Finite-state strategies in regular infinite games - Springer Link
Finite-State Strategies in Regular Infinite Games Wolfgang Thomas Institut ffir Informatik und Praktische Mathematik Christian-Albrechts-Universit~.t Kiel, D-24098 Kiel E-Mail: [email protected] A b s t r a c t . This paper surveys work on the synthesis of reactive programs which implement winning strategies in infinite two-person games. The representation of such games by Muller automata and by game graphs (as introduced by McNaughton) is considered, and the construction of winning strategies is described in three stages, covering "guarantee games", "recurrence games", and generM regular games.
1
Introduction
In many fields of computer science, such as operating systems, communication protocols, and control systems, an appropriate view of computation is that of an ongoing (and hence usually nonterminating) interaction between agents. Programs or modules which represent such agents are called reactive (following [HP85], [PR89]). At the present time, no comprehensive methodology is available for the construction of reactive programs. For a certain restricted domain of specifications and programs, however, namely for the case of finite-slate systems, a complete solution for the problem of synthesizing reactive programs exists. These results originate in a branch of a u t o m a t a theory which is not well known. The purpose of this short survey is to give an introduction into the field, and to invite the reader to look into the details in the cited literature. For the sequel we adopt the following assumptions: There are two agents, representing a reactive module and its environment, respectively. Both carry out actions in turn, starting at some moment and going on indefinitely. The possible range of actions is assumed to be finite and thus representable by a finite alphabet S. A possible sequence of actions by the two agents is an w-word over S . While the environment's actions are arbitrary (possibly subject to given restrictions), the module's actions are intended to guarantee certain properties of the resulting action sequences. With this intuition in mind we call the two agents "Control" and "Disturbance", following the terminology of [NYYb]. A specification of desired sequence properties amounts to the presentation of an wlanguage, consisting of all w-sequences of actions sharing the required properties. Thus, the program synthesis problem for the "Control" component is the task of transforming a given definition of an w-language L into a procedure which allows "Control" to choose actions in such a way that for arbitrary choices of actions by "Disturbance" an action sequence in L will result. Already in the early sixties A. Church [Ch63] introduced a similar setting. He considered the issue of circuit synthesis from specifications in restricted systems
150
of arithmetic (which are today known to define certain regular w-languages). He distinguished three problems: The first, called the solution problem, asks for deciding whether a proposed program for "Control" ensures the possible action sequences to satisfy the specification. Today one would call this a model checking problem. The second and third problems, called solvability and synthesis problem, respectively, pose the question whether such a program for "Control" exists for a given specification, resp. how to construct it. In their pioneering paper [BL69], Bfichi and Landweber solved the problem for specifications by regular w-languages, providing an algorithm for the synthesis of corresponding reactive finite-state programs, realized e.g. by Moore automata. (The solution problem, or model checking problem, in this framework was already settled in Biichi's earlier paper [Bfi62] on the decidability of the second-order theory S1S.) The difficulty of the constructions in [BL69] and the super-exponential complexity of the algorithm may have been reasons why the result did not attract much attention. The only textbook where this work is treated seems to be [TB73]. Other proofs, partly covering more general specifications, were later given by Rabin [Ra72], Gurevich and tIarrington [GH82], A. Vakhnis and V. Yakhnis [YY90], [YY92], Thistle and Wonham [TW92], and McNaughton [McN93]. As papers on applications for the construction of reactive modules we mention those of Abadi, Lamport and Wolper [ALW], Pnueli and Rosner [PR891, Nerode, A. Yakhnis and V. Yakhnis [NYYa], [NYYb]. In the following, we shall review the basic automaton constructions and their complexity. We use a game-theoretic terminology due to Gale and Stewart [GS53]. The specifications will be represented by Muller automata (known to define the regular w-languages). Some special cases, corresponding to the specification of particular kinds of properties of nonterminating computations (namely guarantee-properties, safety-properties, and liveness-properties), turn out to be useN1 steps towards the general (finite-state) case. [ thank Olaf ]unge, Helmut Lescow, Sebastian Seibert, and Thomas Wilke for many helpful discussions. 2
Gale-Stewart
Games
The problem of synthesizing reactive programs is formulated conveniently in t.he framework of infinite two-person games, introduced by Gale and Stewart [GS53]. As above, we call the two players "Control" and "Disturbance" and indicate them by C and D. They pick letters alternately from the two alphabets Z c and ZD, respectively. Let X' = L'c U ~UD. A Gate-Stewart game is specified by an w-language P C (L'cZo) ~. A play of the game is an w-word 7 over (~CKD) ~, built up by alternate choices of letters from Z c and Zo; we take the convention that the first letter is chosen by C. Player C wins the play a if we have o~ E F, otherwise D wins tile play. A strategy for C is a function f : (ZD)* ---* ~ c , specifying a choice of a letter from E c for any finite sequence of previous choices of letters by D. Any strategy f for C determines a map f : (ZD) ~~ -~ (X'c) ~, defined by-f(dodld~.. ~) = coclc2.., with ci = f ( d o d t . . , d~-t). If D chooses the
151
sequence 6 = d o d l . 9 9of letters and C uses the strategy f, then C will choose the sequence 7 = f ( 6 ) of letters, building up the play codoCldl .... We shall indicate this w-word from ( Z e r O ) ~ by 7^6. The strategy f for C is a winning slrategy in the game F if for all 6 E (ZD)W, we have f(5)^6 E F. Similarly, a strategy for D is a function g : E + --* ~D, inducing a corresponding map ~ : ( Z c ) ~ ~ (ZD) ~. It is a winning strategy for D in F if for all 7 E ( Z c ) ~, we have 7 7 ( 7 ) ~ F. We could have introduced winning strategies for C and D using complete initial segments of plays as arguments, i.e. words from (,UC!TD)*, resp. from ( Z C ~ D ) * Z C . The two variants are not essentially different; while the version above is convenient in the present discussion, we shall prefer the second variant in Section 4 below. Two basic questions on a given infinite game F are the following, sometimes called the problems of uniformization and determinacy, respectively: If V~3 37
7^~EF,
can we provide a uniform definition of 7 by a suitable strategy f such that
Secondly, if there is no such strategy for C, does this imply the opposite extreme that D has a winning strategy (to win all plays)? Both question were answered positively in the difficult work of Martin [Ma75] for a wide range of infinite games, the so-called Borel games. (This refers to the Cantor space of infinite words, cf. e.g. [Th90] or [TL94] for definitions). Theoreml.
