which is the image of an instruction and that is guarded by !in(m). The process is the encoding of the (m − M )-th instruction – for every m ≥ M + N there is no sub-process which is the image of an instruction and that is guarded by !in(m)

48


Formally, we define in Coq the following (decidable) inductive predicates in Prop: Inductive is RAM instruction [registers no : nat ; pc : nat] : program→Prop Inductive is RAM image no pc [registers no : nat] : agent→Prop Inductive is RAM image pc [registers no : nat] : agent→Prop Inductive instruction does not occur [registers no:nat; n:nat] : agent→Prop Inductive instruction occurs once [registers no:nat ; n:nat] : agent→Prop Inductive is RAM image [registers no : nat ; program length : nat ; P:agent] : Prop := Build is RAM image: (is RAM image pc registers no P)→ (∀n:nat.(n<program length)→ (instruction occurs once registers no (plus registers no n) P))→ (∀n:nat.(n≥program length)→ (instruction does not occur registers no (plus registers no n) P))→ (is RAM image registers no program length P).

Note that several of these predicates are used to characterize only subprocesses of RAM images: for example is RAM image no pc is satisfied by RAM image fragments where all the messages are in the [0, n) interval (i.e. are registers). We also need to provide some more predicates to identify the transient states that are assumed by the Linda agent during the two intermediate steps of the −→3 transition: Inductive is RAM image succ [registers no:nat ; r:register ; pc:nat]: agent→Prop Inductive is RAM image decjump [registers no:nat ; r:register ; pc’:nat ; pc:nat] : agent→Prop Inductive is RAM image out pc [registers no:nat ; pc:nat] : agent→Prop Inductive instruction does not occur2 [registers no:nat; n:nat] : agent→Prop Inductive instruction does not occur3 [registers no:nat; n:nat] : agent→Prop


49

The first predicate is used to check that no PC message appears in the agent and that the “body” of the Succ instruction does (i.e. there is exactly one subprocess out(r).out(pc)); the second predicate does the same for the DecJump instruction; the third predicate checks that no PC message appears in the agent and that there is exactly one sub-process out(pc); the last two predicates are almost equivalent to the instruction does not occur predicate, but are used to state that no instruction guarded by !in(n) is present in agents satisfying respectively the is RAM image succ/is RAM image decjump predicates or the is RAM image out pc predicate. Since all the preceding predicates are given in Prop2 , the Coq system is able to automatically generate only the corresponding induction and inversion principles over Prop (i.e. those where the property P to prove is not computationally relevant and lives in Prop). Nevertheless, since all of them are decidable, it is possible to manually define also the corresponding recursion principles (which are extremely useful when proving constructive existential quantifications). In particular, for each inductive predicate we prove a subset of the following lemmas: 1. The decidability proof 2. The corresponding recursion principles (which are proved by induction on the object of the property and using its decidability lemma and the decidability property of all the other properties used in the type of the constructors) 3. An inversion principle in Set (i.e. over computational properties) 4. A dependent version of the induction principle The defined induction/recursion principles can be easily exploited to prove by induction static properties of RAM images. For example, we use them to prove that no agent satisfies both is RAM image no pc and is RAM image pc. The predicate is RAM image pc is particularly important, since it guarantees the existence of just one program counter message in the agent. Later on we will have to prove that an agent satisfying this predicate can make a τ move unless the corresponding RAM is stuck. The τ move will be obtained when the program counter message will be consumed by the program that encodes the corresponding instruction, i.e. the program counter message will perform a p p −→ move and the instruction program a −→ move where p is the value of the program counter message. To be able to give a constructive proof of this fact, we need to provide a computable function (in Set) that, given a process that satisfies is RAM image pc, gives back its program counter: 2

Prop is the sort of all the types whose terms have no computational content; subterms of sort Prop are removed during code extraction. The propositions whose type is Prop can also be proved classically without interfering with the extraction machinery. Set, instead, is the sort of the types whose terms have computational content; subterms of sort Set are kept during code extraction. Thus any subterm of sort Set can not perform any elimination step over a term of sort Prop, since that term will not be available in the extracted code.

50


Definition pc of RAM image pc : Πregisters no:nat. ΠP:agent. (is RAM image pc registers no P) → message.

The definition must be given carefully to ensure its proof-irrelevance in the third argument: Lemma pc of RAM image pc proof irrelevant : ∀registers no:nat. ∀P:agent. ∀P0,P1:(is RAM image pc registers no P). (pc of RAM image pc registers no P P0) = (pc of RAM image pc registers no P P1).

We must also prove several technical lemmas ensuring that the definition is compositional, i.e. that the value of the program counter of an agent which is a parallel composition is the same value computed on the branch which actually holds the program counter. E.g.: Lemma pc of AParallel equal pc1 : ∀registers no:nat. ∀P,Q:agent. ∀HPQ:(is RAM image pc registers no (AParallel P Q)). ∀HP:(is RAM image pc registers no P). (pc of RAM image pc ? ? HPQ) = (pc of RAM image pc ? ? HP).

Once we have characterized all the possible states a RAM image can assume, we need to start describing the dynamic properties of the system. In particular, for every possible label and for every possible RAM image state, we need to study which are the possible moves and their outcome. As an example, we show here a very small subset of the main lemmas we need to prove3 : an agent P that satisfies is RAM image no pc ¬a

1. does not perform any −→ move a 2. does not perform any −→ move a 3. can perform a −→ move only if a is a program counter (i.e. a ≥ n) a

4. can perform a −→ move only if a is a register (i.e. a < n) a

5. if P −→ P then P satisfies is RAM image no pc an agent P that satisfies is RAM image pc ¬a

1. does not perform any −→ move a 2. does not perform any −→ move a 3. can perform a −→ move only if a is a program counter (i.e. a ≥ n) p

4. ∗ P −→ P where p is the PC computed by pc of RAM image pc a 5. if P −→ P then P satisfies is RAM image no pc a 6. the −→ move is deterministic both in a and in the produced agent 3

The lemmas marked with a ∗ are the one with a computational content.


