@article{4280, author = {Ritchie, Mike and Barton, Nicholas H}, issn = {0169-5347}, journal = {Trends in Ecology and Evolution}, number = {7}, pages = {282 -- 283}, publisher = {Cell Press}, title = {{Hybrids and hybrid zones: Reply from M.G. Ritchie and N.H. Barton}}, doi = {10.1016/S0169-5347(98)01396-2}, volume = {13}, year = {1998}, } @article{4281, abstract = {Most higher organisms reproduce sexually, despite the automatic reproductive advantage experienced by asexual variants. This implies the operation of selective forces that confer an advantage to sexuality and genetic recombination, at either the population or individual level. The effect of sex and recombination in breaking down negative correlations between favorable variants at different genetic loci, which increases the efficiency of natural selection, is likely to be a major factor favoring their evolution and maintenance. Various processes that can cause such an effect have been studied theoretically. It has, however, so far proved hard to discriminate among them empirically. }, author = {Barton, Nicholas H and Charlesworth, Brian}, issn = {0036-8075}, journal = {Science}, number = {5385}, pages = {1986 -- 1990}, publisher = {American Association for the Advancement of Science}, title = {{Why sex and recombination?}}, doi = {10.1126/science.281.5385.1986}, volume = {281}, year = {1998}, } @misc{4282, author = {Barton, Nicholas H}, booktitle = {Genetical Research}, issn = {0016-6723}, number = {1}, pages = {73 -- 73}, publisher = {Cambridge University Press}, title = {{Genetics and analysis of quantitative traits}}, doi = {10.1017/S0016672398219732}, volume = {72}, year = {1998}, } @misc{4283, author = {Barton, Nicholas H}, booktitle = {Nature}, issn = {0028-0836}, number = {6704}, pages = {751 -- 752}, publisher = {Nature Publishing Group}, title = {{The geometry of adaptation}}, doi = {10.1038/27338}, volume = {395}, year = {1998}, } @inproceedings{4408, abstract = {This paper presents a complete axiomatization of fully decidable propositional real-time linear temporal logics with past: the Event Clock Logic (ECL) and the Metric Interval Temporal Logic with past (MITL). The completeness proof consists of an effective proof building procedure for ECL. From this result we obtain a complete axiomatization of MITL by providing axioms translating MITL formulae into ECL formulae, the two logics being equally expressive. Our proof is structured to yield a similar axiomatization and procedure for interesting fragments of these logics, such as the linear temporal logic of the real numbers (LTR).}, author = {Raskin, Jean and Schobbens, Pierre and Henzinger, Thomas A}, booktitle = {Proceedings of the 9th Interantional Conference on Concurrency Theory}, isbn = {9783540648963}, location = {Nice, France}, pages = {219 -- 236}, publisher = {Schloss Dagstuhl - Leibniz-Zentrum für Informatik}, title = {{Axioms for real-time logics}}, doi = {10.1007/BFb0055625}, volume = {1466}, year = {1998}, } @inproceedings{4410, abstract = {Rectangular automata are well suited for approximate modeling of continuous-discrete systems. The exact analysis of these automata is feasible for small examples but can encounter severe numerical problems for even medium-sized systems. This paper presents an analysis algorithm that uses conservative overapproximation to avoid these numerical problems. The algorithm is demonstrated on a simple benchmark system consisting of two connected tanks. Supported by the German Research Council (DFG) under grant Ko1430/3 in the special program KONDISK (‘Continuous-discrete dynamics of technical systems’).}, author = {Preußig, Jörg and Kowalewski, Stefan and Wong Toi, Howard and Henzinger, Thomas A}, booktitle = {Proceedings of the 5th International Symposium on Formal Techniques in Real-Time and Fault-Tolerant Systems}, isbn = {9783540650034}, location = {Lyngby, Denmark}, pages = {228 -- 240}, publisher = {Springer}, title = {{An algorithm for the approximative analysis of rectangular automata}}, doi = {10.1007/BFb0055350}, volume = {1486}, year = {1998}, } @inproceedings{4429, abstract = {We study the reachability problem for hybrid automata. Automatic approaches, which attempt to construct the reachable region by symbolic execution, often do not terminate. In these cases, we require the user to guess the reachable region, and we use a theorem prover (Pvs) to verify the guess. We classify hybrid automata according to the theory in which their reachable region can be defined finitely. This is the theory in which the prover needs to operate in order to verify the guess. The approach is interesting, because an appropriate guess can often be deduced by extrapolating from the first few steps of symbolic execution.