Model Checking Infinite-State Systems:
Generic and Specific Approaches

Anthony Widjaja To

NI VER

S

Y

TH

IT

E

U

R

G

H

O F
E

D I

N B

U

Doctor of Philosophy
Laboratory for Foundations of Computer Science
School of Informatics
University of Edinburgh
2010

Abstract
Model checking is a fully-automatic formal verification method that has been extremely successful in validating and verifying safety-critical systems in the past three
decades. In the past fifteen years, there has been a lot of work in extending manymodel checking algorithms over finite-state systems to finitely representable infinitestate systems. Unlike in the case of finite systems, decidability can easily become aproblem in the case of infinite-state model checking.
In this thesis, we present generic and specific techniques that can be used to derive
decidability with near-optimal computational complexity for various model checking
problems over infinite-state systems. Generic techniques and specific techniques primarily differ in the way in which a decidability result is derived. Generic techniques is
a “top-down” approach wherein we start with a Turing-powerful formalism for infinitestate systems (in the sense of being able to generate the computation graphs of Turingmachines up to isomorphisms), and then impose semantic restrictions whereby thedesired model checking problem becomes decidable. In other words, to show that asubclass of the infinite-state systems that is generated by this formalism is decidable
with respect to the model checking problem under consideration, we will simply haveto prove that this subclass satisfies the semantic restriction. On the other hand, specific techniques is a “bottom-up” approach in the sense that we restrict to a non-Turing
powerful formalism of infinite-state systems at the outset. The main benefit of generictechniques is that they can be used as algorithmic metatheorems, i.e., they can give
unified proofs of decidability of various model checking problems over infinite-statesystems. Specific techniques are more flexible in the sense they can be used to derive
decidability or optimal complexity when generic techniques fail.
In the first part of the thesis, we adopt word/tree automatic transition systems asa generic formalism of infinite-state systems. Such formalisms can be used to generate many interesting classes of infinite-state systems that have been considered in theliterature, e.g., the computation graphs of counter systems, Turing machines, pushdown systems, prefix-recognizable systems, regular ground-tree rewrite systems, PAprocesses, order-2 collapsible pushdown systems. Although the generality of theseformalisms make most interesting model checking problems (even safety) undecidable, they are known to have nice closure and algorithmic properties. We use thesenice properties to obtain several algorithmic metatheorems over word/tree automatic
systems, e.g., for deriving decidability of various model checking problems including
recurrent reachability, and Linear Temporal Logic (LTL) with complex fairness coni

straints. These algorithmic metatheorems can be used to uniformly prove decidability
with optimal (or near-optimal) complexity of various model checking problems overmany classes of infinite-state systems that have been considered in the literature. In
fact, many of these decidability/complexity results were not previously known in theliterature.
In the second part of the thesis, we study various model checking problems oversubclasses of counter systems that were already known to be decidable. In particular, we consider reversal-bounded counter systems (and their extensions with discrete
clocks), one-counter processes, and networks of one-counter processes. We shall derive optimal complexity of various model checking problems including: model checking LTL, EF-logic, and first-order logic with reachability relations (and restrictions
thereof). In most cases, we obtain a single/double exponential reduction in the previously known upper bounds on the complexity of the problems.

ii

Acknowledgements
First and foremost, I would like to express my deepest gratitude to my supervisor
Leonid Libkin for his teaching, guidance and sound advice throughout my PhD studies.
I have learnt a lot from him about many aspects of logic and automata, which I would
unlikely have looked at otherwise. His teaching and discussions have always been asource of inspirations. Leonid has also helped me with many academic and personal
issues that I encountered throughout my PhD studies. I cannot thank him enough for
all these helps.
I would also like to thank my co-supervisor Richard Mayr for his guidance and his
inspiring introduction to the area of verification of infinite-state systems. I have lost
count of how many hours of useful discussions about research which we have had in
the last two years.
I am honored to have Luke Ong and Colin Stirling as my PhD examiners. Thankyou for going through the thesis and providing a lot of useful feedback.
I would also like to thank Stefan Göller and Matthew Hague for the fruitful collaborations that we have had throughout my PhD studies. I look forward to working closely together again in the near future. In addition, I am grateful to manyother colleagues presently or previously at the School of Informatics with whom I
have had many useful discussions: Shunichi Amano, Lorenzo Clemente, Claire David,
Christophe Dubach, Kousha Etessami, Floris Geerts, Luis Fabricio Wanderley Goes,
Julian Gutierrez, Xibei Jia, Shuai Ma, Filip Murlak, Vasileios Porpodas, Juan Reutter,
Rahul Santhanam, Karthik T. Sundararajan, Tony Tan, and Yinghui Wu. I would also
like to thank colleagues from other institutes with whom I have had useful research discussions throughout my PhD studies: Vince Barany, Pablo Barcelo, Eryk Kopczynski,
Jerome Leroux, Christof Löding, Christophe Morvan, and Sanming Zhou.
I would also like to acknowledge many teachers and colleagues from Australia whohave been a great source of inspiration. In particular, I thank James Bailey, Harald
Sondergaard, and Sanming Zhou for introducing me to theoretical computer science.
I am also indebted to my mentors Mike Ciavarella and Benjamin Rubinstein for theirpersonal and academic advice.
My PhD studies have been made possible by Overseas Research Students Award
Scheme and EPSRC grant E005039. Thank you for the generous support.
Last but not least, I would like to thank my family and my girlfriend who havesupported me personally throughout my PhD studies. This thesis is dedicated for you.

iii

Declaration
I declare that this thesis was composed by myself, that the work contained herein is
my own except where explicitly stated otherwise in the text, and that this work has notbeen submitted for any other degree or professional qualification except as specified.

(Anthony Widjaja To)

iv

Table of Contents

1 Introduction

1

1.1

Specific approaches . . . . . . . . . . . . . . . . . . . . . . . . . . .

4

1.2

Generic approaches . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

1.3

Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

1.4

Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

122 Preliminaries

13

2.1

General notations . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13

2.2

Automata theory . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14

2.2.1

Automata over finite words . . . . . . . . . . . . . . . . . . .

15

2.2.2

Automata over ω-words . . . . . . . . . . . . . . . . . . . .

22

2.2.3

Automata over trees . . . . . . . . . . . . . . . . . . . . . .

23

2.2.4

Automata over infinite trees . . . . . . . . . . . . . . . . . .

29

2.2.5

Pushdown automata and context-free grammars . . . . . . . .

30

2.2.6

Parikh’s Theorem and semilinear sets . . . . . . . . . . . . .

31

Computability and complexity theory . . . . . . . . . . . . . . . . .

33

2.3.1

Computability . . . . . . . . . . . . . . . . . . . . . . . . .

33

2.3.2

Complexity theory . . . . . . . . . . . . . . . . . . . . . . .

34

2.4

Structures and transition systems . . . . . . . . . . . . . . . . . . . .

37

2.5

Logics and properties . . . . . . . . . . . . . . . . . . . . . . . . . .

38

2.5.1

Safety, liveness, and fairness . . . . . . . . . . . . . . . . . .

39

2.5.2

Reachability and recurrent reachability . . . . . . . . . . . .

40

2.5.3

FO: First-order logic . . . . . . . . . . . . . . . . . . . . . .

41

2.5.4

FOREG (Reach): FO with regular reachability . . . . . . . . .

44

2.5.5

HM-logic: Hennessy-Milner Logic . . . . . . . . . . . . . .

45

2.5.6

EFREG -logic: HM-logic with regular reachability . . . . . . .

46

2.5.7

CTL: Computation Tree logic . . . . . . . . . . . . . . . . .

47

2.3

v

2.5.8

LTL: Linear Temporal Logic . . . . . . . . . . . . . . . . . .

48

2.5.9

Other logics . . . . . . . . . . . . . . . . . . . . . . . . . . .

49

2.5.10 Model checking complexity . . . . . . . . . . . . . . . . . .

50

I Generic Approaches: Algorithmic Metatheorems

53

3 Word/Tree-automatic Systems

55

3.1

3.2

3.3

Word-automatic systems . . . . . . . . . . . . . . . . . . . . . . . .

56

3.1.1

Basic definitions . . . . . . . . . . . . . . . . . . . . . . . .

56

3.1.2

Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . .

58

3.1.3

Basic closure and algorithmic results . . . . . . . . . . . . .

62

3.1.4

Negative results . . . . . . . . . . . . . . . . . . . . . . . . .

67

Tree-automatic systems . . . . . . . . . . . . . . . . . . . . . . . . .

69

3.2.1

Basic definitions . . . . . . . . . . . . . . . . . . . . . . . .

69

3.2.2

Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . .

71

3.2.3

Basic closure and algorithmic results . . . . . . . . . . . . .

73

3.2.4

Negative results . . . . . . . . . . . . . . . . . . . . . . . . .

75

Other generic frameworks . . . . . . . . . . . . . . . . . . . . . . .

75

3.3.1

Length-preserving word-automatic transition systems . . . . .

75

3.3.2

Presburger transition systems . . . . . . . . . . . . . . . . . .

77

3.3.3

Rational transition systems . . . . . . . . . . . . . . . . . . .

78

3.3.4

ω-word automatic transition systems . . . . . . . . . . . . . .

80

4 Algorithmic metatheorems for recurrent reachability
4.1

4.2

4.3

81

The word-automatic case . . . . . . . . . . . . . . . . . . . . . . . .

83

4.1.1

Main theorem . . . . . . . . . . . . . . . . . . . . . . . . . .

83

4.1.2

Proof of the main theorem . . . . . . . . . . . . . . . . . . .

84

4.1.3

A small witness for recurrent reachability . . . . . . . . . . .

91

4.1.4

Two appetizer examples . . . . . . . . . . . . . . . . . . . .

92

The tree-automatic case . . . . . . . . . . . . . . . . . . . . . . . . .

95

4.2.1

Main theorem . . . . . . . . . . . . . . . . . . . . . . . . . .

95

4.2.2

Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . .

96

4.2.3

Proof of the main theorem . . . . . . . . . . . . . . . . . . .

97

4.2.4

An appetizer example . . . . . . . . . . . . . . . . . . . . . 105

Generalized Büchi conditions . . . . . . . . . . . . . . . . . . . . . . 106

vi

4.4

4.3.1

Word-automatic systems . . . . . . . . . . . . . . . . . . . . 107

4.3.2

Tree-automatic systems . . . . . . . . . . . . . . . . . . . . . 107

4.3.3

Applications . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Recurrent reachability via approximation . . . . . . . . . . . . . . . 110

5 Algorithmic metatheorems for logic model checking

113

5.1

Model checking LTL . . . . . . . . . . . . . . . . . . . . . . . . . . 115

5.2

Model checking LTL fragments . . . . . . . . . . . . . . . . . . . . 120
5.2.1

Almost linear Büchi automata . . . . . . . . . . . . . . . . . 120

5.2.2

LTLdet : Deterministic LTL . . . . . . . . . . . . . . . . . . . 124

5.2.3

LTL(Fs , Gs ): LTL with only strict future/global operators . . . 125

5.3

Model checking FOREG (Reach + EGF) . . . . . . . . . . . . . . . . . 126

5.4

Several appetizer applications . . . . . . . . . . . . . . . . . . . . . 127

5.5

5.4.1

Pushdown systems . . . . . . . . . . . . . . . . . . . . . . . 127

5.4.2

Prefix-recognizable systems . . . . . . . . . . . . . . . . . . 128

5.4.3

Regular ground tree rewrite systems . . . . . . . . . . . . . . 129

A nonelementary lower bound for HM-logic . . . . . . . . . . . . . . 131

6 More applications of algorithmic metatheorems

135

6.1

PA-processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

6.2

Reversal-bounded counter systems . . . . . . . . . . . . . . . . . . . 138

6.3

6.2.1

Basic model with one free counter . . . . . . . . . . . . . . . 138

6.2.2

Extension with discrete clocks . . . . . . . . . . . . . . . . . 142

Subclasses of Petri nets . . . . . . . . . . . . . . . . . . . . . . . . . 144
6.3.1

Two-dimensional vector addition systems with states . . . . . 145

6.3.2

Conflict-free Petri nets . . . . . . . . . . . . . . . . . . . . . 146

6.3.3

Reversible Petri nets . . . . . . . . . . . . . . . . . . . . . . 147

II Specific Approaches

149

7 Reversal-bounded counter systems and their extensions

151

7.1

Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

7.2

A Caratheodory-like theorem for linear sets . . . . . . . . . . . . . . 155

7.3

Parikh images of regular languages . . . . . . . . . . . . . . . . . . . 160
7.3.1

A normal form theorem . . . . . . . . . . . . . . . . . . . . 160

7.3.2

Complementary lower bounds . . . . . . . . . . . . . . . . . 164
vii

7.4

7.5

Three simple applications . . . . . . . . . . . . . . . . . . . . . . . . 166
7.4.1

Integer programming . . . . . . . . . . . . . . . . . . . . . . 166

7.4.2

Decision problems for Parikh images of NWAs . . . . . . . . 168

7.4.3

Presburger-constrained graph reachability . . . . . . . . . . . 173

Applications to model checking . . . . . . . . . . . . . . . . . . . . 175
7.5.1

LTL with complex fairness . . . . . . . . . . . . . . . . . . . 175

7.5.2

Branching-time logics . . . . . . . . . . . . . . . . . . . . . 177

8 One-counter processes

179

8.1

Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

8.2

Min-Max Arithmetic . . . . . . . . . . . . . . . . . . . . . . . . . . 182

8.3

8.2.1

The definition . . . . . . . . . . . . . . . . . . . . . . . . . . 182

8.2.2

Syntactic sugar: extended MMA

8.2.3

Basic properties of MMA and extended MMA . . . . . . . . 184. . . . . . . . . . . . . . . 184

Saturations and small arithmetic progressions . . . . . . . . . . . . . 187
8.3.1

Saturation construction . . . . . . . . . . . . . . . . . . . . . 187

8.3.2

Computing small arithmetic progressions . . . . . . . . . . . 188

8.3.3

Characterization of zero paths and positive paths . . . . . . . 190

8.4

A translation to MMA . . . . . . . . . . . . . . . . . . . . . . . . . 191

8.5

Application to weak-bisimilarity checking . . . . . . . . . . . . . . . 196

8.6

Lower bounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

9 Networks of one-counter processes
9.1

201

Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
9.1.1

Asynchronous products . . . . . . . . . . . . . . . . . . . . . 204

9.1.2

Synchronization predicates . . . . . . . . . . . . . . . . . . . 205

9.2

Two fragments L and L′ of Presburger Arithmetic . . . . . . . . . . . 206

9.3

Complexity upper bounds . . . . . . . . . . . . . . . . . . . . . . . . 208

9.4

9.3.1

Combined and data complexity of FOS (Reach) . . . . . . . . 208

9.3.2

Expression complexity of FO2 (Reach) . . . . . . . . . . . . 212

Complexity lower bounds . . . . . . . . . . . . . . . . . . . . . . . . 213

III Epilogue

217

10 Conclusions and Future work

219

viii

Bibliography

223

A Proofs from Chapter 4

245

A.1 Proposition 4.1.5 implies necessity in Lemma 4.1.4 . . . . . . . . . . 245
A.2 Proof of Lemma 4.2.2 . . . . . . . . . . . . . . . . . . . . . . . . . . 246
A.3 Proof of Proposition 4.3.4 . . . . . . . . . . . . . . . . . . . . . . . . 247
A.4 Proof of Proposition 4.3.7 . . . . . . . . . . . . . . . . . . . . . . . . 248
B Proofs from Chapter 5249

B.1 Proof of Proposition 5.4.6 . . . . . . . . . . . . . . . . . . . . . . . . 249
C Proofs from Chapter 7251

C.1 Proof of Fact 7.3.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
C.2 Proof of Lemma 7.3.5 . . . . . . . . . . . . . . . . . . . . . . . . . . 252
C.3 Proof of Lemma 7.3.6 . . . . . . . . . . . . . . . . . . . . . . . . . . 252
C.4 Proof of Proposition 7.3.10 . . . . . . . . . . . . . . . . . . . . . . . 252
C.5 Proof of Proposition 7.4.2 . . . . . . . . . . . . . . . . . . . . . . . . 254
C.6 Proof of Proposition 7.5.7 . . . . . . . . . . . . . . . . . . . . . . . . 255
D Proofs from Chapter 8257

D.1 Proof of Lemma 8.2.2 . . . . . . . . . . . . . . . . . . . . . . . . . . 257
D.2 Proof of Lemma 8.3.1 . . . . . . . . . . . . . . . . . . . . . . . . . . 261
D.3 Proof of Lemma 8.3.3 . . . . . . . . . . . . . . . . . . . . . . . . . . 262
D.4 Proof of Theorem 8.4.3 . . . . . . . . . . . . . . . . . . . . . . . . . 262
D.5 Proof of Proposition 8.6.2 . . . . . . . . . . . . . . . . . . . . . . . . 264
D.6 Proof of Proposition 8.6.3 . . . . . . . . . . . . . . . . . . . . . . . . 269
E Proofs from Chapter 9273

E.1 Proof of Proposition 9.2.1 . . . . . . . . . . . . . . . . . . . . . . . . 273
E.2 Missing proofs from Subsection 9.3.2 . . . . . . . . . . . . . . . . . 274
E.3 Proof of Lemma 9.4.1 . . . . . . . . . . . . . . . . . . . . . . . . . . 279
E.4 Proof sketch of Proposition 9.4.4 . . . . . . . . . . . . . . . . . . . . 280
E.5 Proof of Proposition 9.4.5 . . . . . . . . . . . . . . . . . . . . . . . . 280
E.6 Proof of Proposition 9.4.6 . . . . . . . . . . . . . . . . . . . . . . . . 282

ix

Chapter 1
Introduction
The past few decades saw an unprecendented growth rate of computers in scale andfunctionality. This has resulted in a substantial growth in complexity, which consequently increases the likelihood of subtle errors. It is a truism that in this technologicalera people have grown accustomed to systems that from time to time exhibit certain
faults. Although such faults are a mere nuisance for everyday systems (e.g. personal
desktops “hang”), they could be catastrophic for safety-critical or life-critical systems.
Furthermore, it is well-known that, even when the systems are not safety-critical or
life-critical, errors could still result in a substantial loss of money or productivity1.
Many examples of such system failures and their impacts are well-documented (e.g.
see [Cip95, CGP99, Gre09]).
For a long time, testing has been the standard technique for system validation.
Nowadays, testing is well-known to be insufficient to ensure the correctness of a system. This statement is even truer in the presence of concurrency in the system. To
ensure that a system is correct, formal methods are necessary. Model checking is afully-automatic formal verification method that has been extremely successful in validating and verifiying safety-critical systems in the past three decades resulting in a
recent bestowal of ACM Turing Award to its pioneers. Loosely speaking, in orderto check that a system satisfies a certain property, we first create an abstract model S(usually as a finite transition system) that captures how the system evolves, and express
the property as a formula ϕ is some logical language (usually some temporal logic).
This reduces the initial problem to checking whether S satisfies ϕ, which can then be
checked using standard model checking algorithms (e.g. see [CGP99, Sch02]).
1 The 80/20 rule is a well-known rule of thumb stating that only 20% of software development effort

is spent on writing codes, while the rest is primarily spent on debugging

1

Chapter 1. Introduction

2

Model checking primarily differs from other approaches in the literature of verification (e.g. automated theorem proving and traditional static analysis) in two aspects.
First of all, model checkers are meant to be fully-automatic, i.e., can be used as a
blackbox. This is in contrast to automated theorem provers, which often require considerable user interventions. This aspect of model checking perhaps explains the wide
adoption of model checking technologies by industries including NASA, Intel, IBM,and Motorola. The other major difference of model checking is the use of expressive
specification language, e.g., temporal logics like LTL (Linear Temporal Logic), andCTL (Computation Tree Logic). This is in contrast to traditional static analysis techniques, which are fully-automatic but admit only very simple properties like safety andliveness; see [DKW08] for a more detailed discussion. Nowadays model checking is
widely used for static analysis of programs (cf. [DKW08]).
In theory, real-world systems can almost always be modeled as finite transition
systems that are explicitly represented (e.g. using adjacency lists). However, such anaive approach is often impractical. One well-known problem with this approach isthe state-explosion problem, i.e., the number of configurations in the abstract model
grows exponentially in the number of certain parameters in the actual system. For
example, a distributed protocol with n processes could have at least exponentiallymany possible configurations. One successful approach to deal with this problem
is called symbolic model checking [BCM+ 90, McM93], which is to develop model
checking algorithms on symbolic representations of the transition system. In the caseof [BCM+ 90, McM93], the symbolic representation is ordered binary decision diagrams (OBDDs). An intuitive explanation of the success of this approach is that many
real world systems exhibit a large amount of symmetry and therefore could be succinctly represented as OBDDs, on which efficient algorithms could be developed.
In the past fifteen years, there has been a lot of work in extending the symbolicmodel checking techniques to deal with symbolic representations of infinite-state transition systems. Although most real-world systems could be thought of as finite systems(e.g. the size of hard disks and the number of processes of a distributed protocol are
finite in reality), it is often more suitable to model them as infinite-state systems. For
example, in the study of distributed algorithms [Lyn96], a distributed protocol is said
to satisfy a certain property (e.g. freedom from deadlock) if each instance of the protocol with n processes satisfies the property, i.e., not only for each value of n up to (say)1500, although this number could be reasonable for today’s standard. This is arguably
also the reason why abstract models of computation such as Turing machines (withChapter 1. Introduction

3

an infinite tape) and Minsky’s counter machines (with the ability to store unbounded
integer values) are used as formal definitions of the intuitive notions of algorithms. We
shall now mention a few possible sources of infinity in the abstractions of real-world
systems:
1. Data structures: stacks (e.g. for modeling recursions), queues (e.g. for modelingcommunication channels), arrays and heaps.
2. Numeric data types: integers, reals, etc.
3. Discrete or real-valued clocks.
4. Concurrency: unbounded number of processes.
Most of these sources of infinity can easily result in Turing-powerful models of computation (in the sense of being able to generate the computation graphs of Turing machines up to isomorphisms). Despite this, researchers have obtained promising resultsin this direction that are both interesting from both practical and theoretical points ofview.
Approaches to infinite-state model checking that have been considered in the literature can often be (somewhat loosely) classified into two categories: “generic” and“specific”. Generic approaches usually adopt powerful symbolic representations of
infinite-state systems (i.e., those that can capture Turing-powerful models of computation such as Turing machines or counter machines) and develop partial techniques forsolving model checking problems over such systems. These partial techniques mightturn out to be complete (i.e. yield decidability) in cases when certain restrictions are
imposed. In contrast, specific approaches avoid undecidability by always restricting to
non-Turing-powerful formalisms at the outset. Nonetheless, this does not necessarilymean that positive results obtained in this way are always restrictive. In this thesis,
we shall present generic techniques and specific techniques for obtaining decidability with optimal (or near-optimal) computational complexity of various infinite-statemodel checking problems.
The rest of this section is organized as follows. In Section 1.1 and Section 1.2,
we shall review some results in the literature of infinite-state model checking that havebeen obtained using specific and generic approaches, respectively. In Section 1.3, we
will discuss the contributions of this thesis. Finally, in Section 1.4 we will outline how
the thesis is organized.

Chapter 1. Introduction

4

1.1 Specific approaches
Finding classes of infinite-state systems with decidable model checking tasks is by far
the most popular approach in infinite-state model checking. This perhaps explains theplethora of decidability results that have been obtained in infinite-state model checking.
We shall now review some of the major decidability/complexity results in the area.
One of the earliest decidability results in infinite-state model checking that permits an expressive specification language is arguably Muller and Schupp’s result thatmodel checking monadic second-order logic (MSO) over pushdown systems (i.e. thetransition graphs of pushdown automata) is decidable [MS85]. Pushdown systems
are relevant in verification since they are known to be good abstractions for sequential programs with unbounded recursions. On the other hand, there exists a fixed
pushdown system (i.e. the infinite binary tree) with a nonelementary2 complexityof MSO model checking [Sto74]. This is in contrast to the problem of reachability over pushdown systems, which is easily reducible to the P-complete problem of
nonemptiness of languages of pushdown automata. This motivated researchers to findlogics that are weaker than MSO, but are still sufficiently expressive for verification
purposes, i.e., they should be able to express reachability and possibly also some liveness properties3 . Temporal/modal logics turn out to have much better complexity over
pushdown systems. Walukiewicz [Wal96, Wal01] was the first to identify that model
checking (modal) µ-calculus over pushdown systems is EXP-complete. This specification language is subsumed by MSO, but turns out to be as powerful as MSO for
expressing bisimulation-invariant properties [JW96], which include most properties ofinterests in verification. Linear Temporal Logic (LTL) was then proved to have EXPcomplete model checking complexity over pushdown systems [BEM97]. In contrast
to µ-calculus, model checking LTL was shown to be solvable in P for a fixed formula,which is appealing since LTL specifications are quite small in practice. The complexity for other temporal logics including CTL (Computation Tree Logic), EF-logic, andPropositional Dynamic Logic (PDL) have also been identified to be within EXP (cf.
[BEM97, GL06, Wal00]).
Many of the results for pushdown systems have by now been extended to more
expressive classes of infinite-state systems, which we shall mention next. First, the decidability of MSO has been extended by Caucal [Cau96, Cau03] to prefix-recognizable
2 This means that the time complexity cannot be bounded from above by k-fold exponential functions

for every fixed k > 1.
3 In this sense, Hennesy-Miler logic (or modal logics of actions) does not fall within this category

Chapter 1. Introduction

5

systems, which can be understood as pushdown systems with infinitely many rewrite
rules compactly represented by means of regular languages. The complexity of modal
and temporal logics have also been identified for prefix-recognizable systems [Cac02,
GL06, KPV02]. For example, over µ-calculus the problem remain EXP-complete[Cac02, KPV02]. Over LTL, the problem remains EXP-complete, but the EXP lower
bound still holds for a fixed formula [KPV02]. Interestingly, it was only shown recently[Göl08] that reachability over prefix-recognizable systems is already EXP-hard. Caucal [Cau02] also gave another extension of the MSO decidability of prefix-recognizable
systems to a hierarchy of infinite graphs, which are known as Caucal hierarchy. As has
been shown in [CW03], this hierarchy of graphs is intimately connected to a formalism
called higher-order pushdown automata [Mas76], which extend pushdown automata
by “stack-of-stacks” structures. Some results on model checking higher-order pushdown systems are also known, e.g., model checking µ-calculus is n-EXP complete fororder-n higher-order pushdown systems [Cac03, CW07]. Similar results on related formalisms like higher-order recursion schemes and collapsible higher-order pushdown
automata, which are suitable abstractions for higher-order programs with unboundedrecursions, are also known (cf. [Ong06, HMOS08]).
So far, we have only discussed abstract models of sequential programs. We now
discuss models of concurrent programs. Petri nets — initially proposed by Carl Adam
Petri — are one of the first well-known models for purely concurrent programs withinteresting decidability results. Roughly speaking, they are a subclass of Minsky’s
counter machines with only one state that cannot test whether a counter value is zero.
Reachability for Petri nets is known to be solvable in non-primitive recursive time
[May84], but is only known to be EXPSPACE-hard [Lip76]. On the other hand,branching-time model checking over Petri nets is known to be undecidable [Esp97a]even over EF-logic, which is probably the simplest standard branching-time logic witha reachability operator. Despite this, LTL model checking is decidable, but has beenshown to be as hard as reachability for Petri nets [Esp94]. Interestingly, when only
infinite runs are considered, the complexity of the problem is EXPSPACE-complete[Hab97]. Many subclasses of Petri nets with better decidability/complexity are known.
We shall mention communication-free Petri nets (a.k.a. basic parallel processes),
which are simply Petri nets whose transitions depend only on the value of a single
counter. Communication-free Petri nets are known to have NP-complete reachability
problem [Esp97b] and PSPACE-complete EF-logic model checking problem [May98].
We refer the reader to the survey [Esp96] and the thesis [May98] for more results andChapter 1. Introduction

6

discussions on Petri nets and their subclasses.
The expressive power of Petri nets and pushdown automata as graph generators
are known to be incomparable up to bisimulation (cf. [BCMS01, Mol96]). Intuitively, this is because pushdown systems can only model sequential programs, while
Petri nets only purely concurrent programs. Some research has been made into combining them to obtain a model that is both sequential and concurrent. We shall firstmention PA-processes (cf. [BW90, BCMS01, Mol96]), which are obtained by blending one-state pushdown automata and communication-free Petri nets. PA-processes
are known to have decidable EF-logic model checking and NP-complete reachability [May98, LS02], but undecidable LTL model checking [BH96]. It is also known
that they can be used to model parallel programs with unbounded recursions and unbounded parallelism [BW90, EP00]. The first complete generalization of pushdown
automata and Petri nets was given by Mayr [May98], which he calls Process Rewrite
Systems (PRS). Despite its generality, PRS is still known to have decidable reachability
problem [May98].
Another way of incorporating some concurrency into pushdown systems is to consider rewrite rules over ranked trees instead of words. This approach yields a classof infinite-state systems that is called ground tree rewrite systems (cf. [CDG+ 07]). It
has been shown that ground tree rewrite systems have polynomial-time reachability[CDGV94, Löd03] and decidable model checking with respect to first-order logic withreachability operators [DT90]. Löding [Löd03] was the first to show that some interesting liveness properties could be also decided for ground tree rewrite systems. In particular, he showed that the problem of checking the existence of an infinite path from agiven tree T which visits a given set L (A ) infinitely often, where L (A ) is the languageof a tree automaton A , is decidable in polynomial time. Such a liveness property is often referred to as recurrent reachability and repeated reachability (e.g. see [BBF+ 01]).
In order to emphasize the expressive “target” set L (A ), we shall also address the property as recurrent reachability with regular fairness constraint. These positive results
also extend to regular ground tree rewrite systems [DT90, Löd03, Löd06], which areextensions of ground tree rewrite systems with infinitely many rules compactly represented by means of tree automata (i.e. similar to prefix-recognizable systems). Despite
this, it can be shown that model checking logics like LTL and CTL is undecidable overground tree rewrite systems.
So far, we have discussed some results on systems with two sources of infinity, i.e.,
stacks (or generalizations thereof) and concurrency. What about numeric data types

Chapter 1. Introduction

7

like integers? Unfortunately, adding numeric data types easily result in undecidability,e.g., consider Minsky’s 2-counter machines. As we saw earlier, decidability can beretained if we do not allow zero tests yielding the model called Petri nets. However,this is not satisfactory since programs naturally perform arithmetic expressions, thesimplest of which already require zero test. Let us now discuss some restrictions on
counter machines that still allow test for zero but still have some interesting decidability results. Firstly, if we restrict the number of counters to one, we obtain 1-countermachines, which can be thought of as pushdown automata with one stack symbol plus a
non-removable stack-bottom symbol. In this way, 1-counter systems inherit the decidability results from pushdown systems, e.g., model checking MSO. It turns out, though,that 1-counter systems have better computational complexity. For example, LTL and µcalculus model checking over 1-counter systems were shown to be PSPACE-complete[Dem06, Ser06], in contrast to pushdown systems which are EXP-complete. For EFlogic, the complexity is known to be in PSPACE [Wal00] and DP-hard [JKMS04].
Another well-known decidable restrictions of counter machines are reversal-bounded
counter machines, which were initially proposed by Ibarra [Iba78]. These are simply
counter machines each of whose counters can change from a non-decreasing mode toa non-increasing mode (or vice versa) for a fixed r number of times. Reachability was
initially shown by Gurari and Ibarra [GI81] to be solvable in PSPACE, and later was
shown in [HR87] to be precisely NP-complete when r is given in unary and NEXPcomplete when r is given in binary. Furthermore, when the number of reversals and thenumber of counters are fixed in advance, the problem is solvable in polynomial time
[GI81]. Certain liveness problems like recurrent reachability have also been shown to
be decidable [DIP01] for reversal-bounded counter systems with one free counter.
Results that combine infinite data structures with numeric data types are also available. We shall only mention the result on reversal-bounded counter systems with apushdown stack and finitely many discrete clocks [DIB+ 00]. This class of systems
generalizes pushdown systems, reversal-bounded counter systems, and discrete timed
systems [AD94] simultaneously. Despite this, it was shown in [DIB+ 00] that interesting safety properties are still decidable. It was an open question in [DIP01] whether
interesting liveness properties are also decidable for this model.
There are also other classes of systems with interesting decidability results formodel checking that we have not mentioned. These include lossy channel systems[ACJT96] and probabilistic infinite-state systems including probabilistic pushdown
systems (cf. [KEM06]), which we will not further encounter in the thesis.

Chapter 1. Introduction

8

1.2 Generic approaches
We have hitherto mentioned only models of computations that are not Turing-powerful.
However, these are not the only models that were intensively studied in infinite-statemodel checking communities. Many formalisms that are capable of generating theconfiguration graphs of Turing machines or Minsky’s counter machines have also beenstudied. These include rational transition systems [Mor00, BG09], automatic and ωautomatic structures [Blu99, BG04], tree-automatic structures [Blu99, BLN07], and
Presburger-definable systems (cf. [Boi99, BFLP08, FL02]). Since even reachability
is already undecidable over such systems, most results concerning verification oversuch systems have a semi-algorithmic flavor. In particular, we mention the workon regular model checking, which aims to develop practical semi-algorithmic techniques for computing a symbolic representation (e.g. using regular languages) of thereachability sets or reachability relations of such systems. The reader is referred to[AJNS04, Bou01, Boi99, BLW03, BJNT00, BHV04, KMM+01, Nil05] for moredetails. Many of the semi-algorithms given in this literature, however, do not comewith a completeness criterion, i.e., a criterion on the input systems whereby the semialgorithms will certainly terminate with a correct answer. In other words, the performance of many of these semi-algorithms is only evaluated experimentally. In thecase when completeness criteria are given, they are often unnatural and do not subsumecommonly considered subclasses of systems with decidable model checking problems.
Recently, there have been several successful attempts to provide semi-algorithms
with natural criteria for completeness. In particular, we shall mention the work [LS05a,
BFLS05], which provide semi-algorithms based on the “acceleration techniques” of[CJ98, FL02, Boi03] for computing symbolic representations of reachability sets orreachability relations over linear counter systems (a subset of Presburger-definable systems). They show that their algorithms terminate with a correct answer iff the input
systems are flattable, i.e., they can be turned into a flat counter system [CJ98]. Manyinteresting subclasses of counter systems have been shown to satisfy this property, e.g.,2-dimensional vector addition systems with states [LS04], reversal-bounded countersystems [LS05a], and other subclasses of Petri nets [LS05a]. Thus, this approachyields a single semi-algorithm that is guaranteed to solve the reachability problems forthese subclasses of counter systems, instead of one dedicated algorithm for each subclass. Furthermore, the general procedures turn out to be simpler than the specializedalgorithms (e.g. reachability for 2-dim vector addition systems was shown to be de-Chapter 1. Introduction

9

cidable in [HP79] with a rather difficult technique). These semi-algorithms have also
been implemented in FAST [BFLP08] with impressive experimental results.
The results of [LS05a, BFLS05] can naturally be viewed as algorithmic metatheorems, as was suggested by the authors. More precisely, to prove whether a subclassof linear counter systems has decidable reachability, it suffices to show that they areflattable. In this sense, other results in the verification literature can also be classified as algorithmic metatheorems. In particular, we shall mention the works of[Fin87, Fin90, ACJT96, FS01] on well-structured transition systems and the works of[Sem84, Wal02, CW98] on operations on transition systems that preserve decidabilityof monadic second-order logic. In the case of finite-state model checking, algorithmic
metatheorems are also used extensively to obtain good algorithmic bounds for evaluating logical formulas [FG06].

1.3 Contributions
The main contributions of this thesis are new generic and specific techniques forinfinite-state model checking.
Our generic approach to infinite-state model checking adopts word/tree automatictransition systems [BG04] as generic frameworks. Although reachability is alreadyundecidable, word/tree automatic transition systems are known to satisfy some niceclosure/algorithmic properties, e.g., closure under boolean combinations and automata
projections [Hod83]. Using these properties, we will prove various algorithmic metatheorems for showing decidability of model checking over word/tree automatic transition
systems with optimal (or near-optimal) complexity. More importantly, we will showthat many previously known or unknown decidability/complexity can be obtained in a
uniform way using our metatheorems.
Thus far only algorithmic metatheorems for safety properties are available in theliterature [LS05a, BFLS05]. We complement these results by providing algorithmic
metatheorems for liveness. Our most basic algorithmic metatheorem concerns a particular liveness property over the expressive class of word/tree automatic systems calledrecurrent reachability checking with regular fairness constraints. Such a property isimportant since certain logic model checking (e.g. LTL) can be reduced to it. In particular, we show that, for any subclass C of word/tree automatic systems for which there
exists an algorithm M computing a word/tree automatic presentation of the reachability relation of a given system in C , we may decide recurrent reachability by firstChapter 1. Introduction

10

computing the reachability relation of the given system and then perform some extra
polynomial-time computation. This metatheorem will then be extended to recurrent
reachability with multiple regular fairness constraints (a.k.a. generalized Büchi conditions). Roughly speaking, this problem asks whether there exists an infinite pathfrom a given configuration (i.e. a finite word or a finite tree) visiting each of the given
regular sets L (A1 ), . . ., L (An ) infinitely often (simultaneous visits are not required).
Together with the known results on algorithms for computing reachability relations
for specific classes of infinite-state systems, our metatheorems can be applied to uniformly derive decidability of recurrent reachability over pushdown systems, prefixrecognizable systems, (regular) ground-tree rewrite systems, PA-processes, order-2
collapsible pushdown systems, PA-processes, reversal-bounded counter systems (andextensions thereof), and some subclasses of Petri nets including 2-dim vector addition
systems. For many of these classes of infinite-state systems, we manage to obtain optimal complexity. Many of these decidability/complexity results were not previously
known in the literature. For example, Löding [Löd06] asked whether his result on
the decidability of recurrent reachability with a single regular fairness constraint overground tree rewrite systems could be extended to multiple regular fairness constraints,
which we answer positively using the techniques in this thesis.
Building on our algorithmic metatheorems for recurrent reachability, we provide
algorithmic metatheorems for logic model checking over word/tree automatic systems.
In particular, we consider the LTL (or fragments thereof) model checking problems
with multiple regular fairness constraints. Fairness constraints are standard ways of
eliminating executions that do not represent actual paths in the real-world systems,
i.e., “spurious” executions that are introduced by abstractions (cf. [BBF+ 01]). Regular languages give powerful ways of expressing fairness, which cannot be expressedin LTL alone. Our results are as follows. To begin with, we show that if we additionally require the subclass C of word/tree automatic systems to be closed under
products with finite systems, then we obtain decidability of the full LTL model checking with multiple regular fairness constraints. We will use this algorithmic metatheorem for uniformly deriving decidability with optimal (or near-optimal complexity) of
LTL model checking with multiple regular fairness constraints over pushdown systems,
prefix-recognizable systems, and extensions of reversal-bounded counter systems withdiscrete clocks and one free counter. The condition of closure under products withfinite systems turns out to be rather restrictive. For this reason, we provide a weakening of this condition, which we call closure under taking subsystems. This condition

Chapter 1. Introduction

11

is rather weak and is satisfied by virtually every class of infinite-state systems. Our
second algorithmic metatheorem is that if C satisfies this condition together with thecondition for recurrent reachability, we have decidability of the fragments LTL(Fs , Gs )and LTLdet over C with multiple regular fairness constraints. These fragments of LTL
are sufficiently powerful to express many interesting safety/liveness constraints. More
importantly, we use this algorithmic metatheorem to give new decidability/complexity
results over many of the classes of infinite-state systems.
Additionally, we build on top of our algorithmic metatheorems for recurrent reachability to obtain algorithmic metatheorems for extensions of first-order logic withreachability and recurrent reachability operators (possibly enriched with path constraints). Similarly, we can apply these metatheorems for deriving decidability resultsover classes of infinite-state systems that have been considered in the literature.
Generic approaches are not without limitations. In particular, when we consider
subclasses of counter systems (e.g. one-counter systems and reversal-bounded countersystems), our generic approaches cannot immediately derive optimal complexity. We
address this problem by providing new techniques that are designed specifically forthese classes of systems.
First of all, we will develop techniques to compute Parikh images of nondeterministic finite state automata (as semilinear sets) in a more efficient way. This technique
can then be used to derive an optimal complexity for LTL model checking with multiple regular fairness constraints over reversal-bounded counter systems with discrete
clocks. We will also provide a kind of fixed-parameter tractability result for model
checking EF-logic over reversal-bounded counter systems. These results were not previously known.
Finally, we will consider the problem of model checking EF-logic and first-orderlogic with reachability over one-counter processes and networks of one-counter processes with no bounds on the number of reversals. As we will show later, these classesof systems form a natural subclass of programs with multiple integer variables andsimple synchronizations between the variables. To prove optimal complexity for thesemodel checking problems, we will first introduce new subclasses of Presburger arithmetic and prove that they have good complexity (all below PSPACE). The optimal
complexities of the model checking problems are then derived by polynomial reductions to the membership problems for these subclasses of Presburger arithmetic.

Chapter 1. Introduction

12

1.4 Organizations
The thesis is organized as follows. We shall first recall necessary preliminaries in
Chapter 2. The contents after Chapter 2 are divided into three parts:
1. Part I contains generic techniques for infinite-state model checking. In particular, we shall review basic results on word/tree automatic transition systems in
Chapter 3. In Chapter 4, we will prove algorithmic metatheorems for recurrent
reachability properties and their extensions over word/tree automatic systems. In
Chapter 5, we will extend the algorithms from Chapter 4 to logic model checking. We will use these metatheorems in the corresponding chapter to derivesome known or previously unknown decidability/complexity results in infinitestate model checking. In Chapter 6, we will study more applications of ouralgorithmic metatheorems.
2. Part II contains specific techniques. In particular, we will deal with model checking problems over reversal-bounded counter systems and their extensions in
Chapter 7. In Chapter 8, we will study model checking problems over onecounter processes. Finally, we will consider model checking problems over networks of one-counter processes in Chapter 9.
3. Part III contains a summary of the results in the thesis and future work.
As a convention, we shall use  to end remarks, and ♣ (resp. 2) to end examples(resp. proofs).

Chapter 2
Preliminaries
In this chapter, we shall fix some notations that will be used in the sequel, and review
basic definitions and results from automata theory, complexity theory, and logic. The
reader is assumed to have basic familiarity with these subjects. This chapter is organized as follows. In Section 2.1, we fix some general mathematical notations that weshall use throughout the thesis. Automata theory is perhaps the most important tool in
the thesis. We shall review necessary preliminaries from automata theory in Section
2.2. In Section 2.3, we review standard definitions and results from computability andcomplexity theory. Most mathematical structures that we will encounter in the sequelcan be formalized as transition systems or logical structures over some vocabularies.
We shall review them in Section 2.4. Finally, Section 2.5 reviews the logics and properties that we will deal with in the sequel.

2.1 General notations
Most mathematical notations and terminologies that we use in this thesis are fairly
standard. For the sake of completeness, we shall mention some of these in this section.
Some notations from set theory

We use standard notations for set operations: union(∪) , intersection (∩), set difference (\), Cartesian product (×), and power set (e.g. 2S
for a given set S). Given n sets S1 , . . ., Sn , their product ∏ni=1 Si is the set {(s1 , . . . , sn) :∀i ∈ [1, n](si ∈ Si )}. If S1 = · · · = Sn , then this set is also written S1n . Denote by ω theleast infinite ordinal.

13

Chapter 2. Preliminaries

14

Sets of numbers and vector spaces

Let N be the set of nonnegative integers. As

usual, we use R, and Z to denote, respectively, the set of real numbers, and the setof integers. We also often use such notations as R≥0 and Z>0 , which in this casemean the set of nonnegative real numbers and the set of positive integers, respectively.
Given two integers i < j, we use interval notations of the form [i, j] to denote theset {i, i + 1, . . ., j} of integers (instead of reals), which is more standard in computerscience. Similarly, we shall use notations like (i, j] to mean the set [i, j] but excluding
extreme points (in this case i). Logarithm notations used in this thesis has base 2.
When we fix some vector space Rk , we use 0 to denote the element (0, . . ., 0) in Rk .
We shall also denote by {ei }ki=1 the standard basis for Rk , where ei denotes the vector
with all-zero entries except for the ith.
Partial orders

Recall that a partial order  on a set S is well-founded if there does

not exist a strictly decreasing infinite sequence s1 ≻ s2 ≻ . . . of elements from S. An

element s of S is said to be -minimal, if all s′ ∈ S with s′  s satisfies s = s′ .

In the sequel, we shall reserve  for the component-wise partial order on Nk , i.e.,(a1 , . . . , ak )  (b1 , . . . , bk ) iff ai ≤ bi for all i ∈ {1, . . . , k}. Dickson’s lemma [Dic13]
states that  is well-founded.
Asymptotic notations

We use the following standard asymptotic notations, espe-

cially when measuring the computational complexity of a problem: big-oh O(), smalloh o(), and big omega Ω().
Arithmetic on 2Z

kFirst, we extend standard arithmetic operations (addition, sub-straction, and multiplication) to tuples in a component-wise manner. These can befurther extended to sets of tuples as follows. Given two sets S1 , S2 ⊆ Zk , we define theoperation ⊙ ∈ {+, −, ·} on them as follows: S1 ⊙ S2 := {v1 ⊙ v2 : v1 ∈ S1 , v2 ∈ S2 }.

For n ∈ N and S2 ⊆ N, we shall also write n ⊙ S2 to mean {n} ⊙ S2 . An arithmetic

progression is any set of numbers of the form a + b · N for some a, b ∈ N. The numbera (resp. b) is said to be the offset (resp. the period) of a + bN.

2.2 Automata theory
In this section, we shall review some basic definitions and results from automata theory.
In particular, we will look at finite-state automata on finite words, finite trees, ω-words,

Chapter 2. Preliminaries

15

and ω-trees. We will also briefly recall pushdown automata and context-free grammars used as generators of languages of finite words. Finally, we will look at Parikh’s
Theorem, which relates the sets of letter-counts of languages recognized by regular
languages and context-free languages (on finite words) and semilinear sets. For a morethorough treatment of the subject, the reader is referred to [Koz97, Sip97, Tho96].

2.2.1 Automata over finite words
Languages over finite words

An alphabet Σ is simply a finite nonempty set of letters. We say that Σ is k-ary if|Σ| = k. A word (or string) over Σ is a finite sequence w = a1 . . . an where ai ∈ Σ foreach 1 ≤ i ≤ n and n ∈ N. If n = 0, then w is the unique empty word ε. For 1 ≤ i ≤ j ≤ n,

we write w[i, j] to refer to the word ai ai+1 . . . a j . The word w[i, j] is a subword of w.

Note also that w[i, i] refers to the ith letter ai in w. For convenience, we shall also use
w[i] for w[i, i]. Given two words u = a1 . . . an and v = b1 . . . bm , the concatenation u.v
of u and v is the new word a1 . . . an+m , where an+i := bi for each 1 ≤ i ≤ m (e.g. theconcatentation of aba with bbb is ababbb). Note that ε is the unique word satisfying
ε.u = u.ε = u for each word u over Σ. For convenience, we shall often write uv insteadof u.v in the sequel. Given a number n ∈ N, we define wn as the concatenation of w
with itself n times (e.g. for w = ab, we have w0 = ε, w1 = w, w2 = abab). A word

w = a1 . . . an has length |w| = n. Note that |ε| = 0. For a given letter a ∈ Σ, we denoteby |w|a the number of occurrences of the letter a in w (e.g. |aaba|a = 3). We denoteby Σ∗ (resp. Σ+ ) the set of all words (resp. nonempty words) over Σ. In the sequel,
when we omit mention of Σ when referring to these notions, we tacitly assume someunderlying alphabet Σ.
A language (over Σ) is any subset L ⊆ Σ∗ . We shall define a number of useful op-

erations on languages. Standard set operations such as union (∪), intersection (∩), andcomplement (\) — also known as boolean operations — can be applied to languages
as usual. For a language L , we use L to denote the complement Σ∗ \ L of L . Given

two languages L and L ′ over Σ, we define their concatentation

L .L ′ := {uv : u ∈ L , v ∈ L ′ }.
As before, we will mostly use the notation LL ′ instead of L .L ′. For each n ∈ N, weChapter 2. Preliminaries

16

define L n and L ≤n to be the languages defined as follows

L n := {u1 . . . un : u1 , . . ., un ∈ L }L ≤n :=

n
[

L i.

i=0

Finally, we define the Kleene star of L to be the language

L ∗ :=

[

L i.

i∈N

Regular languages and regular expressions

We now recall the notion of regular languages, along with regular expressions as theirstandard finite representations. We begin by recalling the syntax of regular expressions
e over an alphabet Σ using the standard Backus-Naur Form:e, e′ ::= ε | a (a ∈ Σ) | e + e′ | e.e′ | e∗ .
The three operators here are union (+), concatenation (.), and Kleene star (∗). The
language L (e) generated by a regular expression e can be defined by induction:• L (ε) := ε.
• L (a) := {a} for each a ∈ Σ.
• L (e + e′ ) := L (e) ∪ L (e′).
• L (e.e′) := L (e).L (e′).
• L (e∗ ) := L (e)∗.
Let us now define some syntactic sugar. We shall allow the expression Σ with theobvious meaning L (Σ) = Σ. When the meaning is clear, we shall also write ee′ insteadof e.e′ for two given regular expressions e and e′ . An example of a regular expression is(ab)∗ +a∗ , which describes the set of all words that are of the form (ab)n or an for somen ∈ N. To minimize the use of brackets ‘(’ and ’)’, we assign an operator precedence inthe following order (highest to lowest): ‘*’, ‘.’, and then ‘+’. Furthermore, observe thatboth of the operators ‘+’ and ‘.’ are associative: L (e + (e′ + e′′ )) = L ((e + e′ ) + e′′ )and L (e.(e′.e′′ )) = L ((e.e′).e′′). Therefore, we will write (ab)∗ + b∗ + a∗ instead of((ab)∗ + b∗ ) + a∗ . Regular languages (over Σ) are those languages that are generated
by some regular expressions (over Σ). We now state a standard result about regular
languages (e.g. see [Koz97] for a proof).

Chapter 2. Preliminaries

17

Proposition 2.2.1 Regular languages are effectively closed under union, intersection,complementation, composition, and Kleene star.
Finite automata

We now recall the notions of finite automata. A nondeterministic word automaton(NWA) over an alphabet Σ is a tuple A = (Σ, Q, δ, Q0, F) where• Q is a finite set of states,• Q0 ⊆ Q is a set of initial states,• F ⊆ Q is a set of final states, and• δ ⊆ Q × Σ × Q is a transition relation.
We shall use States(A ) to denote the set Q of states of A . As usual, we shall also treat
the transition relation δ as a transition function δ f : Q × Σ → 2Q such that q′ ∈ δ f (q, a)iff (q, a, q′) ∈ δ. If |Q0 | = 1 and |δ(q, a)| ≤ 1 for each q ∈ Q and a ∈ Σ, then we saythat A is determinsitic. In this case, A is a DWA (deterministic word automaton). A
path π in A from q ∈ Q to q′ ∈ Q is simply an interleaving sequence p0 a1 p1 . . . am pmof states in Q and letters in Σ such that pi+1 = δ(pi , ai+1 ) for each i ∈ [0, m). It is said
to be a run if p0 ∈ Q0 .

We shall also use L (π) to denote the path labels a1 . . . am ,and say that π is a path on (input) a1 . . . am . For convenience, we shall sometimes
omit the path labels from π, and simply refer to it as a path π = p0 . . . pm on the word

a1 . . . am . In addition, the path π has length |π| = m, and we let first(π) := p0 (resp.

last(π) := pm ) denote the initial (resp. end) state in the path π. For 1 ≤ i ≤ j ≤ m, weshall use the notation π[i, j] (resp. π(i)) to denote the path pi ai+1 pi+1 . . . a j p j (resp.
node pi ). Given two paths π = p0 a1 . . . pm and π′ = pm am+1 . . . pn (with m ≤ n), we letπ ⊙ π′ denote the concatenated path p0 a1 . . . pm am+1 . . . pn . A path that ends in some
final state q ∈ F is said to be accepting. The NWA A is said to accept the word w ∈ Σ∗from q if there exists an accepting path of A on w from q. When we say A accepts theword w without mention of the state q, we tacitly assume that q is the initial state of

A . The language L (A ) accepted by A is simply the set of words over Σ accepted by
Σ. As usual, for clarity we may define a finite automaton by drawing an edge-labeled
directed graph whose nodes (resp. arcs) define the states (resp. transitions) of theautomaton. In the sequel, we use filled circles to denote final states, while the initialstate is defined by drawing a source-less incoming arc to a node. For example, thelanguage L ((ab)∗ + a∗ ) is accepted by the automaton in Figure 2.1.

Chapter 2. Preliminaries

18

b
a

a

a
a

Figure 2.1: An NWA recognizing the language L ((ab)∗ + a∗ ).

Remark 2.2.1 Recall that our definition of NWAs allow more than one initial states.
This is done only for convenience since we may easily construct an equivalent NWA
with only one initial state by adding one extra state. In the sequel, we shall often assume that an NWA has only one state q0 and write (Σ, Q, δ, q0, F) instead of(Σ, Q, δ, {q0}, F). 
Complexity measure

For the purpose of complexity analysis, we shall define complexity measures for automata and regular expressions.
We start with regular expressions. The size kek of a regular expression can be

defined inductively as follows:

1. for each a ∈ Σ, kak := 1,
2. ke + e′ k := kek + ke′ k + 1,
3. ke.e′ k := kek + ke′ k + 1, and4. ke∗ k := kek + 1.
In other words, kek is the number of nodes in the parse tree of e. Observe that the
number of bits needed to write an expression e is at most O(kek × log |Σ|).

We now define computational complexity measures for NWAs. Given an NWA

A = (Σ, Q, δ, Q0, F), the easiest, but less precise, measure can be obtained by measuring the number |Q| of states and the size |Σ| of the alphabet separately. Such ameasure is reasonable since all other parameters of A are polynomial in |Q| and |Σ|,e.g., |δ| ≤ |Q|2 × |Σ|. On the other hand, when a more accurate analysis is desired, weshall instead use the following measure. Let kA k be the number of pairs (q, q′) suchthat (q, a, q′) ∈ δ for some a ∈ Σ. In other words, kA k denotes the number of different

Chapter 2. Preliminaries

19

unlabeled transitions in δ. Then, assuming that each state in Q occurs in δ at least
once (by easily removing isolated states in linear time), each parameter in A can be
expressed linearly in kA k and |Σ|. For example, the number |Q| of states is at mostkA k, and the number of transitions in |δ| is at most kA k × |Σ|. Moreoever, the numberof bits needed to write down the automaton is at most O(kA k log kA k × |Σ| log |Σ|). In

the sequel, we call kA k the (unlabeled transition) size of the NWA A . When we intend

to measure the number of states as the complexity measure, we shall be explicit about
this.
Some basic results

We now state several basic results from automata theory over finite words. We firststart with a standard result concerning the equivalence of regular expressions and finite
automata (e.g. see [Koz97] for a proof).
Proposition 2.2.2 Given a language L over Σ, the following statements are effectively
equivalent:(1) L is generated by a regular expression.
(2) L is accepted by an NWA.
(3) L is accepted by a DWA.
Furthermore, there is a linear-time translation from (1) to (2).
All the translations in the proposition above run in time at most exponential in the sizeof the input (e.g. see [Koz97]). It turns out that every translation from (2) to (3) could
be exponential in the worst case even over unary alphabet [Chr86]. In particular, there
exists a class {An }n∈Z>0 of NWAs An with n states over the alphabet {a} whose small√

est equivalent DWA require at least 2Ω( n log n) states. When the alphabet contains atleast two letters, the lower bound can be improved to 2n (e.g. see [Var95]). In addi√tion, the lower bound of 2Ω( n log n) holds also for translations from (1) to (3) even overunary alphabet since NWAs and regular expressions are polynomially equivalent overunary alphabet [Chr86, Mar02, To09b]. Furthermore, there also exists an exponential
lower bound for translations from (3) to (1) even over alphabet of size four [GN08].
In the sequel, we will meet several complex constructions over NWAs, many ofwhich can be understood in terms of simpler constructions over NWAs such as boolean
operations. Therefore, we next state basic results on computing NWAs recognizing

Chapter 2. Preliminaries

20

boolean combinations of languages of the given NWAs (see [Koz97, Var95] for moredetails).
Proposition 2.2.3 Given NWAs A and B over the alphabet Σ:(1) we can compute in time O(|Σ| × (kA k + kB k)) an NWA of size kA k + kB k recognizing the language L (A ) ∪ L (B ),(2) we can compute in time O(|Σ| × (kA k × kB k)) an NWA of size kA k × kB k recognizing the language L (A ) ∩ L (B ), and(3) if n = |States(A )|, we can compute in exponential time a DWA with 2n statesrecognizing the language L (A ).

Proof. We shall describe only the first and the second constructions. The third isdone by the standard subset construction (e.g. see [Koz97, Var95]), which we willA
not encounter in this thesis. Therefore, suppose that A = (Σ, QA , δA , QA
0 , F ) and/B = (Σ, QB , δB , QB0 , F B ). Without loss of generality, we assume that QA ∩ QB = 0.
Let us start with the construction for (1). Define the NWA T = (Σ, Q, δ, Q0, F) as
follows:• Q := QA ∪ QB .
B
• Q0 := QA
0 ∪ Q0 .

• δ := δA ∪ δB .
• F := F A ∪ F B .
It is easy to see that L (T ) = L (A ) ∪ L (B ) and that kT k = kA k + kB k. The construction can also be easily implemented in time O(|Σ| × (kA k + kB k)).

We now describe the construction for (2), which is also known as product construc-tion. Define the NWA T = (Σ, Q, δ, Q0, F) as follows:• Q := QA × QB .
B
• Q0 := QA
0 × Q0 .

• δ((q, q′), a) := δA (q, a) × δB (q′ , b) for all q ∈ QA , q′ ∈ QB , and a ∈ Σ.
• F := F A × F B .

Chapter 2. Preliminaries

21

Intuitively, the automaton T simulates both A and B on the given input word simultaneously. It is not hard to see that L (T ) = L (A ) ∩ L (B ) and kA k = kA k × kB k.

Furthermore, this construction can be easily implemented in time O(|Σ| ×kA k ×kB k).

2
We now state the following basic result on checking language emptiness and membership for NWAs. The proof of the following proposition can be done by using asimple reachability algorithm (e.g. see [Var95]).
Proposition 2.2.4 Checking whether the language recognized by a given NWA A isempty can be done in time O(kA k × |Σ|). Consequently, checking whether a wordw ∈ Σ∗ is a member of L (A ) is solvable in time O(|w| × kA k × |Σ|).
Star-free regular languages

Star-free regular languages form an important subclass of the class of regular languages. They are precisely the languages over the alphabet Σ generated star-free regular expressions over Σ, which are defined by the following grammars:e, e′ ::= ε | a (a ∈ Σ) | e + e′ | e.e′ | ē.
The semantics for e + e′ and e.e′ are the same as the regular expressions. We define

L (ē) = Σ∗ \ L (e). Therefore, star-free regular expressions do not allow Kleene star

operator, but instead allow complementation. Although standard regular expressions
do not have built-in complementation operator, it is easy to see that they are definable
using regular expressions (e.g. using Proposition 2.2.2). On the other hand, it is wellknown that star-free regular languages actually form a proper subclass of the class ofregular languages [MP71]. Other proofs of this result can also be found in [Lib04,
Tho96]. We shall see later that there is a tight connection between star-free regular
languages and the class of languages definable in first-order logic over finite words.
We now touch the computational complexity aspect of star-free regular expres-sions. The most important such result for the present thesis is that checking whether
two star-free regular expressions over an alphabet consisting at least two letters generate the same language is decidable but is nonelementary, i.e., cannot be decided in
k-fold exponential time for some integer k > 0.
Proposition 2.2.5 ([Sto74]) The language equivalence problem for star-free regularexpressions over an alphabet Σ with |Σ| ≥ 2 is decidable but is nonelementary.

Chapter 2. Preliminaries

22

This proposition has been commonly used in the literature for deriving fundamental
complexity lower bounds for translations between automata and logic (cf. [Sto74,
Tho96]).

2.2.2 Automata over ω-words
Languages over ω-words

Fix a finite alphabet Σ. An ω-word over Σ is a mapping w from Z>0 to Σ. As for finite
words, we will often think of w as the infinite sequence w(1)w(2) . . .. Let Σω denotethe set of all ω-words over Σ. We use the notation w[i, j] and for nonnegative integers
i ≤ j to denote the finite word w(i) . . .w( j). Similarly, w[i, ∞) denotes the ω-word

w(i)w(i + 1) . . .. Given a finite word w = a1 . . . an ∈ Σ∗ and an ω-word w′ ∈ Σω , wedefine their concatenation as the ω-word w.w′ (also written as ww′ ) as follows(
ai
if 1 ≤ i ≤ n(w.w′ )(i) :=w′ (i − n)if i > n.

An ω-word language over the alphabet Σ is simply a subset of Σω . As for finite
words, we could apply the standard set operations (union, intersection, and complement) to ω-word languages. Given a finite word language L ⊆ Σ∗ and an ω-wordlanguage L ′ ⊆ Σω , we could define their concatenation as the ω-word language

L .L ′ := {uv : u ∈ L , v ∈ L ′ }.
We shall mostly write LL ′ instead of L .L ′ when the meaning is clear.
ω-regular languages
As in the case of finite words, we can define the notion of ω-regular languages as thoseω-word languages that can be finitely represented by finite automata in some way. Let
us now make this notion more precise. Given an NWA A = (Σ, Q, δ, Q0, F) and an ωword w ∈ Σω , a run of A on w is a function π : N → Q such that π(0) ∈ Q0 and, for eachi ∈ N, we have (π(i), w(i + 1), π(i + 1)) ∈ δ. We say that π is said to be accepting if

there exists infinitely many indices i ∈ N such that π(i) ∈ F. In other words, F is visited

infinitely often in π. Such an acceptance condition is commonly referred to as Büchi
acceptance condition. The ω-word w is accepted by A if there exists an accepting
run of A on w. The language L (A ) accepted by A is simply the set of all ω-words

w ∈ Σω that are accepted by A . When using NWAs as acceptors of ω-word languages,

Chapter 2. Preliminaries

23

a,b

a
a

Figure 2.2: An NBWA recognizing the language {a, b}∗{a}ω .

we refer to such NWAs as nondeterministic Büchi word-automata (NBWA). When the
NWA is deterministic, we say that it is deterministic Büchi word-automaton (DBWA).
A language L ⊆ Σω is said to be ω-regular (or simply regular, when the context is

clear) if it is accepted by some NBWA over Σ. For example, the language {a, b}∗{a}ω
is accepted by the NBWA depicted in Figure 2.2.

As in the case of finite words, ω-regular languages also satisfy desirable closure
properties including union, intersection, and complementation. On the other hand, DBWAs are not as powerful as NBWAs, unlike in the case of finite words. For example,
the language {a, b}∗{a}ω accepted by the NBWA in Figure 2.2 cannot be accepted by

a DBWA (for a proof, see [Var95]). Although there are deterministic automata models
on ω-words that capture ω-regular languages, we will not encounter them in the sequel.
We now state a basic result on emptiness checking for languages recognized by
NBWAs. The proof of the following proposition can be found in [Var95].
Proposition 2.2.6 Checking whether a given NBWA A recognizes an empty language
can be done in linear time.
Loosely speaking, the proof of the aforementioned proposition goes as follows. We
first run Kosaraju’s linear-time algorithm (see [AHU83]) to find the strongly connectedcomponents of the NBWA A (viewed as a directed graph). Checking emptiness, then,amounts to finding a path from some strongly connected component that contains an
initial state to a strongly connected component that contains some final state qF and at
least one edge (so that there is a non-empty cycle that visits the final state qF ).

2.2.3 Automata over trees
A direction alphabet ϒ is a nonempty downward-closed subset of the set Z≥1 of posi-tive integers, i.e., if i ∈ ϒ and 1 ≤ j < i, then j ∈ ϒ. Given a direction alphabet ϒ, a tree
domain over ϒ is a non-empty set D ⊆ ϒ∗ that satisfies the following two properties:• D is prefix-closed, i.e., for each w ∈ ϒ∗ and i ∈ ϒ, wi ∈ D implies w ∈ D, andChapter 2. Preliminaries

24

ε

f
a

g

a

b

a

1

2

21

22

23

Figure 2.3: An example of a 3-ary tree over { f , g, a, b} (left) depicted together with its
tree domain (right) whose elements are ordered by the prefix-of relations.

• for all wi ∈ D and 1 ≤ j < i, it is the case that w j ∈ D.
For a nonempty set Σ called a labeling alphabet, a tree over Σ with direction alphabetϒ is a pair T = (D, τ) where D is a tree domain over ϒ and τ is a function mapping D
to Σ. A k-ary tree over Σ is a tree over Σ with direction alphabet ϒ = {1, . . ., k}. Unlessotherwise stated, we shall say “trees” to mean k-ary trees, for some positive integer k,over a finite labeling alphabet with a finite tree domain. Figure 2.3 gives an example ofa tree depicted together with its tree domain. When the meaning is clear, we shall omit
mention of ϒ and simply say that T is a tree over Σ (or just “tree” when Σ is clear).
We shall now define some standard graph-theoretic terminologies for dealing withtrees. Fix a k-ary tree T = (D, τ) over the labeling alphabet Σ. The elements of D arealso called nodes. Therefore, we shall call τ a node labeling and that each node u ∈ D

is labeled by τ(u). The level of a node u ∈ D, denoted by level(u), is simply the length|u| of the word u. The height of the tree T is defined as 1 + max{level(u) : u ∈ D}. We
shall refer to the root of T as the the node ε ∈ D. Words u ∈ D such that no ui is in D

are called leaves. If v ∈ D and vi ∈ D for some i ∈ ϒ, then we call vi a child of v and v

the parent of vi. Likewise, if vi ∈ D and v j ∈ D for some i, j ∈ ϒ, then we say that vi

and v j are siblings. In addition, if v, vw ∈ D for some w ∈ ϒ∗ , then vw is a descendantof v and v an ancestor of vw. A path (or branch) starting at a node v ∈ D is simply
a sequence π = v0 , . . ., vn of nodes such that v0 = v and vi is a child of vi−1 for eachi = 1, . . . , n. The tree T is said to be complete if, whenever u ∈ D and ui ∈ D for somei ∈ ϒ, it is the case that u j ∈ D for all j ∈ ϒ.