(Martin [Ma75])
I f the w-language F is a Bore~ set in the Cantor space of infinite words, then 1" is determined, i.e.,
(-,Bf V5 f(5)~5 E F) 3
Presentation
of Regular
iff
Bg V7 7^~(7) ~ F.
w-Languages
Regular w-languages are definable in several equivalent formalisms: in the logical system SIS of monadic second-order logic of succssor, in the calculus of w-regular expressions, or by finite automata on infinite words, for instance by nondet,erministic BLichi automata or deterministic Muller automata. A detailed survey is given in [Th90]. Since we identify infinite games with w-languages, we could in principle use any of the mentioned frameworks for specifying regular games. However, all known constructions of winning strategies in regular gaines start from the representation by deterministic automata on w-words. Thus, in the present paper, we introduce the representation by w-automata, more precisely by deterministic Muller automata. (An interesting open problem is to establish a compositional framework for specifying w-languages, e.g. a logic or a calculus of regular expressions, which allows to proceed in a direct way to the construction of strategies.)
152
A (deterministic) Muller aulomar over the alphabet Z is of the form A = (Q, X:, q0, r,.T) with finite state set Q, initial state q0, transition function r : Q • E --~ Q, and a system .T C_ 2 Q of final state sets. The automaton accepts an w-word a if the states visited infinitely often by A while reading the sequence a form a set in ~'. (Formally, given c~ = a(0)c~(1).., and using the canonical extension r* o f t to Q x,U*, this set is {q 6 Q 13~i r*(q0, a ( 0 ) . . . a ( i - 1)) = q}.) From the definition it is clear that only loops (strongly connected components in the state graphs) are reasonable choices of sets in ) r Henceforth we assume this restriction and speak of final loops as opposed to non-final loops. We also assume that in the considered Muller automata all states are reachable from the initial state. The w-language recognized by A consists of all w-words accepted by A. An w-language is regular if it is recognized by some Muller automaton. By an inspection of the acceptance condition of deterministic Muller automata, one verifies that regular w-languages are Borel sets in the Cantor space. (For more background, not given here, the reader is referred to [Wh90] or [TL94].) Thus, by Martin's Theorem, regular games are determined. In the sequel, a more refined view is useful, distinguishing Borel sets by their level in the Borel hierarchy. For regular w-languages, only the first two levels of this hierarchy are relevant. We give a short description (to keep the exposition self-contained) and recall the special fbrm of automata recognizing w-languages in these levels. The first level, consists of the open and the closed ca-languages. A set F C__,U~ is open if it is representable in the form 1" = W ~T M for a set W C L'*. Complements of open sets are called closed. When we regard ca-words as infinite computations, the open and closed sets capture "guarantee properties" and "safety properties" of computations, respectively, requiring that some initial segment, resp. all initial segments of a computation satisfy a condition which is describable by a property of finite words. Typical examples for the second level of the Borel hierarchy are ca-languages of the form lira W (for some W C_ E*), consisting of the w-words over E that have infinitely many initial segments in W. One denotes the class of these w-languages by G~. They represent "recurrence properties" of ca-words, i.e., a certain kind of ]iveness property. (The reader finds more on this classification scheme in [MP92].) Landweber [La69] showed that this classification of w-languages is reflected by the loop structure of corresponding Muller automata; moreover, he showed that this loop structure is an invariant of all Muller automata accepting a given ca-language: 1. A regular w-language/~ is open iff any Muller automaton A recognizing F satisfies the following: From any final loop in A, only loops can be reached in A which are also final. 2. A regular w-language F is in Gs iff any Muller automaton A recognizing P satisfies the following: If F is a final loop and E a loop with F C E, then E is also final. Muller automata with the mentioned closure properties (of the system )r of final state sets) are in fact representable in a simpler form, using a single set F of
153
final states instead. A deterministic finite automaton .A = (Q, Z', q0, r, F) (with F C_ Q) is considered here with the so-called 1-acceptance and 2-acceptance (or Biichi acceptance) mode: A 1-accepts (resp. 2-accepls) the w-word a if for some i (resp. for infinitely many i) we have r*(q0, a ( 0 ) . . , a(i-1)) E F. Finite automata with 1-acceptance correspond to Muller automata as in item (1) above. (Starting from a Muller automaton, one sets F = [..]gr.) Similarly, the w-languages recognized by finite automata with 2-acceptance, also called deterministic Biichi automata, coincide with the w-languages recognized by Muller automata as in item (2). Let us note that the standard transformation of the latter automata into deterministic Biichi automata involves an exponential blow-up of the state space: For simulating a given Muller automaton with state set Q and final system 9r, a corresponding Biichi automaton has the state set Q • 2 @, using the second component as a memory which records the set of visited Q-states; it is reset to 0 when it equals or extends a loop from .T. These reset states (q, 0) are declared as final states.
4
McNaughton's
Game
Graphs
When the players C and D perform a play in a game F specified by the Muller automaton A, the course of the play is fixed by the path through A as determined by the chosen letters during the play. For declaring the winner, however, only the visited stales of this path are relevant. This motivates to drop the transition labels (in the alphabet Z') from a Muller automaton, when the task is just to examine the existence or the construction of winning strategies. This view is taken by McNaughton [McN93], where also other modifications of the model of Muller automaton are suggested in the context of games. For the analysis of the possible courses a path can take through an automaton, it is helpful to associate each state with only one of the two players (namely, that player whose turn it is to choose a transition from the considered state). This leads to a partition of the state set Q into two sets Qc and QD, associated with players C and D, respectively. Finally, an initial state is not specified. From a given Muller automaton A = (Q, Z, q0, r, .T) one can easily pass to a game graph G.a in McNaughton's sense such that the plays in .4 won by C (resp. D) correspond to the plays in GA won by C (resp. D). One introduces two disjoint copies Q' and Q" of the given state set Q and supplies, for any transition (p, a, q) of .A (i.e., such that T(p, a) = q) two edges (p', q") and (p", q'), where the states p~, q~ correspond to p, q in Q~ and p ' , q" correspond to p, q in Q ' . As final state sets in Q' u Q" we admit all sets whose projections to Q determine final sets in .A. A further idea of [McN93] is to distinguish a set W of "relevant states" within the state space Q, whose consideration suffices for determining the winner of a play. Given W, final state sets in the system .T are just subsets of W, and the acceptance condition (or winning condition for player C) only requires that those states from W which are visited infinitely often should form a set in the system
154
5c of final state sets. Thus, final state sets need not be loops. In the present paper, we usually refer only to the case W = Q. In summary, a game graph in the sense of [McN93] is of the form (in our notation) G = (Q, Qc, QD, E, W,.T), where Q is finite, Qc and QD define a partition of Q, E C (Qc x QD) U (Q,D X QC) is a set of edges such that for each q E Q there is an edge leaving q, W C Q, and 5r C 2 W. Plays are now sequences pop1 ... where (Pi,pi+l) E E for all i :> 0, the winning condition is as explained above. As in the previous section, we allow also a single set F of final states instead of f ' . If the winning condition is to reach a state of F at least once, we speak of a guarantee game, if infinitely visits to states in F are required, Of a recurrence
game. As strategies for C, it is convenient to take functions f : (QcQD)*Qc ~ QD (with (p, q) E E for f(Po...Pi-lP) = q), specifying which transition from a Qc'state, ending an initial segment of a play, is to be chosen. (Recall that we have to specify separately a start state for beginning a play.) We speak of a no-memory strategy if the f-values are determined by the last entries of the arguments, i.e. if they are given in the simple form f : Qc -~ QD. Analogously, strategies for D are defined as functions g : (QcQI)) + --~ Qc.
