No abstract

Two-player games on graphs are widely studied in formal methods as they model the interaction between a system and its environment. The game is played by moving a token throughout a graph to produce an infinite path. There are several common modes to determine how the players move the token through the graph; e.g., in turn-based games the players alternate turns in moving the token. We study the bidding mode of moving the token, which, to the best of our knowledge, has never been studied in infinite-duration games. Both players have separate budgets, which sum up to 1. In each turn, a bidding takes place. Both players submit bids simultaneously, and a bid is legal if it does not exceed the available budget. The winner of the bidding pays his bid to the other player and moves the token. For reachability objectives, repeated bidding games have been studied and are called Richman games [37,36]. There, a central question is the existence and computation of threshold budgets; namely, a value t ∈ [0, 1] such that if Player 1's budget exceeds t, he can win the game, and if Player 2's budget exceeds 1 − t, he can win the game. We focus on parity games and mean-payoff games. We show the existence of threshold budgets in these games, and reduce the problem of finding them to Richman games. We also determine the strategy-complexity of an optimal strategy. Our most interesting result shows that memoryless strategies suffice for mean-payoff bidding games. Infinite-Duration Bidding Gamespays the other player, and decides where the token moves. Draws can occur and one needs to devise a mechanism for resolving them (e.g., giving advantage to Player 1), and our results do not depend on a specific mechanism.Bidding arises in many settings and we list several examples below. The players in a twoplayer game often model concurrent processes. Bidding for moving can model an interaction with a scheduler. The process that wins the bidding gets scheduled and proceeds with its computation. Thus, moving has a cost and processes are interested in moving only when it is critical. When and how much to bid can be seen as quantifying the resources that are needed for a system to achieve its objective, which is an interesting question. Other takes on this problem include reasoning about which input signals need to be read by the system at its different states [20,2] as well as allowing the system to read chunks of input signals before producing an output signal [28,27,33]. Also, our bidding game can model scrip systems that use internal currencies for bidding in order to prevent "free riding" [31]. Such systems are successfully used in various settings such as databases [44], group decision making [43], resource allocation, and peer-to-peer networks (see [29] and references therein). Finally, repeated bidding is a form of a sequential auction [38], which is used in many settings including online advertising.Recall that the winner or value of the game is determined according to the outcome, which is an infinite trace. There are several well-studi...

A controller is a device that interacts with a plant. At each time point, it reads the plant's state and issues commands with the goal that the plant operates optimally. Constructing optimal controllers is a fundamental and challenging problem. Machine learning techniques have recently been successfully applied to train controllers, yet they have limitations. Learned controllers are monolithic and hard to reason about. In particular, it is difficult to add features without retraining, to guarantee any level of performance, and to achieve acceptable performance when encountering untrained scenarios. These limitations can be addressed by deploying quantitative run-time shields that serve as a proxy for the controller. At each time point, the shield reads the command issued by the controller and may choose to alter it before passing it on to the plant. We show how optimal shields that interfere as little as possible while guaranteeing a desired level of controller performance, can be generated systematically and automatically using reactive synthesis. First, we abstract the plant by building a stochastic model. Second, we consider the learned controller to be a black box. Third, we measure controller performance and shield interference by two quantitative run-time measures that are formally defined using weighted automata. Then, the problem of constructing a shield that guarantees maximal performance with minimal interference is the problem of finding an optimal strategy in a stochastic 2-player game "controller versus shield" played on the abstract state space of the plant with a quantitative objective obtained from combining the performance and interference measures. We illustrate the effectiveness of our approach by automatically constructing lightweight shields for learned traffic-light controllers in various road networks. The shields we generate avoid liveness bugs, improve controller performance in untrained and changing traffic situations, and add features to learned controllers, such as giving priority to emergency vehicles.

In two-player games on graphs, the players move a token through a graph to produce an infinite path, which determines the winner or payoff of the game. Such games are central in formal verification since they model the interaction between a non-terminating system and its environment. We study bidding games in which the players bid for the right to move the token. Bidding games with variants of firstprice auctions were previously studied: in each round, the players simultaneously submit bids, the higher bidder moves the token, and, in Richman bidding, pays his bid to the other player whereas in poorman bidding, pays his bid to the "bank". While reachability poorman games have been studied before, we present, for the first time, results on infinite-duration poorman games. A central quantity in these games is the ratio between the two players' initial budgets. We show that the favorable properties of reachability poorman games extend to complex qualitative objectives such as parity, similarly to the Richman case: each vertex has a threshold value, which is a necessary and sufficient ratio with which a player can achieve a goal. Our most interesting results concern quantitative poorman games, namely mean-payoff poorman games, where we construct optimal strategies depending on the initial ratio. The crux of the proof shows that strongly-connected mean-payoff poorman games are equivalent to biased random-turn games. The equivalence in itself is interesting, because it does not hold for reachability poorman games and it is richer than the equivalence with uniform random-turn games that Richman bidding exhibit. We also solve the complexity problems that arise in poorman games. * This paper is a full version of [7]. it visits t. The simplest mode of moving is turn based: the vertices are partitioned between the two players and whenever the token reaches a vertex that is controlled by a player, he decides how to move the token.We study a new mode of moving in infinite-duration games, which is called bidding, and in which the players bid for the right to move the token. The bidding mode of moving was introduced in [31, 32] for reachability games, where two variants of first-price auctions where studied: Each player has a budget, and before each move, the players submit sealed bids simultaneously, where a bid is legal if it does not exceed the available budget, and the higher bidder moves the token. The bidding rules differ in where the higher bidder pays his bid. In Richman bidding (named after David Richman), the higher bidder pays the lower bidder. In poorman bidding, which is the bidding rule that we focus on in this paper, the higher bidder pays the "bank". Thus, the bid is deducted from his budget and the money is lost. Note that while the sum of budgets is constant in Richman bidding, in poorman bidding, the sum of budgets shrinks as the game proceeds. One needs to devise a mechanism that resolves ties in biddings, and our results are not affected by the tie-breaking mechanism that is used.Bidding games naturally mode...