The notion of “prefix” for words has a natural analogue for trees. We shall define

this next. For k-ary trees T = (D, τ) and T ′ = (D′ , τ′ ) over the labeling alphabet Σ,
we say that T extends T ′ , written T ′  T , iff D′ ⊆ D and, for each u ∈ D′ , we haveτ(u) = τ′ (u). Observe that the relation  reduces to the prefix-of relations in the word

case. In the sequel, we call the relation  on T REE k (Σ) to be the tree extension relation.
We now define the notion of “subtrees”, which is the tree analogue of the standard

notion of “suffix” of a word. Given k-ary trees T1 = (D1 , τ1 ) and T2 = (D2 , τ2 ) over theChapter 2. Preliminaries

25

u

T1

u

T1 [T2 /u]

Figure 2.4: A depiction of the subtree substitution operation. Here the subtree rooted
at u on the left is replaced by the tree T2 , which is the subtree rooted at u on the right.

labeling alphabet Σ, we say that T2 is a subtree of T1 rooted at u ∈ D1 if D2 coincides
with {v : uv ∈ D} and that τ2 (v) = τ1 (uv) for each v ∈ D2 . This also motivates thesubstitution operation on subtrees. Given k-ary trees T1 = (D1 , τ1 ) and T2 = (D2 , τ2)over the labeling alphabet Σ and a node u ∈ D1 , we write T1 [T2 /u] for the tree obtainedby replacing the subtree of T1 rooted at u by T2 . More precisely, the tree T1 [T2 /u] isdefined to be the tree T = (D, τ) whereD := (D1 \ {uv ∈ D1 : v ∈ {0, . . . , 1}∗}) ∪ uD2 ,(τ1 (w)
if w ∈ (D1 \ {uv ∈ D1 : v ∈ {0, . . ., 1}∗ }),τ(w) :=
τ2 (v)
if w = uv ∈ uD2 .

See Figure 2.4 for an illustration. The subtree substitution operation can also be easily
generalized to take into account multiple substitutions. Given k-ary trees T0 , . . . , Tn
and nodes u1 , . . . , un in T0 that are incomparable with respect to the prefix-of relations
over words {1, . . ., k}∗ (i.e. no ui is an ancestor of u j for all distinct indices i, j),
we define T0 [T1 /u1 , . . . , Tn /un ] to be the tree (. . .(T0 [T1 /u1 ]) . . .)[Tn/un ] obtained byapplying the subtree substitution operations for multiple times (the order of which isof no importance).
The set of all k-ary trees over Σ is denoted by T REE k (Σ). A tree language over
T REE k (Σ) is simply a subset of T REE k (Σ). Observe that word languages can bethought of as a subset of T REE 1 (Σ).
Regular tree languages

To define the notion of regular tree languages, we shall review a standard definitionof tree automata. A (top-down nondeterministic) tree automaton over T REE k (Σ) is atuple A = (Σ, Q, δ, Q0, F) whereChapter 2. Preliminaries

26

f

g

a

$

$

$

a

$

$

$

b

$

$

$

a

$

$

$

$

Figure 2.5: The tree depicted here is virt(T ), where T is the tree from Figure 2.3.

• Q is a finite set of states,• Q0 ⊆ Q is a set of initial states,• F ⊆ Q is a set of final states, and• δ is a transition relation, i.e., a subset of Q × Σ × Qk .
Note that the parameter k is implicit from the representation of A , i.e., it can be deduced
by inspecting the transition relation δ. In the sequel, we denote by States(A ) the setof states of A . For our constructions, it will be most conveninent to define runs ontrees by attaching “virtual” leaves. Given a k-ary tree T = (D, τ), we define virt(T )to be the k-ary tree (D′ , τ′ ) over the alphabet Σ′ := Σ ∪ {$}, where $ ∈/ Σ, such thatD′ = D ∪ {vi : v ∈ D, 1 ≤ i ≤ k} and(τ′ (u) =τ(u)$if u ∈ D,otherwise.

See Figure 2.5 for an example. Notice that virt(T ) is a complete tree. A run of A
on T then is a mapping ρ : D′ → Q such that ρ(ε) ∈ Q0 and, for each node u ∈ D′with children u1, . . ., uk ∈ D′ , we have (ρ(u1), . . ., ρ(uk)) ∈ δ(ρ(u), τ(u)). A run issaid to be accepting if ρ(u) ∈ F for each leaf u ∈ D′ . A tree T ∈ T REE k (Σ) is said

to be accepted by A if there exists an accepting run of A on T . The language L (A )recognized by A is the set of k-ary trees over Σ accepted by A . Such a language is said
to be tree-regular. In the sequel, we shall abbreviate nondeterministic tree automata as
NTA.
For the purpose of complexity analysis, we shall now define the size kA k of an NTA

A = (Σ, Q, δ, q0, F) over k-ary trees. Let kA k be the number of tuples (q, q1, . . . , qk ) ∈Chapter 2. Preliminaries

27

Qk+1 such that (q, a, q1, . . ., qk ) ∈ δ for some a ∈ Σ. As for automata over finite words,
without loss of generality, we may assume that each state in Q occurs in δ at least once.
In this case, the number of bits needed to represent A is at mostO(kA k × |Σ| × k log(|Q|) × log(|Σ|)),which is polynomial in both kA k and |Σ|. This justifies our definition of kA k.
Remark 2.2.2 Several important remarks are in order. Firstly, there is also a notionof bottom-up nondeterministic tree automata, which recognize precisely regular tree
languages (cf. [CDG+ 07]). Furthermore, the translations between these two representations can be performed in linear time. Secondly, it is useful to keep in mind that,
although we may define the deterministic tree automata with respect to these two flavors of tree automata, only the bottom-up notion gives the full power of regular tree
languages. Since we will not need it in the sequel, we shall avoid further mentionof deterministic tree automata. Finally, we cannot simply assume that we only deal
with NTAs with only one final state (unlike in the case of word automata). More precisely, the conversion from general NTAs to those with only one final state might cause
an exponential blow-up in the size of the direction alphabet. Incidentally, if we have
“ε-transitions” in our NTAs (which are abundant, among others, in the literature ofground tree rewrite systems and ground tree transducers [CDG+ 07, Löd03, Löd06]),
the polynomial-time procedure of removing these ε-transitions naturally yield NTAs
with multiple final states (see below). In contrast, it is possible to assume that an NTA
has only one initial state. This is because we can introduce a new initial state q0 and
add linearly many extra transitions in the standard way. In the sequel, we shall often assume that NTAs have only one initial state and write (Σ, Q, δ, q0, F) instead of(Σ, Q, δ, {q0}, F). 
Some basic results

Regular tree languages satisfies the same closure properties that are satisfied by regular word languages, e.g., union, intersection, and complementation. The following
proposition can be proved in the same way as Proposition 2.2.3 (see [CDG+ 07] for a
proof).
Proposition 2.2.7 Given NTAs A and B over T REE k (Σ):• we can compute in time O(|Σ| × (kA k + kB k)) an NTA of size kA k + kB k recognizing the language L (A ) ∪ L (B ),Chapter 2. Preliminaries

28• we can compute in time O(|Σ| × kA k × kB k) an NTA of size kA k × kB k recognizing the language L (A ) ∩ L (B ), and• if |States(A )| = n, we can compute in exponential time an NTA with 2n statesrecognizing the language L (A ).

Checking language emptiness (and hence membership) for tree automata is also easy,
as in the case of word languages. The proof of the following proposition can be foundin [CDG+ 07].
Proposition 2.2.8 Checking whether an NTA A = (Σ, Q, δ, Q0, F) over k-ary trees(where k is not fixed) recognizes a non-empty language can be done in time O(kA k ×|Σ|). Consequently, checking whether a tree T = (D, τ) ∈ T REE k (Σ) is a member of

L (A ) is solvable in time O(|D| × kA k × |Σ|).

Nondeterministic tree automata with ε-transitions

We shall now introduce an extension of NTAs with ε-transitions. This is only done
for the purpose of convenience when describing the NTAs. Roughly speaking, εtransitions are transitions of the form (q, q′ ) for a pair of states of the automaton. Intuitively, if we imagine a top-down tree automaton that that runs on a tree T , then at any
given node u of T when the the automaton is at state q it can use the transition (q, q′)
to instantaneously switch to the state q′ at the same node u. More precisely, an ε-NTA

A over T REE k (Σ) is a tuple (Σ, Q, δ, Q0, F), where Σ, Q, Q0 , and F are the same as for
NTAs and• δ is a transition relation containing transitions of the form (q, a, q1, . . ., qk ) ∈Q × Σ × Qk , or of the form (q, q′ ) ∈ Q × Q.

Before defining the language L (A ) accepted by the ε-NTA A above, we let ⇒ denotethe transitive closure of {(q, q′) ∈ Q × Q : (q, q′) ∈ δ}. Define a new NTA (without
ε-transitions) A ′ := (Σ, Q, δ′ , Q0 , F ′ ) as follows:• δ′ = {(q, a, q1, . . . , qk ) : ∃q′ ∈ Q such that (q′ , a, q1, . . . , qk ) ∈ δ and q ⇒ q′ }, and• F ′ := {q : ∃q′ ∈ F such that q ⇒ q′ }.
A tree T is said to be accepted by A if it is accepted by A ′ . The language L (A ) of A isdefined to be the language L (A ′) of A ′ . The following proposition is now immediate.

Chapter 2. Preliminaries

29

Proposition 2.2.9 Given an ε-NTA A over T REE k (Σ) with n states, we may construct
an NTA A ′ over T REE k (Σ) of size n × kA k such that L (A ) = L (A ′ ) in time O(|Σ| ×n × kA k).

Notice that the parameter k, which is not fixed for the problem, does not get into the
exponent for the size and the computation time of the NTA A ′ . In the sequel, we shalluse ε-NTA solely for a descriptional purpose.

2.2.4 Automata over infinite trees
An infinite k-ary tree over the labeling alphabet Σ is a tuple T = (D, τ), where D ={1, . . ., k}∗ and τ is a mapping from D to Σ. Let T REE ωk (Σ) denote the class of all
infinite k-ary trees over Σ.

Büchi-recognizable infinite-tree languages

In the sequel, we do not need the full power of regular infinite tree languages, which
are usually defined by automata over infinite trees with powerful acceptance conditions
such as Rabin, parity, and Muller [Tho96]. We shall only need automata over infinite
trees with Büchi accepting condition, which is well-known to be strictly less powerfulthan regular infinite-tree languages (e.g. see [Tho96]) unlike in the case of ω-wordautomata.
A (nondeterministic) Büchi k-ary tree automaton, abbreviated as NBTA, over Σ isa k-ary tree automaton A = (Σ, Q, δ, q0, F) that we defined for finite trees, except with
infinite trees as input. Given an infinite-tree T = ({1, . . ., k}∗ , τ), a run of A on T is amapping ρ : {1, . . ., k}∗ → Q such that ρ(ε) = q0 and, for each node v ∈ {1, . . . , k}∗ , wehave (ρ(v1), . . ., ρ(vk)) ∈ δ(ρ(v), τ(v)). The run ρ is said to be accepting if, for each in-finite path π = {vi }∞i=0 in the run ρ (viewed as an infinite k-ary tree) starting at the root

ε, there exists infinitely many indices i such that ρ(vi ) ∈ F. In other words, for each

infinite path in ρ starting at the root, the Büchi acceptance condition for ω-words is satisfied. The language L (A ) recognized by A is the set of all k-ary infinite-trees over Σthat are accepted by A . Such an infinite-tree language is said to be Büchi-recognizable.
The proof of the following proposition can be found in [VW86b], although it was firstproved in [Rab70] for binary trees.
Proposition 2.2.10 Checking whether a given Büchi tree automaton recognizes a nonempty language can be done in quadratic time.

Chapter 2. Preliminaries

30

2.2.5 Pushdown automata and context-free grammars
We now turn back to languages over finite words. A context-free grammar (CFG) G
over the alphabet Σ is a 4-tuple (Σ,V, δ, S0) where• V is a set of non-terminals,• S0 ∈ V is an initial non-terminal,• δ is the set of rewrite rules, which is a finite subset of V × (V × Σ)∗When discussing context-free grammmars, the elements of Σ are also often called terminals. Given two sequences α, β ∈ (V × Σ)∗ of non-terminals and terminals, we

say that β can be immediately derived from α, written α ⇒ β, if there exist words
u, v ∈ (V × Σ)∗ and a rewrite rule (X , w) ∈ δ such that α = uX v and β = uwv. Let⇒∗ denote the transitive-reflexive closure of this immediate derivation relation ⇒⊆(V × Σ)∗ × (V × Σ)∗ . We say that α can be derived from β if α ⇒∗ β. A sequencev ∈ Σ∗ of terminals is said to be derivable by G if S0 ⇒∗ v. The language L (G ) gen-erated by G is simply the set of words v ∈ Σ∗ that are derivable by G . A languageL ⊆ Σ∗ is said to be context-free if some CFG G generates L . It is well-known that

context-free languages strictly subsume regular languages.

We now define pushdown automata, which are another model with the same expressive power as context-free grammars. Fix an (input) alphabet Σ and let Σε := Σ ∪ {ε}.

A pushdown automaton (PDA) P over the input alphabet Σ is a tuple (Σ, Γ, Q, δ, q0, F)
where:• Γ is a finite stack alphabet containing the special stack-bottom symbol $ ∈ Γ,
• Q is a finite set of states,• q0 is an initial state,• F ⊆ Q is a set of final states, and• δ is a transition relation, which is a finite subset of (Q×Σε ×Γ∪{ε})×(Q×Γ∗ ).
The PDA P is said to be ε-free if δ is a subset of (Q × Σ × Γ) × (Q × Γ∗ ). A stackcontent (with respect to P ) is a word w ∈ Σ∗ . The topmost symbol of the stack is on
the right1 .

A configuration of P is a pair (q, w) of state q ∈ Q and a stack content

1 In the literature, stack contents are often written in the reversed way, i.e., topmost symbol on theleft. As we shall see later, this convention is more suitable for our purposes.

Chapter 2. Preliminaries

31

w. Given two configurations (q, w) and (q′ , w′ ) of P and the symbol a ∈ Σε , we write(q, w) →a (q′ , w′ ) if there exists a word v ∈ Γ∗ such that, for some words u ∈ Γ ∪ {ε}and u′ ∈ Γ∗ we have w = vu and w′ = vu′ and that ((q, a, u), (q′, u′ )) is a transition in

P . Given an input word v ∈ Σ∗ , we write (q, w) →v (q′ , w′ ) if there exists a sequence

a1 , . . . , an ∈ Σε of input letters (possibly interleaved with empty words) such that v =a1 . . . an and there exists a sequence of configurations (q0 , w0 ), . . ., (qn , wn ) of P suchthat (q0 , w0 ) = (q, w), (qn , wn ) = (q′ , w′ ), and(q0 , w0 ) →a1 . . . →an (qn , wn ).
We say that P accepts the word v ∈ Σ∗ if, for some final state qF ∈ F, we have
(q0 , $) →v (qF , $). The language L (P ) of P is the set of words v ∈ Σ∗ that are acceptedby P . We say also that P accepts L (P ). The following proposition is well-known (e.g.
see [Sip97] for a proof).
Proposition 2.2.11 There exists a polynomial-time algorithm, which given a CFG G
over Σ, computes a PDA P over Σ such that L (G ) = L (P ). Conversely, there exists a
polynomial-time algorithm, which given a PDA P over Σ, computes a CFG G over Σ

such that L (G ) = L (P ).

2.2.6 Parikh’s Theorem and semilinear sets
We shall now recall Parikh’s Theorem [Par66] — one of the most celebrated theorem in
automata theory — and its connection to semilinear sets. Roughly speaking, Parikh’s
Theorem states that the sets of letter-counts (a.k.a. Parikh images) of regular languages
and context-free languages precisely coincide with semilinear sets. Let us now makethese more precise.
Let us tacitly assume that our finite input alphabet Σ = {a1 , . . ., ak } has some to-tal ordering ≺, say a1 ≺ . . . ≺ ak . Given a word w ∈ Σ, we let P (w) be the tuple(|w|a1 , . . . , |w|ak ) ∈ Nk . In other words, P (w) is obtained by “forgetting” the orderingof the word w, i.e., only count multiplicities of each letter in the alphabet Σ. The Parikh
image P (L ) of the language L ⊆ Σ∗ is simply the set {P (w) : w ∈ L } ⊆ Nk . This definition allows us to now talk about the Parikh images of (the languages of) CFGs andNWAs.
Let us now recall the definition of semilinear sets. For every vector v ∈ Zk andevery finite set S = {u1 , . . . , um } of vectors in Zk , we write P(v; S) to denote the Z-

linear set {v + Σm
i=1 ai ui : a1 , . . . , am ∈ N}. The pair B := hv; Si is said to be a linear

Chapter 2. Preliminaries

32

basis for P(v; S). Notice that there exist non-unique linear bases for a Z-linear set.
The vector v is said to be the offset of B, and the vectors S the periods (or generators)of B. A Z-semilinear set S is simply a finite (possibly empty) union of Z-linear sets
P(v1 ; S1 ), . . ., P(vs ; Ss ). In this case, we say that B = {hvi ; Si i}si=1 is a semilinear basis
for P(B ) := S. Likewise, semilinear bases for S are not unique. A Z-semilinear set

S ⊆ Zk is said to be N-semilinear (or simply semilinear) if it has a semilinear basiswith vectors from Nk only. The notion of N-linear (or simply linear) sets is also
defined similarly. In the sequel, we shall not distinguish (semi)linear sets and theirbases, when it is clear from the context. Thus, we shall use such a phrase as “computea (semi)linear set” to mean that we compute a particular (semi)linear basis for it.
Remark 2.2.3 Since Z-(semi)linear bases B are simply a sequence of vectors from Zk ,we could talk about their size kB k when represented on the tapes of Turing machines.
In particular, we shall use both unary and binary representations of numbers, and be
explicit about this when necessary. The connection between Parikh images of CFGs and NWAs and semilinear sets isgiven by Parikh’s Theorem, which we shall state next.
Theorem 2.2.12 (Parikh [Par66]) Given a subset S ⊆ Nk , the following statements
are equivalent:(1) S is a semilinear set.
(2) S = P (L(A )) for some NWA A over Σ = {a1 , . . . , ak }.
(3) S = P (L(G)) for some CFG G over Σ = {a1 , . . . , ak }.
Furthermore, the translations among these finite representations of the set S are effective.
The translations from (1) to (2) is rather obvious, which can be done in polynomial
time (provided that we represent numbers in unary). There exists a simple polynomialtime algorithm which, given an NWA, computes an equivalent CFG (e.g. see [Sip97])
yielding a translation from (2) to (3). The non-trivial part is the translation from (3)to (1), which was given by Parikh [Par66]. We shall mention also that there are otherconstructions from (3) to (1) with different flavors and techniques (cf. [Esp97b, Koz97,
SSMH04, VSS05]). All these constructions run in exponential time (in fact, they produce exponentially many linear sets in the worst case). We shall see in Chapter 7

Chapter 2. Preliminaries

33

that this cannot be improved even for CFGs over the fixed alphabet Σ = {a}. On theother hand, we shall give a direct translation from (2) to (1) in Chapter 7 that has apolynomial-time worst case complexity when the size of the alphabet is fixed.

2.3 Computability and complexity theory
In this section, we shall recall briefly some standard concepts from computability andcomplexity theory (e.g. see [Koz97, Koz06, Pap94, Sip97] for more details).

2.3.1 Computability
For the sake of completeness, we shall briefly recall the definition of Turing machines.
A nondeterministic Turing machine is a tuple M = (Σ, Γ, Q, δ, q0, qF , 2), where thefollowing are satisfied:• Σ is an input alphabet.
• Γ is a stack alphabet satisfying Σ ∪ {2} ⊆ Γ. Here 2 is a reserved blank symbol.
• Q is a set of states.
• q0 ∈ Q is an initial state.
• qF ∈ Q is an accept state.
• δ : (Q × Γ) × (Q × Γ × {L, R}) a transition function.
The machine M is said to be deterministic if δ is a function from Q × Γ to Q × Γ ×{L, R}. In the sequel, a Turing machine is deterministic, unless stated otherwise. The

configuration of M is simply a word in the language Γ∗ (Q × Γ)Γ∗ . The one-stepreachability relation → between configurations of M can be defined in the standard
way: ((q, a), (q′, b, d)) ∈ δ is executed iff, whenever the machine is in state q andthe tape cell currently pointed to by the machine holds the value a, then the machine

rewrites the value a by b, switches to state q′ , and moves the pointer to the left if
d = L and to the right if d = R. Without loss of generality, we assume that there is notransition from qF . The machine is said to be halting on a word w if every run of M
starting from the configuration (q, 2)w eventually reaches the state qF or a dead end.
The machine is said to be halting if it is halting on every input word. For the case when
there exists a run of M that reaches qF on an input word w, we say that M accepts theChapter 2. Preliminaries

34

word w. Otherwise, it rejects w. The language L (M ) accepted by M consists of allwords w ∈ Σ∗ which are accepted by M .

A language L is said to be recursively enumerable (r.e.) if it is accepted by a Turingmachine. It is said to be co-recursive-enumerable (resp. co-r.e.) if its complement is
accepted by a Turing machine. It is said to be recursive (or decidable) if it is acceptedby a halting Turing machine M . In this case, we also say that L is decided by M .
Let Σ01 (resp. Π01 ) denote the class of r.e. (co-r.e.) languages. Let ∆01 denote the classof decidable languages. For any C of these sets, a language L is said to be C -hard
if for each language L ′ ∈ C there exists a halting Turing machine M which given an

input word w outputs another word M (w) such that w ∈ L iff M (w) ∈ L . Such aTuring machine is also said to be a (many-one) reduction. The language L is said to
be C -complete if it is in C and is C -hard.
It is well-known that Σ01 ∩ Π01 = ∆01 , but Σ01 6= Π01 . These sets can be generalized

in a natural way to form an arithmetic hierarchy (cf. [Koz06]). There are languages
that are beyond this hierarchy. In the sequel, we shall briefly see languages that areΣ11 -complete. In recursion theory, Σ11 can be understood as the class of all relations
R ⊆ Nn that can be defined by a formula of the form
∃ f ϕ(x1 , . . . , xn , f ),where f ranges over number-theoretic functions (i.e. domains and co-domains are N)
and ϕ is a first-order formula in number theory (i.e. quantification over numbers).
Σ11 -complete languages are also often said to be highly undecidable.
Remark 2.3.1 As often done in computability theory, the term “languages” will henceforth be synonymously identified with “problems”.

2.3.2 Complexity theory
In computational complexity, we restrict ourselves to decidable languages and try toclassify difficulty of these languages by restricting resources such as time, space, andnondeterminism. Given a halting Turing machine M and an input word w, we canmeasure the time (or the number of steps) or space that are required to reach a halt. The
time (resp. space) complexity of a Turing machine is then defined to be the function
f : N → N such that for every n ∈ N the maximum amount of time (resp. space)required by M before it terminates on an input word of length n is f (n).

Chapter 2. Preliminaries

35

Let us now recall some standard complexity classes. For a function f : N → N,

we define DTIME( f (n)) (resp. NTIME( f (n))) to be the class of problems solvable
by a deterministic (resp. nondeterministic) Turing machine that runs in time O( f (n)).
Similarly, we define SPACE( f (n)) to be the class of problems that are solvable by aTuring machine that uses O( f (n)) space. Let us define the class expk of functions
for every k ∈ N by induction. Let exp0 be the class of all polynomial functions. By

induction, the class expk (k > 0) contains all functions of the form 2O( f (n)) , where f

is a function in expk−1 . By convention, exp stands for exp1 . We may now define thefollowing standard complexity classes:• P is the class of problems solvable in polynomial-time.
• PSPACE is the class of problems solvable in polynomial space.
• NP is the class of problems solvable by nondeterministic polynomial-time Turing machines.

• NPSPACE is the class of problems solvable by nonterministic polynomial-space
Turing machines.

• k-EXP is the class of problems that are solvable in time expk .
• EXP is the class 1-EXP.
The following containtments are standard:
P ⊆ NP ⊆ PSPACE = NSPACE ⊆ EXP ⊂ 2-EXP ⊂ . . .
Here, set containments of the form ⊆ are not known to be strict. Each of these com-

plexity classes have complete problems under many-one reductions that run in polynomial time. A decidable problem is said to be elementary if it is in k-EXP for somek ∈ N. Otherwise, it is said to be nonelementary.

For a complexity class C , we write coC for the set of problems whose complements

are solvable in C . For example, coNP is the set of problems whose complements are
in NP. While the classes P, PSPACE, and k-EXP closed under complements, it is notknown whether NP = coNP.
We now define polynomial hierarchy. Letppp∆0 = Σ0 = Π0 = P.

Chapter 2. Preliminaries

36

For each k > 0, letp∆k = PΣk−1 ,ppΣk = NPΣk−1 ,ppΠk = coNPΣk−1 .
ppHere, the notation PΣk−1 refers to the class of problems solvable by a polynomial-timepmachine that can make calls to an oracle solving a problem in Σk−1 . Oracles are viewed
as blackboxes and so their computation time is measured as a constant. The notationsppNPΣk−1 and coNPΣk−1 can also be defined in a similar way. Each of these classes arep

known to have complete problems. Let PH be the union of all Σk (k ∈ N). It is known

that PH ⊆ PSPACE. In Chapter 8, we will see the complexity classes PNP and PNP[log] .
p

The former is simply the class ∆2 , while the latter is the class of problems solvable bypolynomial-time Turing machines that can only make logarithmically many calls to NP
oracles. Clearly, we have PNP[log] ⊆ PNP . The class PNP[log] is also known to containNP, coNP, and even the entire boolean hierarchy. We shall only mention the first levelof boolean hierarchy, which is the class DP containing problems of the form
{hv, wi : v ∈ L , w ∈ L ′ }.
for some NP language L and coNP language L ′ .
We shall now briefly recall the notion of alternating Turing machines (see [Koz06,
Sip97] for more details). Alternating Turing machines can be viewed as generalizationsof nondeterministic Turing machines with universal states. More precisely, each stateof a Turing machine M is declared either existential or universal. To accept froma configuration c = v(q, a)w of M where q is existential, some runs of M from cwill have to result in an accept. On the other hand, to accept from a configurationc = v(q, a)w of M where q is universal, all runs of M from c will have to result in an
accept. As before, we can define the amount of time/space used by the algorithm on
an input word w and define the time/space used by the algorithm in terms of its worsecase complexity. We write ATIME( f (n)) (resp. ASPACE( f (n))) to denote the class ofproblems solvable by an alternating Turing machine in time (resp. space) O( f (n)). In
the sequel, we will meet the complexity classes:• AP = ATIME(exp0 (n)).
• ALOG = ASPACE(log(n)).

Chapter 2. Preliminaries

37• APSPACE = ASPACE(exp0 (n)).
It is known that AP = PSPACE, ALOG = P, and APSPACE = EXP. Furthermore,poly-time alternating Turing machines with a fixed number of alternations (between
existential states and universal states) in all their possible runs accept only languages
in PH.
Finally, following [Koz06], we define the notation
STA( f1 (n), f2 (n), f3(n))
to denote the class of problems solvable in space f1 (n), in time f2 (n) and with f3 (n)alternations. We also write ∗ to denote unbounded. For example, we have the follow-

ing:• STA(exp0 (n), ∗, ∗) = PSPACE,• STA(∗, exp0 (n), ∗) = P, and• STA(∗, exp0 (n), exp0 (n)) = AP.

2.4 Structures and transition systems
In this section, we recall the standard definitions of (logical) structures and transition
systems. For a more thorough treatment, the reader may consult the following references [BBF+ 01, BdRV01, CGP99, Lib04, Sti01, Tho96, vD08].
A vocabulary is a finite set σ = {a1 , . . . , an } of (relation) names together with afunction AR : σ → Z>0 mapping each relation name to a positive integer representing

its arity. A σ-structure S is a tuple hS, {Ra}a∈σ i where S is some set (a.k.a. universeor domain) and Ra ⊆ S AR(ai ) is an AR(ai )-ary relation on S.

Example 2.4.1 We now consider several important structures that have played significant roles in logic, automata, and verification. The first structure is naturals withaddition hN, +i. The addition relation + is interpreted as a 3-ary relation consistingof tuples (n, m, k) ∈ N3 such that k is the sum of n and m. The second structure isnonnegative integers with linear order hN, <i, where the binary relation < consists ofpairs (n, m) ∈ N2 such that n is smaller than m. The third structure is naturals withsuccessor hN, succi, where the 2-ary relation succ consists of pairs (n, m) ∈ N2 withm = n + 1. Another important structure is h{0, 1}∗, succ0 , succ1 i, where the binary re-lation succi (i = 0, 1) contains pairs of words of the form (v, vi) with v ∈ {0, 1}∗. The

Chapter 2. Preliminaries

38

structure h{0, 1}∗, succ0 , succ1 i can be naturally interpreted as the infinite complete
binary tree with the root ε. We could also equip this structure with the transitive clo-

sure  of succ0 ∪ succ1 yielding the structure h{0, 1}∗ , succ0 , succ1 , i. Observe that,when h{0, 1}∗, succ0 , succ1 i is viewed as the infinite binary tree, the relation  can beinterpreted as the descendant relation between nodes in the tree. ♣In the sequel, we shall mostly deal with transition systems, which are defined as
structures over vocabulary σ with only names of arity two. Therefore, transition systems are simply edge-labeled directed graphs. In the sequel, we shall often use thenotation →a instead of Ra to denote the binary edge relation with name a, and writes →a s′ instead of (s, s′ ) ∈→a . Since we mostly use transition systems to model theevolution (or behavior) of some dynamic objects, the elements in the universe S ofa transition system S = hS, {→a}a∈σ i are called configurations2. The edge relation→a will be called the transition relation labeled a, while the edges in →a are called

a-labeled transitions. In this case, each name in σ is also said to be an action label.

Hence, we will also use the notation ACT to denote the vocabulary σ and call ACT anaction alphabet.
Example 2.4.2 Some examples of transition systems include the structures hN, succi,hN, <i, h{0, 1}∗, succ0 , succ1 i, and h{0, 1}∗ , succ0 , succ1 , i which we defined in Ex-

amples 2.4.1. Also, each NWA A over Σ (omitting initial and final states) can beeasily construed as transition systems over the action alphabet Σ. Another example of transition systems are those which are generated by a pushdown automaton

P = (Σ, Γ, Q, δ, q0, F), i.e., containing configurations of P as vertices, and transition
relations →a for each a ∈ Σε . For more details of transition systems generated bypushdown automata, see Chapter 3. ♣2.5 Logics and properties
In this section, we shall review the definitions of the logics and verification properties
that we will consider in the sequel. For a more detailed treatment, the reader is referred
to [BBF+ 01, BdRV01, CGP99, Lib04, Sti01, Tho96, vD08].
2 they are often called states in the literature of modal logic, but we have reserved this term for

automata

Chapter 2. Preliminaries

39

2.5.1 Safety, liveness, and fairness
We shall now define safety, liveness, and fairness properties, which are probably themost important properties in verification. Each of these is actually a class of properties, instead of a single property. Such properties are often treated informally in theliterature since they are often definable in some temporal logics or in terms of someother properties including reachability and recurrent reachability (see subsequent subsections). We shall now recall the informal definitions of safety, liveness, and fairness
properties. See [BBF+ 01, Chapters 6–11] for a more thorough treatment.
Two most commonly considered properties in verification are safety (under someconditions, no “bad” configurations are ever reachable) and liveness (under some conditions, some “good” configurations are eventually reachable). For example, the property that “the system never reaches a configuration where two processes are in a critical region” is an important safety property for mutual exclusion protocols, while theproperty that “every philosopher who requests noodle will eventually get it” is a liveness property that is often considered for protocols for dining philosopher problems[BA06, Lyn96]. To prove or disprove a safety property, it suffices to consider only
finite executions of the systems since a violation of the property can be witnessed by afinite path that takes the system from an initial configuration to a bad configuration. On
the other hand, this is not the case with liveness properties. To prove or disprove a liveness property, we need to take into account (potentially infinite) maximal executionsof the systems.
Fairness is another important property in verification. Roughly speaking, it statesthat under certain conditions some events must occur infinitely often. One importantuse of fairness property is that liveness property in a system can often be reduced
to a fairness property in a modified system via an automata-theoretic technique (seebelow). Another use of fairness property is as a hypothesis of a liveness property.
Liveness property is often easily violated unless some fairness hypothesis is imposed.
For example, for a dining philosopher protocol with n philosophers, an “unfair” pathin the system could simply ignore a philosopher’s request indefinitely and therefore
resulting in a violation of a desired liveness property. One common fairness hypothesisin the setting of distributed protocols is that if a resource is requested infinitely, it must
be infinitely often granted.

Chapter 2. Preliminaries

40

2.5.2 Reachability and recurrent reachability
Safety, liveness, and fairness are often best expressed in terms of reachability andrecurrent reachability. We shall now define these concepts. Given a transition system′
S = hS, {→a}a∈
ACT i and a subset ACT ⊆ ACT, we write →ACT′ to denote the relation


S
′ →a
and → to denote the relation →ACT . As usual, for a binary relationa∈ACT

R ⊆ S × S, we write R+ (resp. R∗ ) for the transitive (resp. transitive-reflexive) closureof R. Given s,t ∈ S, we say that s can reach t in S (or t is reachable from s) if itis the case that s →∗ t. In the sequel, the reachability relation for the system S is
the relation →∗ , while its one-step reachability relation is the relation →. We shallalso call →+ the strict reachability relation for the system S. It is also convenient torefer to the preimages and postimages of a relation. To this end, given a set S′ ⊆ S ofconfigurations and a relation R ⊆ S × S, we writepre(S′ )[R] := {v ∈ S : ∃w ∈ S′ ((v, w) ∈ R)},post(S′)[R] := {v ∈ S : ∃w ∈ S′ ((w, v) ∈ R)}.
Given a transition system S = hS, {→a}a∈ACT i and a subset S′ ⊆ S, we now define

the following sets:pre(S′ ) := pre(S′ )[→],
post(S′) := post(S′)[→],pre∗ (S′ ) := pre(S′ )[→∗],
post ∗(S′ ) := post(S′)[→∗],
pre+ (S′ ) := pre(S′ )[→+],
post +(S′ ) := post(S′)[→+].

We now move to recurrent reachability. Given a set S, a subset S′ ⊆ S, and a relation

R ⊆ S × S, we denote by Rec(S′ )[R] the set of all elements s0 ∈ S for which there exists

an infinite sequence {si }i∈Z≥1 such that:• si ∈ S′ for all i ∈ Z≥1 , and• (s j , si ) ∈ R for all pairs of distinct integers satisfying 0 ≤ j < i.
See Figure 2.6 for an illustration of an infinite sequence witnessing s0 ∈ Rec(S′ )[R].
Given a transition system S = hS, {→a}a∈ACT i and a subset S′ ⊆ S, we use the nota-

Chapter 2. Preliminaries

s0

41

s1

s2

·········

Figure 2.6: An illustration of an infinite sequence witnessing s0 ∈ Rec(S′ )[R]. The edges

are from the relation R, while each configuration si (with i > 0) must belong to S′ . The
configurations in this sequence are not necessarily all different.

tion Rec(S′ ) to denote Rec(S′ )[→+]. In this case, by transitivity of →+ we have s0 ∈ S′

iff there exists an infinite sequence {si }i∈Z≥1 such that si ∈ S′ and si−1 →+ si for alli ∈ Z≥1 . In other words, the set Rec(S′ ) is the set of configurations in S′ from which
there exists an infinite path visiting S′ infinitely often.

2.5.3 FO: First-order logic
We assume basic knowledge of mathematical logic (cf. [Lib04, vD08]). We shall only
briefly recall some basic definitions and results on first-order logic.
Syntax and semantics

Let VAR be a countable set of (first-order) variables. In the sequel, we shall use xi , yi , zi
for variables with i ∈ N. The syntax of first-order formulas over the vocabulary σ canbe defined inductively as follows: (i) x = y is an atomic formula for not necessarily

distinct variables x and y (ii) if a ∈ σ and x1 , . . ., xn are (not necessarily distinct) vari-ables, where n = AR (a), then Ra (x1 , . . . , xn ) is an (atomic) formula, (iii) if ϕ and ψ areformulas, then so are their conjunction ϕ ∧ ψ, their disjunction ϕ ∨ ψ, and the negation¬ϕ, and (iv) if ϕ is a formula, then so are ∃xϕ and ∀xϕ. Notice that we allow thestandard built-in equality relation ‘=’. The formula ϕ is said to be existential positive

if it is of the form ∃x1 , . . . , xn ψ, where ψ is quantifier-free, i.e., a boolean combinationsof atomic formulas. The free variables free(ϕ) of a first-order formula ϕ are also built

inductively: (i) free(x = y) = {x, y} (ii) free(Ra (x1 , . . . , xAR(a) ) = {x1 , . . ., xAR (a) },(iii) free(ϕ ∨ ψ) = free(ϕ ∧ ψ) = free(ϕ) ∪ free(ψ), (iv) free(¬ϕ) = free(ϕ), and (iv)free(∃xϕ) = free(∀xϕ) = free(ϕ) \ {x}. If ϕ is a formula with free variables x1 , . . . , xn ,then we write ϕ(x1 , . . ., xn ) to emphasize which free variables the formula ϕ has. A/
first-order sentence is simply a first-order formula ϕ with free(ϕ) = 0.

Chapter 2. Preliminaries

42

Fix a σ-structure S = hS, {Ra}a∈σ i. A S-valuation ν is a function mapping theset VAR of variables to elements of S. Whenever S is clear from the context, we shall
simply say valuation. If ϕ is a formula over σ, we may define the notion of truth of ϕin S with respect to ν in the standard way (cf. [Lib04, vD08]). If ϕ is true in S withrespect to ν, then we also say that S satisfies ϕ with respect to ν and write S |= ϕ[ν].

A standard proposition in mathematical logic is that the truth of ϕ(x1 , . . . , xn ) in S
only depends on the values of the valuation ν on the free variables x1 , . . . , xn of ϕ:
S |= ϕ[ν] iff, for every valuation ν′ that agrees with ϕ on x1 , . . . , xn , it is the casethat S |= ϕ[ν′ ]. For this reason, we shall often simply write S |= ϕ(ν(x1 ), . . . , ν(xn ))whenever S |= ϕ[ν] for some valuation ν.

For two formulas ϕ(x1 , . . . , xn ) and ψ(x1 , . . ., xn ) over the vocabulary σ with thesame free variables, we say that ϕ and ψ are (logically) equivalent, written ϕ ≡ ψ, if

for every σ-structure S and valuation ν it is the case that S |= ϕ[ν] iff S |= ψ[ν]. The

following are several basic results on equivalence of first-order formulas: (i) ¬¬ϕ ≡ ϕ,(ii) ϕ ∧ ψ ≡ ¬(¬ϕ ∨ ¬ψ), (iii) ϕ ∨ ψ ≡ ¬(¬ϕ ∧ ¬ψ), (iv) ∃xϕ ≡ ¬∀x¬ϕ, and (v) ∀xϕ ≡¬∃x¬ϕ. Therefore, we will sometimes assume that first-order formulas use only theoperators {∨, ¬, ∃}. Similarly, by pushing all the negations inside as much as possible,
we may assume that the only occurences of negations in first-order formulas are on theatomic level. For other standard equivalences, the reader is referred to [vD08].
Quantifier rank and alternation rank

The quantifier rank qr(ϕ) of a first-order formula ϕ is defined to be the maximum
quantifier nesting depth inside ϕ. More formally, this notion can be defined inductively: (i) qr(Ra (x1 , . . ., xAR (a) )) = qr(x = y) := 0, (ii) qr(ϕ ∨ ψ) := max(qr(ϕ), qr(ψ)),(iii) qr(¬ϕ) := qr(ϕ), and (iv) qr(∃xϕ) := qr(ϕ) + 1.

Given a formula ϕ, let us push all the negations in ϕ to the atomic level. The alternation rank AL(ϕ) of a formula ϕ is defined to be the maximum number of alternationsof operators in {∀, ∧} and operators in {∃, ∨} over all paths from the root to the leaves
in the parse tree of ϕ.
First-order queries

The somewhat non-standard notion of first-order queries that we shall next define ismotivated by the standard notion of conjunctive queries in database theory literatureChapter 2. Preliminaries

43(cf. [AHV95]). A first-order k-ary query over the vocabulary σ is of the form
υ(x1 , . . . , xk ) ← ϕ(y1 , . . . , yr )where ϕ is a formula over σ, y1 , . . . , yr are distinct variables, and x1 , . . ., xk are notnecessarily distinct variables. Given a σ-structure S, we define the image of S underυ to be the set[[υ]]S := {(ν(x1 ), . . . , ν(xk )) : ν is a S-valuation s.t. S |= ϕ[ν]}.
We shall call υ(x1 , . . . , xk ) the head of the query υ, while ϕ(y1 , . . ., yr ) is called the
body of the query υ. Without loss of generality, since first-order formulas are closed
under existential quantification, we may assume that the variables y1 , . . . , yr in the bodyof υ are among variables x1 , . . ., xk in the head of the query.
Albeit it is the case that first-order queries can be crudely dealt with using only
first-order formulas, there are two main reasons for using the notion of first-order
queries. Firstly, the definition of first-order queries enforces an explicit ordering of
the arguments in the induced k-ary relations, which is important when using automata
to recognize relations (e.g. see Proposition 3.1.1). Secondly, unlike first-order formulas, the arity of the relations defined by first-order queries need not coincide with
the number of free variables in their bodies. More importantly, we shall see later thatfirst-order queries provide a cleaner notation for proofs.
FOk : restriction of FO to k variables
In the literature of model theory (e.g. see [Lib04]), it is common to restrict the expressive power of FO by enforcing only k variables in the formulas, for a fixed k ∈ Z≥1 . In

the sequel, we use FOk to denote the k-variable first-order logic containing the set of
all first-order formulas which only use at most k variables.
First-order logic with two or three variables are often already sufficiently powerful.
One well-known example is the equivalence between FO3 over finite words and starfree regular expressions due to McNaughton and Papert [MP71]. We shall now makethis statement more precise only over the alphabet {0, 1}, although it generalizes toany alphabet. A finite word w = a1 . . . an over the alphabet {0, 1} can be thought of asa finite structure S = hS, <,U i, where• S = {1, . . ., n},• < is the standard transitive binary ordering relation over {1, . . . , n}, andChapter 2. Preliminaries

44• U = {i ∈ S : ai = 1} is a unary relation.
For example, the word 011 corresponds to the structure h{1, 2, 3}, <,U i, where < isthe standard less-than relation over {1, 2, 3} and U = {2, 3}. The reverse interpretation

can similarly be done. Therefore, given a first-order sentence ϕ over the vocabulary

consisting of a binary relation name < and a unary relation name U , we may define

L (ϕ) to be the class of finite words w over {0, 1} such that w |= ϕ. We say thata language L ⊆ {0, 1}∗ is definable in FO (resp. FOk ) if there exists a formula in FO(resp. FOk ) such that L (ϕ) = L . McNaughton and Papert [MP71] proved that a regular
language is star-free iff it is definable in FO. Other proofs for this result can also befound in [Lib04, Tho96]. In fact, it is folklore that FO3 suffices and the translation toFO3 from star-free regular expressions takes polynomial-time (e.g. see [EVW02] for asketch).
Proposition 2.5.1 (McNaughton and Papert [MP71]) A language is star-free regular iff it is definable in FO3 . Furthermore, the translation from star-free regular expressions to FO3 sentences can be performed in polynomial time.
Many results in the literature show that a large number of modal and temporal logics can be embedded in first-order logic with two or three variables possibly extended
with the transitive closure operators (cf. [BdRV01, EVW02, IK89, Kam68, Lib04]).
We shall mention some of these results below.

2.5.4 FOREG (Reach): FO with regular reachability
As we saw earlier, most properties in verification are related to the reachability property in some way. Therefore, a minimum criterion for a suitable logic in verification isthat it needs to be able to express reachability. It is a well-known fact in model theory
that first-order logic is not powerful enough to express reachability (cf. [Lib04]) overgraphs. One way to overcome this limitation is to extend the logic with a reachability
operator. We shall now define the logic FOREG (Reach) that extends FO with “regular”
reachability operators, and its subclass FO(Reach) which extends FO with the simplest reachability operators. These logics are natural and commonly considered in thecontext of verification (e.g. see [Col02, DT90, Löd03, LS05b, WT07]).
Given a finite set ACT of action labels, FOREG (Reach) are built from atomic formulas of the form x = y, x →a y (a ∈ ACT) and ReachA (x, y) for an NWA A over ACT,

which we then close under boolean combinations and first-order quantifications usingChapter 2. Preliminaries

45

the standard rules for first-order logic. The semantics for FO(Reach) are defined withrespect to transition systems. They can be defined in the same way as for FO, except
for formulas of the form ReachA (x, y), which can be defined as follows: given a transition system S over ACT and a S-valuation ν, we define that S |= ReachA (ν(x), ν(y))
iff there exists a path

s0 →a1 . . . →an sn
in S such that s0 = ν(x), sn = ν(y), and a1 . . . an ∈ L (A ). In other words, S |=ReachA (ν(x), ν(y)) iff the configuration ν(x) can reach ν(y) via a sequence of actions

that are permitted by the NWA A .
We define the logic FO(Reach) to be the sublogic of FOREG (Reach) where we
only permit atomic formulas of the form ReachA (x, y), where L (A ) = Γ∗ for someΓ ⊆ ACT. In the sequel, we shall use the shorthand ReachΓ (x, y) to refer to such an

atomic formula, and the shorthand Reach(x, y) to denote ReachACT (x, y). The logic

FOREG (Reach) is probably the weakest extension of FO that can express reachability
in a meaningful way.
The notion of quantifier rank can be easily extended to FOREG (Reach) from FO
by interpreting qr(ReachA (x, y)) := 0. The same goes with the notion of alternation
rank. As before, we use FOkREG (Reach) (resp. FOk (Reach)) to denote the restrictionsof FOREG (Reach) (resp. FO(Reach)) to formulas with at most k variables.

2.5.5 HM-logic: Hennessy-Milner Logic
It is well-known that many properties in verification cannot distinguish bisimulationinvariant properties. Due to its intimate connection with the notion of bisimulation,
Hennessy-Milner logic3 plays an important role in verification. We shall now briefly
recall the definition of Hennessy-Milner logic, the notion of bisimulations, and several
basic results that are relevant to this thesis; for a more thorough treatment, the reader isreferred to [BdRV01, Lib04, Sti01]. Hennessy-Milner logic (HM-logic) over the actionalphabet ACT is defined by the following grammar:ϕ, ψ := ⊤ | ¬ϕ | ϕ ∨ ψ | hACT′ iϕ (ACT′ ⊆ ACT).
If a ∈ ACT, then we write haiϕ to denote h{a}iϕ. We also use the usual abbreviations⊥ := ¬⊤, ϕ ∧ ψ := ¬(¬ϕ ∨ ¬ψ), and [ACT′ ]ϕ := ¬hACT′ i¬ϕ. The semantics [[ϕ]]S3Hennessy-Milner logic (modulo minor syntactic issues) is just modal logic, which was much earlier
introduced in philosophy (cf. [BdRV01]).

Chapter 2. Preliminaries

46

of an HM-logic formula ϕ with respect to a transition system S = hS, {→a}a∈ACT i is
simply a subset of S defined inductively as follows:• [[⊤]]S := S,• [[¬ϕ]]S := S \ [[ϕ]]S ,• [[ϕ ∨ ψ]]S := [[ϕ]]S ∪ [[ψ]]S , and• [[hACT′ iϕ]]S := {s ∈ S : ∃s′ ∈ S(s →ACT′ s′ and s′ ∈ [[ϕ]]S )}.
Given a configuration s ∈ S, we also write S, s |= ϕ iff s ∈ [[ϕ]]S . The problem ofmodel checking HM-logic is defined as follows: given a system S = hS, {→a}a∈ACT i,a configuration s ∈ S, and an HM-logic formula ϕ over ACT, decide whether S, s |= ϕ.
Standard translation to FO2

It is well-known that HM-logic formulas can be thought of as first-order formulas withtwo variables. More precisely, for every HM-logic formula ϕ over ACT, there exists
an FO formula ϕ′ (x) over ACT with one free variable such that, for every transition
system S = hS, {→a}a∈ACT i and s ∈ S, it is the case that
S, s |= ϕ⇔S|= ϕ′ (s).

Furthermore, there exists an algorithm that performs this translation in linear time (cf.
[BdRV01, Lib04]).

2.5.6 EFREG -logic: HM-logic with regular reachability
HM-logic is not capable of expressing reachability. For this reason, we introduce
EFREG -logic, which is HM-logic with a regular reachability operator, and its syntac-

tic restriction EF-logic, which is HM-logic with a simple reachability operator. Moreprecisely, the syntax of EFREG -logic over the action alphabet ACT is the extension of
the syntax of HM-logic over ACT with the following rule:• if A is an NWA over ACT and ϕ an EFREG -logic formula over ACT, then EFA ϕ
is an EFREG -logic formula over ACT.

The semantics of formula of the form EFA ϕ is defined as follows:Chapter 2. Preliminaries

47• for a transition system S = hS, {→a}a∈ACT i and s0 ∈ S, we have S, s0 |= EFA ϕ
iff there exists a path

s0 →a1 . . . →an sn
in S such that a1 . . . an ∈ L (A ) and sn ∈ [[ϕ]]S .
We then define [[EFA ϕ]]S to be the set of configurations s0 ∈ S such that S, s0 |= EFA ϕ.

We define EF-logic to be the restriction of EFREG -logic which allows only reachability
operators of the form EFA , where L (A ) = Γ∗ for some Γ ⊆ ACT. In the sequel, weshall use the shorthand EFΓ to refer to such a reachability operator, and the shorthandEF to denote EFACT .

Remark 2.5.1 In the verification literature, EF-logic is often defined in such a way that
only the reachability operator EF is allowed (e.g. see [BEM97, LS02, May98, Wal00]).
However, it is known that permitting the more general operator EFΓ does not change
the complexity of model checking problems in most cases. For this reason, we shalladopt the more general definition. We saw earlier that HM-logic can be naturally thought of as a fragment FO2 . In
the same manner, EFREG -logic can be thought of as a fragment of FO2REG (Reach) andEF-logic a fragment of FO2 (Reach). Furthermore, the same linear-time translation canbe used in this case.

2.5.7 CTL: Computation Tree logic
CTL is one of the most common branching-time temporal logics that are considered in
the context of verification (cf. [BBF+ 01, CGP99, Lib04, Sti01]). Loosely speaking, it
is an extension of EF-logic with powerful “constraints on the way”. To be more precise,let us define the syntax and semantics of CTL. The syntax of the logic CTL over theaction alphabet ACT is the extension of the syntax of EF-logic with the following two
rules:• if ϕ and ψ are CTL formulas over ACT, then E(ϕ U ψ) is also a CTL formula• if ϕ is a CTL formula over ACT, then so is EGϕ.
The semantics of these types of formulas are defined with respect to a transition system
S = hS, {→a}a∈ACT i and a configuration s0 ∈ S as follows:Chapter 2. Preliminaries

48• S, s0 |= E(ϕ U ψ) iff there exists a path
s0 → . . . → snsuch that S, sn |= ψ and, for each i = 0, . . ., n − 1, we have S, si |= ϕ.
• S, s0 |= EG(ϕ) iff there exists a (finite or infinite) maximal path s0 → s1 → . . .
such that S, si |= ϕ, for each i ∈ N.

As before, we use [[ϕ]]S to denote the set of configurations s ∈ S such that S, s |= ϕ.

The problem of CTL model checking can be defined as follows: given a finite sys-tem S = hS, {→a}a∈ACT i, a configuration s ∈ S, and a CTL formula ϕ over ACT,

decide whether S, s |= ϕ. It is well-known (cf. [CGP99]) that model checking CTL

over finite systems can be done in polynomial time. This definition can also be easily
extended to finitely representable infinite-state systems by permitting finite representations of S and s to be the input.

2.5.8 LTL: Linear Temporal Logic
Linear Temporal Logic (LTL) is one of the most standard and natural temporal logics
considered in the context of verification. It has been argued that the logic is moreintuitive than branching-time temporal logics like CTL (cf. [Var01]). We shall now
recall the definition of LTL and review some of its most important results. See [Var95,
Wol00] for a more thorough treatment.
The syntax of LTL over ACT is defined as follows:ϕ, ϕ′ := a (a ∈ ACT) | ¬ϕ | ϕ ∨ ϕ′ | ϕ ∧ ϕ′ | Xϕ | ϕUϕ′ .
We shall use the standard abbreviations: Fϕ for trueUϕ, Gϕ for ¬F¬ϕ, and Fs and Gs

for their strict versions: Fs ϕ = XFϕ and Gs ϕ = ¬Fs ¬ϕ. The semantics of LTL over

ACT is given by ω-word languages over ACT:

• [[a]] = {v ∈ ACTω : v(1) = a},• [[¬ϕ]] = ACTω − [[ϕ]],• [[ϕ ∨ ϕ′ ]] = [[ϕ]] ∪ [[ϕ′]],• [[ϕ ∧ ϕ′ ]] = [[ϕ]] ∩ [[ϕ′]],• [[Xϕ]] = {v ∈ ACTω : v[1, ∞) ∈ [[ϕ]]}, andChapter 2. Preliminaries

49• [[ϕUϕ′ ]] = {v ∈ ACTω : ∃ j ≥ 0∀i < j(v[i, ∞) ∈ [[ϕ]] ∧ v[ j, ∞) ∈ [[ϕ′ ]])}.
Given an ω-word v ∈ ACTω and an LTL formula ϕ over ACT, we write v |= ϕ iff v ∈ [[ϕ]].

We shall now recall a seminal result by Vardi and Wolper [VW86a].

Proposition 2.5.2 (Vardi-Wolper [VW86a]) Given an LTL formula ϕ over ACT, we
can compute an NBWA Aϕ of size 2O(kϕk) such that L (Aϕ ) = [[ϕ]] in time 2O(kϕk) .
Given a transition system S = hS, {→a}a∈ACT i and a word v = a1 a2 . . . ∈ ACTω , wesay that s0 ∈ S realizes v if there is an infinite path

s0 →a1 s1 →a2 s2 →a3 . . .
in S. We define the semantics of LTL over transition systems in the standard way:
(S, v) |= ϕ iff every ω-word v ∈ ACTω realized by v satisfies ϕ. We write [[ϕ]]∀S for theset of all v ∈ S such that (S, v) |= ϕ. Here, the symbol ∀ is used to signify the universal

semantics that is adopted in the definition (i.e. every path starting in v satisfies ϕ).

Dually, we will write [[ϕ]]∃S for the complement of the set [[¬ϕ]]∀S , i.e., for the set ofv ∈ S from which there exists a path that satisfies ϕ.

The problem of LTL model checking can be defined as follows: given a finite system

S = hS, {→a}a∈ACT i, a configuration s ∈ S, and an LTL formula, decide whetherS, s |= ϕ. This definition can be easily extended to finitely representable infinite-statesystems by allowing a finite representation of S and s as the inputs. In the case offinite systems, the problem is known to be PSPACE-complete, which can be shownusing a model-theoretic technique [SC85] or an automata-theoretic technique (i.e. a
more refined version of Proposition 2.5.2) [Var95, VW86a, Wol00]. See the survey[Sch02] for a more thorough discussion.

2.5.9 Other logics
There are of course other logics that are common in verification. We shall mention a
few others, but not give a precise definition since we will not encounter them in thesequel. Among others, we mention:• Monadic second-order logic (MSO). This is simply first-order logic extended
with quantification over sets of elements (see [Lib04, Tho96, Tho03] for a def-

inition). This logic is perhaps the most expressive logic in verification, i.e., it
subsumes virtually all logics that are considered in verification.

Chapter 2. Preliminaries

50• µ-calculus. This is simply modal logic extended with least fixed point opera-

tors (see [Sti01, Lib04] for a definition). This logic is subsumed in MSO, but

subsumes most logics that are invariant under bisimulation.
• Propositional dynamic logic (PDL). This is simply modal logic extended withrecursion and other modalities (see [BdRV01] for a definition). There are a num-

ber of variations of this logic with different expressive power, but the most basic
PDL is subsumed in µ-calculus.

2.5.10 Model checking complexity
When we deal with the problem of model checking with respect to a certain logic L,
there are usually several parameters that are considered as part of the problems. The
two most important ones are: (1) structures, and (2) formulas.
Let us first clarify how we measure the size of structures and formulas. In this thesis, when structures are part of the model checking problems, they always take shapeof transition systems, i.e., edge-labeled directed graphs. In the case of finite systems,
we may measure them in the standard way we measure the size of graphs. When they
are implicitly (or symbolically) represented (e.g. when the systems are infinite), we
will simply use the size of these symbolic representations, which we will define whendefining a symbolic language for the representations. In the case of formulas, we will
simply measure the size of the parse trees of the given formula (except for Chapter 8
when we represent our formulas as dags). In the case of logic which allows natural
numbers as constants (e.g. Presburger Arithmetic with syntactic sugar), we will alsomeasure the numbers in binary, unless stated otherwise.
There are three standard complexity measures when dealing with model checking
depending on which of the two input parameters are fixed. The first measure is combined complexity when both structures and formulas are considered as part of the input.
This measure is reasonable when both structures and formulas are important parameters. The second measure is data complexity which considers only structures to be partof the input, i.e., formulas are fixed. This measure is considered to be the most usefulmeasure in the context of verification since for most applications the size of the structures can be extremely large, while only small formulas are used in practice. The third
measure is expression complexity which considers only formulas to be part of the input,
i.e., the structures are fixed. Many believe that the third measure is not very reasonablein practice. This is, however, not true since many verification problems these days

Chapter 2. Preliminaries

51

are achieved by reductions to Presburger Arithmetic, S1S, or S2S. Nowadays there arefast solvers that have been developed for these theories (e.g. MONA [HJJ+ 95], LIRA[BDEK07], and Omega [Ome]).

Part I
Generic Approaches: Algorithmic
Metatheorems

53

Chapter 3
Word/Tree-automatic Systems
Generic approaches to infinite-state model checking require generic frameworks thatare expressive enough to subsume Turing-powerful models of computation. Manysuch frameworks have been proposed in the literature (cf. [AJNS04, Bar07, BGR10,
BFLS05, BFLP08, BG09, BLN07, Blu99, BG04, Boi99, Bou01, BLW03, BLW09,
BW94, BJNT00, BHV04, DLS02, FL02, KMM+97, KMM+01, JN00, Mor00, Nil05,
Rub08, WB98]). Such frameworks often make use finite state automata (or equivalentmodels) as finite representations of the transition relations and the domains of transition systems in various ways. Although the use of finite state automata often yield niceclosure and algorithmic properties, they are not in general sufficient for the verificationof reachability or more complex properties due to expressive power of the framework.
In this thesis, we adopt word automatic systems [Blu99, BG04] and tree automatic
systems [Blu99, BG04, BLN07] as our generic frameworks since they strike a goodbalance between the expressive power (e.g. they subsume many decidable classes of
infinite-state transitions systems) and closure/algorithmic properties (e.g. effective closure under boolean combinations and automata projections).
Our purpose of using generic frameworks in this thesis significantly differs from
common uses of generic frameworks in the literature of infinite-state model checking.
For example, generic frameworks are often used in combination with semi-algorithms
for computing reachability sets and reachability relations (cf. [AJNS04, BFLS05,
BFLP08, Boi99, BLW03, Bou01, BW94, BJNT00, BHV04, BLW09, DLS02, Nil05,
KMM+97, KMM+01, JN00, WB98]). Although the results in this thesis can be usedin conjunction with such semi-algorithms, we shall chiefly use generic frameworks
as frameworks for deriving algorithmic metatheorems for decidable model checking,which are generic results that can be used in a “plug-and-play” manner for inferring de55

Chapter 3. Word/Tree-automatic Systems

56

cidability of certain model checking tasks over a large family of formalisms of infinitestate systems, instead of doing so for a single formalism at a time. Such a use of genericframeworks is not new, e.g., this can be found in the work of [BFLP08, BFLS05, LS04,
LS05a] on flattable linear counter systems, which derives a single semi-algorithm forreachability that is guaranteed to terminate over many important subclasses of Petrinets and counter systems (cf. [LS04, LS05a]). We shall give our algorithmic metatheorems for word/tree automatic transition systems in the next two chapters of the thesis.
This chapter aims to review basic definitions and results for word/tree automatictransition systems [Blu99, BG04], and compare them with several other closely-related
generic frameworks that have been considered in the literature. The chapter is organized as follows. We review the definition and standard results of word automatictransition systems in Section 3.1, and of tree automatic systems in Section 3.2. In
particular, we shall review basic properties of word/tree automatic transition systems
and give several well-known concrete classes of infinite-state systems that they cancapture. In Section 3.3, we shall discuss a number of other well-known generic frameworks that have been considered in the literature — in particular, length-preserving
word-automatic systems, rational transition systems, Presburger-definable transition
systems, and ω-automatic transition systems — and compare them with word/tree automatic systems in terms of expressive power and closure/algorithmic properties.

3.1 Word-automatic systems
In this section, we shall define the framework of word-automatic systems [Blu99,
BG04]. The reader is also referred to [Bar07, BGR10, Rub08] for more recent results regarding automatic structures.

3.1.1 Basic definitions
Loosely speaking, word-automatic systems S = hS, {→a}a∈ACT i are those transition

systems such that, for some alphabet Σ, S is a regular language over Σ and →a is a“regular relation” over Σ. To define the notion of regular relations, we need a binary
operation over Σ∗ called convolution ⊗, which computes an encoding of a pair of words

over Σ∗ as a word over some new alphabet. More precisely, given words v, w ∈ Σ∗

where v = a1 . . . an and w = b1 . . . bm , let v ⊗ w be the word c1 . . . ck over the alphabet

Chapter 3. Word/Tree-automatic Systems

57Σ⊥ × Σ⊥ , where Σ⊥ := Σ ∪ {⊥} with ⊥∈/ Σ, k = max(n, m), and
 " #
ai

if i ≤ min(n, m)


bi


 " #
⊥
if n < i ≤ m
ci =
bi


"
#



 ai
if m < i ≤ n.
⊥

Roughly speaking, the word v ⊗ w is obtained by putting v on top of w and padding theshorter word by the padding symbol ⊥. For example, when v = aab and w = ababab,the word v ⊗ w is simply

"

a
a

#"

a
b

#"

b
a

#"

⊥
b

#"

⊥
a

#"

⊥
b

#

.

A relation →a ⊆ Σ∗ ×Σ∗ is said to be regular if the language {v⊗w : v →a w} is regular.
Example 3.1.1 The relation = ⊆ {0, 1}∗ × {0, 1}∗ consisting of pairsof equal words
(u, v) is obviously regular, e.g., it is generated by the regular expression

"

0
0

#

+

"

1
1

#

∗

The relation el ⊆ {0, 1}∗ × {0, 1}∗ consisting of words (u, v) ∈ {0, 1}∗ × {0, 1}∗ ofequal length is regular, e.g., it is generated by the regular expression ({0, 1} × {0, 1})∗.

The prefix-of relation  ⊆ {0, 1}∗ × {0, 1}∗ consisting of words (u, uw) for somewords u, w ∈{0, 1}∗ is also regular, e.g., it is generated by the regular expression

# ∗
#
"
"
1
0
({⊥} × {0, 1})∗. ♣+0

1

In the sequel, we shall not distinguish a relation and its language representation. Let
us now summarize the definition of word-automatic systems as follows.
Definition 3.1.1 A transition system S = hS, {→a}a∈ACT i is said to be Σ∗ -automatic

if S is a regular language over Σ and each →a is a regular relation over Σ. It is said to
be word-automatic (or just automatic) if it is Σ∗ -automatic for some alphabet Σ.

As there are multiple ways of representing a given regular language, there are also
non-unique ways of representing a given word-automatic system. This motivates thefollowing definition. A presentation of a Σ∗ -automatic system hS, {→a}a∈ACT i is atuple η = hAS , {Aa }a∈ACT i where AS and Aa ’s are NWAs such that L (AS ) = S and

L (Aa ) = {v ⊗ w : v →a w} for each a ∈ ACT. We shall also use the notation Sη todenote the transition system of which η is a presentation. A transition system S′

over ACT is said to be (word-)automatically presentable if it is isomorphic to some
automatic system S over ACT.

.

Chapter 3. Word/Tree-automatic Systems

58

Remark 3.1.1 Two remarks are in order. Firstly, our definition of automatic systems
is slightly different from the common definition in the literature of automatic structures(e.g. see [BG04]); the latter coincides with our definition of automatically presentablesystems. Nonetheless, both approaches are equivalent since we are only interested inverification problems, instead of the expressive power of certain logics, over automatic
systems. Secondly, our definition of automatic presentations use NWAs as default
representations of regular languages. One may of course adopt other representationsof regular languages, such as regular expressions or DWAs. Nonetheless, our choice ofrepresentations of regular languages is justified by computational complexity reasons,i.e., that most systems that are considered in the literature permit succinct automaticpresentations in terms of NWAs (but not necessarily in terms of DWAs or regular
languages), while the complexity of the algorithmic metatheorems that we obtain in thethesis do not increase even if we adopt NWAs (instead of DWAs or regular languages)
as default representations of regular languages.