51

an agent P that satisfies instruction does not occur a

1. can not perform a −→ move on the instruction that does not occur an agent P that satisfies instruction occurs once r

1. ∗ performs a −→ move on the instruction guarded by !in(r) that occurs just once a 2. the −→ move is deterministic an agent P that satisfies is RAM decjump a

1. does not perform any −→ move a 2. can perform a −→ move only if a is a program counter (i.e. a ≥ n) or if a is the register to be decremented a 3. can perform a −→ move only if a is a register (i.e. a < n) ... Proving all these statements without any form of automation turned out to be extremely annoying, since for each proof we need to consider many cases, most of them absurd. Moreover many of the proofs are very similar, since (1) the different predicates just state slightly different properties over similar classes of processes and (2) many cases are due to Linda process constructors or to Linda transitions that are symmetric cases of already considered situations. For example, let’s consider a typical proof fragment: τ

Proof. Given two agents Q and Q such that is RAM image pc(Q) and Q −→ Q , we need to prove a certain property P(Q). We proceed by induction on the proof of the hypothesis is RAM image pc(Q). The two inductive cases are symmetric. The first one is: Case AParallel1: let Q1 , Q2 be two agents such that is RAM image pc(Q1 ), τ is RAM image no pc(Q2 ) and Q1 |Q2 −→ Q . We need to prove P(Q). We τ proceed by cases on the definition of −→. Four out of six cases are absurd: τ Case Tau-Right: Q2 −→ Q2 . Absurd because every process P such that is RAM image no pc(P ) is stuck. r r Case In-Out: Q1 −→ Q1 and Q2 −→ Q2 . Absurd since r < n (because Q2 has no program counter) and r ≥ n since Q1 is a RAM image and the only sub-processes that starts with an rd( ) guard are the instructions which expect to read a program counter message. r r Case Read-Out: Q1 −→ Q1 and Q2 −→ Q2 . Absurd since a RAM image r can not move with a −→ move. Case Out-Read: Dual of the previous case. There are several alternative ways to reduce the size of the proofs and the time spent to develop them: – Register all the lemmas in the database used by the Auto tactic of Coq to try to automatically prove the theorems. – Develop ad-hoc tactics able to prune out all the typical absurd cases.

52


– Develop a whole library of elimination principles used to reason on the dynamic properties of processes. The first solution is not very effective and leads to very poor performances during the proof-searching/compilation phase. In fact, just expanding the few Auto tactics we were using to the script they were producing, we cut down the overall compilation time from 2m30s to less than 2m. Moreover, as for the second solution, only the size of the script is reduced, and not the size of the generated proof-object (lambda-term). Big proof-objects make type-checking slow, are unmanageable when exported to libraries of mathematical knowledge [8], are difficult to data-mine and to render [9]. Moreover, ad-hoc tactics are a form of implicit knowledge that can not be easily shared with other proof assistants, nor presented to the users. The third solution is the one we tried to pursue4 . The idea is to introduce one elimination principle a` la McBride [4] for each combination of moves and preconditions on the agents that perform the move. In appendix A we show the thesis of the elimination principle over the dynamic behavior of a process P such τ that is RAM image pc(P ), instruction occurs oncepc (P ) and P −→ P . The elimination principle can be exploited to enormously reduce the size of both the scripts and the proof-objects of, for example, proof of reduction invariants. A typical case of a statement whose proof is a simple application of one of these elimination principles5 is: Lemma is RAM image decjump Tau message multiplicity eq: ∀registers no:nat. ∀r,m:register. ∀pc,pc’:nat. ∀P,P’:agent. r=m→ (is RAM image decjump registers no r pc’ pc P)→ (OStep P Tau P’)→ (message multiplicity m P)=(message multiplicity m P’).

Once that we have characterized all the possible transitions that RAM images are subject to in each of their states, we can state the completeness axiom and put our attention on the soundness proofs: Axiom RAMs to Linda completeness: (r:RAM ; c,c’:configuration) (RAMs.step r c c’)→ (step3 (agent of RAM and configuration r c) (agent of RAM and configuration r c’)). 4 5

So far only a few elimination principles have been introduced. We plan to give all the needed principles and re-prove all the theorems using them. The one describing the dynamic behavior of RAM images where a DecJump instruction is under execution.


53

Theorem RAMs to Linda soundness: ∀r:RAM. ∀c:configuration. ∀P’:agent. ∀H:(step3 (agent of RAM and configuration r c) P’). (Σc’:configuration | (ΣH0:(RAMs.step r c c’) let Hc be (agent of RAM and configuration is RAM image r c) in let Hc’ be (is RAM image step3 is RAM image ? ? ? ? Hc H) in let Hc’’ be (agent of RAM and configuration is RAM image r c’) in (RAM image equivalence’ ? ? P’ (agent of RAM and configuration r c’) Hc’ Hc’’))).

Note that, to state the soundness theorem, we need to provide another set of lemmas that grants that – the encoding of a RAM satisfies the predicate is RAM image (Lemma agent of RAM and configuration is RAM image). The proof is quite straightforward. – after three steps a RAM image becomes again a RAM image (Lemma is RAM image step3 is RAM image). The proof is very complex and relies on all the previous lemmas. Many of the difficulties met in the second proof derive from the combination of dependent types (used all over the theory) with proof-irrelevant definitions (the function to extract the program counter from a RAM image). In particular we were forced to introduce the following axiom6 . Axiom pc of RAM image pc dependent proof irrelevant: ∀registers no:nat. ∀P,P’:agent. ∀H:(is RAM image pc registers no P). ∀H’:(is RAM image pc registers no P’). P=P’→ (pc of RAM image pc registers no P H) = (pc of RAM image pc registers no P’ H’).

Notice that both the compleness axiom and the axiom we have just introduced are non-informative (i.e. they are of sort Prop). As a consequence, they do not inhibit code extraction, even if inconsistent axioms can destroy the strong normalization property of the extracted code. Indeed, Coq 7.2 successfully extracts code from all the modules that make up our development. The proof of the soundness theorem is obtained by the completeness axiom and by two further lemmas which state that: 6

The axiom is surely related to the axiom used to derive Leibniz equality from JohnMajor equality [4]. As a future work, it should be possible to show the consistency of our axiom by adapting one of the modes that validates the John-Major equality axiom.

54


1. A RAM is stuck iff its RAM image is: 2. The −→3 relation is deterministic up to the congruence induced by the equality on RAMs: Theorem step3 almost deterministic: ∀registers no:nat. ∀program length:nat. ∀P,P’,P’’:agent. (is RAM image registers no program length P)→ (step3 P P’)→(step3 P P’’)→ ∀H:(is RAM image registers no program length P’). ∀H’:(is RAM image registers no program length P’’). (RAM image equivalence’ registers no program length P’ P’’ H H’).