}, author = {Henzinger, Thomas A and Rusu, Vlad}, booktitle = {Proceedings of the 1st International Workshop on Hybrid Systems: Computation and Control}, isbn = {9783540643586}, location = {Berkely, CA, United States of America}, pages = {190 -- 204}, publisher = {Springer}, title = {{Reachability verification for hybrid automata}}, doi = {10.1007/3-540-64358-3_40}, volume = {1386}, year = {1998}, } @proceedings{4430, editor = {Henzinger, Thomas A}, isbn = {978-3-540-64358-6}, location = {Berkeley, CA, United States of America}, publisher = {Springer}, title = {{HSCC: Hybrid Systems—Computation and Control}}, doi = {10.1007/3-540-64358-3}, volume = {1386}, year = {1998}, } @inproceedings{4486, abstract = {The simulation preorder on state transition systems is widely accepted as a useful notion of refinement, both in its own right and as an efficiently checkable sufficient condition for trace containment. For composite systems, due to the exponential explosion of the state space, there is a need for decomposing a simulation check of the form P< s Q into simpler simulation checks on the components of P and Q. We present an assume-guarantee rule that enables such a decomposition. To the best of our knowledge, this is the first assume-guarantee rule that applies to a refinement relation different from trace containment. Our rule is circular, and its soundness proof requires induction on trace trees. The proof is constructive: given simulation relations that witness the simulation preorder between corresponding components of P and Q, we provide a procedure for constructing a witness relation for P< s Q. We also extend our assume-guarantee rule to account for fairness assumptions on transition systems}, author = {Henzinger, Thomas A and Qadeer, Shaz and Rajamani, Sriram and Tasiran, Serdar}, booktitle = {Proceedings of the 2nd International Conference on Formal Methods in Computer-Aided Design}, isbn = {9783540651918}, location = {Palo Alto, CA, United States of America}, pages = {421 -- 432}, publisher = {Springer}, title = {{An assume-guarantee rule for checking simulation}}, doi = {10.1007/3-540-49519-3_27}, volume = {1522}, year = {1998}, } @inproceedings{4488, abstract = {Assume-guarantee reasoning has long been advertised as an important method for decomposing proof obligations in system verification. Refinement mappings (homomorphisms) have long been advertised as an important method for solving the language-inclusion problem in practice. When confronted with large verification problems, we therefore attempted to make use of both techniques. We soon found that rather than offering instant solutions, the success of assume-guarantee reasoning depends critically on the construction of suitable abstraction modules, and the success of refinement checking depends critically on the construction of suitable witness modules. Moreover, as abstractions need to be witnessed, and witnesses abstracted, the process must be iterated. We present here the main lessons we learned from our experiments, in limn of a systematic and structured discipline for the compositional verification of reactive modules. An infrastructure to support this discipline, and automate parts of the verification, has been implemented in the tool Mocha.}, author = {Henzinger, Thomas A and Qadeer, Shaz and Rajamani, Sriram}, booktitle = {Proceedings of the 10th International Conference on Computer Aided Verification}, isbn = {9783540646082}, location = {Vancouver, Canada}, pages = {440 -- 451}, publisher = {Springer}, title = {{You assume, we guarantee: Methodology and case studies}}, doi = {10.1007/BFb0028765}, volume = {1427}, year = {1998}, } @inproceedings{4489, abstract = {Symbolic model checking, which enables the automatic verification of large systems, proceeds by calculating with expressions that represent state sets. Traditionally, symbolic model-checking tools arc based on backward state traversal; their basic operation is the function pre, which given a set of states, returns the set of all predecessor states. This is because specifiers usally employ formalisms with future-time modalities. which are naturally evaluated by iterating applications of pre. It has been recently shown experimentally that symbolic model checking can perform significantly better if it is based, instead, on forward state traversal; in this case, the basic operation is the function post, which given a set of states, returns the set of all successor states. This is because forward state traversal can ensure that only those parts of the state space are explored which are reachable from an initial state and relevant for satisfaction or violation of the specification; that is, errors can be detected as soon as possible. In this paper, we investigate which specifications can be checked by symbolic forward state traversal. We formulate the problems of symbolic backward and forward model checking by means of two -calculi. The pre- calculus is based on the pre operation; the post- calculus, on the post operation. These two -calculi induce query logics, which augment fixpoint expressions with a boolean emptiness query. Using query logics, we are able to relate and compare the symbolic backward and forward approaches. In particular, we prove that all -regular (linear-time) specifications can be expressed as post- queries, and therefore checked using symbolic forward state traversal. On the other hand, we show that there are simple branching-time specifications that cannot be checked in this way.