3.1.2 Examples
We now give four examples of classes of infinite-state systems which can be construed
as word-automatic systems; more will be given in subsequent chapters.
Example 3.1.2 (Pushdown systems) A pushdown system (PDS) is a PDA without an
initial state and the set of final states (cf. [BEM97, May98, MS85, Tho03]). Thisomission is due to the fact that we are no longer interested in PDAs as acceptors oflanguages, but instead as generators of infinite transition systems. More precisely,
given a PDA (Σ, Γ, Q, δ, q0, F), the tuple P := (ACT, Γ, Q, δ) is a PDS over the actionalphabet ACT, which we define to be the set of elements a in Σε for which there exists a transition rule in δ of the form ((q, a, u), (q′, u′ ). Many notions for PDAs (e.g.
configurations) can be easily adapted to PDSs. The PDS P gives rise to the transition system SP = hS, {→a}a∈ACT i, where S ⊆ Q × Γ∗ is the set of configurations of

P and →a ⊆ S × S is the binary relation containing tuples ((q, vu), (q′, vu′ )) such that
there exists a transition ((q, a, u), (q′, u′ )) ∈ δ. A simple example of a transition systemgenerated by a PDS (up to isomorphism) is the structure S2S; see Example 2.4.1 for adefinition. This can, in fact, be generated by a PDS with one state.
Transition systems generated by pushdown systems can be easily thought of as
word-automatic systems as follows. Given a PDS P = (ACT, Γ, Q, δ), let Ω = Q ∪ Γ.

Chapter 3. Word/Tree-automatic Systems

59

We define the set S′ and, for each a ∈ ACT, the relation →′a as follows:
S′ := QΓ∗:= {(qu, q′u′ ) ∈ S′ × S′ : (q, u) →a (q′ , u′ )}.

→′a

In other words, by interpreting each configuration (q, u) of P as the word qu ∈ QΓ∗ , we

see that the transition system S′P = hS′ , {→′a}a∈ACT i is isomorphic to SP . Further-more, the isomorphism function can be implemented to run efficiently, i.e., in linear
time. It is now not hard to see that S′P is word-automatic for which a presentation canbe computed in time O(|Q ∪ Γ|2 + |Γ| × kP k). This is because each NWA Aa for →′a

is over the alphabet Ω2⊥ and behaves as follows:

1. nondeterministically guess a transition in (q, a, u, q′, u′ ) ∈ δ,
2. make sure that

"

q
q′

#

is the first letter read,

3. read a word of the form v ⊗ v ∈ (Γ × Γ)∗ , and4. nondeterministically jump to a state to check that the rest of the input word isu ⊗ u′ .
In other words, these two representations of pushdown systems are polynomially equivalent. Therefore, in the sequel we shall use the term “pushdown system” to refer toeither of these representations. ♣Example 3.1.3 (Prefix-recognizable systems) Prefix-recognizable systems are natural generalizations of pushdown systems, where we allow potentially infinitely manyrules which are represented using regular languages (cf. [Cau03]). More precisely, aprefix-recognizable system1 P over ACT is a tuple (ACT, Γ, Q, δ) where• Γ is a finite stack alphabet,• Q is a finite set of states, and• δ is a transition relation, i.e., a finite set of transitions of the form((q, a, A ), (q′, A ′ ), A ′′),
where q, q′ ∈ Q, a ∈ ACT, and A , A ′ , A ′′ are NWAs over Γ.
1 In the literature, prefix-recognizable systems are usually defined without state components. How-ever, the two definitions are easily seen to be equivalent.

Chapter 3. Word/Tree-automatic Systems

60

As for PDSs, a configuration is simply a pair (q, w) ∈ Q × Γ∗ consisting of a state anda word in Γ∗ . Given two configurations (q, w) and (q′ , w′ ) of P , we write (q, w) →a(q′ , w′ ) if there exist three words α, β, γ ∈ Γ∗ and a rule ((q, a, A ), (q′, A ′ ), A ′′ ) in δ suchthat w = αβ, w′ = αγ, α ∈ L (A ′′ ), β ∈ L (A ), and γ ∈ L (A ′). The transition system SP

generated by P is simply the system hS, {→a}a∈ACT i, where S ⊆ Q × Γ∗ is simply theset of all configurations of P , and →a is the one-step reachability relation via action athat we just defined. To understand the definition of prefix-recognizable systems andthe transition systems they generate, it is helpful to draw an analogy with pushdown
systems. We may think of pushdown systems as prefix-recognizable systems P =(Σ, Γ, Q, δ), where each rule in δ is of the form ((q, a, A ), (q′, A ′ ), A ′′) for some NWAs

A and A ′ that accepts only a single word in Γ∗ and for some A ′′ that accepts all wordsin Γ∗ . A simple example of a transition system that can easily be generated by a prefixrecognizable system (up to isomorphisms) is h{0, 1}∗, succ0 , succ1 , i (see Example
2.4.1). This, however, cannot be generated by pushdown systems since the nodes inh{0, 1}∗, succ0 , succ1 i have an infinite degree.

Transition systems generated by prefix-recognizable systems can be easily thoughtof as word-automatic systems as follows. Given a prefix-recognizable system P =(ACT, Γ, Q, δ), let Ω := Q∪Γ. We define a transition system S′P = hQΓ∗ , {→′a }a∈ACT iin the same way as in the previous example. In other words, we interpret each configuration (q, u) of P as the word qu ∈ QΓ∗ . It is easy to see that the new transition system

S′P is isomorphic to SP . Furthermore, the isomorphism function can be computed inlinear time. Similarly, it is not hard to see that S′P is automatic for which a presentation
can be computed in time O(|Q ∪ Γ|2 + kP k). The construction for the NWAs for each→′a is a simple adaptation of the construction in the previous example. In the sequel,
when the meaning is clear from the context, we shall use the term “prefix-recognizable
system” to refer to either of these representations of prefix-recognizable systems. ♣Example 3.1.4 Counter machines [Min67] are a well-known Turing-powerful modelof computation. We shall now define the notion of counter systems, which are simply
counter machines without initial and final states. A k-counter system M over the actionalphabet ACT is a tuple (ACT, X , Q, ∆) where• X is a set of k (counter) variables, say {x1 , . . . , xk },• Q is a set of states,• ∆ is a finite set of instructions of the form ((q, ϕ(X )), a, (q′, i1 , . . . , ik )), where:Chapter 3. Word/Tree-automatic Systems

61– q, q′ ∈ Q,
– a ∈ ACT,
– each i j is a number in {−1, 0, 1}– ϕ(X ) is a (guard) Presburger formula of the form
Y ⊆ X and ∼x ∈ {=, >}.

x∈Y x ∼x 0 for someV

A configuration of M is a tuple (q, n1 , . . ., nk ) ∈ Q × Nk expressing the state M is inand the current values of the k counters. Given two configurations c1 = (q, n1 , . . ., nk )and c2 = (q′ , n′1 , . . . , n′k ), we write c1 →a c2 if there exists an instruction((q, ϕ(X )), a, (q′, i1 , . . . , ik ))such that the guard formula ϕ(n1 , . . . , nk ) is true in hN, +i, and for each j = 1, . . ., kwe have n j = max(0, n j + i j ). In other words, when the counter value is 0, it stays 0

when M tries to substract 1 from it. The transition system generated by M is simply
SM := hS, {→a}a∈ACT i, where S ⊆ Q × Nk is the set of all configurations of M and→a is the one-step reachability relation via action a that we just defined. It is well-known that the reachability problem for counter systems (i.e. checking whether agiven configuration c2 of a counter system M is reachable in SM from another given
configuration c1 of M ) is undecidable [Min67].
We can think of transition systems generated by k-counter systems M as automatic
systems in two different ways depending on whether we adopt the standard binary representation of numbers (cf. [Kla08, WB00]), or its reverse (cf. [BC96, BHMV94]).
In the sequel, we shall adopt the reversed binary representation of numbers from[BC96, BHMV94]. More precisely, given a number n, let rev-bin(n) denote thestandard binary representation of n (with unnecessary leading 0s removed) written
in reverse order, e.g., rev-bin(8) = 0001. Given the numbers n1 , . . ., nk ∈ N, define

n1 ⊗0 . . .⊗0 nk as the word rev-bin(n1 ) ⊗ . . .⊗ rev-bin(nk ) with the symbol ⊥ replacedby the symbol 0. For example, 7 ⊗0 8 ⊗0 6 is the word    
1
1
10
    
 0  0  0  1 .
    01
10Therefore, n1 ⊗0 . . . ⊗0 nk is a word over the alphabet {0, 1}k . Define a new alphabetΩ := Q ∪ {0, 1}k . Then, we can define a function χ mapping a given configuration

Chapter 3. Word/Tree-automatic Systems

62c = (q, n1 , . . ., nk ) ∈ Q × Nk of M to the word qw ∈ Ω∗ , where w = n1 ⊗0 . . . ⊗0 nk . We

may therefore think of the set of configurations of M as the set
S := {χ(c) : c ∈ Q × Nk }and the relation →a as the relation→′a := {(χ(c), χ(c′ )) : c →a c′ }.

It is easy to construct an NWA AS for the set S with 2 states in time O(|Q| + 2k ), mostof which is spent in enumerating the letters in the alphabet Ω. Similarly, it is not hard
to construct in time O(|Q|2 × 2k ) an NWA Aa with O(kM k × 2k ) states over Ω2⊥ for→′a . Intuitively, the automaton first nondeterministically guesses a transition in M thatwill be executed and remember it in its finite memory. Upon reading any input letter{0, 1}k × {0, 1}k , it will remember in its finite memory precisely one carry bit for eachof the k counters. ♣Example 3.1.5 Given a Turing machine M = (Σ, Γ, Q, δ, q0, qF , 2), define the transition system SM = hS, →i, where S = Γ∗ (Q × Γ)Γ∗ is the set of all configurations of

M and → is the one-step reachability relation defined by M . The reachability problem

for transition systems generated by Turing machines is well-known to be undecidable.
It is known that transition systems generated by Turing machines are automatic[BG04]. Define Ω := Γ ∪ (Q × Γ). The set S of configurations of M is therefore
regular. We can also easily construct an NWA for the relation → ⊆ S × S since M

makes only local changes at each step (i.e. at most three cells and the state of M ). In
fact, this automatic presentation for SM can be computed in time polynomial in kM k.
♣

3.1.3 Basic closure and algorithmic results
Given v1 , . . . , vn ∈ Σ∗ , let us write vi = ai,1 . . . ai, ji for each i = 1, . . . , n. Letting m =max( j1 , . . . , jn ), we define v1 ⊗ . . . ⊗ vn as the word c1 . . . cm over the alphabet Σn⊥where, for each k = 1, . . . , m, ck := (c1,k , . . ., cn,k ) and(ai,kif k ≤ ji
ci,k :=⊥
if ji < k ≤ m.

An r-ary relation R ⊆ (Σ∗ )r is said to be regular if the language{v1 ⊗ . . . ⊗ vr : (v1 , . . . , vr ) ∈ R}

Chapter 3. Word/Tree-automatic Systems

63

is regular. Observe that this definition generalizes our earlier definition of binary regular relations. As before, we do not distinguish a relation and its language representation.
Definition 3.1.2 A Σ∗ -automatic structure over the vocabulary σ is a σ-structure S =hS, {Ra}a∈σ i where S is a regular language over Σ and Ra is an AR(a)-ary regular

relation over S. A σ-structure is said to be automatic if it is Σ∗ -automatic for somealphabet Σ.
An automatic presentation η of a Σ∗ -automatic structure Sη = hS, {Ra}a∈σ i is a tuple hAS , {Aa }a∈σ i, where AS is an NWA over Σ with L (AS ) = S and Aa is an NWA
AR (a)

over Σ⊥such that L (Aa ) = Ra . A σ-structure is said to be (word-)automaticallypresentable if it is isomorphic to an automatic structure over σ. Remark 3.1.1 for our
definition of automatic systems also holds for our definition of automatic structures.
Example 3.1.6 Presburger arithmetic hN, +i is well-known to be {0, 1}∗-automatic(via the reverse binary encoding of numbers; see Example 3.1.4). In fact, the extension hN, +, |2i with the binary relation |2 is automatic, where for all n, m ∈ N,

n |2 m iff n divides m and n = 2k for some k ∈ N. The structure hN, +, |2 i is also

known as Büchi Arithmetic. See [BGR10, Blu99, BHMV94] for more details. The

structure h{0, 1}∗ , succ0 , succ1 , i = h{0, 1}∗, succ0 , succ1 , i is also word-automatic[Blu99, BG04]. In fact, it is still automatic even when extended with an equal-length

binary relation el defined in Example 3.1.1. For more examples, see the recent survey[BGR10]. ♣The following closure properties are well-known.
Proposition 3.1.1 ([Hod83]) Given an automatic presentation η of an automatic structure Sη = hS, {Ra}a∈σ i over the vocabulary σ and a first-order query υ(x̄) ← ϕ(ȳ) overσ, the relation [[υ]]Sη is effectively regular.

We shall next sketch a standard proof of this proposition in some details as it will be
used in the sequel as a backbone of a more complex construction.
Proof Sketch. We shall adopt NWAs as representations of regular languages. Supposethat η = hAS , {Aa }a∈ACT i. Inductively on the structure of the query body ϕ(ȳ), weshall construct an NWA over Σm⊥ , where m = AR (υ), such that for all v1 , . . . , vm ∈ S, it

is the case that

(v1 , . . . , vm ) ∈ [[υ]]Sη

⇔

v1 ⊗ . . . ⊗ vm ∈ L (Aϕ ).

Chapter 3. Word/Tree-automatic Systems

64

An NWA for [[υ]]Sη can later be obtained by taking a product of Aϕ with the regular
set Lm := S| ⊗ .{z. . ⊗ S}, for which an NWA of size kAS km can be easily constructed.
m times• Base case: ϕ := Ra (xi1 , . . . , xir ) for an r-ary relation Ra and some (not necessarily
distinct) indices 1 ≤ i1 , . . . , ir ≤ m. If Aa = (Σr⊥ , Q, δ, Q0 , F) is the NWA for Ra′
in the presentation η, then we construct the NWA Aυ = (Σm⊥ , Q, δ , Q0 , F) whereδ′ (q, (a1, . . . , am )) := δ(q, (ai1 , . . ., air )).
Therefore, we have L (Aυ ) ∩ Lm = [[υ]]. Note that kAυ k = kAa k. The time taken
to construct Aυ is clearly. O(|Σ|m × kAa k).

• Inductive case: ϕ := ¬ψ(xi1 , . . . , xir ) for some indices 1 ≤ i1 , . . . , ir ≤ m. Define
the new queryυ′ (x1 , . . . , xm ) ← ψ(xi1 , . . . , xir ).
Let Aυ′ be an NWA such that L (Aυ′ ) ∩ Lm = [[υ′ ]] which can be obtained byinduction. To obtain an NWA Aυ such that L (Aυ ) ∩ Lm = [[υ]], we determinize

and then complement Aυ′ . The number |States(Aυ )| of states of Aυ′ is at most
exponential in the number |States(Aυ′ )| of states of Aυ′ . It follows that kAυ k ≤22|States(Aυ′ )| . The time taken to construct Aυ is 2O(|States(Aυ′ )|+m log(|Σ|)) on top of
the time taken to construct Aυ′ .
• Inductive case: ϕ := ϕ′ (xi1 , . . . , xis ) ∨ ϕ′′ (x j1 , . . ., x jr ) for some indices1 ≤ xi1 , . . ., xis ≤ m

and1 ≤ j1 , . . . , jr ≤ m.

Define new queries
υ′ (x1 , . . ., xm ) ← ϕ′ (xi1 , . . ., xis )andυ′′ (x1 , . . . , xm ) ← ϕ′′ (x j1 , . . ., x jr ).
By induction, we can construct the NWAs Aυ′ and Aυ′′ such that

L (Aυ′ ) ∩ Lm = [[υ′ ]],L (Aυ′′ ) ∩ Lm = [[υ′′ ]].
To obtain an NWA Aυ such that L (Aυ ) ∩ Lm = [[υ]], we simply perform NWA

union of Aυ′ and Aυ′′ . It follows that kAυ k = kAυ′ k + kAυ′′ k. The time taken to

construct Aυ is O(|Σ|m × (kAυ′ k + kAυ′′ k)) on top of the time taken to construct

Aυ′ and Aυ′′ .

Chapter 3. Word/Tree-automatic Systems

65• Inductive case: ϕ := ϕ′ (xi1 , . . . , xis ) ∧ ϕ′′ (x j1 , . . ., x jr ) for some indices1 ≤ xi1 , . . ., xis ≤ m

and1 ≤ j1 , . . . , jr ≤ m.

This case is identical to the disjunction case, but instead we compute the productautomata. The number of states of the resulting NWA is the product (instead ofsum) of the number of states of the two NWAs obtained from induction. Such isalso the case for the time taken to compute the NWA for [[υ]].
• Inductive case: ϕ := ∃yϕ′ (xi1 , . . ., xir , y) for some indices 1 ≤ xi1 , . . ., xir ≤ m. By

induction, we can construct an NWA Aυ′ such that L (Aυ′ ) ∩ Lm+1 = [[υ′ ]], where

υ′ is defined as

υ′ (x1 , . . . , xm , y) ← ϕ′ (xi1 , . . . , xir , y).
Observe that [[υ]] = {(v1 , . . ., vm ) : ∃u ∈ S((v1 , . . . , vm , u) ∈ [[υ′ ]])}. Therefore,

we need to construct a new NWA Aυ′ ′ from Aυ′ in such a way that L (Aυ′ ) ∩(Lm × Σ∗⊥ ) = [[υ′ ]]. More precisely, suppose that AS = (Σ, Q2 , δ2 , Q20 , F2 ). Let

AS′ = (Σm+1 , Q2 , ∆, Q20 , F 2 ) be the NWA such that (q, (a1, . . ., an , an+1 ), q′ ) ∈ ∆iff (q, an+1 , q′ ) ∈ δ2 . Taking a product of Aυ′ and AS′ , we obtain an NWA
′
′
′ ′
′
∗
′
Aυ′ ′ = (Σm+1⊥ , Q , δ , Q0 , F ) such that L (Aυ′ ) ∩ (Lm × Σ⊥ ) = [[υ ]]. We now shallconstruct an NWA Aυ = (Σm⊥ , Q, δ, Q0 , F) such that L (Aυ ) ∩ Lm = [[υ]] as follows:– Q := Q′ ,– Q0 := q′0 ,– for each q ∈ Q and a1 , . . . , am ∈ Σ⊥ , letδ(q, (a1, . . . , am )) :=[δ′ (q, (a1, . . . , am , a)),

a∈Σ⊥

and
– let F be the set of states q ∈ Q′ from which there exists a path π in Aυ′ onsome word w ∈ ({⊥}m × Σ)∗ to some state in F.

Such a construction is commonly known as NWA projection. Obviously, we
have F ⊆ F ′ but they might not necessarily coincide. The reason for this defini-tion of F is simply that, given (v1 , . . . , vm ) ∈ [[υ]], the word u such that
(v1 , . . ., vm , u) ∈ [[υ′ ]]Chapter 3. Word/Tree-automatic Systems

66

might have length greater than max(v1 , . . . , vm ). Furthermore, the set F can becomputed by the standard algorithm for testing nonemptiness for NWAs, which
requires only linear time. Note that Aυ = kAυ′ k × kAS k. The time taken to

construct Aυ is at most O(|Σ|m+1 × kAυ′ k × kAS k) on top of the time taken to
construct Aυ′ .

This completes our proof of the proposition. 2
It is easy to see that the aforementioned construction runs in nonelementary time.
Clearly, the most expensive operation in the construction is complementation, whichyields a DWA of exponential size. In contrast, NWA projection takes only linear time.
A more careful analysis of the aforementioned construction, however, reveals that thebottleneck of the complexity of the construction comes from the number of alternations between negations and existential quantifiers in the given first-order formula: theformer turns an NWA into a DWA of exponential size (for which all boolean operations can be easily done), but the latter turns a DWA back into an NWA (for which
complementation is expensive).
A better complexity can be obtained for the above proposition when restricting
to simpler fragments of first-order logic. The most commonly used fragment in thesequel is the class of conjunctive queries, i.e., first-order queries υ(x̄) ← ∃y1 , . . . , yn ϕ,where ϕ is simply a conjunction of atomic formulas. The following proposition can beobtained in a straightforward way by applying the proof of Proposition 3.1.1.
Proposition 3.1.2 Let
υ(x1 , . . . , xm ) ← ∃y1 , . . . , yn ϕbe a conjunctive query over σ, where
ϕ = Ra1 (z1 ) ∧ . . . ∧ Rak (zk )is a conjunction of atomic formulas, where zi ⊆ x̄ ∪ ȳ for each i = 1, . . ., k and eachvariable in x̄ occurs in one of zi at least once. Given a presentation η = hAS , {Aa }a∈σ i
of the Σ∗ -automatic structure Sη , an NWA Aυ accepting [[υ]]Sη of size O ∏ki=1 kAi k
can be computed in time O |Σ|m+n × ∏ki=1 kAi k .

Example 3.1.7 In this example, we show how the above Proposition can be used toprove that the reachability relation of a transition system is “efficiently” interdefinable with the strict reachability relation, provided that they are regular. Suppose thatSη = hS, {→a}a∈ACT i is a Σ∗ -automatic transition system over ACT, presented by theChapter 3. Word/Tree-automatic Systems

67

presentation η = h{AS }, {Aa }a∈ACT i. Since regular languages are closed under union,S
the relation →= a∈ACT →a is recognized by an NWA N of size ∑a∈ACT kAa k andis computable in time O(|Σ|2 × ∑a∈ACT kAa k). As we shall see later, the reachability
∗S
relation →∗ = a∈ACT →a and the strict version →+ are in general not regular (infact, not even recursive).

Suppose, however, that →∗ is regular and is recognized by the NWA R . Ob-

serve now that Proposition 3.1.2 implies that the strict reachability relation →+ isalso regular, for which an NWA R ′ of size O(kN k × kR k) is computable in timeO(|Σ|3 × kN k × kR k). This is because the relation →+ is definable in the new structure S′ = hS, →, →∗i as follows: x →+ y ⇔ ∃z(x → z ∧ z →∗ y). Conversely, if →+is regular and is recognized by the NWA R , then so is the relation →∗ since →∗ isnothing but the union of → and →+ . This also implies that an NWA for →∗ of size

O(kN k + kR k) is computable in time O(|Σ|2 × (kN k + kR k)). ♣It turns out that the above proposition easily extends to the more general class ofexistential positive first-order formulas.
Proposition 3.1.3 Letϕ(y1 , . . . , ym ) = ∃x1 , . . . , xn ψ(x1 , . . . , xn , y1 , . . ., ym )bet a first-order formula over the vocabulary σ, where ψ is a positive boolean combination of atomic propositions with h conjunctions. Given an automatic presentation
η of an automatic structure Sη , an NWA Aϕ accepting [[ϕ]]Sη is computable in timepolynomial in kηk and kψk, but exponential in h and n + m.

3.1.4 Negative results
It turns out that the nonelementary complexity of the construction above is unavoidable[BG04, Grä90], even when the input formula has no free variables.
Proposition 3.1.4 There exists an automatic structure whose first-order theory has
nonelementary complexity.
A simple example of an automatic structure with nonelementary first-order theory is
S2S with descendant [CH90]. Since transition systems of Turing machines are automatic, the following proposition due to [BG04] is immediate.

Chapter 3. Word/Tree-automatic Systems

68

Proposition 3.1.5 ([BG04]) The reachability problem for automatic transition systems is undecidable. In fact, it is Σ01 -complete even for a fixed automatic transition
system.
In fact, the Σ01 -hardness lower bound follows from the fact that the transition systems
generated by counter machines and Turing machines are automatically presentable.
The upper bound is owing to the fact that reachability for automatic transition systems has a finite witness that can be effectively checked. We now adapt the proof of
Proposition 3.1.5 to show that for the problem of checking recurrent reachability for
automatic transition systems is much harder: given a presentation η of an automatic
system Sη = hS, {→a}a∈ACT i, an initial configuration s0 ∈ S, and an NWA A , decide
whether s0 ∈ Rec(L (A ))[→+].

Proposition 3.1.6 The recurrent reachability problem for automatic transition systems
is Σ11 -complete.
Proof. To prove Σ11 -hardness, we establish a many-to-one reduction from the recurrent
state properties for nondeterministic Turing machines: given an NTM

M = (Σ, Γ, Q, δ, q0, qF )and a state q ∈ Q, check whether M have an infinite computation path visiting thestate q infinitely often. This problem is known to be Σ11 -complete (e.g. see [Har86,

Corollary 6.2]). Therefore, we may use the construction of automatic presentation η
for the transition system SM = hS, →i generated by M from Example 3.1.5, whichworks as well for NTMs. Therefore, M has an infinite computation path visiting q
infinitely often iff (q0 , 2) ∈ Rec(Γ∗ ({q} × Γ)Γ∗)[→]. This completes the reduction.

One way to prove membership in Σ11 is to establish a many-to-one reduction to the

problem of recurrent state properties for NTMs. More precisely, given a presentation
η = hAS , {→a}a∈ACT i for the Ω∗ -automatic system Sη = hS, {→a}a∈ACT i, an initialconfiguration v0 ∈ S, and an NWA AF over Ω for a set F ⊆ S, we construct the NTM

M that has a special state q that is visited iff a signalling bit b is turned “on”. The
machine M initially replaces the input word on the tape with v0 , turns “off” the bitb, and begins “exploring” the transition system Sη from v0 . At each stage of M ’s
computation, M will remember on the tape a word w ∈ Ω∗ that is reachable fromv0 , and a bit b signalling whether w ∈ F. If w ∈ F is signalled, then M will visit
the state q and then turn off the bit b before resuming the exploration of Sη from

Chapter 3. Word/Tree-automatic Systems

69

the currently remembered configuration w. If w ∈/ F, the NTM M will resume theexploration of Sη without first visiting the state q. After this, the machine M will
nondeterministically write down a word w′ ∈ Ω∗ on the tape. Note that this step of M

might not terminate, but is not important as the resulting infinite computation path will
not visit q infinitely often. In the case when M terminates with w′ fully written on thetape, M checks whether w → w′ , which could be easily done since an NWA for → canbe easily constructed. If w → w′ , then M will set w := w′ , adjust the value of the bit b

according to whether w′ ∈ L, and continue to the next stage. If w 6→ w′ , the M simply

enters a halting state. Finally, it is easy to check that v0 ∈ Rec(F) iff the NTM M has

an infinite computation path visiting q infinitely often on the empty input. 2

Let us briefly revisit the proof of this proposition. For the proof, it is important that the
NWA A in the input has an infinite language. In fact, if A recognizes a finite language,by pigeonwhole principle one of the configurations in L (A ), say s, must be visited
infinitely often. This means that there exists finite witnesses for positive instances (i.e.
a path from the initial configuration s0 to s, and a path from s to itself), and therefore
is recursively enumerable.

3.2 Tree-automatic systems
In this section, we review the basic definitions and results for tree-automatic systems[BLN07, Blu99, BG04]. We refer the reader to [Bar07, BGR10] for a more up-to-date
exposition of the subject.

3.2.1 Basic definitions
The notion of tree-automatic systems is to a large extent similar to word-automatic systems, except that we use NTAs instead of NWAs to represent the domain and the transition relations of the systems. To make this notion more precise, we define the convolution operation ⊗ over T REE k (Σ) as follows: given two trees T1 , T2 ∈ T REE k (Σ) with
T1 = (D1 , τ1 ) and T2 = (D2 , τ2 ), let T1 ⊗ T2 be the k-ary tree (D, τ) over the alphabetΣ⊥ × Σ⊥ , where Σ⊥ := Σ ∪ {⊥} with ⊥∈/ Σ, such that D = D1 ∪ D2 and τ(u) = (a1 , a2 )where ai = τi (u) if u ∈ Di , or else ai =⊥. Observe that this is a simple generaliza-tion of the word case. Figure 3.1 illustrates how this operation works. A relation
R ⊆ T REE k (Σ) × T REE k (Σ) is said to be tree-regular (or simply regular) if the lan-

guage {T1 ⊗ T2 : (T1 , T2 ) ∈ R} is tree-regular.

Chapter 3. Word/Tree-automatic Systemsaab(a, c)

c
a

b

70

⊗ a

b
b

=

(b, a)(a, ⊥)(b, ⊥)(a, b)(⊥, b)

Figure 3.1: A specific example illustrating the convolution operation on binary trees

Example 3.2.1 The identity relation = on T REE k (Σ) is obviously tree-regular. In fact,
it can be recognized by an NTA with one state q, which only has transitions of theform (q, (a, a), q, q, . . ., q) for a ∈ Σ. Similarly, the equal tree-domain relation ≈dom on

T REE k (Σ) (i.e. that two trees have the same tree domain but possibly different label-ings) is also tree-regular, for which an NTA with one state could be easily constructed.
The tree extension relation  on T REE k (Σ) is also easily seen to be regular. In fact, one

may construct an NTA for  with precisely two states and at most O(2|Σ|) transitions.

♣

As in the case of word-automatic systems, we shall not distinguish a relation andits language representation. Let us now summarize the definition of tree-automatic
systems.
Definition 3.2.1 A transition system S = hS, {→a}a∈ACT i is said to be T REE k (Σ)-

automatic if S is a regular tree language over T REE k (Σ) and each →a ⊆ T REE k (Σ) ×

T REE k (Σ) is a tree-regular relation. The system S is said to be tree-automatic if it is

T REE k (Σ)-automatic for some k and Σ.
A presentation of a T REE k (Σ)-automatic system hS, {→a}a∈ACT i is a tupleη = hAS , {Aa }a∈ACT i,
where AS is an NTA over T REE k (Σ) and each Aa an NTA over T REE k (Σ) × T REE k (Σ),
such that L (AS ) = S and L (Aa ) = {T ⊗ T ′ : T →a T ′ } for each a ∈ ACT. We shall use
the notation Sη to denote the tree-automatic transition system of which η is a presen-tation. A transition system S′ over ACT is said to be tree-automatically presentable
if it is isomorphic to some tree-automatic system S over ACT. Clearly, the class oftree-automatic (resp. tree-automatically presentable) systems subsumes the class ofword-automatic (resp. word-automatically presentable) systems.
Remark 3.2.1 Just as in the case of word-automatic systems, our definition of treeautomatic systems is slightly different from the common definition in the literatureChapter 3. Word/Tree-automatic Systems

71

of automatic structures (e.g. see [BG04]); the latter coincides with our definition oftree-automatically presentable systems. Nonetheless, both approaches are equivalent
since we are only interested in verification problems, instead of the expressive powerof certain logics. 

3.2.2 Examples
We now give two examples of tree-automatic transition systems; more will be given in
subsequent chapters.
Example 3.2.2 A ground tree rewrite system (GTRS) over ACT (cf. [DT90, Löd03])
is a tuple P = (k, Σ, ∆), where• k is a positive integer,• Σ is a labeling alphabet, and• ∆ is a finite set of rewrite rules of the form (t, a,t ′), where t,t ′ ∈ T REE k (Σ) anda ∈ ACT.

The GTRS P gives rise to a transition system SP = hS, {→a}a∈ACT i where S :=T REE k (Σ) and, for all trees T, T ′ ∈ T REE k (Σ) where T = (D, τ), we have T →a T ′ ifffor some rewrite rule (t, a,t ′) ∈ P and u ∈ D it is the case that t is a subtree of T rooted

at u and T ′ = T [t ′/u]. It is easy to see that ground tree rewrite systems generalize
pushdown systems in their expressive power as generators of transition systems.

Transition systems generated by GTRSs can be easily construed as tree-automatic
systems as follows. Given a GTRS P = (k, Σ, ∆), let SP = hS, {→a}a∈ACT i be thetransition system generated by P . It is easy to produce an NTA that recognizes each→a . More precisely, an NTA Aa for →a can be either in a “guessing mode”, “idlemode”, or “checking mode”. Suppose T ∈ T REE k (Σ2⊥ ) is the input tree to Aa , and letvirt(T ) = (D, τ) and u ∈ D. When Aa is an idle mode, it simply ensures that the subtree
rooted at u is an identity relation (i.e. the subtree rooted at u when projected onto thefirst component coincides with the subtree rooted at u when projected onto the second
component). When Aa is in guessing mode, it nondeterministically guesses (with εtransitions) whether the current node is the root of the subtree where the rewriting
takes place. When the guess is negative, Aa chooses one of its children to “pass on”
the guessing mode, while the rest of the children are to be in idle mode. When the guessis positive, it instantaneously switches to a checking mode. Then Aa chooses a rewriteChapter 3. Word/Tree-automatic Systems

72

rule (t, a,t ′) ∈ δ encoded in its finite memory and ensures that the subtree rooted at u

when projected onto the first component coincides with t (minus the padding symbol),and when projected onto the second component coincides with t ′ (minus the padding
symbol). This can be done by simultaneously verifying the two components.The final
states are declared to be the union of the idle state and the states after successful checks
have been made.
Let us now measure the computation time to produce a tree-automatic presentation
for the transition systems generated by GTRSs. Analyzing the algorithm above, it iseasy to see that the NTA over T REE k (Σ2⊥) that recognizes the one-step reachability isof size O(kP k) and can be computed in time O(|Σ|2 × kP k). In other words, these two
representations of ground tree rewrite systems are polynomially equivalent. Therefore,

in the sequel we shall use the term “ground tree rewrite systems” to refer to either ofthese representations. ♣Example 3.2.3 We now present a generalization of ground tree rewrite systems called
regular ground tree rewrite systems (RGTRSs) (cf. [DT90, Löd03, Löd06]). Intuitively,
RGTRSs extend ground tree rewrite systems in the same way prefix-recognizable systems extend pushdown systems. More precisely, a regular ground tree rewrite system(RGTRS) over ACT is a tuple P = (k, Σ, ∆), where k and Σ are the same as for GTRS and∆ is a finite set of rules of the form (A , a, A ′), where A and A ′ are NTAs over T REE k (Σ)
and a ∈ ACT. This GTRS P gives rise to a transition system SP = hS, {→a}a∈ACT i

where S = T REE k (Σ) and, for all trees T, T ′ ∈ T REE k (Σ) where T = (D, τ), we have

T →a T ′ iff for some rewrite rule (A , a, A ′ ) ∈ ∆, a tree t ∈ L (A ), a tree t ′ ∈ L (A ′ ),and a node u ∈ D it is the case that t is a subtree of T rooted at u and T ′ = T [t ′ /u]. It

is known (cf. [Löd03]) that RGTRSs subsume prefix-recognizable systems, although
the latter could be exponentially more succinct than the former.
It is not difficult to see that transition systems generated by RGTRSs are treeautomatic. This can be proven in the same way as for GTRSs, e.g., for the verification
stage, we can do product construction. It is easy to see that the resulting NTA over
T REE k (Σ2⊥) is of size O(kP k2 ) and can be computed in time O(|Σ|2 × kP k2 ). In otherwords, these two representations of RGTRSs are polynomially equivalent. Therefore,
we shall not distinguish them in the sequel. ♣Chapter 3. Word/Tree-automatic Systems

73

3.2.3 Basic closure and algorithmic results
We now generalize the convolution operator ⊗ to take n trees (n ∈ Z≥1 ). Given k-ary

trees T1 = (D1 , τ1 ), . . ., Tn = (Dn , τn ) over the labeling alphabet Σ, we define T1 ⊗ . . . ⊗Tn to be the k-ary tree T = (D, τ) over the labeling alphabet Σn⊥ , where Σ⊥ = Σ ∪ {⊥}and ⊥∈/ Σ, such that
• D=

Sn

i=1 Di , and• for each u ∈ D, it is the case that τ(u) = (a1 , . . . , an ), where(τi (u)
if u ∈ Di ,ai =⊥otherwise.
Observe that when n = 2 this definition coincides with the 2-ary convolution operator
for T REE k (Σ) that we defined earlier. An n-ary relation R over T REE k (Σ) is said to betree-regular (or simply regular) if the language{T1 ⊗ . . . ⊗ Tn : (T1 , . . . , Tn ) ∈ R}
is tree-regular. As before, we do not distinguish a relation and its language representation.
Definition 3.2.2 A T REE k (Σ)-automatic structure over the vocabulary σ is a structure
S = hS, {Ra}a∈σ i, where S is a tree-regular language over T REE k (Σ) and Ra an AR (a)-regular relation on S. A σ-structure is said to be tree-automatic if it is T REE k (Σ)automatic for some integer k > 0 and labeling alphabet Σ.
A presentation η of a tree-automatic structure Sη = hS, {Ra}a∈σ i is a simply tuple

hAS , {Aa }a∈σ i, where AS is an NTA over T REE k (Σ) with L (AS ) = S and Aa is an NTA
over T REE k (Σn⊥ ) (where n = AR (a)) such that L (Aa) = Ra . A σ-structure is said to betree-automatically presentable if it is isomorphic to a tree-automatic structure over σ.

Remark 3.2.1 for our definition of tree-automatic systems also holds for our definitionof tree-automatic structures.
Example 3.2.4 It is easy to see that every Σ∗ -automatic structure is a T REE 1 (Σ)automatic structure. We now give two tree-automatically presentable structures which
are not word-automatically presentable. The first is the structure (N, ×) over natural numbers with multiplication (i.e. Skolem arithmetic). Each positive integer canbe uniquely decomposed into a product of primes, say, pa11 . . . pann , where pi is the ithChapter 3. Word/Tree-automatic Systems

◦
1

◦
0

◦
◦

0
0

1

◦

74

◦

◦

0
◦

1

1

1

◦
1

Figure 3.2: Tree representation of the numbers 2,3,5, and 60.

prime and an > 0. We may then represent each positive integer as a binary tree over thelabeling alphabet {0, 1, ◦}, whose ith branch corresponds to the reverse binary repre-

sentation of ai . For example, the number 2,3, 5 and 60 can be represented as the trees
in Figure 3.2. The ternary relation × can then be recognized by an NTA which sepa-

rately runs the NWA for adding numbers on each branch (it is easy to treat the number
0 as a separate case). See [BGR10] for more details. Another example is the structurehT REE k (Σ), , ≈dom i, with the tree extension relation  and the equal tree domain re-lation ≈dom . Furthermore, it is still tree-automatic when we extend this structure withthe binary relations succai (1 ≤ i ≤ k and a ∈ Σ), which extend each leaf of a tree by its

ith child labeled a. See [BLN07] for more details. For more examples, see the recent
survey [BGR10]. ♣Just as for the case of word-automatic structures, the images of a tree-automatic
structure under a first-order query is also effectively tree-regular. The proof of thisresult is identical to the word case and so is omitted.
Proposition 3.2.1 Given a presentation η of a tree-automatic structureSη = hS, {Ra}a∈σ iover the vocabulary σ and a first-order query υ(x̄) ← ϕ(ȳ) over σ, the relation [[υ]]Sη

is effectively tree-regular.

Just as in the case of word-automatic structures, a better complexity can be obtained
when restricting to conjunctive queries.
Proposition 3.2.2 Let
υ(x1 , . . . , xm ) ← ∃y1 , . . . , yn ϕbe a conjunctive query over σ, where
ϕ = Ra1 (z1 ) ∧ . . . ∧ Rah (zh )Chapter 3. Word/Tree-automatic Systems

75

is a conjunction of atomic formulas, where zi ⊆ x̄ ∪ ȳ for each i = 1, . . ., h. Given a pre-sentation η = hAS , {Aa }a∈σ i of the T REE k (Σ)-automatic structure Sη , an NTA Aυ ac
cepting [[υ]]Sη of size O ∏hi=1 kAi k can be computed in time O |Σ|m+n × ∏hi=1 kAi k .
Example 3.2.5 Just as in the case of word-automatic systems, Proposition 3.2.2 canbe used to show that reachability relations and strict reachability relations for treeautomatic systems are polynomially interdefinable. See Example 3.1.7. ♣3.2.4 Negative results
Finally, since tree-automatic transition systems generalize word-automatic transition
systems, the negative results from word-automatic transition systems carry over totree-automatic transition systems. The Σ01 and Σ11 upper bounds for, respectively, reachability and recurrent reachability also easily carry over to the automatic case.

3.3 Other generic frameworks
In this section, we shall briefly discuss several other generic frameworks that havebeen considered in the literature and compare them with word/tree automatic transition
systems. In particular, we will mention length-preserving word-automatic systems,
rational transition systems, Presburger-definable transition systems, and ω-automatictransition systems.

3.3.1 Length-preserving word-automatic transition systems
A relation R ⊆ Σ∗ × Σ∗ is said to be length-preserving if (v, w) ∈ R implies |v| = |w|.
A word-automatic system S = hS, {→a}a∈ACT i is said to be length-preserving if eachrelation →a is length-preserving. The class of length-preserving word-automatic sys-

tems are commonly considered in the literature of regular model checking (e.g. see[AJNS04, Bou01, BJNT00, BHV04, JN00, Nil05]), which aims to develop semialgorithms for dealing with various verification problems over generic frameworks
where the domains are represented as words or trees over some alphabet2 . Lengthpreserving automatic systems are known to be suitable for modeling parameterized
2 Despite this, nowadays the term “regular model checking” seems to almost exclusively mean model
checking over length-preserving word-automatic systems

Chapter 3. Word/Tree-automatic Systems

76

systems, which are simply distributed protocols with a finite, but unbounded, numberof processes (e.g. the thesis [Nil05] gives many examples).
Most verification problems for length-preserving word-automatic systems are always defined slightly differently in such a way that words of every length will haveto be considered simultaneously. For example, to check safety for parameterized systems, it is necessary to be able to compute post ∗(L (A )) or pre∗ (L (A )) for an arbitrary NWA A . Note that, unlike in the case of general word-automatic systems,
computing post ∗(s0 ) and pre∗ (s0 ), for any given word s0 ∈ Σ∗ , is decidable since there

are at most 2O(|s0 |) reachable configurations from s0 . In fact, this simple observation generalizes to most verification problems (e.g. temporal logic model checking)when considered over length-preserving automatic transition systems. On the other
hand, the set post ∗(L (A )) and pre∗ (L (A )) need not be regular nor computable ingeneral since it can be used to solve the halting problems for Turing machines (e.g. see[AJNS04, BJNT00, Nil05]).
So, how general is length-preserving automatic systems compared to the class of
all word-automatic systems? Which verification problems for the general class of all
word-automatic systems can be reduced to the length-preserving case? We have seen
an answer to the first question: length-preserving automatic systems indeed are a general class of infinite systems, although there are only finitely many reachable configurations from any given configuration. Let us now briefly answer the second question.
A verification problem for the class of all word-automatic systems that involves only
finite paths can in some sense be reduced to a variant of the problem over lengthpreserving automatic systems. This includes checking reachability (i.e. safety). The
reduction is done by treating the padding symbol ⊥ as a letter in the domainof the"#system and composing each resulting transition relation with the language⊥⊥∗. Thatway, checking whether a configuration v can reach another configuration w can be
reduced to checking whether w ⊥∗ ⊆ post ∗(v ⊥∗ ) in the resulting length-preserving

automatic system. In contrast, such a reduction cannot be done for liveness problems

including recurrent reachability or for temporal logic model checking. To explain this,consider as an example the problem of checking whether, for two given NWAs A andA ′ over the alphabet Σ and a length preserving Σ∗ -automatic system S, there exists
a configuration v (or for each configuration v) in the language L (A ) for which it is
the case that v ∈ Rec(L (A ′ )) is satisfied in S. Since there are only finitely manyreachable configurations from any given configuration v, the infinite path witnessingv ∈ Rec(L (A ′)) in S must eventually loop at some configuration v′ ∈ L (A ′ ). In fact, itChapter 3. Word/Tree-automatic Systems

77

is easy to see that this problem is r.e. or co-r.e., which is in contrast to the highly undecidable problem of recurrent reachability for the class of all word-automatic systems(see Proposition 3.1.6). This gives a theoretical justification that length-preserving automatic transition systems are not suitable for dealing with liveness and temporal logic(e.g. LTL) model checking since most interesting classes of infinite-state systems (e.g.
pushdown systems) could easily generate a simple infinite path.

3.3.2 Presburger transition systems
Presburger transition systems are transition systems whose domains and transition relations are definable in Presburger arithmetic. More precisely, a Presburger transition
system is a transition system S = hS, {→a}a∈ACT i, where for some first-order for-mulas ϕ(x1 , . . . , xk ) and ψa (x1 , . . . , x2k ) over hN, +i, for each a ∈ ACT, it is the casethat

• S = {(i1 , . . ., ik ) ∈ Nk : hN, +i |= ϕ(i1 , . . . , ik )}, and• for all tuples (i1 , . . . , ik ), ( j1, . . . , jk ) ∈ Nk , we have (i1, . . . , ik ) →a ( j1 , . . ., jk ) iff
hN, +i |= ψa (i1, . . . , ik , j1 , . . . , jk ).

A transition system is said to be Presburger-presentable if it is isomorphic to a Presburger transition system. Every presburger transition system is word-automatic [BG04,
BHMV94] since the structure hN, +i is word-automatic (as we saw in Example 3.1.6)

and first-order queries are regularity preserving over automatic structures (Proposition
3.1.1). On the other hand, some word-automatic systems are not even Presburgerpresentable. For example, it can be seen that the word-automatic transition systemh{0, 1}∗, succ0 , succ1 , i is not Presburger-presentable since the first-order theory ofh{0, 1}∗, succ0 , succ1 , i has a nonelementary lower bound [CH90, Sto74], while thefirst-order theory of every fixed Presburger-presentable system can be solved in 3-fold
exponential time by any standard algorithm for checking satisfactions in Presburger
arithmetic (e.g. see [Koz06]).
The class of Presburger transition systems (and restrictions thereof) has been con-sidered as generic frameworks for model checking in the literature and many powerfulsemi-algorithms for computing reachable sets and reachability relations using representations of semilinear sets have been fully implemented (e.g. see [Boi99, YKB09,
YKBB05, LAS, ABS01, BFLP08, FL02]). Although the class of Presburger transition
systems is strictly smaller than the class of word-automatic systems, it still subsumes

Chapter 3. Word/Tree-automatic Systems

78

many interesting classes of systems such as Minsky machines and Petri nets, many
subclasses of which we shall encounter in the sequel. One of the most appealing
aspects of the class of Presburger transition systems is that it contains many natural
subclasses whose reachability relations are themselves Presburger-definable. This includes reversal-bounded counter systems [ISD+ 02, Iba78] and their extensions with
one free counter and/or discrete clocks [ISD+ 02, Iba78, DIB+ 00]; and many subclasses of Petri nets [LS04, Esp97b, LS05a].
One reason to consider the full class of word-automatic transition systems insteadof the subclass of Presburger transition systems is that there are natural models of computation whose reachability relations can be captured within word-automatic framework, but not within Presburger framework. Two such models include pushdown systems and prefix-recognizable systems. The framework of Presburger transition systems is not even powerful enough to capture the transition systems that are generated
by prefix-recognizable systems; the system h{0, 1}∗, succ0 , succ1 , i is one such ex-

ample. It turns out that the framework of Presburger transition systems is powerfulenough to capture pushdown systems, although not their reachability relations.
Proposition 3.3.1 Pushdown systems are Presburger transition systems
Proof Sketch. Each configuration (qi , w) ∈ Q × Γ∗ of a pushdown system P with states
Q = {q0 , . . . , qn−1 } and stack alphabet Γ = {0, 1} can be interpreted (in a bijective way)

as a tuple (i, bin(1w)) ∈ N × N. Note that the stack content is interpreted as bin(1w)instead of bin(w) so that w = 000 and w = 0 are not interpreted as the same numbers.
The transition relations →a can also be easily defined as a formula ϕ(x1 , y1 , x2 , y2 )in Presburger arithmetic. Obviously the changes in the finite state unit of P can behandled easily in Presburger arithmetic. To deal with the changes in the stack content,
first observe that testing whether w has a suffix of the form u ∈ {0, 1}∗ expressedusing a sequence of divisibility tests by 2 (at most |u| times), which is expressible in
Presburger arithmetic. For example, to check whether w has a suffix of the form 01
can be done by testing that 2 6 |y1 and 2|⌊y1 /2⌋. The changes in the stack content canalso be deal with using a sequence of divisions and multiplications by 2 (and perhaps
additionally additions/substractions by a 1). 2

3.3.3 Rational transition systems
Rational transition systems are transition systems whose domain is a regular set ofwords over some alphabet (like word-automatic systems) and whose transition rela-Chapter 3. Word/Tree-automatic Systems

79

tions are “rational”, which is a more general notion than regular relations. In order to define the notion of rational systems, we need to first recall the standard notion of finite-state input/output transducers (a.k.a. rational transducers). A rationaltransducer R over the input alphabet Σ is an NWA over the alphabet Σε × Σε , whereΣε = Σ∪{ε}. The" relation
realizedby R consists of precisely all tuples (v, w) ∈ Σ∗ ×Σ∗#"#

where, for some

a1
b1

...

an
bn

∈ L (R ) ⊆ (Σε × Σε )∗ , it is the case that v = a1 . . . an andw = b1 . . . bn . Note that in this case we do not necessarily have |v| = |w| since someof the letters ai ’s and b j ’s might be ε. A simple example of a rational relation is therelation {(an, a2n ) : n ∈ N} over the alphabet Σ = {a}, which can be easily proved to be
not a regular relation by an application of pumping lemma for regular languages. We
refer the reader to the textbook [Ber79] for a more thorough treatment of rational transducers and their basic properties. A rational transition system is a transition system
S = hS, {→a}a∈ACT i, where for some NWA A and rational transducers {Ra }a∈ACT ,it is the case that S = L (A ) and →a is realized by Ra . Rational transducers are alsostudied in the context of natural language processing (e.g. [JM00]).

The class of rational transition systems is more general than the class of wordautomatic transition systems, but is not known to be comparable to the class of treeautomatic transition systems. On the other hand, unlike automatic systems, many simple problems are already undecidable for rational transition systems. For example, it
is undecidable to check whether a rational transition system has a self-loop [Mor00],
which is trivially decidable for word/tree automatic systems since the property can beeasily expressed in first-order logic. Other such problems include checking whether
a transition relation →a in the system is symmetric, reflexive, or transitive [Joh86],
all of which are easily expressible in first-order logic. Despite this, model checking

HM-logic enriched with inverse modality over rational transition systems and regularatomic propositions is decidable [BG09] since the images and preimages of regular
languages under rational relations are effectively regular. A partial technique for computing the transitive closure of rational relations has also been proposed by Dams et al.
in [DLS02].
In summary, although rational transition systems is a natural class of transition
systems and is more general than the class of word-automatic transition systems, itremains to be seen whether it can be used to model natural classes of infinite-statetransition systems with decidable model checking that cannot already be modeled as
word-automatic systems. We also leave it as an open question if the positive results inthis thesis can be extended in some way to the class of rational transition systems.

Chapter 3. Word/Tree-automatic Systems

80

3.3.4 ω-word automatic transition systems
ω-word automatic transition systems can be defined in the same way as word-automatictransition systems, but using NBWAs instead of NWAs. They can be easily seen asa natural generalization of word-automatic transition systems (cf. [Bar07, BGR10,
Blu99, BG04]). They are also known to satisfy most properties which are satisfied
by word-automatic transition systems (e.g. closure under boolean combinations andautomata projections, and decidability of first-order logic). Similar notions can also be
defined for ω-word automatic structures. The class of ω-word automatic structures isquite expressive. For example, they include real numbers with addition hR, +i evenwith an extra test of whether x is an integer [Blu99, BG04] and other interesting pred-icates. It follows that any infinite-state transition system which can be defined in thefirst-order theory of reals (possibly with extra tests for integers) are also ω-automatic.
There are several interesting classes of infinite-state transition systems that are known
to be definable in the first-order theory of the reals including real-timed systems (cf.
[CJ99]). In fact, Comon and Jurski showed that even the reachability relation is definable in the first-order theory of the reals. For these reasons, it is natural to adopt
ω-word automatic transition systems as a generic framework and consider whether
the results in this thesis for word/tree automatic systems can be proven for ω-wordautomatic systems. We leave this as future work.
We shall also mention some partial techniques that have been developed for restrictions ω-word automatic systems. Legay et al. [BLW03, BLW09] have developed semialgorithms for computing reachability relations and LTL model checking for ω-wordautomatic systems when the given automata are weak-deterministic. These results are
orthogonal to the result in this thesis.

Chapter 4
Algorithmic metatheorems forrecurrent reachability
Recall that the problem of recurrent reachability over word (resp. tree) automatic
systems is defined as follows: given a presentation η of a word (resp. tree) automatic
system Sη = hS, {→a}a∈ACT i, an initial configuration s0 ∈ S, and a NWA (resp. NTA)

A (called the “target automaton”), decide whether v0 ∈ Rec(L (A ))[→+]. That is, wewish to decide whether there exists an infinite path from v0 in Sη which visits L (A )infinitely often. The global version of this problem is simply to compute an NWA(resp. NTA) representing the set Rec(L (A ))[→+], if this set turns out to be regular.
These problems are tightly connected with LTL model checking, as we shall see in thenext chapter.
As we mentioned in Proposition 3.1.6, the problem of recurrent reachability is
Σ11 -complete (i.e. highly undecidable) for automatic systems. In this chapter, weshall show that it becomes decidable if we are given an NWA (resp. NTA) representing the reachability relation of the automatic system as part of the input. In fact,stronger results are shown in this chapter. Firstly, it turns out that in this case the set
Rec(L (A ))[→+] is guaranteed to be effectively regular. Secondly, a succinct representation of the witnessing infinite path as nondeterministic Büchi word/tree automata
can also be computed. As an immediate corollary, when we restrict to any subclass

C of word/tree automatic systems for which there exists an algorithm for computing
the reachability relations, we immediately obtain decidability for recurrent reachability
and its global version over C . In this sense, our result is an algorithmic metatheorem
for decidable recurrent reachability. The time complexity of our algorithm is polynomial in the size of the automaton R which represents the reachability relation →+ of81

Chapter 4. Algorithmic metatheorems for recurrent reachability

82

the word/tree automatic system Sη and the size of the target automaton A , on top of
the time taken to produce R from the input presentation η. We shall present our algorithmic metatheorem for word automatic systems in Section 4.1, and for tree-automatic
systems in Section 4.2. In these sections, we shall also give direct applications of ouralgorithmic metatheorems for uniformly deriving a polynomial-time complexity for recurrent reachability and its global version for pushdown systems and (regular) groundtree rewrite systems, and an exponential-time complexity for prefix-recognizable systems. These turn out to be also optimal for the respective classes of systems. These
results are already known in the literature (e.g. see [EKS03, KPV02, Löd03, Löd06]).
In Chapter 6, we will use these algorithmic metatheorems for deriving new decidability results for checking recurrent reachability, e.g., over reversal-bounded counter systems extended with discrete clocks, PA-processes, and order-2 collapsible pushdown
systems.
In Section 4.3, we give an extension of our algorithmic metatheorem for recurrent
reachability to handle generalized Büchi condition: given several automata A1 , . . . , An
(instead of one, as for the original problem) decide whether there exists an infinite path
visiting each of the sets L (A1 ), . . . , L (An) infinitely often. In fact, this extension is acomparatively simple corollary of our algorithmic metatheorem for recurrent reachability over word/tree automatic systems. In this case, the complexity of our algorithm
becomes exponential in n and polynomial in the size of other input parameters, which
we show to be optimal. Using this result, we derive an exponential-time algorithm
for recurrent reachability with generalized Büchi condition for pushdown systems, forwhich we give a PSPACE lower bound, and prefix-recognizable systems and regular
ground tree-rewrite systems, for which we give a matching EXP lower bound. Incidentally, this answers an open question by Löding [Löd06] concerning the decidabilityof recurrent reachability with generalized Büchi conditions1.
In practice, it has been observed (cf. [AJNS04, AJRS06, BFLP08, BLW03, BLW09,
DLS02, Nil05]) that partial techniques for computing the reachability relations overmany generic frameworks have not been as successful in practice as partial techniques
for deriving reachability sets, although recent work by Cook et al. (cf. [CPR06b,
CPR06a]) sheds a light that they could be made practical. In Section 4.4, we study what
we can deduce when we are given an automaton R which represents an over/under approximation of the reachability relation →+ , i.e., →+ ⊆ L (R ) or L (R ) ⊆→+ . Such
1 Löding [Löd06] remarked that his technique for solving recurrent reachability for RGTRSs cannot

easily handle generalized Büchi condition, which he left as an open problem whether it is still decidable

Chapter 4. Algorithmic metatheorems for recurrent reachability

83

techniques could prove valuable when combined with partial techniques for computing upper/under approximations of the reachability relations of word/tree automatic
systems.
In the next chapter, we shall apply our results from this chapter for deriving algorithmic metatheorems for decidable LTL model checking with complex fairness
constraints, as well as model checking extensions of FOREG (Reach) with recurrent
reachability operators. Part of the result in this chapter has been published in [TL08].

4.1 The word-automatic caseIn this section, we prove an algorithmic metatheorem for decidable recurrent reachability over Σ∗ -automatic systems, which we will apply for deriving an optimal complexity of checking recurrent reachability over PDSs and prefix-recognizable systems.
Analyzing the proof of our main theorem, we shall also deduce that with an extra
polynomial-time overhead we may compute four “small” words over Σ which represent periodic infinite paths witnessing positive instances of the problem.

4.1.1 Main theorem
The setting of our algorithmic metatheorems is simple. Let us start with a class Cof presentations of word-automatic systems. What conditions are sufficient for ensuring decidable recurrent reachability over C ? We shall now give one such sufficientcondition.
Definition 4.1.1 A class C of presentations of automatic systems is said to be closed
under transitive closure if, for each automatic transition system Sη = hS, {→a}a∈ACT iS
presented by some η ∈ C over Σ, the transitive closure →+ of a∈ACT →a ⊆ Σ∗ ×Σ∗is regular.

Furthermore, the class C is effectively closed under transitive closure if

there exists an algorithm MC that computes an NWA R + recognizing this transitive
closure relation for each input presentation η ∈ C . We say that MC is an effective

transitive closure witness (ETC-witness) of C .

Notice that above we may alternatively define that the non-strict reachability relations→∗ are effectively regular. However, these two definitions are equivalent since these

two relations are polynomially interdefinable (see Example 3.1.7). In the sequel, weshall tacitly assume that MC runs in at least linear time since such an algorithm should

Chapter 4. Algorithmic metatheorems for recurrent reachability

84

read the entire input. The output of the algorithm M on input η is written M (η) withsize kM (η)k, which obviously satisfies kM (η)k ≤ TIMEM (kηk). We now state ouralgorithmic metatheorem for decidable recurrent reachability.

Theorem 4.1.1 Suppose C is class of automatic systems closed under transitive closure. Then, given a presentation η ∈ C over Σ of an automatic system Sη = hS, {→a}a∈ACT i and an NWA A over Σ, the set Rec(L (A )) is regular.

Moreover, if C is effectively closed under transitive closure with an ETC-witness

M , then an NWA recognizing Rec(L (A )) of size O((kM (η)k + kηk) × kM (η)k ×
kA k) is computable in time TIMEM (kηk) + O(|Σ|2 × kM (η)k3 × kA k2 ).
Observe that once an NWA A ′ recognizing Rec(L (A )) has been computed, we cancheck whether v ∈ Rec(L (A )) for a given word v ∈ Σ∗ in time O(|Σ| × |v| × kA ′k) by astandard membership algorithm for NWAs. In other words, assuming effective closure
under transitive closure for the class C of presentations of automatic systems, recurrent

reachability is decidable in polynomial time assuming that the reachability relation is
given as part of the input.

4.1.2 Proof of the main theorem
We now give a proof of Theorem 4.1.1. Firstly, our assumption of closure under transitive closure gives an NWA R over the alphabet Σ⊥ × Σ⊥ recognizing the transitiveS→closure →+ of. By definition, we have v ∈ Rec(L (A )) iff there existsaa∈ACTa sequence {vi }i∈N of words in Σ∗ with v0 = v such that vi−1 ⊗ vi ∈ L (R ) and vi ∈L (A ) for all i > 0. We now divide the set Rec(L (A )) into two sets Rec (L (A )) andRec։ (L (A )), where Rec (L (A )) contains words with witnessing sequence {vi }i∈Nthat satisfies v j = vk for some k > j ≥ 0, and Rec։ (L (A )) contains words with a witnessing sequence {vi }i∈N that satisfies v j 6= vk for all distinct j, k ∈ N. Clearly, it is thecase that

Rec(L (A )) = Rec (L (A )) ∪ Rec։ (L (A )).
Hence, we may separately construct NWAs for Rec (L (A )) and Rec։ (L (A )), fromwhich we can easily compute their union. Let us start with the easy case of constructing
an NWA A recognizing Rec (L (A )).
Lemma 4.1.2 An NWA A of size at most kA k × kR k × (kR k + kηk) recognizing
Rec (L (A )) can be constructed in time O(|Σ|2 × kA k × kR k × (kR k + kηk)).

Chapter 4. Algorithmic metatheorems for recurrent reachability

v

85

w

Figure 4.1: A witnessing sequence for v ∈ Rec (L (A )) of lasso shape.

Proof. Observe that, for each word v ∈ Σ∗ , v ∈ Rec (L (A )) iff there exists a wordw ∈ Σ∗ such that v →∗ w, w →+ w, and w ∈ L (A ). The pair (v, w) is a witnessing
sequence of lasso shape; see Figure 4.1. To this end, we simply apply Proposition
3.1.2 on the formulaϕ(x) := ∃y(x →∗ y ∧ y →+ y ∧ y ∈ L (A )).
Observe that an NWA for →∗ can be obtained by taking a union of the NWA R for →+
S
and the NWA (of size kηk) fora∈ACT →a . Therefore, we obtain an upper boundof kA k × kR k × (kR k + kηk) for the size of A , and an upper bound of O(|Σ|2 ×kA k × kR k × (kR k + kηk)) for the amount of time needed to compute A . 2

Thus, it remains to construct an NWA A։ recognizing Rec։ (L (A )).
Lemma 4.1.3 An NWA A։ of size O(kA k × kR k2 ) recognizing Rec։ (L (A )) can beconstructed in time O(|Σ|2 × kA k2 × kR k3 ).

The proof of this lemma is substantially more involved than the proof of the previous lemma. Therefore, we first give the proof idea. Firstly, by applying pigeonhole
principles on word lengths, we can show that it suffices to consider witnessing infinite
sequences {vi }i∈N such that there exist two sequences {αi }i∈N and {βi }i∈N of words
over Σ such that:

1. |αi | > 0 for all i > 0,2. |αi | = |βi | for all i ∈ N, and3. vi = β0 . . . βi−1 αi for all i ∈ N.
See Figure 4.2 for an illustration of witnessing infinite sequences of this special form.
Such pairs of sequences {αi }i∈N and {βi }i∈N can then be represented as a pair (α, β)of ω-words over Σ ∪ {#}, where # is a new symbol not in Σ andα := α0 #α1 # . . . ,β := β0 #β1 # . . . .

Chapter 4. Algorithmic metatheorems for recurrent reachability

86

v0 = α0v1 = β0 α1v2 = β0 β1 α2v3 = β0 β1 β2 α3..
.
Figure 4.2: Witnessing infinite sequences {vi }i∈N of special form. The lengths of thewords in the sequence are strictly increasing and that, for all i ∈ N, |αi | = |βi |.

The strategy then is to construct an NBWA B that accepts ω-words α ⊗ β correspond-

ing to witnessing sequences of this special form. Once B is constructed, it will be easy

to obtain A։ . If we assume that the NWAs A and R are deterministic, the constructionof B is then rather immediate. We will, however, refrain from determinizing the NWAs

A and R since this will cause an exponential blow-up in the size of the automaton B .
Instead, by further applying pigeonhole principles on the runs of A and infinite Ramsey theorem on the runs of R , we will prove sufficiency of infinite sequences of theabove special form that satisfy further technical restrictions (see below) as witnesses.
An NBWA B that recognizes such sequences can then be constructed in polynomial
time.
We shall now elaborate the details of the proof of Lemma 4.1.3. Let A = (Σ⊥ ×Σ⊥ , Q, δ, q0 , F) and R = (Σ, Q′ , δ′ , q′0 , F ′ ). The following lemma asserts that we may
restrict ourselves to witnessing infinite sequences of a special form.
Lemma 4.1.4 For every word v ∈ Σ∗ , it is the case that v ∈ Rec։ (L (A )) iff there exist

two infinite sequences {αi }i∈N and {βi }i∈N of words over Σ such that(1) α0 = v and |αi | > 0 for all i > 0,(2) |αi | = |βi | for all i ∈ N,(3) there exists an infinite run π of A on β0 β1 . . . such that, for all i ∈ N, the NWA A
accepts αi+1 from q, where q = π(|β0 . . . βi |),(4) there exists an infinite run π′ of R on (β0 × β0 )(β1 ⊗ β1 ) . . . such that, for alli ∈ N, R accepts αi ⊗ βi αi+1 from q′ where q′ = π′ (|β0 . . . βi−1 |).

Chapter 4. Algorithmic metatheorems for recurrent reachability

v0

v1

v2

87

·········

Figure 4.3: An illustration of ω-chains.