The two lemmas are proved combining all the previously proved lemmas. A key observation to prove the second lemma is that the transition relation of RAM images is almost deterministic: the only situation where more than one transition is possible is the execution of the DecJump(r, s) instruction, that can remove from the tuple space any instance of the < r > message in case the value of the register r (in the corresponding RAM) is greater than 1. Once the lemmas have been proved, the proof becomes almost straightforward. Informally, if the agent that encodes the RAM r and the configuraiont c can move in a new agent P , than the couple (r, c) must move in a new state (r, c ) (because of the first lemmas); the completeness property grants that the image P of (r, c) moves into a new agent P ; since the second lemma states that the reduction −→3 is deterministic (up to the congruence induced by the equality on RAMs), we must conclude that P = P , ending the proof. All the lemmas and proof can be found into the two files RAMs to Linda proofs.v and RAMs to Linda proofs1.v, which are currently about 8700 lines long and require some minutes to be compiled.

6

Conclusions

In this paper we present the formalizations in Coq of both Random Access Machines (RAMs) and a Turing complete version of a process algebra built around the Linda coordination primitives. We also give an encoding of RAMs into the process algebra and a constructive proof of the soundness of the encoding. The formalizations of the two calculi as well as the formalization of the encoding are almost straightforward. The soundness proof, instead, turned out to be extremely long and complex. The deep reasons of the complexity of some parts of the proof can be traced back to the constructive nature of the proof and the heavy usage of functions having both a computational content and proofirrelevant arguments (i.e. functions of the form Πx : A.(P x) → B : Set). More concretely, though, the proof required so much work because of lack of automation in the Coq system: in particular Coq provides only a very limited support for the generation of inversion/induction principles over decidable predicates and no automation at all for the handling of “similar” or “symmetric” cases.


55

Finally, we strongly believe that both the size of the proof script and of the proof-objects can be highly reduced introducing many more elimination and inversion principles to characterize the dynamic behavior of the processes. The generation of these principles, though, should be automatized, since even guessing their precise statement is a non-trivial task. The difficulties we have met and the solutions proposed seem to be unrelated from the particular proof we are examining. Thus further work could be spent in trying to generalize the technique and apply it to other proofs about the mutual encoding of formalisms. Automatizing part of the proofs would be very promising. As a matter of facts, though, it is evident that without any additional automation, the Coq system is not very effective in dealing with this kind of proofs: even for relatively trivial facts, the time spent in the development of the boring details of a constructive and fully formalized proof largely overcomes the time required by the interesting steps. In the next few months we are going to finish the whole development giving also the completeness proof and extracting the code to read-back a RAM from its Linda encoding. A long term goal would be to define inside the RAM formalism its own interpreter and then proving the undecidability of the halting problem. This would really pave the way to far more interesting results, as the proof that the two versions of the Linda Calculus (with Ordered and Unordered Semantics) are not equivalent.

References 1. N. Busi, R. Gorrieri and G. Zavattaro. On the Expressiveness of Linda Coordination Primitives. Information and Computation, 156(1/2):90-121, 2000. 2. The Coq proof-assistant: http://coq.inria.fr/ 3. M. Hofmann. Extensional concepts in intensional type theory. Ph.D. thesis, University of Edinburgh, July 1995. 4. C. McBride. Dependently Typed Functional Programs and their Proofs. Ph.D. thesis, University of Edinburgh, 2000. 5. D. Gelernter. Generative Communication in Linda. ACM Transactions on Programming Languages and Systems, 7(1):80-112, 1985. 6. D. Gelernter and N. Carriero. Coordination Languages and their Significance. Communications of the ACM, 35(2):97-102, 1992. 7. G. Barthe and P. Courtieu. Efficient Reasoning about executable specifications in Coq. In V. Carre˜ no, C. Mun˜ oz and S. Tahar editors, Theorem Proving in Higher Order Logics (TPHOLS), volume 2410 of LNCS, pages 31-46, Springer Verlag, 2001. 8. A. Asperti, F. Guidi, L.Padovani, C. Sacerdoti Coen and I. Schena. Mathematical Knowledge Management in HELM. In On-Line Proceedings of the First International Workshop on Mathematical Knowledge Management (MKM2001), RISCLinz, Austria, September 2001. 9. A. Asperti, F. Guidi, L.Padovani, C. Sacerdoti Coen and I. Schena. XML, Stylesheets and the re-mathematization of Formal Content. In On-Line Proceedings of EXTREME 2001.

56


10. R. Milner. The Polyadic π-Calculus: A Tutorial Technical Report, Department of Computer Science, University of Edinburgh, ECS-LFCS-91-180, October 1991. 11. M. L. Minsky. Computation: finite and infinite machines. Prentice-Hall, Englewood Cliffs, 1967. 12. J. C. Shepherdson and J. E. Sturgis. Computability of recursive functions. Journal of the ACM, 10:217-255, 1963. 13. N. Busi, R. Gorrieri and G. Zavattaro. A Process Algebraic View of Linda Coordination Primitives. Theoretical Computer Science, 192(2):167-199, 1998. 14. N. Busi and G. Zavattaro. On the Expressiveness of Movement in Pure Mobile Ambients. In Prof. of Workshop on Peer-to-Peer Computing, LNCS 2376, SpringerVerlag, 2002.

A

One Example of Elimination Principle Characterizing a Dynamic Behaviour

Lemma is RAM image pc instruction occurs once Tau ind: ∀registers no:nat. ∀P:(agent→agent→Prop). (∀P0,P’,Q:agent. ∀H:(is RAM image pc registers no P0). (is RAM image no pc registers no Q)→ let pc be (pc of RAM image pc ? ? H) in (* This hypothesis can be strengthened *) (instruction occurs once registers no pc (AParallel P0 Q))→ (P P0 P’)→(P (AParallel P0 Q) (AParallel P’ Q)))→ (∀P0,Q,Q’:agent. (is RAM image no pc registers no P0)→ (is RAM image pc registers no Q)→ let pc be (pc of RAM image pc ? ? H) in (* This hypothesis can be strengthened *) (instruction occurs once registers no pc (AParallel P0 Q))→ (P Q Q’)→(P (AParallel P0 Q) (AParallel P0 Q’))→ (∀P0,P’,Q,Q’:agent. ∀r:register. ∀H:(is RAM image pc registers no P0). (is RAM image no pc registers no Q)→ let pc be (pc of RAM image pc ? ? H) in (* This hypothesis can be strengthened *) (instruction occurs once registers no pc (AParallel P0 Q))→ (OStep P0 (LOut r) P’)→ (OStep Q (LIn r) Q’)→ (P (AParallel P0 Q) (AParallel P’ Q’)))→ (∀P0,P’,Q,Q’:agent. ∀r:register. (is RAM image no pc registers no P0)→ ∀H:(is RAM image pc registers no Q). let pc be (pc of RAM image pc ? ? H) in (* This hypothesis can be strengthened *)


(instruction occurs once registers no pc (AParallel P0 Q))→ (OStep P0 (LIn r) P’)→ (OStep Q (LOut r) Q’)→ (P (AParallel P0 Q) (AParallel P’ Q’)))→ ∀a,a’:agent. ∀H:(is RAM image pc registers no a). let pc be (pc of RAM image pc ? ? H) in (instruction occurs once registers no pc a)→ (OStep a Tau a’)→ (P a a’).