5
Guarantee
Games
and
Recurrence
Games
Let G = (Q, Q c , QD, E, W, F) be a game graph with a single set F of final states. For simplicity we set W = Q. We shall determine those states from which player C has a winning strategy in the guarantee game and in the recurrence game given by G. First we consider the case of a guarantee game. We have to find the states from which player C can force a visit in F. If this is possible starting from q we write q --~ F. (Later we also use the notation q ~ + F to express that from q, C can force a visit in F after at least one step.) The idea is to compute inductively the sets Pi of states from which a visit in F can be forced within i steps (for i _> 0). We have P0 = F and
Pi+I : PiU{p E Qc [ 3(P,q) E E : q E Pi} U {pE Qo ! V(P,q) E Z : q E P i } . Then Pi C_ Pi+l for i >_ 0, so by finiteness of Q the sequence of the Pi becomes constant at some index k. Let P = P~ for the minimal such k. Clearly, from states in P, player C has a winning strategy, because by the above induction C can force to visit states in the sets Pk-1, .Pk-2,. 99 successively, reaching P0 (and thus F ) after at most k steps. Conversely, if the start state is not in P, player D has a winning strategy, simply by keeping to states outside P. (If from some state q outside P, player C could force a visit in P, q would belong to some Pi, contradicting q ~ P.) For D, the game thus amounts to a safety game in which the task is to remain permanently in a specified set of states (in our case in the set Q\P). If a game is specified originally as a safety game (with the requirement that visited states
155
should all belong to F), the states for which a winning strategy exists can be determined by considering the guarantee game for the complement of F and proceeding as above. We now consider the recurrence game given by a game graph of the form G = (Q, Qc, QD, E, W, F). Our task is to determine those states from which a visit to an F-state can be forced by C such that from there infinitely many visits of F-states can be forced. We compute the sets R/, consisting of the states in F from which i visits in F can be forced by C (within a single play): We set R1 = F and R i + l -- f~i Ci
{ q E F I q ''++ Ri } .
Then t~i D_ Ri+l for i >_ 1, and the sequence becomes stationary at some set R = R1 = Rl+l. The set S = {q ~ Q I q "-* R} contains those states for which player C has a winning strategy. It turns out that in all types of games considered here, guarantee games, safety games, and recurrence games, the winning player has a no-memory strategy. No-memory strategies do not arise when the presentation of recurrence games refers to systems ~" of final state sets satisfying Landweber's condition (2) (cf. Section 3). The standard construction for such strategies involves an auxiliary memory of exponential size in the number of states. It is open whether a memory of polynomial size would suffice.
6
Regular
Games
The construction of winning strategies in unrestricted regular games, as given by game graphs G = (Q, Qc, QD, E, W, .T), is more complicated, and we can provide here only a brief sketch of the main approaches developed in the literature. The first proof in [BL69] (reproduced with intuitive explanations in [TB73]) generalizes the analysis of reachability of states as given in the previous section. Since for a win of player C it must be ensured that in some set F of the collection .T all states are visited infinitely often, it is necessary to set up a sequence of goal states to be visited again and again, never leaving the set F while approaching these goals in turn. The complicated point is to remember and reset goals appropriately (from F to other final state sets) when player D has the possibility to force a leave from F. As shown in [BL69], it suffices to use a memory in which increasing chains of final loops are recorded, each with a momentary "state goal". This, however, leads to a doubly exponential size of the finite-state program executing such a winning strategy (in the number of states of the game graph). A different approach was developed by Rabin in IRa72]. He started from the observation that a strategy can be represented as a finitely branching infinite labelled tree. A strategy for C of the form f : (QcQD)*Qc ~ QD corresponds to a IQc I-branching tree whose nodes are given by words from (Qc)* and where the label at a node Pl -..pk is from QD, giving the value f(Plql ...Pk-lqk-lPk) with qi = f(Plql ...Pi-*) for i < h. It is easy to transform a given game graph
156
into a Muller tree automaton which accepts precisely the trees representing winning strategies for C in the game. The question whether there exists a winning strategy amounts to the non-emptiness problem for Muller tree automata. If the tree language is nonempty, it contains even a regular tree, corresponding to a finite-state strategy. Rabin showed how to extract a regular tree from a given tree automaton, using an inductive argument by which the number of states of the considered tree automaton is successively reduced. (A short exposition is given in [Th90].) Rabin's approach (more precisely, an improvement of the nonemptiness test by Hossley and Rackoff [HR72]) was applied by [ALW], [PR89] in constructing reactive programs, giving better complexity bounds than those of [BL69]. A transparent way to set up the state space of winning strategies was found by Gurevich and Harrington [GH82]. Their motivation was to apply a determinacy result (on more general games than regular ones) to the complementation of Rabin tree automata, an approach which also Bfichi adopted in [Bfi77], [Bit83]. Gurevich and Harrington showed that from an initial segment of a play, it suffices to extract the so-called latest appearance record (called latest visitation record LVR in [McN93]) to fix the next move. The LVR contains the states of the game graph in the order they were last visited, i.e. the state q visited last takes the last position, the state p distinct from q which was visited last before q takes the penultimate position, and so on. This approach has been worked out, resp. extended, in several papers ([YY90], [K192], [YY92], [McN93], [Ze94]). A lucid and efficient construction based on the notion of LVR-strategy and starting from finite game graphs is presented in [McN93]. As in Rabin's approach described above, an inductive argument is applied to remove successively states from the game graph. As it turns out, the induction requires only IWI steps (instead of IQI steps). The inductive assumption supplies LVR-strategies for the subgames thus obtained. Reference to the inductive assumption is possible if one of the two players can force to avoid some of the states in W. In the other case, assuming w.l.o.g, that W belongs to 5v and player C is considered, the aim of C is to keep within a proper subset of W (then again referring to the induction hypothesis), or else, if D chooses so, to circle through whole of W infinitely often (which leads to a win of C by W C Y'). The analysis of the proof shows the following: T h e o r e m 2. ([McN93]) Given a finite game graph G : (Q, Qc, QD, E, W, 5 ) one can test in time O(IQ[3+ IW[!) whether player C has a winning strategy and construct a finite-state program executing such a winning strategy with the same bound on the number of its states. Present work in the author's group by O. Junge, H. Lescow, and S. Seibeft (e.g. [Ju94], [Se94]) is concerned with improvements of these complexity bounds and the proof of lower bounds. S. Seibert has shown that 2 [WI is a lower bound on the size of winning strategies in games specified by graphs G = (Q,Qc, Qo, E, W , Y ) . Another aim is to find (size-) optimal strategies for recurrence games specified in this way.