One direction of the lemma is easy: if (1)–(4) hold, then from the infinite sequences{αi }i∈N and {β}i∈N we can form a new sequence {vi }i∈N with vi := β0 . . . βi−1 αi . Con-

dition (3) ensures that vi ∈ L (A ) for all i > 0, and condition (4) implies that vi →+ vi+1

for all i ∈ N. This implies that v ∈ Rec։ (L (A )) and thus proving sufficiency in Lemma
4.1.4. To prove the converse, we will prove a more general lemma concerning ω-

chains, which are simply the transitive closures of any one-directional infinite path(see Figure 4.3). More precisely, let R ⊆ Σ∗ × Σ∗ be a (not necessarily transitive) binary relation and U ⊆ Σ∗ a language. A (transitive) U -coloured ω-chain in R froma word v ∈ Σ∗ is an infinite sequence {vi }i∈N of distinct words in Σ∗ such that thefollowing three properties are satisfied:• v0 = v,• for each integer i > 0, it is the case that vi ∈ U , and• for each pair of integers j ≥ i ≥ 0, we have (vi , v j ) ∈ R.
Figure 4.3 gives an illustration of ω-chains. We write C HAIN (U, R) to denote theset of words v ∈ Σ∗ from which there exists a U -coloured ω-chain in R. Observethat C HAIN (L (A ), →+) coincides with Rec։ (L (A )). The following proposition is a
Ramsey-type result for ω-chains in word-automatic systems.

Proposition 4.1.5 Suppose that N is an NWA over Σ, and T an NWA over Σ⊥ × Σ⊥recognizing a regular relation R ⊆ Σ∗ × Σ∗ . Then, for every wordv ∈ C HAIN (L (N ), L (T )),there exists a word v′ v′′ such that
1. |v′ | = |v| and |v′′ | > 0
2. v ⊗ v′ v′′ ∈ L (T ),Chapter 4. Algorithmic metatheorems for recurrent reachability

88

3. there exists an accepting run ρ of N on v′ v′′ , and a run ρ′ on T on v′ ⊗ v′′

such that v′′ ∈ C HAIN (L (N q ), L (T q )), where q := ρ(|v|), q′ := ρ′ (|v|), and′N q (resp. T q ) is the NWA N but with q (resp. q′ ) as the initial state.

Proof. Suppose that v ∈ C HAIN (L (N ), L (T )). Then, there exists a sequence σ ={vi }i∈N of distinct words over Σ such that v0 = v, and it is the case that, for all i >0, the word vi is in L (N ) with accepting run ηi , and for all distinct pair of indicesj > i ≥ 0, we have vi ⊗ v j ∈ L (T ). As there are only finitely many different wordsof length |v| but infinitely many words in σ, we may assume that |vi | > |v| for alli ≥ 1; for, otherwise, we may simply omit these words from σ. Now every word vi ,where i > 0, can be written as vi = ui wi for some words ui , wi such that |ui | = |v| and|wi | > 0. As there are only finitely many different words of length |v| and finitely manydifferent runs of N of length |v|, by pigeonhole principle there must exist k > 0 suchthat η j [0, |v|] = ηk [0, |v|] (and so u j = uk by the definition of NWA runs) for infinitely

many j > 0. Let v′ := uk and ρ := ηk [0, |v|]. Therefore, we may discard all words vi in

σ with i ≥ 1 such that η is not a prefix of ηi . By renaming indices, call the resulting
sequence σ = {vi }i∈N and, for all i ≥ 1, denote by ηi the accepting run of N on vi thathas ρ as a prefix. Notice that σ is still a witness for v ∈ C HAIN (L (N ), L (T )). So, fork > j ≥ 0, let θ j,k denote the accepting run of T on v j ⊗ vk . Let X denote the finite

set of all runs of T on v′ ⊗ v′ . Notice that it is not necessarily the case that |X | = 1

since T is nondeterministic. Therefore, consider the edge-labeled undirected graph
G = hV, {Eu}u∈X i such that V = Z>0 and
Eu = {{ j, k} : 0 < j < k and u is a prefix of θ j,k }.
Notice that {Eu }u∈X is a partition of {{ j, k} : j 6= k, k > 0}, and so G is a completegraph. By infinite Ramsey theorem, G has a monochromatic complete infinite sub-graph H = hV ′ , Eu i for some u ∈ X . Set ρ′ := u. Notice that if the elements of V ′are i1 < i2 < . . ., then the run θi j ,ik (for all k > j > 0) has u as a prefix. Therefore,
we can discard all words vi (i > 0) in σ such that i ∈/ V ′ and by renaming indices callthe resulting sequence σ = {vi }i∈N . We now set v′′ to be the unique word w such that
v1 = v′ w. It is easy to see that (1) and (2) are satisfied. Furthermore, it is easy to check′that v′′ ∈ C HAIN (L (N q ), L (T q )) with a witnessing sequence {wi }i>0 , where wi is theunique word such that vi = v′ wi for all i > 0. 2

Now it is not difficult to complete the proof of Lemma 4.1.4. Given v ∈ Rec։ (L (A )) =C HAIN (L (A ), L (T )), we will inductively construct the desired sequences {αi }i∈NChapter 4. Algorithmic metatheorems for recurrent reachability89

and {βi }i∈N , along with the run π of the NWA A and the run π′ of the NWA R , byusing Proposition 4.1.5 at every induction step. The gist of the proof is that fromthe word v′ v′′ given by Proposition 4.1.5 at induction step k, we will set βk = v′ andαk+1 = v′′ , and extend the partial runs π and π′ in Lemma 4.1.4. Notice that we have′v′′ ∈ C HAIN (L (N q ), L (T q )), which sets up the next induction step. See the appendix
for a detailed argument. This completes the proof of Lemma 4.1.4.

It is now easy to construct an NBWA B that recognizes ω-words of the form α ⊗ βsatisfying

α := α0 #α1 # . . . ,β := β0 #β1 # . . .
for some {αi }i∈N and {βi }i∈N satisfying the conditions in Lemma 4.1.4. The automa-

ton B will attempt to simultaneously guess the runs π and π′ , while at the same timechecking that the runs satisfy the conditions (3) and (4) in Lemma 4.1.4. To this end,

B will run a copy of A and R , while simultaneously also running several other copies
of A and R to check that the runs π and π′ guessed so far satisfy the conditions (3)and (4) along the way. The automaton B consists of three components depicted as Box
1, Box 2, and Box 3 in Figure 4.4." Thefirst box is used for reading the prefix of the#
input before the first occurrence of##, while the other boxes are used for reading theremaining suffix. Boxes 2-3 are essentially identical, i.e., they have the same sets ofstates and essentially the same transition functions. When B arrives in Box 2, it will
read a single letter in Σ × Σ and goes to Box 3 so as to make sure that |αi"| >#0 for eachi > 0. When B is in Box 3, it will go to Box 2 upon reading the letter##. We will

set all states in Box 2 as the final states so as to make sure that infinitely many

"

#
#

#

is

seen, i.e., the sequences {αi }i and {βi }i are both infinite, and each words αi and βi are"

finite.

Box 1

#
#

#

Box 2

"

a

"

#

b

#

#
#

Box 3

Figure 4.4: A bird’s eye view of the Büchi automaton B

Chapter 4. Algorithmic metatheorems for recurrent reachability

90


" #

#
2
More precisely, the NBWA B = Σ ∪, S, ∆, s0, SF is defined as follows.
#

DefineP := (Q × Q′ × Q′ ) ∪ (Q × Q′ × Q × Q′ × Q′ × {2, 3}).
Intuitively, Q × Q′ × Q′ will be the states in Box 1 and Q × Q′ × Q × Q′ × Q′ × {i} willbe the states in Box i. The initial state is defined to be s0 := (q0 , q′0 , q′0 ). The first andthe last components in each state are meant for guessing the infinite runs π and π′ . The
second component of each state in Box 1 is used for guessing a prefix of the accepting
run of R on α ⊗ β0 α1 . The automaton B will finish this guessing when it reaches Box

3 upon the completion of parsing α1 ⊗ β1 . When B is in Box 2 or 3 reading αi ⊗ βi ,where i > 0, the third and fourth components of the states are used for checking that
β0 . . . βi−1 αi ⊗ β0 . . . βi αi+1 ∈ L (R ), which will be completed in the next iteration. We
now formally define the transition function. Let
 " #
 " #a′′′ δ(q, b) × δ q ,× δ q′′ , b



"
#
∆ (q, q′, q′′ ),

a
b

:=

′′

′

, if a, b 6= #

b

b

′′

(q, q , q, q , q , 2)




0/

, if a = b = #, otherwise.

and, when B is in a state in Q × Q′ × Q × Q′ × Q′ × {i}, where i = 2, 3, and a, b 6= # wedefine∆(q1 , q2 , q′1 , q′2 , q′′2 , i),

"

a
b

#

 " #
× δ(q′1 , a) ×:= δ(q1 , b) × δ q2 , ab
 " #
 " #
⊥′′′× {3}.
× δ q′′2 , bδ q2 ,′

ab

If q′1 ∈ F and q′2 ∈ F ′ , then we set"##′ ′ ′′= (q1 , q′′2 , q1 , q2 , q′′2 , 2).
∆ (q1 , q2 , q1 , q2 , q2 , 3),#Finally, the set of final states are SF := Q × Q′ × Q × Q′ × Q′ × {2}. Correctness of thisconstruction is immediate. Furthermore, it is easy to see that the construction takes
time O(|Σ|2 × kA k2 × kR k3 ).

Now, from B we can easily compute the NWA A։ = (Q1 , Σ, δ1 , q10 , F 1 ) that recog-

nizes Rec։ (L (A )). The automaton A։ accepts the set of finite words α0 such that theword α0 #α1 # . . . ⊗ β0 #β1 # . . . is accepted by B for some {αi }i>0 and {βi }i∈N . There-

fore, we will set the new set of states Q1 to be Q × Q′ × Q′ , i.e., the first component of

B in Figure 4.4. We then apply projection operation on the transition function ∆ of B

Chapter 4. Algorithmic metatheorems for recurrent reachability

to obtain δ1 . More precisely, if a ∈ Σ, we setδ ((q1, q2 , q′2 ), a) =
1

[

∆

b∈Σ



(q1 , q2 , q′2 ),

"

a
b

#

91

.

Finally, the new set F 1 of final
states will be those states in Q1 from which B can accept"#
some ω-words of the form##

w for some ω-word w. For this, a simple modification of

the standard linear-time algorithm for testing nonemptiness for NBWA can be applied(cf. Proposition 2.2.6), which still takes linear time. Finally, it is easy to check that thesize of the resulting NWA is O(kA k × kR k2 ), and the total time taken to compute itis O(|Σ|2 × kR k3 × kA k2 ) on top of the time taken to compute R . This completes theproof of Lemma 4.1.3 and hence the proof of Theorem 4.1.1.

Remark 4.1.1 As we mentioned earlier, the proof of Lemma 4.1.3 can be greatly simplified by determinizing the NWA R . By doing this, we avoid the use of Ramsey
theorem, but at the expense of an exponential blow-up, i.e., the algorithm no longer
runs in polynomial time. Such a proof technique (without Ramsey theorem) was usedin [KRS05] for proving a König’s lemma for automatic partial orders. In fact, ourproof above directly improves the complexity of the results from [KRS05].

4.1.3 A small witness for recurrent reachability
The following corollary of the proof of Theorem 4.1.1 is rather immediate.
Corollary 4.1.6 Suppose that C is a class of automatic systems effectively closed under transitive closure with an ETC-witness M . Then, given a presentation η ∈ C over

Σ of an automatic system Sη = hS, {→a}a∈ACT i, a word v0 ∈ S, and an NWA A overΣ, we can effectively decide whether v0 ∈ Rec(L (A )) and, if so, produce a witness ofthe form:

1. (v0 , w) ∈ Σ∗ × Σ∗ such that v0 →∗ w, w →+ w, and w ∈ L (A ), or
2. (v0 , w0 , v1 , w1 ) ∈ (Σ∗ )4 such that whenever s0 := v0 and si := w0 wi−1
1 v1 (for each
integer i ≥ 1), it is the case that:• si →+ s j for each pair of integers j > i ≥ 0, and• si ∈ L (A ) for each integer i > 0.
Furthermore, the total running time of the algorithm is TIMEM (kηk) + O(|Σ|2 ×
kM (η)k3 × kA k2 × |v0 |).

Chapter 4. Algorithmic metatheorems for recurrent reachability

92

We shall now sketch the proof of this corollary. Whenever v0 ∈ Rec(L (A )), we either

have v0 ∈ Rec (L (A )) or v0 ∈ Rec։ (L (A )). For the former case, as in the proof of

Lemma 4.1.2, we may apply the construction from the Proposition 3.1.1 on the formulaψ(y) := v0 →∗ y ∧ y →+ y ∧ y ∈ L (A )and obtain an NWA A ′ of size O(|v0 | × kA k × kR k × (kR k + kηk)). Therefore, we

may easily compute a witnessing word w ∈ L (A ′ ) such that |w| ≤ kA ′ k. For thecase v0 ∈ Rec։ (L (A )), we work from the NBWA B that was obtained during thecomputation of A։ . From B , we may compute a new NBWA B ′ that recognizes ωwords α ⊗ β ∈ L (B ) of the form
α := v0 #α1 # . . .
β := β0 #β1 # . . .

for some sequences {αi }i>0 and {βi }i∈N of words in Σ∗ . The NBWA B ′ can be computed by taking a product of Box 1 in Figure 4.4 with a simple NWA that recognizes

only the word v0 . To obtain the words w0 , v1 , w1 ∈ Σ∗ , we simply apply the standard
nonemptiness algorithm for NBWA on B ′ . In fact, the maximum length of these words
is bounded by the size of the NBWA B ′ . The complexity of the algorithm in Corollary
2 is immediate from the complexity of the algorithm from Theorem 4.1.1.

4.1.4 Two appetizer examples
We now give two immediate applications of Theorem 4.1.1 for deriving an optimal
complexity (up to a polynomial) of checking recurrent reachability of pushdown systems and prefix-recognizable systems. More concrete examples will be given in later
chapters.
Pushdown systems

Recall that pushdown systems can be thought of as word-automatic systems (see Example 3.1.2). Caucal [Cau90] proved that the reachability relations of pushdown systems are rational, for which a rational transducer is computable in polynomial time.
Later in [Cau92] Caucal noted that the reachability relations are in fact also regular,
for which NWAs can be computed within the same time complexity.

Chapter 4. Algorithmic metatheorems for recurrent reachability

93

Proposition 4.1.7 ([Cau90, Cau92]) Given a PDS P , the reachability relation →∗ of

P is regular. Furthermore, an NWA for →∗ can be computed in time polynomial inkP k.
Notice that this proposition immediately implies the regularity of the strict reachability
relation →+ , for which an NWA can be computed in polynomial time (see Example

3.1.7). Combining this with Theorem 4.1.1, the following theorem is immediate.

Theorem 4.1.8 Recurrent reachability for PDSs is decidable in polynomial time. Furthermore, the set of configurations Rec(L (A )) which satisfies the recurrent reachability properties is also regular for which an NWA is computable in polynomial time.
This theorem is not new. In fact, it can be inferred from either from the result of Löding[Löd03, Löd06] concerning recurrent reachability of ground tree rewrite systems or the
result of Esparza, Kucera and Schwoon [EKS03] concerning LTL model checking over
PDSs with “regular valuations”.
For the sake of completeness, we shall now sketch a proof of Proposition 4.1.7.
We start with the following well-known result, which can be proven using the standard“saturation” construction (e.g. see [BEM97, EHRS00]).
Proposition 4.1.9 Given a PDS P and an NWA A , one can compute in polynomial
time two automata A pre∗ and A post ∗ recognizing pre∗ (L (A )) and post ∗(L (A )), respectively.
In fact, the algorithm given in [EHRS00] computes these automata in cubic time,
and the sizes of A pre∗ and A post ∗ are at most quadratic in kA k. Now, given a PDS

P = (ACT, Γ, Q, δ), we write Dom(P ) for the set of configurations qu ∈ QΓ∗ such that((q, a, u), (q′, u′ )) ∈ δ for some a ∈ ACT, q′ ∈ Q and u′ ∈ Γ∗ . To construct an NWA R
recognizing the reachability relation of P , we shall need the following easy lemma.
Lemma 4.1.10 Given a pushdown system P = (ACT, Γ, Q, δ) and two configurations
q1 u1 , q2 u2 ∈ QΓ∗ , then q1 u1 →∗ q2 u2 iff there exists a configuration q3 u3 of P , which
satisfies either q3 u3 ∈ Dom(P ) or u3 = ε, and words x, v1 , v2 ∈ Γ∗ such that u1 = xv1 ,u2 = xv2 , and q1 v1 →∗ q3 u3 →∗ q2 v2 .

This lemma can be easily proved by induction on the length of the path witnessing
q1 u1 →∗ q2 u2 . Now constructing the NWA R for the reachability relation →∗ of P issimple. First, we use Proposition 4.1.9 to compute the NWAs A Cpre∗ and A Cpost ∗ that recognize, respectively, pre∗ (C) and post ∗ (C) for every configuration C ∈ Dom(P ) ∪ Q.

Chapter 4. Algorithmic metatheorems for recurrent reachability

94

Then, on input q1 u1 ⊗ q2 u2 , the NWA R first remembers (q1 , q2 ) in its finite mem-

ory, and guesses a configuration C ∈ Dom(P ) ∪ Q and a position at which the initialcommon prefix x in Lemma 4.1.10 ends. The automaton R then simultaneously runs
the automata A Cpre∗ and A Cpost ∗ to verify that the top part v1 and the bottom part v2 ofthe remaining input word (preceding the padding symbol ⊥) satisfy q1 v1 ∈ L (A Cpre∗ )and q2 u2 ∈ L (A Cpost ∗ ). By Proposition 4.1.9, NWAs for pre∗ (C) and post ∗(C) can becomputed in polynomial time for each configuration C ∈ Dom(P ) ∪ Q. Hence, we canalso compute the NWA R in polynomial time.

Prefix-recognizable systems

We now use Theorem 4.1.1 to infer the decidability of recurrent reachability for prefixrecognizable systems with optimal complexity. Recall that prefix-recognizable systems can be thought of as word-automatic systems (see Example 3.1.3). It turns out thatthe reachability relations for prefix-recognizable systems are also regular, for which
NWAs can be computed in exponential time.
Proposition 4.1.11 Given a prefix-recognizable system kP k, the reachability relation→∗ of P is regular. Furthermore, an NWA for →∗ can be computed in time exponential
in kP k.

As for PDSs, this proposition also implies the regularity of the strict reachability relations of prefix-recognizable systems, for which NWAs can be computed within thesame time complexity. To prove the above proposition, we first use the well-known fact(e.g. see [Cac02, Löd03]) that given a prefix-recognizable system P = (ACT, Γ, Q, δ)
we could construct another prefix-recognizable system P ′ = (ACT, Γ′ , Q, δ′ ) such thateach rule ((q, a, A ), (q′, A ′ ), A ′′ ) satisfies L (A ′′) = Γ∗ . In other words, the prefix constraints in the original prefix-recognizable systems have been removed. This fact canbe proven via the standard technique for prefix-rewrite systems (cf. [Cac02, EKS03,
Löd03]) of annotating the runs of each NWA representing a prefix constraint of P in
the new alphabet Γ′ and each rule in δ′ , which causes the size of Γ′ and δ′ to be exponential in the number of prefix constraints in P (but polynomial in the rest of theparameters). One could now proceed in exactly the same way as in the proof of Proposition 4.1.7 of the previous example, and infer that the reachability relation for P ′ isregular, for which an NWA can be computed in time polynomial in kP k.

Combining Proposition 4.1.11 and Theorem 4.1.1, we obtain the desired result onrecurrent reachability for prefix-recognizable systems.

Chapter 4. Algorithmic metatheorems for recurrent reachability

95

Theorem 4.1.12 Recurrent reachability for prefix-recognizable systems is decidable
in exponential time. Furthermore, the set Rec(L (A )) which satisfies the recurrent
reachability properties is also regular for which an NWA is computable in exponential
time.
This theorem was previously known, e.g., it can be easily derived from the result ofKupferman, Piterman, and Vardi [KPV02]. In addition, it turns out that the complexity
given in the preceding theorem is optimal in the sense that the problem is EXP-hard,which can be easily deduced from the recent result of Göller [Göl08] on the EXPcompleteness of the reachability problem for prefix-recognizable systems.

4.2 The tree-automatic caseIn this section, we extend our algorithmic metatheorem for recurrent reachability overword-automatic systems to tree-automatic systems, which we apply for deriving an
optimal complexity of checking recurrent reachability over regular ground tree rewrite
systems. The proof in this section is substantially more technical than the proof fromthe previous section since we need to reason about many different branches of the trees
at the same time. Nonetheless, the proof idea is essentially the same: we encode an
infinite sequence of trees as an infinite tree which will be recognized by a nondeterministic top-down Büchi automaton. Therefore, the reader is advised to first read theconstruction from the previous section.

4.2.1 Main theorem
Let us first state the tree analogue of Definition 4.1.1.
Definition 4.2.1 A class C of presentations of tree-automatic systems is said to beclosed under transitive closure if, for each tree-automatic system Sη = hS, {→a}a∈ACT iS
presented by some η ∈ C , the transitive closure →+ of a∈ACT →a is tree-regular.

Furthermore, the class C is effectively closed under transitive closure if there exists analgorithm MC that computes an NTA R + recognizing this transitive closure relationfor each input presentation η ∈ C . We say that MC is an effective transitive closure
witness (ETC-witness) of C .

As before, we shall tacitly assume that MC runs in at least linear time since such analgorithm should read the entire input. The output of the algorithm M on input η is

Chapter 4. Algorithmic metatheorems for recurrent reachability

96

written M (η) with size kM (η)k, which obviously satisfies kM (η)k ≤ TIMEM (kηk).
We now state our algorithmic metatheorem for decidable recurrent reachability fortree-automatic systems.
Theorem 4.2.1 Suppose that C is a class of tree-automatic presentations that areclosed under transitive closure. Then, given a presentation η ∈ C of a T REE k (Σ)automatic system Sη = hS, {→a}a∈ACT i and an NTA A over T REE k (Σ), it is the casethat the set Rec(L (A )) is tree-regular.

Moreover, if C is effectively closed under transitive closure with an ETC-witness

M , then an NTA recognizing Rec(L (A )) of size O(kA k × kM (η)k2 ) is computable intime TIMEM (kηk) + O(|Σ|2 × kR k6 × kA k4 ).
Observe that the time complexity obtained in this theorem, albeit still polynomial, isslightly worse than the time complexity obtained in the word case (see Theorem 4.1.1).

4.2.2 Preliminaries
We will first fix some definitions and notations that we will use in the proof of Theorem
4.2.1. A k-ary (linear) context tree over the labeling alphabet Σ with variables X ={x1 , . . . , xn } is a tree T = (D, τ) ∈ T REE k (Σ ∪ X ) such that for each i = 1, . . . , n, there isexactly one node ui ∈ D with τ(ui ) = xi ; furthermore, ui is a leaf. The leaves u1 , . . . , un

are also called context leaves. To emphasize which variables are in T ′ , we will often
write T [x1 , . . ., xn ] for T . Observe that whenever n = 0 the context tree T is just a
normal tree (a.k.a. ground tree). Given ground trees t1 , . . .,tn ∈ T REE k (Σ), the tree

T [t1, . . . ,tn] is the ground tree T [t1/u1 , . . . ,tn/un ], obtained by replacing all context
leaves u1 , . . . , un by the ground trees t1, . . . ,tn, respectively. We also define"T ⊗# T justas we defined the operator ⊗ for ground trees, but we replace the label

xi
xi

by xi .

For a context tree T ′ = (D′ , τ′ ) and a tree T = (D, τ), we write T ′  T if D′ ⊆ D andτ′ (u) = τ(u) whenever u ∈ D′ and u is not a context leaf.

Given an NTA A = (Σ, Q, δ, q0 , F) over T REE k (Σ), we now extend the notion ofruns of A to k-ary context trees T = (D, τ) over Σ with variables X = {x1 , . . . , xn } andcontext leaves u1 , . . . , un . First, we define virt(T ) to be the k-ary tree T ′ = (D′ , τ′ )over the alphabet Σ′ := Σ ∪ X ∪ {$}, where $ ∈/ Σ, such that D′ = D ∪ {vi : v ∈ D \{u1 , . . . , un }, 1 ≤ i ≤ k} andτ′ (u) =

(

τ(u)
$

if u ∈ D,otherwise.

Chapter 4. Algorithmic metatheorems for recurrent reachability

97

Observe that this definition is to a large extent similar to the special case of groundtrees, except that we treat the context leaves u1 , . . . , un in the original context tree T as
virtual leaves. A run of A on T , then, is a mapping ρ : D′ → Q′ that can be defined in

the same way as for ground trees by treating u1 , . . ., un as virtual leaves. We say that ρis potentially accepting if ρ(u) ∈ F for each leaf u ∈ D′ − {u1 , . . . , un }. In other words,
potentially accepting runs might become accepting after we replace the context leaves
with some ground trees.
We shall also need the definition of unranked trees as a conceptual tool. An unranked tree over a potentially infinite labeling alphabet Σ is a tree over the labelingalphabet Σ and some direction alphabet ϒ = {0, . . ., k}, for some integer k > 1, witha potentially infinite tree domain. Notice that the direction alphabet of unranked trees
are not apriori fixed, although they are finitely branching.

4.2.3 Proof of the main theorem
Let ϒ = {1, . . . , k}. Let R be the NTA over T REE k (Σ⊥ ) × T REE k (Σ⊥ ) that recognizes
S
the transitive closure →+ ofa∈ACT →a . For the rest of the proof, we write A =(Q1 , δ1 , q10 , F1 ) and R = (Q2 , δ2 , q20 , F2 ). By definition, for every tree T ∈ T REE k (Σ),

we have T ∈ Rec(A ) iff there exists an infinite sequence {Ti }i∈N of trees in T REE k (Σ)

such that T0 = T , Ti−1 →+ Ti , and Ti ∈ L (A ) for all i > 0. As in the case of words,
we shall prove that it is sufficient to consider only infinite sequences of trees of a

special form that can be recognized by a Büchi infinite-tree automaton B , after whichconstructing the desired NTA A ′ for Rec(A ) will be easy. Unlike in the word case,we shall find it notationally simpler not to treat separately trees with looping and nonlooping witnessing sequences.
Just as in the word case, we shall apply pigeonhole principles on the structure of
the subtrees in the witnessing infinite sequence to obtain a witnessing infinite sequencein a special form. The main difference in the tree case is that the number of branches(as well as the length thereof) of the trees appearing in the witnessing sequence could
all grow indefinitely. To this end, we shall need the following definition.
Definition 4.2.2 For any context tree T ′ [x1 , . . . , xn ] = (D′ , τ′ ) ∈ T REE k (Σ∪{x1 , . . . , xn })and a tree T = (D, τ) ∈ T REE k (Σ), we write T ′ [x1 , . . ., xn ] ⊑ T (or just T ′ ⊑ T ) if, when-ever u1 , . . . , un , are the context leaves in T labeled by x1 , . . . , xn , respectively, it is thecase that• for each i = 1, . . ., n, we have ui ∈/ D,Chapter 4. Algorithmic metatheorems for recurrent reachability

a
a

98

f
c

x

⊑ b

g
a

b

Figure 4.5: An illustration of the relation ⊑.

• D′ − {u1 , . . ., un } ⊆ D, and• ui = vi ri for some ri ∈ ϒ and vi ∈ D ∩ D′ .
In other words, T ′ ⊑ T if all the nodes in T ′ are in T except for the context leaves. See

Figure 4.5 for an example. Note that in the word case the relation ⊑ simply reduces tocomparing the length of two words. The following lemma gives a basic fact about therelation ⊑.
Lemma 4.2.2 Given trees T1 , T2 ∈ T REE k (Σ), there exists a context tree T with variables x1 , . . . , xn (for some n ∈ N) such that the following two conditions hold:(1) T [x1 , . . . , xn ] ⊑ T2 , and(2) for some trees t1 , . . . ,tn ∈ T REE k (Σ), it is the case that T [t1, . . . ,tn] = T1 .
Furthermore, the context tree T is unique up to relabeling of the context leaves.
aaa

As an illustration of Lemma 4.2.2, we may take T1 to be the treeac

and T2 tobbe the right tree in Figure 4.5. The unique context tree T satisfying the two prescribed
conditions in Lemma 4.2.2 is the left tree in Figure 4.5. The proof of the lemma is easy,
which we relegate into the appendix. We are now ready to state a normal form lemma(analogous to Lemma 4.1.4) for the infinite sequences witnessing T ∈ Rec(L (A )).
Notation. For the rest of the proof, we shall use the following notation. Given an
NTA N = (Σ, Q, δ, q0, F) over T REE k (Σ) and a state q ∈ Q, we write N q for the NTA(Σ, Q, δ, q, F) obtained by replacing the initial state of N with q. 

Lemma 4.2.3 For every tree T ∈ T REE k (Σ), it is the case that T ∈ Rec(L (A )) iff there
exists an unranked tree T = (DT , τT ) over the labeling alphabetΓ := {(t,t ′[x1 , . . ., xr ], q, q′ ) : q ∈ Q1 , q′ ∈ Q2 , r ∈ N,t ∈ T REE k (Σ),
t ′ ∈ T REE k (Σ ∪ {x1 , . . ., xr }), and t ′ ⊑ t},

Chapter 4. Algorithmic metatheorems for recurrent reachability99

and τT (u) = (αu , βu [x1 , . . . , xru ], qu , q′u ) for all u ∈ DT , such that the following conditions hold:

1. τT (ε) = (T, βε [x1 , . . . , xrε ], q10, q20 ) for some context tree βε [x1 , . . ., xrε ] and somerε ∈ N such that βε ⊑ T ,2. for all u ∈ DT we have(a) the number of children of u is the same as ru ,′(b) αu ⊗ βu [αu1 , . . . , αuru ] ∈ L (R qu ),(c) if v1 , . . ., vru are the nodes of βu labeled by x1 , . . . , xru respectively, thenthere exist an accepting run ρu of A qu on βu [αu1 , . . . , αuru ] and a potentially′accepting run ρ′u of R qu on βu ⊗ βu such that, for each i = 1, . . ., ru , it is
the case that qui = ρu (vi ) and q′ui = ρ′u (vi ).

Intuitively, the unranked tree T in the above lemma encodes an infinite sequence of a
special form that witnesses T ∈ Rec(L (A )). In case of word-automatic systems, thetree T reduces to a single branch which may grow indefinitely. However, in general

the tree T could have more than one infinite branch, which correspond to the branches
in the witnessing infinite sequence that grow indefinitely. It is of course possible that
all of the branches in T are finite (and hence T is finite) in which case each leaf of
T is labeled by some (t ⊗ t ′ [x1 , . . ., xr ], q, q′ ) ∈ Γ with r = 0. The role of α’s and β’s
in the node labels of T is very similar to the word case (see Figure 4.2). We shallnow show sufficiency in Lemma 4.2.3. To this end, we shall construct a witnessing
sequence {Ti }i≥0 out of the the tree T. We shall inductively define {Ti }i≥0 together
with a sequence {Ci }i≥0 of context trees as follows. We set T0 := αε = T , C0 := x,
T1 := βε [α1 , . . ., αrε ], and C1 := βε [xε1 , . . ., xεrε ]. Suppose that Ci , for some i ≥ 1, has been
defined to be the context tree T ′ [xu11 , . . ., xuru11 , . . . , xu1n , . . . , xurunn ] for all nodes u1 , . . . , unin T of level i − 1, where n ∈ N and ru1 , . . . , run ∈ N. We define Ci+1 to be T ′ [σ],
u

u k

u k

where σ replaces xk j by βu j k [x1 j , . . . , xruj j k ]. Similarly, we define Ti+1 to be T ′ [σ],uwhere σ replaces xk j by αu j k . See Figure 4.6 for an illustration. Notice that if Ci isground, then Ti+1 = Ti and Ci+1 = Ci . By induction, the sequence {Ti }i≥0 together
with {Ci }i≥0 have been defined. It is not difficult to prove by induction that Ti ∈ L(A )and Ti−1 ⊗ Ti ∈ L(R ) for all i ∈ Z≥1 . Therefore, we conclude that T ∈ Rec(L (A )).

We shall now prove the converse of Lemma 4.2.3. To this end, we shall prove a tree

analogue of Proposition 4.1.5. Recall from Section 2.5 that Rec(L (A ))[R] is definedeven when the relation R is non-transitive.

Chapter 4. Algorithmic metatheorems for recurrent reachability

100

u′

u

xk j . . . xk′j

Ci

αuj k

......

αuj′ k′

βuj k

Ti+1

......

βuj′ k′Ci+1

Figure 4.6: An illustration of how the trees Ci+1 and Ti+1 are obtained from Ci .

Proposition 4.2.4 Suppose N and T are, respectively, an NTA over T REE k (Σ) and an
NTA over T REE k (Σ⊥ × Σ⊥ ), where the relation L (T ) is not necessarily transitive. For

every tree T = (D, τ) ∈ T REE k (Σ), if T ∈ Rec(L (N ))[L (T )], then one of the following

is true:(1) there exists a tree T ′ = (D′ , τ′ ) ∈ T REE k (Σ) such that D′ ⊆ D, T ′ ∈ L (N ),(T, T ′ ) ∈ L (T ), and (T ′ , T ′ ) ∈ L (T ).

(2) There exist a k-ary context tree T ′ [x1 , . . ., xn ] = (D′ , τ′ ) over the labeling alphabetΣ and trees t1 , . . .,tn ∈ T REE k (Σ) such that(a) T ′ ⊑ T ,(b) (T, T ′ [t1, . . . ,tn]) ∈ L (T ),(c) there exist an accepting run ρ = (Dρ , τρ) of N on T ′ [t1, . . . ,tn] and a potentially accepting run ρ′ = (Dρ′ , τρ′ ) of T on T ′ ⊗ T ′ such that, whenever′1 ≤ i ≤ n, it is the case that ti ∈ Rec(L (N qi ))[L (T qi )] where qi = τρ (ui )and q′i = τρ′ (ui ).

Note that statement (1) yields an infinite witnessing sequence of lasso shape, as wasshown in Figure 4.1 in the word case.

Chapter 4. Algorithmic metatheorems for recurrent reachability

101

Proof. Suppose that T = (D, τ) ∈ Rec(L (N ))[L (T )], but statement (1) is false. Then,

there exists an infinite sequence σ = {Ti }i∈N of trees such that T0 = T , T j 6= Tk for all

distinct indices j, k (since statement (1) is false), and it is the case that, for all i > 0,Ti ∈ L (N ) with accepting run ηi = (Dηi , τηi ), and for all distinct pair of indices 0 ≤ i <i′ , Ti ⊗ Ti′ ∈ L (T ). Now, for every tree Ti , where i > 0, Lemma 4.2.2 implies that there

exists a unique context tree Ci [x1 , . . . , xni ] = (Di , τi ) with variables x1 , . . ., xni for someni ∈ N, such that Ci ⊑ T , and Ti = Ci [t1i , . . .,tni i ] for some (ground) trees t1i , . . .,tni i ∈T REE k (Σ). Let H = {Ci [x1 , . . ., xni ] : i > 0}. For infinitely many i > 0, it is the case thatni > 0, i.e., there exists a node in Ti that is not in D; for, otherwise, there are infinitely
many indices i such that Di ⊆ D where Ti = (Di , τi ) and, since there are only finitely
many different such trees, pigeonhole principle tells us that one of these trees must
repeat in σ, which contradicts our assumption that statement (1) is false. On the other
hand, it is easy to see that the number of nodes in any context tree Ci in H is boundedby |ϒ| × |D|. Therefore, the set H is finite and so is the number of different potentiallyaccepting runs of N on context trees in H. So, if we define η′i := (ηi )|Di , i.e., the partof the run tree ηi restricted to the domain Di of Ci , then by pigeonhole principle there
exists k > 0 such that Ck [x1 , . . . , xnk ] = C j [x1 , . . . , xn j ] and η′k = η′j for infinitely many
indices js. Let n := nk , T ′ [x1 , . . . , xn ] := Ck [x1 , . . ., xn ], and η′ = η′k . We remove all
elements Ti (i > 0) from σ such that Ci 6= T ′ or η′i 6= η′ and, by renaming indices, callthe resulting sequence σ = {Ti }i∈N where T0 = T . The same is done for the sequence{ηi }i≥1 of runs so that ηi is an accepting run N on Ti (i ≥ 1) such that η′  ηi . Noticethat σ is still a witness for T ∈ Rec(L (N ))[L (T )]. Now let θ j,k , where 0 ≤ j < k, be
an accepting run of T on T j ⊗ Tk . Let C be the finite set of all potentially accepting

runs of T on T ′ ⊗ T ′ . The set C is nonempty as T ′ ⊗ T ′  T j ⊗ Tk and T j ⊗ Tk ∈ L (T ).
Consider the edge-labeled undirected graph G = (V, {Eθ })θ∈C such that V = Z≥1 andEθ := {{ j, k} : 0 < j < k and θ  θ j,k }.
Notice that {Eθ }θ∈C is a partition of {{ j, k} : j 6= k ∈ Z≥1 }, and so G is a completegraph. By (infinite) Ramsey theorem, G has a monochromatic complete infinite sub-graph H = (V ′ , Eρ′ ) for some ρ′ ∈ C . Notice that if V ′ contains precisely the elements j1 < j2 < . . . then ρ′  θ jk , jk′ for all k′ > k ≥ 1. We now remove all Ti (i ≥ 1)from σ with i ∈/ V ′ and, again, rename indices. Notice that σ is still a witness forT ∈ Rec(L (N ))[L (T )]. Recall that for each i ≥ 1, we have Ti = T ′ [ti1, . . .,tin ] for someground trees ti1 , . . .,tin . Set ρ := η1 and tk := t1k for each k = 1, . . ., n. Letting σk =′{tik }i≥1 for each k = 1, . . . , n, it is easy now to check that tk ∈ Rec(L (N qk ))[L (T qk )]Chapter 4. Algorithmic metatheorems for recurrent reachability

102with witnessing sequence σk , where qk = τρ (uk ) and q′k = τρ′ (uk ) if uk is the leaf nodeof T ′ labeled by xk . So, condition (2c) holds. That (2b) holds is also immediate. As
we already saw that T ′ ⊑ T , our proof is complete. 2
In the same way we used Lemma 4.1.5 to complete the proof of necessity in Lemma
4.1.4, we can now finish off the proof of necessity in Lemma 4.2.3 by constructing
the tree T inductively and adding nodes of height n at step n ∈ N by using Proposition

4.2.4. Therefore, the proof of Lemma 4.2.3 is complete.

Before we construct a Büchi tree automaton recognizing witnessing infinite pathsof a special form, we will first show how any unranked tree T satisfying the conditions
in Lemma 4.2.3 can be represented as ranked trees. For any tree T = (D, τ), we write
Tb for the tree obtained by attaching a new node labeled by the new symbol # to theroot of T , i.e., Tb := (1D, bτ) with bτ(ε) := # and, whenever u ∈ D, bτ(1u) := τ(u). Givenan unranked tree T = (DT , τT ) satisfying the conditions in Lemma 4.2.3, we can in-ductively define a Ω-labeled ϒ-tree Hv for every v ∈ DT , where Ω := Σ2⊥ ∪ {#}. Weddset Hv := (αv ⊗ βv )[H
v1 , . . ., H
vrv ]. Note that Hv might be infinite for some v ∈ DT . If
∗ , τ′ ) such that if u ∈ D,
Hv = (D, τ), we also denote by full(Hv ) the full infinite tree(ϒ"#then τ′ (u) := τ(u); if u ∈/ D, then τ′ (u) := ⊥ where ⊥ :=⊥⊥. In other words, the treefull(Hv) is the tree Hv made full by padding finite branches by ⊥.

We now construct the NBTA B = (Ω,U, δ, q0, F). The automaton B accepts pre-cisely all Ω-labeled full infinite binary tree full(Hε ), where Hε is generated by someunranked tree T satisfying the conditions in Lemma 4.2.3. The construction is very
similar to the word case. For notational convenience, we shall sketch it only in thecase of ϒ = {1, 2}, though the construction extends to k-ary trees with precisely thesame complexity. Let q1F and q2F be new states not in Q1 ∪ Q2 . Denote by U1 (resp. U2 )the set Q1 ∪ {q1F } (resp. Q2 ∪ {q2F }). We define

U := (U1 ×U2 ×U2 ) ∪ (U1 ×U2 ×U1 ×U2 ×U2 ).
The start state is q0 := (q10 , q20 , q20 ). The states in (U1 × U2 × U2 ) are meant to handle

the cases when no # has thus far been seen by B . On the other hand, when B isin U1 × U2 × U1 × U2 × U2 , at least one # has been seen. We now formally define

the transition function δ. We first define how B behaves when it is in U1 × U2 × U2 .

Chapter 4. Algorithmic metatheorems for recurrent reachability

103

Suppose that q1 ∈ Q1 , and q2 , q′2 ∈ Q2 . For all a, b ∈ Σ, we set′ ), (q , q , q′ )) | 

((q
,
q
,
q
L1
L2
R1
R2


L2
R2








(qL1 , qR1 ) ∈ δ1 (q1 , b),


"
#
"
#
a
′
a
δ((q1 , q2 , q2 ),) :=.
(qL2 , qR2 ) ∈ δ2 (q2 ,
), 
b



b


"
#




b

′
′
′


(qL2 , qR2 ) ∈ δ2 (q2 ,) b

For all a ∈ Σ, q1 ∈ F1 ∪ {q1F } and q′2 ∈ F2 ∪ {q2F }, we set
δ((q1 , q2 , q′2 ),"#) := {((q1F , qL2 , q2F ), (q1F , qR2, q2F )) : (qL2 , qR2 ) ∈ δ2 (q2 ,
⊥
a

"

a
⊥

#

)}

and, if q2 ∈ F2 ∪ {q2F }, we set
δ((q1 , q2 , q′2 ), ⊥) := {((q1F , q2F , q2F ), (q1F , q2F , q2F ))}.
Remark 4.2.1 Observe that, for all a, b ∈ Σ, we have δ((q1 , q2 , q′2 ),

"

a
b

#

) = 0/ if at

least one of the following
holds:
q1 = q1F , q2 = q2F , or q′2 = q2F . Similarly, for a ∈ Σ,"#

we have δ((q1 , q2 , q′2 ),δ((q1F , q2F , q2F ),

"

a
⊥

#

a

⊥

) = 0/ unless q1 = q1F and q′2 = q2F . Likewise, we have

) = 0/ unless a = ⊥. This means that once B is in (q1F , q2F , q2F ), it is“trapped” and is forced to only see the node label ⊥. 

Suppose now that q1 ∈ U1 \ {q1F } and q2 , q′2 ∈ U2 \ {q2F }. We then set
δ((q1 , q2 , q′2 ), #) := ((q1, q′2 , q1 , q2 , q′2 ), (q1F , q2F , q2F )).
Notice that the state sent to the right child is (q1F , q2F , q2F ) as the right child of every#-labeled node in full(Hε ) is ⊥-labeled.

We now proceed with our definition of δ when B is in U1 × U2 × U1 × U2 × U2 .

Suppose that q1 , q′1 ∈ Q1 and q2 , q′2 , q′′2 ∈ Q2 . For all a, b ∈ Σ, we defineδ (q1 , q2 , q′1 , q′2 , q′′2 ),
as













"

a
b

#



(qL1 , qR1) ∈ δ1 (q1 , b),


"
#


a

(qL2 , qR2) ∈ δ2 (q2 ,
), 


b



′
′
′
′
′
′′
′
′
′′
,
a),
)
∈
δ
(q
,
q
(q
1
(qL1, qL2 , qL1 , qL2 , qL2), (qR1, qR2 , qR1 , qR2, qR2 )
1 "
L1 R1
#



′
′
′ , ⊥ ), 


(q
,
q
)
∈
δ
(q


2 2
L2 R2


a




"
#




b
′′
′′
′′

(qL2 , qR2) ∈ δ2 (q2 ,
) 


b

Chapter 4. Algorithmic metatheorems for recurrent reachability

If a ∈ Σ, q1 ∈ F1 , and q′′2 ∈ F2 , we defineδ (q1 , q2 , q′1 , q′2 , q′′2 ),

"

#

a
⊥

as












(q1F , qL2 , q′L1 , q′L2, q2F )), (q1F , qR2 , q′R1 , q′R2, q2F )

104(qL2 , qR2) ∈ δ2 (q2 ,

"

a
⊥



), 




#

(q′L1 , q′R1) ∈ δ1 (q′1 , a),
"
#
⊥
′
′
′
(qL2 , qR2) ∈ δ2 (q2 ,
)
a







If q1 , q′1 ∈ F1 and q2 , q′2 , q′′2 ∈ F2 , we set δ((q1 , q2 , q′1 , q′2 , q′′2 ), ⊥) := (q1F , q2F , q1F , q2F , q2F ).
Finally, if (q1 , q2 , q′1 , q′2 , q′′2 ) ∈ Q1 × Q2 × F1 × F2 × Q2 , then we set
δ((q1 , q2 , q′1 , q′2 , q′′2 ), l) :=({(q1 , q′′2 , q1 , q2 , q′′2 )}if l = #,0/otherwise.

We now set
F := S{(q1F , q2F , q2F ), (q1F , q2F , q1F , q2F , q2F )}Q1 × Q2 × F1 × F2 × Q2

It is easy to see that B recognizes precisely all trees full(Hε ), where Hε is generated bysome unranked tree T satisfying lemma 4.2.3. Furthermore, checking the definition of
the transition function δ of B , it is easy to see that kB k = O(kA k2 × kR k3 ) and thatthe construction of B takes time O(|Σ|2 × kA k2 × kR k3 ).

We now show how to construct from B the automaton A ′ = (Σ, Q′, δ′ , q′0 , F ′ ) thatrecognizes Rec(L (A )). The intuitive idea is similar to the word case: given a tree
T , the automaton A ′ guesses a tree full(Hε ), where Hε is generated by an unranked
tree T = (DT , τT ) satisfying lemma 4.2.3 such that τT (ε) = (T ⊗ βε [x1 , . . . , xrε ], q10, q20 )for some context tree βε [x1 , . . . , xrε ]. More formally, we set Q′ := (U1 ×U2 ×U2 ) and

q′0 = (q10 , q20 , q20 ). The transition function is defined as follows:δ′ ((q1 , q2 , q′2 ), a) =[δ((q1 , q2 , q′2 ),

b∈Σ⊥

"

a
b

#

).

Finally, we set(F1 ∪ {q1F }) × (F2 ∪ {q2F }) × (F2 ∪ {q2F })F ′ := ∪ {(q1 , q2 , q′2 ) ∈ Q1 × Q2 × Q2 |′B (q1 ,q2 ,q2 ) accepts some Ω-labeled binary tree of the form Tb}.

Chapter 4. Algorithmic metatheorems for recurrent reachability

105

Observe that F ′ can be computed by using the algorithm for checking emptiness forBüchi tree automata, which runs in quadratic time O(|B |2 ) = O(|Σ|2 × kA k4 × kR k6 )(e.g. see [VW86a]). Finally, observe that kA ′ k = O(kA k × kR k2 ) and the total time

taken to compute A ′ is O(|Σ|2 × kA k4 × kR k6 ). Theorem 4.2.1 is now immediate.

Remark 4.2.2 Recall that the proof of the analogous statement for the word-automaticcase (i.e. Lemma 4.1.3) could be greatly simplified by first determinizing the NWA R
at the cost of an exponential blow-up in the size of R . Our proof for Lemma 4.1.3
provides an exponential reduction in the size of R , although this is not necessary ifcomplexity is not a primary concern. On the other hand, it is not obvious to adapt sucha technique in the tree case (i.e. to prove Lemma 4.2.3). This is simply because nondeterministic top-down tree automata are not determinizable in general. Furthermore,
replacing the NTA R by a bottom-up deterministic automaton does not seem to help in
the construction of the Büchi tree automaton B since the standard definition of Büchitree automata is top-down, which is more natural since the input tree is infinite. Incidentally, our proof technique above easily yields a generalization of the results from
[KRS05] to the tree-automatic case. 

4.2.4 An appetizer example
We now give an immediate application of Theorem 4.2.1 for deriving an optimal complexity (up to a polynomial) of checking recurrent reachability of regular ground tree
rewrite systems. More concrete examples will be given in Chapter 6.
Regular ground tree rewrite systems

Recall that RGTRSs can be thought of as tree-automatic systems. We now give anotherproof of the result by Löding [Löd03, Löd06] on polynomial-time procedure for deciding recurrent reachability over RGTRSs. We first recall a classic result by Dauchet
and Tison [DT90] (also see [CDG+ 07, Chapter 3]) on the reachability relation for
RGTRSs.
Proposition 4.2.5 The reachability relations of RGTRSs are effectively tree-regular
relations. Furthermore, they can be computed in time polynomial in the size of the
input RGTRS.
The proof for the above proposition first constructs “ground tree transducers”, which
can then be easily converted into a tree-automatic presentation (e.g. see [CDG+ 07,

Chapter 4. Algorithmic metatheorems for recurrent reachability

106

Chapter 3]). Since reachability relations and strict reachability relations are polynomially interdefinable for tree-automatic systems (see Example 3.2.5), Theorem 4.2.1 and
Proposition 4.2.5 gives the following immediate corollary.
Corollary 4.2.6 Recurrent reachability over RGTRSs is solvable in polynomial-time.
Furthermore, the set of configurations Rec(L (A )) which satisfies the recurrent reachability property is also regular for which an NTA can be computed in polynomial-time.

4.3 Generalized Büchi conditions
We now consider a more general version of recurrent reachability. Given a transition
system S = hS, {→a}a∈ACT i and the sets S1 , . . ., Sn ⊆ S, we define Rec(S1 , . . ., Sn )to be the set of all s0 ∈ S from which there exists an infinite path π = s0 s1 . . . suchthat, for each i = 1, . . ., n, we have s j ∈ Si for infinitely many j ∈ N. In other words,

Rec(S1 , . . . , Sn ) contains all s ∈ S from which there exists an infinite path which vis-

its each Si (for all i = 1, . . . , n) infinitely often. In analogy with finite automata overω-words, one may call this problem recurrent reachability with generalized Büchi con-dition2. Observe that this definition coincides with the definition of recurrent reachability in the case when n = 1. On the other hand, it is not necessarily the case that
Rec(S1 , . . . , Sn ) = Rec(Sn

i=1 Si ) in general since the latter only enforces the existenceof path which visits at least one Si infinitely often.
In this section, we shall apply Theorem 4.1.1 and Theorem 4.2.1 to show how tohandle generalized Büchi conditions for word/tree automatic systems. In contrast torecurrent reachability (without generalized Büchi conditions), the time complexity of
our algorithm becomes exponential in the number n of “target automata”, which weshow to be optimal even for simpler classes of word/tree automatic presentations including pushdown systems and ground tree rewrite systems. As applications of ourmain results of this section, we derive algorithms with optimal complexity for solving recurrent reachability with generalized Büchi conditions over pushdown systems,
prefix-recognizable systems, and ground-tree rewrite systems.
2 Automata over ω-words with generalized Büchi conditions, which recognize precisely ω-regular

languages, are well-studied (e.g. see [Wol00])

Chapter 4. Algorithmic metatheorems for recurrent reachability

107

4.3.1 Word-automatic systems
Let us first start with word-automatic systems. The following theorem is an extension
on Theorem 4.1.1 to recurrent reachability with generalized Büchi conditions.
Theorem 4.3.1 Suppose that C is a class of automatic systems closed under transitive
closure. Then, given a presentation η ∈ C over Σ of an automatic system Sη = hS, {→a}a∈ACT i and NWAs A1 , . . . , An over Σ, the set Rec(L (A1 ), . . . , L (An)) is regular.

Moreover, if C is effectively closed under transitive closure with an ETC-witness

M , then an NWA recognizing Rec(L (A1 ), . . ., L (An)) of size O(kR k2n × Πni=1 kAi k2 )in time O(|Σ|n+1 × kR k3n × Πni=1 kAi k3 ).
Notice that if the number n of target automata is fixed, then the algorithm runs inpolynomial time. We shall see in Proposition 4.3.4 that the complexity in the above
algorithm cannot be substantially lowered.
We now proceed with the proof of Theorem 4.3.1. Observe that, for each s0 ∈ S,

it is the case that s0 ∈ Rec(L (A1 ), . . ., L (An )) iff there exists a sequence {si }i∈N suchthat si →+ si+1 for each integer i ∈ N, and snk+i ∈ L (Ai ) for each pair of integers k ≥ 0

and i ∈ [1, n]. Therefore, let R be the NWA over Σ⊥ × Σ⊥ that accepts precisely →+ .

Define a new binary relation →1 ⊆ S × S, where for each s0 , sn ∈ S
s0 →1 sn ⇔ ∃s1 , s2 , . . . , sn−1 ∈ S

n−1
^
i=0

+

(si → si+1 ) ∧

n
^
i=1

!

si ∈ L (Ai ) .

By transitivity of →+, we see that →1 is also a transitive relation. Furthermore, it isclear that, for each s ∈ S,

s ∈ Rec(L (A1 ), . . ., L (An ))[→+] ⇔ s ∈ Rec(Σ∗ )[→1].
By Proposition 3.1.2, the relation →1 is regular for which an NWA of size O(kR kn ×Πni=1 kAi k) can be computed in time O(|Σ|n + 1 × kR kn × Πni=1 kAi k). By Theorem

4.1.1, we can compute an NWA of size O(kR k2n × Πni=1 kAi k2 ) for the set
Rec(L (A1 ), . . . , L (An))[→+]
in time O(|Σ|n+1 × kR k3n × Πni=1 kAi k3 ).

4.3.2 Tree-automatic systems
We now proceed to the tree analogue of Theorem 4.3.1.

Chapter 4. Algorithmic metatheorems for recurrent reachability

108

Theorem 4.3.2 Suppose that C is a class of tree-automatic systems closed under transitive closure. Then, given a presentation η ∈ C over Σ of a T REE k (Σ)-automatic

system Sη = hS, {→a}a∈ACT i and NTAs A1 , . . ., An over T REE k (Σ), the set
Rec(L (A1 ), . . ., L (An ))is tree-regular. Moreover, if C is effectively closed under transitive closure with an
ETC-witness M , then an NTA recognizing Rec(L (A1 ), . . ., L (An )) of size O(kR k2n ×
Πni=1 kAi k2 ) in time O(|Σ|n+1 × kR k6n × Πni=1 kAi k6 ).

The proof of this theorem is identical to the proof of Theorem 4.3.1 (except for using
the tree analogues of the results for word-automatic systems), and hence is omitted.
We shall see in Proposition 4.3.7 that the complexity in the above result cannot be
substantially improved.

4.3.3 Applications
We now apply Theorem 4.3.1 and Theorem 4.3.2 for deriving optimal algorithms
for recurrent reachability with generalized Büchi conditions over pushdown systems,
prefix-recognizable systems, and RGTRSs.
Pushdown systems and prefix-recognizable systems

An immediate application of Theorem 4.3.1 and Proposition 4.1.7 is the following
Theorem.
Theorem 4.3.3 Recurrent reachability with generalized Büchi conditions expressed as
NWAs A1 , . . ., An (over the appropriate alphabet) is solvable in exponential time over
pushdown systems. Furthermore, when the number n is fixed, then the problem can besolved in polynomial time.
This result is now new, e.g., it can be derived using the techniques from [EKS03]. It
turns out that the complexity cannot be substantially lowered, as the following proposition shows.
Proposition 4.3.4 The problem of checking recurrent reachability with generalizedBüchi conditions for the class of pushdown systems is PSPACE-hard.
The proof of this proposition, which can be found in the appendix, is via a simple
polynomial-time reduction from the emptiness of language intersections of DWAs,

Chapter 4. Algorithmic metatheorems for recurrent reachability

109

which is PSPACE-complete [GJ79]. This also shows that the time complexity for
Theorem 4.3.1. In fact, combining this proof with Birget’s [Bir92] lower bound forthe smallest size of NWAs recognizing the intersections of n languages of DWAs,
it follows that the size of the NWA for Rec(L (A1 ), . . ., L (An )) from Theorem 4.3.1
cannot be substantially lowered for pushdown systems.
Another application of Theorem 4.3.1 is the following result for prefix-recognizable
systems.
Theorem 4.3.5 Recurrent reachability with generalized Büchi conditions over prefixrecognizable systems is EXP-complete.
As we saw earlier, the problem was already EXP-complete without generalized Büchi
conditions due to Göller’s recent EXP-completeness result for reachability for prefixrecognizable systems [Göl08]. This theorem can also be alternatively derived using
the technique from [EKS03, KPV02].
Regular ground tree rewrite systems

We now apply Theorem 4.3.2 to answer Löding’s open question [Löd06] regarding
recurrent reachability with generalized Büchi conditions for regular ground tree rewrite
systems (it was also not known to be decidable even for ground tree rewrite systems).
Theorem 4.3.6 Recurrent reachability with generalized Büchi conditions expressedas the NTAs A1 , . . . , An for RGTRSs is solvable in exponential time. Furthermore, theproblem is solvable in polynomial time if n is fixed.
It turns out this upper bound is essentially tight even for ground tree rewrite systems,
as the following proposition shows.
Proposition 4.3.7 Recurrent reachability with generalized Büchi conditions for GTRSs
is EXP-hard.
The proof of this proposition, which can be found in the appendix, is via a simple
reduction from the nonemptiness problem for the intersections of the languages of n
NTAs, which is EXP-complete [CDG+ 07].

Chapter 4. Algorithmic metatheorems for recurrent reachability

110

4.4 Recurrent reachability via approximation
The transitive closure →+ of a regular relation → is in general non-recursive (Propo-

sition 3.1.5). In the previous sections, we have shown that recurrent reachability could
be solved when →+ is effectively regular. In practice, we cannot always hope to beable to obtain an NWA for →+ since deciding whether the transitive closure →+is regular for a given regular relation is already undecidable. In this section, we
briefly consider the scenario when we have obtained an NWA representing an “under/upper approximations” of a regular relation →. This scenario is reasonable sincesemi-algorithms that aim to compute under/upper approximations of transitive clo-

sure relations have been developed in the area of regular model checking (e.g. see[AJNS04, BLW03, Bou01, DLS02, Nil05]). More precisely, suppose that we are
given a regular relation R ⊇→+ , i.e., a regular relation that overapproximates the realtransitive closure relation. What can we say about the original recurrent reachability

problem? Similarly, we may ask the same question when we are instead given a regular relation R ⊆→+ , i.e., a regular relation that underapproximates the real transitive

closure relation. Note that R may not necessarily be transitive. In both cases, our tech-niques in the previous sections can be easily adapted to give partial answers for theoriginal recurrent reachability problem over the original word/tree automatic transition
system. We shall first state the result for the word-automatic case.
Theorem 4.4.1 Given an NWA A over Σ and a presentation η of a Σ∗ -automatic
system Sη = hS, {→a}a∈ACT i, suppose that →+ is the strict reachability relationof Sη and R is a regular relation, given as an NWA R , satisfying R ⊇→+ (resp.

R ⊆→+ ). Then, given a word v0 ∈ S, we may check whether v0 ∈ Rec(L (A ))[R]in time O(|Σ|2 × 2O(kR k) × kA k2 ) and, whenever v0 ∈/ Rec(L (A ))[R] (resp. v0 ∈Rec(L (A ))[R]) it is the case that v0 ∈/ Rec(L (A ))[→+] (resp. v0 ∈ Rec(L (A ))[→+]).

Recall from Section 2.5 that Rec(L (A ))[R] is defined even when the relation R is
non-transitive. In other words, whenever R is an upper-approximation of →+ , wehave sound negative tests for v0 ∈ Rec(L (A ))[→+]. In the case when R is an under-

approximation of →+ , we have sound positive tests for v0 ∈ Rec(L (A ))[→+]. These
simply follow from the simple observations that:R ⊇ →+

R ⊆ →+⇒⇒

Rec(L (A ))[R] ⊇ Rec(L (A ))[→+],

Rec(L (A ))[R] ⊆ Rec(L (A ))[→+].

Chapter 4. Algorithmic metatheorems for recurrent reachability

111

These observations hold even when R is not transitive. In the case when R is transitive,
Theorem 4.4.1 then follows from Theorem 4.1.1, in which case better computational
complexity that was stated in Theorem 4.4.1 is achievable (i.e. polynomial also inkR k).

In the case when R is not transitive, it is also not difficult to prove Theorem 4.4.1.

For this, we will have to go through the proof of Theorem 4.1.1. Recall that in the
proof of Theorem 4.1.1 we first divided the set Rec(L (A )) into two sets Rec (L (A ))and Rec։ (L (A )). We may generalize the definitions of these two sets even when R
is not transitive in the obvious way. More precisely, we define v0 ∈ Rec (L (A ))[R]
iff there exists a sequence {vi }i∈N such that (1) vi ⊗ v j ∈ R, for all integers j > i ≥ 0,(2) vi ∈ L (A ) for all integer i > 0, and (3) vi = v j for some j > i ≥ 0. Similarly, wedefine v0 ∈ Rec։ (L (A ))[R] iff there exists a sequence {vi }i∈N such that (1) vi ⊗v j ∈ R,

for all integers j > i ≥ 0, (2) vi ∈ L (A ) for all integer i > 0, and (3) vi 6= v j for all

j > i ≥ 0. We may compute an NWA for Rec (L (A ))[R] in the same way we proved

Lemma 4.1.2. In the case of Rec։ (L (A ))[R], a proof that is similar to our proof of

Lemma 4.1.3 can also be given. Recall that it suffices to consider only witnessing
infinite sequences of words with strictly increasing lengths (see Figure 4.2). Now
observe that the conditions on the runs of R in Lemma 4.1.4 assume that L (R ) istransitive (see Condition 4). This can however be easily fixed by considering each pair
(αi , βi βi+1 . . . β j−1 α j ) of suffixes in the witnessing sequence, i.e., by asserting that R
accepts αi ⊗ βi βi+1 . . . β j−1 α j instead of only αi ⊗ βi αi+1 . In addition, we use thesame definition of ω-chains and so Proposition 4.1.5 can be directly used. Now, inthe construction of the NBWA B , we will additionally have to make sure that, for all
integers j > i ≥ 0, the word ε ⊗ βi+1 . . . β j−1 α j is accepted by R from an appropriate

state. Since there are only finite many states in R , we simply have to keep track ofevery possible subset of the states in R to handle this causing an exponential blow-up
in the number of states in R .
We shall also state the tree analogue of Theorem 4.4.1, which can be proven in thesame way.
Theorem 4.4.2 Given an NTA A over T REE k (Σ) and a presentation η of a T REE k (Σ)automatic system Sη = hS, {→a}a∈ACT i, suppose that →+ is the strict reachability
relation of Sη and R is a regular relation, given as an NTA R , satisfying R ⊇→+(resp. R ⊆→+ ). Then, given a tree T0 ∈ S, we may check whether T0 ∈ Rec(L (A ))[R]in time O(|Σ|2 × 2O(kR k) × kA k4 ) and, whenever T0 ∈/ Rec(L (A ))[R] (resp. T0 ∈

Chapter 4. Algorithmic metatheorems for recurrent reachability

112

Rec(L (A ))[R]) it is the case that T0 ∈/ Rec(L (A ))[→+] (resp. T0 ∈ Rec(L (A ))[→+]).
Remark 4.4.1 The proof of Theorem 4.4.1 also yields a proof of that “Ramseyan
quantifiers” preserve regularity over word-automatic structures, which was proven by
Rubin [Rub08]. For the tree case, the proof of Theorem 4.4.2 yields a proof of theregularity-preserving property of Ramseyan quantifiers over tree-automatic structures.
This has been independently observed by Kartzow and Kuske this year3 .

3 Private communication with Kartzow (2010)

Chapter 5
Algorithmic metatheorems for logic
model checking
In the previous chapter, we proved algorithmic metatheorems for decidable recurrent
reachability over word/tree automatic systems and show that they can be used for deriving uniform proofs of decidability (with optimal complexity) for various recurrent
reachability problems for pushdown systems, prefix-recognizable systems, and regular ground tree rewrite systems. Although recurrent reachability by itself is a rather
weak property, in this chapter we shall see that the algorithmic metatheorems fromthe previous chapter can be used to obtain algorithmic metatheorems for decidable
model checking with respect to various logics including LTL (and fragments thereof)
with “complex fairness constraints” and extensions of first-order logic. As we shallsee later in this chapter, they can be used to obtain optimal model checking algorithms
for pushdown systems, prefix-recognizable systems, and regular ground tree rewrite
systems (more applications can be found in the next chapter).
In Section 5.1, we study the problem of LTL model checking over word/tree automatic systems with regular fairness constraints: given a presentation η of a Σ∗ automatic (resp. T REE k (Σ)-automatic) system Sη = hS, {→a}a∈ACT i, a configurations0 ∈ S, an LTL formula ϕ over ACT, and a “fairness” NWA (resp. NTA) A over Σ (resp.
T REE k (Σ)), decide whether, for each infinite path

π := s0 →a1 s1 →a2 s2 →a3 . . .
in Sη satisfying si ∈ L (A ) for infinitely many indices i ∈ N, it is the case that π |= ϕ.