57

Finite Horizon Analysis of Stochastic Systems with the Murϕ Verifier Giuseppe Della Penna1 , Benedetto Intrigila1, , Igor Melatti1 , Enrico Tronci2 , and Marisa Venturini Zilli2 1

Dip. di Informatica, Universit` a di L’Aquila, Coppito 67100, L’Aquila, Italy {dellapenna,intrigila,melatti}@di.univaq.it 2 Dip. di Informatica Universit` a di Roma “La Sapienza”, Via Salaria 113, 00198 Roma, Italy {tronci,zilli}@dsi.uniroma1.it

Abstract. Many reactive systems are actually Stochastic Processes. Automatic analysis of such systems is usually very difficult thus typically one simplifies the analysis task by using simulation or by working on a simplified model (e.g. a Markov Chain). We present a Finite Horizon Probabilistic Model Checking approach which essentially can handle the same class of stochastic processes of a typical simulator. This yields easy modeling of the system to be analysed together with formal verification capabilities. Our approach is based on a suitable disk based extension of the Murϕ verifier. Moreover we present experimental results showing effectiveness of our approach.

1

Introduction

Correctness of digital hardware, embedded software and protocols can often be verified with Model Checking techniques [5,9,14,13,18,26] by modeling such systems as Nondeterministic Finite State Systems (NFSS). However, there are many reactive systems that exhibit uncertainty in their behavior, i.e. which are stochastic systems. Examples of such systems are: fault tolerant systems, randomized distributed protocols and communication protocols. Typically stochastic systems cannot be conveniently modeled using NFSS. However they can often be modeled as Stochastic Processes [19]. Unfortunately, automatic analysis of stochastic processes is quite hard, apart from some noticeable special classes of stochastic processes. For this reason typically approximated approaches are used. Namely: simulation or model approximation. Simulation carries out an approximate analysis on the given stochastic

This research has been partially supported by MURST projects: MEFISTO and SAHARA Corresponding Author: Benedetto Intrigila. Tel: +39 0862 43 31 32. Fax: +39 0862 43 31 80


Finite Horizon Analysis of Stochastic Systems with the Murϕ Verifier

59

process. Model approximation carries out an exact analysis on a simplified (approximated) model of the given stochastic process. For example, Markov Chains [3,11] can be used to approximate a given stochastic process. Automatic analysis of Markov Chains can be effectively performed by using Probabilistic Model Checkers [28,6,17,23,12,25,4,7,8,2,15,27]. Probabilistic Model Checkers have been developed also for some particular class of Stochastic Processes [10], namely those in which the probability of an outgoing transition from state s is a function of the sojourn time in state s (semi-Markov Processes). Stochastic Simulators [19] typically can handle fairly general stochastic systems. However, from a simulator we can only get information about the average behavior of the system at hand, whereas from a model checker we also get information about low probability events. In this paper we focus on Discrete Time Stochastic Processes (SP). Our goal is to compute the probability that a given SP reaches an error state in at most k steps starting from a given initial state (Finite Horizon Verification). We will present an approach and a tool to carry out Finite Horizon Verification of a class of SP that is essentially as large as the class of SP that can be handled by many simulators (e.g. [27,19]). To the best of our knowledge, this is the first time that such an approach is presented. Our results can be summarized as follows. 1. We present (Section 3) Probabilistic Rule Based Transition Systems(PRBTS) and show (Section 4) how PRBTS can be used to model a fairly large class of Finite State SP (Discrete Time Stochastic Processes). By using finite precision real numbers as in [21] (and as in any simulator) we can also handle Discrete Time Hybrid Stochastic Processes, i.e. stochastic processes which have continuous (i.e. finite precision real) as well as discrete state variables. 2. PRBTS can be used as a low level language to define stochastic systems. This is useful to separate the task of designing high level languages for system descriptions from the task of designing Verification Engines. As an example, we show (Section 5) how a high level Communicating Processes definition of a stochastic system can be translated, in linear time, into a low level PRBTS definition of the same system. 3. We show (Section 7) how FHP-Murϕ [22], a suitable disk based extension of the Murϕ verifier [18], can be used for automatic Finite Horizon Verification of PRBTS. Indeed, using FHP-Murϕ, PRBTS can be used as a low level language to define stochastic systems whereas FHP-Murϕ can be used as a low level Verification Engine for Finite Horizon Verification of stochastic systems. 4. We show (Section 7) effectiveness of our approach by presenting experimental results on automatic analysis of two nontrivial stochastic systems using with FHP-Murϕ. Our experimental results show that FHP-Murϕ can handle more general models than state-of-the-art Probabilistic Model Checkers like PRISM [24,2,16] or TwoTowers [27].

60

Giuseppe Della Penna et al.

On the other hand PRISM as well as TwoTowers can verify more general properties (e.g. all PCTL [12] properties for PRISM) than FHP-Murϕ. In fact FHP-Murϕ can only handle Finite Horizon Verification.

