# Study of Baryon Number Transport Dynamics and Strangeness Conservation
Effects Using $\Omega$-hadron Correlations

Weijie Dong1 Xiaozhou Yu1 Siyuan Ping1 Xiatong Wu2 Gang Wang2
<EMAIL_ADDRESS>Huan Zhong Huang1,2<EMAIL_ADDRESS>Zi-Wei Lin3
1Key Laboratory of Nuclear Physics and Ion-beam Application (MOE), Fudan
University, Shanghai 200433, China  2 Department of Physics and Astronomy,
University of California, Los Angeles, CA 90095, USA  3 Department of Physics,
East Carolina University, Greenville, NC 27858, USA

###### Abstract

In nuclear collisions at RHIC energies, an excess of $\Omega$ hyperons over
$\overline{\Omega}$ is observed, indicating that $\Omega$ carries a net baryon
number despite $s$ and $\bar{s}$ quarks being produced in pairs. The baryon
number in $\Omega$ could have been transported from the incident nuclei and/or
acquired and balanced in baryon pair productions associated with other types
of anti-hyperons, such as $\overline{\Xi}$. To investigate these two
scenarios, we propose to measure correlations between $\Omega$ and $K$, as
well as between $\Omega$ and anti-hyperons. We will use two versions, the
default and string-melting, of a multiphase transport (AMPT) model to
illustrate the correlation method. We will present the $\Omega$-hadron
correlations from simulated Au+Au collisions at $\sqrt{s_{NN}}=7.7$ and 14.6
GeV, and discuss the dependence on collision energy and on the hadronization
scheme in these two AMPT versions. These correlations from the AMPT model
provide a baseline for experimental exploration of the dynamics of baryon
number transport and the effects of baryon number and strangeness conservation
in nuclear collisions.

††preprint: APS/123-QED

##  I INTRODUCTION

Figure 1:  Schematic illustration of two possible scenarios for the
$\Omega^{-}$ production based on the quark coalescence picture with
strangeness and baryon number conservation. In Scenario 1 (left), $\Omega^{-}$
carries the baryon number initially residing in the $u$ and $d$ quarks from
colliding nuclei. In Scenario 2 (right), $\Omega^{-}$ does not carry a net
baryon number. Associated production of $\Omega$ and kaon in default version
could have similar qualitative features as scenario 1 in coalescence picture.

Strangeness enhancement was proposed as a signature of the quark-gluon plasma
(QGP) created in relativistic heavy-ion collisions [1] and has been a subject
of intensive theoretical and experimental investigations [2]. Since the
incident protons and neutrons are composed of $u$ and $d$ quarks, the strange
quarks observed in the aftermath of the collision can only originate from pair
of $s\bar{s}$ production. Lattice Quantum ChromoDynamics (QCD) predicted that
the temperature at which the quark-hadron phase transition occurs is
approximately 150 MeV. Thus, in the QGP phase where the temperature is higher
than the $s$-quark mass, strangeness may be abundantly produced via flavor
creation ($qq\rightarrow s\bar{s}$, $gg\rightarrow s\bar{s}$) and gluon
splitting ($g\rightarrow s\bar{s}$), leading to enhanced production of
strangeness in the final state [1, 3]. The investigation of multi-strange
hyperon production is particularly valuable for studying the equilibration of
strangeness in the QGP. The yields of $\Omega$ hyperons in heavy-ion
collisions, for example, have been measured to be significantly higher than
those in $p$+$p$ collisions scaled by the number of participants at CERN Super
Proton Synchrotron (SPS) [4], Relativistic Heavy Ion Collider (RHIC) [5, 6],
and the Large Hadron Collider (LHC) [7, 8]. Furthermore, many strange hadrons
are believed to have small hadronic rescattering cross-sections, so that they
retain information from the hadronization stage and can be used to probe the
phase boundary of the quark-hadron transition [9, 10, 11].

The RHIC Beam Energy Scan (BES) program aims to search for a possible critical
point in the QCD phase diagram where strangeness production also plays a major
role [12]. At low BES energies, the measured ratios of anti-baryons to baryons
are significantly lower than unity at midrapidities for three hyperons
($\Lambda$, $\Xi$, and $\Omega$). Therefore, these hyperons must carry a net
baryon number. The baryon number transport dynamics have been a subject of
interest of the heavy-ion collision physics since its inception [13, 14, 15].
The baryon number in a proton or neutron may be attributed to valence $u$ and
$d$ quarks, each carrying $1/3$ of the baryon number. However, in high energy
collisions the valence quarks tend to inherit a significant fraction of the
incident nucleon momentum, making them ineffective in transporting baryon
number from beam rapidities to midrapidities. Previous theoretical
calculations have proposed the existence of topological objects known as gluon
junctions, which can effectively convey baryon number over large rapidity gaps
in nuclear collisions [16]. Once a gluon junction reaches midrapidities during
a nuclear collision, it must emerge as a baryon in the final state, with its
flavor determined by the quark flavors present in the surrounding QGP medium.
Such exotic dynamics have a particularly discernible impact on net $\Omega$
hyperons, as $\Omega$ hyperons consist of three $s$ quarks that must be pair-
produced.

The quantum numbers of strangeness and baryon number are strictly conserved in
nuclear collisions, leading to correlations among particles in the final
state. To gain insights into the production dynamics of $\Omega$ hyperons, we
propose to measure the correlations between $\Omega$ and other particles,
namely $K^{+}$, $\bar{\Lambda}$, and $\bar{\Xi}^{+}$, along with their
respective anti-particle pairs. By examining the shape and strength of these
correlation functions, we illustrate the extent that we can quantitatively
characterize the role of conservation laws in the $\Omega$ production dynamics
in nuclear collisions. These measurements will also provide a baseline
reference to the search for exotic dynamics such as gluon junction transport.

In this paper, we use a multiphase transport (AMPT) model [17] to simulate
Au+Au collisions at $\sqrt{s_{NN}}=$ 7.7 GeV and 14.6 GeV and present the
$\Omega$-hadron correlations from these simulations. In section 2, we describe
briefly the AMPT simulations and the analysis methods. The correlation results
and discussions are presented in section 3, followed by a summary in section
4.

##  II AMPT Simulations and Analysis Methods

###  II.1 AMPT Simulations

To investigate the impact of different hadronization schemes on baryon number
transport dynamics, we exploit both the default and string melting (SM)
versions of the AMPT model to simulate Au+Au collisions. The initial phase
space is provided by the HIJING model [18, 19, 20, 21], which is a Monte Carlo
event generator for parton and particle production in high-energy hadronic and
nuclear collisions. In the default version of AMPT, minijets and their parent
nucleons form excited strings after partonic interactions of minijets, and
these strings fragment into hadrons via Lund String Fragmentation [22]. In the
SM version, the strings are converted through the ”string melting” mechanism
into partons, which subsequently interact with each other during the
evolution, and the coalescence mechanism is used to combine partons into
hadrons. The parton interactions are described by the Boltzmann equation, and
solved by the ZPC model [23], which only includes two-body elastic
scatterings. In the quark coalescence process, the two or three nearest
partons (quarks and anti-quarks) in the phase space recombine to form a meson
or a baryon. The AMPT version v1.25t4cu/v2.25t7cu, which strictly conserves
net electric charge, strangeness, and baryon number, is employed in our study.
We have generated more than 50 million minimum bias events of Au+Au collisions
at both 7.7 GeV and 14.6 GeV.