When hη, s0, ϕ, A i is a positive instance of the problem, we write (Sη, s0 , L (A )) |= ϕand say that Sη satisfies ϕ from s0 with fairness constraint A . Fairness constraints are
113

Chapter 5. Algorithmic metatheorems for logic model checking

114

natural conditions which allow the users of a model checker to specify which paths
clearly cannot occur in the actual systems being modeled, i.e., occur only in the abstract models. Only fair paths then should be considered by the model checker (see[BBF+ 01] for a more thorough discussion). As we shall see later, regular fairness constraints are powerful enough for modeling interesting fairness constraints. Unlike thecase of recurrent reachability properties, the condition of effective closure under transitive closure on a class C of automatic systems is not sufficient to imply decidabilityof LTL model checking over C even without the extra fairness constraint. On the other
hand, if we impose an extra condition that the class C is closed under products withfinite systems, decidability of LTL model checking with regular fairness constraints
over C can be retained. The time complexity of the algorithm is exponential in the sizeof the formula ϕ and polynomial in the size of the presentation η of the system and theinitial configuration s0 , assuming an oracle for computing the reachability relations.
We shall also present an extension of this metatheorem to the problem of LTL model
checking with multi-regular fairness constraints (i.e. when we have several regularconstraints A1 , . . ., An akin to generalized Büchi conditions), in which case we obtainthe same complexity as the single-regular constraint case but exponential in the number
n of regular constraints. We shall see in Section 5.4 that the condition of closure under
products with finite systems is satisfied by the class of pushdown systems and prefixrecognizable systems, which yields decidability (with optimal complexity) of LTL withmulti-regular fairness constraints over pushdown systems and prefix-recognizable systems.
Closure under products with finite systems is a rather strong condition, which is
not satisfied by many classes of infinite-state systems (e.g. ground-tree rewrite systems). Such classes of infinite-state systems often have undecidable LTL model checking. In Section 5.2, we propose a weakening of the condition of closure under products with finite systems that could still be used to obtain algorithmic metatheoremsof fragments of LTL with decidable model checking over word/tree automatic systems. This relaxed condition is called closure under taking “subsystems”: a class Cof presentations of word/tree automatic systems is closed under taking subsystems if
η = hAS ; {Aa }a∈ACT i ∈ C and ACT′ ⊆ ACT implies that hAS ; {Aa }a∈ACT′ i ∈ C . In

other words, the subsystem of Sη that is obtained by removing some transition relations is still presented by some presentation in the class C . This is a rather innocuous
condition which is satisfied by virtually every natural class of infinite-state systems that

Chapter 5. Algorithmic metatheorems for logic model checking

115

is considered in the literature1 . We show that, when this condition is satisfied together
with effective closure under transitive closure, two commonly considered fragments of
LTL called LTL(Fs , Gs ) and LTLdet have decidable model checking with multi-regularfairness constraints. In this case, we show that these model checking problems havepolynomial time data complexity (when the number of constraints is fixed), assuming
an oracle for computing the reachability relations. We shall see in Section 5.4 thatthe class of RGTRSs is closed under taking subsystems and therefore have decidable
LTL(Fs , Gs ) and LTLdet model checking with multi-regular fairness constraints (infact, with polynomial-time data complexity). In addition, we show that multi-regularfairness constraints are sufficiently powerful for modelling natural fairness constraints
when we use RGTRSs as abstract models of concurrent programs with an unbounded
number of processes.
Finally, we conclude this chapter with a result which strongly suggests that obtaining algorithmic metatheorems for model checking branching-time logics over wordor tree automatic transition systems with good computational complexity is difficult.
More precisely, we show that model checking HM-logic (i.e. the simplest branchingtime logic) is already nonelementary over a fixed word-automatic system.
Parts of the results in this chapter have previously appeared in [TL10] and [To09a].

5.1 Model checking LTL
In this section, we present our algorithmic metatheorems for decidable LTL model
checking over word/tree automatic systems with regular fairness constraints. Observe first that this problem is more general than the problem of checking recurrent
reachability since the latter can be easily reduced to the former: given a presentation η of a word/tree automatic system Sη = hS, {→a}a∈ACT i, an initial configurations0 ∈ S, and a target automaton A , we have s0 ∈ Rec(L (A )) iff it is not the case that(Sη, s0 , L (A )) |= ⊥. Therefore, a natural question is whether effective closure un-

der transitive closure over a class C is sufficient to ensure decidability of LTL model
checking with regular fairness constraints over C . It turns out that this is not the caseeven for LTL model checking without regular fairness constraints, as the following
proposition shows.
Proposition 5.1.1 There exists a presentation η of a fixed automatic system Sη such
1 Similar remark has been made in [May01]

Chapter 5. Algorithmic metatheorems for logic model checking

116

that:
1. {η} is closed under transitive closure, but
2. LTL model checking over Sη is undecidable.
Proof. We shall give a reduction from the acceptance problem for the universal Turingmachine. Fix a universal Turing machine M = (Σ, Γ, Q, δ, q0, qF , 2) and its automaticpresentation η = hAS , Aa i of the transition system SM = hS, →ai generated by M

from Example 3.1.5, where S = Γ∗ (Q × Γ)Γ∗ and →a the one-step reachability relationof M . Define a new transition relation →acc ⊆ S × S as follows: from any accepting
configuration of the form w(qF , a)w′ , it is the case that w(qF , a)w′ →acc w(qF , a)w′

(i.e. a self-loop). Observe that →acc is a regular relation. In addition, we introduce

a “cheat” transition relation →b ⊆ S × S that can take any configuration c ∈ S to an-other configuration c ∈ S, i.e., →b = S × S. Observe that →b is a regular relation.
Therefore, the transitive closure of → :=→a ∪ →acc ∪ →b = →b is also regular.

Let Aacc and Ab be NWAs that recognize, respectively, →acc and →b . Define a newautomatic presentation η′ = hAS , Aa , Ab i which generates the automatic transition system Sη′ := hS, →a, →acc , →b i. Therefore, the class {η′ } of automatic presentations is
closed under transitive closure.

Now consider the LTL formula ϕ := a U acc. It is easy to see that, for each w ∈ Σ∗ ,it is the case that Sη , (q0, 2)w |= ϕ iff w is accepted by M . 2

We shall now introduce the condition of closure under products with finite systems
for a class C of word/tree automatic systems and show that decidability of LTL model
checking with regular fairness constraints can be retained when this extra condition
is imposed. Let us begin with word-automatic systems. Given a finite system F =hQ, {Ra}a∈ACT i and an Σ∗ -automatic system Sη = hS, {→a}a∈ACT i presented by apresentation η, their product is the system F ⋉ Sη = hS′ , {→′a}a∈ACT i where• S′ is the language QS = {qv : q ∈ Q, v ∈ S} over the alphabet Q ∪ Σ, and• →′a is such that qv →′a pw iff (p, q) ∈ Ra and v →a w.
Obviously, the system F ⋉ Sη is (Q ∪ Σ)∗ -automatic, for which a presentation is com-putable in time O(kFk × kηk). Although there are non-unique presentations of thesystem F ⋉ Sη , for convenience we will define the condition of closure under prod-

ucts with finite systems in such a way that the computation of the product system is
efficient.

Chapter 5. Algorithmic metatheorems for logic model checking

117

Definition 5.1.1 (Closure under products with finite systems) A class of automaticpresentations C is said to be (effectively) closed under products with finite systems if
there exists an algorithm which, given a finite system F over ACT and an automatictransition system Sη = hS, {→a}a∈ACT i presented by some η ∈ C , computes a presentation η′ ∈ C for the system F ⋉ Sη in time O(kFk × kηk).

We now state our algorithmic metatheorem for decidable LTL model checking withregular fairness constraints over word-automatic systems.
Theorem 5.1.2 Suppose that C is a class of word-automatic presentations that are effectively closed under transitive closure with an ETC-witness M and are closed under
products with finite systems. Then, there exists an algorithm which, given a presentation η of a Σ∗ -automatic system Sη = hS, {→a}a∈ACT i, a word v0 ∈ S, an NWA A

over Σ, and an LTL formula ϕ over ACT, decides whether (Sη, v0 , L (A )) |= ϕ in time
linear in |v0 | and polynomial in TIMEM (2O(kϕk) × kηk) and kA k.

Observe that when the formula ϕ is fixed, we obtain the same complexity as for ouralgorithmic metatheorem for recurrent reachability (up to a polynomial).
Proof. Let Sη = hS, {→a}a∈ACT i be the system presented by the input automaticpresentation η. We apply Vardi-Wolper’s algorithm (i.e. Proposition 2.5.2) on thenegation ¬ϕ of the given LTL formula ϕ yielding an NBWA B = (ACT, Q, δ, q0, F) of

size 2O(kϕk) such that L (B ) = [[¬ϕ]]. The algorithm runs in time 2O(kϕk) . It is clearthat B can be treated as a finite transition system (e.g. by omitting the initial stateq0 and set F of final states). We then use the assumption of closure under productswith finite systems to obtain in time O(kB k × kηk) an automatic presentation η′ of thesystem B ⋉ Sη = hQS, {→′a}a∈ACT i ∈ C . We may then apply the algorithm M on η′
to obtain the transitive closure →+ ofS′a∈ACT (→a ) in time

TIMEM (kB k × kηk) = TIMEM (2O(kϕk) × kηk).
Then, for each v0 ∈ S, we have (Sη , v0 , L (A )) 6|= ϕ iff it is the case that there exists an
infinite path

π := v0 →a1 v1 →a2 . . .
in Sη such that vi ∈ L (A ) for infinitely many indices i ∈ N and that a1 a2 . . . ∈/ [[ϕ]](or equivalently a1 a2 . . . ∈ L (B )). The latter in turn is true iff it is the case that v0 ∈Rec(FS, L (A ))[→+]. It is easy to see that an NWA N for FS can be constructed intime O(kB k × kηk). By Theorem 4.3.1, we may compute an NWA A ′ recognizing theChapter 5. Algorithmic metatheorems for logic model checking

118

set Rec(FS, L (A ))[→+] in time polynomial in TIMEM (kB k × kηk) and kA k. Testingwhether v0 ∈ L (A ′ ) can then be done in O((|Σ|+|Q|)×|v0|×kA ′ k), where |Q| ≤ kB k.
This immediately implies the theorem. 2

This proof also shows that the decidability in Theorem 5.1.2 holds for any logic thatcan be converted to Büchi automata, e.g., Regular LTL and its extension with past
operators [LS07, SL10]. Theorem 5.1.2 can also be extended to LTL model checking
with multi-regular constraints over word-automatic systems: given a presentation η ofa Σ∗ -automatic system Sη = hS, {→a}a∈ACT i, a configuration s0 ∈ S, an LTL formula
ϕ over ACT, and a sequence of “fairness” NWAs A1 , . . . , An over Σ, decide whether,for each infinite path
π := s0 →a1 s1 →a2 s2 →a3 . . .
in Sη satisfying ∃∞ i(si ∈ L (A j )) for each j ∈ N, it is the case that π |= ϕ. Whenhη, s0 , ϕ, {Ai }ni=1 i is a positive instance of the problem, we write (Sη, s0 , {L (Ai )}ni=1 ) |=ϕ and say that Sη satisfies ϕ from s0 with fairness constraints A1 , . . . , An . This prob-

lem can be defined in a similar way for tree-automatic systems. The following theorem
is now immediate from the proof of Theorem 5.1.2 and Theorem 4.3.1.
Theorem 5.1.3 Suppose that C is a class of word-automatic presentations that are
effectively closed under transitive closure with an ETC-witness M and are closed
under products with finite systems. Then, there exists an algorithm which, given a
presentation η of a Σ∗ -automatic system Sη = hS, {→a}a∈ACT i, a word v0 ∈ S, a se-quence of NWAs {A }ni=1 over Σ, and an LTL formula ϕ over ACT, decides whether(Sη, v0 , {L (Ai )}ni=1) |= ϕ in time linear in |v0 | and polynomial in TIMEM (2O(kϕk) ×kηk) and ∏ni=1 kAi k.

Observe that Theorem 5.1.2 is the restriction to Theorem 5.1.3 to n = 1. Also, observethat Theorem 5.1.3 when the formula ϕ is fixed, we obtain the same complexity as forrecurrent reachability with generalized Büchi conditions (i.e. Theorem 4.3.1.
We now proceed to the tree case. Given a finite system F = hQ, {Ra }a∈ACT i andan T REE k (Σ)-automatic system Sη = hS, {→a}a∈ACT i presented by a presentation η,

their product is the system F ⋉ Sη = hS′ , {→′a}a∈ACT i where the following conditions
are satisfied:• S′ is the language containing trees T = (D, τ) ∈ T REE k (Σ ∪ Q) for which there isChapter 5. Algorithmic metatheorems for logic model checking

119

a tree T ′ = (D′ , τ′ ) ∈ T REE k (Σ) and a state q ∈ Q satisfying D = 1D′ ∪ {ε} and(q
if w = ε,τ(w) =
τ(1w)otherwise.
For convenience, we shall write T ′ = q(T ) in the sequel.
• q1 (T1 ) →′a q2 (T2 ) iff (q1 , q2 ) ∈ Ra and T1 →a T2 .
Obviously, the system F ⋉ Sη is T REE k (Σ ∪ Q)-automatic, for which a presentationis computable in time O(kFk × kηk). As for the word-automatic case, there are non-unique presentations for the system F ⋉ Sη . For convenience, we will define the condition of closure under products with finite systems that ensures efficient computationof the product systems.
Definition 5.1.2 (Closure under products with finite systems; tree case) A class Cof tree-automatic presentations is said to be (effectively) closed under products withfinite systems if there exists an algorithm which, given a tree-automatic transition
system Sη = hS, {→a}a∈ACT i presented by some η ∈ C and a finite system F over
ACT, computes a presentation η′ ∈ C for the system F ⋉ Sη in time O(kFk × kηk).

We directly state our algorithmic metatheorem for decidable LTL model checking withmulti-regular fairness constraints over tree-automatic systems.
Theorem 5.1.4 Suppose that C is a class of tree-automatic presentations that are
effectively closed under transitive closure with an ETC-witness M and are closed
under products with finite systems. Then, there exists an algorithm which, given a
presentation η of a T REE k (Σ)-automatic system Sη = hS, {→a}a∈ACT i, a tree T0 ∈S, a sequence of NTAs {Ai }ni=1 over T REE k (Σ), and an LTL formula ϕ over ACT,

decides whether (Sη , T0 , {L (Ai )}ni=1) |= ϕ in time linear in |T0 | and polynomial in
TIMEM (2O(kϕk) × kηk) and ∏ni=1 kAi k.

Observe that when the formula ϕ is fixed, we obtain the same complexity as for our algorithmic metatheorem for recurrent reachability with a generalized Büchi conditions(up to a polynomial). In addition, the subcase of LTL model checking with singleregular constraints can be obtained when n is restricted to 1. The proof of Theorem
5.1.4 is essentially identical to the proof of Theorem 5.1.3 and so is omitted. As in theword-automatic case, this theorem holds for any logic that can be converted to Büchi
automata, e.g., Regular LTL and its extension with past operators [LS07, SL10].

Chapter 5. Algorithmic metatheorems for logic model checking

120

5.2 Model checking LTL fragments
Closure under product with finite systems is a strong condition that is not satisfied
by many classes of infinite-state systems (e.g. ground-tree rewrite systems). In thissection, we study a weakening of the condition of closure under products with finite
systems called closure under taking subsystems, and which fragments of LTL still
have decidable model checking over word/tree automatic systems when this relaxed
condition is imposed. Let us first start with the definition of this relaxed condition.
Definition 5.2.1 (Closure under taking subsystems) A class of word/tree automaticpresentations C is said to be closed under taking subsystems if, given an automatic presentation hAS , {Aa }a∈ACT i ∈ C and a subset ACT′ ⊆ ACT, the automatic presentation
hAS , {Aa }a∈ACT′ i is also in C .

As we previously mentioned, this condition is rather weak and is satisfied by virtually
every class of infinite-state systems that is considered in the literature. In this section,
we shall show that this condition, combined with effective closure under transitive closure, is sufficient to guarantee decidability of two following fragments of LTL: LTLdet
and LTL(Fs , Gs ). To this end, we shall first show an algorithmic metatheorem for decidable recurrent reachability checking on word/tree automatic transition systems withan extra almost linear Büchi automaton constraint.

5.2.1 Almost linear Büchi automata
As we saw from Proposition 2.5.2, LTL formulas can alternatively be represented as
NBWAs. Model checking a given LTL formula then can be reduced to checking recurrent reachability of the original system with an additional NBWA constraint encoding
the negation of the LTL formula. We shall now consider a subclass of NBWAs called
almost linear NBWAs [BŘS09], which are sufficiently powerful to represent the negations of formulas in the fragments of LTL that we will consider in this section.
To define almost linear NBWAs, we shall first define the notion of linear NBWAs.
An NBWA A = (Σ, Q, δ, q0, F) is called linear (a.k.a. 1-weak) if there exists a partial order  ⊆ Q × Q such that q′ ∈ δ(q, a) implies q  q′ . Intuitively, the partial

order ensures that once A leaves a state q, it will never be able to come back to q. In

other words, graph-theoretically A looks like a dag possibly with self-loops, i.e., eachstrongly connected component (SCC) in A contains only a single state. Observe that

Chapter 5. Algorithmic metatheorems for logic model checking

121

every accepting run of A must eventually self-loop in one final state q ∈ F, i.e., sink at
q. In the sequel, the depth of A refers to the length of the longest simple path in A .

Definition 5.2.2 ([BŘS09]) An almost linear NBWA A over the alphabet Σ is a pairof a linear NBWA B = (Σ, Q, δ, q0, F) and a function χ mapping each final state q ∈ F
to an LTL formula over Σ of the form

^

GFpi

i∈I

where each pi is a disjunction of positive atomic formulas. The language L (A ) of A
contains all words w ∈ Σω for which there is an accepting run of B on w sinking at

some q ∈ F which satisfies w |= χ(q). The size kA k of A is simply the sum of kB k and∑q∈F kχ(q)k.

Almost linear NBWAs are not more powerful than NBWAs in terms of expressive
power: there is a simple polynomial-time translation from almost linear NBWAs to
NBWAs [BŘS09] by a technique that is similar to the reduction from generalizedBüchi automata to standard Büchi automata (cf. [Wol00]). We shall now prove atechnical lemma that will be used to obtain algorithmic metatheorems for decidable
model checking of LTLdet and LTL(Fs , Gs ) over word/tree automatic transition systems. First, let us fix the following notation: given a transition system S = hS, {→a}a∈ACT i over ACT, a sequence of subsets σ = {Si }ni=1 of S, and an almost linear

NBWA A = (ACT, Q, δ, q0, F, χ), write [[A ]]∃S,σ to denote the set of all configurationss0 ∈ S from which there exists an infinite path
π = s0 →a1 s1 →a2 . . .
satisfying a1 a2 . . . ∈ L (A ) and ∃∞ i(si ∈ S j ) for each j ∈ [1, n].
Lemma 5.2.1 Suppose that C is a class of word-automatic presentations that is effectively closed under transitive closure with an ETC witness M and is closed under taking subsystems. Then, there exists an algorithm which, given a presentation η of a Σ∗ automatic system Sη = hS, {→a}a∈ACT i, a word v0 ∈ S, a sequence of NWAs {Ai }ni=1over Σ, and an almost linear NBWA A over ACT, decides whether v0 ∈ [[A ]]∃Sη,{L (Ai )}ni=1

in time linear in |v0 |, polynomial in TIMEM (kηk), kA k, and ∏ni=1 kAi k, but exponen-tial in the depth of A .

Proof. Suppose that A = (B , χ), where B = (ACT, Q, δ, q0 , F) is a linear NBWA over
ACT. Let d denote the depth of A . Loosely speaking, this lemma can be proven byChapter 5. Algorithmic metatheorems for logic model checking

122

observing that each infinite path s0 →a1 s1 →a2 . . . witnessing v0 ∈ [[A ]]∃Sη,{L (Ai )}n

i=1

can be divided into an initial finite segment {s0 }ri=1 and the remaining infinite segmentm{si }ω
i=r+1 such that there exists a sequence σ = {pi }i=1 of states in B satisfying(1) p0 = q0 ,(2) pm ∈ F,(3) for every i ∈ [1, m] it is the case that (pi , ai , pi+1 ) ∈ δ for some ai ∈ ACT,jj(4) there is an accepting run p00 . . . pmm (with each ji ∈ N) of B (when viewed as

automata over finite words) on a1 . . . ar ,V(5) ar+1 ar+2 . . . |= G a:pm ∈δ(pm ,a) a ∧ χ(pm ), and(6) ∃∞ i ≥ r + 1(si ∈ L (A j )) for each j ∈ [1, n].

Conversely, given two such segments, we may glue them to obtain an infinite path
witnessing v0 ∈ [[A ]]∃Sη,{L (Ai )}n . Our approach is to treat the finite segment and thei=1

infinite segments separately for each path σ of SCCs in B .

Fix a path σ = {pi }mi=1 of SCCs in B satisfying the conditions (1)–(3). Of course,

it is the case that m is at most the depth d of A . Combining the assumption of closure
under taking subsystems and effective closure under transitive closure of C , given any
subset ACT′ ⊆ ACT, it is possible to compute NWAs R+

transitive closure relations →+ACT′and →∗ACT′

ACT′

and R∗

ACT′

over Σ2⊥ for thefor the transition system Sη . This canbe done in time polynomial in TIMEM (kηk) for each given ACT′ ⊆ ACT.

Consider now the relation Rσ,1 ⊆ S × S containing tuples (s, s′) for which there ex-

ists a path s0 →b1 . . . →br sr such that s0 = s, sr = s′ , and there exists a run of B onjjb1 . . . br of the form p00 . . . pmm for some j0 , . . ., jm ∈ N. It is easy to compute a con-junctive query ϕ1 (x, y) with at most 2m = O(d) quantifiers and 2m = O(d) conjuncts,
each of the form R+

ACT′

or R∗

ACT′

, which expresses Rσ,1 . That is, we will choose ACT′that expresses the set of labels a that takes pi to pi+1 (or that self-loops on pi ). By
Proposition 3.1.2, we obtain an NWA for Rσ,1 in time polynomial in TIMEM (kηk)
and kA k, but exponential in the depth d of A .

We now consider the relation Rσ,2 ⊆ S consisting of elements s ∈ S from which

there exists an infinite pathsuch that a1 a2 . . . |= GV

s0 →a1 s1 →a2 . . .
∞pm ∈δ(pm ,a) a ∧χ(pm ), and ∃ i(si ∈ L (A j )) for each j ∈ [1, n].

Observe that it suffices to show that there exists an algorithm for computing an NWA

Chapter 5. Algorithmic metatheorems for logic model checking

123

over Σ for S that runs in time polynomial in TIMEM (kηk), kA k, and ∏ni=1 kAi k, but

exponential in the depth of A ; for, if this is the case, we would be able to easily put
together Rσ,1 and Rσ,2 by another conjunctive query with one conjunct and quantifier(and appealing to Proposition 3.1.2), which will finish the proof since there are at mostO(kA kd ) paths of SCCs in A satisfying (1)–(3).

Thus, it remains to show how to compute an NWA for Rσ,2 . Suppose that χ(pm ) =Vk

i=1 GFpi . Since pi is a disjunction of positive atomic formulas, we may think of themas a subset of ACT. We consider a modified transition system S′ = hS′ , {Ea }a∈ACT idefined as follows:• S′ = {1, . . ., k} × S,
• (iv, jw) ∈ Ea iff pm ∈ δ(pm , a), v →a w, and whenever i 6= j, then a ∈ pi .
It is easy to come up with a presentation η′ in time polynomial in kηk and kA k suchthat S′ = Sη′ . Suppose now that E + is the transitive closure ofSa∈ACT Ea . Observe

now thatRσ,2 = Rec(L (A1 ), . . ., L (An ), {1} × Σ∗, . . . , {k} × Σ∗ )[E +].
Therefore, by Theorem 4.3.1, it suffices to show that an NWA for E + can be computedin time polynomial in kA k and TIMEM (kηk). To this end, observe first that for eachpath (i0 , s0 ) →a1 . . . →ar (ir , sr ) in S′ , there exists a path from (i0 , s0 ) to (ir , sr ) of theform(i0 , s0 ) →a1 (i0 , s1 ) →a2 . . . →ar−1 (i0 , sr−1 ) →ar (ir , sr ).
In other words, to reach from (i, v) to ( j, w), we may always simply travel throughonly configurations of the form {i} × S and only at the end switch to ( j, w). SinceR∗{a:pm ∈δ(pm ,a)} can be computed in time polynomial in TIMEM (kηk), for each pair(i, j) ∈ [1, k] × [1, k], we may easily compute a conjunctive query ψ(i, j) (x, y) with one
conjunct and one quantifier over the relations {R∗

ACT′

, R+

ACT′

: ACT′ ⊆ ACT} which

expresses precisely all pairs in E + of the form (iv, jw). The relation E + can then be

easily obtained by taking union of k2 = O(kA k) NWAs which represent each [[ψ(i, j)]].
2
We shall now state the tree analogue of Lemma 5.2.1. The proof is completely identicalto the word case and therefore is omitted.

Chapter 5. Algorithmic metatheorems for logic model checking

124

Lemma 5.2.2 Suppose that C is a class of tree-automatic presentations that is effectively closed under transitive closure with an ETC witness M and is closed undertaking subsystems. Then, there exists an algorithm which, given a presentation η of a
T REE k (Σ)-automatic system Sη = hS, {→a}a∈ACT i, a tree T0 ∈ S, a sequence of NTAs

{Ai }ni=1 over T REE k (Σ), and an almost linear NBWA A over ACT, decides whether
T0 ∈ [[A ]]∃Sη,{L (Ai )}nin time linear in |T0 |, polynomial in TIMEM (kηk), kA k, andi=1
n∏i=1 kAi k, but exponential in the depth of A .

5.2.2 LTLdet : Deterministic LTL
Deterministic LTL (or LTLdet ) is logic proposed by Maidl [Mai00] that captures a common fragment of LTL and CTL. We start with the definition of the syntax of LTLdet :ϕ, ϕ′:= p | Xϕ | ϕ ∧ ϕ′ | (p ∧ ϕ) ∨ (¬p ∧ ϕ′ ) |(p ∧ ϕ)U(¬p ∧ ϕ′ ) | (p ∧ ϕ)W(¬p ∧ ϕ′ ).

Here p is a boolean combination of ACT. The semantics can be defined in the same
way as for LTL. For example, ϕWϕ′ is interpreted as the formula Gϕ ∨ (ϕUϕ′ ), i.e.,

the weak until operator. Maidl [Mai00] showed that negations of LTLdet formulas canbe translated into linear NBWAs efficiently, which is in contrast to the general LTL
formulas.
Lemma 5.2.3 ([Mai00]) There exists a polynomial-time algorithm which, given an
LTLdet formula ϕ over Σ, computes a linear NBWA A¬ϕ of size O(kϕk) such that

L (A¬ϕ) = [[¬ϕ]].

To obtain our algorithmic metatheorems for LTLdet , we simply need to combine Maidl’sresult above with Lemma 5.2.1 or Lemma 5.2.2.
Theorem 5.2.4 Suppose that C is a class of word/tree automatic presentations thatare effectively closed under transitive closure with an ETC-witness M and are closed
under taking subsystems. Then, there exists an algorithm which, given a presentation
η of a Σ∗ -automatic (resp. T REE k (Σ)-automatic) system Sη = hS, {→a}a∈ACT i, aconfiguration s0 ∈ S, a sequence of NWAs (resp. NTAs) {Ai }ni=1 over Σ (resp. over

T REE k (Σ)) and an LTLdet formula ϕ, decides whether Sη , s0 , {Ai }ni=1 |= ϕ in time

linear in |s0 |, polynomial in TIMEM (kηk) and ∏ni=1 kAi k, and exponential in kϕk.

In fact, if we also assume closure under products with finite systems, a better complexity can be obtained. The following theorem can be obtained by following the proofs

Chapter 5. Algorithmic metatheorems for logic model checking

125of Theorem 5.1.2 and replace the use of Vardi-Wolper’s construction by Maidl’s result
above.
Theorem 5.2.5 Suppose that C is a class of word/tree automatic presentations that are
effectively closed under transitive closure with an ETC-witness M and are closed under products with finite systems. Then, there exists an algorithm which, given a presentation η of a Σ∗ -automatic (resp. T REE k (Σ)-automatic) system Sη = hS, {→a}a∈ACT i,a configuration s0 ∈ S, a sequence of NWAs (resp. NTAs) {Ai }ni=1 over Σ (resp.

T REE k (Σ)) and an LTLdet formula ϕ over ACT, decides whether Sη , s0, {A }ni=1 |= ϕ intime linear in |s0 | and polynomial in TIMEM (kϕk × kηk) and ∏ni=1 kAi k.

5.2.3 LTL(Fs , Gs ): LTL with only strict future/global operators
We now proceed to the fragment LTL(Fs , Gs ) of LTL with only modalities Fs and
Gs . This fragment is strictly more expressive than the LTL fragment with the nonstrict versions F and G of the modalities Fs and Gs as the former can be expressedin terms of the latter, e.g., Fϕ ≡ ϕ ∨ Fs ϕ. Observe that the fragment LTL(Fs , Gs ) is

closed under negation. We next recall a known translation from LTL(Fs , Gs ) formulas
to almost linear NBWAs.

Lemma 5.2.6 ([Reh07, BŘS09]) There exists a double-exponential time translationfrom LTL(Fs , Gs ) formulas ϕ over ACT to almost linear NBWAs A over ACT such that[[ϕ]] = L (A ). Furthermore, the depth of A is exponential in kϕk.
It is presently open whether the double-exponential time upper bound from [Reh07,
BŘS09] can be improved. To obtain our algorithmic metatheorems for LTL(Fs , Gs ),we simply need to combine this lemma with Lemma 5.2.1 and Lemma 5.2.2.
Theorem 5.2.7 Suppose that C is a class of word/tree automatic presentations thatare effectively closed under transitive closure with an ETC-witness M and are closed
under taking subsystems. Then, there exists an algorithm which, given a presentation
η of a Σ∗ -automatic (resp. T REE k (Σ)-automatic) system Sη = hS, {→a}a∈ACT i, aconfiguration s0 ∈ S, a sequence of NWAs (resp. NTAs) {Ai }ni=1 over Σ (resp. over

T REE k (Σ)) and an LTL(Fs , Gs ) formula ϕ, decides whether Sη, s0 , {Ai }ni=1 |= ϕ in time

linear in |s0 |, polynomial in TIMEM (kηk) and ∏ni=1 kAi k, and double-exponential inkϕk.

Chapter 5. Algorithmic metatheorems for logic model checking

126

The upper bound in terms of the size of the formula in this theorem seems not optimal.
To improve this upper bound, one has to first answer whether the upper bound from
Lemma 5.2.6 can be improved further, which we leave as an open problem.

5.3 Model checking FOREG (Reach + EGF)
In this section, we give algorithmic metatheorems for showing decidability of an extension of the logic FOREG (Reach) and FO(Reach), called FOREG (Reach + EGF) andFO(Reach + EGF), over word/tree automatic systems.
We define the logic FOREG (Reach + EGF) as an extension of FOREG (Reach) withthe generalized recurrent reachability operator with ω-regular constraints on the way.
More precisely, the logic FOREG (Reach + EGF) over ACT can be defined as follows:• Each FOREG (Reach) formula over ACT is an FOREG (Reach + EGF) formula over
ACT.

• Whenever ϕ1 , . . ., ϕn are each an FOREG (Reach + EGF) formula over ACT with
one free variable and B is an NBWA over the alphabet ACT, then
EGFB (ϕ1 , . . . , ϕn )is an FOREG (Reach + EGF) formula over ACT with one free variable.
• The logic FOREG (Reach + EGF) is closed under boolean combinations and firstorder quantification, with the standard rules for free variables.

We only need to provide the semantics for the second rule (the rest is standard). Givena transition system S = hS, {→a}a∈ACT i and s ∈ S, we define• S |= EGFB (ϕ1 , . . . , ϕn )(s) iff there exists an infinite paths →a1 s1 →a2 s2 →a2 . . .
in S such that a1 a2 a3 . . . ∈ L (B ) and, for each j = 1, . . . , n, we have si |= ϕ j forinfinitely many i ∈ N.

Observe that the semantics of the operators EGFB are similar to recurrent reachability
with generalized Büchi conditions. We define FO(Reach + EGF) as a sublogic of
FOREG (Reach + EGF) containing formulas in which each occurence of the reachability
operator ReachA (x, y) satisfies L (A ) = Γ∗ for some Γ ⊆ ACT, and each occurence ofChapter 5. Algorithmic metatheorems for logic model checking

127

the recurrent reachability operator EGFB satisfies L (B ) = Γω for some Γ ⊆ ACT. We

now state our algorithmic metatheorem for FOREG (Reach + EGF).

Theorem 5.3.1 Suppose that C is a class of word/tree automatic systems that are effectively closed under transitive closure and closed under products with finite systems.
Then, given an FOREG (Reach + EGF) formula ϕ(x̄) over ACT and a presentation η ∈ C

of a word/tree automatic system Sη = hS, {→a}a∈ACT i, the set [[ϕ]] is effectively reg-ular. That is, model checking FOREG (Reach + EGF) over C is decidable.

The proof of this theorem can be easily done due to effective closures under first-order
operations for word/tree automatic systems (Proposition 3.1.1 and Proposition 3.2.1).
When seeing a predicate ReachA (x, y), we first construct a product with the finite system A and then apply the assumption of effective closure under transitive closure.
Similarly, when we encounter a EGFA operator, we first construct a product with finite
system B and then applying our algorithmic metatheorem for recurrent reachability
with generalized Büchi conditions (Theorem 4.3.1 and Theorem 4.3.2). We may also
relax the condition of closure under products with finite systems and instead use themuch weaker condition of closure under taking subsystems. In this case, we obtain thefollowing theorem using a similar proof.
Theorem 5.3.2 Suppose that C is a class of word/tree automatic systems that is effectively closed under transitive closure and closed under taking subsystems. Then, given
a presentation η ∈ C of a word/tree automatic system Sη = hS, {→a}a∈ACT i and an

FO(Reach + EGF) formula ϕ(x̄) over ACT, the set [[ϕ]] is effectively regular. That is,model checking FO(Reach + EGF) over C is decidable.

5.4 Several appetizer applications
In this section, we give applications of the algorithmic metatheorems that we provedin this chapter on pushdown systems, prefix-recognizable systems, and regular groundtree rewrite systems. More examples will be given in the next chapter.

5.4.1 Pushdown systems
Consider the problem of model checking LTL over PDSs. This combined complexity
was initially shown to be EXP-complete by Bouajjani, Esparza, and Maler [BEM97].

Chapter 5. Algorithmic metatheorems for logic model checking

128

The lower bound in [BEM97] can also be adapted to show EXP-hardness for expression complexity. On the other hand, the problem is solvable in P for a fixed LTL
formula [BEM97]. These upper bounds also hold for LTL formulas with regular valuations [EKS03], which are powerful enough for encoding multi-regular fairness constraints. Different proofs for these upper bounds have also been given (e.g. [PV04]).
Our techniques from the previous sections (Theorem 5.1.2 and Proposition 4.1.7) give
yet another proof for these upper bounds since PDSs are easily seen to be closed under
products with finite systems.
Proposition 5.4.1 Model checking LTL over pushdown systems with multi-regular fairness constraints is in EXP. For a fixed formula and fixed number of regular constraints,
the problem is solvable in P.
In fact, using our techniques, better combined complexity can be immediately obtainedfor LTLdet . The following proposition easily follows from Theorem 5.2.5 and Proposition 4.1.7.
Proposition 5.4.2 Model checking LTLdet over pushdown systems with a fixed numberof regular constraints is in P.
Our algorithmic metatheorems for FOREG (Reach + EGF) can also be used to give decidability of FOREG (Reach + EGF) model checking over PDSs, though this is rather
immediate from the decidability of model checking over PDSs with respect to MSO
formulas [MS85].

5.4.2 Prefix-recognizable systems
We now proceed to the problem of LTL model checking over prefix-recognizable
systems with multi-regular fairness constraints. This problem is known to be EXPcomplete, even for a fixed formula and no regular fairness constraints [KPV02]. Combining Theorem 5.1.2 and Proposition 4.1.11, we give yet another proof of this result
since prefix-recognizable systems are easily seen to be closed under products with finite systems.
Proposition 5.4.3 Model checking LTL with multi-regular fairness constraints overprefix-recognizable systems is solvable in EXP.

Chapter 5. Algorithmic metatheorems for logic model checking

129

On the other hand, our algorithmic metatheorem for LTLdet does not help lower thecomplexity of the problem since model checking a fixed LTLdet formula (with no regular fairness constraint) over prefix-recognizable system is already EXP-hard, which
follows from the EXP-completeness of checking reachability over prefix-recognizable
systems [Göl08]. In addition, our algorithmic metatheorems for FOREG (Reach + EGF)
can also be used to give decidability of FOREG (Reach + EGF) model checking overprefix-recognizable systems, though this immediately follows from the decidabilityof model checking over prefix-recognizable systems with respect to MSO formulas[Cau03].

5.4.3 Regular ground tree rewrite systems
Let us now proceed to the problem of model checking RGTRSs. We first start with anegative result about model checking LTL over GTRSs.
Proposition 5.4.4 The problem of model checking a fixed LTL formula over GTRSs(with no regular fairness constraints) is undecidable.
This proposition can be easily proved by an easy adaptation of the proof of the undecidability of model checking LTL over PA-processes [BKRS09]. In fact, this undecidability result holds for the fragment of LTL only with operator U, or the fragmentwith only operator F and X. In addition, observe that the class of GTRSs (or RGTRSs)
is not closed under product with finite systems, which explains why our algorithmic
metatheorems for decidable LTL model checking over tree-automatic systems fail inthis case. On the other hand, we can still recover some decidable fragments as thefollowing theorem shows.
Theorem 5.4.5 Model checking LTLdet with multi-regular fairness constraints overRGTRSs is in EXP. Model checking LTL(Fs , Gs ) with multi-regular fairness constraints over RGTRSs is solvable in double exponential time. Furthermore, for fixed
formulas and a fixed number of regular fairness constraints, model checking LTLdet
and LTL(Fs , Gs ) over RGTRSs is in P.
This theorem is a simple corollary of Theorem 5.2.4, Theorem 5.2.7, and Proposition
4.2.5. In the case of non-fixed LTLdet or LTL(Fs , Gs ) formulas but a fixed number ofregular fairness constraints, can the complexity of the problem be improved to P? For
example, this is the case for recurrent reachability as we showed in Theorem 4.3.6.

Chapter 5. Algorithmic metatheorems for logic model checking

130This is unlikely to be the case for LTL(Fs , Gs ) since the problem is already coNPcomplete even for finite systems [SC85]. However, LTLdet model checking over finite
systems is solvable in P [Mai00]. Despite this, this is not the case for GTRSs even in
the absence of regular fairness constraints.
Proposition 5.4.6 Model checking LTLdet over GTRSs is coNP-hard.
The proof of this proposition is by a simple reduction from the complement of thehamiltonian path problem, which is given in the appendix. We leave the precise combined complexity of LTLdet and LTL(Fs , Gs ) over GTRSs and RGTRSs for futurework.
An application of Theorem 5.4.5 is for model checking concurrent programs withan unbounded number of processes in the presence of fairness constraints. GTRSs
are natural models for modeling concurrent programs with an unbounded number ofprocesses, but with only “local communications”. We may think of each node in atree as a process in our concurrent programs. Trees ensure a hierarchical structure
amongs the processes in the programs: a node v with children v1, . . . , vk means thatthe processes v1, . . . , vk are subprocesses of the parent process v. GTRSs rules ensurethat communications only happen “locally”. Node labels in the trees then correspondto the finite abstract domains that are obtained by predicate abstractions [GS97] (inthe manner of how pushdown systems can be obtained from sequential programs, c.f.
[BMMR01, EK99]). A natural fairness constraint for concurrent programs is that thereis each leaf process will eventually be executed (i.e. there is some rewrite rule thatwill used to rewrite a subtree containing this node). This fairness constraint can bemodeled using multi-regular fairness constraints as follows. First introduce two extra
colors {1, 2} for the leaf nodes, i.e., if Σ is the original node alphabet, we use Σ′ :={1, 2, ?} × Σ for the new node alphabet. We then define a new GTRS which has thesame rule as the original GTRS, but ensures that internal nodes are labeled by {?} × Σ

while leaves are labeled by {1, 2} × Σ. Each rule will then allow the color in the leaves
to stay the same or toggle. We then simply have to consider infinite runs where the setof trees in which all the leaves are labeled by {1} × Σ and set of trees in which all theleaves are labeled by {2} × Σ are both visited infinitely often, which can be modeledusing two regular fairness constraints.

We close this section by mentioning the application of Theorem 5.3.2 to RGTRSs.
Theorem 5.4.7 Model checking FO(Reach + EGF) over RGTRSs is decidable.

Chapter 5. Algorithmic metatheorems for logic model checking

131

5.5 A nonelementary lower bound for HM-logic
In Section 5.3, we obtained algorithmic metatheorems for decidable model checkingof FOREG (Reach + EGF). The complexity that we obtained was nonelementary in thesize of the formula, which was optimal since there exists a fixed pushdown system (i.e.
the infinite binary tree) with a nonelementary FO(Reach) theory. A natural questionis whether better upper bounds can be given for weaker logics, say, EF-logic. In thissection, we shall prove that this is not the case even for HM-logic. More precisely, we
shall show that there exists a fixed automatic transition system with a nonelementary
HM-logic model checking. In fact, the transitive closure of the union of the transition
relations in this system is also regular, which strongly suggests that any algorithmic
metatheorem for decidable branching-time logics (like CTL and EF-logic) must impose much stronger restrictions for it to have nice computational complexity properties. Our nonelementary lower bound also strengthens Proposition 3.1.4 and answers
an open question from [BG09] on the expression complexity of modal logic over rational graphs.
Theorem 5.5.1 ([To09a]) There exists a fixed word-automatic transition system T =hS, {→a}a∈ACT i and a state s0 in S such that checking whether (S, s0) satisfies agiven HM-logic formula is nonelementary. Furthermore, the transitive closure ofSa∈ACT (→a ) is regular.

We shall now give a proof for this theorem. Recall that h{0, 1}∗, succ0 , succ1 , i is theinfinite binary tree with a descendant relation. We shall start with an observation that
the FO4 theory of h{0, 1}∗, succ0 , succ1 , i is nonelementary.
Proposition 5.5.2 The FO4 theory of h{0, 1}∗, succ0 , succ1 , i is nonelementary.
Although the first-order theory of h{0, 1}∗, succ0 , succ1 , i was proved to be nonele-

mentary in [CH90], it is not easy to see whether FOk suffices from the proof. Nevertheless, one can easily show that FO4 suffices using Stockmeyer’s result [Sto74], together
with a reduction from [CH90], as we shall sketch next. We start with a result which
is a simple corollary of Stockmeyer’s well-known result [Sto74] that equivalence ofstar-free regular expressions over the alphabet {0, 1} is nonelementary.
Proposition 5.5.3 The FO3 theory of the class C of finite linear orders with a unarypredicate is nonelementary.

Chapter 5. Algorithmic metatheorems for logic model checking

132

This proposition is a simple corollary of Stockmeyer’s result [Sto74] and Proposition
2.5.1. To deduce Proposition 5.5.2, we may simply use the polynomial time reduction
in [CH90] which, given a first-order sentence ϕ over C , outputs a first-order sentence
ψ with one extra variable such that ϕ is true in C iff (h{0, 1}∗, succ0 , succ1 , i, ε) |= ψ.
By Proposition 5.5.3, the proof for Proposition 5.5.2 is complete.
Now define the transition system
T := h{0, 1}∗ × {0, 1}∗ × {0, 1}∗ × {0, 1}∗;{≺i0 }4i=1 , {≺i1 }4i=1 , {<i }4i=1 , {=i, j }1≤i< j≤4 , {Gi }4i=1 i.

where the transition relations are defined as follows:• ≺i0 := { w, w′ : w′i = wi 0 and ∀ j 6= i(w j = w′j )}. This relation takes the ith component to its left child.

• ≺i1 := { w, w′ : w′i = wi 1 and ∀ j 6= i(w j = w′j )}. This relation takes the ith component to its right child.

• <i := { w, w′ : wi ≺ w′i and ∀ j 6= i(w j = w′j )}. This relation takes the ith component to its descendant.

• =i, j := { w, w′ : wi = w j and ∀k(wk = w′k )}. This relation simply loops if theith component equals the jth component.

• Gi := { w, w′ : ∀ j 6= i(w j = w′j )}. This relation takes the ith component to any
other word (i.e. global modality).

It is not difficult to give a word-automatic system that is isomorphic to T with a regulartransitive closure relation (since we have the global modalities Gi ).
Lemma 5.5.4 The transition system T is automatically presentable with a regulartransitive closure relation.
Proof. Let Γ := {0, 1, #} and Σ := Γ4 . Given words v1 , . . . , v4 ∈ {0, 1}∗, we definev1 ⊗′ . . . ⊗ v4 to be the word v1 ⊗ . . . ⊗ v4 but using # (instead of ⊥) as the padding

symbol, e.g., 0 ⊗′ 11 ⊗′ 1 ⊗′ 101 is simply  ##0  
 1  1  #        .
 1  #  #   
1
01

Chapter 5. Algorithmic metatheorems for logic model checking

133

Let S := {v1 ⊗′ . . . ⊗′ v4 : v1 , . . ., v4 ∈ Σ∗ }. We then define a relation Ra over S foreach relation a in T in the obvious way. For example, the relation R≺i is defined as the0

relation {(v, v′ ) ∈ S ×S : (v, v′ ) ∈≺i0 }. Let T′ be the system with domain S and relations

Ra , where a is a relation in T. It is easy to give an NWA AS over Σ recognizing theset S. Similarly, it is easy to construct an NWA Aa over the alphabet Σ⊥ × Σ⊥ forthe relations Ra . [These NWAs are very similar to the automata in Example 3.1.1.]

Therefore, T′ is a word-automatic system isomorphic to T. Finally, observe that thetransitive closure of the transition relations in T′ coincides with the regular relation
S × S, which completes the proof. 2
The following lemma is now sufficient to deduce Theorem 5.5.1.
Lemma 5.5.5 Checking whether a given HM-logic formula ϕ over T is satisfied by(T, (ε, ε, ε, ε)) is nonelementary.
Proof. We give a poly-time reduction from the FO4 theory of h{0, 1}∗, succ0 , succ1 , 
i. More precisely, we give a polynomial time computable function λ from FO4 for-mulas ϕ(x1 , . . . , x4 ) to HM-logic formulas λ(ϕ) over the vocabulary of T such that, foreach v1 , . . . , v4 ∈ {0, 1}∗,h{0, 1}∗ , succ0 , succ1 , i |= ϕ(v1 , . . . , v4 )⇔T, (v1 , . . . , v4 ) |= λ(ϕ)(∗)

The function λ is defined by induction on FO4 formulas over h{0, 1}∗, succ0 , succ1 , i.
First consider the three base cases:• We set λ(xi ≺0 x j ) := h≺i0 ih=i, j i⊤.
• We set λ(xi ≺1 x j ) := h≺i1 ih=i, j i⊤.
• We set λ(xi < x j ) := h<i, j ih=i, j i⊤.
It is easy to check that the statement (*) hold for these. Now consider the inductive
cases:• We set λ(ϕ ∧ ϕ′ ) := λ(ϕ) ∧ λ(ϕ′ ). It is easy to see that (*) holds by inductive
hypothesis.

• We set λ(¬ϕ) := ¬ϕ. Clearly, the statement (*) holds by inductive hypothesis.

Chapter 5. Algorithmic metatheorems for logic model checking

134• We set λ(∃xi ϕ) := hGi iλ(ϕ). We now show that (*) holds in this case. Without

loss of generality, let i = 1 (the other cases are similar). Let ψ := ∃x1 ϕ. Given

v1 , . . ., v4 ∈ {0, 1}∗ , we have h{0, 1}∗, succ0 , succ1 , i |= ψ(v1 , . . . , v4 ) iff there
exists v′1 ∈ {0, 1}∗ such that h{0, 1}∗, succ0 , succ1 , i |= ϕ(v′1 , v2 , v3 , v4 ). By in-ductive hypothesis, the latter statement is true iff T, (v′1 , v2 , v3 , v4 ) |= λ(ϕ), which
is true iff T, (v1, v2 , v3 , v4 ) |= hGi iλ(ϕ) by the definition of Gi relation. This fin-ishes the proof that (*) holds in this case.
2

Chapter 6More applications of algorithmic
metatheorems
In this chapter, we will give other applications of our algorithmic metatheorems fromthe previous chapters. In particular, we will apply our algorithmic metatheorems tomodel checking problems over PA-processes, subclasses of Petri nets (e.g. reversible
Petri nets and 2-dimensional vector addition systems), and reversal-bounded countersystems with discrete clocks and one free counter. There are other applications that we
do not mention in this chapter, e.g., for deriving decidability of LTL with multi-regularfairness constraints over order-2 collapsible pushdown systems (combining with Kartzow’s recent result [Kar10]).
Notation. We define a notation for LTL model checking with multiple fairness constraints. Given an LTL formula ϕ over ACT, a transition system S = hS, {→a}a∈ACT i,and subsets {Si }ni=1 of S, we write [[ϕ]]S,{Si}ni=1 to denote the set of configurations s ∈ S

satisfying (S, s, {Si}ni=1 ) |= ϕ, i.e., for each infinite path π = s0 →a1 s1 →a2 . . . in S

satisfying ∃∞ i(si ∈ Si ) for each j ∈ N, it is the case that π |= ϕ. 

6.1 PA-processes
PA [BW90, May98] is a well-known process algebra allowing sequential and parallel
compositions, but no communication. It generalizes basic parallel processes (BPP),
and context-free processes (BPA), but is incomparable to pushdown systems and Petrinets (e.g. see [May98]). PA has found applications in the interprocedural dataflow
analysis of parallel programs [EP00].

135

Chapter 6. More applications of algorithmic metatheorems

136

We review the basic definitions, following the presentation of [LS02]: we initially distinguish terms that are equivalent up to simplification laws. Fix a finite set
Var = {X ,Y, Z, . . .} of process variables. Process terms over Var, denoted by FVar , aregenerated by the grammar:t,t ′ := 0 | X , X ∈ Var | t.t ′ | tkt ′where 0 denotes a “nil” process, and t.t ′ and tkt ′ are sequential and parallel compositions, respectively. Process terms can be viewed as Σ-labeled binary trees, whereΣ = Var ∪ {0, k, ·}. In particular, inner nodes are always labeled by ‘.’ or ‘k’, while

leaves are labeled by elements in Var ∪ {0}. Observe that FVar is a regular tree language, for which a small NTA can be easily computed from any given Var. A PA

declaration over ACT is a tuple P = (ACT, FVar, ∆), where ∆ is a finite of rewrite rulesof the form (X , a,t), where X ∈ Var, a ∈ ACT, and t ∈ FVar . We set Dom(∆) = {X :(X → t) ∈ ∆, for some t ∈ FVar }, and Var0/ = Var − Dom(∆). A PA declaration P gen-erates a transition relation SP = hS, {→a}a∈ACT i, where S = FVar and →a is definedby the following inference rules:
t1 →a t1′
t1 →a t1′
t1 kt2 →a t1′ kt2
t1 .t2 →a t1′ .t2
t2 →a t2′
t2 →a t2′
t1 ∈ IsNilt1 kt2 →a t1kt2′
t1 .t2 →a t1 .t2′

X →a t(X , a,t) ∈ ∆Here IsNil is the set of “terminated” process terms, i.e., those in which all variables
are in Var0/ . It is easy to give an NTA Ra over T REE 2 (Σ⊥ ) for →a , whose size is linear
in the size kP k of P . It is defined in the same way as for GTRSs, except that when
it guesses a leaf node v at which a rule is applied, it must further ensure that v has no‘.’-labeled ancestor u such that v is a descendant of u2 and that the subtree rooted at
u1 is not a terminated process term. See [LS05a] for further details. The following
proposition is a well-known result concerning PA.
Proposition 6.1.1 ([LS02, LS05a, EP00]) Given a PA declaration ∆ and a NTA A
describing a set of process terms over Var, the sets pre∗ (L (A )) and post ∗ (L (A )) areregular, for which NTAs can be computed in time O(|Var| × kP k × kA k), and one canconstruct an NTA R + over T REE k (Σ⊥) for →+ in poly-time1 .

In this section, we consider only tree languages that are interpreted as regular subsets of FVar . From Proposition 6.1.1, Theorem 5.2.4, and Theorem 5.2.7, the following
1 Lugiez and Schnoebelen first proved this in [LS02] for a notion of tree transducers, but later in[LS05a] realized that regular relations sufficeChapter 6. More applications of algorithmic metatheorems

137

theorem is immediate.
Theorem 6.1.2 Model checking LTLdet and LTL(Fs , Gs ) with multi-regular fairness
constraints over PA are solvable in EXP and 2-EXP, respectively. For fixed formulasand fixed number of fairness constraints, these problems are solvable in P.
In the study of PA processes, it is common to use a structural equivalence on process
terms. We now extend our results to PA modulo structural equivalence. Let ≡ be thesmallest equivalence relation on FVar that satisfies the following:t.0 ≡ t(tkt ′)kt ′′ ≡ tk(t ′kt ′′)0.t ≡ ttk0 ≡ t(t.t ′).t ′′ ≡ t.(t ′.t ′′)We let [t]≡ stand for the equivalence class of t and [L]≡ for

tkt ′ ≡ t ′ktt∈L [t]≡. We write L/ ≡S

for {[t]≡ : t ∈ L}. It was shown in [LS02] that, for each t ∈ FVar , [t]≡ is a regular tree
language, although the set [L]≡ need not be regular even for regular L. Given a PA

declaration P and the transition system SP = hS, {→a}a∈ACT i generated by P , theequivalence ≡ generates a new transition system (SP / ≡) = hS′ , {⇒}a∈ACT i, where
S′ = [S]/ ≡, and [t]≡ ⇒a [u]≡ iff there exist t ′ ∈ [t]≡ and u′ ∈ [u]≡ such that t ′ →a u′ .

We need the following result:Lemma 6.1.3 ([LS02]) The relation ≡ is bisimulation: for all t,t ′, u ∈ FVar , if t ≡ t ′and t →a u, then there exists u′ ∈ FVar such that t ′ →a u′ and u ≡ u′ .

Using this lemma, we may easily show that, for every sequence {Ai }ni=1 of NTAs
such that each L (Ai ) is closed under ≡, and every LTL formula ϕ over ACT, the set[[ϕ]]SP ,{L (Ai )}ni=1 is also closed under ≡. This also implies that[[ϕ]]SP ,{L (Ai )}ni=1 = [[[ϕ]]SP ,{L (Ai )}ni=1 ]≡ = {t : t ∈ [[ϕ]](SP /≡),{L (Ai )/≡}ni=1 }.
The following theorem is then a direct consequence of Theorem 6.1.2.
Theorem 6.1.4 Given a PA P = (ACT, Var, ∆), a sequence of NTAs {Ai }ni=1 such thateach L (Ai ) is closed under ≡, an LTLdet (resp. LTL(Fs , Gs )) formula ϕ over ACT, anda process term t ∈ FVar, it is possible to decide whether (SP / ≡, [t]≡, {L (Ai )}ni=1 ) |= ϕin time EXP (resp. 2-EXP). Furthermore, for a fixed formula and a fixed number offairness constraints, the problem is solvable in P.
To see this, since [[ϕ]]SP ,{L (Ai )}ni=1 = [[[ϕ]]SP ,{L (Ai )}ni=1 ]≡, we need only test whether

SP ,t, {L (Ai)}ni=1 |= ϕ, which can be done by appealing to Theorem 6.1.2.

Chapter 6. More applications of algorithmic metatheorems

138

The decidability result of Theorem 6.1.4 is known in the absence of multi-regularfairness constraints, but without complexity analysis [BKRS09, Reh07]. A natural
question regarding Theorem 6.1.4 is whether multi-regular fairness constraints are useful since we need each constraint to be closed under ≡. The answer is positive. Recall

from Section 5.4 that multi-regular fairness constraints can be used to encode somenatural fairness constraint considered in the verification of ground tree rewrite systems, e.g., that each leaf process will eventually be executed. The encoding of thisconstraint is by additionally coloring the leaf processes by the color ‘1’ or ‘2’. We thenuse two regular fairness constraints L1 and L2 , where L1 encodes the set of all trees allof whose leaves are colored 1, while L2 encodes the set of all trees all of whose leaves
are colored 2. This encoding also works for PA since both L1 and L2 will be closed
under ≡.

6.2 Reversal-bounded counter systems
In this section, we combine our algorithmic metatheorems from the previous chapter
with known results in the literature to obtain new results on model checking problems
over reversal-bounded counter systems and their extensions with discrete clocks andone free counter, which were extensions of Ibarra’s reversal-bounded counter systems[Iba78] that were introduced in [DIB+ 00]. We first start with reversal-bounded countersystems with one free counter, and then extend the result when the systems have discrete clocks.

6.2.1 Basic model with one free counter
We first define the notion of reversal-bounded counter systems [Iba78]. First, the reader
should review the definition of counter systems from Example 3.1.4. Consider now ak-counter system M = (ACT, X , Q, ∆), the transition system SM generated by M , anda pathπ := s0 → s1 → . . . → sm
in SM , where si = (qi , n1,i , . . ., nk,i ). Intuitively, the number of reversals on a counterj in π is defined to be the number of switches from a non-increasing mode to a nondecreasing mode (or vice versa) of the value of the counter j in π. For example, if thevalues of f j are 1,1,1,2,3,4,3,2,2,3, then the number of reversals on the jth counter is
2. Let us make this definition more precise. For each j ∈ [1, k], consider the function

Chapter 6. More applications of algorithmic metatheorems

139

f j : [0, m] → N defined by f j (i) = n j,i . Observe that f simply records the value of thecounter j in configuration si . The number of reversals on a counter j in π is the numberof indices i ∈ [1, m − 2] for which there exists i′ > i satisfying either• (i) n j,i+1 = n j,i + 1, (ii) n j,i+1 = . . . = n j,i′ , and (iii) n j,i′ +1 = n j,i′ − 1, or• (i) n j,i+1 = n j,i − 1, (ii) n j,i+1 = . . . = n j,i′ , and (iii) n j,i′ +1 = n j,i′ + 1.
We define the number of reversals in π to be the maximum number of reversal on all
counters j in π. We say that M is r-reversal bounded if the number of reversals of M
on all paths π in SM is at most r. In addition, an r-reversal bounded counter system

M is said to have a free counter if there is no bound on the number of reversals madeby the first counter.
We are interested in the problem of model checking LTL formulas over reversalbounded k-counter systems M = (ACT, X , Q, ∆), where Q = {q1 , . . . , qn }, with multiregular fairness constraints (again, see Example 3.1.4 for the representation of sets ofconfigurations of M using automata). Note that regular relations are more expressive
than Presburger-definable relations as we have noted in Example 3.1.6.
Theorem 6.2.1 Model checking an LTL formula ϕ with multi-regular fairness constraints over r-reversal bounded k-counter system with n states and one free countercan be done in time polynomial in the size of each fairness constraint, exponential inn and in the number of fairness constraints, but double exponential in r, k, and kϕk.
In the case of a single Presburger arithmetic fairness constraint, this problem was already known to be decidable [DIP01], but without any complexity analysis. In the next
chapter, we shall lower the above upper bound complexity by one exponential when
there is no extra free counter.
Before we apply our algorithmic metatheorems for proving Theorem 6.2.1, let us
make a simple observation that the class of r-reversal bounded counter systems with
one free counter (for any fixed r ∈ N) is closed under products with finite systems.
Lemma 6.2.2 Given an r-reversal bounded k-counter system M = (ACT, X , Q, ∆) with
one free counter and a finite system F over ACT, the product F ⋉ SM can be represented by an r-reversal bounded k-counter system M ′ with one free counter, which canbe computed in polynomial time.
Let us now consider the reachability relations of reversal bounded counter systems with
one free counter. We shall first discuss how we may represent the reachability relations

Chapter 6. More applications of algorithmic metatheorems

140

of a k-counter system M with states Q = {q1 , . . . , qn } as subsets of N2k . For each pairqi , q j ∈ Q of states, we may define the 2k-ary relation Ri, j such that (l1 , . . . , l2k ) ∈Ri, j iff the configuration (q j , lk+1 , . . ., l2k ) is reachable from (qi , l1 , . . . , lk ) in SM . In

other words, Ri, j encodes the reachability relations of M from configurations of theform (qi , v) to configurations of the form (q j , w). In the sequel, if we say that thereachability relation of M is semilinear, we mean that each Ri, j is semilinear. We need
the following result on the reachability relations of reversal-bounded counter systems.
Proposition 6.2.3 ([Iba78, ISD+ 02]) The reachability relations of r-reversal bounded
k-counter systems M with one free counter are semilinear.
Let us briefly discuss the proof ideas of this proposition. To do so, we must first define
the notion of reversal-bounded counter automata, which can be understood as reversalbounded counter systems used as language recognizers (the difference is similar tothe difference between pushdown automata and pushdown systems). More precisely,
an r-reversal bounded k-counter automaton over Σ is an r-reversal bounded countersystem M = (Σε , X , Q, δ), where Σε = Σ ∪ {ε}, with an initial state q0 and a set F of
final states. The language L (M ) recognized by M contains the set of words w ∈ Σ∗

for which there exists a path

(p0 , v0 ) →a1 . . . →am (pm , vm )in the transition system SM generated by M satisfying p0 = q0 , pm ∈ F, and w =a1 . . . am . Such a path is said to be accepting and that w is said to be accepted by M .
Similar notions can be defined for reversal-bounded counter automata with one freecounter. The first step in the proof is the following lemma from [ISD+ 02].
Lemma 6.2.4 ([ISD+ 02]) There exists a polynomial-time algorithm which, given an
r-reversal-bounded k-counter system with states Q = {q1 , . . . , qn } with (resp. without) one free counter, computes a r-reversal bounded k-counter automaton with (resp.

without) one free counter such that the Parikh image of its language coincides with thereachability relations {Ri, j }i, j∈[1,n] .
The Parikh images of the language of r-reversal bounded k-counter automata with one
free counter have been shown by Ibarra [Iba78] to be effectively semilinear, which
immediately implies Proposition 6.2.3. We shall state Ibarra’s result as a proposition
since we will refer to it in the sequel.

Chapter 6. More applications of algorithmic metatheorems

141

Proposition 6.2.5 ([Iba78]) Given a reversal-bounded counter automaton with one
free counter, the Parikh image of its language is effectively semilinear.
We now offer a slight modification of Ibarra’s algorithm for computing the Parikh
image of reversal-bounded counter automata to obtain an acceptable complexity upper bound. It is well-known that semilinear sets over Nk coincide with subsets of Nk
that are definable in Presburger arithmetic [GS66]. If we represent semilinear sets asexistential Presburger formulas with homogenous linear (in)equations of the form
a1 x1 + . . . + am xm ∼ b,
where a1 , . . ., am , b ∈ Z and ∼∈ {=, 6=, <, >, ≤, ≥}, as atomic formulas, it turns outthat we can obtain the following upper bounds.

Proposition 6.2.6 We can compute a representation of the Parikh image of the language of a given r-reversal bounded k-counter automaton M with n states and one
free counter as existential positive Presburger formulas with linear (in)equations (withunary representation of numbers) in time polynomial in n, and exponential in k and r.
The complexity analysis of this proposition can simply be derived by replacing theuse of the original proof of Parikh’s Theorem [Par66] in Ibarra’s proof of Proposition
6.2.5 by the polynomial-time algorithm from [VSS05] computing an existential positive Presburger formula with linear (in)equations which represents the Parikh image ofa given context-free grammar (equivalently, pushdown automata).
Remark 6.2.1 In [Iba78], Ibarra did not provide complexity analysis of his algorithm.
This complexity analysis, however, can be easily inferred by analyzing the algorithm
from [Iba78] after using the algorithm from [VSS05] instead of [Par66]. Using this proposition, it is immediate that the Parikh images of the language ofreversal-bounded counter automata with one free counter are regular (in the sense given
in Example 3.1.4) since linear (in)equations can always be replaced by Presburger formulas. In order to obtain compact automata representations, we will instead use thefollowing translation from linear (in)equations to automata representations.
Proposition 6.2.7 ([BC96, WB00]) Given a homogeneous linear (in)equation of theform
a1 x1 + . . . + am xm ∼ bChapter 6. More applications of algorithmic metatheorems

142

where a1 , . . . , am , b ∈ Z, ∼∈ {=, 6=, <, ≤, >, ≥}, the subset of Nm containing valid val-uations (i1 , . . ., im ) of the variables (x1 , . . . , xm ) can be represented as an NWA A over{0, 1}m (in the sense of Example 3.1.4) with O(∑ni=1 |ai | + log(|b|)) states. Furthermore, this can be computed in time polynomial in ∑ni=1 |ai | + log(|b|).

In other words, NWAs representing linear (in)equations can be represented polynomially in the size of the numbers (with unary representations), but exponentially in thenumber of summands. In fact, it is known that this upper bound cannot be substantially improved for DWAs [Kla08], which was recently shown to hold also for NWAs
[DGH]. Proposition 6.2.7 can be combined with Proposition 3.1.3 from Chapter 3
to obtain a complexity bound on the size of NWA for existential positive Presburger
formulas with linear (in)equations. The following proposition can be derived by combining Proposition 6.2.7, Proposition 3.1.3, Proposition 6.2.6, and Lemma 6.2.4.
Proposition 6.2.8 There exists an algorithm which, given an r-reversal bounded kcounter system M with n states and one free counter, computes an NWA A representing
the reachability relation of M . Furthermore, the algorithm runs in time exponential in
n but double exponential in r and k.
Theorem 6.2.1 is then an immediate corollary of Proposition 6.2.8 and our algorithmic
metatheorem for LTL model checking over word-automatic transition systems.

6.2.2 Extension with discrete clocks
We now give an extension of Theorem 6.2.1 with discrete clocks with no increase incomputational complexity.
Let us first recall the definition of counter systems with discrete clocks [DIB+ 00].
An atomic clock constraint on clocks Y = {y1 , . . . , yt } is simply an expression of theform yi ∼ y j or yi − y j ∼ c, where ∼∈ {<, >, =}, 1 ≤ i, j ≤ t and c ∈ Z is a constant.