2

Basic Notation

We give some basic definitions on Finite State/Discrete Time General Stochastic Processes. For more details on stochastic processes see, e.g., [20]. Definition 1. 1. A Finite State/Discrete Time Stochastic Process (shortened SP in the following) is a triple X = (S, P, q) where S is a finite set (of states), q ∈ S is the initial state, Seq(S) is the set of all finite sequences of elements of S, and P : S × Seq(S) × S→ [0, 1] is a transition probability function, i.e. for all s ∈ S, π ∈ Seq(S), t∈S P(s, π, t) = 1. (We included the initial state q in the SP definition to simplify our exposition.) 2. An execution sequence (or path) in the SP X = (S, P, q) is a nonempty (finite or infinite) sequence π = s0 s1 s2 . . . where si are states and P(si , s0 . . . si−1 , si+1 ) > 0 for i = 0, 1, . . .. If π = s0 s1 s2 . . . we write π(k) for sk , and we write π|k for the sequence s0 s1 s2 . . . sk−1 . The length of a finite path π = s0 s1 s2 . . . sk is k (number of transitions), whereas the length of an infinite path is ∞. We denote with |π| the length of π. We denote with Path(X , s) the set of infinite paths π in X s.t. π(0) = s. If X = (S, P, q) we write also Path(X ) for Path(X , q). 3. For s ∈ S we denote with (s) the smallest σ-algebra on Path(X , s) which, for any finite path ρ starting at s, contains the basic cylinders { π ∈ Path(X , s) | ρ is a prefix of π }. The probability measure P r on (s) is the unique k−1 measure with P r{ π ∈ Path(X , s) | ρ is a prefix of π } = P(ρ) = i=0 P(ρ(i), ρ|i, ρ(i+1)) = P(ρ(0), , ρ(1)) P(ρ(1), ρ|1, ρ(2)) · · · P(ρ(k−1), ρ|(k−1), ρ(k)), where k = |ρ| and is the empty sequence. We recall that a Markov Chain is a particular SP, such that the probability transition function P(s, π, t) actually does not depend on π (“lack of memory”) and therefore reduces to a Stochastic Matrix (see [3]). Given a SP, we want to compute the probability that a path of length k starting from the initial state q reaches a state s satisfying a given boolean formula φ.If φ models an error condition, this computation allows us to compute the probability of reaching an error condition in at most k transitions. Problem 1. Let X = (S, P, q) be a SP, k ∈ N, and φ be a boolean function on S. We want to compute: P (X , k, φ) = P r((∃i ≤ k φ(π(i))) | π ∈ Path(X )). That is, we want to compute the probability of reaching a state satisfying φ in at most k steps in the SP X (starting from the initial state q).


61

Problem 1 can be very difficult both from a computational and from an analytical point of view [4,6,7]. So, the first task is to single out a (large enough) class of tractable SP. Moreover, we need to better specify the computational model we want to use. We introduce this model in Section 3. Then, in Section 4 we will show how we intend to cope with our verification problem.

3

Probabilistic Rule Based Transition Systems

Definition 2. A Probabilistic Rule Based Transition System (PRBTS) S is a 3-tuple (S, Rules, q), where: S is a finite set (of states), q ∈ S and Rules is a finite set of pairs (p, f ), with p being a function from S to [0, 1] and f being a function from S to S and ∀s ∈ S (p,f )∈Rules p(s) = 1. Definition 3. Let S = (S, Rules, q) be a PRBTS. An execution sequence in S is a nonempty (finite or infinite) sequence π = s0 s1 s2 . . . where si are states and for every i = 0, 1, . . . there exists a pair (p, f ) ∈ Rules, such that f (si ) = si+1 and p(si ) > 0. As expected, to a PRBTS we can univocally associate a Markov Chain. This can be done as follows. mc = Definition 4. Let S = (S, Rules, q) be a PRBTS. The Markov Chain S (S, P, q) associated to S is defined as follows: P(s, t) = (p,f )∈Ruless.t.f (s)=t p(s) (taking as 0 summation on an empty set).

Proposition 1. Let S = (S, Rules, q) be a PRBTS. Then, the Markov Chain S mc associated to S is well defined.

4

From Stochastic Processes to PRBTS

As we discussed in Section 1, we cannot hope to analyze all possible SP. So, we restrict our analysis to SP such that their transition probabilities depend only on some fixed characteristics of the process history. We formalize this as follows. Definition 5. Let the SP X = (S, P, q) be given. We say that X has finite character n iff there exists an equivalence relation R on Seq(S) of finite index n (that is with n equivalence classes) such that for every π1 , π2 ∈ Seq(S) if R(π1 , π2 ) then ∀s, t ∈ S. P(s, π1 , t) = P(s, π2 , t) Now we show that to a finite character SP X we can associate a PRBTS S, in such a way that the verification Problem 1 for X can be reduced to that for S.

62


Proposition 2. Let the SP X = (S, P, q) be of finite character n w.r.t. an equivalence relation R. Let moreover Q0 , . . . , Qn−1 be an enumeration of the equivalence classes of R. Then there exists a PRBTS S = (S1 , Rules, q1 ), such that: 1. S1 = S × n, where n denotes the set {0, . . . , n − 1}; 2. if π is any sequence in Path(X ), such that π ∈ Qi and π1 = πs is in Qj , where by πs we denote the concatenation of s to the sequence π, and P(s, π, t) > 0, then – there exists at least one pair (p, f ) in Rules such that f ((s, i)) = (t, j) and p((s, i)) > 0, – (p,f )∈Rules s.t.f ((s,i))=(t,j) p(s) = P(s, π, t); 3. q1 = (q, i0 ), where q ∈ Qi0 ; 4. Problem 1 on X with respect to φ can be reduced to compute: P (S mc , k, φ1 ) = P rS mc ((∃i ≤ k φ1 (π(i))) | π ∈ Path(S mc )) where ∀j ∈ n, φ1 ((s, j)) = φ(s), that is P (X , k, φ) = P (S mc , k, φ1 ). Proof. (Sketch) It is easy to see that a PRBTS S, verifying the required conditions, can be specified from X : simply insert in Rules a suitable pair (p, f ) of functions, for every transition P(s, π, t) > 0, taking into account to choose one representative for each equivalence class. As an example, given P(s, π, t) > 0 with π ∈ Qi and πs ∈ Qj , set f as the constant function on S1 returning always (t, j), and set p as the function that returns P(s, π, t) for input (s, i) and 0 otherwise. For the last point, observe that for every such S, the associated Markov Chain S mc gives rise to essentially the same probability measure of X on cylinders and therefore on every set. Indeed, given a path π ∈ Path(S mc ) the indexes in π give no information, since they are univocally determined by the path π itself. We stress that a PRBTS is always defined by a program of a suitable (e.g. C-like) programming language. This allows us to specify functions (p, f ) ∈ Rules inside the program as procedures. This makes their formulation parametric and concise. On the basis of such considerations, we state the following claim: Claim. A rule based (i.e. PRBTS oriented) approach to SP specification is in many cases exponentially shorter than a Markov Chain based specification approach. By a Markov Chain based specification approach we mean any language requiring in many cases an explicit (i.e. tabular) definition of the stochastic matrix of the input Markov Chain. In fact, by comparing the protocol LQS modeled in Section 7.1 (with FHPMurϕ, so with PRBTS) with the model of the same protocol in PRISM (that it is not included here, for space reasons: see [29]), we can see that the former is much shorter than the latter, since it does not grow with the parameter ITEM Q. One may wonder whether this is only a problem of language expressiveness. In a sense, this is not the case, since PRISM needs to store in memory the complete Markov Chain stochastic matrix. On the opposite, FHP-Murϕ treats the Markov Chain exactly with the transition rules given in the model and it does not need to generate all the transition matrix.