###  II.2 $\Omega$ Production and Conservation of Strangeness and Baryon
Number

The $\Omega^{-}$ production is governed by both strangeness conservation (SC)
and baryon number conservation. Additionally, the presence of net $\Omega$
hyperons at midrapidities indicates the involvement of baryon number transport
(BNT) dynamics. Figure 1 illustrates two basic scenarios based on the quark
coalescence picture for the $\Omega^{-}$ production. In Scenario 1 (left side
of Fig. 1), three $\bar{s}$ quarks are pair-produced with the three $s$ quarks
in $\Omega^{-}$, and may combine with $u$ or $d$ quarks from the incident
nuclei to form three kaons. In this case, the $\Omega^{-}$ hyperon does not
have an accompanying anti-baryon and carries a baryon number initially
residing in the $u$ and $d$ quarks from the colliding nuclei. In exotic
dynamics involving gluon junction, the production of the three $s$-$\bar{s}$
pairs may be combined with a gluon junction, which gives rise to $\Omega^{-}$.
Consequently, Scenario 1 would describe a BNT via gluon junction to the
$\Omega$ hyperon, while valence $u/d$ quarks form the kaons [15]. In default
version, associated production of $\Omega$ and kaons could also yield
qualitatively similar features as the coalescence picture. Therefore, Scenario
1 encompasses contributions from both ordinary physical processes and the
gluon junction dynamics. The AMPT model in our simulation does not invoke the
gluon junction dynamics, and our results may serve as a baseline to the
experimental search for the exotic dynamics. In Scenario 2 (right side of Fig.
1), the three pair-produced $\bar{s}$ quarks combine with $u$($\bar{u}$) or
$d$($\bar{d}$) quarks to form an anti-hyperon and a kaon. For instance,
$\bar{\Xi}^{+}(\bar{\Xi}^{0})$ and $K^{0}(K^{+})$ could emerge alongside the
$\Omega^{-}$ hyperon. In this scenario, the baryon number in $\Omega^{-}$ is
balanced by the other types of anti-hyperon, and no direct BNT from the
incident nuclei is present.

To characterize the numbers of kaons and anti-baryons associated with the
$\Omega$ production, we introduce

$\Delta N_{A}\equiv\langle A\rangle_{{\rm w.}\Omega^{-}}-\langle
A\rangle_{{\rm w.o.}\Omega^{-}},$ (1)

where $\langle A\rangle_{{\rm w.}\Omega^{-}}$ and $\langle A\rangle_{{\rm
w.o.}\Omega^{-}}$ denote the average numbers of particle $A$ in events with
one $\Omega^{-}$ and without any $\Omega^{-}$, respectively. Here, we assume
that all other aspects of the two event classes are the same. Table 1 lists
the $\Delta N_{K}$ and $\Delta N_{\bar{B}}$ values expected by the two
scenarios, where $K$ represents both $K^{+}$ and $K^{0}$, and $\bar{B}$ refers
to anti-baryons ($\bar{\Lambda}$, $\bar{\Sigma}$, $\bar{\Xi}$, and so on)
associated with the $\Omega^{-}$ production. In our study, we choose the beam
energies of 7.7 and 14.6 GeV in order to limit the fraction of Au+Au events
that produce multiple $\Omega$ ($\bar{\Omega}$) hyperons. Compared with
Scenario 2, Scenario 1 exhibits a stronger $\Omega^{-}$-$K$ correlation and a
weaker $\Omega^{-}$-$\bar{B}$ correlation.

Table 1: $\Delta N_{K}$ and $\Delta N_{\bar{B}}$ in the two scenarios for the production of an $\Omega^{-}$ . | $\Delta N_{K}$ | $\Delta N_{\bar{B}}$
---|---|---
Scenario 1 (SC+BNT) | 3 | 0
Scenario 2 (SC) | 1, 2, 3 | 1
Figure 2:  AMPT calculations of the difference in strange hadron yields
between $\Omega^{-}$ events and non-$\Omega^{-}$ events of Au+Au collisions at
7.7 GeV.  Figure 3:  AMPT calculations of the difference in strange hadron
yields between $\Omega^{-}$ events and non-$\Omega^{-}$ events of Au+Au
collisions at 14.6 GeV.

###  II.3 Correlation Using the Event Mixing Technique

To divide out the combinatorial background, we first analyze the correlations
between $\Omega^{-}$ and strange hadrons with the traditional normalization
using mixed events. The correlation function is

$C(k^{*})=\mathcal{N}\frac{A(k^{*})}{B(k^{*})},$ (2)

where $A(k^{*})$ is the same-event distribution, $B(k^{*})$ is the mixed-event
distribution, and $k^{*}\equiv\frac{1}{2}|k_{1}-k_{2}|$ is the reduced
momentum in the pair rest frame. $\mathcal{N}$ is the normalization factor
determined by matching the same-event and mixed-event correlations in the
uncorrelated phase space, for example, by requiring $C(k^{*}>1$ GeV/$c)=1$.

The technique of event mixing normalization allows for the investigation of
the correlation length between two types of particles in momentum space by
analyzing their distributions. The underlying assumption is that the
distribution in mixed events should be equivalent to that in same events in
the absence of any correlation, thereby representing the combinatorial
background. By dividing out this mixed-event background, one can obtain the
correlation between the two particles of interest. It is crucial to choose a
proper $k^{*}$ range for normalization in order to achieve meaningful results.
Typically, the $k^{*}$ range with the high counting density is selected for
normalization, as it provides a reliable estimate of the background. This
method has also been applied to examine the correlation function for
$\Omega^{-}$-$K^{+}$, $\Omega^{-}$-$\bar{\Lambda^{0}}$, and
$\Omega^{-}$-$\bar{\Xi}^{+}$ in terms of relative rapidity and relative
transverse momentum. However, it is important to note that due to the
normalization procedure, this correlation function cannot fully capture the
possibility of multiple kaons being correlated with the $\Omega$ production,
nor can it fully account for the sensitivity of the correlation to the
production dynamics.

###  II.4 Correlations Using Combinatorial Background Subtraction

In order to make the correlation measurement sensitive to the number of
associated hadrons, we introduce the combinatorial background subtracted (CBS)
correlations, by taking the difference between the $\Omega$-hadron correlation
and the $\bar{\Omega}$-hadron correlation, each normalized by the
corresponding number of $\Omega$ or $\bar{\Omega}$ hyperons. For example, the
$\Omega^{-}$-$K^{+}$ correlation is defined as

$C^{\text{CBS}}_{\Omega^{-}K^{+}}(k^{*})=\frac{dN_{\Omega^{-}K^{+}}/dk^{*}}{N_{\Omega^{-}}}-\frac{dN_{\bar{\Omega}^{+}K^{+}}/dk^{*}}{N_{\bar{\Omega}^{+}}}.$
(3)

This background subtraction approach is intended to extract the main component
of the correlation due to SC in the $\Omega^{-}$-$K^{+}$ pairs. The opposite-
sign pair ($\Omega^{-}$-$K^{+}$ or $\bar{\Omega}^{+}$-$K^{-}$) distribution in
the first term contains the signal, while the same-sign pair distribution in
the second term ($\bar{\Omega}^{+}$-$K^{+}$ or $\Omega^{-}$-$K^{-}$) models
the uncorrelated background. This subtraction scheme is sensitive to the
difference in the number of kaons between events with $\Omega^{-}$ and events
with $\bar{\Omega}^{+}$, as well as to the phase space distribution of the
extra kaons. There may be variations of kinematic phase spaces for these pairs
in nuclear collisions, and such effects can be mitigated with this
normalization scheme and with fine collision centrality bins. Similar
approaches have been applied to study the correlations between $\Omega$ and
other hadrons.

