@inproceedings{4462, abstract = {A major hurdle in the algorithmic verification and control of systems is the need to find suitable abstract models, which omit enough details to overcome the state-explosion problem, but retain enough details to exhibit satisfaction or controllability with respect to the specification. The paradigm of counterexample-guided abstraction refinement suggests a fully automatic way of finding suitable abstract models: one starts with a coarse abstraction, attempts to verify or control the abstract model, and if this attempt fails and the abstract counterexample does not correspond to a concrete counterexample, then one uses the spurious counterexample to guide the refinement of the abstract model. We present a counterexample-guided refinement algorithm for solving ω-regular control objectives. The main difficulty is that in control, unlike in verification, counterexamples are strategies in a game between system and controller. In the case that the controller has no choices, our scheme subsumes known counterexample-guided refinement algorithms for the verification of ω-regular specifications. Our algorithm is useful in all situations where ω-regular games need to be solved, such as supervisory control, sequential and program synthesis, and modular verification. The algorithm is fully symbolic, and therefore applicable also to infinite-state systems.}, author = {Henzinger, Thomas A and Jhala, Ranjit and Majumdar, Ritankar}, booktitle = {Proceedings of the 30th International Colloquium on Automata, Languages and Programming}, isbn = {9783540404934}, location = {Eindhoven, The Netherlands}, pages = {886 -- 902}, publisher = {Springer}, title = {{Counterexample-guided control}}, doi = {10.1007/3-540-45061-0_69}, volume = {2719}, year = {2003}, } @inproceedings{4464, abstract = {We introduce the paradigm of schedule-carrying code (SCC). A hard real-time program can be executed on a given platform only if there exists a feasible schedule for the real-time tasks of the program. Traditionally, a scheduler determines the existence of a feasible schedule according to some scheduling strategy. With SCC, a compiler proves the existence of a feasible schedule by generating executable code that is attached to the program and represents its schedule. An SCC executable is a real-time program that carries its schedule as code, which is produced once and can be revalidated and executed with each use. We evaluate SCC both in theory and practice. In theory, we give two scenarios, of nonpreemptive and distributed scheduling for Giotto programs, where the generation of a feasible schedule is hard, while the validation of scheduling instructions that are attached to the programs is easy. In practice, we implement SCC and show that explicit scheduling instructions can reduce the scheduling overhead up to 35% and can provide an efficient, flexible, and verifiable means for compiling Giotto programs on complex architectures, such as the TTA.}, author = {Henzinger, Thomas A and Kirsch, Christoph and Matic, Slobodan}, booktitle = {Proceedings of the 3rd International Conference on Embedded Software}, isbn = {9783540202233}, location = {Philadelphia, PA, USA}, pages = {241 -- 256}, publisher = {ACM}, title = {{Schedule-carrying code}}, doi = {10.1007/978-3-540-45212-6_16}, volume = {2855}, year = {2003}, } @article{4460, abstract = {Symbolic model checking, which enables the automatic verification of large systems, proceeds by calculating expressions that represent state sets. Traditionally, symbolic model-checking tools are based on back- ward state traversal; their basic operation is the function pre, which, given a set of states, returns the set of all predecessor states. This is because specifiers usually employ formalisms with future-time modalities, which are naturally evaluated by iterating applications of pre. It has been shown experimentally that symbolic model checking can perform significantly better if it is based, instead, on forward state traversal; in this case, the basic operation is the function post, which, given a set of states, returns the set of all successor states. This is because forward state traversal can ensure that only parts of the state space that are reachable from an initial state and relevant for the satisfaction or violation of the specification are explored; that is, errors can be detected as soon as possible. In this paper, we investigate which specifications can be checked by symbolic forward state traversal. We formulate the problems of symbolic backward and forward model checking by means of two μ-calculi. The pre-μ calculus is based on the pre operation, and the post-μ calculus is based on the post operation. These two μ-calculi induce query logics, which augment fixpoint expressions with a boolean emptiness query. Using query logics, we are able to relate and compare the symbolic backward and forward approaches. In particular, we prove that all ω-regular (linear-time) specifications can be expressed as post-μ queries, and therefore checked using symbolic forward state traversal. On the other hand, we show that there are simple branching-time specifications that cannot be checked in this way.