}, author = {Henzinger, Thomas A and Kupferman, Orna and Qadeer, Shaz}, booktitle = {Proceedings of the 10th International Conference on Computer Aided Verification}, isbn = {9783540646082}, location = {Vancouver, Canada}, pages = {195 -- 206}, publisher = {Springer}, title = {{From pre-historic to post-modern symbolic model checking}}, doi = {10.1007/BFb0028745}, volume = {1427}, year = {1998}, } @inproceedings{4490, abstract = {A specification formalism for reactive systems defines a class of Ω-languages. We call a specification formalism fully decidable if it is constructively closed under boolean operations and has a decidable satisfiability (nonemptiness) problem. There are two important, robust classes of Ω-languages that are definable by fully decidable formalisms. The Ω -reqular languages are definable by finite automata, or equivalcntly, by the Sequential Calculus. The counter-free Ω-regular languages are definable by temporal logic, or equivalcntly, by the first-order fragment of the Sequential Calculus. The gap between both classes can be closed by finite counting (using automata connectives), or equivalently, by projection (existential second-order quantification over letters). A specification formalism for real-time systems defines a class of timed Ω-langnages, whose letters have real-numbered time stamps. Two popular ways of specifying timing constraints rely on the use of clocks, and on the use of time bounds for temporal operators. However, temporal logics with clocks or time bounds have undecidable satisfiability problems, and finite automata with clocks (so-called timed automata) are not closed under complement. Therefore, two fully decidable restrictions of these formalisms have been proposed. In the first case, clocks are restricted to event clocks, which measure distances to immediately preceding or succeeding events only. In the second case, time bounds are restricted to nonsingular intervals, which cannot specify the exact punctuality of events. We show that the resulting classes of timed Ω-languages are robust, and we explain their relationship. First, we show that temporal logic with event clocks defines the same class of timed Ω-languages as temporal logic with nonsingular time bounds, and we identify a first-order monadic theory that also defines this class. Second, we show that if the ability of finite counting is added to these formalisms, we obtain the class of timed Ω-languages that are definable by finite automata with event clocks, or equivalently, by a restricted second-order extension of the monadic theory. Third, we show that if projection is added, we obtain the class of timed Ω-languages that are definable by timed automata, or equivalently, by a richer second-order extension of the monadic theory. These results identify three robust classes of timed Ω-languages, of which the third, while popular, is not definable by a, fully decidable formalism. By contrast, the first two classes are definable by fully decidable formalisms from temporal logic, from automata theory, and from monadic logic. Since the gap between these two classes can be closed by finite counting, we dub them the timed Ω-regular languages and the timed counter-free Ω-rcgular languages, respectively.}, author = {Henzinger, Thomas A and Raskin, Jean and Schobbens, Pierre}, booktitle = {Proceedings of the 25th International Colloqium on Automata, Languages and Programming}, isbn = {9783540647812}, location = {Aalborg, Denmark}, pages = {580 -- 591}, publisher = {Springer}, title = {{The regular real-time languages}}, doi = {10.1007/BFb0055086}, volume = {1443}, year = {1998}, } @article{4491, abstract = {We present two methods for translating nonlinear hybrid systems into linear hybrid automata. Properties of the nonlinear systems can then be inferred from the automatic analysis of the translated linear hybrid automata. The first method, called clock translation, replaces constraints on nonlinear variables by constraints on clock variables. The second method, called linear phase-portrait approximation, conservatively overapproximates the phase portrait of a hybrid automaton using piecewise-constant polyhedral differential inclusions. Both methods are sound for safety properties. We illustrate both methods by using HYTECH, a symbolic model checker for linear hybrid automata, to automatically check properties of a nonlinear temperature controller and of a predator-prey ecology}, author = {Henzinger, Thomas A and Ho, Pei and Wong Toi, Howard}, issn = {0018-9162}, journal = {IEEE Transactions on Automatic Control}, number = {4}, pages = {540 -- 554}, publisher = {IEEE}, title = {{Algorithmic analysis of nonlinear hybrid systems}}, doi = {10.1109/9.664156 }, volume = {43}, year = {1998}, } @article{4492, abstract = {Hybrid automata model systems with both digital and analog components, such as embedded control programs. Many verification tasks for such programs can be expressed as reachability problems for hybrid automata. By improving on previous decidability and undecidability results, we identify a boundary between