Abstract. Weighted automata map input words to real numbers and are useful in reasoning about quantitative systems and specifications. The containment problem for weighted automata asks, given two weighted automata A and B, whether for all words w, the value that A assigns to w is less than or equal to the value B assigns to w. The problem is of great practical interest, yet is known to be undecidable. Efforts to approximate weighted containment by weighted variants of the simulation pre-order still have to cope with large state spaces. One of the leading approaches for coping with large state spaces is abstraction. We introduce an abstraction-refinement paradigm for weighted automata and show that it nicely combines with weighted simulation, giving rise to a feasible approach for the containment problem. The weighted-simulation pre-order we define is based on a quantitative two-player game, and the technical challenge in the setting origins from the fact the values that the automata assign to words are unbounded.The abstraction-refinement paradigm is based on under-and over-approximation of the automata, where approximation, and hence also the refinement steps, refer not only to the languages of the automata but also to the values they assign to words.

In two-player games on graphs, the players move a token through a graph to produce a finite or infinite path, which determines the qualitative winner or quantitative payoff of the game. We study bidding games in which the players bid for the right to move the token. Several bidding rules were studied previously. In Richman bidding, in each round, the players simultaneously submit bids, and the higher bidder moves the token and pays the other player. Poorman bidding is similar except that the winner of the bidding pays the "bank" rather than the other player. Taxman bidding spans the spectrum between Richman and poorman bidding. They are parameterized by a constant τ ∈ [0, 1]: portion τ of the winning bid is paid to the other player, and portion 1 − τ to the bank. While finite-duration (reachability) taxman games have been studied before, we present, for the first time, results on infinite-duration taxman games. It was previously shown that both Richman and poorman infinite-duration games with qualitative objectives reduce to reachability games, and we show a similar result here. Our most interesting results concern quantitative taxman games, namely mean-payoff games, where poorman and Richman bidding differ significantly. A central quantity in these games is the ratio between the two players' initial budgets. While in poorman mean-payoff games, the optimal payoff of a player depends on the initial ratio, in Richman bidding, the payoff depends only on the structure of the game. In both games the optimal payoffs can be found using (different) probabilistic connections with random-turn games in which in each turn, instead of bidding, a coin is tossed to determine which player moves. While the value with Richman bidding equals the value of a random-turn game with an un-biased coin, with poorman bidding, the bias in the coin is the initial ratio of the budgets. We give a complete classification of mean-payoff taxman games that is based on a probabilistic connection: the value of a taxman bidding game with parameter τ and initial ratio r, equals the value of a random-turn game that uses a coin with bias F (τ, r) = r+τ •(1−r) 1+τ. Thus, we show that Richman bidding is the exception; namely, for every τ < 1, the value of the game depends on the initial ratio. Our proof technique simplifies and unifies the previous proof techniques for both Richman and poorman bidding. 2012 ACM Subject Classification Theory of computation → Solution concepts in game theory; Theory of computation → Formal languages and automata theory Keywords and phrases Bidding games, Richman bidding, poorman bidding, taxman bidding, meanpayoff games, random-turn games

Classical network-formation games are played on a directed graph. Players have reachability objectives: each player has to select a path from his source to target vertices. Each edge has a cost, shared evenly by the players using it. We introduce and study network-formation games with regular objectives. In our setting, the edges are labeled by alphabet letters and the objective of each player is a regular language over the alphabet of labels. Unlike the case of reachability objectives, here the paths selected by the players need not be simple, thus a player may traverse some edges several times. Edge costs are shared by the players with the share being proportional to the number of times the edge is traversed. We study the existence of a pure Nash equilibrium (NE), the inefficiency of a NE compared to a social-optimum solution, and computational complexity problems in this setting.

Time-triggered (TT) switched networks are a deterministic communication infrastructure used by real-time distributed embedded systems. These networks rely on the notion of globally discretized time (i.e. time slots) and a static TT schedule that prescribes which message is sent through which link at every time slot, such that all messages reach their destination before a global timeout. These schedules are generated offline, assuming a static network with fault-free links, and entrusting all error-handling functions to the end user. Assuming the network is static is an over-optimistic view, and indeed links tend to fail in practice. We study synthesis of TT schedules on a network in which links fail over time and we assume the switches run a very simple error-recovery protocol once they detect a crashed link. We address the problem of finding a pk, qresistant schedule; namely, one that, assuming the switches run a fixed error-recovery protocol, guarantees that the number of messages that arrive at their destination by the timeout is at least , no matter what sequence of at most k links fail. Thus, we maintain the simplicity of the switches while giving a guarantee on the number of messages that meet the timeout. We show how a pk, q-resistant schedule can be obtained using a CEGAR-like approach: find a schedule, decide whether it is pk, q-resistant, and if it is not, use the witnessing fault sequence to generate a constraint that is added to the program. The newly added constraint disallows the schedule to be regenerated in a future iteration while also eliminating several other schedules that are not pk, q-resistant. We illustrate the applicability of our approach using an SMT-based implementation.