157
7
Conclusion
We have considered the problem of synthesizing reactive programs whose behaviour is given by a regular w-language. If this w-language is specified by a logical formula (for example, a formula of the logic S1S or of propositional temporal logic), the program may be synthesized in three steps. First, the logical formula is converted into a deterministic w-automaton. This automaton is transformed into a game graph, from which then a winning strategy and its implementation by a reactive program are constructed. The first and the third step are difficult, and especially for the third one better synthesis algorithms and complexity bounds (possibly in appropriate special cases) should be found. Other research topics are, for instance, the description of all winning strategies for player C starting from a game representation, and the consideration of non-regular games. These could be games which are presented by certain infinite game graphs (e.g., context-free graphs or recursive graphs). It would be interesting to find appropriate classes of winning strategies reflecting the types of the games, as the finite-state strategies correspond to the regular games.
References [ALW] M. Abadi, L. Lamport, P. Wolper, Realizable and unrealizable specifications of reactive systems, in: Automata, Languages, and Pro9rammin9 (G. Ausiello et al., eds.), Lecture Notes in Computer Science 372 (1989), Springer-Verlag, Berlin 1989, pp. 1-17. [Ch63] A. Church, Logic, arithmetic and automata, Proc. Intern. Congr. Math. 1960, Almqvist and Wiksells, Uppsala 1963. [Bfi62] J.R. Biichi, On a decision method in restricted second order arithmetic, in: Proc. Int. Congr. Logic, Method. and Philos. of Science (E. Nagel et al., eds.), Stanford Univ. Press, Stanford 1962, pp. 1-11. [Bfi77] J.R. Biichi, Using determinacy to eliminate quantifiers, in: Fundamentals o] Computation Theory (M. Karpinski, ed.), Lecture Notes in Computer Science 56, Springer-Verlag, Berlin 1977, pp. 367-378. [B/i83] J.R. Bfichi, State-strategies for games in F~6 N G6~, J. Symb. Logic 48 (1983), 1171-1198. [BL69] J.R. Bfichi, L.H. Landweber, Solving sequential conditions by finite-state strategies, Trans. Amer. Math. Soc. 138 (1969), 295-311. [r D. Gale, F.M. Stewart, Infinite games with perfect information, in: Contributions to the Theory of Games, Princeton Univ. Press, Princeton, N J, 1953. [GH82] Y. Gurevich, L. Harrington, Trees, automata, and games, in: Proc. 14th ACM Syrup. on the Theory of Computing, San Francisco, 1982, pp. 60-65. [HP85] D. Harel, A. Pnueli, On the development of reactive systems, in: NATO A S I Series, Vol F13, Springer-Verlag, New York 1985, pp. 477-498. [HR72] R. Hossley, C.W. Rackoff, The emptiness problem for automata on infinite trees, in: Proe. 18th IEEE Syrup. on Switching and Automata Theory, 1972, 121-124. [Ju94] O. Junge, Konstruktion und Klassifizierung yon Strategien ffir unendliche Spiele auf endlichen Graphen, Diploma Thesis, Inst. f. Informatik u. Prakt. Math., Kiel 1994.
158
[K192]
N. Klarlund, Progress measures, immediate determinacy, and a subset construction for tree automata, in: Proc. 7th IEEE Syrup. on Logic in Computer Science, 1992. [La69] L.H. Landweber, Decision problems for w-automata, Math. Systems Theory 3 (1969), 376-384. [M475] D. Martin, Borel determinacy, Ann. Math. 102 (1975), 363-371. [McN93] R. McNaughton, Infinite games played on finite graphs, Ann. Pure AppL Logic 65, 149-184. [MP92] Z. Manna, A. Pnueli, The Temporal Logic of Reactive and Concurrent Programs, Springer-Verlag, Berlin, Heidelberg, New York 1992. [NYYa] A. Nerode, A. Yakhnis, V. Yakhnis, Concurrent programs as strategies in games, in: Logic from Computer Science (Y. Moschovakis, ed.), Springer~ Verlag, New York 1992. [NYYb] A. Nerode, A. Yakhnis, V. Yakhnis, Modelling hybrid systems as games, in: Proc. 31st IEEE Conf. on Decision and Control, Tucson, Arizona, pp. 29472952. [PR89] A. Pnueli, R. Rosner, On the synthesis of a reactive module, in: Proc. 16th ACM Syrup. on Principles of Progr. Lang., Austin, pp. 179-190. [R472] M.O. Rabin, Automata on infinite objects and Church's Problem, Amer. Math. Soc., Providence, R.I, 1972. [Se94] S. Seibert, Doctoral Thesis, in preparation. [TW92] J.G. Thistle, W.M. Wonham, Control of w-automata, Church's Problem, and the emptiness problem for tree w-automata, in: Computer Science Logic (E. BSrger et al. eds.), Lecture Notes in Computer Science 626 , Springer-Verlag, Berlin 1992, pp. 367-381. [Th90] W. Thomas, Automata on infinite objects, in: J. v. Leeuwen (ed.), Handbook of Theoretical Computer Science, Vol. B., Elsevier Science Publ., Amsterdam 1990, pp. 133-191. [TL94] W. Thomas, It. Lescow, Logical specifications of infinite computations, in: A Decade of Concurrency (J.W. de Bakker et al., eds.), Lecture Notes in Computer Science 803, Springer-Verlag, Berlin 1994, pp. 583-621. [TB73] B.A. Trakhtenbrot, Y.M. Barzdin, .Finite Automata, North-Holland, Amsterdam 1973. [YY90] A. Yakhnis, V. Yakhnis, Extension of Gurevich-Harrington's restricted memory determinacy theorem: A criterion for the winning player and an explicit class of winning stategies, Ann. Pure Appl. Logic 48 (1990), 277-297. [YY92] A. Yakhnis, V. Yakhnis, Gurevich-Harrington games defined by finite automata, Rep. 92-25, Math. Sciences Inst., CorneH Univ., Ithaca, N.Y. [Ze94] S. Zeitman, "Unforgettable forgetful determinacy, J. Logic Computation 4 (1994), 273-283.