5

63

From Communicating Stochastic Processes to PRBTS

As an example of usage of PRBTS as a low level definition language for SP, in this Section we show how the definition of an SP S specified by Communicating Stochastic Processes can be translated into a suitable PRBTS. Definition 6. A System of Communicating Stochastic Processes (SCSP) S is a 4-tuple (n, S, q, R), where: n is an integer (denoting the number of processes in our system); S = S1 ×. . .×Sn is the Cartesian product of finite sets (of states) Si , i = 1, . . . , n; q = (q1 , . . . , qn ) ∈ S; R = R1 , . . . , Rn is a n-tuple of sets Ri i = 1, . . . , n s.t. Ri is a finite set of pairs (p, f ) where p is a function from S to [0, 1], f is a function from S to Si , and ∀i ∈ {1, . . . , n} ∀s ∈ S (p,f )∈Ri p(s) = 1. In the following we denote with boldface letters (e.g. x) elements of S = S1 × . . .×Sn and with xi the i-th component of x. We can define the transition relation of a SCSP assuming that processes are scheduled with uniform probability (1/n if we have n processes). Definition 7. Let S = (n, S, q, R) be a SCSP. The Markov Chain S mc = (S, P, q) associated to S is defined as follows: i=n P(s, t) = i=1 (p,f )∈Ri s.t. (s1 ,...,si−1 ,f (s),si+1 ,...,sn )=t ( n1 · p(s)) (taking as 0 summations on empty sets). Essentially PRBTS are (probabilistic) shared variable concurrent programs. Thus it is not surprising [1] that a SCSP can be transformed into a PRBTS using a suitable uniform probability scheduler. The following definition shows how this can be done (e.g. along the lines in PRISM [24]). Definition 8. Let S = (n, S, q, R) be a SCSP. We denote with Γ (S) the PRBTS 1 (S, q, Rules) defined as follows: Rules = ∪i=n i=1 ∪(p,f )∈Ri {(λx.( n · p(x)), f )} The following proposition follows immediately from the construction in Definition 8. Proposition 3. Let S be a SCSP. Then S mc = Γ (S)mc

Remark 1. Note that the PRBTS transformation of a SCSP is not limited to the case in which the processes are scheduled with a uniform probability. In fact, it is sufficient to modify Definition 8 in this way: Rules = ∪i=n i=1 ∪(p,f )∈Ri {(λx.(s(i) · p(x)), f )}, where s is a function from {1, . . . , n} to [0, 1] denoting the scheduling n probability of the process i ∈ {1, . . . , n} (obviously, s must be such that i=1 s(i) = 1).

64

6


Defining Probabilistic Systems with the Murϕ Verifier

We want to extend the input language of the Murϕ verifier to allow definition of SP using PRBTS. Since Murϕ input language defines NFSS, our main modification to Murϕ input language consists of adding transition probabilities to transition rules. In this Section we show how we modified Murϕ input language to achieve the above goal thus defining FHP-Murϕ input language. The length of FHP-Murϕ finite horizon is passed on the command line to FHP-Murϕ. 6.1

FHP-Murϕ Input Language

We modify Murϕ input language in the following parts: 1. We add a probability specification to each start state; 2. We change the semantics of rules; 3. We only allow one invariant to which we add a probability bound. To handle Discrete Time Hybrid Stochastic Processes it is useful to have state variables ranging on real numbers. For this reason in the following we will consider the Murϕ version enhanced with finite precision real numbers, as described in [21]. To add probabilities in definitions of startstates, we modify the startstate nonterminal production of the Murϕ language grammar (Chapter 7 of the documentation [18]) as follows: <startstate> ::= startstate [<string>] [] [{<decl>} begin] [<stmts>] end where the expression realexpr must evaluate to a real number in [0, 1], and defaults to 1 when it is not specified. If we are given h startstates with probabilities h p1 , . . . , ph , then i=1 pi has to be 1, or FHP-Murϕ will return an error. To add probabilities on rules, we modify the semantics of the simplerule nonterminal production of the Murϕ language grammar (Chapter 7 of the documentation [18]) as follows. The original production, without priority and fairness (not modified in our work), was <simplerule> ::= rule [ <expr> ] ==> [ <decl> begin ] [ stmts ] end.

In FHP-Murϕ, we simply require the expression after the keyword rule (i.e. expr) to be a real expression valued in [0, 1], instead of a boolean as it is for Murϕ. FHP-Murϕ does not allow simultaneous use of both boolean and probability based rules. The above modification to <simplerule> has a deep impact on Murϕ semantics. In fact, with boolean rules, each state has a set of enabled transitions, leading to other states; the activation of a rule only depends on its condition being true or false. In our probabilistic setting, each Murϕ rule defines a pair (p, f ) of the PRBTS being defined. Finally, we modify the invariant nonterminal production of the Murϕ language grammar (Chapter 7 of the documentation [18]) as follows: ::= invariant [ <string> ] where has to be a real valued expression in [0, 1], while has to be a boolean valued expression.


65

type real_type : real(4, 10); var x : real_type; startstate "init"

begin x := 1.0; end;

rule "reset" (x = 0.0? 1.0 : 0.0) ==> begin x := 1.0; end; rule "beetwen 0 and x" (x > 0.0? x : 0.0) ==> begin x := x/10; end; rule "beetwen x and 1" (x > 0.0? 1.0 - x : 0.0) ==> begin x := (1.0 + x)/2.0; end; invariant "never reaches 0.0" 0.0 (x != 0.0)

Fig. 1. An example of FHP-Murϕ input file

In FHP-Murϕ the invariant statement invariant p γ requires that with probability at least p the following holds: “all states reachable in at most k steps from an initial state satisfy γ” (k is FHP-Murϕ horizon). This is equivalent to say that the probability of reaching in at most k steps from an initial state a state not satisfying γ is less than (1 − p). 6.2

A Toy Example

Consider the SP S defined as follows. Initially S is in state 1. If S is in a state x > 0, then with probability x S moves to state x/10, and with probability (1 − x) S moves to state (1 + x)/2. If S is in state 0 then S deterministically moves to state 1. In Fig. 1 we give the FHP-Murϕ definition for S. The FHP-Murϕ invariant in Fig. 1 requires that, with probability at least 0.0 (i.e. always), in all the states, that are reachable in at most k transitions (horizon), x = 0 holds. That is, the probability that we reach, within horizon k, state 0, is less than 0. That is, state 0 is not reachable in S. From definition of S should be quite clear that indeed state 0 is not a reachable state for S. However, since we are using finite precision real numbers, state 0 may be reached because of numerical approximations. In Fig. 1, since the precision of x is 10−9 (with this precision, we have 10−10 = 0), we will reach the state 0 if the horizon is a k ≥ 10. For example, if k = 10, then the probability to reach state 0 is 10−45 .