Here c is given in binary. In the sequel, we shall call this constant c a clock comparison
constant. An atomic counter constraint on counters X = {x1 , . . . , xk } is simply an

expression of the form xi ∼ 0, where ∼∈ {=, >}. A counter-clock (CC) constraint θon (X ,Y ) is simply a conjunction of a clock constraint on Y and a counter constraint on

X . Given a valuation ν : X ∪Y → N to the counter/clock variables, we can determine

whether θ[ν] is true or false in the obvious way. A k-counter system with t discrete
clocks over ACT is a tuple M = (ACT, X ,Y, Q, ∆), where• X = {x1 , . . . , xk } is a set of k counter variables,

Chapter 6. More applications of algorithmic metatheorems

143• Q is a set of states,• Y = {y1 , . . . , yt } is a set of t clock variables,• ∆ is a finite set of instructions of the form ((q, θ(X ,Y)), a, (q′, v,Y ′ )), where:– q, q′ ∈ Q,
– a ∈ ACT,– θ(X ,Y ) is a CC constraint on (X ,Y ),– v ∈ {−1, 0, 1}k , and– Y ′ ⊆ Y is a set of clock resets.
A configuration of M is a tuple (q, v, w) ∈ Q × Nk × Nt expressing the state M isin, the current values of the k counter, and the current values of the t clocks. The

k-counter system with t discrete clocks M also generates a transition system SM =hS, {→a}a∈ACT i defined as follows:• S = Q × Nk × Nt contains all configurations of M .
• Given two configurations c = (q, v, w) and c′ = (q′ , v′ , w′ ), we have c →a c′ iffthere exists an instruction ((q, θ(X ,Y )), a, (q′, u,Y ′ )) ∈ ∆ such that– θ[v, w] holds,– v′ = v + u, and/ then each clock progresses by one time unit: w′ = w + 1. If– If Y ′ = 0,
/ then the value of the clocks in Y ′ are reset, while the values of otherY ′ 6= 0,
clocks stay the same: for each yi ∈ Y ′ and y j ∈ Y \Y ′ , w′i = 0 and w′j = w j .

We may define the notions of reversal-bounded counter systems with one free counterand discrete clocks in the same way.
In order to apply our algorithmic metatheorems, first observe that the class ofreversal-bounded counter systems with one free counter and discrete clocks are closed
under products with finite systems. This observation is very similar to Lemma 6.2.2.
We next consider their reachability relations. First recall the following proposition
from [DIB+ 00].
Proposition 6.2.9 Suppose that M is an r-reversal bounded k-counter systems with t
discrete clocks and with (resp. without) one free counter. Let n be the number of states

Chapter 6. More applications of algorithmic metatheorems

144of M and l be the size (in binary) of the maximum absolute values of clock comparison
constants in M . Then, we may compute a r + 1-reversal bounded (k + t + 1)-counter
automata M ′ with (resp. without) one free counter such that P (L (M ′ )) coincides withthe reachability relation of M . Furthermore, the procedure runs in time polynomial inn, k, and r, but exponential in l and t.
In fact, in the paper [DIP01] Dang et al. only gave the proof of this proposition when
there is only one free counter and no reversal bounded counters, though they remarked
that this can easily be extended with reversal bounded counters which can indeed beeasily checked. Therefore, we may proceed as for the case without discrete clocks andobtain the following theorem.
Theorem 6.2.10 Model checking an LTL formula ϕ with multi-regular fairness constraints over r-reversal bounded k-counter system M with n states, t discrete clocks,
and one free counter can be done in time polynomial in the size of each fairness constraint, exponential in n and in the number of fairness constraints, but double exponential in r, k, t, kϕk, and the size (in binary) of the maximum absolute value of clock
comparison constant in M .

This theorem also answers an open question by Dang et al. [DIP01] whether recurrent
reachability with one Presburger-definable fairness constraint over reversal-bounded
counter systems with discrete clocks and one free counter is decidable.

6.3 Subclasses of Petri nets
In this section, we shall apply our algorithmic metatheorems from earlier chapters to
subclasses of Petri nets: (1) 2-dimensional vector addition systems with states, (2)reversible Petri nets, and (3) conflict-free Petri nets. Another subclass of Petri nets on
which we can apply our algorithmic metatheorems is called basic parallel processes,
which are a subclass of PA-processes which we considered earlier in this chapter.
Let us first recall the definition of vector addition systems with states. For our
purpose, a vector addition system with states (VASS) is a tuple P = (ACT, X , Q, δ),
where• X = {x1 , . . . , xk } is a set of places, and• δ is a finite subset of Q × ACT × Zk × Q each of whose member is a transition.

Chapter 6. More applications of algorithmic metatheorems

145

The transition system SP = hS, {→a}a∈ACT i generated by P is defined as follows:• S = Q × Nk , and• for each action symbol a ∈ ACT, and pair of configurations (q1 , v1 ), (q2 , v2 ) ∈Q × Nk , define (q1 , v1 ) →a (q2 , v2 ) iff there exists a transition (q1 , a, u, q2 ) ∈ δsuch that w = v + u.

Observe that this definition enforces that no place could be made negative in any execution of the system. We define Petri nets to be vector addition systems with one state,in which case we will omit the state component when defining Petri nets. It is not hard
to show that the transition systems generated by VASS and Petri nets are the same, i.e.,
for any given VASS P , we can come up with one-state VASS that simulates P . Finally,observe that VASS can be thought of as counter systems with no guard formulas.

6.3.1 Two-dimensional vector addition systems with states
Two-dimensional (2-dim) vector addition systems with states are simply VASS withtwo places. Leroux and Sutre [LS04] recently showed that the reachability relations of
2-dim VASS are effectively semilinear.
Proposition 6.3.1 ([LS04]) The reachability relations of 2-dim VASS are effectively
semilinear.
This result generalizes an earlier result by Hopcroft and Pansiot [HP79] on the effective
semilinearity of post ∗ and pre∗ for 2-dim VASS. Nonetheless, no complexity analysis
was provided in [LS04].
Observe now that VASS are word-automatic using the same encoding of countersystems as automata (see Example 3.1.4). Furthermore, we have remarked that semilinear sets (or equivalently Presburger-definable subsets of Nk ) can also be interpreted
as regular languages using the same encoding of tuples of numbers. Since 2-dim VASS
are closed under product with finite systems, our algorithmic metatheorem for decidable LTL model checking with multi-regular fairness constraints imply the following
theorem.
Theorem 6.3.2 Model checking LTL with multi-regular fairness constraints over 2dim VASS is decidable.

Chapter 6. More applications of algorithmic metatheorems

146

For this theorem, we could also replace regular fairness constraints with fairness constraints expressed as first-order formulas over Büchi Arithmetic (see Example 3.1.6),
which generalizes Presburger Arithmetic. In addition, although it is known that model
checking LTL over all VASS is EXPSPACE-complete [Yen92] (when only infinite
paths are considered), to the best of our knowledge it is open whether the problem isdecidable in the presence of semilinear (let alone, multi-regular) fairness constraints.
At any rate, this problem is easily seen as hard as reachability for Petri nets, which is
decidable but not known to be primitive recursive (cf. [May84]). As we remarked, thecomplexity of the construction of the reachability relations from [LS04] was not given.
Therefore, we leave it as an open problem to pinpoint the precise complexity of thisproblem.

6.3.2 Conflict-free Petri nets
Let us briefly recall the definition of conflict-free Petri nets; for more details, the reader
is referred to [Esp96]. Let P = (ACT, X , δ) be a Petri net with k places. Given a
configuration v of P , and a transition t = (a, u) of P , we say that t is enabled at v iftt

there exists w ∈ Nk such that w = v + u. In this case, we write v → w or simply v →if w is not important. We say that P is conflict free if, for each v ∈ Nk , and pairs t1 ,t2
t

t

t

t

1
2
1
2
of transitions of P , we have v →and v →
implies v →w→
for some w ∈ Nk . The

reachability relations of conflict-free Petri nets are known to be effectively semilinear.

Proposition 6.3.3 ([LS05a]) The reachability relations of conflict-free Petri nets are
effectively semilinear.
Combining this with our algorithmic metatheorem for recurrent reachability with generalized Büchi conditions, we obtain the following theorem.
Theorem 6.3.4 Checking recurrent reachability with multi-regular fairness constraints
over conflict-free Petri nets is decidable.
Since no complexity analysis was provided in [LS05a], we leave the complexity ofthis problem for future work. Finally, since it is easy to see that conflict free Petrinets are closed under taking subsystems, our algorithmic metatheorems for LTLdet and
LTL(Fs , Gs ) imply the following theorem.
Theorem 6.3.5 Model checking LTLdet and LTL(Fs , Gs ) with multi-regular fairness
constraints over conflict-free Petri nets is decidable.

Chapter 6. More applications of algorithmic metatheorems

147

6.3.3 Reversible Petri nets
A Petri net P = (ACT, X , δ) is said to be reversible if for each transition t ∈ δ, theret′texists a transition t ′ ∈ δ such that → is an inverse of the relation →, i.e.,tt′→= {(v, w) : w → v}.
For a more thorough treatment of reversible Petri nets, we refer the reader to [Esp96].
The reachability relations of reversible Petri nets are known to be effectively semilinear.
Proposition 6.3.6 ([LS05a]) The reachability relations of reversible Petri nets are effectively semilinear.
Combining this with our algorithmic metatheorem for recurrent reachability with generalized Büchid conditions, we obtain the following theorem.
Theorem 6.3.7 Checking recurrent reachability with multi-regular fairness constraints
over reversible Petri nets is decidable.
Again, since no complexity analysis was provided in [LS05a], we leave the complexityof this problem for future work.

Part II
Specific Approaches

149

Chapter 7
Reversal-bounded counter systems
and their extensions
Minsky’s counter systems are well-known Turing-powerful models of computation.
Hence, to obtain decidability, restrictions need to be imposed. We have seen in Chapter 6 that reversal-bounded counter systems, which were initially proposed by Ibarra[Iba78], are not Turing-powerful since they have decidable reachability and LTL model
checking with complex fairness constraints. Furthermore, we saw that this is true evenin the presence of one free counter and any number of discrete clocks. In this chapter, we shall investigate such models more thoroughly, especially with regards to theprecise complexity of model checking problems.
We saw in Chapter 6 that our algorithmic metatheorem for LTL model checking
with fairness constraints, combined with the result of [DIB+ 00, ISD+ 02, Iba78], yields
decidability of LTL with fairness constraints over r-reversal k-counter systems with t
discrete clocks and one free counter, which was left open by by Dang et al. [DIP01]. In
fact, the complexity upper bound that we obtained was double exponential time, evenfor a fixed LTL formula. This is far worse than the best known complexity lower boundfor the problem, which is PSPACE-hard due to the presence of an unbounded numberof clocks or binary representation of numbers in the clock constraints [CY92] (also see[AM04]). In this chapter, we shall rectify this problem in the case of reversal-bounded
counter systems with discrete clocks, but without one free counter.
Recall from Chapter 6 that the results of [DIB+ 00, ISD+ 02, Iba78] yield a doubleexponential time procedure for computing an NWA representing the reachability relation of a given r-reversal k-counter systems P with t discrete clocks and one freecounter. More precisely, if n is the number of states of P , the complexity of this pro151

Chapter 7. Reversal-bounded counter systems and their extensions

152

cedure is exponential in n, and double exponential in r (in unary), k, t, and the size ofthe binary representation of the maximum number appearing in clock constraints in P .
We observe that the constructions from [DIB+ 00, ISD+ 02, Iba78] substantially rely on
Ibarra’s original algorithm [Iba78] for the computation of semilinear sets representing
the Parikh image of the language recognized by reversal-bounded counter machines.
Ibarra’s original algorithm [Iba78] has been observed by Gurari and Ibarra [GI81]
to give non-optimal algorithms for solving various problems (e.g. nonemptiness) for
reversal-bounded counter machines. Gurari and Ibarra proposed a new technique forderiving a PSPACE upper bound for nonemptiness (and therefore reachability) for
reversal-bounded counter machines. In fact, the procedure of [GI81] runs in polynomialtime when the parameters r and k are fixed constants. Later, Howell and Rosier [HR87]
improved both the upper bound and lower bound for nonemptiness of reversal-bounded
counter machines even in presence of one free counter. They showed that the problem
is NP-complete when at least one of the parameters r and k is not fixed. Again, thetechnique of Howell and Rosier’s avoids the use of Ibarra’s original algorithm from[Iba78].
A careful look at Ibarra’s algorithm [Iba78] reveals that the bottleneck of its running time is due to the use of Parikh’s Theorem [Par66]. It can be easily checked that
Parikh’s construction of the Parikh images for CFGs (or, equivalently pushdown automata) runs in exponential time and may output a union of exponentially many linear
sets in the worst case. In the case of r-reversal k-counter machines without one freecounter, Parikh’s construction was applied in [Iba78] to an NWA that is obtained fromthe input reversal-bounded counter machine of size exponential in r and k, and polynomial in the number n of states of the counter machine. The exponentiallity of Parikh’s
construction then gives double exponential complexity in r and k, and exponential inn for computing the Parikh images of reversal-bounded counter machines. Althoughseveral different proofs for Parikh’s Theorem with different flavours and techniques
exist in the literature (e.g. see [Esp97b, Koz97, SSMH04, VSS05]), it can be easily
checked that all of these constructions could produce at least exponentially many linear
sets in the worst case even when the size of the alphabet is restricted to one.
The first hint that better upper bounds could be obtained for NWAs is due to
Chrobak [Chr86] and Martinez [Mar02], who showed that there exists a polynomialtime algorithm which, given an NWA A over an alphabet Σ of size 1, computes a unionSmi=1 {ai + tbi : t ∈ N} of polynomially many arithmetic progressions — whose offsets

ai and periods bi are bounded polynomially in the number of states — representing

Chapter 7. Reversal-bounded counter systems and their extensions

153

the Parikh image P (A ) of A . [Unfortunately, the proofs in [Chr86, Mar02] containa subtle error, which were recently fixed by the author in [To09b].] A generalization of Chrobak-Martinez’s Theorem has been recently discovered independently byKopczynski [Kop10] and the author [To10] with different proofs (see also the merged
paper [KT10]). These results give an algorithm which, given an NWA with n statesover an alphabet of size k ≥ 1, computes a union of linear sets with at most k peri2

ods and total size 2O(k log n) (with unary representation of numbers in the output), i.e.,

polynomial for all fixed k. Previously, it was not even known whether the number of
periods in the linear sets could be made independent of n except for the special cases
when k = 1 [Chr86] and k = 2 [Abe95]. Furthermore, the running time of our algorithms is polynomial in n and exponential in k, i.e., polynomial when k is fixed. This
chapter primarily aims to present the author’s proof [To10] of this normal form theorem for NWAs, and show how they can be applied to obtain optimal model checking
complexities of reversal-bounded counter systems and their extensions with discrete
clocks.
This chapter is organized as follows. In Section 7.2, we prove a “Caratheodorylike” theorem for linear sets. Caratheodory’s Theorem for convex cones is a wellknown result from the study of convex sets [Zie07] that over Rk the convex cone generated by the vectors in V = {v1 , . . . , vm } ⊆ Rk could be subdivided into convex conesthat are generated by subsets S ⊆ V of size at most k. More precisely, this fact can be

written ascone(V ) =[cone(S),

S⊆V,|S|≤kwhere, if S = {w1 , . . . , wr }, we define cone(S) := {∑ri=1 ti wi : t1, . . . ,tr ∈ R≥0 }. Ob-

serve that the number of cones on the right is only exponential in k (and polynomial
in m). Our Caratheodory-like theorem for linear sets simply says that, given the set

V = {v1 , . . ., vm } ⊆ Nk , the linear set P(0;V ) can be written as a union of r linear
sets P(w1 ; S1 ), . . . , P(wr ; Sr ), where each Si is a subset of V of size at most k andthe parameter r, as well as each number in each offset wi , is bounded exponentiallyin the dimension k, but polynomially in m and the maximum number a occuring invectors in V . Furthermore, the linear sets P(w1 ; S1 ), . . . , P(wr ; Sr ) can be computedin polynomial time provided that the dimension k is fixed. In fact, we shall provea more general version of this Caratheodory-like for Z-linear sets. In Section 7.3,
we shall use this Caratheodory-like theorem for linear sets to obtain a normal form
theorem for Parikh images of NWAs. We shall also show in this section that the up-

Chapter 7. Reversal-bounded counter systems and their extensions

154

per bound complexity given by this normal form theorem is tight and that the same
upper bound does not hold for CFGs even over the fixed alphabet Σ = {a}. Before

showing how the normal form theorem can be used to improve model checking complexities of reversal-bounded counter systems and their extensions, in Section 7.4 wegive three simple applications of our Caratheodory-like theorem for linear sets andnormal form theorem for Parikh images of NWAs: (1) polynomial-time fragments ofinteger linear programming, (2) decision problems for Parikh images of NWAs, and(3) Presburger-constrained graph reachability. In Section 7.5, we use our normal form
theorem to obtain optimal complexity for the problem of model checking LTL withcomplex fairness constraints and EF-logic over reversal-bounded counter systems andtheir extensions with discrete clocks. Moreoever, we shall show that model checking
CTL is undecidable over reversal-bounded counter systems without discrete clocks.

7.1 Preliminaries
In this section, we shall define notations that will be used throughout this chapter. Fix
an NWA A over some alphabet Σ. Given a path π = p0 a1 . . . pm in an NWA A , we shallwrite P (π) to denote the Parikh image P (a1 . . . am ) of the path labels a1 . . . am .
We shall now fix some matrix notations. Given two n-by-n 0-1 matrices M =[mi, j ]n×n and M ′ = [m′i, j ]n×n , we write M • M ′ to denote the matrix M ′′ = [m′′i, j ]n×n

with m′′i, j =′k=1 (mi,k ∧ mk, j ). The operator • is often referred to as boolean matrix
multiplication, which can easily be evaluated in O(n3 ). We also write M ∨ M ′ to denoteWn

the application of the boolean operation ∨ component-wise, i.e., resulting in a matrix
M ′′ = [m′′i, j ]n×n with m′′i, j = mi, j ∨ m′i, j . In the sequel, we shall also write M[i, j] for the(i, j)-component mi, j of M.

Above we have defined the notions of convex cones. We now define a similar
notion when the coefficients of the linear combinations are naturals (instead of nonnegative reals). Given a finite subset S of vectors over Zk , let coneN (S) denote thelinear set P(0; S). We now state a very simple fact about arithmetic on semilinear sets
which we will frequently use in this chapter.
Sr

St
k
k
i=1 P(vi ;Vi ) ⊆ N and S2 = j=1 P(w j ;W j ) ⊆ N . Then,
S S
it is the case that S1 + S2 = ri=1 tj=1 P(vi + w j ;Vi ∪ W j ). In addition, we have

Fact 7.1.1 Suppose that S1 =P(v; S) = v + coneN (S).

Chapter 7. Reversal-bounded counter systems and their extensions

155

7.2 A Caratheodory-like theorem for linear sets
In this section, we shall prove a Caratheodory-like theorem for linear sets of the form
coneN (V ). This will also imply a Caratheodory-like theorem for general linear sets
P(v;V ) = v + coneN (V ).
Theorem 7.2.1 Let V := {v1 , . . . , vm } ⊆ Zk \ {0} with m > 0. Let a ∈ N be the max-

imum absolute value of numbers appearing in vectors of V . Then, it is possible to2compute in time 2O(k log(m)+k log(ka)) a sequence of Z-linear bases hw1 ; S1 i, . . . , hwµ ; Sµ isuch that

coneN (V ) =µ[P(wi ; Si )i=1

where the maximum absolute value of entries of each wi is O(m(k2a)2k+3 ), each Si is2

a subset of V with |Si | ≤ k, and µ = O(m2k (k2 a)2k +3k ). Furthermore, if V ⊆ Nk , wehave {w1 , . . . , wµ } ⊆ Nk .

Observe that this theorem causes only an exponential blow-up in the dimension k.
Moreover, each set Si contains at most k generators. To prove this theorem, we startwith a slight strengthening of the conical version of Caratheodory’s theorem from thetheory of convex sets [Zie07, Proposition 1.15]. The proof is given in the appendix.
Lemma 7.2.2 Let V := {v1 , . . . , vm } ⊆ Zk \ {0} with m > 0. Let a ∈ N be the maximum

absolute value of numbers appearing in vectors of V . Then, it is possible to computein time 2O(k log m+log log a) , a sequence S1 , . . ., Sr of distinct linearly independent subsets
of V with d elements, where d ∈ {1, . . ., k} is the rank of V , andcone(V ) =r[cone(Si ).

i=1

Let us first explain the idea behind the rest of the proof of Theorem 7.2.1. Intuitively,
Lemma 7.2.2 says that cone(V ) ⊆ Rk can be subdivided into smaller subcones withexactly d ∈ {1, . . ., k} generators where d is the rank of V . This lemma immediately
gives an upper bound for coneN (V ) as the union of the integer points in cone(Si ); in
general, the latter contains many more points than coneN (V ). On the other hand, we
have

Sr

i=1 coneN (Si ) ⊆ coneN (V ), where the inclusion is strict in general. It turns outthat an equality can be achieved by first making a “few” duplicates of each coneN (Si )and then shifting them appropriately by some “small” integer vectors.

Chapter 7. Reversal-bounded counter systems and their extensions

156

We now prove Theorem 7.2.1. First invoke Lemma 7.2.2 on V and obtain linearly independent d-subsets S1 , . . ., Sr of V , where d = rank(V ) and r ≤ mk , satisfyingSS
cone(V ) = rj=1 cone(S j ). Then, it follows that cone(V )∩Zk = rj=1 cone(S j ) ∩ Zk .

To compute the integer vector “shifts”, we shall need to define the notions of canonicaland minimal vectors.
Characterization via canonical and minimal vectors

Suppose now that v ∈ cone(S j ) ∩ Zk and S j = {u1 , . . ., ud }. We make several simple
observations:(O1) There exists a unique vector [v] ∈ {−ka, . . . , ka}k ∩ cone(S j ) and unique nonnegative integers s1 , . . . , sd such that: 1) v = [v] + Σdi=1 si ui , and 2) [v] = Σdi=1ti ui

for some (unique) 0 ≤ t1 , . . .,td < 1. To see this, observe that by linear independence of S j there exist some unique λ1 , . . ., λd ∈ R≥0 such that v = Σdi=1 λi ui .

Simply let si := ⌊λi ⌋, ti := λi − si , and [v] := Σdi=1ti ui . Uniqueness is immediatefrom uniqueness of λ1 , . . . , λd .

(O2) Given v′ ∈ cone(S j ) ∩ Zk , we write v ∼ v′ iff [v] = [v′ ]. It is easy to see that ∼ isan equivalence relation of finite index (there are at most (2ka + 1)k equivalenceclasses). If [v] = v, the vector v is said to be a canonical representative of theequivalence class {u ∈ cone(S j ) ∩ Zk : [u] = v}. In this case, we will also call v

an S j -canonical vector, or simply canonical vector when S j is understood.

(O3) If v is in coneN (V ) ∩ cone(S j ), then v + Σdi=1 si ui ∈ coneN (V ) ∩ cone(S j ) for
every s1 , . . . , sd ∈ N.

We shall now use these observations to define a natural well-founded partial order  j/ Given v, w ∈ coneN (V )∩on coneN (V )∩cone(S j ); note that coneN (V )∩cone(S j ) 6= 0.

cone(S j ), we write v  j w iff, for some (unique) S j -canonical vector v0 and some
(unique) coefficients s1 , . . ., sd ∈ N and t1 , . . .,td ∈ N, it is the case that: 1) v = v0 +

Σdi=1 si ui , 2) w = v0 + Σdi=1ti ui , and 3) (s1 , . . . , sd )  (t1 , . . .,td ). The following simple

lemma shows that  j is a well-founded partial order, and characterizes  j -minimal
elements.
Lemma 7.2.3 The relation  j is a well-founded partial order on coneN (V )∩cone(S j ).
Furthermore, a vector v ∈ coneN (V ) ∩ cone(S j ) is  j -minimal iff none of the vectors(v − u1 ), . . . , (v − ud ) are in coneN (V ) ∩ cone(S j ).

Chapter 7. Reversal-bounded counter systems and their extensions

157

Proof. That  j is a partial order is due to:• Observations (O1) and (O2): the uniqueness of choice of canonical vector v0
and coefficients s1 , . . . , sd ∈ N for each vector v satisfying v = v0 + Σdi=1 si ui .

• That  is a partial order on Nk .
To see that  j is well-founded, assume that there exists a strictly decreasing sequencev1  j v2  j . . .. Let vi = v0 + Σdj=1 sij ui for some unique canonical vector v0 = [vi ] andjunique coefficients ai = (si1 , . . . , sd ) ∈ Nd . In this way, we generate a strictly decreasing

sequence a1 ≻ a2 ≻ . . . for the well-founded partial order ≻ on Nk , and therefore acontradiction. Thus,  j is a well-founded partial order on coneN (V ) ∩ cone(S j ).

Given a  j -minimal vector v ∈ coneN (V ) ∩ cone(S j ), it is obvious that none of thevectors (v − u1 ), . . ., (v − ud ) cannot be in coneN (V ) ∩ cone(S j ). Conversely, given a

vector v ∈ coneN (V )∩cone(S j ) which is not  j -minimal, we could find another vectorv′ ∈ coneN (V ) ∩ cone(S j ) such that v′  j v. Using Observation (O3), it is easy to showthat at least one of the vectors (v − u1 ), . . . , (v − ud ) is in coneN (V ) ∩ cone(S j ). 2

Lemma 7.2.3 and Observation (O3) immediately implies that coneN (V ) is a union of
linear sets P(v; S j ) taken over all j = 1, . . . , r and  j -minimal vectors v.
Lemma 7.2.4 The following equality holds
coneN (V ) =r [[P(v; S j ),j=1 v

where v is taken over all  j -minimal vectors.
Proof. (⊇) Obvious.
(⊆) If v ∈ coneN (V ), then v ∈ cone(S j ) ∩ Zk for some j ∈ {1, . . ., r}. By Lemma

7.2.3, there exists a  j -minimal vector v′ satisfying v′  j v. Observation (O3) implies
that v ∈ P(v′ ; S j ). 2
Note also that if V ⊆ Nk , then all  j -minimal vectors (1 ≤ j ≤ r) are also nonnegative.
A roadmap for rest of the proof is as follows. We shall show that each  j -minimal

vectors cannot be too large and can be efficiently enumerated. This will immediately
give us the desired sequence of linear bases. The proof of this will require connections
to integer programming, and the use of dynamic programming.

Chapter 7. Reversal-bounded counter systems and their extensions

158

Bounds via integer programming

For each S j = {u1 , . . . , ud }, we shall now show that all  j -minimal vectors v cannot

be too large. To this end, for each canonical vector v0 ∈ cone(S j ) ∩ Zk , consider the

integer linear program Ax = vT0 (x  0), where A is the k × (m + d) matrix consist-ing of columns v1 , v2 , . . . , vm , −u1 , −u2 , . . ., −ud (in this order) and x is the column(m + d)-vector consisting of the variables x1 , . . ., xm , y1 , . . . , yd (in this order). The fol-lowing simple lemma shows that -minimal solutions to such integer programs — as

we shall see, they cannot be too large as well — provide upper bounds for how large
 j -minimal vectors can be.
Lemma 7.2.5 For every  j -minimal vector v ∈ coneN (V ) ∩cone(S j ), let v0 := [v] andt = (t1, . . . ,td ) ∈ Nd be the unique coefficients such that v = v0 + Σdi=1ti ui . Suppose

also that c = (c1 , . . . , cm ) is a -minimal solution to the integer program Σm
i=1 xi vi = v(x  0). Then, the vector w := (c, t) ∈ Nm+d is a -minimal solution to the integer
program Ax = v0 (x  0).

Proof. That w is a solution is immediate. To show -minimality, consider a vectoru = (c′1 , . . ., c′m ,t1′ , . . .,td′ ) ∈ Nm+d such that u  w and AuT = v0 . Define v′ := v0 +′′
Σdi=1ti′ ui and thus v′ = Σm
i=1 ci vi . This means that v ∈ coneN (V ) ∩ cone(S j ) and, by j -minimality of v, it follows that v′ = v and thus ti′ = ti for every 1 ≤ i ≤ d. That c is′a -minimal solution to the integer program Σm
i=1 xi vi = v (v  0) implies that ci = ci

for every 1 ≤ i ≤ m and, thus, u = w. 2

Consider the set U of all vectors v0 + Σdi=1 si ui , where v0 ranges over all canonical vectors and s1 , . . . , sd ranges over all d-tuples of nonnegative integers such that
(c1 , . . . , cm , s1 , . . . , sd ) is a -minimal solution to the integer program Ax = v0 , forsome c1 , . . . , cm ∈ N. We shall see now that the maximum absolute value B of numbers
appearing in U exists, which immediately gives an upper bound for the maximum ab-

solute value of entries of  j -minimal vectors. The following general lemma, whose
proof is a straightforward adaptation of the proof of [Pap81, Theorem p. 767], yields
an upper bound for B.
Lemma 7.2.6 Let A be a k × n integer matrix and b a k-vector, both with entries in[−t,t] ∩ Z, where t ∈ N. Then, every -minimal solution x ∈ Nn to Ax = b (x  0) isin {0, 1, . . ., n(kt)2k+1}n .

Chapter 7. Reversal-bounded counter systems and their extensions

159

Notice that the maximum absolute value of numbers appearing in our integer programs
cannot exceed t := ak (which could appear on the right hand side of the equation). If
M := (m+k)(kt)2k+1 , it follows that B ≤ akM +ak ≤ N := (m+k)(k2 a)2k+2 +ak. This

completes the proof of existence for Theorem 7.2.1 and gives us the desired bounds forthe parameter µ and the maximum absolute value of entries of each wi in Theorem
7.2.1. It remains to show how to make this algorithmic.
Computing canonical and minimal vectors

We first show how to compute all the canonical vectors. Since Gaussian-elimination
over rational numbers can be implemented to run in time polynomial in the total
number of bits in the input matrix [Edm67] and that each S j is linearly independent, we could easily compute all S j -canonical vectors (for all j ∈ {1, . . ., r}) in time
2O(k log(ka)+k log m) by going through all candidate vectors v ∈ {−ka, . . . , ka}k and checking whether there exist 0 ≤ t1 , . . . ,td < 1 such that Σdi=1ti ui = v. [Transform into row-

reduced echelon form to compute the unique solution, if exists. Since S j ∪ {v} ⊆ Zk ,the coefficients t1 , . . . ,td will be rational.]

For each fixed j ∈ {1, . . ., r} and each fixed S j -canonical vector v0 , we now show

how to compute the set of all  j -minimal vectors v such that [v] = v0 by dynamic
2

programming in time 2O(k log m+k log(ka)) . Observe that since there are at most r(2ak +1)k = 2O(k log(kam)) possible v0 , doing this for all canonical vectors would take time2

2O(k log m+k log(ka)) , which is also the total complexity of the algorithm. To this end, we
first fill out in stages a table T1 which keeps track of all vectors v ∈ {0, 1, . . ., N}k ∩coneN (V ). At stage h = 1, 2, . . ., m, we collect all vectors v that can be written asΣhi=1 ci vi , where 0 ≤ ci ≤ M. Since the size of the table is at most N k (k log N) —k log N bits are used to identify each element in the table with an associated k-tuple —2this could be carried out in time O(m(N k (k log N))2 ) = 2O(k log m+k log(ka)) . We thenfill out in stages another table T2 , which keeps track of all vectors v ∈ {0, 1, . . ., N}k ∩P(v0 ; S j ). This could be done in d stages, similar to the computation of T1 , and could be2

implemented to run in time O(k(N k (k log N))2 ) = 2O(k log m+k log(ka)) . We then simply
compute a new table T3 = T1 ∩ T2 , from which we eliminate vectors that are not  j -minimal by using the characterization of  j -minimal vectors from Lemma 7.2.3. All2

in all, this could be implemented to run in time 2O(k log m+k log(ka)) .

Chapter 7. Reversal-bounded counter systems and their extensions

160

7.3 Parikh images of regular languages
7.3.1 A normal form theorem
In this section, we shall apply Theorem 7.2.1 to obtain a normal form theorem for
Parikh images of NWAs.
Theorem 7.3.1 Let A be an NWA with n states over an alphabet Σ of size k. Then,
there exists a representation of the Parikh images P (L (A )) of A as a union of linear
sets P(v1 ; S1 ), . . ., P(vm ; Sm ), where the maximum entry of each vi is O(n3(k+1) k4k+6 ),2each Si is a subset of {0, . . ., n}k with |Si | ≤ k, and m = O(nk +3k+3 k4k+6 ). Further2

more, this is computable in time 2O(k log(kn)) .

Observe that this theorem causes an exponential blow-up only in the size of the alphabet. Efficiency could be improved by outputting numbers in binary.
We shall now prove this theorem. Let A = (Σ, Q, δ, q0, qF ) be a given NWA, where|Q| = n and Σ = {a1 , . . . , ak }. Throughout the proof, we shall use the notion of “cycletype”. A cycle type is a Parikh image v ∈ Nk of any word w ∈ Σ≤n such that there isa path π of A on w from some (not necessarily initial) state p to itself. The cycle π issaid to witness v. Observe that the sum of the components of any cycle type cannot
exceed n.
Characterization of P (L(A))

We start with a characterization of the Parikh image of A in terms of Parikh images of“short” paths together with some cycle types. Given a path π = p0 a1 p1 . . . ar pr of A
from the state p0 to the state pr , let Sπ ⊆ {0, . . . , n}k be the set of all the cycle types

that are witnessed by some cycles C = p′0 p′1 . . . pt′ p′0 in A such that p′i = p j for somei ∈ {0, . . . ,t} and j ∈ {0, . . . , r}. That is, C and π meet at state p′i = p j ; see Figure 7.1.
Now define Tπ to be the linear set P(P (π); Sπ).

Lemma 7.3.2 The following identity holds:

P (L (A )) =

[
π

Tπ ,

where π is taken over all accepting runs of A of length at most (n − 1)2.
To prove this lemma, we shall make use of the following simple fact, whose proof (inAppendix) is to a large extent similar to the well-known fact from graph theory that

Chapter 7. Reversal-bounded counter systems and their extensions

161

C
π
p′i = pj
Figure 7.1: The path π (solid line) meets with the cycle C (broken line) at the state

p′i = p j (filled circle).
C2
q2
π′

C1
q1

q0

q3

Figure 7.2: The path π is defined as follows: from q0 it walks to q1 , continues to q2 (viahalf of cycle C1 ), takes the cycle C2 once, and then proceeds to q1 (via the rest of cycleC1 ) and straight to q3 . The decomposition is π′ (in solid line) and the cycles C1 and C2(in broken lines).

the existence of a path between two given points implies the existence of a simple path
between the same given points.
Fact 7.3.3 Given an NWA A with n states and a path π in A from q to q′ , there exist
a simple path π′ from q to q′ and finitely many simple cycles C1 , . . .,Ch (possibly with
duplicates) such thath

P (π) = P (π′ ) + ∑ P (Ci ).
i=1

An illustration of this simple fact is given in Figure 7.2.
Proof of Lemma 7.3.2. (⊆) Assume that v ∈ P (L (A )) and let σ = p0 a1 p1 . . . ar pr bean accepting run in A such that P (σ) = v. We shall construct another accepting run

σ′ in A of length at most (n − 1)2 . For each state q occuring in σ, let l(q) be the last(i.e. maximum) index i ∈ {0, . . . , r} such that pi = q. Let us write down all such l(q)in an increasing order, e.g., i0 < i1 < . . . < is = r. Note that s < n. By Fact 7.3.3,

each subpath σ[i j , i j+1 ] of σ can be decomposed into a simple path π j from pi j topi j+1 of length at most n − 1 and finitely many simple cycles (possibly with duplicates)

Chapter 7. Reversal-bounded counter systems and their extensions

162

C1 , . . . ,Ch each of length at most n such that P (π[i j , i j+1 ]) = P (π j ) + Σhi=1 P (Ci ). Sucha decomposition result, however, might allow some cycle Ci to avoid (i.e. not meetwith) π j . For example, in Figure 7.2 the cycle C2 does not meet with the path π′ . On
the other hand, Ci must visit some states of pi0 , . . . , pis as this sequence contains allstates in σ. Thus, we simply define σ′ to be the accepting path π0 ⊙ π1 ⊙ . . . ⊙ πs−1 oflength at most (n − 1)2 . It follows that v ∈ Tσ′ .

(⊇) Conversely, let v ∈ Tπ for some accepting run π in A of length at most (n − 1)2 .

Then, if Sπ = {v1 , . . . , vs }, then v = P (π) + Σsi=1ti vi for some t1 , . . . ,ts ∈ N. Let Ci bea cycle in A that meets with π and satisfies P (Ci ) = vi . We can construct an accepting

path σ in A with P (σ) = v as follows: start from π as the “base” path, and for eachi ∈ {1, . . ., s}, attach ti copies of Ci to one pre-selected common state of Ci and π. 2
As an immediate corollary of Lemma 7.3.2, we have:
Proposition 7.3.4 Let A be an NWA with n states over an alphabet Σ of size k. Then,P (L (A )) can be represented as a union of linear sets P(v1 ; S1 ), . . . , P(vm ; Sm), wherevi ∈ {0, . . . , (n − 1)2}k and the components of each vector in Si cannot exceed n.
Remark: A slightly stronger version of this proposition was claimed in [SSM07],
where the maximum component of each vi cannot exceed n. Their proof turns out
to have a subtle error that also occurs in the proof of Chrobak-Martinez Theorem[Chr86, Mar02], which was recently fixed in [To09b]. In fact, we show in Proposition 7.3.10 below that our quadratic bound is essentially optimal, i.e., it cannot belowered to o(n2).

(End Remark)Observe now that the proof of existence in Theorem 7.3.1 is essentially immediate from Proposition 7.3.4 and Theorem 7.2.1. We will next show that an algorithm
for computing the desired semilinear basis can be obtained using a dynamic programming.
Dynamic programming algorithm

We first show how to compute all the cycle types of A . More precisely, let Q ={q0 , . . . , qn−1 }, where qn−1 := qF , and let I = {(t1, . . . ,tk ) ∈ Nk : Σki=1ti ≤ n}. For
each vector v ∈ Nk , we write Mv = [ai, j ]n×n for the n-by-n 0-1 matrix where ai, j = 1

iff there exists a path π from qi to q j with P (π) = v. We are interested in computing
all matrices Mv for each v ∈ I. Observe that the naive algorithm, which runs throughall paths of A from qi to q j with P (π) = v, has time complexity that is exponential

Chapter 7. Reversal-bounded counter systems and their extensions

163

in n. We will give an algorithm for computing these in time 2O(k log n) using dynamic
programming. To this end, let us derive a recurrence relation for computing Mv basedon Mv′ with v′  v. As a base case, we first observe that M0 is the n-by-n identity

matrix. Furthermore, each matrix Mei could be constructed easily from the transition
relation δ of A . [Recall that {ei }ki=1 is the standard basis for Rk .]Lemma 7.3.5 Let v = (r1 , r2 , . . ., ri−1 , ri + 1, ri+1 , . . . , rk ) with each ri ∈ N. Then, thefollowing identity holds:

Mv =

_
u,w

Mu • Mei • Mw

where u ranges over all vectors  v whose ith entry is 0, and w is the vector v − ei − u.
Intuitively, this recurrence relation can be derived by observing that a path π with

P (π) = v can be uniquely decomposed into three consecutive path segments π1 , π2 ,and π3 with P (π1 ) = u, P (π2 ) = ei , and P (π3 ) = w, for some u and w satisfying theprescribed condition. The path segment π2 contains the first occurence of the letter ai
in the path π. The proof of this lemma can be found in the appendix. The following
lemma, whose proof is also in the appendix, is a simple application of Lemma 7.3.5
and dynamic programming.
Lemma 7.3.6 We can compute {Mv }v∈I in time 2O(k log n) .
For each i ∈ {0, . . ., n − 1}, let Γi be the set of all cycle types v witnessed by somecycle π = p0 p1 . . . p0 in A with p j = qi . Since {Mv }v∈I have been computed, all sets

Γi could be computed within O(nk+1 ) extra time.

2

We now show how to compute P (L (A )) in time 2O(k log(kn)) . To this end, we shalluse another application of dynamic programming based on Lemma 7.3.2, Theorem2
7.2.1, and the sets {Γi }n−1i=0 , which we already computed. For each 0 ≤ i ≤ (n − 1)π Tπ where π is taken over all paths in A of length i
S(n−1)2
from q0 to q j . By Lemma 7.3.2, it is the case that P (L (A )) = i=0 Ti,n−1 ; recall

and each 0 ≤ j < n, let Ti, j :=Sthat qn−1 = qF by definition. We shall now derive a recurrence relation for Ti, j .
Lemma 7.3.7 It is the case that T0,0 = {0} and T0, j = 0/ for each j ∈ {1, . . . , n − 1}.
Whenever i > 0 and j ∈ {0, . . ., n − 1}, we haveTi, j =n−1[
h=0

Ti−1,h +[1≤l≤k,(qh ,al ,q j )∈δ

P(el , Γ j ) .

Chapter 7. Reversal-bounded counter systems and their extensions

164

This recurrence relation can be derived by observing that every path π of length i fromq0 to q j can be decomposed into the path π[0, i − 1] ending at some state qh and thepath π[i − 1, i] = qh al q j . The cycle types Γ j can be “used” since q j is visited. The
proof is in the appendix.

To finish the proof of Theorem 7.3.1, it suffices to give an algorithm with running2

time 2O(k log(kn)) for computing a desired semilinear basis Pi, j for each set Ti, j . The
algorithm runs in (n − 1)2 + 1 stages, where at stage i = 0, . . ., (n − 1)2 the set Pi, j iscomputed. Obviously, we first set P0,0 = {0} and P0, j = 0/ for each j ∈ {1, . . . , n −h1}. Inductively, suppose that Pi,h = {hvhs ; Ssh i}ms=1 has been computed for each h ∈{0, . . ., n − 1}. We will show how to compute Pi+1, j for any given j ∈ {0, . . ., n − 1}.

For each h ∈ {0, . . ., n − 1}, let Jh denote the set of numbers l ∈ {1, . . ., k} such that
(qh , al , q j ) ∈ δ. Therefore, we have Pi,h +Sl∈Jh P(el ; Γ j ) =S mh Ss=1hhl∈Jh P(vs + el ; Ss ∪Γ j ). We use the algorithm from Theorem 7.2.1 to compute another semilinear basis foreach P(vhs + el ; Ssh ∪ Γ j ) and then compute unions in the obvious way to obtain Pi+1, j(note: duplicates is removed). The output of this algorithm is P =S(n−1)2i=1

Pi,n−1 . The

correctness of the algorithm is immediate from Lemma 7.3.7.
We now analyze the time complexity of this algorithm. By induction, it is easy
to see that at every stage of the algorithm Ssh ∪ Γ j ⊆ {0, . . ., n}k holds for each h ∈{0, . . ., n −1} and s ∈ {1, . . . , mh }. Therefore, the maximum component over all offsets

in the semilinear basis Pi+1, j is at most a + O(n3(k+1) k4k+6 ), where a is the maximum

entry in each vhs + el over all h ∈ {0, . . ., n − 1}, l ∈ Jh , and s ∈ {1, . . . , mh }. Note thatthe summand O(n3(k+1) k4k+6 ) is due to an application of Theorem 7.2.1. By induction,3(k+1) k4k+6 ).
at stage i the maximum component over all offsets in {Pi, j }n−1j=0 is i × O(nThis means that the maximum entry of each offset in P is O(n3k+5 k4k+6 ), and the num2

ber of linear bases in P is O(nk +3k+5 k4k+6 ) (since duplicates are always removed). It2

is also easy to see that at each stage i, the algorithm runs in time 2O(k log(nk)) , primarily spent in the algorithm from Theorem 7.2.1. All in all, our algorithm runs in time2

2O(k log(nk)) , which is also the complexity of the entire procedure.

7.3.2 Complementary lower bounds
We shall now prove three lower bounds to complement earlier results in this section.
We start by proving that every semilinear basis for the Parikh image of a DWA can belarge in the size of the alphabet.
Proposition 7.3.8 For each k ∈ Z>0 and each integer n > 1, there exists a DWA An,kChapter 7. Reversal-bounded counter systems and their extensions

165

over the alphabet Σk := {a1 , . . . , ak } with n + 1 states whose Parikh image contains atleast nk−1 /(k − 1)! linear sets.

Proof. Let An,k = (Q = {q0 , . . . , qn }, δ, q0 , qn ) with δ(qi , a) = qi+1 for each a ∈ Σk and0 ≤ i < n. This automaton has a finite language L (An,k ) with Parikh image P (L (An,k ))containing precisely all ordered integer partitions of n into k parts, i.e., all tuples(n1 , . . . , nk ) with ∑ki=1 nk = n. Since the set P (L (An,k )) is finite, each ordered integer partition (n1 , . . . , nk ) of n must appear in precisely one linear set. Finally, it is easy
to check (e.g. see [vLW01, Chapter 13]) that the number of ordered partitions of n intok parts equals n+k−1≥ nk−1 /(k − 1)!. 2
k−1
This proposition implies that, for every fixed k ≥ 1, there exists infinitely many DWAs

{An } over an alphabet of size k where An has size O(n) but P (L (An )) must containΩ(nk−1 ) linear bases. Therefore, this shows that k cannot be removed from the exponent in Theorem 7.3.1. In addition, observing that the DWAs that we constructed haveequivalent regular expressions of size O(n), Proposition 7.3.8 also gives lower bounds
for Parikh images of regular expressions.
Next, we show that Theorem 7.3.1 cannot be extended to languages of CFGs
(equivalently, PDAs). More precisely, we show that the number of linear sets for Parikh
images of CFGs could be exponential in the size of the CFGs.
Proposition 7.3.9 There exists a small constant c ∈ Z>0 such that, for each integern > 1, there exists a CFG Gn of size at most cn over the alphabet Σ := {a} whose
Parikh image contains precisely 2n linear sets.

Proof. We will construct a CFG Σn such that P (L (Gn )) = {0, 1, . . ., 2n − 1}, each ofwhose elements will appear in precisely one linear set. Our construction uses the lower
bound technique in [PSW02].
n−1
Our CFG Gn contains nonterminals S, {Ai }n−1i=0 , and {Bi }i=0 , and consists preciselyof the following rules:

S → A0 . . . An−1

Ai → ε for each 0 ≤ i < n
Ai → Bifor each 0 ≤ i < n

Bi → Bi−1 Bi−1
B0 → afor each 0 < i < nChapter 7. Reversal-bounded counter systems and their extensions

166

The initial nonterminal is declared to be S. It is easy to prove by induction that, foriieach word w ∈ Σ∗ , Bi ⇒∗ w iff w = a2 . This implies that Ai generates either ε or a2 .

Thus, we see that L (Gn ) = {ai : 0 ≤ i < 2n }, which easily yields the desired result. 2

Finally, we give a lower bound proving the tightness of quadratic upper bound in
Proposition 7.3.4, even when restricted to DWAs.
Proposition 7.3.10 For each positive integer n > 2, there exists a DWA An with 2n + 3
states such that if P (L (An )) =Sr

i=1 P(vi ; Si ), then one entry in some vi is at leastn(n + 1)/2.
This proof is given in the appendix. In fact, the constructed DWA An has an equivalent
regular expression of size O(n) as well, therefore yielding the same quadratic lower
bound for regular expressions.

7.4 Three simple applications
In this section, we shall give three simple applications of our main results in previous sections not all of which are related to model checking: (1) polynomial-time
fragments of integer linear programming, (2) decision problems for Parikh images ofNWAs, and (3) Presburger-constrained graph reachability. As we shall see in the next
section, some of these results will be used to obtain better complexity upper bounds formodel checking over reversal-bounded counter systems and their extensions with discrete clocks. Other applications of the main results in the previous sections including
polynomial PAC-learnability of semilinear sets (with unary representation of numbers)
can be found in [To10].

7.4.1 Integer programming
Integer programming (IP) is the problem of checking whether a given integer program
Ax = b (x  0), where A is a k-by-m integer matrix and b ∈ Zk , has an integral solution.
This problem is a standard NP-complete problem in computational complexity (cf.

[PS98]). We shall mention two well-known polynomial-time fragments of IP and thengive a generalization that subsumes both.
The first polynomial-time fragment of IP, due to Lenstra [Len83], is obtained by
fixing the number m of variables in the integer programs. More precisely, Lenstra
showed that IP is solvable in time polynomial in the size of the input and exponential

Chapter 7. Reversal-bounded counter systems and their extensions

167

in m. The complexity of Lenstra’s algorithm has been improved by Kannan [Kan83] tomlog m L log L, where L is the input length. Let us now mention the second polynomialtime fragment, due to Papadimitriou [Pap81]. Firstly, observe that when k = 1 is fixed,
IP reduces to the well-known NP-complete knapsack problem (cf. [PS98]). On theother hand, the knapsack problem is easily seen to be pseudopolynomial-time solvable(cf. [PS98]), i.e., solvable in polynomial-time when numbers in the input are represented in unary. The second polynomial-time fragment of IP is obtained by restricting
the number k of equations in the integer programs and enforcing the numbers in the
input to be represented in unary. Therefore, it is a generalization of the knapsack problem when numbers in the input are represented in unary. Papadimitriou [Pap81] gave2

an algorithm for solving IP that runs in time 2O(k log m+k log(ka)) , where a is the maximum absolute value of numbers appearing in the input. This immediately yields apolynomial-time algorithm for the second fragment of IP. Notice that the complexityof the algorithm is exponential unless a is represented in unary and k is fixed.
We now present a generalization of the two aforementioned polynomial-time fragments of IP. Let IPk,m be the problem of deciding whether an integer program Ax = b′

has a non-negative integral solution, where b ∈ Zk is represented in unary and A is a
k′ -by-m′ integer matrix of the form

A=

"

A1 A2
A3

0

#

(7.1)

for a k-by-m matrix A1 and a (k′ − k)-by-m matrix A3 where numbers are represented

in binary, and a k-by-(m′ − m) matrix A2 where numbers are represented in unary. The
bottom right block of A is simply a (k′ − k)-by-(m′ − m) matrix full of zeros.

Proposition 7.4.1 For fixed integers k > 0 and m > 0, the problem IPk,m is solvable inpolynomial-time.
Proof. Let Ax = b be the given integer program, where A is of the form given in
Equation 7.1 above. Let m1 = m′ − m. Write the given integer program Ax = b in an
equational form:
a1,1 x1..
.

+ ... +..
.

a1,m xm..
.

+ c1,1 y1 + . . . + c1,m1 ym1 =
..
..
..
.
.
.

b1
..
.

ak,1 x1+ ... +

ak,m xm+ ck,1 y1 + . . . + ck,m1 ym1 =bk

ak+1,1 x1 + . . . + ak+1,m xm
..
..
..
.
.
.
ak′ ,1 x1+ ... +

ak′ ,m xm= bk+1..
.
=bk ′ .

Chapter 7. Reversal-bounded counter systems and their extensions

168

For each i = 1, . . ., m1 , let us write ci for the ith column vector of A2 , i.e., the transposeof the row vector (c1,i , . . ., ck,i ). Let V = {c1 , . . . , cm1 } and denote by a be the max-

imum absolute value of numbers in V . By Theorem 7.2.1, we may compute in time2

2O(k log m1 +k log(ka)) a sequence P(w1 ; S1 ), . . ., P(wr ; Sr ) of linear sets with
coneN (V ) =r[

P(wi ; Si ),i=1

where the maximum absolute value of entries of each wi is O(m1 (k2 a)2k+3 ), each Si is2

2 2k +3k ). Let d = rank(V ),a subset of V with |Si | = rank(V ) ≤ k, and r = O(m2k
1 (k a)which we can compute in polynomial time using Gaussian elimination. Therefore,

Ax = b has a non-negative integral solution iff for some P(w j ; S j ), say with w j =(s1 , . . ., sk ) and S j = {ci1 , . . . , cid }, the following integer program Pj in equational form
has a non-negative integral solution:
a1,1 x1..
.

+ ... +..
.

a1,m xm..
.

+ c1,i1 y1 + . . . + c1,id yd = b1 − s1
..
..
..
..
.
.
.
.

ak,1 x1+ ... +

ak,m xm+ ck,i1 y1 + . . . + ck,id yd = bk − sk

ak+1,1 x1 + . . . + ak+1,m xm
..
..
..
.
.
.
ak′ ,1 x1+ ... +

ak′ ,m xm

=

bk+1
..
.

=

bk ′ .

Note that the size of each w j when the numbers are given in binary representation is
at most kL, where L is the size of the original integer program. Hence, the size of theinteger program Pj is at most kL. Therefore, Kannan’s algorithm [Kan83] can solve
each integer program Pj in time O((m + k)9(m+k) kL log(kL)), where L is the size of the
input. In the worst case, we will have to run Kannan’s algorithm on each Pj . All in all,the total running time is22

2 2k +3k
2O(k log m1 +k log(ka)) + O(m2k× (m + k)9(m+k) kL log(kL)),
1 (k a)which is polynomial when k and m are fixed constants, and a is represented in unary.
2

7.4.2 Decision problems for Parikh images of NWAs
We now give another application of the main results from the previous sections to thefollowing decision problems for Parikh images of NWAs: membership, disjointness,
universality, and equivalence. The result for membership was independently proven byChapter 7. Reversal-bounded counter systems and their extensions

169

Kopczynski [Kop10] and the author [To10]. The results for disjointness, universality,and equivalence were initially shown by Kopczynski [Kop10], different proofs are
given below.
Membership

The membership problem for Parikh images of NWAs is defined as follows: given an
NWA A over Σ = {a1 , . . . , ak } and a tuple b ∈ Nk given in binary, decide whetherb ∈ P (L (A )). Similar problems can be easily defined for DWAs, regular expressions,
CFGs, and PDAs. It is known that the membership problem for Parikh images ofNWAs is solvable in NP (e.g. see [Esp97b, Huy83, VSS05]). It turns out that thisupper bound is tight.
Proposition 7.4.2 The membership problems for Parikh images of DWAs and regularexpressions are NP-hard, even when numbers in the input are given in unary.
The proof is given in the appendix. The lower bound for DWAs is obtained by areduction from the well-known NP-complete hamiltonian path problem. On the other
hand, NP-hardness for regular expressions is obtained by a reduction from a variantof 3SAT. The lower bound for DWAs was also independently proven by Kopczynski[Kop10].
In contrast to Proposition 7.4.2, the membership problem for Parikh images ofNWAs becomes solvable in polynomial time when the size k of the alphabet is fixed.
Proposition 7.4.3 ([Kop10, KT10, To10]) Given an NWA A with n states over the alphabet Σ = {a1 , . . . , ak } and a tuple b = (b1 , . . . , bk ) ∈ Nk written in binary with b :=2

max1≤i≤k {bi }, checking whether b ∈ P (L (A )) can be done in time 2O(k log(kn)+log log b) .
This proposition can be obtained almost in the same way as in Proposition 7.4.1. Thatis, we first use Theorem 7.3.1 to compute a union of linear sets P(w1 ; S1 ), . . ., P(wr ; Sr )with at most k periods that such that P (L (A )) =Sr

i=1 P(wi ; Si ). Then, we simply needto test whether there exists i = 1, . . . , r such that b ∈ P(wi ; Si ), which can be done by
Kannan’s polynomial-time algorithm (as in Proposition 7.4.1).

Let us finally remark that Proposition 7.4.3 cannot be extended to CFGs (or equivalently PDAs).

Chapter 7. Reversal-bounded counter systems and their extensions

170

Proposition 7.4.4 ([Kop10, KT10, To10]) The membership problem of CFGs over thealphabet Σ = {a} is NP-hard.
This proposition improves the known NP-hardness lower bound for the problem overa non-fixed alphabet (e.g. see [Esp97b, Huy83]). The proof of this proposition is by asimple reduction from the knapsack problem using the succinct encoding of numbers
given in the proof of Proposition 7.3.9. In fact, the lower bound is optimal since themembership problem of CFGs is solvable in NP [Esp97b, Huy83].
Disjointness

The disjointness problem for Parikh images of NWAs is defined as follows: given two/ SimNWAs A and B over Σ = {a1 , . . ., ak }, decide whether P (L (A )) ∩ P (L (B )) = 0.
ilar problems can be easily defined for CFGs. First of all, it is a simple corollaryof the result of [VSS05] that the disjointness problem for Parikh images of CFGs isin coNP. This is because there exists a polynomial time algorithm which, given two
CFGs G1 and G2 over the alphabet Σ = {a1 , . . ., ak }, computes an existential Pres-burger formula ϕ1 (x1 , . . . , xk ) and ϕ2 (x1 , . . . , xk ) such that, for each i = 1, 2 and numbers m1 , . . . , mk ∈ N,
hN, +i |= ϕi (m1 , . . . , mk ) ⇔ (m1 , . . ., mk ) ∈ P (L (Gi )).
Testing whether P (L (G1 )) ∩ P (L (G2)) 6= 0/ then corresponds to checking whether
hN, +i |= ∃x1 , . . ., xk (ϕ1 (x1 , . . . , xk ) ∧ ϕ2 (x1 , . . . , xk )),which can be done in NP since checking existential Presburger formulas is in NP[GS78]. It follows that checking whether P (L (G1)) ∩ P (L (G2 )) = 0/ is in coNP. In

fact, a matching coNP lower bound has been shown by Kopczynski [Kop10] even for
CFGs over the fixed alphabet {a}. This simple proof technique also gives an easy

polynomial-time upper bound for disjointness problem for Parikh images of NWAs fora fixed alphabet size, which was first shown by Kopczynski [Kop10] using a different
technique, i.e., by observing that Theorem 7.3.1 holds for NWAs with negative inputs.
Proposition 7.4.5 The disjointness problem for Parikh images of NWAs over a fixedalphabet Σ = {a1 , . . . , ak } can be decided in polynomial-time.
We now sketch a proof of this proposition. Given two NWAs A1 , A2 over Σ with(respectively) n1 and n2 states, we may apply Theorem 7.3.1 on A1 and A2 to obtain

Chapter 7. Reversal-bounded counter systems and their extensions

171

in polynomial time two semilinear bases B1 := {hv1 ; S1 i, . . . , hvm1 ; Sm1 i} and B2 :=′ i} for, respectively, the Parikh images of L (A ) and L (A ){hw1 ; S1′ i, . . ., hwm2 ; Sm122such that |Si | ≤ k and |S′j | ≤ k. We shall now state an easy fact relating semilinear
bases and existential Presburger formulas.

Fact 7.4.6 Given a semilinear basis B = {hv1 ; S1 i, . . . , hvr ; Sr i} over Nk with |Si | = m

for each 1 ≤ i ≤ r, there exists an existential Presburger formula ϕ(x1 , . . . , xk ) of theform

ϕ(x1 , . . ., xk ) = ∃y1 , . . . , ym ψ(x̄, ȳ)such that ψ is quantifier-free and, for each sequence i1 , . . . , ik of nonnegative integers,
it is the case thathN, +i |= ϕ(i1 , . . . , ik ) ⇔ (i1, . . . , ik ) ∈ P(B ).
Furthermore, kϕk is linear in kB k (even with binary representation of numbers) andthat ϕ can be computed in linear time.

Example 7.4.1 We shall give an example of how the translation from Fact 7.4.6 isperformed. Suppose we have the semilinear basis

B = {h(10, 3); {(1, 2), (8, 7)}i, h(5, 5); {(7, 1), (25, 13)}i}.
The existential Presburger formula that represents P(B ) is simply
ϕ(x1 , x2 ) := ∃y1 , y2 (ψ1 (x̄, ȳ) ∨ ψ2 (x̄, ȳ)),whereψ1 (x̄, ȳ) := (x1 = 10 + y1 + 8y2 ) ∧ (x2 = 3 + 2y1 + 7y2 )andψ2 (x̄, ȳ) := (x1 = 5 + 7y1 + 25y2 ) ∧ (x2 = 5 + y1 + 13y2 ).
♣Therefore, we compute existential Presburger formulas ϕ1 (x1 , . . ., xk ) and ϕ2 (x1 , . . . , xk )each with at most k quantifiers, which represent B1 and B2 , respectively. Hence, wehave
P(B1 ) ∩ P(B2) 6= 0/ ⇔ hN, +i |= ∃x1 , . . ., xk (ϕ1 (x̄) ∧ ϕ2 (x̄)).
Clearly, we can move the existential quantifiers in ϕ1 and ϕ2 to the front of the formula(after introducing new variable names) yielding an existential formula θ with 3k quantifiers. That is, the formula θ has a fixed number of quantifiers regardless of the inputChapter 7. Reversal-bounded counter systems and their extensions

172

automata A1 and A2 . Since checking existential Presburger formulas with a fixed number of quantifiers can be done in polynomial time [Len83, Sca84] (also see [Grä88]), it
follows that checking P(B1 ) ∩ P(B2 ) 6= 0/ can be done in polynomial time. Proposition
7.4.5 immediately follows.

As a final remark, Proposition 7.4.5 is tight in the sense that allowing unboundedalphabet size makes the problem coNP-complete [Kop10].
Universality and equivalence

The universality problem for Parikh images of NWAs is defined as follows: given an
NWA A over Σ = {a1 , . . ., ak }, decide whether P (L (A )) = Nk . The equivalence prob-

lem for Parikh images of NWAs is defined as follows: given two NWAs A1 and A2 over
Σ = {a1 , . . . , ak }, decide whether P (L (A1 )) = P (L (A2 )). Kopczynski [Kop10] was

the first to observe that Theorem 7.3.1 yields coNP upper bounds for these two problems in the case of a fixed alphabet size. In fact, there is a matching coNP lower boundfor these two problems even in the case of alphabet of size 1, which was first shown by
Stockmeyer and Meyer [SM73]. The precise complexity in the case of unbounded alphabet size is only known to be in between coNEXP and coNP [Kop10, KT10]. In thefollowing, we shall employ the same technique that we use for the disjointness problem
above to rederive Kopczynski’s coNP upper bound for universality and equivalence.
Proposition 7.4.7 Universality and equivalence problems for Parikh images of NWAs
over a fixed alphabet {a1 , . . . , ak } are in coNP.
Our proof is similar to the proof of Proposition 7.4.5, but instead uses Grädel’s result[Grä88] that evaluating Presburger formulas of the form ∀x̄∃ȳψ(x̄, ȳ) is coNP-complete

provided that the number of variables in x̄ and ȳ is fixed. For example, for the universality problem, we invoke the algorithm from Theorem 7.3.1 to compute in polynomial
time a semilinear basis (each of whose linear bases has at most k periods) that represents the Parikh image P (L (A )) of the given automaton A . Using Fact 7.4.6, we maythen compute an existential Presburger formula ϕ(x1 , . . . , xk ) with k quantifiers that
represents P (L (A )). Checking universality of P (L (A )) then amounts to checking
whether hN, +i |= ∀x̄ϕ(x1 , . . . , xk ), which is in coNP by [Grä88] since the number ofquantifiers in this formula is at most 2k. The coNP upper bound for the equivalence

problem can be derived in the same manner.

Chapter 7. Reversal-bounded counter systems and their extensions

173

7.4.3 Presburger-constrained graph reachability
Presburger-constrained graph reachability is a simple extension of the standard graphreachability problem: given a transition system S = hS, {→a}a∈ACT i over the actionalphabet ACT = {a1 , . . ., ak }, two configurations s,t ∈ S, and an arbitrary Presburger

formula (a.k.a. constraint) ϕ(xi1 , . . . , xir ) (with 1 ≤ i1 < . . . < ir ≤ k), decide whether

there exists a path

s0 →ai1 . . . →aim sm
such that, if (i1 , . . ., ik ) = P (ai1 . . . aim ), then hN, +i |= ϕ(i1 , . . . , ik ). Problems related

to Presburger-constrained graph reachability have been studied in the context of pathqueries over graph-structured databases (cf. [BHLW10, HPW09b, HPW09a, MW95]).
Presburger constraints are natural since in many cases we do not care about the order ofactions in the path we are interested in. For example, consider a graph which models
a transportation network, where the vertices are locations in the network (e.g. city
attractions, bus stops, and so forth) and the edges are labeled by means of transport(e.g. bus, walk, airplane, subway). The reader is referred to [HPW09b, Figure 1] fora specific example. One could, for example, be interested in reaching a point t from apoint s in such a graph by taking at most one subway and avoiding buses altogether.
Observe that the order in which the actions take place is not important for such a query,which can therefore be expressed as a Presburger formula.
In general, Presburger-constrained graph reachability has the same complexity as
evaluating Presburger formulas.
Proposition 7.4.8 Presburger-constrained graph reachability is complete for the classnO(1)STA(∗, 22, n)).

To show this proposition, recall that the precise complexity of evaluating PresburgernO(1)formulas is precisely STA(∗, 22, n), due to Berman [Ber80] (also see [Koz06]). To

derive the upper bound in Proposition 7.4.8, suppose that the input transition system is
S over the action alphabet ACT = {a1 , . . . , ak } with initial configuration s ∈ S and final

configuration t ∈ S. We treat S as an NWA A with initial state s and final state t, forwhich we can compute an existential Presburger formula ψ(x1 , . . ., xk ) for P (L (A ))in polynomial time using the result of [VSS05]. If the input Presburger formula isϕ(xi1 , . . . , xir ), then the problem reduces to checking whether
hN, +i |= ∃x1 , . . ., xk (ψ(x1 , . . . , xk ) ∧ ϕ(xi1 , . . . , xir )),Chapter 7. Reversal-bounded counter systems and their extensions

174

which can be solved by the procedure for evaluating Presburger formulas. This immenO(1)diately yields the desired upper bound. Hardness for STA(∗, 22, n) can be easily

obtained by a polynomial reduction from the evaluation of Presburger formulas. In
fact, hardness easily holds even for a fixed transition system over the action alphabet
Σ = {a} with one configuration (both of which are initial and final).