1
Introduction
In many fields of computer science, such as operating systems, communication protocols, and control systems, an appropriate view of computation is that of an ongoing (and hence usually nonterminating) interaction between agents. Programs or modules which represent such agents are called reactive (following [HP85], [PR89]). At the present time, no comprehensive methodology is available for the construction of reactive programs. For a certain restricted domain of specifications and programs, however, namely for the case of finite-slate systems, a complete solution for the problem of synthesizing reactive programs exists. These results originate in a branch of a u t o m a t a theory which is not well known. The purpose of this short survey is to give an introduction into the field, and to invite the reader to look into the details in the cited literature. For the sequel we adopt the following assumptions: There are two agents, representing a reactive module and its environment, respectively. Both carry out actions in turn, starting at some moment and going on indefinitely. The possible range of actions is assumed to be finite and thus representable by a finite alphabet S. A possible sequence of actions by the two agents is an w-word over S . While the environment's actions are arbitrary (possibly subject to given restrictions), the module's actions are intended to guarantee certain properties of the resulting action sequences. With this intuition in mind we call the two agents "Control" and "Disturbance", following the terminology of [NYYb]. A specification of desired sequence properties amounts to the presentation of an wlanguage, consisting of all w-sequences of actions sharing the required properties. Thus, the program synthesis problem for the "Control" component is the task of transforming a given definition of an w-language L into a procedure which allows "Control" to choose actions in such a way that for arbitrary choices of actions by "Disturbance" an action sequence in L will result. Already in the early sixties A. Church [Ch63] introduced a similar setting. He considered the issue of circuit synthesis from specifications in restricted systems
150
of arithmetic (which are today known to define certain regular w-languages). He distinguished three problems: The first, called the solution problem, asks for deciding whether a proposed program for "Control" ensures the possible action sequences to satisfy the specification. Today one would call this a model checking problem. The second and third problems, called solvability and synthesis problem, respectively, pose the question whether such a program for "Control" exists for a given specification, resp. how to construct it. In their pioneering paper [BL69], Bfichi and Landweber solved the problem for specifications by regular w-languages, providing an algorithm for the synthesis of corresponding reactive finite-state programs, realized e.g. by Moore automata. (The solution problem, or model checking problem, in this framework was already settled in Biichi's earlier paper [Bfi62] on the decidability of the second-order theory S1S.) The difficulty of the constructions in [BL69] and the super-exponential complexity of the algorithm may have been reasons why the result did not attract much attention. The only textbook where this work is treated seems to be [TB73]. Other proofs, partly covering more general specifications, were later given by Rabin [Ra72], Gurevich and tIarrington [GH82], A. Vakhnis and V. Yakhnis [YY90], [YY92], Thistle and Wonham [TW92], and McNaughton [McN93]. As papers on applications for the construction of reactive modules we mention those of Abadi, Lamport and Wolper [ALW], Pnueli and Rosner [PR891, Nerode, A. Yakhnis and V. Yakhnis [NYYa], [NYYb]. In the following, we shall review the basic automaton constructions and their complexity. We use a game-theoretic terminology due to Gale and Stewart [GS53]. The specifications will be represented by Muller automata (known to define the regular w-languages). Some special cases, corresponding to the specification of particular kinds of properties of nonterminating computations (namely guarantee-properties, safety-properties, and liveness-properties), turn out to be useN1 steps towards the general (finite-state) case. [ thank Olaf ]unge, Helmut Lescow, Sebastian Seibert, and Thomas Wilke for many helpful discussions. 2
Gale-Stewart
Games
The problem of synthesizing reactive programs is formulated conveniently in t.he framework of infinite two-person games, introduced by Gale and Stewart [GS53]. As above, we call the two players "Control" and "Disturbance" and indicate them by C and D. They pick letters alternately from the two alphabets Z c and ZD, respectively. Let X' = L'c U ~UD. A Gate-Stewart game is specified by an w-language P C (L'cZo) ~. A play of the game is an w-word 7 over (~CKD) ~, built up by alternate choices of letters from Z c and Zo; we take the convention that the first letter is chosen by C. Player C wins the play a if we have o~ E F, otherwise D wins tile play. A strategy for C is a function f : (ZD)* ---* ~ c , specifying a choice of a letter from E c for any finite sequence of previous choices of letters by D. Any strategy f for C determines a map f : (ZD) ~~ -~ (X'c) ~, defined by-f(dodld~.. ~) = coclc2.., with ci = f ( d o d t . . , d~-t). If D chooses the
151
sequence 6 = d o d l . 9 9of letters and C uses the strategy f, then C will choose the sequence 7 = f ( 6 ) of letters, building up the play codoCldl .... We shall indicate this w-word from ( Z e r O ) ~ by 7^6. The strategy f for C is a winning slrategy in the game F if for all 6 E (ZD)W, we have f(5)^6 E F. Similarly, a strategy for D is a function g : E + --* ~D, inducing a corresponding map ~ : ( Z c ) ~ ~ (ZD) ~. It is a winning strategy for D in F if for all 7 E ( Z c ) ~, we have 7 7 ( 7 ) ~ F. We could have introduced winning strategies for C and D using complete initial segments of plays as arguments, i.e. words from (,UC!TD)*, resp. from ( Z C ~ D ) * Z C . The two variants are not essentially different; while the version above is convenient in the present discussion, we shall prefer the second variant in Section 4 below. Two basic questions on a given infinite game F are the following, sometimes called the problems of uniformization and determinacy, respectively: If V~3 37
7^~EF,
can we provide a uniform definition of 7 by a suitable strategy f such that
Secondly, if there is no such strategy for C, does this imply the opposite extreme that D has a winning strategy (to win all plays)? Both question were answered positively in the difficult work of Martin [Ma75] for a wide range of infinite games, the so-called Borel games. (This refers to the Cantor space of infinite words, cf. e.g. [Th90] or [TL94] for definitions). Theoreml.