7

Two Protocols in FHP-Murϕ

In this Section we show how FHP-Murϕ (Finite Horizon Probabilistic Murϕ) [22], a suitable disk based extension of the Murϕ verifier [18], can be used for automatic Finite Horizon Verification of PRBTS. More specifically, we give two examples of our approach describing the behavior of two different queueing systems, showing their implementation in FHPMurϕ and sketching why they are more naturally described in FHP-Murϕ than in PRISM. Both examples describe queue systems with a certain probability that an element in the queue decides to leave its slot without having being served. This results in an error state.

66

7.1


A Length-Based Queue System

The first system models a “Length-Based” Queue System (LQS in the following), and it has the dynamics described below. In a generic state s, the following moves are allowed: 1. An enqueue operation. This operation is possible only if the queue is not full; 2. A dequeue operation. This operation is possible only if the queue is not empty; 3. Each element in the queue can leave its slot (this results in an error state); 4. The system may remain in the same state s. The probabilities of the preceding moves are as follows. Let n be the number of queue slots. Suppose that, in state s, h operations are allowed. We have that 1 ≤ h ≤ 3 + n, since each of the at most n elements in the queue can go in an error state. Then the probability of the first two moves (if they are allowed) is 1 1−e−j h . The probability that a queue element i enters an error state is h , where j is the number of elements preceding i in the queue (i.e. the number of dequeue operations that i must wait for before it is its turn). This means that the more elements preceding i, the higher the probability that i leaves the queue. Finally, the probability that no operation is performed is the complement to 1 of the sum of the other defined probabilities. The implementation of such a system in FHP-Murϕ is quite simple. The queue is modeled with a circular array managed by two pointers, head and tail. For each slot in the queue, we memorize if it is in a correct state or in an error state (i.e. the element has left). In Figure 2 we show the two main functions, prob trans and make trans, and how they are called by the rule ‘‘main’’. Function prob trans returns the outgoing probabilities from the current state s. The parameter i is needed to identify which of the moves allowed in −j s is the one to be calculated. Note that the function 1−eh , where j is the number of elements preceding an element in the queue, is calculated by the function prob err. Function make trans changes state s so as to generate a next state. It uses the parameter i in the same manner as prob trans. The ruleset in Figure 2 calls the rule ‘‘main’’ with the different values for the variable i which are needed in functions prob trans and make trans. Finally, the invariant to be checked states that the probability of the event “for all states s that are reachable in a finite number of steps k, s is not an error state” must be at least 0, where k is a parameter of the verification. Having set the probability to be p ≥ 0 (which is always true) forces FHP-Murϕ to always reach the horizon k (if we had set it to be p ≥ γ, with 0 < γ ≤ 1, the visit would have stopped when p had become less than γ).


67

function prob_trans(i : trans_possib_type) : real_type; begin tmp := 0; /* number of moves except enqueue and dequeue */ trans_possib := 1; /* total number of possible moves */ calc_trans_possib(trans_possib, tmp); if (i >= trans_possib) then return 0.0; /* i ranges on the max transitions number, whilest they are not always all possible */ else if (i < tmp) then return 1.0/trans_possib; else if (i = trans_possib - 1) then return 1.0/trans_possib - sum_prob_prec(); else return prob_err(i - tmp)/trans_possib; endif; endif; endif; end; procedure make_trans(i : trans_possib_type); begin /* the first part is the same as prob_trans */ tmp := 0; trans_possib := 1; calc_trans_possib(trans_possib, tmp); if (i begin make_trans(i); end; end; invariant "queue ok" 0.0 forall i : queue_range do q[i] != err endforall);

Fig. 2. FHP-Murϕ implementation sketch for LQS

7.2

A Time-Based Server-Queue System

The second system models a “Time-Based” Server-Queue System (TSQS in the following), and it has the sequent behavior. In a generic state s, there are two different set of allowed moves. The first set just consists of the enqueue, the dequeue, the server status change and the null operations, with uniform probability. The server status is given by a counter ranging from 0 to MAX COUNT S, modeling the time of service. If the server counter is 0, the server is free, then a dequeue (on a nonempty queue) can be made. In this case, the server counter is set to MAX COUNT S. If the server counter is greater than 0, then it is reset to 0 with probability proportional to the current server counter, and it is simply decremented with a complementary probability. This models the fact that the higher the time of service, the higher the probability of returning free. The second set of moves consists in updating a counter associated to each element in the queue, modeling the time spent by the element in the queue. When this counter reaches a given maximum value (MAX COUNT Q), we are in an error state. The updating phase consist in n + 1 possible transitions, where n is the number of elements currently in the queue: each of the element counters can immediately reach MAX COUNT Q with probability directly proportional to