The high complexity in Proposition 7.4.8 can be lowered by, for example, con-sidering only existential Presburger formulas, in which case the complexity becomes
NP-complete (cf. [BHLW10]). Another way of lowering the complexity in Proposition 7.4.8 is by observing that the Presburger constraint is usually small in real life, i.e.,practically fixed. In this case, it turns out that the complexity of Presburger-constrainedgraph reachability becomes polynomial-time solvable.
Proposition 7.4.9 Presburger-constrained graph reachability is polynomial-time solvable for any fixed Presburger constraint.
Proof. Suppose that the fixed Presburger constraint is ϕ(x1 , . . . , xr ). Then, the classicalresult of Ginsburg and Spanier [GS66] says that there exists a semilinear basis B suchthat, for all (i1 , . . ., ir ) ∈ Nk , it is the case thathN, +i |= ϕ(i1 , . . . , ir )⇔

(i1 , . . . , ir ) ∈ P(B ).

Therefore, using Fact 7.4.6, we may assume an existential Presburger formula ϕ′ (x̄)
that is equivalent with ϕ(x̄). Let h be the (fixed) number of quantifiers of ϕ′ .
Given a transition system S = hS, {→a}a∈ACT i over ACT = {a1 , . . . , ak } (wherer < k), an initial configuration s ∈ S, and a final configuration t ∈ S, let ACT′ ={a1 , . . . , ar , ?} and define the automaton A = (ACT′ , Q, δ, q0, qF ) as follows:• Q = S,• δ=(′′
i=1 →ai ) ∪ {(q, ?, q ) : ∃ j ∈ (r, k](q →a j q )},Sr• q0 = s, and• qF = t.
In other words, we relabel the action a j ( j = r + 1, . . . , k) with the new action symbol’?’. Since r is fixed, the NWA A has a fixed alphabet size. Therefore, using Theorem
7.3.1 and Fact 7.4.6, we obtain in polynomial time an existential Presburger formulaChapter 7. Reversal-bounded counter systems and their extensions

175

ψ(x1 , . . ., xr+1 ) with a fixed number r + 1 of quantifiers for the Parikh image P (L (A )).
Hence, the input hS, s,ti is a positive instance of the problem iff
hN, +i |= ∃x1 , . . ., xr+1 (ψ(x1 , . . . , xr+1 ) ∧ ϕ′ (x1 , . . ., xr )).
By moving the existential quantifiers to the front of the formula (after variable renaming), we obtain an existential formula with a fixed number 2r + 2 + h of quantifiers andof size polynomial in the size of the input (recall that ϕ′ has a fixed size), which can beevaluated in polynomial time by Lenstra-Scarpellini’s algorithm [Len83, Sca84] (alsosee [Grä88]). 2

7.5 Applications to model checking
In this section, we shall show how the earlier results in this chapter can be used toobtain better model checking complexities for reversal-bounded counter systems andtheir extensions with discrete clocks.

7.5.1 LTL with complex fairness
We shall first state our main result of LTL model checking with multi-regular fairness
constraints over reversal-bounded counter systems with discrete clocks.
Theorem 7.5.1 Model checking an LTL formula ϕ with multi-regular fairness constraints over r-reversal bounded k-counter system M with n states and t discrete clocks
can be done in time polynomial in the size of each fairness constraint and in n, but exponential in the following parameters: the number of fairness constraints, r, k, t, kϕk,and the size (in binary) of the maximum absolute value of clock comparison constant lin M .
Observe that this theorem improves Theorem 6.2.10 by a single exponential for almost
all parameters at the expense of not allowing a single free counter. In fact, the timecomplexity of this algorithm cannot be improved for the following reasons. If we fix
all the parameters but ϕ and n, we obtain LTL model checking over finite systems,
which is PSPACE-complete [SC85, VW86a]. If we fix all the parameters but t andn, we may still reduce in polynomial time the emptiness of discrete-timed automata,which are PSPACE-complete [CY92]. The same goes if we fix all parameters but land t, since emptiness of timed automata is PSPACE-complete already for three clocks

Chapter 7. Reversal-bounded counter systems and their extensions

176[CY92]. What if we fix all parameters except for only n and r or only n and k? Itturns out that this problem is still NP-hard, as can be shown be a polynomial reduction
from the NP-complete emptiness problem of reversal-bounded counter automata witha fixed number of reversals or with a fixed number of counters [HR87].
Let us now proceed to the proof of Theorem 7.5.1. This theorem can be provedby simply observing that Theorem 7.3.1 can be used to refine Proposition 6.2.6 when
there is no free counter:
Proposition 7.5.2 We can compute a representation of the Parikh image of the language of a given r-reversal bounded k-counter automaton M with n states as a unionof conjunctive queries over hN, +i with linear equations consisting of at most O(rk)summands (numbers are given in unary) such that each conjunctive query has at mostO(rk) conjuncts and O(rk) variables. Furthermore, this can be done in time polynomial in n, and exponential in k and r.
Notice that the complexity in this proposition is the same as the complexity in Proposition 6.2.6, but the output existential Presburger formulas have some further structures,
which we have already seen in Fact 7.4.6. The crucial component of Proposition 7.5.2
is that the number of conjuncts and the number of existential quantifiers in every conjunctive query is at most O(rk) and does not depend on the number n of states of

M . To prove this theorem, one simply replaces the use of the polynomial-time algorithm from [VSS05] in the modified Ibarra’s algorithm by Theorem 7.3.1 following aslightly more precise analysis of the structure of existential Presburger formulas obtained in Fact 7.4.6 (i.e. by using the fact that existential quantifiers distribute acrossdisjunctions). The following proposition is now a direct corollary of Proposition 7.5.2,
Proposition 3.1.2, Proposition 6.2.7, and Proposition 6.2.9.
Proposition 7.5.3 The reachability relation of a given n-state r-reversal bounded kcounter systems M with t discrete clocks is regular, for which an NWA can be computedin time polynomial in n, but exponential in r, k, t, and the size (in binary) of the
maximum absolute value of the clock comparison constants in M .
Combining this proposition with our algorithmic metatheorem for decidable LTL model
checking over word-automatic systems, Theorem 7.5.1 is now immediate.

Chapter 7. Reversal-bounded counter systems and their extensions

177

7.5.2 Branching-time logics
We now apply Theorem 7.3.1 to EF-model checking over reversal-bounded countersystems. Our main theorem is a kind of fixed-parameter tractability result:
Theorem 7.5.4 Fix an EF-logic formula ϕ and positive integers r, k. Then, model
checking ϕ over r-reversal bounded k-counter systems is solvable in PH.
The same result holds in the presence of finitely many discrete clocks, where clock
comparison constants are represented in unary. To prove this theorem, we first apply
Proposition 7.5.2 and Lemma 6.2.4 to obtain the following corollary.
Proposition 7.5.5 The reachability relation of a given n-state r-reversal bounded kcounter systems M can be represented by an existential Presburger formula with O(rk)quantifiers. Furthermore, this can be computed in time polynomial in n, and exponential in r, k.
In particular, this algorithm runs in polynomial time for fixed values of r and k. Observe also that the number of quantifiers is O(rk) (i.e. independent on the number ofstates in M ) since each of the conjunctive queries in the union of conjunctive queries
that we obtain from Proposition 7.5.2 has O(rk) quantifiers and that, if y and z containthe same number of variables, we can use the standard logical equivalence∃yϕ(x, y) ∨ ∃zϕ′ (x, z) ≡ ∃y(ϕ(x, y) ∨ ϕ′ (x, y)).
To complete the proof of Theorem 7.5.4, we shall recall the following result byGrädel [Grä88].
Proposition 7.5.6 ([Grä88]) Fix a number d > 0. Checking whether a Presburger
formula ϕ in prenex-normal form with at most d quantifiers can be done in PH. Furthermore, this still holds in the presence of linear (in)equations and numeric constants
represented in binary.
We are now ready to prove Theorem 7.5.4. The goal is to reduce the original EF
model checking problem into evaluating Presburger formulas in prenex-normal form
with a fixed number of quantifiers. This can be achieved as follows. Convert the
fixed EF-formula ϕ into an equivalent FO(Reach) formula ϕ′ (x) in prenex normal
form. We then translate each formula of the form ReachΓ (y, z) into an existential
Presburger formula with at most O(rk) quantifiers using Proposition 7.5.5. In doingChapter 7. Reversal-bounded counter systems and their extensions

178

so, we also replace each variable in ϕ′ with a tuple of O(rk) variables (recall thateach configuration consists of counter values). Again, we may move all the quantifiers
outside resulting in a formula with at most O(rkkϕ′ k) quantifiers (i.e. a fixed number).
Formulas of the form →a can be translated into a quantifier-free Presburger formula.
Altogether, we obtain a Presburger formula ψ(x) with a fixed number of quantifiersin polynomial time to which our original problem is reduced. Theorem 7.5.4 is then
immediate from Grädel’s result above.
Remark 7.5.1 It is possible to give a matching PH lower bound for this problem in thesense that, for each n ∈ N, there exists two positive integers r and k, and an EF formula

ϕ such that the problem of model checking ϕ over r-reversal k-counter systems is hardpfor Σn . This can be easily shown using the lower bound technique in Chapter 9. Finally, what about the problem of model checking CTL over reversal-bounded
counter systems? It turns out that this problem is undecidable. In fact, this alreadyholds for 1-reversal 3-counter systems and very simple CTL formulas.
Proposition 7.5.7 Model checking CTL over 1-reversal 3-counter systems is undecidable.
This can be proven by a reduction from the undecidability problem of checking emptiness of languages of deterministic 0-reversal 3-counter systems that may test equalityof the current values of two counters [ISD+ 02]. The proof can be found in the appendix.

Chapter 8One-counter processes
In this chapter, we shall study another decidable restriction of Minksy’s counter machines. It is well-known that two-counter machines are sufficient to obtain Turingpowerful models of computation [Min67]. On the other hand, this is not the case when
we restrict the number of counters to one since such machines can now be viewed asa special case of pushdown systems with just one stack symbol, plus a non-removablebottom symbol which indicates an empty stack (and thus allows to test the counter forzero). Such machines are often referred to as one-counter processes (OCPs). The aimof this chapter is to obtain a precise computational complexity of the EF-logic model
checking problem over one-counter processes and show how this can be used to derive
an optimal complexity for the problem of weak-bisimilarity checking of one-counter
processes against finite systems.
Recall that, although our generic approach is able to derive decidability of EF-logic
over PDSs (and hence OCPs), Theorem 5.5.1 shows that this approach will not provide
an elementary upper bound for the problem. In contrast, the precise complexity ofEF-logic model checking over PDSs is only PSPACE-complete [BEM97, Wal00]. The

PSPACE lower bound was first proven by Bouajjani, Esparza and Maler [BEM97]
even for a fixed EF formula, and only later the PSPACE upper bound was provided
by Walukiewicz [Wal00]. This immediately gives a PSPACE upper bound for the
combined complexity of EF-logic model checking over OCPs. On the other hand, thebest lower bound known for this problem was only DP-hard [JKMS04], which is below
the second level of the polynomial hierarchy.
The first hint that the computational complexity of model checking over OCPs
could be easier than the same problem considered over PDSs is Serre’s result [Ser06]
that µ-calculus model checking over OCPs is PSPACE-complete. This is lower than179

Chapter 8. One-counter processes

180

the EXP complexity of the same problem over PDSs due to Walukiewicz [Wal01]. In
the case of equivalence checking, it is known that strong-bisimilarity checking against
finite systems is solvable in polynomial time for OCPs [Kuc00], which is lower than
the PSPACE complexity of the same problem when considered over PDSs [KM02,
May00].
In this chapter, we shall present the recent result of Göller, Mayr, and the author[GMT09] that the problem of model checking EF-logic over OCPs is in PNP , which
is below the second level of the polynomial hiearachy. They also showed that PNP hardness can be obtained when the formula is represented as a dag, although thislower bound has recently been superseded by the recent Göller and Lohrey’s PNP lower
bound [GL10] for the standard representation of EF formulas. The PNP upper boundis derived by establishing a close correspondence of the problem with the membershipproblem of a fragment of Presburger arithmetic, which we call Min-Max Arithmetic(MMA), which we also show to be PNP -complete. We shall present this Min-Max
Arithmetic in Section 8.2 and prove that it has a PNP membership problem. In Section 8.3, we show how to efficiently transform OCPs into a suitable normal form. In
Section 8.4, we provide a polynomial-time translation from the model checking problems of OCPs in this normal form to the membership problem of MMA. Combining
this translation with the PNP upper bound for the membership problem of MMA, we
immediately obtain a PNP upper bound for EF model checking over OCPs.
One of the most interesting applications of the PNP upper bound for the problem
of EF-logic model checking over OCPs is an immediate application to the problem
of weak-bisimilarity checking of OCPs against finite systems. In Section 8.5, weshow how a PNP upper bound for the latter can be derived. We shall show in Section 8.6 a matching PNP lower bound for this problem. This complexity is lower thanthe complexity for the corresponding problem for PDSs, which is PSPACE-complete[KM02, May00]. Finally, we shall conclude Section 8.6 with PNP[log] lower bounds
for weak-bisimilarity checking of OCPs against a fixed finite system, and for model
checking a fixed EF formula against OCPs.

8.1 Preliminaries
In this section, we shall fix some notations that we will use throughout this chapter.

Chapter 8. One-counter processes

181

One-counter processes

We shall first use a more conveninent notation for one-counter processes.
Definition 8.1.1 A one-counter process (OCP) is a tuple P = (Q, δ0 , δ>0 ), where Q isa finite set of states (a.k.a. control locations), δ0 ⊆ Q × ACT × Q × {0, 1} is a finite

set of zero transitions, and δ>0 ⊆ Q × ACT × Q × {−1, 0, 1} is a finite set of positivetransitions. The size of a one-counter process is defined as kP k = |Q| + |δ0 | + |δ>0 |. A
one-counter net is a one-counter process that additionally satisfies δ0 ⊆ δ>0 .

An OCP P = (Q, δ0 , δ>0 ) defines a transition system SP = hS, {→a}a∈ACT i, where

S = Q × N and (q, n) →a (q′ , n + k) if and only if either n = 0 and (q, a, q′, k) ∈ δ0 , orn > 0 and (q, a, q′, k) ∈ δ>0 . If (q1 , n1 ) →a (q2 , n2 ) for some a ∈ ACT, we also write(q1 , n1 ) →P (q2 , n2 ) (or even (q1 , n1 ) → (q2 , n2 ) if P is understood). Notice that thisdefinition coincides with the definition of 1-counter systems from Example 3.1.4.
EF dag-formulas

We now formalize the intuitive notion of EF formulas represented as directed acyclic
graphs (dag). An EF dag-formula over ACT is a finite sequence of definitions ϕ =(ϕi )i∈[l] for some l ∈ N, where for each i ∈ [l] the definition ϕi is exactly one of thefollowing, either:
1. ϕi = ⊤,2. ϕi = ¬ϕ j for some j ∈ [i − 1],
3. ϕi = ϕ j ∧ ϕk for some j, k ∈ [i − 1],
4. ϕi = haiϕ j for some a ∈ ACT and some j ∈ [i − 1], or
5. ϕi = EFΓ ϕ j for some j ∈ [i − 1] and Γ ⊆ ACT.
For each i ∈ [l], we define the size kϕi k = 1 if ϕi = ⊤ and kϕi k = ⌈log i⌉ otherwise.

The size of ϕ is defined as kϕk = ∑li=1 kϕi k. Define the partial order ≺ϕ ⊆ [l] × [l] as( j, i) ∈≺ϕ if and only if ϕ j appears in the definition of ϕi . If j ≺+ϕ i, we say that ϕ j

is a subformula of ϕi . Note that i is minimal with respect to ≺+ϕ whenever ϕi = ⊤.

Observe that ([l], ≺ϕ) is a dag. The standard definition of EF formulas coincide withthis definition when ([l], ≺ϕ) is a directed tree. In this chapter, we shall call themEF tree-formulas to emphasize this fact. Next, we define the semantics. For this, letChapter 8. One-counter processes

182

S = hS, {→a}a∈ACT i be a transition system. Let us define [[ϕi ]]S ⊆ S for each i ∈ [l]by induction on ≺+ϕ as follows:
1. [[⊤]]S = S,
2. [[¬ϕ j ]]S = S \ [[ϕ j ]]S ,3. [[ϕ j ∧ ϕk ]]S = [[ϕ j ]]S ∩ [[ϕk ]]S ,4. [[haiϕ j ]]S = {s ∈ S | ∃t ∈ [[ϕ j ]]S : s →a t}, and
5. [[EFΓ ϕ j ]]S = {s ∈ S | ∃t ∈ [[ϕ j ]]S : s →∗Γ t}.
We define [[ϕ]]S = [[ϕl ]]S . We also write S, s |= ϕi whenever s ∈ [[ϕi ]]S . We deal

with the model checking problem for EF-logic over one-counter processes defined asfollows:
M ODEL CHECKING EF- LOGIC OVER OCP S

Instance: An OCP P , a configuration (q, n) of SP with n in binary, and an EF
dag/tree-formula ϕ.
Question: SP , (q, n) |= ϕ?
.

8.2 Min-Max Arithmetic
In this section we introduce a suitable representation of natural numbers in terms of alogic that we call MMA for Min-Max Arithmetic. In fact, the sets definable in MMA
equal the sets definable in Presburger Arithmetic with one free variable or equivalently
the one-dimensional semilinear sets. MMA can be seen as a syntactic variant of Presburger Arithmetic that is tailored towards having a fairly low complexity (PNP ) of themembership problem.

8.2.1 The definition
Formally, an MMA dag-formula is a sequence of definitions α = (αi )i∈[l] for somel ≥ 1, where for each i ∈ [l] the definition αi is precisely one of the following, wherej, k ∈ [i − 1] and where ∼∈ {≤, ≥}:1. ≡ m mod n, where n > 0 and m ∈ Z/nZ,

Chapter 8. One-counter processes

183

2. ∼ n, where n ∈ N,
3. ¬α j ,4. α j ∧ αk ,5. ∼ min α j ,6. n ∼ min α j , where n ∈ N,
7. ∼ max(α j , n), where n ∈ N, or
8. m ∼ max(α j , n), where m, n ∈ N.
We call αi atomic in case it is of type (1) or (2). We will introduce usual abbreviations<, >, and = with expected meanings. We formally put min 0/ = ∞, max 0/ = −1. More-over we put k ≤ ∞ and k 6≥ ∞, k 6≤ −1, and k ≥ −1 for each k ∈ N. Define the binary
relation ≺α ⊆ [l] × [l] as j ≺α i if and only if α j occurs in the definition of αi for eachi, j ∈ [l]. Note that ([l], ≺α) is a dag and hence ([l], ≺+α ) is a strict partial order. Recall
that i is minimal with respect to ≺+α if and only if αi is atomic. We say α is a MMA

tree-formula if ([l], ≺α) is a directed tree. Let us now define the semantics of MMA

dag-formulas. For each αi we define the set [[αi ]] ⊆ N by induction on i w.r.t. ≺+α asfollows:

1. [[≡ m mod n]] = {k ∈ N | k ≡ m mod n},
2. [[∼ n]] = {k ∈ N | k ∼ n},
3. [[¬α j ]] = N \ [[α j ]],4. [[α j ∧ αk ]] = [[α j ]] ∩ [[αk ]],5. [[∼ minα j ]] = {k ∈ N | k ∼ min[[α j ]]},

N if n ∼ min[[α j ]]6. [[n ∼ min α j ]] =,0/otherwise

7. [[∼ max(α j , n)]] = {k ∈ N | k ∼ max([[α j ]] ∩ [0, n])},8.
[[m ∼ max(α j , n)]] =(N if m ∼ max([[α j ]] ∩ [0, n])0/otherwise.

Chapter 8. One-counter processes

184

Observe that MMA can be seen as a fragment of Presburger Arithmetic. We define [[α]] = [[αl ]]. We call α valid if [[α]] = N, for example ≥ 0 is valid. Define thesize kαi k by case distinction as follows: k ≡ m mod nk = k ∼ nk = ⌈log n⌉, k¬α j k =⌈log j⌉, kα j ∧αk k = ⌈log j⌉+⌈log k⌉, k∼ min α j k = ⌈log j⌉, kn ∼ min α j k = ⌈log n⌉+⌈log j⌉, k∼max(α j , n)k = ⌈log j⌉ + ⌈log n⌉, and finally km ∼ max(α j , n)k = ⌈log m⌉ +⌈log j⌉ + ⌈log n⌉. Define the size of α as kαk = ∑i∈[l] kαi k. For better readability, we

will allow more complex definitions such as e.g. αi = ¬α j ∧ (x ≡ 3 mod 5).

8.2.2 Syntactic sugar: extended MMA
In order to ease our reduction from model checking OCP to evaluating MMA formulas,
we introduce extended MMA formulas. Extended MMA formulas allow definitionsof the kind αi = α j − 1 and αi = α j + 1. For ⊙ ∈ {+, −}, the semantics is definedas [[α j ⊙ 1]] = ([[α j ]] ⊙ 1) ∩ N. Observe that, in general, the two operators cannot beinterchanged, i.e. we generally do not have [[(α − 1) + 1]] = [[(α + 1) − 1]]. On theother hand, observe that [[α]] = [[(α +1) −1]]. Define the size of kα j +1k = kα j −1k =⌈log j⌉ + 1. For each natural k define α j ⊙ k to be the abbreviation for(· · ·(α j ⊙1) · · · ) ⊙ 1|{z}
k many times

for each ⊙ ∈ {−, +}.

8.2.3 Basic properties of MMA and extended MMA
We shall now prove basic properties that are satisfied by MMA and extended MMA
dag-formulas. We shall first prove a periodicity lemma for extended MMA dagformulas, i.e., sufficiently large numbers which are satisfied by extended MMA dagformulas have nice periodic behaviors. We shall also show that extended MMA are
neither more expressive nor more succinct by providing a polynomial-time translationfrom extended MMA dag-formulas to equivalent MMA dag-formulas. Using theseresults, we shall show that the membership problem for extended MMA dag-formulas
can be solved in PNP .
We shall start with a simple but important periodicity lemma for extended MMA
dag-formulas. Let α = (αi )i∈[l] be an extended MMA dag-formula. Define νi to be
maximal number n such that α j is ∼ n or ∼ max(α j , n) for some j ∈ [i]. Define Li tobe the least common multiple of all n > 0 such that the definition of α j is ≡ m mod n

Chapter 8. One-counter processes

185

for some j ∈ [i − 1] and some m ∈ Z/nZ, and 1 if no such formula exists. Observe thati < j implies Li |L j and moreover Li ∈ exp(kαk), thus polynomially (in kαk) many bits

suffice to represent each Li .

Lemma 8.2.1 (Periodicity Lemma for extended MMA) Let i ∈ [l] and assume that

n1 , n2 > i · Li + νi . Then the following implication holds:
n1 ≡ n2 mod Li⇒(n1 ∈ [[αi ]] ⇔ n2 ∈ [[αi ]])Proof. We prove the lemma by induction on ≺+α . For the induction base, assume thati is minimal with respect to ≺+α , i.e. αi is atomic.

Case αi is ≡m mod n, for some n > 0 and some m ∈ Z/nZ. Observe that the implication holds since Li is a multiple of n by definition.

Case αi is ∼ n, where ∼∈ {≤, ≥} and where n ∈ N. By definition we have νi ≥ n. The

implication clearly holds since natural numbers exceeding n are either all contained in[[αi ]] or are all not contained in [[αi ]].
For the induction step, assume that i is not minimal with respect to ≺+α . For this,we make a case distinction according to αi .

Case αi = ¬α j for some j ∈ [i − 1]. The required implication holds trivially due toinduction hypothesis and the fact that j · L j + ν j ≤ i · Li + νi and Li = L j .

Case αi = α j ∧ αk for some j, k ∈ [i − 1]. First, we have that both Lk and L j divide Li .

Second, both j · L j + ν j and k · Lk + νk are at most i · Li + νi . Now let n1 , n2 > i · Li + νi

and assume n1 ≡ n2 mod Li . Then we have n1 ∈ [[αi ]] if and only if n1 ∈ [[α j ]] andn1 ∈ [[αk ]]. By induction hypothesis, the latter is equivalent to n2 ∈ [[α j ]] and n2 ∈ [[αk ]]which is in turn equivalent to n2 ∈ [[αi ]].

Case αi is ∼ min α j for some ∼∈ {≤, ≥} and for some j ∈ [i − 1]. We claim that the/
implication holds for i by distinguishing if [[α j ]] is empty or not. In case [[α j ]] = 0,

/ depending on ∼. The implication(recall min 0/ = ∞), then [[αi ]] either equals N or 0,/ then there exists some n ∈ [[α j ]] withobviously holds in this case. In case [[α j ]] 6= 0,n ≤ j · L j + ν j + L j by induction hypothesis. Observe that the latter is less than or equalto (i − 1) · Li + νi + Li = i · Li + νi . Again, depending on ∼, all naturals exceeding n(in particular naturals exceeding i · Li + νi ) are either all in [[αi ]] or are all not in [[αi ]].

Thus, the implication holds.

Case αi = n ∼ min α j for some n ∈ N, some ∼∈ {≤, ≥}, and some j ∈ [i − 1]. Since/ the implication trivially holds.
[[αi ]] either equals N or 0,

Chapter 8. One-counter processes

186

Case αi is ∼ max(α j , n) for some ∼∈ {≤, ≥}, some j ∈ [i − 1], and some n ∈ N. First

observe that n ≤ νi by definition. Second, all naturals exceeding n (in particular thoseexceeding νi ) either all satisfy αi or all do not, depending on ∼. Thus, the implication

holds.

Case αi is m ∼ max(α j , n) for some ∼∈ {≤, ≥}, some j ∈ [i − 1], and some m, n ∈ N.

/ the implication holds trivially.
Since [[αi ]] either equals N or 0,

Case αi = α j ⊙ 1 for some j ∈ [i − 1] and some ⊙ ∈ {+, −}. The implication follows

directly from j · L j + ν j + 1 ≤ (i − 1) · Li + νi + Li = i · Li + νi and induction hypothesis.
2
It turns out that extended MMA formulas are neither more expressive nor more
succinct than MMA formulas.
Lemma 8.2.2 The following problem is computable in polynomial time:
INPUT: An extended MMA dag-formula α.
OUTPUT: A MMA dag-formula β such that [[α]] = [[β]].
The proof of this lemma, which is not difficult but rather tedious, is given in the appendix. Now, by a bottom-up computation and combining Lemma 8.2.1 and Lemma
8.2.2, we can deduce a PNP upper bound for the membership problem for extended
MMA .
Proposition 8.2.3 The following problem is in PNP :INPUT: n0 ∈ N in binary and an extended MMA dag-formula α.

QUESTION: n0 ∈ [[α]]?

Proof. First, it is easy to see that if α is an MMA dag-formula with no occurrence ofmin and max then checking whether n0 ∈ [[α]] can be done is polynomial time. We
shall make use of this basic fact in the proof. In a first step, we apply Lemma 8.2.2 andcompute in polynomial time an MMA dag-formula formula β such that [[β]] = [[α]].
Assume β = (βi )i∈[l]. In a second step, we eliminate min and max operators that occur
in β inductively on ≺+β.

For this, let i ∈ [l] be minimal with respect to ≺+β such that the definition βi contains

either min or max. In case βi is ∼ min β j , we know that for each n1 , n2 > j · L j + ν jwith n1 ≡ n2 mod L j we have n1 ∈ [[β j ]] if and only if n2 ∈ [[β j ]] by Lemma 8.2.1. Thisimplies that min[[β j ]] ∈ [0, ( j + 1) · L j + ν j ] ∪ {∞}. Moreover, observe that ( j + 1) · L j +ν j can represented using polynomially many bits in kβk. Furthermore, note that weChapter 8. One-counter processes

187

can decide deterministically in polynomial time whether, for a given m given in binary,
we have m ∈ [[β j ]], since neither the definition of β j nor the definition of βk contains
min or max, for each k ≺+β j. Via a binary search method, we can computeµ = min{m ∈ [0, ( j + 1) · L j + ν j ] | m ∈ [[β j ]]}by some deterministic polynomial time bounded Turing machine that has access to an
NP oracle. After that, we “symbolically” modify β by replacing βi ’s previous definition∼ min β j by ∼ µ. The cases when βi = n ∼ min β j , βi =∼ max(β j , n), or βi = m ∼max(β j , n) can be dealt with analogously.

We repeat this replacement process until β does not contain any min or max operator. Finally, we check if n0 ∈ [[β]] in polynomial time. 2

8.3 Saturations and small arithmetic progressions
For the rest of this section, let us fix some one-counter process P = (Q, δ0 , δ>0 ). For
technical reasons, we add a new transition label λ ∈ ACT that does not previously oc-

cur in δ0 ∪ δ>0 and which we fix for the rest of this section. Our goal is to “saturate”

P with λ-labeled transitions so that we only have to consider normalized paths, i.e.
paths, where the sequence of counter values of the involved configurations are first

non-increasing and then non-decreasing. Let P ′ denote the resulting OCP after saturation. Our saturation construction has the following motivation: (1) We can computein polynomial time all information needed for representing normalized paths in SP ′in terms of few “small” arithmetic progressions, and (2) for every EF dag-formula ϕin which λ does not occur we have SP , s |= ϕ if and only if SP ′ , s |= ϕ for every
configuration s ∈ Q × N.

8.3.1 Saturation construction
Given a nonempty path π = (q1 , n1 ) →P (q2 , n2 ) · · · →P (qk , nk ) in SP , we call π

mountain, if n1 = nk and ni ≥ n1 for each i ∈ [k]. We call π zero, if ni = 0 for somei ∈ [k], otherwise we call π positive. Let (q1 , n1 ), (q2, n2 ) ∈ Q × N be configurations.
Then, we write (q1 , n1 ) ↓P (q2 , n2 ) (resp. (q1 , n1 ) ↑P (q2 , n2 )) whenever (q1 , n1 ) →P

(q2 , n2 ) and n2 ≤ n1 (resp. and n2 ≥ n1 ). We now present a saturation construction thatallows us to shortcut mountain paths by adding λ-transitions.

Chapter 8. One-counter processes

188

Choosing control locations q, q′ ∈ Q and δ ∈ {δ0 , δ>0 }, we now present rules (R1)to (R4) that can be applied only if (q, λ, q′, 0) 6∈ δ. In this case, we can add the transition(q, λ, q′, 0) to δ if at least one of the following conditions holds:(R1) (q, a, q′, 0) ∈ δ for some a ∈ ACT.

(R2) (q, a1, q1 , +1) ∈ δ and (q1 , a2, q′ , −1) ∈ δ>0 for some q1 ∈ Q and some a1 , a2 ∈ACT.

(R3) (q, a1, q1 , +1) ∈ δ, (q1 , λ, q2, 0) ∈ δ>0, and (q2 , a2 , q′ , −1) ∈ δ>0 for some q1 , q2 ∈Q and some a1 , a2 ∈ ACT.

(R4) (q, λ, q1, 0) ∈ δ and (q1 , λ, q′ , 0) ∈ δ for some q1 ∈ Q.
Formally, let P ′ = (Q, δ′0 , δ′>0 ) denote the unique one-counter process that we obtainfrom P by applying rules (R1)–(R4) until it is no longer possible. The following
lemma, whose proof is in the appendix, shows that reachability in this saturated OCP

P ′ can be witnessed by a path, in which the changes in the counter values is extremely
simple: monotonically non-increasing and then monotonically non-decreasing.
Lemma 8.3.1 Let s,t ∈ Q × N be configuration. Then, the following three statements

are equivalent:
1. s →∗P t.
2. s →∗P ′ t.

3. There exists some configuration u ∈ Q × N such that s ↓∗P ′ u and u ↑∗P ′ t.

8.3.2 Computing small arithmetic progressions
Observe that if (q1 , n1 ) ↑∗P ′ (q2 , n2) and n1 > 0, then also (q1 , n1 + i) ↑∗P ′ (q2 , n2 + i)for each i ∈ N. Similarly, if (q1 , n1 ) ↓∗P ′ (q2 , n2 ) and n2 > 0, then also (q1 , n1 + i) ↓∗P ′(q2 , n2 +i) for each i ∈ N. This motivates us to define, for each q1 , q2 ∈ Q, the following
sets of differences of counter values of monotone positive paths:∗∆>0↑ (q1 , q2 ) = {d ∈ N | (q1 , 1) ↑P ′ (q2 , d + 1)}∗∆>0↓ (q1 , q2 ) = {d ∈ N | (q1 , d + 1) ↓P ′ (q2 , 1)}Chapter 8. One-counter processes

189

Analogously, we collect the sets of differences of counter values of monotone zero
paths:∗∆=0↑ (q1 , q2 ) = {d ∈ N | (q1 , 0) ↑P ′ (q2 , d)}∗∆=0↓ (q1 , q2 ) = {d ∈ N | (q1 , d) ↓P ′ (q2 , 0)}

It turns out that these sets can be expressed as a union of a small number of arithmetic
progressions whose offsets and periods are also small. Furthermore, the computationof these arithmetic progressions from P ′ can be done efficiently.
>0=0=0
Lemma 8.3.2 Each of the sets ∆>0↑ (q1 , q2 ), ∆↓ (q1 , q2 ), ∆↑ (q1 , q2 ), ∆↓ (q1 , q2 ) canbe represented as a union of O(|Q|2) arithmetic progressions with offsets bounded by
O(|Q|2) and periods bounded by O(|Q|) that are moreover computable in polynomial
time.
This lemma can be proven by treating P ′ as NWAs over a unary alphabet and applying
the special case of Theorem 7.3.1 over a unary alphabet.
Proof. To obtain better polynomial upper bounds, we recall Chrobak-Martinez’s Theorem [Chr86, Mar02, To09b], which is a previously known special case of Theorem
7.3.1 over unary alphabets: given an NWA A over the alphabet {♯} with n states, theset P ((L (Aut))) of the lengths of words in L (A ) can be represented as a union ofO(n2 ) arithmetic progressions with offsets bounded by O(n2 ) and periods bounded by

O(n); moreover, this can be computed in polynomial time. We shall only show Lemma
8.3.2 for ∆=0↑ (q1 , q2 ); the other cases can be proven analogously. Let

A = ({♯}, Q × {0, 1}, δ, q1, {(q2, 0), (q2, 1)})be the NWA (with ε transitions) such that• δ((q, 0), ♯) = {(q′ , 1) : ∃a ∈ ACT : (q, a, q′, 1) ∈ δ′0 },• δ((q, 1), ♯) = {(q′ , 1) : ∃a ∈ ACT : (q, a, q′, 1) ∈ δ′>0 },• δ((q, 0), ε) = {(q′ , 0) : ∃a ∈ ACT : (q, a, q′ , 0) ∈ δ′0 }, and• δ((q, 1), ε) = {(q′ , 1) : ∃a ∈ ACT : (q, a, q′ , 0) ∈ δ′>0 }.
That is, A is obtained from P ′ by regarding it as an NWA over {♯} by removing all

pop-transitions, treating zero transitions as ε-transitions, and treating push transitions
as reading the symbol ♯. Observe that A simulates precisely paths in SP ′ from (q1 , 0)

Chapter 8. One-counter processes

190

to some configuration in {q2 } × N on which the counter behaves monotonically non-decreasing. It is easy to see now that P (L (A )) coincides with ∆=0↑ (q1 , q2 ). Since we

may compute an equivalent NWA without ε-transitions and with the same number ofstates in polynomial time, Chrobak-Martinez’s Theorem implies that we can computefrom A in polynomial time a union of O(n2 ) arithmetic progressions, with offsetsbounded by O(n2 ) and periods bounded by O(n), representing ∆=0↑ (q1 , q2 ). 2

8.3.3 Characterization of zero paths and positive paths
Lemma 8.3.2 will now be used to obtain characterizations of zero paths and positive
paths in S′P . Let q1 , q2 ∈ Q be control locations. Note that if (q1 , n) ↓∗P ′ (q3 , 1) ↑∗P ′(q2 , n) for some q3 ∈ Q, then also (q1 , n + i) ↓∗P ′ (q3 , 1 + i) ↑∗P ′ (q2 , n + i). Therefore,
we define ∇(q1 , q2 ) ∈ N ∪ {∞} to bemin{n > 0 | ∃q3 ∈ Q : (q1 , n) ↓∗P ′ (q3 , 1) ↑∗P ′ (q2 , n)}.
Observe that ∇(q, q) = 1 for every q ∈ Q. The following lemma, whose proof is in the
appendix, can be easily proven using Lemma 8.3.2 as a subroutine.

Lemma 8.3.3 Either ∇(q1 , q2 ) = ∞ or ∇ ∈ O(|Q|2). Moreover ∇(q1 , q2 ) can be computed in polynomial time.

We now obtain a characterization for zero paths.
Lemma 8.3.4 There is a zero path from (q, n) to (q′ , n′ ) in SP ′ if and only if n ∈′′′′′=0 ′′ ′∆=0
↓ (q, q ) and n ∈ ∆↑ (q , q ) for some q ∈ Q.

=0
Proof. “If”: Follows directly from definition of the sets ∆=0↓ and ∆↑ .

“Only-if”: Let π = (q1 , n1 ) →P ′ (q2 , n2 ) · · · →P ′ (qk , nk ) be a zero path from (q, n)to (q′ , n′ ) in SP ′ . Let l = min{i ∈ [k] | ni = 0} and let r = max{i ∈ [k] | ni = 0}. Thenobserve that since (q1 , n1 ) →∗P ′ (ql , 0), it follows (q1 , n1 ) ↓∗P ′ (ql , 0) due to the equiv-

alences of points (2) and (3) of Lemma 8.3.1 and the definition of ↓P ′ . Analogously,

we have (qr , 0) ↑∗P ′ (qk , nk ). Moreover, there exists a (mountain) subpath ρ from (ql , 0)

to (qr , 0) in π. By again applying the equivalences of points (2) and (3) of Lemma

8.3.1 the subpath ρ can be replaced by a path on which all states have counter value 0.
Hence, altogether there exists some q′′ ∈ Q such that we have
(q1 , n1 ) ↓∗P (ql , 0) ↓∗P ′ (q′′ , 0) ↑∗P ′ (qr , 0) ↑∗P ′ (qk , nk ).
′′=0 ′′ ′
Hence we obtain n1 ∈ ∆=0↓ (q, q ) and nk ∈ ∆↑ (q , q ) as required. 2

Chapter 8. One-counter processes

191

The next lemma characterizes positive paths.
Lemma 8.3.5 Assume n ≤ n′ . Then there exists a positive path in SP ′ from (q, n) to′′ ′′′(q′ , n′ ) if and only if n ≥ ∇(q, q′′) and n′ − n ∈ ∆>0↑ (q , q ) for some q ∈ Q.

Assume n ≥ n′ . Then there exists a positive path from (q, n) to (q′ , n′ ) in SP ′ if and′′′′only if n′ ≥ ∇(q′′ , q′ ) and n − n′ ∈ ∆>0↓ (q, q ) for some q ∈ Q.

Proof. We only prove the case when n ≤ n′ . The case when n ≥ n′ can be provenanalogously.

′′ ′
′′
∗
“If”: Assume n ≥ ∇(q, q′′) and n′ − n ∈ ∆>0↑ (q , q ) for some q ∈ Q. Then (q, n) ↓P ′(q0 , n − d) ↑∗P ′ (q′′ , n) for some q0 ∈ Q and some d ∈ [0, n − 1] following immediately
′′ ′
′′
∗
′ ′
from definition of ∇(q, q′′). Moreover n′ − n ∈ ∆>0↑ (q , q ) implies (q , n) ↑P ′ (q , n ).

Altogether, there exists a positive path of the kind (q, n) ↓∗P ′ (q0 , n − d) ↑∗P ′ (q′ , n′ ) in

SP ′ as required.

“Only-if”: Let π = (q1 , n1 ) →∗P ′ (q2 , n2 ) · · · (qk , nk ) be a positive path from (q, n) to(q′ , n′ ). Let µ = min{ni | i ∈ [k]} be the minimal counter value that appears in π. Recall

that µ > 0 since π is positive. Define l = min{i ∈ [k] | ni = µ} and r = max{i ∈ [k] |ni = µ}. Since (q1 , n1 ) →∗P ′ (ql , µ), it follows from the equivalences of points (2) and(3) of Lemma 8.3.1 and the definition of ↓P ′ that (q1 , n1 ) ↓∗P ′ (ql , µ). Analogously, itfollows that (qr , µ) ↑∗P ′ (qk , nk ). Moreover the subpath from (ql , µ) to (qr , µ) in π can be

replaced by a path of the kind (ql , µ) ↓∗P ′ (qµ , µ) ↑∗P ′ (qr , µ) for some qµ ∈ Q by Lemma
8.3.1. Altogether, we have shown the existence of a path of the following kind(q, n) ↓∗P ′ (qµ , µ) ↑∗P ′ (q′ , n′ ).
Thus, there exists some q′′ ∈ Q such that the previous path can be split up as(q, n) ↓∗P ′ (qµ , µ) ↑∗P ′ (q′′ , n) ↑∗P ′ (q′ , n′ ).
This implies n ≥ ∇(q, q′′) and n′ − n ∈ ∆↑ (q′′ , q′ ) as required. 2

8.4 A translation to MMA
In this section, we shall present a polynomial-time translation from the problem ofmodel checking EF dag-formulas over OCPs to the membership problem of MMA. In
fact, the following theorem shows a stronger statement: the set of configurations ofan OCP satisfying the given EF dag-formula can be represented by MMA formulas;
moreover, they can be computed in polynomial time.

Chapter 8. One-counter processes

192

Theorem 8.4.1 From a given one-counter process P and a given EF dag-formula ϕ,we can compute in polynomial time for each control location q of P an MMA dagformula α(q) such that [[α(q)]] = {n ∈ N | (SP , (q, n)) |= ϕ}.
By combining Theorem 8.4.1 with Proposition 8.2.3, the following corollary is immediate.
Corollary 8.4.2 The problem of model checking EF dag-formulas over OCPs is in
PNP .
Therefore, it remains to prove Theorem 8.4.1. For the rest of this section, let us fix an
OCP P = (Q, δ0 , δ>0 ) and an EF dag-formula ϕ = (ϕi )i∈[l]. For convenience, we shallassume that each occurrence of the EFΓ operator in ϕ satisfies Γ = ACT (or equivalently EFΓ = EF); for the general case of Γ ⊆ ACT, the proof can easily be adapted byfirst restricting ourselves to Γ-transitions in P when we see EFΓ operators. Assume
now that Q = {q1 , . . ., qk }. For technical convenience, we will identify each element(qi , j) ∈ Q × [l] with the corresponding natural number i + ( j − 1) · k ∈ [k · l]. The goalof this section is to present a polynomial time algorithm to compute an extended MMA

formula α = (α(q, j) )(q, j)∈Q×[l] such that [[α(q, j)]] = {n ∈ N | (SP , (q, n)) |= ϕ j } foreach (q, j) ∈ Q × [l].

First, we saturate P in polynomial time. Then, we apply Lemma 8.3.2 and compute

>0
′
′
=0
′
′
=0
in polynomial time the sets ∆>0↓ (q, q ), ∆↑ (q, q ), ∆↓ (q, q ), and ∆↑ (q, q ), which areeach unions of O(|Q|2 ) arithmetic progressions with offsets bounded by O(|Q|2) andperiods bounded by O(|Q|) for each q, q′ ∈ Q. By applying Lemma 8.3.5 we computein polynomial time ∇(q, q′ ) ∈ [n∇ ] ∪ {∞} for each q, q′ ∈ Q, where n∇ ∈ O(|Q|2).

Let us now present the computation of the MMA formula α = (α(q, j) )(q, j)∈Q×[l].

We will do this by induction on j with respect to ≺+ϕ and simultaneously for each q ∈ Q.
Base Case.

Assume j is minimal with respect to ≺+ϕ . Then ϕ j = ⊤ and we putα(q, j) = (≥ 0) for each q ∈ Q.
Induction Step.

Assume ϕ j = ¬ϕ j′ for some j′ ∈ [ j − 1]. Then we put α(q, j) = ¬α(q, j′ ) for each q ∈ Q.
Assume ϕ j = ϕ j1 ∧ ϕ j2 for some j1 , j2 ∈ [ j − 1]. Then we put α(q, j) = α(q, j1 ) ∧ α(q, j2 )for each q ∈ Q.

Chapter 8. One-counter processes

193

Assume ϕ j = haiϕ j′ for some a ∈ ACT and some j′ ∈ [ j − 1]. By induction hypothesis,
we haveα(q′ , j′ ) = {n ∈ N | (q′ , n) |= ϕ j′ }b = − and −b = +, we define α(q, j) as the conjunction offor each q′ ∈ Q. By putting +



and


(= 0) → 
_α(q′ , j′ ) − 1 ∨q′ ∈Q:(q,a,q′ ,+1)∈δ0(> 0) → _q′ ∈Q:(q,a,q′ ,0)∈δ0b ∨α(q′ , j′ ) ⊙1q′ ∈Q,⊙∈{−,+}:(q,a,q′ ,⊙1)∈δ>0
α(q′ , j′ ) 


_

_




α(q′ , j′ ) .

q′ ∈Q:(q,a,q′ ,0)∈δ>0

Finally, assume ϕ j = EFϕ j′ for some j′ ∈ [ j − 1]. Let us first fix control locationsq, q′ ∈ Q. By induction hypothesis[[α(q′ , j′ ) ]] = {n ∈ N | (q′ , n) |= ϕ j′ }.
By Lemma 8.2.1 we know that for each n1 , n2 ∈ N which exceed a threshold t(q′ , j′ )such that n1 ≡ n2 mod L(q′ , j′ ) we have n1 ∈ [[α(q′ , j′ ) ]] if and only if n2 ∈ [[α(q′ , j′ ) ]]. Notethat this implies that [[α(q′ , j′ ) ]] is infinite if and only if there exists some n ∈ [[α(q′ , j′ ) ]]such that t(q′ , j′ ) < n ≤ t(q′ , j′ ) + L(q′ , j′ ) .

Let us now fix an arithmetic progression a + bN with b > 0 that is a subset of some

>0
′
=0
′
=0
′
′
of the sets ∆>0↓ (q, q ),∆↑ (q, q ), ∆↓ (q, q ), or ∆↑ (q, q ). Moreover, let c ∈ Z/bZ

be some residue class. We aim at defining an MMA formula inf(q′ , j′ , c, b) that is
valid if and only if there are infinitely many naturals that satisfy α(q′ , j′ ) and that arecongruent c modulo b. Now observe that the latter is the case exactly whenever there

exists some n ∈ [[α(q′ , j′ ) ]] such that t(q′ , j′ ) < n ≤ t(q′ , j′ ) + L(q′ , j′ ) and moreover n ≡ c

mod gcd(b, L(q′ , j′ ) ). Let us define the auxiliary MMA formulaψ(q′ , j′ , c, b) = α(q′ , j′ ) ∧ (≡ c mod gcd(b, L(q′ , j′ ) ))and finallyinf(q′ , j′ , c, b) = t(q′ , j′ ) < max(ψ(q′ , j′ , b, c),t(q′, j′ ) + L(q′ , j′ ) ).
Next, we aim at defining the set{n ∈ N | ∃n′ ∈ N : (q, n) →∗P (q′ , n′ ), (q′, n′ ) |= ϕ j′ }Chapter 8. One-counter processes

194

in terms of an extended MMA formula. For this, assume that there is a path π from(q, n) to (q′ , n′ ) in SP ) such that (q′ , n′ ) |= ϕ j′ , where n′ ∈ N. We distinguish three(not necessarily distinct) cases. Either (1) π is positive and n ≤ n′ , (2) π is positive andn ≥ n′ , or (3) π is zero. We will realize each of these cases by corresponding extended
MMA dag-formulas β1 (q, q′ ), β2 (q, q′ ), and β3 (q, q′) respectively.

Let us first consider case (1), i.e. π is positive and n ≤ n′ . Then n ≥ ∇(q, q′′) and

′′ ′
′′
′
n′ − n ∈ ∆>0↑ (q , q ) for some q ∈ Q by Lemma 8.3.5. Thus, (n − n) ∈ a + bN for′′ ′some arithmetic progression a + bN ⊆ ∆>0↑ (q , q ). Furthermore, let c ∈ Z/bZ be theresidue class of n′ modulo b. So altogether, we will fix the witnesses q′′ , a + bN, andc in the following. First, let us first assume that b > 0. We now distinguish the cases

when there are either (i) infinitely or (ii) finitely many n′′ ∈ N such that n′′ ≡ c mod band (q′ , n′′ ) |= ϕ j′ .

• Case (i) is expressed by the formula γ(q′′ , a, b, c)∞ which is defined asinf(q′ , j′ , c, b) ∧ ≥ ∇(q, q′′ ) ∧ ≡ (c − a) mod b.
• Case (ii) can be realized by saying that the maximal such n′′ is reachable fromn via the arithmetic progression a + bN. For this, let the formula γ(q′′ , a, b, c)<∞be defined as the conjunction of¬ inf(q′ , j′ , c, b) ∧ ≥ ∇(q, q′′ )and≡ (c − a) mod b ∧ ≤ max(α(q′ , j′ ) − a,t(q′ , j′ ) ).
The last conjunct guarantees that n + a ≤ n′′ , which is necessary since we haveto have that n′′ ∈ n + a + bN.

The case when b = 0 can easily be realized by putting
γ(q′′, a) = ≥ ∇(q, q′′ ) ∧ (α(q′ , j′ ) − a).
Altogether, we put
β1 (q, q′ ) =_q′′ ∈Q

_γ(q′′, a)∨′′a+0N⊆∆>0↑ (q,q )_γ(q , a, b, c)∞ ∨ γ(q , a, b, c)<∞ .

′′a+bN⊆∆>0↑ (q,q )b>0,c∈Z/bZ



′′

′′

Chapter 8. One-counter processes

195

Let us now consider case (2), i.e. when π is positive and n ≥ n′ . Then n′ ≥ ∇(q′′, q′ )′′′′′and n − n′ ∈ ∆>0↓ (q, q ) for some q ∈ Q by Lemma 8.3.5. Hence, n − n ∈ a + bN for′′some a + bN ⊆ ∆>0↓ (q, q ). Firstly, let us assume that b > 0. Recall that c ∈ Z/bZ

is the residue class of n′ . Now the simple observation is that the witness n′ can be
replaced by the minimal n′′ ∈ N such that n′′ ≡ n′ ≡ c mod b, n′′ ≥ ∇(q′′ , q′ ), and(q′ , n′′ ) |= ϕ j′ . We realize this by the formula θ(q′′ , a, b, c) defined as the conjunctionof ≡ c + a mod b and



′′ ′
≥ min (≥ ∇(q , q ) ∧ α(q′ , j′ ) ∧ ≡ c mod b) + a .

Secondly, let us assume that b = 0. This case is realized by the formulaθ(q′′, a) = ≥ (∇(q′′, q′ ) + a) ∧ (α(q′ , j′ ) + a).
Altogether, we define β2 (q, q′ ) to be_ 

q′′ ∈Qθ(q , a, b, c) ∨
′′

_




_





θ(q , a) .

′′′′

a+0N⊆∆>0↓ (q,q )a+bN⊆∆>0 (q,q′′ )↓b>0,c∈Z/bZ

Finally, let us consider case (3), i.e. when π is zero. For each q′′ ∈ Q, define thepredicate′′ ′′∃m ∈ N : m ∈ ∆=0↑ (q , q ) ∧ (q , m) |= ϕ j′ .

′′
′′
′′
In other words, case (3) can be rephrased as n ∈ ∆=0↓ (q, q ) and π(q ) for some q ∈ Q

by Lemma 8.3.4. Now check that the predicate π(q′′) can be expressed as
0 ≤ max(≡ a mod b ∧ α(q′ , j′ ) ,t(q′ , j′ ) + L(q′ , j′ ) )_a+bN⊆∆=0 (q′′ ,q′ )↑b>0∨Define β3 (q, q′) =_a = min((α(q′ , j′ ) − a) + a).

′′ ′a+0N⊆∆=0↑ (q ,q )′′′′′′q′′ ∈Q π(q ) ∧ ρ(q ), where ρ(q ) isW_(≡ a mod b) ∨′′a+bN⊆∆=0↓ (q,q )We finally put α(q, j) =W_(= a).

′′
a+0N⊆∆=0↓ (q,q )′′′q′ ∈Q β1 (q, q ) ∨ β2 (q, q ) ∨ β3 (q, q ).

This concludes the definition of α. It is straightforward to see that α can be computed in time polynomial in kP k + kϕk. By additionally applying Lemma 8.2.2, we

obtain Theorem 8.4.1.

It turns out that a more precise analysis of our translation allows us to derive thefollowing polynomial time upper bound, when the one-counter process is fixed.

Chapter 8. One-counter processes

196

Theorem 8.4.3 The problem of model checking EF dag-formulas over a fixed OCP isin P.
This is in stark contrast to the problem of model checking EF-logic over a fixed pushdown system, which can be shown to be PSPACE-complete using the proof from
[BEM97, Wal00]. The proof of Theorem 8.4.3 can be found in the appendix.

8.5 Application to weak-bisimilarity checking
In this section, we use our PNP upper bound from the previous section to derive a
PNP upper bound for weak-bisimilarity checking of OCPs against finite systems. This
improves the previous PSPACE upper bound known for the problem [Kuc00]. In thenext section, we shall in fact give a PNP lower bound for weak-bisimilarity checking
of OCPs against finite systems.
We shall first recall the definition of weak bisimulation (cf. [KJ06]). Let S =hS, {→a}a∈ACT i be a transition system and assume some distinguished internal sym-bol τ ∈ ACT. Define the extended transition relation ⇒a ⊆ S × S for each a ∈ ACT ass ⇒a t if and only if either a 6= τ and there exist s′ ,t ′ ∈ S such that s →∗τ s′ →a t ′ →∗τ t,

or a = τ and s →∗τ t. Given two transition systems S = hS, {→a}a∈ACT i and S′ =hS′ , {→′a}a∈ACT i, a relation R ⊆ S × S′ is a weak-bisimulation (or w-bisimulation) if it

is nonempty, and whenever (s, s′ ) ∈ R, then for every a ∈ ACT the following two condi-

tions hold (i) if s →a t for some t ∈ S, then s′ ⇒′a t ′ for some t ′ ∈ S′ such that (t,t ′) ∈ R,

and (ii) if s′ →′a t ′ for some t ′ ∈ S′ , then s ⇒a t for some t ∈ S such that (t,t ′) ∈ R.

For every s ∈ S and every s′ ∈ S′ , we say that s and s′ are w-bisimilar, written s ≈ s′ ,whenever there exists a w-bisimulation R ⊆ S × S′ such that (s, s′ ) ∈ R. We now define
w-bisimilarity checking of one-counter processes against finite systems as follows.
W-B ISIMILARITY C HECKING : OCP S AGAINST FINITE SYSTEMS
Instance: A one-counter process P , a state (q, n) of SP with n given in binary, a finite
system T , and a state t of T .
Question: (q, n) ≈ t?

In order to derive our upper bound, we recall the following well-known result from
[JKM01] (a more recent presentation can be found in [KJ06]).
1

Lemma 8.5.1 Let S1 = hS1 , {→a }a∈ACT i be a (possibly infinite) transition system
2and S2 = hS2 , {→a }a∈ACT i be a finite transition system with k states. Then, given any

Chapter 8. One-counter processes

197

state s2 ∈ S2 , we can construct an EF dag-formula ϕs2 ,S2 in polynomial time (in k) suchthat, for every state s1 ∈ S1 , it is the case that s1 ≈ s2 if and only if S1 , s1 |= ϕs2 ,S2 .

In other words, Lemma 8.5.1 implies that the w-bisimulation checking problem ispolynomial-time reducible to the problem of model checking EF dag-formulas. Combining this lemma with our results in the previous sections, the following theorem caneasily be derived.
Theorem 8.5.2 The w-bisimilarity checking problem is solvable in PNP . The problem
becomes solvable in P when the one-counter process is fixed.

8.6 Lower bounds
We conclude this chapter with several tight lower bounds for the problem of model
checking EF-logic over OCPs and weak-bisimulation problems of OCPs against finite
systems.
Let us start with the problem of model checking EF-logic over OCPs. We havemanaged to give a PNP lower bound for this problem in [GMT09] when the input
formulas are represented as dags. This is achieved by a simple reduction from the
PNP -complete problem called DSAT. On the other hand, we will not reproduce theproof here since a matching PNP lower bound has recently been given by Göller and
Lohrey [GL10] for EF tree-formulas.
Proposition 8.6.1 ([GMT09, GL10]) The problem of model checking EF dag/tree formulas over OCPs is PNP -hard.
We now proceed to the lower bound of weak-bisimilarity checking of OCPs against
finite systems. We will show that this problem is PNP -hard by a reduction from a
problem called DSAT [Pap94], which takes the following input: a sequence of boolean
formulas F1 , . . . , Fn with variables x1 , . . . , xn and sets of variables Z1 , . . ., Zn such thatthe formula Fi can take only variables from {x1 , . . . , xi−1 } and Zi . The goal is to decide

whether there exists an assignment σ : {x1 , . . ., xn } → {0, 1} that sets xn to 1 such thatthe following are satisfied for all i ∈ [n]:σ(xi ) = 1⇔∃Zi Fi (x1 , . . . , xi−1 , Zi ).

(8.1)

Notice that imposing the constraint in (8.1) ensures that there exists a unique assignment σ. The only question is whether this assignment satisfies σ(xn ) = 1.

Chapter 8. One-counter processes

198

Proposition 8.6.2 The problem of checking weak-bisimulation between a given onecounter net and a given finite system is hard for PNP .
To prove this proposition, we will have to be able to encode assignments to boolean
formulas (i.e. a sequence of 0s and 1s) as numbers. We shall achieve this via Gödelencodings (i.e. using the uniqueness of prime decomposition). To this end, we shalldefine the Gödel function G : Z>0 → {0, 1}ω as follows: if pi is the ith prime numberjand n = ∏i>0 pi i , where ji ∈ N, then define G(n) = j1′ j2′ . . ., where ji′ = 0 if ji = 0 andji′ = 1 if ji > 0. Since the proof of Proposition 8.6.2 is rather intricate, we shall only

present a sketch of the proof (the full proof can be found in the appendix).
Proof Sketch. In this proof, we shall present the weak-bisimulation as games between
two players: Attacker and Defender (e.g. see [Sti98]). Briefly, Attacker’s goal isto prove that two given processes are not w-bisimilar, while Defender tries to proveotherwise. In every round of the game, there is a pebble placed on a unique state ineach transition system. Attacker then chooses one transition system and moves thepebble from the pebbled state to one of its successors by an action →a . Defender must

imitate this by moving the pebbled state from the other system to one of its successors
by the same action →a , possibly together with several internal τ-actions, i.e. he has

to move the pebble along a ⇒a -transition. If one player cannot move, then the otherplayer wins. Defender wins every infinite game. Two states s and t are w-bisimilar(resp. not w-bisimilar) if and only if Defender (resp. Attacker) has a winning strategy
on the game with initial pebble configuration (s,t).
We now present the proof sketch of Proposition 8.6.2. We reduce DSAT to the wbisimulation checking problem by constructing a suitable one-counter net and a finite
system. The finite system contains (among many others) states P1 and P2 , and the onecounter net contains control-states sFi for 1 ≤ i ≤ n such that the following statements
are equivalent:• hF1 , . . ., Fi i ∈ DSAT.
• P1 ≈ sFi (l) for all l ∈ N.
• P2 is not w-bisimilar to sFi (l) for some l in N.
In the particular case of i = n, this is the reduction we are looking for. The idea is thatchecking the truth of every subformula ∃Zi Fi (x1 , . . . , xi−1 , Zi ) of the DSAT problem

is encoded into a complex w-bisimulation game for P1 ≈ sFi (l). In this game, theChapter 8. One-counter processes199τ

defender player gets to choose (by a long ⇒ move) a natural number l ′ which is stored
in the one-counter net. This number encodes (by Gödel encoding) the assignment ofvalues to the boolean variables in the block Zi . Later in the game, these values canbe tested by special counter-decreasing loops, which implement divisibility tests on l ′ .
The variables xk are treated differently, because they depend on other subformulae Fkwith smaller index numbers k < i. If the value of some xk (for k < i) needs to be tested,
then the w-bisimulation game jumps to some subgame which tests either P1 ≈ sFk (l ′ )or P2 ≈ sFk (l ′ ), depending on whether the value of xk is claimed as true or false.

The main technical difficulty of the proof is to restrict the freedom of the players

in the w-bisimulation game, so that they exactly make the choices needed in the verification game for the formula ∃Zi Fi (x1 , . . ., xi−1 , Zi ) in the right step, and do not makea move that is reserved for the other player. This is rather intricate, because of theasymmetry of the two compared systems, one infinite-state one-counter process and afinite system. In particular, isomorphic copies of the finite system are replicated in thefinite-control of the one-counter net. 2
In contrast to Kučera’s DP lower bound [Kuc00] which holds for a fixed one-counter
net, our proof of Proposition 8.6.2 requires that the finite system is not fixed. Nevertheless, we can show that the w-bisimilarity checking problem for fixed finite systems
is harder than DP.
Proposition 8.6.3 There exists a fixed finite system for which the w-bisimilarity checking problem is hard for PNP[log] even for one-counter nets.
This lower bound proof, which is given in the appendix, is achieved by a reduction
from a PNP[log] -complete problem called INDEX-ODD. Together with Lemma 8.5.1,
we also obtain a PNP[log] lower bound for a fixed EF formula (in this case tree/dag
representations are not important since the formula is fixed).
Proposition 8.6.4 There exists a fixed EF formula ϕ such that model checking ϕ over
one-counter nets is PNP[log] -hard.
In [GMT09], we gave a direct reduction which shows the same hardness result when
only EFΓ operators satisfying Γ = ACT are permitted.

Chapter 9
Networks of one-counter processes
In the previous chapter, we have studied one-counter processes and several verification problems over such systems. One-counter processes are, however, a rather weakmodel. They can only be used to model programs with bounded recursions and one
unbounded integer variable (used as a counter). Let us now imagine a more generalscenario when several integer-valued counters are used in a program. Consider thefollowing code snippet written in a C-like language:
INT i, n, m;
STRING s;// Initialized elsewhere// bounded length

L1:n, s are used ...
FOR( i = n; i ≥ 0; i = i − 1 )// Synch.

i, s are used ...

m = n − 2;// Synch.

L2: ...
This program has three unbounded integer variables and other bounded data structures(e.g. strings). The places where these variables synchronize in the form of simple variable assignments are underlined. Notice that the synchronizations take place outside
for/while loops. Within for/while loops, at most one integer variable is used. Observethat such a program already cannot be modeled by OCPs since we have to keep track ofseveral integer counters simultaneously, e.g., the variable n in this program is assigned
to i and m at different points of the program.
201

Chapter 9. Networks of one-counter processes

FO(Reach)4

FO (Reach)202

FO2 (Reach)EF-logic

in PNP & PNP[log] -hard (Chap. 8)

Combined

PSPACEPSPACE

Expression

PSPACE

in P

in P (Chap. 8)

PH

in PNP & PNP[log] -hard (Chap. 8)

Data

PH

Table 9.1: Results for OCPs.

The approach that we will take in this chapter is to study model checking problems
over asynchronous products of OCPs, which we denote by ΠOCP. They can also
be construed as networks of one-counter processes with each component behaving
independently (i.e. the processes do not interact). Observe that reachability for ΠOCP
can trivially be reduced to the reachability problems of their components. On the other
hand, when we consider the model checking problems of asynchronous products of
OCPs with more powerful logics like FO(Reach) and EF-logic, asynchronous products
are sufficiently powerful for modeling bounded synchronizations among the finitecontrol units of the OCPs. This follows from a more general result by Wöhrle andThomas [WT07] regarding finitely synchronized products of infinite-state systems. In
order to permit some synchronizations amongst the counters, we will also enrich theselogics with some simple synchronization predicates. These will enable us to verify
interesting properties of programs with multiple integer-valued counters with boundedsynchronizations between the counters, i.e., in every execution of the program, thenumber of times at which integer variables synchronize is bounded a priori. Noticethat the example of a program that we saw above falls within this category since it uses
only two synchronizations outside for/while loops.
The model checking problems over ΠOCP that we will consider in this chapter are with respect to the specifications in (1) FO(Reach), (2) the k-variable fragments FOk (Reach) (k ≥ 2) of FO(Reach), and (3) EF-logic, which is a fragment of

FO2 (Reach). We also study these logics extended with simple component-wise synchronizing predicates testing whether components i and j have the same counter values, which we denote by FOS (Reach), FOkS (Reach), and EFS -logic, respectively. The
goal of this chapter is to provide not only decidability results, but also the precise complexity of these model checking problems.
The results of this chapter are summarized in Table 9.1 and Table 9.2 together withthe results from the previous chapter. Notice that OCPs are simply the special case ofChapter 9. Networks of one-counter processes

203

FO(Reach)
FO4 (Reach)

FO2 (Reach)EF-logic

EFS -logic

FOS (Reach)
Combined

PSPACEPSPACEPSPACEPSPACE

Expression

PSPACE

in P

in P

PSPACE

Data

PH

PH

in PNP & PNP[log] -hard

PH

Table 9.2: Results for ΠOCP.