(Martin [Ma75])
I f the w-language F is a Bore~ set in the Cantor space of infinite words, then 1" is determined, i.e.,
(-,Bf V5 f(5)~5 E F) 3
Presentation
of Regular
iff
Bg V7 7^~(7) ~ F.
w-Languages
Regular w-languages are definable in several equivalent formalisms: in the logical system SIS of monadic second-order logic of succssor, in the calculus of w-regular expressions, or by finite automata on infinite words, for instance by nondet,erministic BLichi automata or deterministic Muller automata. A detailed survey is given in [Th90]. Since we identify infinite games with w-languages, we could in principle use any of the mentioned frameworks for specifying regular games. However, all known constructions of winning strategies in regular gaines start from the representation by deterministic automata on w-words. Thus, in the present paper, we introduce the representation by w-automata, more precisely by deterministic Muller automata. (An interesting open problem is to establish a compositional framework for specifying w-languages, e.g. a logic or a calculus of regular expressions, which allows to proceed in a direct way to the construction of strategies.)
152
A (deterministic) Muller aulomar over the alphabet Z is of the form A = (Q, X:, q0, r,.T) with finite state set Q, initial state q0, transition function r : Q • E --~ Q, and a system .T C_ 2 Q of final state sets. The automaton accepts an w-word a if the states visited infinitely often by A while reading the sequence a form a set in ~'. (Formally, given c~ = a(0)c~(1).., and using the canonical extension r* o f t to Q x,U*, this set is {q 6 Q 13~i r*(q0, a ( 0 ) . . . a ( i - 1)) = q}.) From the definition it is clear that only loops (strongly connected components in the state graphs) are reasonable choices of sets in ) r Henceforth we assume this restriction and speak of final loops as opposed to non-final loops. We also assume that in the considered Muller automata all states are reachable from the initial state. The w-language recognized by A consists of all w-words accepted by A. An w-language is regular if it is recognized by some Muller automaton. By an inspection of the acceptance condition of deterministic Muller automata, one verifies that regular w-languages are Borel sets in the Cantor space. (For more background, not given here, the reader is referred to [Wh90] or [TL94].) Thus, by Martin's Theorem, regular games are determined. In the sequel, a more refined view is useful, distinguishing Borel sets by their level in the Borel hierarchy. For regular w-languages, only the first two levels of this hierarchy are relevant. We give a short description (to keep the exposition self-contained) and recall the special fbrm of automata recognizing w-languages in these levels. The first level, consists of the open and the closed ca-languages. A set F C__,U~ is open if it is representable in the form 1" = W ~T M for a set W C L'*. Complements of open sets are called closed. When we regard ca-words as infinite computations, the open and closed sets capture "guarantee properties" and "safety properties" of computations, respectively, requiring that some initial segment, resp. all initial segments of a computation satisfy a condition which is describable by a property of finite words. Typical examples for the second level of the Borel hierarchy are ca-languages of the form lira W (for some W C_ E*), consisting of the w-words over E that have infinitely many initial segments in W. One denotes the class of these w-languages by G~. They represent "recurrence properties" of ca-words, i.e., a certain kind of ]iveness property. (The reader finds more on this classification scheme in [MP92].) Landweber [La69] showed that this classification of w-languages is reflected by the loop structure of corresponding Muller automata; moreover, he showed that this loop structure is an invariant of all Muller automata accepting a given ca-language: 1. A regular w-language/~ is open iff any Muller automaton A recognizing F satisfies the following: From any final loop in A, only loops can be reached in A which are also final. 2. A regular w-language F is in Gs iff any Muller automaton A recognizing P satisfies the following: If F is a final loop and E a loop with F C E, then E is also final. Muller automata with the mentioned closure properties (of the system )r of final state sets) are in fact representable in a simpler form, using a single set F of
153
final states instead. A deterministic finite automaton .A = (Q, Z', q0, r, F) (with F C_ Q) is considered here with the so-called 1-acceptance and 2-acceptance (or Biichi acceptance) mode: A 1-accepts (resp. 2-accepls) the w-word a if for some i (resp. for infinitely many i) we have r*(q0, a ( 0 ) . . , a(i-1)) E F. Finite automata with 1-acceptance correspond to Muller automata as in item (1) above. (Starting from a Muller automaton, one sets F = [..]gr.) Similarly, the w-languages recognized by finite automata with 2-acceptance, also called deterministic Biichi automata, coincide with the w-languages recognized by Muller automata as in item (2). Let us note that the standard transformation of the latter automata into deterministic Biichi automata involves an exponential blow-up of the state space: For simulating a given Muller automaton with state set Q and final system 9r, a corresponding Biichi automaton has the state set Q • 2 @, using the second component as a memory which records the set of visited Q-states; it is reset to 0 when it equals or extends a loop from .T. These reset states (q, 0) are declared as final states.
4
McNaughton's
Game
Graphs
When the players C and D perform a play in a game F specified by the Muller automaton A, the course of the play is fixed by the path through A as determined by the chosen letters during the play. For declaring the winner, however, only the visited stales of this path are relevant. This motivates to drop the transition labels (in the alphabet Z') from a Muller automaton, when the task is just to examine the existence or the construction of winning strategies. This view is taken by McNaughton [McN93], where also other modifications of the model of Muller automaton are suggested in the context of games. For the analysis of the possible courses a path can take through an automaton, it is helpful to associate each state with only one of the two players (namely, that player whose turn it is to choose a transition from the considered state). This leads to a partition of the state set Q into two sets Qc and QD, associated with players C and D, respectively. Finally, an initial state is not specified. From a given Muller automaton A = (Q, Z, q0, r, .T) one can easily pass to a game graph G.a in McNaughton's sense such that the plays in .4 won by C (resp. D) correspond to the plays in GA won by C (resp. D). One introduces two disjoint copies Q' and Q" of the given state set Q and supplies, for any transition (p, a, q) of .A (i.e., such that T(p, a) = q) two edges (p', q") and (p", q'), where the states p~, q~ correspond to p, q in Q~ and p ' , q" correspond to p, q in Q ' . As final state sets in Q' u Q" we admit all sets whose projections to Q determine final sets in .A. A further idea of [McN93] is to distinguish a set W of "relevant states" within the state space Q, whose consideration suffices for determining the winner of a play. Given W, final state sets in the system .T are just subsets of W, and the acceptance condition (or winning condition for player C) only requires that those states from W which are visited infinitely often should form a set in the system
154
5c of final state sets. Thus, final state sets need not be loops. In the present paper, we usually refer only to the case W = Q. In summary, a game graph in the sense of [McN93] is of the form (in our notation) G = (Q, Qc, QD, E, W,.T), where Q is finite, Qc and QD define a partition of Q, E C (Qc x QD) U (Q,D X QC) is a set of edges such that for each q E Q there is an edge leaving q, W C Q, and 5r C 2 W. Plays are now sequences pop1 ... where (Pi,pi+l) E E for all i :> 0, the winning condition is as explained above. As in the previous section, we allow also a single set F of final states instead of f ' . If the winning condition is to reach a state of F at least once, we speak of a guarantee game, if infinitely visits to states in F are required, Of a recurrence
game. As strategies for C, it is convenient to take functions f : (QcQD)*Qc ~ QD (with (p, q) E E for f(Po...Pi-lP) = q), specifying which transition from a Qc'state, ending an initial segment of a play, is to be chosen. (Recall that we have to specify separately a start state for beginning a play.) We speak of a no-memory strategy if the f-values are determined by the last entries of the arguments, i.e. if they are given in the simple form f : Qc -~ QD. Analogously, strategies for D are defined as functions g : (QcQI)) + --~ Qc.
