THE EXISTENCE OF GR(1) CONTRACTS WITH FULL INFORMATION
10.2 Memoryless contracts
10.2.1 One-sided counterexample
The example shown in Fig. 10.1 has the main feature that leads to inexistence of memoryless GR(1) contracts. The figure shows a game between two play- ers, each player chooses the outgoing edge from nodes of the same shape. The objective is to find a GR(1) contract for the two players, so that together they implement φ ≜ 23s6. We start by trying to find a (generalized) Streett(1) liveness goal for the disk player that relaxes 23s6, because 23s6 is unrealiz- able by the disk player. This turns out to be impossible: for each candidate persistence goal 32P, either
• (32P)∨23s6 is unrealizable by the disk player, or
• 32P is realizable by the disk player (and, clearly,P contains a cycle that omitss6—the onlyP that contains a cycle withs6 includes all nodes, so is equivalent totrue).
In more detail, 23s6 alone is unrealizable. Any P that does not contain any cycle yields a property (32P)∨23s6 that is equivalent to 23s6 (due to the safety constraints that represent the game graph). The smallest cycles are C1 ≜{s0,s1} and C2 ≜ {s2,s3}. Thus any persistence set P that contains a cycle contains at least one of these two cycles. Thus, whenever (32P)∨23s6 is weaker than 23s6 (so possibly realizable), 32P is realizable too, i.e., the disk player can choose to remain forever in C1 or forever in C2, instead of repeatedly visiting s6.
More formally (the below proof sketch and the proof in [65] take a different approach than the outline above)2
2The symbol −sr▷ is shorthand for (2ρe ∧We) −sr▷ (2ρs∧Ws) ≜ 2(
(⃝∼2−ρe) ⇒ ρs
)∧
G
Attr1(s5∨s6)
Attr0(G) s2
s0 s1 s3 s4 s5 s6
s7
Figure 10.2: Two-sided counter-example where a GR(1) contract does not exist. Compare to Fig. 10.1.
Proposition 3. Assume: Define the transition relations ρ0, ρ1 by the game graph of Fig. 10.1, the set of nodes V ≜{s0, . . . ,s7}, and the goal JGK≜{s6} of player 0. Prove: For all sets JPK⊆V , with ψ1 ≜(2ρ0)−sr▷(
2ρ1∧23P) andψ0 ≜(
2ρ1∧23P) sr
−▷(
2ρ0∧23G)
, it isJWin(0, ψ0)K∩JWin(1, ψ1)K=∅. Proof Sketch: For any P that does not intersect {s0, . . . ,s3}, player 1 cannot win, because player 0 can force, and keep, the play outside of P. For similar reasons,P should intersect each of{s0,s1}and {s2,s3}. IfP intersects {s0,s1} and {s2,s3}, then player 1 can win by always moving from s4 to s1, when the play comes to s4. This forces a visit to either both s0 and s1, or boths2 ands3. So, for noP do both players have a winning strategy. A proof can be found in [65].
10.2.2 General counterexample
Assigning the goal 23s6 to the box player in Fig. 10.1 reveals that there is a GR(1) contract (32(s0 ∨s1 ∨s2 ∨s3)∨23s6 for the box player, and 23(s4∨s5∨s6 ∨s7) for the disk player).
By adding two edges to Fig. 10.1, we obtain the example of Fig. 10.2. There is no safety-preserving GR(1) contract for this example. A proof sketch is as follows. Assume that all recurrence goals of both players have the form23R, where R contains nodes other than {s6,s7}. If so, then
̸|= (φ1∧φ2)⇒φ
because all the recurrence goals in φ1 ∧φ2 are satisfiable by a behavior that cycles through all nodes in {si : i ∈ 0..5}, and forever avoids s6. Similarly, any nontrivial realizable persistence goal omits s6.
((2ρe∧We)⇒Ws)≡(2ρe)−sr▷(
2ρs∧(Ws ⇒We)) .
Thus, at least one component specification,φ1 or φ2, must include 23s6 as a conjunct (or the equivalent 23(s6∨s7)). So it suffices to reason only about specifications where either one of the players has the goal 23s6. Additional recurrence goals only strengthen the specifications, and we split cases by real- izability of the persistence goals.
The goal 23s6 is unrealizable without a relaxation by persistence goals. Each relaxation is either unrealizable, or if realizable, then some nontrivial persis- tence goal is realizable, which avoidss6. The root cause is the same as for the one-sided example. For the box player, getting pasts5 requires assuming that
“waiting” in a set of nodes that includes s5 will lead to an eventual response by the disk player. However, such a waiting set (persistence goal) would have to contain {s2,s3,s4}. The box player can remain forever in this set. Similar observations apply to the disk player. Therefore, a GR(1) contract does not exist for this example.
The claims of both the one-sided and the two-sided examples for the goal23s6
assigned to each player have been checked by a machine, using a GR(1) solver (the Python module omega.games.gr1), and multiple parametric persistence goals 32P1∨32P2 ∨. . .∨32P64 (the parameters are BDD bits that are not quantified during computations).
10.2.3 What about refinement by realizable parts?
What if we replaced the requirement (φ1∧φ2)⇒φwith the corresponding re- alizable parts? A behaviorσsatisfies the realizable partR(φ1) of the property φ1 if there exists some implementation of φ1 that gives rise to this behavior (under some environment behavior). We show below that memoryless GR(1) contracts do not exist even if we relax the requirement in this way, using the example of Fig. 10.2.
Assume that ̸|= (φ1∧φ2)⇒φ but
(R(φ1)∧ R(φ2))⇒φ
(a contract requires realizability, and thus R(φ1) and R(φ2) are not false).
Pick two strategies f,g that realize φ1 and φ2, respectively. If either f or g realizes a goal 32P that implies 32¬s6, then we are done showing that the implication fails.
G s2
s0 s1 s3 s4 s5 s6
s7 loop that never visits node s6
Figure 10.3: Two strategies that violate φ, thus showing that in case ̸|= (φ1∧ φ2)⇒φ, conjoining realizable parts does not ensure that φis implemented.
Otherwise φ1 ∧φ2 contains recurrence goals that are satisfied by a behavior that satisfies32¬s6(by the assumption above). Construct two new strategies p,q for each player, by the following procedure:
• Stategy p for the disk player chooses the edge s5 ∧s′2 and alternates between s1∧s′0 and s1∧s′2 on each visit to s1, unless for 100 steps the recurrence goals withinφ1 are not visited. If so, thenp switches to using f, otherwise it renews counting steps.
• Strategy q for the box player alternates between s4 ∧s′5 and s4∧s′1 on each visit tos4, and switches to g under similar conditions to p.
The strategies p and q will never switch to f and g, because the recurrence goals in φ1 ∧φ2 are all visited within 100 steps, by visiting all the nodes {si : i ∈ 0..5}. Thus
̸|= (R(φ1)∧ R(φ2))⇒φ,
which is a contradiction. In other words, if ̸|= (φ1 ∧φ2) ⇒ φ, then any two strategies that implement φ1 and φ2 can happen to “conspire” so that when assembled, the resulting behavior violates φ, as shown in Fig. 10.3.
10.3 Stateful contracts