##  III Correlation Results and Discussions

###  III.1 Strangeness Conservation and Strange Hadron Yields

We first list in Table 2 the AMPT simulations of the difference in the number
of $s\bar{s}$ pairs between events with one $\Omega^{-}$ and events without
any $\Omega^{-}$ or $\bar{\Omega}^{+}$ in Au+Au collisions at $\sqrt{s_{NN}}=$
7.7 GeV and 14.6 GeV. For events with one $\Omega$, at least three $s\bar{s}$
pairs are produced because of SC. The AMPT results are slightly greater than
three, and the excess indicates that the underlying strangeness production may
affect the probability for the $\Omega$ formation. Compared with the SM
version of AMPT, the default version yields a slightly larger number of
$s\bar{s}$ pairs, as well as a smaller $\Omega$ formation probability. This
correlation is presumably due to the difference in the formation dynamics
and/or the $s\bar{s}$ phase space. The AMPT simulations suggest that at the
lower collision energies, slightly more strangeness in the underlying event is
needed to form $\Omega$ hyperons than at higher energies.

Table 2: Difference in the number of $s\bar{s}$ pairs between events with one $\Omega^{-}$ and events without any $\Omega^{-}$ or $\bar{\Omega}^{+}$.  | 7.7 GeV | 14.6 GeV
---|---|---
AMPT SM | 3.22 | 3.07
AMPT default | 3.25 | 3.16
Table 3: Average numbers of $\Delta N_{K}$ and $\Delta N_{\bar{B}}$ as defined in Eq. (1).  | 7.7 GeV |  | 14.6 GeV
---|---|---|---
| $\Delta N_{K}$ | $\Delta N_{\bar{B}}$ |  | $\Delta N_{K}$ | $\Delta N_{\bar{B}}$
AMPT SM | 2.46 | 0.017 |  | 2.44 | 0.119
AMPT default | 1.74 | 0.078 |  | 1.76 | 0.28

Table 3 shows the AMPT calculations of $\Delta N_{K}$ and $\Delta N_{\bar{B}}$
as defined in Eq. (1). When compared with the expectations in Table 1
corresponding to the two $\Omega$ production scenarios, these numbers indicate
that the $\Omega$ production is likely to receive contributions from both
scenarios. The SM version seems to favor the dominance of Scenario 1, with the
$\Delta N_{K}$ values close to three and the lower $\Delta N_{\bar{B}}$
values.

Strangeness and baryon number can be represented by various particle types in
the final states of nuclear collisions. For example, $s$ quarks can exist in
$K^{+}$ and $K^{0}$. The actual distributions of strangeness and baryon
numbers in the final-state particles could be sensitive to nuclear dynamics
and may also depend on beam energy. Figures 2 and 3 show the AMPT results of
the difference in strange hadron yields between $\Omega^{-}$ events and
non-$\Omega^{-}$ events of Au+Au collisions at 7.7 GeV and 14.6 GeV,
respectively. At 7.7 GeV and 14.6 GeV, the correlations between $\Omega^{-}$
and kaons are stronger in the SM version, but the correlations between
$\Omega^{-}$ and anti-hyperons are stronger in the default version. For
$\Omega^{-}$ events, the number of kaons is much larger than the number of
anti-hyperons, suggesting that the correlations between $\Omega^{-}$ and kaons
are much stronger than those between $\Omega^{-}$ and anti-hyperons. These
numbers seem to support that scenario 1 contributes more significantly to
$\Omega$ yields in both versions.

###  III.2 Correlations between $\Omega^{\pm}$ and Strange Hadrons

Figure 4:  Correlation functions between $\Omega^{-}$ and strange hadrons
using the event mixing normalization in the 0–5% centrality range of Au + Au
collisions at 7.7 GeV ($|\eta|<1$). Figure 5:  Correlation functions between
$\Omega^{-}$ and strange hadrons using the event mixing normalization in the
0–5% centrality range of Au + Au collisions at 14.6 GeV ($|\eta|<1$).

We first show the correlations between $\Omega$ and strange hadrons as a
function of the reduced momentum $k^{*}$ in the pair rest frame using the
event mixing normalization. Figure 4 presents the correlation functions for
(a) $\Omega^{-}$-$K^{+}$, (b) $\Omega^{-}$-$\bar{\Lambda}$, and (c)
$\Omega^{-}$-$\bar{\Xi}^{+}$ pairs for 0–5% centrality Au + Au collisions at
7.7 GeV. The normalization between the same event and the mixed event
distributions is determined by the $k^{*}$ region of 0.6–1.5 GeV/$c$. There is
a distinct correlation between $\Omega^{-}$ and $K^{+}$, indicating that SC
must play a major role in the $\Omega^{-}$ and $K^{+}$ yields, with the
typical correlation length on the order of less than $k^{*}$ of 0.5 GeV/$c$.
The $\Omega^{-}$ may also be correlated with the anti-hyperons of
$\bar{\Lambda}$ and $\bar{\Xi}^{+}$, but the current simulated results do not
have sufficient statistics to be definitive.

Figure 6:  CBS correlations between $\Omega^{-}(\bar{\Omega}^{+})$ and kaons
in 0–5% most central Au + Au collisions at 7.7 GeV ($|\eta|<1$). The left
columns show the results of $C^{\rm CBS}_{\Omega^{-}K^{+}}$, and the right
columns, those of $C^{\rm CBS}_{\bar{\Omega}^{+}K^{-}}$.  Figure 7:  CBS
correlations between $\Omega^{-}(\bar{\Omega}^{+})$ and kaons in 0–5% most
central Au + Au collisions at 14.6 GeV.

Figure 5 shows (a) $\Omega^{-}$-$K^{+}$, (b) $\Omega^{-}$-$\bar{\Lambda}$, and
(c) $\Omega^{-}$-$\bar{\Xi}^{+}$ correlations for 0–5% centrality Au + Au
collisions at 14.6 GeV. The $\Omega^{-}$-$K^{+}$ correlation at 14.6 GeV seems
to be less prominent than that at 7.7 GeV. This could be explained by our
normalization scheme that involves the dilution of the $\Omega^{-}$-$K^{+}$
correlation by uncorrelated kaons, which are expected to be more significant
at 14.6 GeV.