5
Guarantee
Games
and
Recurrence
Games
Let G = (Q, Q c , QD, E, W, F) be a game graph with a single set F of final states. For simplicity we set W = Q. We shall determine those states from which player C has a winning strategy in the guarantee game and in the recurrence game given by G. First we consider the case of a guarantee game. We have to find the states from which player C can force a visit in F. If this is possible starting from q we write q --~ F. (Later we also use the notation q ~ + F to express that from q, C can force a visit in F after at least one step.) The idea is to compute inductively the sets Pi of states from which a visit in F can be forced within i steps (for i _> 0). We have P0 = F and
Pi+I : PiU{p E Qc [ 3(P,q) E E : q E Pi} U {pE Qo ! V(P,q) E Z : q E P i } . Then Pi C_ Pi+l for i >_ 0, so by finiteness of Q the sequence of the Pi becomes constant at some index k. Let P = P~ for the minimal such k. Clearly, from states in P, player C has a winning strategy, because by the above induction C can force to visit states in the sets Pk-1, .Pk-2,. 99 successively, reaching P0 (and thus F ) after at most k steps. Conversely, if the start state is not in P, player D has a winning strategy, simply by keeping to states outside P. (If from some state q outside P, player C could force a visit in P, q would belong to some Pi, contradicting q ~ P.) For D, the game thus amounts to a safety game in which the task is to remain permanently in a specified set of states (in our case in the set Q\P). If a game is specified originally as a safety game (with the requirement that visited states
155
should all belong to F), the states for which a winning strategy exists can be determined by considering the guarantee game for the complement of F and proceeding as above. We now consider the recurrence game given by a game graph of the form G = (Q, Qc, QD, E, W, F). Our task is to determine those states from which a visit to an F-state can be forced by C such that from there infinitely many visits of F-states can be forced. We compute the sets R/, consisting of the states in F from which i visits in F can be forced by C (within a single play): We set R1 = F and R i + l -- f~i Ci
{ q E F I q ''++ Ri } .
Then t~i D_ Ri+l for i >_ 1, and the sequence becomes stationary at some set R = R1 = Rl+l. The set S = {q ~ Q I q "-* R} contains those states for which player C has a winning strategy. It turns out that in all types of games considered here, guarantee games, safety games, and recurrence games, the winning player has a no-memory strategy. No-memory strategies do not arise when the presentation of recurrence games refers to systems ~" of final state sets satisfying Landweber's condition (2) (cf. Section 3). The standard construction for such strategies involves an auxiliary memory of exponential size in the number of states. It is open whether a memory of polynomial size would suffice.
6
Regular
Games
The construction of winning strategies in unrestricted regular games, as given by game graphs G = (Q, Qc, QD, E, W, .T), is more complicated, and we can provide here only a brief sketch of the main approaches developed in the literature. The first proof in [BL69] (reproduced with intuitive explanations in [TB73]) generalizes the analysis of reachability of states as given in the previous section. Since for a win of player C it must be ensured that in some set F of the collection .T all states are visited infinitely often, it is necessary to set up a sequence of goal states to be visited again and again, never leaving the set F while approaching these goals in turn. The complicated point is to remember and reset goals appropriately (from F to other final state sets) when player D has the possibility to force a leave from F. As shown in [BL69], it suffices to use a memory in which increasing chains of final loops are recorded, each with a momentary "state goal". This, however, leads to a doubly exponential size of the finite-state program executing such a winning strategy (in the number of states of the game graph). A different approach was developed by Rabin in IRa72]. He started from the observation that a strategy can be represented as a finitely branching infinite labelled tree. A strategy for C of the form f : (QcQD)*Qc ~ QD corresponds to a IQc I-branching tree whose nodes are given by words from (Qc)* and where the label at a node Pl -..pk is from QD, giving the value f(Plql ...Pk-lqk-lPk) with qi = f(Plql ...Pi-*) for i < h. It is easy to transform a given game graph
156
into a Muller tree automaton which accepts precisely the trees representing winning strategies for C in the game. The question whether there exists a winning strategy amounts to the non-emptiness problem for Muller tree automata. If the tree language is nonempty, it contains even a regular tree, corresponding to a finite-state strategy. Rabin showed how to extract a regular tree from a given tree automaton, using an inductive argument by which the number of states of the considered tree automaton is successively reduced. (A short exposition is given in [Th90].) Rabin's approach (more precisely, an improvement of the nonemptiness test by Hossley and Rackoff [HR72]) was applied by [ALW], [PR89] in constructing reactive programs, giving better complexity bounds than those of [BL69]. A transparent way to set up the state space of winning strategies was found by Gurevich and Harrington [GH82]. Their motivation was to apply a determinacy result (on more general games than regular ones) to the complementation of Rabin tree automata, an approach which also Bfichi adopted in [Bfi77], [Bit83]. Gurevich and Harrington showed that from an initial segment of a play, it suffices to extract the so-called latest appearance record (called latest visitation record LVR in [McN93]) to fix the next move. The LVR contains the states of the game graph in the order they were last visited, i.e. the state q visited last takes the last position, the state p distinct from q which was visited last before q takes the penultimate position, and so on. This approach has been worked out, resp. extended, in several papers ([YY90], [K192], [YY92], [McN93], [Ze94]). A lucid and efficient construction based on the notion of LVR-strategy and starting from finite game graphs is presented in [McN93]. As in Rabin's approach described above, an inductive argument is applied to remove successively states from the game graph. As it turns out, the induction requires only IWI steps (instead of IQI steps). The inductive assumption supplies LVR-strategies for the subgames thus obtained. Reference to the inductive assumption is possible if one of the two players can force to avoid some of the states in W. In the other case, assuming w.l.o.g, that W belongs to 5v and player C is considered, the aim of C is to keep within a proper subset of W (then again referring to the induction hypothesis), or else, if D chooses so, to circle through whole of W infinitely often (which leads to a win of C by W C Y'). The analysis of the proof shows the following: T h e o r e m 2. ([McN93]) Given a finite game graph G : (Q, Qc, QD, E, W, 5 ) one can test in time O(IQ[3+ IW[!) whether player C has a winning strategy and construct a finite-state program executing such a winning strategy with the same bound on the number of its states. Present work in the author's group by O. Junge, H. Lescow, and S. Seibeft (e.g. [Ju94], [Se94]) is concerned with improvements of these complexity bounds and the proof of lower bounds. S. Seibert has shown that 2 [WI is a lower bound on the size of winning strategies in games specified by graphs G = (Q,Qc, Qo, E, W , Y ) . Another aim is to find (size-) optimal strategies for recurrence games specified in this way.