decidability and undecidability for the reachability problem of hybrid automata. On the positive side, we give an (optimal) PSPACE reachability algorithm for the case of initialized rectangular automata, where all analog variables follow independent trajectories within piecewise-linear envelopes and are reinitialized whenever the envelope changes. Our algorithm is based on the construction of a timed automaton that contains all reachability information about a given initialized rectangular automaton. The translation has practical significance for verification, because it guarantees the termination of symbolic procedures for the reachability analysis of initialized rectangular automata. The translation also preserves theω-languages of initialized rectangular automata with bounded nondeterminism. On the negative side, we show that several slight generalizations of initialized rectangular automata lead to an undecidable reachability problem. In particular, we prove that the reachability problem is undecidable for timed automata augmented with a single stopwatch.}, author = {Henzinger, Thomas A and Kopke, Peter and Puri, Anuj and Varaiya, P.}, isbn = {0022-0000}, journal = {Journal of Computer and System Sciences}, number = {1}, pages = {94 -- 124}, publisher = {Elsevier}, title = {{What's decidable about hybrid automata?}}, doi = {10.1006/jcss.1998.1581}, volume = {57}, year = {1998}, } @inproceedings{4515, abstract = {We summarize and reorganize some of the last decade's research on real-time extensions of temporal logic. Our main focus is on tableau constructions for model checking linear temporal formulas with timing constraints. In particular, we find that a great deal of real-time verification can be performed in polynomial space, but also that considerable care must be exercised in order to keep the real-time verification problem in polynomial space, or even decidable.}, author = {Henzinger, Thomas A}, booktitle = {Proceedings of the 9th Interantional Conference on Concurrency Theory}, isbn = {978-3-540-64896-3}, location = {Nice, France}, pages = {439 -- 454}, publisher = {Schloss Dagstuhl - Leibniz-Zentrum für Informatik}, title = {{It's about time: Real-time logics reviewed}}, doi = {10.1007/BFb0055640}, volume = {1466}, year = {1998}, } @inproceedings{4603, abstract = {Alternating transition systems are a general model for composite systems which allow the study of collaborative as well as adversarial relationships between individual system components. Unlike in labeled transition systems, where each transition corresponds to a possible step of the system (which may involve some or all components), in alternating transition systems, each transition corresponds to a possible move in a game between the components. In this paper, we study refinement relations between alternating transition systems, such as “Does the implementation refine the set A of specification components without constraining the components not in A?” In particular, we generalize the definitions of the simulation and trace containment preorders from labeled transition systems to alternating transition systems. The generalizations are called alternating simulation and alternating trace containment. Unlike existing refinement relations, they allow the refinement of individual components within the context of a composite system description. We show that, like ordinary simulation, alternating simulation can be checked in polynomial time using a fixpoint computation algorithm. While ordinary trace containment is PSPACE-complete, we establish alternating trace containment to be EXPTIME-complete. Finally, we present logical characterizations for the two preorders in terms of ATL, a temporal logic capable of referring to games between system components.}, author = {Alur, Rajeev and Henzinger, Thomas A and Kupferman, Orna and Vardi, Moshe}, booktitle = {Proceedings of the 9th Interantional Conference on Concurrency Theory}, isbn = {978-3-540-64896-3}, location = {Nice, France}, pages = {163 -- 178}, publisher = {Schloss Dagstuhl - Leibniz-Zentrum für Informatik}, title = {{Alternating refinement relations}}, doi = {10.1007/BFb0055622}, volume = {1466}, year = {1998}, } @inproceedings{4604, author = {Alur, Rajeev and Henzinger, Thomas A and Mang, Freddy and Qadeer, Shaz and Rajamani, Sriram and Tasiran, Serdar}, booktitle = {Proceedings of the 10th International Conference on Computer Aided Verification}, isbn = {9783540646082}, location = {Vancouver, Canada}, pages = {521 -- 525}, publisher = {Springer}, title = {{Mocha: Modularity in model checking}}, doi = {10.1007/BFb0028774}, volume = {1427}, year = {1998}, } @inproceedings{4606, abstract = {In formal design verification, successful model checking is typically preceded by a laborious manual process of constructing design abstractions. We present a methodology for partially—and in some cases, fully—bypassing the abstraction process. For this purpose, we provide to the designer abstraction operators which, if used judiciously in the description of a design, structure the corresponding state space hierarchically. This structure