According to Table 1, the correlation between $\Omega$ and anti-hyperons may
also be susceptible to the two $\Omega$ production scenarios. The middle and
right panels of Figs. 4 and 5 show the $\Omega^{-}$-$\bar{\Lambda}^{0}$ and
$\Omega^{-}$-$\bar{\Xi}^{+}$ correlation functions using the event-mixing
technique at 7.7 GeV and 14.6 GeV, respectively. At both energies, the
$\Omega^{-}$-$\bar{\Lambda}^{0}$ results lack enough statistics for a
definitive conclusion, whereas some level of the $\Omega^{-}$-$\bar{\Xi}^{+}$
correlation may exist. However, there is no significant difference between
$\Omega^{-}$-$\bar{\Xi}^{+}$ and $\bar{\Omega}^{+}$-$\Xi^{-}$, similar to the
$\Omega$-$K$ results.

For both beam energies, there is no significant difference in the observed
correlations between the two AMPT hadronization schemes. It seems that the
correlations using the event-mixing technique are only sensitive to the
kinematic region where SC links the $s\bar{s}$ pairs. The magnitude
differences as shown in Table 3 are, however, not quantitatively reflected in
the measured correlations due to the normalization scheme. We will explore the
CBS correlations within the same event framework and background subtraction
scheme.

Our goal is to use the $\bar{\Omega}^{+}$-$K^{-}$ correlation (Scenario 2
only) as a baseline for the $\Omega^{-}$-$K^{+}$ correlation. For each of
these CBS correlations, we again select events with one $\Omega^{-}$ or
$\bar{\Omega}^{+}$ from 0–5% most central collisions. As described in Eq. (3),
the combinatorial background of the $\Omega^{-}$-$K^{+}$ correlation is
modeled by the $\bar{\Omega}^{+}$-$K^{+}$ correlation based on events with one
$\bar{\Omega}^{+}$. $\bar{\Omega}^{+}$ and $K^{+}$ both containing $\bar{s}$
quarks and the narrow centrality bin make the $\bar{\Omega}^{+}$-$K^{+}$
correlation a good candidate for the combinatorial background in the
$\Omega^{-}$-$K^{+}$ correlation. Similarly, we can also take the difference
between $\bar{\Omega}^{+}$-$K^{-}$ and $\Omega^{-}$-$K^{-}$ to calculate the
$\bar{\Omega}^{+}$-$K^{-}$ correlation, which represents contributions only
from SC. Therefore, any difference between $\Omega^{-}$-$K^{+}$ and
$\bar{\Omega}^{+}$-$K^{-}$ correlations will be sensitive to the BNT dynamics,
which is absent in Scenario 2.

Figures 6 and 7 show the CBS correlations, for (left) $\Omega^{-}$-$K^{+}$ and
(right) $\bar{\Omega}^{+}$-$K^{-}$ at 7.7 GeV and 14.6 GeV, respectively. The
correlations are shown as a function of $k^{*}$, rapidity difference ($\Delta
y$), and transverse momentum difference ($\Delta p_{T}$) in three rows,
respectively. At 7.7 GeV, the two AMPT versions exhibit clear differences.
Compared with the SM version, the default version shows a stronger
$\bar{\Omega}^{+}$-$K^{-}$ correlation, presumably indicating a stronger and
more localized SC. For the $\Omega^{-}$-$K^{+}$ correlation, which is
sensitive to both SC and BNT dynamics, while the total magnitudes (integral)
are similar between the two AMPT versions, the correlation shapes are
different as a function of both $k^{*}$ and $\Delta p_{T}$. In the SM version,
the coalescence formation mechanism and the BNT dynamics seem to yield a
narrower correlation function between $\Omega^{-}$ and $K^{+}$.

Figure 8:  CBS correlations between $\Omega^{-}(\bar{\Omega}^{+})$ and
$\bar{\Lambda}(\Lambda)$ in 0–5% most central Au + Au collisions at 7.7 GeV
($|\eta|<1$). The left columns show the results of $40\times C^{\rm
CBS}_{\Omega^{-}{\bar{\Lambda}}}$, and the right columns, those of $C^{\rm
CBS}_{\bar{\Omega}^{+}\Lambda}$.  Figure 9:  CBS correlations between
$\Omega^{-}(\bar{\Omega}^{+})$ and $\bar{\Lambda}(\Lambda)$ in 0–5% most
central Au + Au collisions at 14.6 GeV ($|\eta|<1$). The left columns show the
results of $10\times C^{\rm CBS}_{\Omega^{-}{\bar{\Lambda}}}$, and the right
columns, those of $C^{\rm CBS}_{\bar{\Omega}^{+}\Lambda}$.

At 14.6 GeV (Fig. 7), the difference between the two hadronization schemes is
relatively small. The shape difference in the correlation as a function of
$k^{*}$ and $\Delta p_{T}$ is still visible, albeit much less prominent than
at 7.7 GeV. The CBS correlations at 7.7 GeV and 14.6 GeV suggest that the
event-level $\Omega^{-}$-$K^{+}$ correlation is stronger than the
$\bar{\Omega}^{+}$-$K^{-}$ one. Since $\bar{\Omega}^{+}$ is only produced in
Scenario 2, whereas $\Omega^{-}$ can be produced in both scenarios, the
stronger $\Omega^{-}$-$K^{+}$ correlation indicates the presence of Scenario 1
for the $\Omega^{-}$ production at both beam energies. Particularly at 7.7
GeV, Scenario 1 seems to contribute more to the $\Omega^{-}$ production in the
SM version, as the difference in correlation amplitudes between
$\Omega^{-}$-$K^{+}$ and $\bar{\Omega}^{+}$-$K^{-}$ becomes noticeably larger.

Figure 10:  CBS correlations between $\Omega^{-}(\bar{\Omega}^{+})$ and
$\bar{\Xi}^{+}(\Xi^{-})$ in 0–5% most central Au + Au collisions at 7.7 GeV
($|\eta|<1$). The left columns show the results of $5\times C^{\rm
CBS}_{\Omega^{-}{\bar{\Xi}}^{+}}$, and the right columns, those of $C^{\rm
CBS}_{\bar{\Omega}^{+}\Xi^{-}}$.  Figure 11:  CBS correlations between
$\Omega^{-}(\bar{\Omega}^{+})$ and $\bar{\Xi}^{+}(\Xi^{-})$ in 0–5% most
central Au + Au collisions at 14.6 GeV ($|\eta|<1$). The left columns show the
results of $5\times C^{\rm CBS}_{\Omega^{-}{\bar{\Xi}}^{+}}$, and the right
columns, those of $C^{\rm CBS}_{\bar{\Omega}^{+}\Xi^{-}}$.

Figures 8 and 9 show the CBS correlations between $\Omega$ and
$\bar{\Lambda}$, and their anti-particle pairs as a function of three
kinematic variables in 0–5% most central Au + Au collisions at 7.7 GeV and
14.6 GeV, respectively. Besides strangeness and baryon number conservation
that govern the correlations between $\Omega^{-}$ and $\bar{\Lambda}$, the
$\bar{\Omega}^{+}$-$\Lambda$ correlations are also sensitive to BNT dynamics.
At 7.7 GeV, the default version of AMPT displays stronger correlations than
the SM version.