157
7
Conclusion
We have considered the problem of synthesizing reactive programs whose behaviour is given by a regular w-language. If this w-language is specified by a logical formula (for example, a formula of the logic S1S or of propositional temporal logic), the program may be synthesized in three steps. First, the logical formula is converted into a deterministic w-automaton. This automaton is transformed into a game graph, from which then a winning strategy and its implementation by a reactive program are constructed. The first and the third step are difficult, and especially for the third one better synthesis algorithms and complexity bounds (possibly in appropriate special cases) should be found. Other research topics are, for instance, the description of all winning strategies for player C starting from a game representation, and the consideration of non-regular games. These could be games which are presented by certain infinite game graphs (e.g., context-free graphs or recursive graphs). It would be interesting to find appropriate classes of winning strategies reflecting the types of the games, as the finite-state strategies correspond to the regular games.
References [ALW] M. Abadi, L. Lamport, P. Wolper, Realizable and unrealizable specifications of reactive systems, in: Automata, Languages, and Pro9rammin9 (G. Ausiello et al., eds.), Lecture Notes in Computer Science 372 (1989), Springer-Verlag, Berlin 1989, pp. 1-17. [Ch63] A. Church, Logic, arithmetic and automata, Proc. Intern. Congr. Math. 1960, Almqvist and Wiksells, Uppsala 1963. [Bfi62] J.R. Biichi, On a decision method in restricted second order arithmetic, in: Proc. Int. Congr. Logic, Method. and Philos. of Science (E. Nagel et al., eds.), Stanford Univ. Press, Stanford 1962, pp. 1-11. [Bfi77] J.R. Biichi, Using determinacy to eliminate quantifiers, in: Fundamentals o] Computation Theory (M. Karpinski, ed.), Lecture Notes in Computer Science 56, Springer-Verlag, Berlin 1977, pp. 367-378. [B/i83] J.R. Bfichi, State-strategies for games in F~6 N G6~, J. Symb. Logic 48 (1983), 1171-1198. [BL69] J.R. Bfichi, L.H. Landweber, Solving sequential conditions by finite-state strategies, Trans. Amer. Math. Soc. 138 (1969), 295-311. [r D. Gale, F.M. Stewart, Infinite games with perfect information, in: Contributions to the Theory of Games, Princeton Univ. Press, Princeton, N J, 1953. [GH82] Y. Gurevich, L. Harrington, Trees, automata, and games, in: Proc. 14th ACM Syrup. on the Theory of Computing, San Francisco, 1982, pp. 60-65. [HP85] D. Harel, A. Pnueli, On the development of reactive systems, in: NATO A S I Series, Vol F13, Springer-Verlag, New York 1985, pp. 477-498. [HR72] R. Hossley, C.W. Rackoff, The emptiness problem for automata on infinite trees, in: Proe. 18th IEEE Syrup. on Switching and Automata Theory, 1972, 121-124. [Ju94] O. Junge, Konstruktion und Klassifizierung yon Strategien ffir unendliche Spiele auf endlichen Graphen, Diploma Thesis, Inst. f. Informatik u. Prakt. Math., Kiel 1994.
158
[K192]
N. Klarlund, Progress measures, immediate determinacy, and a subset construction for tree automata, in: Proc. 7th IEEE Syrup. on Logic in Computer Science, 1992. [La69] L.H. Landweber, Decision problems for w-automata, Math. Systems Theory 3 (1969), 376-384. [M475] D. Martin, Borel determinacy, Ann. Math. 102 (1975), 363-371. [McN93] R. McNaughton, Infinite games played on finite graphs, Ann. Pure AppL Logic 65, 149-184. [MP92] Z. Manna, A. Pnueli, The Temporal Logic of Reactive and Concurrent Programs, Springer-Verlag, Berlin, Heidelberg, New York 1992. [NYYa] A. Nerode, A. Yakhnis, V. Yakhnis, Concurrent programs as strategies in games, in: Logic from Computer Science (Y. Moschovakis, ed.), Springer~ Verlag, New York 1992. [NYYb] A. Nerode, A. Yakhnis, V. Yakhnis, Modelling hybrid systems as games, in: Proc. 31st IEEE Conf. on Decision and Control, Tucson, Arizona, pp. 29472952. [PR89] A. Pnueli, R. Rosner, On the synthesis of a reactive module, in: Proc. 16th ACM Syrup. on Principles of Progr. Lang., Austin, pp. 179-190. [R472] M.O. Rabin, Automata on infinite objects and Church's Problem, Amer. Math. Soc., Providence, R.I, 1972. [Se94] S. Seibert, Doctoral Thesis, in preparation. [TW92] J.G. Thistle, W.M. Wonham, Control of w-automata, Church's Problem, and the emptiness problem for tree w-automata, in: Computer Science Logic (E. BSrger et al. eds.), Lecture Notes in Computer Science 626 , Springer-Verlag, Berlin 1992, pp. 367-381. [Th90] W. Thomas, Automata on infinite objects, in: J. v. Leeuwen (ed.), Handbook of Theoretical Computer Science, Vol. B., Elsevier Science Publ., Amsterdam 1990, pp. 133-191. [TL94] W. Thomas, It. Lescow, Logical specifications of infinite computations, in: A Decade of Concurrency (J.W. de Bakker et al., eds.), Lecture Notes in Computer Science 803, Springer-Verlag, Berlin 1994, pp. 583-621. [TB73] B.A. Trakhtenbrot, Y.M. Barzdin, .Finite Automata, North-Holland, Amsterdam 1973. [YY90] A. Yakhnis, V. Yakhnis, Extension of Gurevich-Harrington's restricted memory determinacy theorem: A criterion for the winning player and an explicit class of winning stategies, Ann. Pure Appl. Logic 48 (1990), 277-297. [YY92] A. Yakhnis, V. Yakhnis, Gurevich-Harrington games defined by finite automata, Rep. 92-25, Math. Sciences Inst., CorneH Univ., Ithaca, N.Y. [Ze94] S. Zeitman, "Unforgettable forgetful determinacy, J. Logic Computation 4 (1994), 273-283.