68

Giuseppe Della Penna et al. function prob_trans(i : trans_possib) : real_type; begin num_trans_possib := 1; calc_trans_possib(trans_possib); if (i >= num_trans_possib) then return 0.0; else /* mod_glob distinguish the two set of moves */ if (mod_glob = 0) then if (s > 0 & i < 2) then if (i = 1) then return (s/MAX_COUNT_S)/(num_trans_possib - 1); else return (1.0 - s/MAX_COUNT_S)/(num_trans_possib - 1); endif; else return 1.0/(s > 0? num_trans_possib - 1 : num_trans_possib); endif; else if (i!=num_trans_possib-1) then return (q[slot(i)]/MAX_COUNT)/num_trans_possib; else return 1.0/trans_possib - sum_prob_prec(); endif; endif; endif; end; procedure make_trans(i : trans_possib); begin num_trans_possib := 1; calc_trans_possib(trans_possib); if (i < num_trans_possib) then if (mod_glob = 0) then if (s > 0 & i < 2) then s := (i = 1? s - 1 : 0); else if (!queue_empty() & s = 0 & i < 1) then . . . . /* dequeue operation */ s := MAX_COUNT_S; else if (!queue_full()&(s>0?i 0 and for every pair of complexity-optimal automata M and N recognizing respectively the prefix u[1] and the suffix u[2, ω] of u, Concatenate(M, N ) is a complexity-optimal automaton recognizing u; ii) l > 0 and there is an integer r ∈ [1, 2l + 2q] such that whenever M and N are two complexity-optimal automata recognizing respectively the prefix u[1, p] (with p being the period of u[1, r]) and the suffix u[r + 1, ω[ of u, then Concatenate(Repeat(M, pr ), N ) is a complexity-optimal automaton recognizing u. iii) l = 0 and for every complexity-optimal automaton M recognizing u[1, q], Iterate(M ) is a complexity-optimal automaton recognizing u; Theorems 1 and 2 suggest a simple dynamic programming algorithm which, given a finite string u or a string-based representation of an ultimately periodic word u, computes in polynomial time a complexity-optimal RLA recognizing u. This algorithm heavily uses information on periods of all the substrings of u. For any finite string v (or any finite prefix v of a given ultimately periodical word), the periods of all the substrings of v can be efficiently computed in time Θ(|v|2 ) by exploiting noticeable properties of periods and borders (the approach is somehow similar to the one used by Knuth, Morris, and Pratt in order to compute the prefix function of a pattern in the context of stringmatching problems [8]). In particular, it turns out that the length q(j) of the maximum border of v[1, j] satisfies the equations q(1) = 0 and, for every j > 1, q(j) = max ({0} ∪ {l : v[l] = v[j] ∧ l − 1 ∈ q + (j − 1)}), where q + denotes the transitive closure of the function q. Since to each maximum border corresponds a minimum partial period, it turns out that the minimum partial periods of all the prefixes of v can be computed in linear time. The above mentioned bound easily follows.

7

Further Work

In this paper we gave a polynomial time algorithm that determines a complexityoptimal representation for RLA. We believe that such an algorithm can actually be improved, by exploiting subtle relationships between repeating patterns of strings and secondary transition functions of complexity-optimal RLA. As a matter of fact, we conjecture that loops of primary and secondary transition functions of a complexity-optimal RLA can be related to maximal repetitions in the recognized word (a maximal repetition of u is a periodical substring u[i, j] whose minimum period increases as soon as u[i, j] is prolonged to the right, e.g., u[i, j + 1], or to the left, e.g., u[i − 1, j]. Another interesting research direction is the development of an algorithm that efficiently solves the size-minimization problem. To this end, we conjecture that size-optimal automata can be built up from smaller components, as we did for complexity-optimal ones, via concatenation, repetition, iteration, and a new operator which collapses “non-distinguishable” states of RLA (at the moment, the major stumbling block is the problem of finding an appropriate definition of RLA distinguishable states).

Towards Compact and Tractable Automaton-Based Representations

85

References 1. C. Bettini, S. Jajodia, and X.S. Wang. Time Granularities in Databases, Data Mining, and Temporal Reasoning. Springer, July 2000. 2. H. Calbrix, M. Nivat, and A. Podelski. Ultimately periodic words of rational ω-languages. In Proceedings of the 9th International Conference on Mathematical Foundations of Programming Semantics, volume 802 of Lecture Notes in Computer Science, pages 554–566. Springer, 1994. 3. C. Combi, M. Franceschet, and A. Peron. A logical approach to represent and reason about calendars. In Proceedings of the 9th International Symposium on Temporal Representation and Reasoning, pages 134–140. IEEE Computer Society Press, 2002. 4. U. Dal Lago and A. Montanari. Calendars, time granularities, and automata. In Proceedings of the 7th International Symposium on Spatial and Temporal Databases (SSTD), volume 2121 of Lecture Notes in Computer Science, pages 279–298. Springer, July 2001. 5. U. Dal Lago, A. Montanari, and G. Puppis. Time granularities, calendar algebra, and automata. Technical Report 4, Dipartimento di Matematica e Informatica, Universit` a degli Studi di Udine, Italy, February 2003. 6. U. Dal Lago, A. Montanari, and G. Puppis. Towards compact and tractable automaton-based representations of time granularities. Technical Report 17, Dipartimento di Matematica e Informatica, Universit` a degli Studi di Udine, Italy, July 2003. 7. C.E. Dyreson, W.S. Evans, H. Lin, and R.T. Snodgrass. Efficiently supporting temporal granularities. IEEE Transactions on Knowledge and Data Engineering, 12(4):568–587, July/August 2000. 8. D.E. Knuth, J.H. Morris, and V.R. Pratt. Fast pattern matching in strings. SIAM Journal on Computing, 6:323–350, 1977. 9. P. Ning, S. Jajodia, and X.S. Wang. An algebraic representation of calendars. Annals of Mathematics and Artificial Intelligence, 36:5–38, 2002. 10. W. Thomas. Languages, automata, and logic. In G. Rozemberg and A. Salomaa, editors, Handbook of Formal Languages, volume 3, pages 389–455. Springer, 1997. 11. J. Wijsen. A string-based model for infinite granularities. In C. Bettini and A. Montanari, editors, Proceedings of the AAAI Workshop on Spatial and Temporal Granularities, pages 9–16. AAAI Press, 2000.

Lower Bounds on the Size of Quantum Automata Accepting Unary Languages Alberto Bertoni, Carlo Mereghetti, and Beatrice Palano Dipartimento di Scienze dell’Informazione Universit` a degli Studi di Milano via Comelico 39/41, 20135 Milano, Italy {bertoni,mereghetti,palano}@dsi.unimi.it

Abstract. In this paper, we study measure-once 1-way quantum automata accepting unary languages, i.e., of type L ⊂ {a}∗ . We give two lower bounds on the number of states of such automata accepting certain languages. 1. We prove the existence of n-periodic languages requiring Ω( logn n ) states to be recognized. This should be compared with results in the literature stating that every n-periodic language can be recognized √ with O( n) states. 2. We give a lower bound on the number of states of automata accepting the finite language L

Theoretical Computer Science, 8 conf., ICTCS 2003

Theoretical Computer Science, 7 conf., ICTCS 2001

Theoretical Computer Science, 9 conf., ICTCS 2005

Computer Security - ESORICS 2003, 8 conf

STACS 91, Theoretical Aspects of Computer Science 8 conf

Computer Science Logic, 17 conf., CSL 2003

Computer Science Logic, 8 conf., CSL '94

Mathematical Foundations of Computer Science 2003, 28 conf., MFCS 2003