For both AMPT versions, the $\Omega^{-}$-$\bar{\Lambda}$ correlations are much
weaker than the $\bar{\Omega}^{+}$-$\Lambda$ ones, confirming that
$\bar{\Omega}^{+}$ is only produced via Scenario 2. The default version also
indicates a larger discrepancy between $\bar{\Omega}^{+}$-$\Lambda$ and
$\Omega^{-}$-$\bar{\Lambda}$, which suggests a more prominent contribution
from Scenario 2, complementary to the information on the difference between
the $\Omega^{-}$-$K^{+}$ and $\bar{\Omega}^{+}$-$K^{-}$ results. At 14.6 GeV,
the $\bar{\Omega}^{+}$-$\Lambda$ correlations (the right column in Fig. 9) are
also higher than $\Omega^{-}$-$\bar{\Lambda}$ (the left column in Fig. 9) by
about an order of magnitude. However, there seems to be no significant
difference between the two AMPT versions at this energy.

Figures 10 and 11 show the CBS correlations between $\Omega$ and $\bar{\Xi}$
as a function of three kinematic variables in 0–5% most central Au + Au
collisions at 7.7 GeV and 14.6 GeV, respectively. At both beam energies, the
stronger $\bar{\Omega}^{+}$-$\Xi^{-}$ correlations relative to
$\Omega^{-}$-$\bar{\Xi}^{+}$ also imply that Scenario 2 provides a larger
contribution to the $\bar{\Omega}^{+}$ production than to $\Omega^{-}$. At 7.7
GeV, the difference in the $\Omega^{-}$-$\bar{\Xi}^{+}$ correlations between
the two AMPT versions suggests that the default version generates a larger
contribution from Scenario 2 to the $\Omega^{-}$ production. At 14.6 GeV, the
$\bar{\Omega}^{+}$-$\Xi^{-}$ correlations are still stronger than
$\Omega^{-}$-$\bar{\Xi}^{+}$, but no significant difference appears between
the two versions.

##  IV Summary

The $\Omega$ production in nuclear collisions at the RHIC BES involves
dynamics of baryon number transport, strangeness conservation, and baryon
number conservation. To investigate these effects, we have used the AMPT model
with both the default and the string melting versions to simulate central
Au+Au collisions at 7.7 and 14.6 GeV, and showed that $\Omega^{-}$-$K^{+}$ and
$\Omega^{-}$-anti-hyperon correlations are sensitive to the dynamics. In
particular, we have considered two $\Omega$ production scenarios, one with
three $\bar{s}$ quarks in kaons (Scenario 1), and the other with $\bar{s}$
quarks in anti-hyperon and kaons (Scenario 2). Both scenarios are constrained
by strangeness and baryon number conservation, and only the former is
sensitive to baryon number transport. The AMPT simulations show that in Au+Au
collisions, both scenarios contribute to the $\Omega$ production, and Scenario
1 becomes more important from 14.6 to 7.7 GeV. The shape of the correlations
can also be sensitive to the hadronization schemes in the default and the
string melting versions of the AMPT model. Experimental measurements of these
correlations and comparisons with our AMPT simulation results could greatly
advance our understanding of baryon transport dynamics and effects of
strangeness and baryon number conservation on the $\Omega$ production, and
possibly enable future experimental searches for exotic baryon transport
mechanisms such as gluon junction.

## References

  * Koch  _et al._ [1986] P. Koch, B. Müller, and J. Rafelski, Strangeness in relativistic heavy ion collisions, Physics Reports 142, 167 (1986).
  * Adams  _et al._ [2005a] J. Adams, M. Aggarwal, Z. Ahammed, J. Amonett, B. Anderson, D. Arkhipkin, G. Averichev, S. Badyal, Y. Bai, J. Balewski, _et al._ , Experimental and theoretical challenges in the search for the quark–gluon plasma: The star collaboration’s critical assessment of the evidence from RHIC collisions, Nuclear Physics A 757, 102 (2005a).
  * Rafelski and Müller [1982] J. Rafelski and B. Müller, Strangeness production in the quark-gluon plasma, Physical Review Letters 48, 1066 (1982).
  * Antinori  _et al._ [1999] F. Antinori _et al._ (WA97), Production of strange and multistrange hadrons in nucleus nucleus collisions at the SPS, Nucl. Phys. A 661, 130 (1999).
  * Adams  _et al._ [2005b] J. Adams _et al._ (STAR), Experimental and theoretical challenges in the search for the quark gluon plasma: The STAR Collaboration’s critical assessment of the evidence from RHIC collisions, Nucl. Phys. A 757, 102 (2005b), arXiv:nucl-ex/0501009 .
  * Abelev  _et al._ [2008] B. I. Abelev _et al._ (STAR), Enhanced strange baryon production in Au + Au collisions compared to p + p at $\sqrt{s_{NN}}$= 200 GeV, Phys. Rev. C 77, 044908 (2008), arXiv:0705.2511 [nucl-ex] .
  * Abelev  _et al._ [2014] B. B. Abelev _et al._ (ALICE), Multi-strange baryon production at mid-rapidity in Pb-Pb collisions at $\sqrt{s_{NN}}$ = 2.76 TeV, Phys. Lett. B 728, 216 (2014), [Erratum: Phys.Lett.B 734, 409–410 (2014)], arXiv:1307.5543 [nucl-ex] .
  * Adam  _et al._ [2017] J. Adam _et al._ (ALICE), Enhanced production of multi-strange hadrons in high-multiplicity proton-proton collisions, Nature Phys. 13, 535 (2017), arXiv:1606.07424 [nucl-ex] .
  * van Hecke  _et al._ [1998] H. van Hecke, H. Sorge, and N. Xu, Evidence of early multistrange hadron freeze-out in high energy nuclear collisions, Physical Review Letters 81, 5764 (1998).
  * Takeuchi  _et al._ [2015] S. Takeuchi, K. Murase, T. Hirano, P. Huovinen, and Y. Nara, Effects of hadronic rescattering on multistrange hadrons in high-energy nuclear collisions, Physical Review C 92, 044907 (2015).
  * Mohanty and Xu [2009] B. Mohanty and N. Xu, Probe of the QCD phase diagram with $\phi$-mesons in high-energy nuclear collisions, Journal of Physics G: Nuclear and Particle Physics 36, 064022 (2009).
  * Adam  _et al._ [2020] J. Adam _et al._ (STAR), Strange hadron production in Au+Au collisions at $\sqrt{s_{{}_{\mathrm{NN}}}}$ = 7.7, 11.5, 19.6, 27, and 39 GeV, Phys. Rev. C 102, 034909 (2020), arXiv:1906.03732 [nucl-ex] .
  * Busza and Goldhaber [1984] W. Busza and A. S. Goldhaber, Nuclear stopping power, Physics Letters B 139, 235 (1984).
  * Busza and Ledoux [1988] W. Busza and R. Ledoux, Energy deposition in high-energy proton-nucleus collisions, Annual Review of Nuclear and Particle Science 38, 119 (1988).
  * Huang [1999] H. Z. Huang, Selected topics on baryon transport in nuclear collisions, in  _Heavy Ion Physics From Bevalac To RHIC-Proceedings Of The Relativistic Heavy Ion Symposium, Aps Centennial Meeting’99_ (World Scientific, 1999) p. 3.
  * Kharzeev [1996] D. Kharzeev, Can gluons trace baryon number?, Physics Letters B 378, 238 (1996).
  * Lin  _et al._ [2005] Z.-W. Lin, C. M. Ko, B.-A. Li, B. Zhang, and S. Pal, Multiphase transport model for relativistic heavy ion collisions, Physical Review C 72, 064901 (2005).
  * Wang [1991] X.-N. Wang, Role of multiple minijets in high-energy hadronic reactions, Physical Review D 43, 104 (1991).
  * Wang and Gyulassy [1991] X.-N. Wang and M. Gyulassy, HIJING: A Monte Carlo model for multiple jet production in pp, pA, and AA collisions, Physical Review D 44, 3501 (1991).
  * Wang and Gyulassy [1992a] X.-N. Wang and M. Gyulassy, Systematic study of particle production in p+p collisions via the HIJING model, Physical Review D 45, 844 (1992a).
  * Wang and Gyulassy [1992b] X.-N. Wang and M. Gyulassy, Gluon shadowing and jet quenching in A+A collisions at $\sqrt{s}$= 200A GeV, Physical Review Letters 68, 1480 (1992b).
  * Andersson  _et al._ [1983] B. Andersson, G. Gustafson, G. Ingelman, and T. Sjöstrand, Parton fragmentation and string dynamics, Physics Reports 97, 31 (1983).
  * Li and Ko [1995] B.-A. Li and C. M. Ko, Formation of superdense hadronic matter in high energy heavy-ion collisions, Physical Review C 52, 2037 (1995).