}, author = {Henzinger, Thomas A and Kupferman, Orna and Qadeer, Shaz}, issn = {0925-9856}, journal = {Formal Methods in System Design}, number = {3}, pages = {303 -- 327}, publisher = {Springer}, title = {{From pre-historic to post-modern symbolic model checking}}, doi = {10.1023/A:1026228213080}, volume = {23}, year = {2003}, } @article{4469, abstract = {Giotto provides an abstract programmer's model for the implementation of embedded control systems with hard real-time constraints. A typical control application consists of periodic software tasks together with a mode-switching logic for enabling and disabling tasks. Giotto specifies time-triggered sensor readings, task invocations, actuator updates, and mode switches independent of any implementation platform. Giotto can be annotated with platform constraints such as task-to-host mappings, and task and communication schedules. The annotations are directives for the Giotto compiler, but they do not alter the functionality and timing of a Giotto program. By separating the platform-independent from the platform-dependent concerns, Giotto enables a great deal of flexibility in choosing control platforms as well as a great deal of automation in the validation and synthesis of control software. The time-triggered nature of Giotto achieves timing predictability, which makes Giotto particularly suitable for safety-critical applications.}, author = {Henzinger, Thomas A and Horowitz, Benjamin and Kirsch, Christoph}, issn = {0018-9219 }, journal = {Proceedings of the IEEE}, number = {1}, pages = {84 -- 99}, publisher = {IEEE}, title = {{Giotto: A time-triggered language for embedded programming}}, doi = {10.1109/JPROC.2002.805825}, volume = {91}, year = {2003}, } @article{4338, abstract = {Mosaic hybrid zones arise when ecologically differentiated taxa hybridize across a network of habitat patches. Frequent interbreeding across a small-scale patchwork can erode species differences that might have been preserved in a clinal hybrid zone. In particular, the rapid breakdown of neutral divergence sets an upper limit to the time for which differences at marker loci can persist. We present here a case study of a mosaic hybrid zone between the fire-bellied toads Bombina bombina and B. variegata (Anura: Discoglossidae) near Apahida in Romania. In our 20 × 20 km study area, we detected no evidence of a clinal transition but found a strong association between aquatic habitat and mean allele frequencies at four molecular markers. In particular, pure populations of B. bombina in ponds appear to cause massive introgression into the surrounding B. variegata gene pool found in temporary aquatic sites. Nevertheless, the genetic structure of these hybrid populations was remarkably similar to those of a previously studied transect near Pescenica (Croatia), which had both clinal and mosaic features: estimates of heterozygote deficit and linkage disequilibrium in each country are similar. In Apahida, the observed strong linkage disequilibria should stem from an imperfect habitat preference that guides most (but not all) adults into the habitats to which they are adapted. In the absence of a clinal structure, the inferred migration rate between habitats implies that associations between selected loci and neutral markers should break down rapidly. Although plausible selection strengths can maintain differentiation at those loci adapting the toads to either permanent or temporary breeding sites, the divergence at neutral markers must be transient. The hybrid zone may be approaching a state in which the gene pools are homogenized at all but the selected loci, not dissimilar from an early stage of sympatric divergence.}, author = {Vines, Timothy and Kohler, S C and Thiel, M and Ghira, Ioan and Sands, T R and Maccallum, Catriona and Barton, Nicholas H and Nürnberger, Beate}, issn = {0014-3820}, journal = {Evolution}, number = {8}, pages = {1876 -- 1888}, publisher = {Wiley-Blackwell}, title = {{On the maintenance of reproductive isolation in a mosaic hybrid zone between the toads Bombina bombina and B. variegata}}, doi = {10.1111/j.0014-3820.2003.tb00595.x}, volume = {57}, year = {2003}, } @article{4350, abstract = {The phylogeny of Crocodylia offers an unusual twist on the usual molecules versus morphology story. The true gharial (Gavialis gangeticus) and the false gharial (Tomistoma schlegelii), as their common names imply, have appeared in all cladistic morphological analyses as distantly related species, convergent upon a similar morphology. In contrast, all previous molecular studies have shown them to be sister taxa. We present the first phylogenetic study of Crocodylia using a nuclear gene. We cloned and sequenced the c-myc proto-oncogene from Alligator mississippiensis to facilitate primer design and then sequenced an 1,100-base pair fragment that includes both coding and noncoding regions and informative indels for one species in each extant crocodylian genus and six avian outgroups. Phylogenetic analyses using parsimony, maximum likelihood, and Bayesian inference all strongly agreed on the same tree, which is identical to the tree found in previous molecular analyses: Gavialis and Tomistoma are sister taxa and together are the sister group of Crocodylidae. Kishino-Hasegawa tests rejected the morphological tree in favor of the molecular tree. We excluded long-branch attraction and variation in base composition among taxa as explanations for this topology. To explore the causes of discrepancy between molecular and morphological estimates of crocodylian phylogeny, we examined puzzling features of the morphological data using a priori partitions of the data based on anatomical regions and investigated the effects of different coding schemes for two obvious morphological similarities of the two gharials.