can then be exploited by verification tools, and makes possible the automatic and exhaustive exploration of state spaces that would otherwise be out of scope for existing model checkers. Specifically, we present the following contributions: - A temporal abstraction operator that aggregates transitions and hides intermediate steps. Mathematically, our abstraction operator is a function that maps a flat transition system into a two-level hierarchy where each atomic upper-level transition expands into an entire lower-level transition system. For example, an arithmetic operation may expand into a sequence of bit operations. - A BDD-based algorithm for the symbolic exploration of multi-level hierarchies of transition systems. The algorithm traverses a level-n transition by expanding the corresponding level-(n − 1) transition system on-the-fly. The level-n successors of a state are determined by computing a level-(n − 1) reach set, which is then immediately released from memory. In this fashion, we can exhaustively explore hierarchically structured state spaces whose flat counterparts cause memory overflows. - We experimentally demonstrate the efficiency of our method with three examples—a multiplier, a cache coherence protocol, and a multiprocessor system. In the first two examples, we obtain significant improvements in run times and peak BDD sizes over traditional state-space search. The third example cannot be model checked at all using conventional methods (without manual abstractions), but can be analyzed fully automatically using transition hierarchies.}, author = {Alur, Rajeev and Henzinger, Thomas A and Rajamani, Sriram}, booktitle = {Proceedings of the 4th International Conference on Tools and Algorithms for the Construction and Analysis of Systems}, isbn = {9783540643562}, location = {Lisbon, Portugal}, pages = {330 -- 344}, publisher = {Springer}, title = {{Symbolic exploration of transition hierarchies}}, doi = {10.1007/BFb0054181}, volume = {1384}, year = {1998}, } @inproceedings{4639, abstract = {An open system can be modeled as a two-player game between the system and its environment. At each round of the game, player 1 (the system) and player 2 (the environment) independently and simultaneously choose moves, and the two choices determine the next state of the game. Properties of open systems can be modeled as objectives of these two-player games. For the basic objective of reachability-can player 1 force the game to a given set of target states?-there are three types of winning states, according to the degree of certainty with which player 1 can reach the target. From type-1 states, player 1 has a deterministic strategy to always reach the target. From type-2 states, player 1 has a randomized strategy to reach the target with probability 1. From type-3 states, player 1 has for every real ε>0 a randomized strategy to reach the target with probability greater than 1-ε. We show that for finite state spaces, all three sets of winning states can be computed in polynomial time: type-1 states in linear time, and type-2 and type-3 states in quadratic time. The algorithms to compute the three sets of winning states also enable the construction of the winning and spoiling strategies. Finally, we apply our results by introducing a temporal logic in which all three kinds of winning conditions can be specified, and which can be model checked in polynomial time. This logic, called Randomized ATL, is suitable for reasoning about randomized behavior in open (two-agent) as well as multi-agent systems}, author = {De Alfaro, Luca and Henzinger, Thomas A and Kupferman, Orna}, booktitle = { Proceedings 39th Annual Symposium on Foundations of Computer Science}, isbn = {0818691727}, location = {Palo Alto, CA, United States of America}, pages = {564 -- 575}, publisher = {IEEE}, title = {{Concurrent reachability games}}, doi = {10.1109/SFCS.1998.743507 }, year = {1998}, } @article{8527, abstract = {We introduce a new potential-theoretic definition of the dimension spectrum of a probability measure for q > 1 and explain its relation to prior definitions. We apply this definition to prove that if and is a Borel probability measure with compact support in , then under almost every linear transformation from to , the q-dimension of the image of is ; in particular, the q-dimension of is preserved provided . We also present results on the preservation of information dimension and pointwise dimension. Finally, for and q > 2 we give examples for which is not preserved by any linear transformation into . All results for typical linear transformations are also proved for typical (in the sense of prevalence) continuously differentiable functions.}, author = {Hunt, Brian R and Kaloshin, Vadim}, issn = {0951-7715}, journal = {Nonlinearity}, keywords = {Mathematical Physics, General Physics and Astronomy, Applied Mathematics, Statistical and Nonlinear Physics}, number = {5}, pages = {1031--1046}, publisher = {IOP Publishing}, title = {{How projections affect the dimension spectrum of fractal measures}}, doi = {10.1088/0951-7715/10/5/002}, volume = {10}, year = {1997}, }