11institutetext:  School of EECS,
Pennsylvania State University, State College USA
11email<EMAIL_ADDRESS>School of Computer Science,
Carnegie Mellon University, Pittsburgh USA
22email<EMAIL_ADDRESS>EECS Department,
University of Michigan, Ann Arbor USA
33email<EMAIL_ADDRESS>
44institutetext: Khoury College of Computer Science, Northeastern University,
Boston USA
44email<EMAIL_ADDRESS>
# Safe Environmental Envelopes of Discrete Systems

Rômulo Meira-Góes 11 Ian Dardik 22 Eunsuk Kang 22 Stéphane Lafortune 33
Stavros Tripakis 44

###### Abstract

A safety verification task involves verifying a system against a desired
safety property under certain assumptions about the environment. However,
these environmental assumptions may occasionally be violated due to modeling
errors or faults. Ideally, the system guarantees its critical properties even
under some of these violations, i.e., the system is _robust_ against
environmental deviations. This paper proposes a notion of _robustness_ as an
explicit, first-class property of a transition system that captures how robust
it is against possible _deviations_ in the environment. We modeled deviations
as a set of _transitions_ that may be added to the original environment. Our
robustness notion then describes the safety envelope of this system, i.e., it
captures all sets of extra environment transitions for which the system still
guarantees a desired property. We show that being able to explicitly reason
about robustness enables new types of system analysis and design tasks beyond
the common verification problem stated above. We demonstrate the application
of our framework on case studies involving a radiation therapy interface, an
electronic voting machine, a fare collection protocol, and a medical pump
device.

###### Keywords:

Robustness Discrete Transition Systems Model Uncertainty.

## Acknowledgements

This project was supported by the US NSF Awards CCF-2144860, CNS-1801342,
CNS-1801546, CCF-1918140, and ECCS-2144416.