}, author = {Harshman, John and Huddleston, Christopher and Bollback, Jonathan P and Parsons, Thomas and Braun, Michael}, issn = {0039-7989 }, journal = {Systematic Biology}, number = {3}, pages = {386 -- 402}, publisher = {Oxford University Press}, title = {{True and false gharials: A nuclear gene phylogeny of crocodylia}}, doi = {10.1080/10635150390197028}, volume = {52}, year = {2003}, } @article{4348, abstract = {Many questions in evolutionary biology are best addressed by comparing traits in different species. Often such studies involve mapping characters on phylogenetic trees. Mapping characters on trees allows the nature, number, and timing of the transformations to be identified. The parsimony method is the only method available for mapping morphological characters on phylogenies. Although the parsimony method often makes reasonable reconstructions of the history of a character, it has a number of limitations. These limitations include the inability to consider more than a single change along a branch on a tree and the uncoupling of evolutionary time from amount of character change. We extended a method described by Nielsen (2002, Syst. Biol. 51:729-739) to the mapping of morphological characters under continuous-time Markov models and demonstrate here the utility of the method for mapping characters on trees and for identifying character correlation.}, author = {Huelsenbeck, John and Nielsen, Rasmus and Bollback, Jonathan P}, issn = {0039-7989 }, journal = {Systematic Biology}, number = {2}, pages = {131 -- 158}, publisher = {Oxford University Press}, title = {{Stochastic mapping of morphological characters}}, doi = {10.1080/10635150390192780}, volume = {52}, year = {2003}, } @article{4254, abstract = {Chromosomal rearrangements can promote reproductive isolation by reducing recombination along a large section of the genome. We model the effects of the genetic barrier to gene flow caused by a chromosomal rearrangement on the rate of accumulation of postzygotic isolation genes in parapatry. We find that, if reproductive isolation is produced by the accumulation in parapatry of sets of alleles compatible within but incompatible across species, chromosomal rearrangements are far more likely to favor it than classical genetic barriers without chromosomal changes. New evidence of the role of chromosomal rearrangements in parapatric speciation suggests that postzygotic isolation is often due to the accumulation of such incompatibilities. The model makes testable qualitative predictions about the genetic signature of speciation.}, author = {Navarro, Arcadio and Barton, Nicholas H}, issn = {0014-3820}, journal = {Evolution; International Journal of Organic Evolution}, number = {3}, pages = {447 -- 459}, publisher = {Wiley-Blackwell}, title = {{Accumulating postzygotic isolation genes in parapatry: a new twist on chromosomal speciation}}, doi = {10.1111/j.0014-3820.2003.tb01537.x}, volume = {57}, year = {2003}, } @article{4257, abstract = {Variation within a species may be structured both geographically and by genetic background. We review the effects of such structuring on neutral variants, using a framework based on the coalescent process. Short-term effects of sex differences and age structure can be averaged out using fast timescale approximations, allowing a simple general treatment of effective population size and migration. We consider the effects of geographic structure on variation within and between local populations, first in general terms, and then for specific migration models. We discuss the close parallels between geographic structure and stable types of genetic structure caused by selection, including balancing selection and background selection. The effects of departures from stability, such as selective sweeps and population bottlenecks, are also described. Methods for distinguishing population history from the effects of ongoing gene flow are discussed. We relate the theoretical results to observed patterns of variation in natural populations.}, author = {Charlesworth, Brian and Charlesworth, Deborah and Barton, Nicholas H}, issn = {1543-592X}, journal = {Annual Review of Ecology and Systematics}, pages = {99 -- 125}, publisher = {Annual Reviews}, title = {{The effects of genetic and geographic structure on neutral variation}}, doi = {10.1146/annurev.ecolsys.34.011802.132359}, volume = {34}, year = {2003}, } @article{4256, abstract = {Artificial Life models may shed new light on the long-standing challenge for evolutionary biology of explaining the origins of complex organs. Real progress on this issue, however, requires Artificial Life researchers to take seriously the tools and insights from population genetics.}, author = {Barton, Nicholas H and Zuidema, Willem}, issn = {0960-9822}, journal = {Current Biology}, number = {16}, pages = {R649 -- R651}, publisher = {Cell Press}, title = {{The erratic path towards complexity}}, doi = {10.1016/S0960-9822(03)00573-6}, volume = {13}, year = {2003}, }