## References

  * [1] Alves, M.V.S., da Cunha, A.E.C., Carvalho, L.K., Moreira, M.V., Basilio, J.C.: Robust supervisory control of discrete event systems against intermittent loss of observations. International Journal of Control pp. 1–13 (2019)
  * [2] Baier, C., Katoen, J.P.: Principles of Model Checking. The MIT Press (2008)
  * [3] Bloem, R., Chatterjee, K., Greimel, K., Henzinger, T.A., Hofferek, G., Jobstmann, B., Könighofer, B., Könighofer, R.: Synthesizing robust systems. Acta Inf. 51(3–4), 193–220 (Jun 2014)
  * [4] Bloem, R., Greimel, K., Henzinger, T.A., Jobstmann, B.: Synthesizing robust systems. In: 2009 Formal Methods in Computer-Aided Design. pp. 85–92 (2009)
  * [5] Bolton, M.L., Bass, E.J.: Evaluating human-automation interaction using task analytic behavior models, strategic knowledge-based erroneous human behavior generation, and model checking. In: 2011 IEEE International Conference on Systems, Man, and Cybernetics. pp. 1788–1794 (2011). https://doi.org/10.1109/ICSMC.2011.6083931
  * [6] Bonakdarpour, B., Kulkarni, S.S.: Sycraft: A tool for synthesizing distributed fault-tolerant programs. In: van Breugel, F., Chechik, M. (eds.) CONCUR 2008 \- Concurrency Theory. pp. 167–171. Springer Berlin Heidelberg (2008)
  * [7] Cassandras, C.G., Lafortune, S.: Introduction to Discrete Event Systems. Springer, Cham, 3rd edn. (2021)
  * [8] Chaudhuri, S., Gulwani, S., Lublinerman, R., Navidpour, S.: Proving programs robust. In: Proceedings of the 19th ACM SIGSOFT Symposium and the 13th European Conference on Foundations of Software Engineering. p. 102–112. ESEC/FSE ’11, Association for Computing Machinery (2011)
  * [9] Cheng, C.H., Rueß, H., Knoll, A., Buckl, C.: Synthesis of fault-tolerant embedded systems using games: From theory to practice. In: Jhala, R., Schmidt, D. (eds.) Verification, Model Checking, and Abstract Interpretation. pp. 118–133. Springer Berlin Heidelberg (2011)
  * [10] Cury, J., Krogh, B.: Robustness of supervisors for discrete-event systems. IEEE Transactions on Automatic Control 44(2), 376–379 (1999)
  * [11] D’Ippolito, N., Braberman, V., Piterman, N., Uchitel, S.: The modal transition system control problem. In: Giannakopoulou, D., Méry, D. (eds.) FM 2012: Formal Methods. pp. 155–170. Springer Berlin Heidelberg (2012)
  * [12] Ebnenasir, A., Kulkarni, S.S., Arora, A.: FTSyn: A framework for automatic synthesis of fault-tolerance. Int. J. Softw. Tools Technol. Transf. 10(5), 455–471 (Oct 2008)
  * [13] Gärtner, F.C.: Fundamentals of fault-tolerant distributed computing in asynchronous environments. ACM Comput. Surv. 31(1), 1–26 (Mar 1999)
  * [14] Girault, A., Rutten, E.: Automating the Addition of Fault Tolerance with Discrete Controller Synthesis. Formal Methods in System Design 35, 190–225 (2009)
  * [15] Grädel, E., Thomas, W., Wilke, T. (eds.): Automata Logics, and Infinite Games: A Guide to Current Research. Springer-Verlag, Berlin, Heidelberg (2002)
  * [16] Henzinger, T.A., Otop, J., Samanta, R.: Lipschitz Robustness of Finite-state Transducers. In: Raman, V., Suresh, S.P. (eds.) 34th International Conference on Foundation of Software Technology and Theoretical Computer Science (FSTTCS 2014). Leibniz International Proceedings in Informatics (LIPIcs), vol. 29, pp. 431–443. Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, Dagstuhl, Germany (2014)
  * [17] Kang, E.: Robustness analysis for secure software design. In: Proceedings of the 3rd ACM SIGSOFT International Workshop on Software Security from Design to Deployment. p. 19–25. SEAD 2020, Association for Computing Machinery (2020)
  * [18] Leveson, N., Turner, C.: An investigation of the therac-25 accidents. Computer 26(7), 18–41 (1993). https://doi.org/10.1109/MC.1993.274940
  * [19] Lin, F.: Robust and adaptive supervisory control of discrete event systems. IEEE Transactions on Automatic Control 38(12), 1848–1852 (Dec 1993)
  * [20] Lin, F.: Control of networked discrete event systems: Dealing with communication delays and losses. SIAM Journal on Control and Optimization 52(2), 1276–1298 (2014)
  * [21] Lin, L., Zhu, Y., Su, R.: Towards bounded synthesis of resilient supervisors. In: 2019 IEEE 58th Conference on Decision and Control (CDC). pp. 7659–7664 (2019)
  * [22] Lynch, N.A.: Distributed Algorithms. Morgan Kaufmann Publishers Inc., San Francisco, CA, USA (1996)
  * [23] Magee, J., Kramer, J.: Concurrency: State Models and Java Programs. John Wiley and Sons, Inc., USA (2000)
  * [24] Majumdar, R., Render, E., Tabuada, P.: Robust discrete synthesis against unspecified disturbances. In: Proceedings of the 14th International Conference on Hybrid Systems: Computation and Control. p. 211–220. HSCC ’11, Association for Computing Machinery (2011)
  * [25] McNaughton, R.: Infinite games played on finite graphs. Annals of Pure and Applied Logic 65(2), 149–184 (1993)
  * [26] Meira-Góes, R., Marchand, H., Lafortune, S.: Towards resilient supervisors against sensor deception attacks. In: 2019 IEEE 58th Annual Conference on Decision and Control (CDC) (Dec 2019)
  * [27] Meira-Goes, R., Dardik, I., Kang, E., Lafortune, S., Tripakis, S.: Transitional robustness github repository (2023), https://github.com/cmu-soda/transitional-robustness, accessed on May 29, 2023
  * [28] Meira-Góes, R., Kang, E., Lafortune, S., Tripakis, S.: On tolerance of discrete systems with respect to transition perturbations. arXiv:2110.04200 [eess.SY] (2021)
  * [29] Meira-Góes, R., Kang, E., Lafortune, S., Tripakis, S.: On synthesizing tolerable and permissive controllers for labeled transition systems. 16th IFAC Workshop on Discrete Event Systems WODES 2022 55(28), 158–164 (2022)
  * [30] Meira-Goes, R., Lafortune, S., Marchand, H.: Synthesis of supervisors robust against sensor deception attacks. IEEE Transactions on Automatic Control 66(10), 4990–4997 (2021)
  * [31] Neider, D., Weinert, A., Zimmermann, M.: Synthesizing optimally resilient controllers. Acta Inf. 57(1), 195–221 (Apr 2020)
  * [32] Paoli, A., Lafortune, S.: Safe diagnosability for fault-tolerant supervision of discrete-event systems. Automatica 41(8), 1335–1347 (Aug 2005)
  * [33] Pease, M., Shostak, R., Lamport, L.: Reaching agreement in the presence of faults. J. ACM 27(2), 228–234 (Apr 1980)
  * [34] Pnueli, A., Rosner, R.: On the synthesis of a reactive module. In: Proceedings of the 16th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. p. 179–190. POPL ’89, Association for Computing Machinery (1989)
  * [35] Pnueli, A.: The temporal logic of programs. In: 18th Annual Symposium on Foundations of Computer Science (sfcs 1977). pp. 46–57 (1977)
  * [36] Ramadge, P.J., Wonham, W.M.: Supervisory control of a class of discrete event processes. SIAM J. Control Optim. 25(1), 206–230 (Jan 1987)
  * [37] U.S. Attorney’s Office Eastern District of Kentucky: Clay county officials and residents convicted on racketeering and voter fraud charges (Mar 2010), https://archives.fbi.gov/archives/louisville/press-releases/2010/lo032510.htm
  * [38] Rohloff, K.: Bounded sensor failure tolerant supervisory control. 11th IFAC Workshop on Discrete Event Systems 45(29), 272 – 277 (2012)
  * [39] Samanta, R., Deshmukh, J.V., Chaudhuri, S.: Robustness analysis of string transducers. In: Van Hung, D., Ogawa, M. (eds.) Automated Technology for Verification and Analysis. pp. 427–441. Springer Publishing Company (2013)
  * [40] Sempreboni, D., Viganò, L.: X-men: A mutation-based approach for the formal analysis of security ceremonies. In: 2020 IEEE European Symposium on Security and Privacy (EuroS&P). pp. 87–104 (2020). https://doi.org/10.1109/EuroSP48549.2020.00014
  * [41] Tabuada, P., Balkan, A., Caliskan, S.Y., Shoukry, Y., Majumdar, R.: Input-output robustness for discrete systems. In: Proceedings of the Tenth ACM International Conference on Embedded Software. p. 217–226. EMSOFT ’12, Association for Computing Machinery (2012)
  * [42] Tabuada, P., Neider, D.: Robust Linear Temporal Logic. In: Talbot, J.M., Regnier, L. (eds.) 25th EACSL Annual Conference on Computer Science Logic (CSL 2016). Leibniz International Proceedings in Informatics (LIPIcs), vol. 62, pp. 10:1–10:21. Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, Dagstuhl, Germany (2016)
  * [43] Takai, S.: Maximizing robustness of supervisors for partially observed discrete event systems. Automatica 40(3), 531 – 535 (2004)
  * [44] Topcu, U., Ozay, N., Liu, J., Murray, R.M.: On synthesizing robust discrete controllers under modeling uncertainty. In: Proceedings of the 15th ACM International Conference on Hybrid Systems: Computation and Control. p. 85–94. HSCC ’12, Association for Computing Machinery (2012)
  * [45] Tun, T.T., Bennaceur, A., Nuseibeh, B.: Oasis: Weakening user obligations for security-critical systems. In: 2020 IEEE 28th International Requirements Engineering Conference (RE). pp. 113–124 (2020). https://doi.org/10.1109/RE48521.2020.00023
  * [46] Wang, F., Shu, S., Lin, F.: Robust networked control of discrete event systems. IEEE Transactions on Automation Science and Engineering 13(4), 1528–1540 (2016)
  * [47] Young, S., Garg, V.K.: Model uncertainty in discrete event systems. SIAM Journal on Control and Optimization 33(1), 208–226 (1995)
  * [48] Zhang, C., Garlan, D., Kang, E.: A behavioral notion of robustness for software systems. In: Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. p. 1–12. ESEC/FSE 2020, Association for Computing Machinery (2020)

## Appendix

### Uniqueness of $\Delta$

*

###### Proof

By contradiction. Assume that there exist $\Delta_{1},\Delta_{2}\subseteq
2^{Q_{E}\times Act_{E}\times Q_{E}}$ such that they satisfy conditions 1, 2,
3, and 4 in Def. LABEL:def:robustness and $\Delta_{1}\neq\Delta_{2}$. Without
loss of generality, we assume that $\exists
d_{1}\in\Delta_{1}\setminus\Delta_{2}$. Since $d_{1}\in\Delta_{1}$, we have
that $E_{d_{1}}/C\models P_{saf}$ and $E_{d_{1}}\models P_{env}$ as
$\Delta_{1}$ satisfies 1 and 4. As $\Delta_{2}$ satisfies 2 and
$d_{1}\notin\Delta_{2}$, we have that $\exists d_{2}\in\Delta_{2}$ such that
$E_{d_{2}}/C\models P_{saf}$, $E_{d_{2}}\models P_{env}$, and $d_{1}\subseteq
d_{2}$. Since $d_{1}\in\Delta_{1}\setminus\Delta_{2}$, it follows that
$d_{1}\subseteq d_{2}$. Back to $\Delta_{1}$, condition 3 implies that
$d_{2}\notin\Delta_{1}$ since $d_{1}\in\Delta_{1}$ and $d_{1}\subseteq d_{2}$.
Furthermore, it does not exist $d\in\Delta_{1}$ such that $d_{2}\subseteq d$,
because $d_{1}\in\Delta_{1}$ and $d_{1}\subseteq d_{2}\subseteq d$, and
$\Delta_{1}$ satisfies condition 3. Consequently, the deviation $d_{2}$ is a
witness of the $\Delta_{1}$ violating condition 2, which contradicts our
assumption that $\Delta_{1}$ satisfies conditions 1, 2, 3, and 4.

### Solving safety games

We now briefly describe how to solve the safety game that provides solutions
to Problem LABEL:prob:meta-control. We define the _invariant_ of the set of
states $S\subseteq Q_{F}$, denoted as $Inv(S)$. Intuitively, the invariant of
the set of states $S\subseteq Q_{F}$ contains exactly the states from which
the meta-controller can force the meta-system to remain within $S$. Formally,
the invariant is defined recursively using sets $Inv^{i}(S)$ from which the
meta-controller can enforce retention in $S$ for at most $i\geq 0$ steps.

$Inv^{0}(S):=S$ (1) $Inv^{i}(S):=Inv^{i-1}(S)\ \cap\ \\{q\in Q_{F}\mid
R_{F}\downharpoonright E(q)\subseteq Inv^{i-1}(S)\\}$ (2)

and

$Inv(S):=\bigcap_{i\geq 0}Inv^{i}(S)$ (3)

where $R_{F}\downharpoonright
E\big{(}(q_{e},q_{c},q_{p})\big{)}=\\{(q^{\prime}_{e},q^{\prime}_{c},q^{\prime}_{p})\in
Q_{F}\mid\exists((q_{e},q_{c},q_{p}),a,(q^{\prime}_{e},q^{\prime}_{c},q^{\prime}_{p}))\in
R_{F}\text{ s.t. }\allowbreak(q_{e},a,q^{\prime}_{e})\in R_{E}\\}$ describes
the controllable successor states with respect to $R_{E}$.

### Proof of Theorem LABEL:theo:robustness

To prove Theorem LABEL:alg:tol-control, let us assume the definitions given in
Alg. LABEL:alg:tol-control and Sect. LABEL:subsect:unconstraint.

###### Lemma 1

Let environment $E$, controller $C$, safety property $P_{saf}$, and
environmental property $P_{env}=Act_{E}^{*}$ be given. For any set of states
$S\subseteq W$, the deviation $d=A\setminus del$ is robust, where
$W=Inv(Q_{F}\setminus Err)$, $A=Q_{E}\times Act_{E}\times Q_{E}$ and $del$ is
defined in Eq. LABEL:eq:del.

###### Proof

Let $T$ be the meta-controller found by computing $Meta-Controller(S,F)$. Note
that $T\subseteq F$ and that $T$ satisfy Problem LABEL:prob:meta-control. By
construction of $d$, we have that $E_{d}||C||P_{saf}\subseteq T$ since $d$ is
constructed based on $T$. It follows that for any $x_{0}\dots x_{n}\in
beh(E_{d}||C||P_{saf})$, we have that $x_{n}\notin Err$. Therefore, $d$ is
robust.

###### Lemma 2

Let environment $E$, controller $C$, safety property $P_{saf}$, and
environmental property $P_{env}=Act_{E}^{*}$ be given. For any deviation
$d\in\Delta$, there exists a set of states $S\subseteq W$ such that
$d=A\setminus del$ where $del$ is defined in Eq. LABEL:eq:del with set $S$.

###### Proof

Let $M=E_{d}||C||P_{saf}$, we show that $d=A\setminus del$ where $del$ is
computed based on $Q_{M}$. Note that $Q_{M}\subseteq W$ since $d$ is robust.
Let $T=Meta-Controller(Q_{M},F)$, we show that $Q_{M}=Q_{T}$ and
$R_{M}\subseteq R_{T}$.

First, we show that $Q_{M}=Q_{T}$. We start by showing that
$Inv(Q_{M})=Q_{M}$. By the definition of $Inv$, we have that
$Inv(Q_{M})\subseteq Q_{M}$. Next, we demonstrate that $Q_{M}\subseteq
Inv(Q_{M})$. Since $E_{d}$ contains all transitions in $E$, it follows that
$R_{F}\downharpoonright E(Q_{M})\subseteq Q_{M}$. Therefore, it must be that
$Q_{M}\subseteq Inv(Q_{M})$.

In the second part, we show that $R_{M}\subseteq R_{T}$. Intuitively, the
transitions in $M$ are a subset of the one in $T$ since $T$ only removes the
transitions that would leave $Q_{M}$. For instance, obtaining the meta-
controller in Fig. LABEL:fig:meta-system-safe dictates the removal of
transition $((3,C),a,err)$. Projecting this transition to the environment
translates to the removal of transition $(3,a,3)$. If we compute the
$E_{d}||C||P_{saf}$ for $d$ without transition $(3,a,3)$ results in a system
without the transition $((3,C),a,(3,B)$ in addition to the removal of
$((3,C),a,err)$. Formally, in the construction of $T$, only transitions from
$Q_{T}\times Act_{F}\times Q_{F}\setminus Q_{T}$ are removed. Therefore it
follows that $R_{M}\subseteq R_{T}$

Combining these two facts, we have that $d=A\setminus del$ computed based on
$Q_{M}$. The systems $T$ and $M$ have the same set of states and they remove
the same transitions that leave $Q_{M}$ to $Q_{F}\setminus Q_{M}$. Therefore,
$d$ could only have more transitions that are related to transitions within
$Q_{M}$, i.e., pictorially, they would be within the shaded area in Fig.
LABEL:fig:meta-systems. Since the computation of $T$ only deletes transitions
that leave the shaded area, it follows that those transitions are also part of
$T$. As a consequence, we have $A\setminus del\subseteq d$. The direction
$d\subseteq A\setminus del$ follows from the fact that $M\subseteq T$.

### Case study figures

Figure 1: In the Therac-25 case study, $P_{env}$ restricts the environment to
firing the beam at most once.

(a) Voting booth model.

(b) User interface for the voting machine.

Figure 2:  Models for the voting machine example. In the figures above, the
prefix “v” represents actions by the voter, while the prefix “eo” represents
actions by the election official. Figure 3: The normative environment for the
PCA pump. Figure 4: The sole maximal robust deviation for the PCA pump. Green
arrows indicate transitions that are not in the normative environment.