ΠOCP with only one component. In particular, all our results are within PSPACE,
in contrast to PDS whose expression complexity for FO(Reach) is nonelementary[CH90]. Our upper bounds are shown by first introducing two syntactic restrictions
L and L′ of Presburger Arithmetic, for which we give optimal quantifier elimination
procedures, and showing that the ΠOCP model checking problems are poly-time reducible to either L or L′ . Note that, to obtain a sharp upper bound, we cannot consider
only OCPs (without products) and apply Feferman-Vaught type of composition methods (e.g. see [Mak04, Rab07, WT07]) as the resulting algorithm will run in time that isnonelementary in the formula size. Concerning our lower bound results, in contrast to
the result from the previous chapter that model checking EF-logic is in PNP , data complexity of FO2 (Reach) over OCPs is already hard for every level of PH. On the other
hand, the expression complexity of FO2 (Reach) over ΠOCP is in P. This generalizes one of the key results from the previous chapter that the expression complexity ofEF-logic over OCPs (without products) is in P. However, for each k > 3, we can showthat the expression complexity of FOk (Reach) is PSPACE-complete already for OCPs.
Also, notice that the combined complexity of EF-logic becomes PSPACE, which holds
already for products of two OCPs. Finally, notice that adding simple synchronization
relations to EF-logic causes the expression and data complexity to increase significantly.
What about model checking with respect to specifications in CTL or LTL? We do
not consider them since they are easily shown to be undecidable by a simple reduction
from reachability of Minsky’s 2-counter systems, e.g., we can encode full synchronizations of the counters in a CTL formula of the form E(ϕ U ψ) (synchronization isembedded in ϕ). For monadic second-order logic, undecidability can be more easily
obtained by an asynchronous product of two OCPs which only increments their counters (i.e. this generates the two-dimensional infinite grid with an undecidable MSO

Chapter 9. Networks of one-counter processes

204

theory [Tho96]).
This chapter is organized as follows. We start with the definitions of asynchronous
products of OCPs and logics with synchronizing predicates in Section 9.1. In Section
9.2, we define our two fragments L and L′ of Presburger arithmetic and give a reduction
from our model checking problems to the membership problems of these logics. In
Section 9.3, we give optimal quantifier elimination procedures for L and L′ and deduce
optimal upper bounds for all model checking problems in Table 9.1 and Table 9.2. We
prove the lower bounds in Section 9.4. The results in this chapter have previously
appeared in [To09a].

9.1 Preliminaries
In this section, we first define the notions of asynchronous products of OCPs. We thenexplain how synchronizing predicates can be added in our logics.

9.1.1 Asynchronous products
We now review the definition of asynchronous products of transition systems and asynchronous products of OCPs.
Let ACT1 , . . . , ACTr be r pairwise disjoint sets of actions. Let ACT be their union.
For each i ∈ [1, r], let Gi = hVi , {Ea }a∈ACTi i be a transition system over ACTi . An asyn-chronous product of G1 , . . ., Gr is the transition system Πri=1 Gi := hV, {E a }a∈ACT i,
where V := Πri=1Vi and, whenever a ∈ ACTi , ū = (u1 , . . . , ur ), and v̄ = (v1 , . . ., vr ), we

have (ū, v̄) ∈ E a iff (ui , vi ) ∈ Ea and u j = v j for all j 6= i. Intuitively, the product is“asynchronous” as each edge relation in Πri=1 Gi changes at most one component ineach vertex of Πri=1 Gi , i.e., causing no interaction between different components. See[Rab07, WT07] for more details.
An asynchronous product P of r OCPs is simply a tuple of r OCPs P1 , . . . , Prover pairwise disjoint action alphabets ACT1 , . . . , ACTr .The product P has action labels
ACT := ACT1 ∪ . . . ∪ ACTr . Then, the transition system SP generated by P is defined

to be the transition system Πri=1 SPi over ACT. In the sequel, asynchronous productsof OCPs are abbreviated as ΠOCP.
We define the model checking problems of ΠOCP with respect to FO(Reach) as
follows.

Chapter 9. Networks of one-counter processes

205

M ODEL CHECKING FO(Reach) OVER ΠOCP
Instance: A ΠOCP P over ACT, an FO(Reach) formula ϕ(x1 , . . . , xk ) over ACT, kconfigurations {ci }ki=1 of P with binary representation of numbers.

Question: SP |= ϕ(c1 , . . . , ck )?

For other logics like FOk (Reach) (k ≥ 2) and EF-logic, we could define the model
checking problems in a similar fashion.

9.1.2 Synchronization predicates
So far, our logics cannot compare the values between two different counters in thesystem. We now introduce an extension that permits simple comparison tests (or synchronizing predicates) between counter values.
To add synchronizing predicates to the logic, we first add these predicates in thesemantics of ΠOCP. Given an asynchronous product ΠOCP of r OCPs P1 , . . . , Prover ACT =SrS
i=1 ACTi , we define a transition system SP as the transition system GP

expanded with the “synchronizing” edge relations {=i, j }1≤i6= j≤r that are defined as=i, j := {(c, c) : ni = n j },where c = ((q1 , n1 ), . . ., (qr , qr )). In other words, the relation =i, j contains all selfloops in SSP restricted to tuples in which the counter values of the ith component andthe jth component agree. The graph SSP has action labels ACT ∪ {(i, j)}i, j∈[1,r].

The logics FOS (Reach), FOkS (Reach), and EFS -logic are simply defined to be

FO(Reach), FOk (Reach), and EF-logic interpreted over this modified semantics. The
problem of model checking FOS (Reach) over ΠOCP can be defined as follows.
M ODEL CHECKING FOS (Reach) OVER ΠOCP
Instance: An asynchronous product P of r OCPs ACT, an FOS (Reach) formulaϕ(x1 , . . . , xk ) over ACT ∪ {(i, j)}i, j∈[1,r], k configurations {ci }ki=1 of P withbinary representation of numbers.

Question: SSP |= ϕ(c1 , . . . , ck )?

We can similarly define the model checking problems of FOkS (Reach) and EFS -logic over ΠOCPs.

Chapter 9. Networks of one-counter processes

206

9.2 Two fragments L and L′ of Presburger Arithmetic
We define our first fragment L of Presburger Arithmetic, to which we will reduce themodel checking of FOS (Reach) over ΠOCP.
Definition 9.2.1 The syntax of the logic L is as follows. Atomic propositions are of theform:• x ∼ y + c, where ∼∈ {≤, ≥, =},• x ∼ c, where ∼∈ {≤, ≥, =},• x ≡ y + c (mod d), where c ∈ [0, d − 1], and• x ≡ c (mod d), where c ∈ [0, d − 1].
Here, x and y can take any variables, while c and d are constant natural numbers,
given in binary representations. We then close the logic under boolean combinations,and existential and universal quantifications. The semantics is given directly fromPresburger Arithmetic. The expression x ≡ y + c (mod d) is to be interpreted as the
Presburger formula ∃z( x = y + c + dz ∨ x + dz = y + c ).

Intuitively, the logic L is the fragment of Presburger Arithmetic that permits only inequality tests, addition with constants, and modulo tests. We now impose some further
syntactic restrictions to our logic L, to which model checking FO2 (Reach) over ΠOCP
is still poly-time reducible.
Definition 9.2.2 Define the logic L′ as follows. The only variables allowed are xi andyi , where i ∈ Z>0 . The atomic propositions of L′ are given as follows for each i ∈ Z>0 :• xi ∼ yi + c and yi ∼ xi + c,
• xi ∼ c and yi ∼ c,
• xi ≡ yi + c (mod d) and yi ≡ xi + c (mod d), and• xi ≡ c (mod d) and yi ≡ c (mod d).
Here, c and d are constant natural numbers given in binary. We then close the logic
under boolean combinations, and existential and universal quantifications.

Chapter 9. Networks of one-counter processes

207

Observe that the logic L′ allows only two variables xi and yi to be related. In fact, if
we only allow x1 and y1 as variables, then L′ coincides with FO2 fragment of L.
We shall briefly discuss the expressive power of L in terms of subsets of Nk thatcan be defined in the logics. Let us first briefly recall the definition of first-ordermodulo counting logic FOMOD , which extends FO with the modulo counting quantifiers ∃ p,q , for each q ∈ Z>0 and p ∈ [0, q). When interpreted over over (N, <), thesemantics of FOMOD is defined over (N, <) as follows: (N, <) |= ∃ p,q xϕ(x, b) iff thenumber l := |{a ∈ N : (N, <) |= ϕ(a, b)}| is either infinite or finite and l ≡ p (mod q).
See [Pél92] for more details. It turns out that L coincides with the FOMOD theory

over hN, <i. In fact, [Pél92] shows that FOMOD theory over hN, <i admits a quantifier elimination, when the vocabulary is expanded with congruence tests. Therefore,

L subsumes FOMOD over hN, <i. To show that L ⊆ FOMOD hN, <i, observe that ex-pressions of the form x ∼ y + c can easily be replaced by equivalent FO formulas overhN, <i. Also, the atomic formula x ≡ y + c (mod d) can be defined as

Vd−1

a=0 (y ≡ a(mod d) ↔ x ≡ a + c (mod d)), and congruence tests x ≡ a (mod d) can be definedin FOMOD over hN, <i as ∃a,d y(y < x). The expressive power of FOMOD over hN, <iwas shown in [Pél92] to be strictly in between FO over hN, <i and Presburger Arithmetic. For example, it was shown that Presburger formulas of the form x = 2y is notdefinable in FOMOD over hN, <i. Finally, we shall emphasize that the proof in [Pél92]

of quantifier elimination for FOMOD over hN, <i expanded with congruence tests isnonconstructive.

The membership problem of the logic L is defined as follows: given ϕ(x) ∈ L,

where x = (x1 , . . ., xn ) and a tuple a ∈ Nn in binary, decide whether hN, +i |= ϕ(a).

The membership problem for L′ can be defined similarly. We now state a proposition,
which gives a reduction from model checking problems of ΠOCP to the membershipproblem for L or L′ .
Proposition 9.2.1 There is a poly-time reduction from the problem of model checking

FOS (Reach) (resp. FO2 (Reach)) over ΠOCP to the membership problem for L (resp.
L′ ). Furthermore, the alternation rank of the output formula in L (resp. L′ ) is the sameas the alternation rank of the input formula in FOS (Reach) (resp. FO2 (Reach)) up to
addition by a small constant.
This proposition can be proved easily using Lemma 8.3.1, Lemma 8.3.4, and Lemma
8.3.5. For this reason, we relegate the proof to the appendix.

Chapter 9. Networks of one-counter processes

208

9.3 Complexity upper bounds
In this section, we shall show that the combined and data complexity of FOS (Reach)over ΠOCP are, respectively, in PSPACE and PH. We then show that the expression
complexity of FO2 (Reach) is in P. To deduce a PNP upper bound for data complexityof EF-logic over ΠOCP, it suffices to invoke the Feferman-Vaught type of composition
method for EF-logic [Rab07] and use the PNP algorithm for model checking EF-logic
over OCPs from the previous chapter. Observe that these will give the claimed upperbounds in Table 9.1 and Table 9.2.

9.3.1 Combined and data complexity of FOS (Reach)
We start with the combined and data complexity of FOS (Reach) over ΠOCP.
Theorem 9.3.1 The combined and data complexity FOS (Reach) over ΠOCP are in
PSPACE and in PH, respectively.
By Proposition 9.2.1, to deduce this theorem it suffices to prove the following proposition.
Proposition 9.3.2 The membership problem of L -formulas is in PSPACE. Moreover,fixing the alternation rank of input formulas, the problem is in PH.
The proof is done via a quantifier elimination technique (e.g. see [Koz06] for an
overview). Intuitively, our proof can be thought of as an extension of EhrenfeuchtFraı̈ssé games on linear orders (e.g. see [Lib04]) with modulo tests. We first define anequivalence relation ≡kp,m on tuples of natural numbers.
Definition 9.3.1 Given two (k + 1)-tuples a = (a0 , . . ., ak ), b = (b0 , . . . , bk ) of natural
numbers such that a0 = b0 = 0 and two numbers p, m > 0, we write a ≡kp,m b iff for alli, j ∈ [0, k] the following statements hold:

1. |ai − a j | < pm implies |ai − a j | = |bi − b j |,2. |bi − b j | < pm implies |ai − a j | = |bi − b j |,3. |ai − a j | ≥ pm iff |bi − b j | ≥ pm,
4. ai ≡ bi (mod p),
5. ai ≤ a j iff bi ≤ b j .

Chapter 9. Networks of one-counter processes

209

The first two conditions above state that if two elements are “near”, then the difference
for the corresponding two elements in the other tuple is the same. The third conditionis the opposite of this condition: if two elements are “far” away from each other, thenso are the corresponding two elements in the other tuple. It is easy to check that, givenm′ ≥ m > 0, we have a ≡kp,m′ b implies a ≡kp,m b. Similarly, if p|p′ , then a ≡kp′ ,m b

implies a ≡kp,m b. The following lemma can be used to eliminate a quantifier.

Lemma 9.3.3 Given two (k + 1)-tuples a = (a0 , . . ., ak ), b = (b0 , . . ., bk ) of natural
numbers such that a0 = b0 = 0 and two numbers p, m > 0, if a ≡kp,3m b, then for all′a′ ∈ N, there exists b′ ∈ N such that a, a′ ≡k+1
p,m b, b .

Proof. In this proof, for two numbers c, d ∈ N, we write d(c, d) to denote |c − d|.
Suppose that a′ ∈ N. If a′ = ai for some i ∈ [0, k], then we simply set b′ = bi and see′that a, a′ ≡k+1
p,m b, b . Otherwise, there are two cases to consider:(Case I) the number a′ falls into a region R = (ar , as ) for some distinct integers r, s ∈[0, k].

(Case II) the number a′ falls into a region R = (ar , ∞) for some r ∈ [0, k] such that
there is no s ∈ [0, k] with ar < as .

Let us first consider Case I. Pick two indices r and s such that there is no l ∈ [0, k] withal ∈ R. There are several subcases to consider:

1. d(ar , as ) < 3pm. In this case, assumption implies that d(br , bs) = d(ar , as ).
Therefore, we may pick b′ = br +d(ar , a′ ). It is then easy to verify that a, a′ ≡k+1
p,mb, b′ .

2. d(ar , as ) ≥ 3pm. In this case, our assumption implies that d(br , bs) ≥ 3pm.
There are now three further subcases to consider:(a) d(ar , a′ ) < pm. In this case, it follows that we have d(a′ , as) ≥ pm. Pick′b′ = br + d(ar , a′ ). It is then easy to check that a, a′ ≡k+1
p,m b, b .

(b) d(a′ , as) < pm. This case is similar to the previous item; one can set b′ :=bs − d(a′ , as).
(c) d(ar , a′ ) ≥ pm and d(a′ , as ) ≥ pm. Since d(ar , as), ≥ 3pm, it follows that
there are at least p consecutive numbers in the region [ar + pm, as − pm].

Likewise, since d(br , bs) ≥ pm, there are at least p consecutive numbers inChapter 9. Networks of one-counter processes

210

the region [br + pm, bs − pm]. This implies that for every c ∈ [0, p), there

exists a′′ ∈ (ar , as ) with a′′ ≡ c (mod p), d(ar , a′′ ) ≥ pm, and d(a′′ , as) ≥pm iff there exists b′′ ∈ (br , bs ) with b′′ ≡ c (mod p), d(br , b′′) ≥ pm andd(b′′ , bs ) ≥ pm. Therefore, if a′ ≡ c (mod p) for some c ∈ [0, p), it follows that there exists b′ ∈ (br , bs ) with b′ ≡ c (mod p), d(br , b′ ) ≥ pm and′d(b′ , bs) ≥ pm. It it easy now to check that a, a′ ≡k+1
p,m b, b .

This completes our proof for Case I. Let us now turn to Case II. There are two possibilities:
1. d(ar , a′ ) < pm. In this case, we set b′ = br + d(ar , a′ ) and it is easy to see that′a, a′ ≡k+1
p,m b, b .

2. d(ar , a′ ) ≥ pm. In this case, we may set b′ = br + pm +(d(ar , a′ ) mod p). Since

we have ar ≡ br (mod p), it follows that a′ ≡ b′ (mod p). It is easy now to′verify that a, a′ ≡k+1
p,m b, b .

This concludes our proof. 2
Let us consider only tuples a = (a0 , . . . , ak ) of natural numbers satisfying a0 = 0.
′
Given an ≡kp,3m -equivalence class C and an ≡k+1
p,m -equivalence class C , we say that

C′ is consistent with C if there exist a tuple a = (a0 , . . ., ak ) of natural numbers and anumber a′ ∈ N such that a0 = 0, a ∈ C, and (a, a′ ) ∈ C′ . The following lemma showsthat we need not consider large numbers when eliminating a quantifier.

Lemma 9.3.4 Let a = (a0 , . . . , ak ) be a tuple of natural numbers and C be its ≡kp,3m -equivalence class. Then, every ≡k+1
p,m -equivalence class has a representative in the set{(a, a′ ) : 0 ≤ a′ ≤ max(a) + pm + p}.

Proof. This follows from the proof of Lemma 9.3.3, i.e., that we never need to add
more than pm + p from the maximal element in b. 2
Define r(0, m) := m and r(n + 1, m) := 3r(n, m), for n ∈ N. By induction, we haver(n, m) = 3n m. Let us now define the notion of offsets and periods of formulas in L.

If ϕ are atomic formulas of the form x ∼ y + c, x ∼ c, x ≡ y + c (mod d), or x ≡ c(mod d), then offsets of ϕ are defined to be the integer c. If ϕ is not an atomic formula,then its offset is the largest offset of atomic subformulas of ϕ. If ϕ are atomic formulasof the form x ∼ y + c or x ∼ c, then its period is defined to be 1. If ϕ are atomic
formulas of the form x ≡ y + c (mod d) or x ≡ c (mod d), then its period is definedChapter 9. Networks of one-counter processes

211

to be d. Otherwise, if ϕ is not an atomic formula, its period is defined to be the least
common multiple of the periods of each of its atomic subformulas. For p, m ∈ Z>0 ,define L p,m to be formulas in L, whose periods divide p and whose offsets are smaller
than m.
Lemma 9.3.5 Let p, m ∈ Z>0 . Suppose a = (a0 , . . . , ak ), b = (b0 , . . . , bk ) are tuplesof natural numbers satisfying a0 = b0 = 0 and a ≡kp,r(n,m) b. Then, given a formulaϕ(x1 , . . . , xk ) in L p,m of quantifier rank n,

hN, +i |= ϕ(a1 , . . . , ak ) ⇔ hN, +i |= ϕ(b1 , . . ., bk ).

Proof. The proof is by induction on ϕ. Let us consider the base cases. There are fourcases:• ϕ is of the form xi ∼ x j + c. Suppose that d(ai , a j ) < pm. In this case, ourassumption a ≡kp,m b implies that we have d(ai , a j ) = d(bi , b j ). Pick an integerr such that ai = bi + r. Then, since ai ≤ a j ⇔ bi ≤ b j , we have a j = b j + r.

Therefore, for each ∼∈ {≤, ≥, =}, we have ai ∼ a j + c iff bi + r ∼ b j + r + c iff

bi ∼ b j + c. Let us now consider the case when d(ai , a j ) ≥ pm. In this case, ourassumption a ≡kp,m b implies that d(bi , b j ) ≥ pm. Then, since ai ≤ a j ⇔ bi ≤ b j

and c < m ≤ pm, it follows that ai ≤ a j + c ⇔ bi ≤ b j + c. Furthermore, sincec < m ≤ pm, it follows that ai 6= a j + c and bi 6= b j + c. Altogether, these imply

that ai ∼ a j + c iff bi ∼ b j + c for each ∼∈ {≤, ≥, =}.

• ϕ is of the form xi ∼ c. This follows from the proof for the previous case.
• ϕ is of the form xi ≡ x j + c (mod d). Since ai ≡ bi (mod p) and a j ≡ b j(mod p), we also have ai ≡ bi (mod d) and a j ≡ b j (mod d) as d divides p.

It is then immediate that ai ≡ a j + c (mod d) iff bi ≡ b j + c (mod d).
• ϕ is of the form xi ≡ c (mod d). Same as the previous case.

We now turn to the inductive cases. The cases for boolean combinations are easy.
So, consider the case when ϕ is of the form ∃xk+1 ψ(x, xk+1 ). Then, let us provethat hN, +i |= ϕ(a) implies hN, +i |= ϕ(b); the converse is completely symmetric. If
hN, +i |= ϕ(a), then there exists ak+1 ∈ N such that hN, +i |= ψ(a, ak+1 ). Since a ≡kp,m′b, Lemma 9.3.3 implies that there exists bk+1 ∈ N such that a, a′ ≡k+1
p,r(n−1,m) b, b . By

induction, it follows that hN, +i |= ψ(b, b′ ), which proves that hN, +i |= ϕ(b). 2

Chapter 9. Networks of one-counter processes212

We are now ready to prove Proposition 9.3.2.
Proof of Proposition 9.3.2. We now give a polynomial-time alternating Turing machine M which checks whether hN, +i |= ϕ(a1 , . . . , an ) for given a formula ϕ(x1 , . . . , xn )and a n + 1-tuple a = (a0 , . . . , an ), where a0 = 0. First, push all the negations downward to the atomic propositions level, which can be done easily. Suppose that p andm be, respectively, the period and offset of the input formula. Now if ϕ is an atomic
proposition (i.e. inequality, or modulo tests), it is easy to see that M can check it inpoly-time. If ϕ is ψ ∨ ψ′ (resp. ψ ∧ ψ′ ), then existentially (resp. universally) guess ψor ψ′ and check the guessed formula. If ϕ is of the form ∃xψ(y, x) (resp. ∀xψ(y, x))

and has quantifier rank k, then M existentially (resp. universally) guesses a number
an+1 not exceeding max(a) + pr(k, m) + p ≤ max(a) + p3k m + p and check whether

hN, +i |= ψ(a, an+1 ). The upper bound for an+1 is sufficient due to Lemma 9.3.4.

To analyze the running time of M, notice that the maximum number that M canguess on any of its run on input ϕ of quantifier rank h and a tuple a of natural numbers(in binary) is max(a) + Σhj=0 (pr( j, m) + p) ≤ max(a) + p(h + 1)3h m + p(h + 1), which

can be represented using polynomially many bits. [Note that p and m are represented

in binary and so the guessed number is polynomial in log(p) and log(m).] This implies
that membership of L-formulas is in PSPACE. Finally, notice that the number of alternations used by M corresponds to the alternation rank of ϕ. Therefore, considering
only formulas of fixed alternation rank, the membership problem for L-formulas is in
PH. 2

9.3.2 Expression complexity of FO2 (Reach)
We now deal with the expression complexity of FO2 (Reach).
Theorem 9.3.6 The expression complexity of FO2 (Reach) over ΠOCP is in P.
Define L′p,m to be the set of all formulas in L′ whose periods divide p and whose
offsets do not exceed m. Let L′p,m (n) to be the set of all formulas in L′p,m that use only
variables in {x1 , . . ., xn } ∪ {y1 , . . ., yn }. For all fixed p, m, n ∈ Z>0 , the membershipproblem of L′p,m (n) is as follows: given ϕ(x, y) ∈ L′p,m (n) and two tuples a, b ∈ Nn of

numbers in binary representation, decide whether hN, +i |= ϕ(a, b). By Proposition
9.2.1, Theorem 9.3.6 follows from the following proposition.

Proposition 9.3.7 For fixed p, m, n ∈ Z>0 , the membership problem of L′p,m (n) is in P.

Chapter 9. Networks of one-counter processes

213

This proposition can also be proved via quantifier elimination. The intuition that we
can obtain a poly-time algorithm is from a two-pebble Ehrenfeucht-Fraı̈ssé games overlinear orders (see [Lib04]), which can only distinguish small linear orders (i.e. only
linear in the quantifier rank of the FO2 (Reach) formula). The proof is similar to thecase for FO(Reach), but is much more tedious, which we relegate to the appendix.

9.4 Complexity lower bounds
In order to facilitate our lower bound proofs in this section, we shall define a 2-player
game, called the buffer game, which we shall prove to be PSPACE-complete. First, let
LDIV be the set of quantifier-free L-formulas in 3-CNF (i.e. in CNF and each clausehas exactly three literals) with one free variable x, whose atomic propositions are of theform x ≡ 0 (mod p) where p is a prime number. The buffer game is played by Player∃ and Player ∀. An arena of the buffer game is a tuple (v, k, ϕ), where v is a finite
and strictly increasing sequence of positive integers, k is the number of integers in v,

and ϕ a formula of LDIV . The buffer game with arena (v, k, ϕ), where v = (v1 , . . . , vk ),has k + 1 rounds and is played as follows. Each round r defines a positive number mr ,which represents the current buffer value. At round 0, Player ∃ chooses a number m0

to be written to the buffer. Suppose that 0 < r ≤ k, and m0 , . . ., mr−1 are the buffer
values chosen from the previous rounds. At even (resp. odd) round r, Player ∃ (resp.

Player ∀) rewrites the buffer by a numbermr ≥ mr−1
 of his choosing such that mr ≡rrp j ), i.e., mr = mr−1 + c ∏vj=1
mr−1 (mod ∏vj=1
p j for some c ∈ N. In particular, by

Chinese remainder theorem, this condition implies that, for each 1 ≤ j ≤ vr , p j |mr iff

p j |mr−1 . In other words, each player is not allowed to “overwrite” some divisibility

information in the buffer. Player ∃ wins if hN, +i |= ϕ(mk ). Otherwise, Player ∀ wins.

The problem BUFFER is defined as follows: given an arena (v, k, ϕ) of the buffer game,where each number is represented in unary, decide whether Player ∃ has a winning

strategy. For each n ∈ N, we define the problem BUFFERn to be the restriction of the
problem BUFFER which takes only an input arena of the form (v, n, ϕ).

Lemma 9.4.1 The problem BUFFER is PSPACE-complete. The problem BUFFERk ispΣk+1 -complete.
Loosely speaking, by applying Gödel encoding (see Section 8.6 for its definition)
one can encode each truth valuation for boolean formulas into a number. Therefore,boolean formulas can be reduced to statements about divisibility. Furthermore, a blockChapter 9. Networks of one-counter processes214of ∃ (resp. ∀) quantifers in a quantified boolean formula can be reduced into a choiceof number at a single round in the buffer game for Player ∃ (resp. Player ∀). The proof

of Lemma 9.4.1 can be found in the appendix.

We now use the buffer game to prove our first lower bound result for the problem
of model checking OCPs.
Proposition 9.4.2 Combined complexity of FO2 (Reach) on OCPs is PSPACE-hard.
For every k ∈ N, there is a fixed formula ϕk of FO2 (Reach) with k + c quantifier alterp

nations, for some small constant c ∈ N, such that checking ϕk over OCPs is Σk -hard.

To prove this theorem, we first state a standard lemma, whose proof can be found in[JKMS04] (similar proof techniques have been used earlier in [Kuc00], and were also
used in our lower bound proofs in the previous chapter).
Lemma 9.4.3 Given a LDIV -formula ϕ, we can compute in polynomial time an OCP

P with a fixed set Γ of action symbols and an initial state qI such that, for each positive
integer m, it is the case that SP , (qI , m) |= α iff hN, +i |= ϕ(m), where α is a small fixed
EF formula.

The crucial idea in the proof of the above lemma is that both divisibility and indivisibility tests of the form p|x or p6 |x can be reduced to a certain reachability question for

an appropriate OCP P by embedding a cycle of length p in P .

Proof sketch of Proposition 9.4.2. We give a poly-time reduction from BUFFER. Givenan arena A = (v, k, ϕ), we compute an FO2 (Reach) sentence ϕ′ , and a OCP P =(Q, δ0 , δ>0 ) such that Player ∃ has a winning strategy in A iff SP |= ϕ′ . Let v =(v1 , . . . , vk ). As we shall see, ϕ′ depends only on k and has quantifier rank k + c forsome small constant c ∈ N, which by Lemma 9.4.1 will prove the desired lower boundfor data complexity.

We now run the algorithm given by Lemma 9.4.3 on input ϕ to compute a OCP

P1 = (D, δ10 , δ1>0 ) with initial state qI ∈ D. The key now is to build on top of P1 and thefixed formula α (which can be thought of as an FO2 (Reach) formula) so as to encode
the initial guessing of numbers.
The structure of our output OCP P can be visualized as
B0 → B1 . . . → Bk → P1 .

Chapter 9. Networks of one-counter processes

215

1

s

0

1

0

1
1
0 −1

0
0
10

t

−1

Figure 9.1: The s →∗ t path-weights in this graph equals (1 + 2N) ∪ (1 + 3N) ∪ (2 +3N) ∪ Z<0 .

The number k + 1 of blocks Bi in P corresponds to the number of rounds played in thebuffer game. The initial state is in block B0 . Our output FO2 (Reach) formula will havek + 1 leading (alternating) quantifiers so as to ensure that each player moves in theirdesignated rounds. One variable will be used for storing the last buffer value from theprevious round, while the other is used for storing the buffer value after the designatedplayer has made his move. We now describe how to ensure that at each round i (i > 0)vi
the player can only add numbers that are in the set Hi := {c ∏ j=1 p j : c ∈ N}. Define
the function g : Z>0 → Z>0 as g(s) := ∏sj=1 p j . Note that g grows exponentially in s,

which is why we cannot simply embed a cycle of length g(vi ) in Bi , for each i ∈ [1, k].
SS
On the other hand, notice that Hi is Z − Li , where Li :=
a
+
Np
∪
j
1≤ j≤vi a∈(0,p j )Z<0 .

In turn, Li can be characterized as the set of weights of paths in a small finite graph
Gi from a vertex s to a vertex t, where the weight of a path is the sum of the weights
of its edges (which we shall allow to be only either -1,0, or 1). In fact, Gi will haveiO(Σvj=1
p j ) vertices, which is polynomial in vi . For example, the set (1 + 2N) ∪ (1 +3N) ∪ (2 + 3N) ∪ Z<0 corresponds to the weights of s →∗ t paths in the graph in Figure

9.1.

Furthermore, the graph Gi can be thought of as an OCP. Adding the self-loop transitions (s, loops , s, 0) and (t, loopt ,t, 0) on states s and t, the binary relation{((s, a), (t, a + b)) : b ∈ Hi }can then be expressed in FO2 (Reach) as ¬(x →∗ y) ∧ Eloops (x, x) ∧ Eloopt (y, y). There-

fore, we shall embed the modified OCP Gi into Bi , where t will be the entry state forblock Bi+1 of P . [Bk+1 shall be interpreted as P1 .]Finally, using this idea, it is not difficult to compute the desired FO2 (Reach) sen-tence by mimicking the k + 1 rounds of the game by using at most k + c alternating
quantifiers (using only the variables x and y). The end buffer value m, which needs toChapter 9. Networks of one-counter processes

216

be checked against ϕ, can be checked against α instead. 2
We can also apply Lemma 9.4.1 to prove the following lower bound.
Proposition 9.4.4 The combined complexity of model checking EF-logic over an asynchronous product of two one-counter processes is PSPACE-hard.
The proof of this lower bound is given in the appendix. Intuitively, instead of simulating each alternation in the buffer game as values in the two variables x and y, we
can simulate them as values in two different counters. We can make sure that thedivisibility information is not “overwritten” by encoding it as a non-fixed formula.
We saw in the previous section that the expression complexity of FO2 (Reach) over
ΠOCP is in P. In contrast, we can show that this is not the case for FO4 (Reach) evenover OCPs (without products).
Proposition 9.4.5 The expression complexity of FO4 (Reach) (without equality relation) over OCPs is PSPACE-hard.
The fixed graph is in fact hN, <i. The proof, which is given in the appendix, adapts

the technique in [GS05] of succinctly encoding addition arithmetic on large numbers
using the successor relations and linear order < with only four variables.
We already saw that the data complexity of EF-logic over ΠOCP is PNP . In contrast, we can show the following proposition.
Proposition 9.4.6 For each k ∈ N, there is a fixed EFS -logic formula ϕk such thatpmodel checking ϕk over ΠOCP is Σk -hard.

Intuitively, by using the synchronization constraints, one can faithfully simulate twovariables x and y in any given FO2 (Reach) formula as values of two different counters.
Again this proof is given in the appendix. This idea can easily be adapted for showing
the following proposition by appealing to Proposition 9.4.5.
Proposition 9.4.7 The expression complexity of EFS -logic over ΠOCP is hard for
PSPACE.

Part III
Epilogue217

Chapter 10
Conclusions and Future work
In this thesis, we have presented several generic and specific techniques for deriving
decidability for infinite-state model checking with optimal or near-optimal complexity.
This chapter will conclude the thesis with a brief summary of the main results we haveobtained in this thesis and some future work.
Summary

We first recapitulate the generic techniques that we have given in this thesis. We adopt
word/tree automatic transition systems as our generic framework for modeling infinitestate systems. These classes of systems strike a good balance between expressive
power and closure/algorithmic properties. The expressive power of this framework
easily yields undecidability even for simple safety properties. Nevertheless, we haveobtained several algorithmic metatheorems for showing decidability (with optimal ornear-optimal complexity) for various model checking problems over these frameworks.
More importantly, we have shown that these algorithmic metatheorems can be used touniformly prove many known or previously not known decidability results with optimal (or near-optimal) complexity. Our algorithmic metatheorems are for recurrent
reachability (possibly with generalized Büchi conditions), model checking LTL (orfragments thereof) with multi-regular fairness constraints, and extensions of first-orderlogic with reachability and extended recurrent reachability operators. Our algorithmic
metatheorems can be used to obtain decidability for (among others) pushdown systems, prefix-recognizable systems, regular ground-tree rewrite systems, PA-processes,
order-2 collapsible pushdown systems, reversal-bounded counter systems (and theirextensions with discrete clocks), and many subclasses of Petri nets. For most of these,
we have been able to derive optimal or near-optimal complexity.
219

Chapter 10. Conclusions and Future work220

We now summarize the specific techniques that we have presented in the second
part of this thesis. Most of these techniques are specific for subclasses of countersystems. In particular, we considered reversal-bounded counter systems (and their extensions with discrete clocks) and one-counter processes. For reversal-bounded conter
systems (and extensions thereof), we provide a new algorithm for computing Parikh
images of NWAs as semilinear sets with optimal complexity, which we then use together with Ibarra’s algorithm [Iba78] to obtain an optimal algorithm for computing
the reachability relations of such systems. Together with the algorithmic metatheorem from Part I, we obtain an optimal complexity for LTL model checking withmulti-regular fairness constraints over reversal-bounded counter systems with discrete
clocks. We also provide a kind of fixed-parameter tractability result for model checking EF-logic over reversal-bounded counter systems. For one-counter processes andnetworks of one-counter processes, we obtain optimal complexity by providing three
new fragments of Presburger Arithmetic with better complexity ranging from PNP to
PSPACE. We have provided optimal complexity for nearly all model checking problems over these subclasses of counter systems that we considered.
Future work

We close this thesis by several future research directions:• Is it possible to develop semi-algorithms for computing reachability relations
over word/tree automatic systems with natural and general criteria for completeness? Recall that reachability for many subclasses of Petri nets and countersystems can be solved by one semi-algorithm given in [BFLS05, LS05a] for theclass of linear counter systems. In contrast, each of the upper bound that wederive using our algorithmic metatheorems requires the use of a specific known
result for computing reachability relations for a specific class of systems. Sucha semi-algorithm, if exists, will enable us to perform logic model checking overmany classes of infinite-state systems in a uniform way.
• Can our algorithmic metatheorems be extended to ω-automatic transition sys-

tems? As we have mentioned, this class subsumes interesting classes of infinitestate systems including real-timed systems. Furthermore, semi-algorithms forcomputing a subclass of ω-automatic systems have also been developed [BLW03,
BLW09]. However, this problem appears to be rather difficult owing to its con-

Chapter 10. Conclusions and Future work221

nection with the open problem on Ramseyan quantifiers over ω-automatic structures (cf. [Bar07, BGR10, Rub08] for more details).
• Develop new algorithmic metatheorems with better complexity over Presburger-

definable systems. Our algorithmic metatheorems cannot be used to give optimal
complexity for LTL model checking over subclasses of counter systems. For
example, LTL model checking over one-counter processes is PSPACE-complete,

while our technique only yields EXP upper bound. Restricting to Presburgerdefinable systems (i.e. a subclass of word automatic systems) could potentiallylead to better complexity.
• Obtain algorithmic metatheorems for branching-time logic model checking withgood complexity. As we saw, the approach that we develop in this thesis canonly give nonelementary upper bounds for branching-time logic model checking. This is in contrast to the complexity for pushdown systems or one-counter
processes which are within EXP. The challenge is to obtain sufficiently general
metatheorems but still with good complexity.
• Give extensions of the normal form theorem for Parikh images of NWAs, e.g.
to one-counter automata. As saw in Chapter 7, our normal form theorem for

Parikh images of NWAs cannot be extended to context-free grammars. There
are, however, subclasses of pushdown automata to which our normal form theorem could extend. In particular, an extension to one-counter automata will imply
that our exponential time complexity for LTL model checking over reversalbounded counter systems with discrete clocks also extend to the case when oneof the counter in the system is free.

Bibliography[Abe95] N. Abe. Characterizing PAC-learnability of semilinear sets. Inf. Comput.,
116(1):81–102, 1995.
[ABS01] A. Annichini, A. Bouajjani, and M. Sighireanu. TReX: A tool for reachability analysis of complex systems. In G. Berry, H. Comon, and A. Finkel,
editors, CAV, volume 2102 of Lecture Notes in Computer Science, pages
368–372. Springer, 2001.
[ACJT96] P. A. Abdulla, K. Cerans, B. Jonsson, and Y. K. Tsay. General decidability theorems for infinite-state systems. In LICS, pages 313–321, 1996.
[AD94] R. Alur and D. L. Dill. A theory of timed automata. Theor. Comput. Sci.,
126(2):183–235, 1994.
[AHU83] A. V. Aho, J. E. Hopcroft, and J. D. Ullman. Data Structures and Algorithms. Addison-Wesley, 1983.
[AHV95] S. Abiteboul, R. Hull, and V. Vianu. Foundations of Databases. AddisonWesley, 1995.
[AJNS04] P. A. Abdulla, B. Jonsson, M. Nilsson, and M. Saksena. A survey ofregular model checking. In Proc. of CONCUR04, volume 3170 of LNCS,
pages 35–48. Springer, 2004.
[AJRS06] P. A. Abdulla, B. Jonsson, A. Rezine, and M. Saksena. Proving livenessby backwards reachability. In C. Baier and H. Hermanns, editors, CONCUR, volume 4137 of Lecture Notes in Computer Science, pages 95–109.
Springer, 2006.
[All01] E. Allender. The division breakthroughs. Bulletin of the EATCS, 74:61–
77, 2001.
223

Bibliography

224[AM04] R. Alur and P. Madhusudan. Decision problems for timed automata: A
survey. In M. Bernardo and F. Corradini, editors, SFM, volume 3185 ofLecture Notes in Computer Science, pages 1–24. Springer, 2004.
[AP04] R. Alur and D. Peled, editors. Computer Aided Verification, 16th International Conference, CAV 2004, Boston, MA, USA, July 13-17, 2004, Proceedings, volume 3114 of Lecture Notes in Computer Science. Springer,
2004.
[BA06] M. Ben-Ari. Principles of Concurrent and Distributed Programming.
Addison Wesley, second edition, 2006.
[Bar07] V. Barany. Automatic Presentations of Infinite Structures. PhD thesis,
RWTH Aachen, 2007.
[BBF+ 01] B. Bérard, M. Bidoit, A. Finkel, F. Laroussinie, A. Petit, L. Petrucci, and
Ph. Schnoebelen. Systems and Software Verification: Model-Checking
Techniques and Tools. Springer, 2001.
[BC96] A. Boudet and H. Comon. Diophantine equations, Presburger arithmetic
and finite automata. In H. Kirchner, editor, CAAP, volume 1059 of Lecture Notes in Computer Science, pages 30–43. Springer, 1996.
[BCM+ 90] J. R. Burch, E. M. Clarke, K. L. McMillan, D. L. Dill, and L. J. Hwang.
Symbolic model checking: 102 0 states and beyond. In Meyer [Mey90],
pages 428–439.
[BCMS01] O. Burkart, D. Caucal, F. Moller, and B. Steffen. Verification on infinite
structures. In Handbook of process algebra, pages 545–623. Elsevier,North-Holland, 2001. Chapter 9.
[BDEK07] B. Becker, C. Dax, J. Eisinger, and F. Klaedtke. LIRA: Handling constraints of linear arithmetics over the integers and the reals. In Proceedings of the 19th International Conference on Computer Aided Verification(CAV’07), volume 4590 of Lecture Notes in Computer Science, pages
307–310. Springer-Verlag, 2007.
[BdRV01] P. Blackburn, M. de Rijke, and Y. Venema. Modal Logic. Cambridge
University Press, 2001.

Bibliography

225[BEM97] A. Bouajjani, J. Esparza, and O. Maler. Reachability analysis of pushdown automata: Application to model-checking. In A. W. Mazurkiewicz
and J. Winkowski, editors, CONCUR, volume 1243 of Lecture Notes in
Computer Science, pages 135–150. Springer, 1997.
[Ber79] J. Berstel. Transductions and Context-free Languages. Teubner Verlag,
1979.
[Ber80] L. Berman. The complexity of logical theories. Theor. Comput. Sci.,
11:71–77, 1980.
[BFLP08] S. Bardin, A. Finkel, J. Leroux, and L. Petrucci. FAST: acceleration fromtheory to practice. STTT, 10(5):401–424, 2008.
[BFLS05] S. Bardin, A. Finkel, J. Leroux, and Ph. Schnoebelen. Flat accelerationin symbolic model checking. In Peled and Tsay [PT05], pages 474–488.
[BG04] A. Blumensath and E. Grädel. Finite presentations of infinite structures:
Automata and interpretations. Theory Comput. Syst., 37(6):641–674,
2004.
[BG09] W. Bekker and V. Goranko. Symbolic model checking of tense logics onrational Kripke models. LNAI, 5489:3–21, 2009.
[BGR10] V. Barany, E. Graedel, and S. Rubin. Automata-based presentations of
infinite structures, 2010.
[BH96] A. Bouajjani and P. Habermehl. Constrained properties, semilinear systems, and Petri nets. In Montanari and Sassone [MS96], pages 481–497.
[BHLW10] P. Barceló, C. A. Hurtado, L. Libkin, and P. T. Wood. Expressive languages for path queries over graph-structured data. In J. Paredaens and
D. Van Gucht, editors, PODS, pages 3–14. ACM, 2010.
[BHMV94] V. Bruyére, G. Hansel, C. Michaux, and R. Villemaire. Logic and precognizable sets of integers. Bull. Belg. Math. Soc., 1:191–238, 1994.
[BHV04] A. Bouajjani, P. Habermehl, and T. Vojnar. Abstract regular model checking. In Alur and Peled [AP04], pages 372–386.

Bibliography

226[Bir92] J. C. Birget. Intersection and union of regular languages and state complexity. Inf. Process. Lett., 43(4):185–190, 1992.
[BJNT00] A. Bouajjani, B. Jonsson, M. Nilsson, and T. Touili. Regular model
checking. In Emerson and Sistla [ES00], pages 403–418.
[BKRS09] L. Bozzelli, M. Kretı́nský, V. Rehák, and J. Strejcek. On decidability of
LTL model checking for process rewrite systems. Acta Inf., 46(1):1–28,
2009.
[BLN07] M. Benedikt, L. Libkin, and F. Neven. Logical definability and querylanguages over ranked and unranked trees. ACM Trans. Comput. Log.,
8(2), 2007.
[Blu99] A. Blumensath. Automatic structures. Master’s thesis, RWTH Aachen,
1999.
[BLW03] B. Boigelot, A. Legay, and P. Wolper. Iterating transducers in the large(extended abstract). In W. A. Hunt Jr. and F. Somenzi, editors, CAV,
volume 2725 of Lecture Notes in Computer Science, pages 223–235.
Springer, 2003.
[BLW09] A. Bouajjani, A. Legay, and P. Wolper. A framework to handle linear temporal properties in (ω-)regular model checking. CoRR, abs/0901.4080,
2009.
[BMMR01] T. Ball, R. Majumdar, T. Millstein, and S. K. Rajamani. Automatic predicate abstraction of C programs. SIGPLAN Not., 36(5):203–213, 2001.
[Boi99] B. Boigelot. Symbolic Methods for Exploring Infinite State Spaces. PhD
thesis, Université de Liège, 1999.
[Boi03] B. Boigelot. On iterating linear transformations over recognizable sets ofintegers. Theor. Comput. Sci., 309(1-3):413–468, 2003.
[Bou01] A. Bouajjani. Languages, rewriting systems, and verification of infinitestate systems. In F. Orejas, P. G. Spirakis, and J. van Leeuwen, editors,
ICALP, volume 2076 of Lecture Notes in Computer Science, pages 24–
39. Springer, 2001.

Bibliography

227[BŘS09] T. Babiak, V. Řehák, and J. Strejček. Almost Linear Büchi Automata. In
Proceedings 16th International Workshop on Expressiveness in Concurrency 2009 (EXPRESS’09). EPTCS 8, pages 16–25, 2009.
[BW90] J. Baeten and W. Weijland. Process Algebra. Cambridge University
Press, 1990.
[BW94] B. Boigelot and P. Wolper. Symbolic verification with periodic sets. In
D. L. Dill, editor, CAV, volume 818 of Lecture Notes in Computer Science, pages 55–67. Springer, 1994.
[Cac02] T. Cachat. Uniform solution of parity games on prefix-recognizablegraphs. Electr. Notes Theor. Comput. Sci., 68(6), 2002.
[Cac03] T. Cachat. Higher order pushdown automata, the Caucal hierarchy ofgraphs and parity games. In J. C. M. Baeten, J. K. Lenstra, J. Parrow,and G. J. Woeginger, editors, ICALP, volume 2719 of Lecture Notes in
Computer Science, pages 556–569. Springer, 2003.
[Cau90] D. Caucal. On the regular structure of prefix rewriting. In A. Arnold,
editor, CAAP, volume 431 of Lecture Notes in Computer Science, pages
87–102. Springer, 1990.
[Cau92] D. Caucal. On the regular structure of prefix rewriting. Theor. Comput.
Sci., 106(1):61–86, 1992.
[Cau96] D. Caucal. On infinite transition graphs having a decidable monadic theory. In F. Meyer auf der Heide and B. Monien, editors, ICALP, volume1099 of Lecture Notes in Computer Science, pages 194–205. Springer,
1996.
[Cau02] D. Caucal. On infinite terms having a decidable monadic theory. In Diks
and Rytter [DR02], pages 165–176.
[Cau03] D. Caucal. On infinite transition graphs having a decidable monadic theory. Theor. Comput. Sci., 290(1):79–115, 2003.
[CDG+ 07] H. Comon, M. Dauchet, R. Gilleron, C. Löding, F. Jacquemard,
D. Lugiez, S. Tison, and M. Tommasi. Tree automata techniques and applications. Available on: http://www.grappa.univ-lille3.fr/tata,2007. release October, 12th 2007.

Bibliography

228[CDGV94] J. L. Coquidé, Max Dauchet, Rémi Gilleron, and Sándor Vágvölgyi.
Bottom-up tree pushdown automata: Classification and connection withrewrite systems. Theor. Comput. Sci., 127(1):69–98, 1994.
[CGP99] E. M. Clarke, O. Grumberg, and D. A. Peled. Model checking. The MIT
Press, 1999.
[CH90] K. J. Compton and C. W. Henson. A uniform method for proving lower
bounds on the computational complexity of logical theories. Ann. Pure
Appl. Logic, 48(1):1–79, 1990.
[Chr86] M. Chrobak. Finite automata and unary languages. Theor. Comput. Sci.,
47(3):149–158, 1986.
[Cip95] B. Cipra. How number theory got the best of the Pentium chip. Science,
267(5195):175, 1995.
[CJ98] H. Comon and Y. Jurski. Multiple counters automata, safety analysis andPresburger arithmetic. In Hu and Vardi [HV98], pages 268–279.
[CJ99] H. Comon and Y. Jurski. Timed automata and the theory of real numbers.
In J. C. M. Baeten and S. Mauw, editors, CONCUR, volume 1664 of
Lecture Notes in Computer Science, pages 242–257. Springer, 1999.
[Col02] T. Colcombet. On families of graphs having a decidable first order theory
with reachability. In P. Widmayer, F. T. Ruiz, R. M. Bueno, M. Hennessy,
S. Eidenbenz, and R. Conejo, editors, ICALP, volume 2380 of Lecture
Notes in Computer Science, pages 98–109. Springer, 2002.
[CPR06a] B. Cook, A. Podelski, and A. Rybalchenko. Termination proofs for systems code. In M. I. Schwartzbach and T. Ball, editors, PLDI, pages 415–
426. ACM, 2006.
[CPR06b] B. Cook, A. Podelski, and A. Rybalchenko. Terminator: Beyond safety.
In T. Ball and R. B. Jones, editors, CAV, volume 4144 of Lecture Notes
in Computer Science, pages 415–418. Springer, 2006.
[CW98] B. Courcelle and I. Walukiewicz. Monadic second-order logic, graphcoverings and unfoldings of transition systems. Ann. Pure Appl. Logic,
92(1):35–62, 1998.

Bibliography

229[CW03] A. Carayol and S. Wöhrle. The Caucal hierarchy of infinite graphs interms of logic and higher-order pushdown automata. In P. K. Pandya
and J. Radhakrishnan, editors, FSTTCS, volume 2914 of Lecture Notes in
Computer Science, pages 112–123. Springer, 2003.
[CW07] T. Cachat and I. Walukiewicz. The complexity of games on higher order
pushdown automata. CoRR, abs/0705.0262, 2007.
[CY92] C. Courcoubetis and M. Yannakakis.

Minimum and maximum de-lay problems in real-time systems. Formal Methods in System Design,
1(4):385–415, 1992.
[Dem06] S. Demri.

Linear-time temporal logics with Presburger constraints:

An overview. Journal of Applied Non-Classical Logics, 16(3-4):311–
347, 2006.
[DGH] A. Durand-Gasselin and P. Habermehl. On the use of nondeterministic
automata for Presburger arithmetic. To appear in CONCUR 2010.
[DIB+ 00] Z. Dang, O. H. Ibarra, T. Bultan, R. A. Kemmerer, and J. Su. Binary
reachability analysis of discrete pushdown timed automata. In Emerson
and Sistla [ES00], pages 69–84.
[Dic13] L.E. Dickson. Finiteness of the odd perfect and primitive abundant numbers with r distinct prime factors. Amer. Journal Math., 35:413–422,
1913.
[DIP01] Z. Dang, O. H. Ibarra, and P. S. Pietro. Liveness verification of reversalbounded multicounter machines with a free counter. In R. Hariharan,
M. Mukund, and V. Vinay, editors, FSTTCS, volume 2245 of Lecture
Notes in Computer Science, pages 132–143. Springer, 2001.
[DKW08] V. D’Silva, D. Kroening, and G. Weissenbacher. A survey of automatedtechniques for formal software verification. IEEE Trans. on CAD of Integrated Circuits and Systems, 27(7):1165–1178, 2008.
[DLS02] D. Dams, Y. Lakhnech, and M. Steffen. Iterating transducers. J. Log.
Algebr. Program., 52-53:109–127, 2002.

Bibliography

230[DR02] K. Diks and W. Rytter, editors. Mathematical Foundations of Computer Science 2002, 27th International Symposium, MFCS 2002, Warsaw, Poland, August 26-30, 2002, Proceedings, volume 2420 of Lecture
Notes in Computer Science. Springer, 2002.
[DT90] M. Dauchet and S. Tison. The theory of ground rewrite systems is decidable. In Meyer [Mey90], pages 242–248.
[Edm67] J. Edmonds. Systems of distinct representatives and linear algebra. J.
Res. Nat. Bur. Standards, 71B:241–245, 1967.
[EHRS00] J. Esparza, D. Hansel, P. Rossmanith, and S. Schwoon. Efficient algorithms for model checking pushdown systems. In Emerson and Sistla[ES00], pages 232–247.
[EK99] J. Esparza and J. Knoop. An automata-theoretic approach to interprocedural data-flow analysis. In W. Thomas, editor, FoSSaCS, volume 1578
of Lecture Notes in Computer Science, pages 14–30. Springer, 1999.
[EKS03] J. Esparza, A. Kucera, and S. Schwoon. Model checking LTL with regularvaluations for pushdown systems. Inf. Comput., 186(2):355–376, 2003.
[EP00] J. Esparza and A. Podelski. Efficient algorithms for pre* and post* oninterprocedural parallel flow graphs. In POPL, pages 1–11, 2000.
[ES00] E. A. Emerson and A. P. Sistla, editors. Computer Aided Verification,
12th International Conference, CAV 2000, Chicago, IL, USA, July 15-19,
2000, Proceedings, volume 1855 of Lecture Notes in Computer Science.
Springer, 2000.
[Esp94] J. Esparza. On the decidability of model checking for several µ-calculi
and petri nets. In S. Tison, editor, CAAP, volume 787 of Lecture Notes in
Computer Science, pages 115–129. Springer, 1994.
[Esp96] J. Esparza. Decidability and complexity of Petri net problems - an introduction. In W. Reisig and G. Rozenberg, editors, Petri Nets, volume 1491
of Lecture Notes in Computer Science, pages 374–428. Springer, 1996.
[Esp97a] J. Esparza. Decidability of model checking for infinite-state concurrent
systems. Acta Inf., 34(2):85–107, 1997.

Bibliography

231[Esp97b] J. Esparza. Petri nets, commutative context-free grammars, and basic
parallel processes. Fundam. Inf., 31(1):13–25, 1997.
[EVW02] K. Etessami, M. Y. Vardi, and T. Wilke. First-order logic with two variables and unary temporal logic. Inf. Comput., 179(2):279–295, 2002.
[FG06] J. Flum and M. Grohe. Parameterized Complexity Theory. Springer,
2006.
[Fin87] A. Finkel. A generalization of the procedure of Karp and Miller to wellstructured transition systems. In T. Ottmann, editor, ICALP, volume 267
of Lecture Notes in Computer Science, pages 499–508. Springer, 1987.
[Fin90] A. Finkel. Reduction and covering of infinite reachability trees. Inf.
Comput., 89(2):144–179, 1990.
[FL02] A. Finkel and J. Leroux. How to compose Presburger-accelerations: Applications to broadcast protocols. In M. Agrawal and A. Seth, editors,
FSTTCS, volume 2556 of Lecture Notes in Computer Science, pages 145–
156. Springer, 2002.
[FS01] A. Finkel and Ph. Schnoebelen. Well-structured transition systems everywhere! Theor. Comput. Sci., 256(1-2):63–92, 2001.
[GI81] E. M. Gurari and O. H. Ibarra. The complexity of decision problems forfinite-turn multicounter machines. J. Comput. Syst. Sci., 22(2):220–229,
1981.
[GJ79] M. R. Garey and D. S. Johnson. Computers and Intractability: A Guide
to the Theory of NP-completeness. W.H.Freeman & Co Ltd, 1979.
[GL06] S. Göller and M. Lohrey. Infinite state model-checking of propositional
dynamic logics. In Z. Ésik, editor, CSL, volume 4207 of Lecture Notes in
Computer Science, pages 349–364. Springer, 2006.
[GL10] S. Göller and M. Lohrey. Branching-time model checking of one-counter
processes. In Marion and Schwentick [MS10], pages 405–416.
[GMT09] S. Göller, R. Mayr, and A. W. To. On the computational complexity ofverifying one-counter processes. In LICS, pages 235–244. IEEE Computer Society, 2009.

Bibliography

232[GN08] W. Gelade and F. Neven. Succinctness of the complement and intersection of regular expressions. In S. Albers and P. Weil, editors, STACS,
volume 1 of LIPIcs, pages 325–336. Schloss Dagstuhl - Leibniz-Zentrum
fuer Informatik, Germany, 2008.
[Göl08] S. Göller. Reachability on prefix-recognizable graphs. Inf. Process. Lett.,
108(2):71–74, 2008.
[Grä88] E. Grädel. Subclasses of Presburger arithmetic and the polynomial-timehierarchy. Theor. Comput. Sci., 56:289–301, 1988.
[Grä90] E. Grädel. Simple interpretations among complicated theories. Inf. Process. Lett., 35(5):235–238, 1990.
[Gre09] S. Greengard. Making automation work. Commun. ACM, 52(12):18–19,
2009.
[Gru97] O. Grumberg, editor. Computer Aided Verification, 9th International
Conference, CAV ’97, Haifa, Israel, June 22-25, 1997, Proceedings, volume 1254 of Lecture Notes in Computer Science. Springer, 1997.
[GS66] S. Ginsburg and E. H. Spanier. Semigroups, Presburger formulas, andlanguages. Pacific J. Math., 16(2):285–296, 1966.
[GS78] J. Von Zur Gathen and M. Sieveking. A bound on solutions of linear
integer equalities and inequalities. Proc. AMS, 72:155–158, 1978.
[GS97] S. Graf and H. Saı̈di. Construction of abstract state graphs with PVS. In
Grumberg [Gru97], pages 72–83.
[GS00] S. Graf and M. I. Schwartzbach, editors. Tools and Algorithms for Construction and Analysis of Systems, 6th International Conference, TACAS
2000, Held as Part of the European Joint Conferences on the Theory andPractice of Software, ETAPS 2000, Berlin, Germany, March 25 - April 2,
2000, Proceedings, volume 1785 of Lecture Notes in Computer Science.
Springer, 2000.
[GS05] M. Grohe and N. Schweikardt. The succinctness of first-order logic onlinear orders. Logical Methods in Computer Science, 1(1), 2005.

Bibliography

233[Hab97] P. Habermehl. On the complexity of the linear-time mu-calculus for Petrinets. In P. Azéma and G. Balbo, editors, ICATPN, volume 1248 of Lecture
Notes in Computer Science, pages 102–116. Springer, 1997.
[Har86] D. Harel. Effective transformations on infinite trees, with applications
to high undecidability, dominoes, and fairness. J. ACM, 33(1):224–248,
1986.
[HJJ+95] J.G. Henriksen, J. Jensen, M. Jørgensen, N. Klarlund, B. Paige, T. Rauhe,and A. Sandholm. Mona: Monadic second-order logic in practice. In
Tools and Algorithms for the Construction and Analysis of Systems, FirstInternational Workshop, TACAS ’95, LNCS 1019, 1995.
[HMOS08] M. Hague, A. S. Murawski, C.-H. L. Ong, and O. Serre. Collapsible
pushdown automata and recursion schemes. In LICS, pages 452–461.
IEEE Computer Society, 2008.
[Hod83] B. R. Hodgson. Decidabilite par automate fini. Ann. Sc. Math. Quebec,
7(1):39–57, 1983.
[HP79] J. E. Hopcroft and J. J. Pansiot. On the reachability problem for 5dimensional vector addition systems. Theor. Comput. Sci., 8:135–159,
1979.
[HPW09a] C. A. Hurtado, A. Poulovassilis, and P. T. Wood. Finding top-k approximate answers to path queries. In T. Andreasen, R. R. Yager, H. Bulskov,
H. Christiansen, and H. L. Larsen, editors, FQAS, volume 5822 of Lecture Notes in Computer Science, pages 465–476. Springer, 2009.
[HPW09b] C. A. Hurtado, A. Poulovassilis, and P. T. Wood. Ranking approximate
answers to semantic web queries. In L. Aroyo, P. Traverso, F. Ciravegna,
P. Cimiano, T. Heath, E. Hyvönen, R. Mizoguchi, E. Oren, M. Sabou,and E. P. B. Simperl, editors, ESWC, volume 5554 of Lecture Notes in
Computer Science, pages 263–277. Springer, 2009.
[HR87] R. R. Howell and L. E. Rosier. An analysis of the nonemptiness problem
for classes of reversal-bounded multicounter machines. J. Comput. Syst.
Sci., 34(1):55–74, 1987.

Bibliography234[Huy83] D. T. Huynh. Commutative grammars: The complexity of uniform word
problems. Information and Control, 57(1):21–39, 1983.
[HV98] A. J. Hu and M. Y. Vardi, editors. Computer Aided Verification, 10th
International Conference, CAV ’98, Vancouver, BC, Canada, June 28 July 2, 1998, Proceedings, volume 1427 of Lecture Notes in Computer
Science. Springer, 1998.
[Iba78] O. H. Ibarra. Reversal-bounded multicounter machines and their decision
problems. J. ACM, 25(1):116–133, 1978.
[IK89] N. Immerman and D. Kozen. Definability with bounded number of boundvariables. Inf. Comput., 83(2):121–139, 1989.
[ISD+ 02] O. H. Ibarra, J. Su, Z. Dang, T. Bultan, and R. A. Kemmerer. Countermachines and verification problems. Theor. Comput. Sci., 289(1):165–
189, 2002.
[JKM01] P. Jancar, A. Kucera, and R. Mayr. Deciding bisimulation-like equivalences with finite-state processes. Theor. Comput. Sci., 258(1-2):409–
433, 2001.
[JKMS04] P. Jancar, A. Kucera, F. Moller, and Z. Sawa. DP lower bounds forequivalence-checking and model-checking of one-counter automata. Inf.
Comput., 188(1):1–19, 2004.
[JM00] D. Jurafsky and J. H. Martin. Speech and Language Processing. Prentice
Hall, 2000.
[JN00] B. Jonsson and M. Nilsson. Transitive closures of regular relations forverifying infinite-state systems. In Graf and Schwartzbach [GS00], pages
220–234.
[Joh86] J. H. Johnson. Rational equivalence relations. Theor. Comput. Sci.,
47(3):39–60, 1986.
[JW96] D. Janin and I. Walukiewicz. On the expressive completeness of the
propositional mu-calculus with respect to monadic second order logic.
In Montanari and Sassone [MS96], pages 263–277.

Bibliography

235[Kam68] H. Kamp. Tense Logic and the Theory of Linear Order. PhD thesis,
UCLA, 1968.
[Kan83] R. Kannan. Improved algorithms for integer programming and related
lattice problems. In STOC, pages 193–206. ACM, 1983.
[Kar10] A. Kartzow. Collapsible pushdown graphs of level 2 are tree-automatic.
In Marion and Schwentick [MS10], pages 501–512.
[KEM06] A. Kucera, J. Esparza, and R. Mayr. Model checking probabilistic pushdown automata. Logical Methods in Computer Science, 2(1), 2006.
[KJ06] A. Kucera and P. Jancar. Equivalence-checking on infinite-state systems:
Techniques and results. TPLP, 6(3):227–264, 2006.
[Kla08] F. Klaedtke. Bounds on the automata size for Presburger arithmetic. ACM
Trans. Comput. Log., 9(2), 2008.
[KM02] A. Kucera and R. Mayr. On the complexity of semantic equivalences for
pushdown automata and BPA. In Diks and Rytter [DR02], pages 433–
445.
[KMM+97] Y. Kesten, O. Maler, M. Marcus, A. Pnueli, and E. Shahar. Symbolicmodel checking with rich ssertional languages. In Grumberg [Gru97],
pages 424–435.
[KMM+01] Y. Kesten, O. Maler, M. Marcus, A. Pnueli, and E. Shahar. Symbolicmodel checking with rich assertional languages. Theor. Comput. Sci.,
256(1-2):93–112, 2001.
[Kop10] E. Kopczynski. Complexity of problems for commutative grammars.
CoRR, abs/1003.4105, 2010.
[Koz97] D. C. Kozen. Automata and Computability. Springer-Verlag, 1997.
[Koz06] D. C. Kozen. Theory of Computation. Springer-Verlag, 2006.
[KPV02] O. Kupferman, N. Piterman, and M. Y. Vardi. Model checking linear
properties of prefix-recognizable systems. In E. Brinksma and K. G.
Larsen, editors, CAV, volume 2404 of Lecture Notes in Computer Science, pages 371–385. Springer, 2002.

Bibliography

236[KRS05] B. Khoussainov, S. Rubin, and F. Stephan. Automatic linear orders andtrees. ACM Trans. Comput. Log., 6(4):675–700, 2005.
[KT10] E. Kopczynski and A. W. To. Parikh images of grammars: Complexity
and applications. To appear in LICS, 2010.
[Kuc00] A. Kucera. Efficient verification algorithms for one-counter processes. In
U. Montanari, J. D. P. Rolim, and Emo Welzl, editors, ICALP, volume
1853 of Lecture Notes in Computer Science, pages 317–328. Springer,
2000.
[LAS] Homepage

LASH.

http://www.montefiore.ulg.ac.be/∼boigelot/research/lash/.

[Len83] H.W. Lenstra. Integer programming with a fixed number of variables.
Math. Oper. Res., 8(4):538–548, 1983.
[Lib04] L. Libkin. Elements Of Finite Model Theory (Texts in Theoretical Computer Science. An EATCS Series). Springer-Verlag, 2004.
[Lip76] R. J. Lipton. The reachability problem requires exponential space. Technical Report 62, Department of Computer Science, Yale University, 1976.
[Löd03] C. Löding. Infinite Graphs Generated by Tree Rewriting. PhD thesis,
RWTH Aachen, 2003.
[Löd06] C. Löding.

Reachability problems on regular ground tree rewritinggraphs. Theory Comput. Syst., 39(2):347–383, 2006.
[LS02] D. Lugiez and Ph. Schnoebelen. The regular viewpoint on PA-processes.
Theor. Comput. Sci., 274(1-2):89–115, 2002.
[LS04] J. Leroux and G. Sutre. On flatness for 2-dimensional vector addition
systems with states. In P. Gardner and N. Yoshida, editors, CONCUR,
volume 3170 of Lecture Notes in Computer Science, pages 402–416.
Springer, 2004.
[LS05a] J. Leroux and G. Sutre. Flat counter automata almost everywhere! In
Peled and Tsay [PT05], pages 489–503.

Bibliography

237[LS05b] D. Lugiez and Ph. Schnoebelen. Decidable first-order transition logics
for PA-processes. Inf. Comput., 203(1):75–113, 2005.
[LS07] M. Leucker and C. Sánchez. Regular linear temporal logic. In C. B.
Jones, Z. Liu, and J. Woodcock, editors, ICTAC, volume 4711 of Lecture
Notes in Computer Science, pages 291–305. Springer, 2007.
[Lyn96] N. A. Lynch. Distributed Algorithms. Morgan Kaufmann Publishers Inc.,San Francisco, CA, USA, 1996.
[Mai00] M. Maidl. The common fragment of CTL and LTL. In FOCS, pages
643–652, 2000.
[Mak04] J. A. Makowsky. Algorithmic uses of the Feferman-Vaught theorem.
Ann. Pure Appl. Logic, 126(1-3):159–213, 2004.
[Mar02] A. Martinez. Efficient computation of regular expressions from unary
NFAs. In DFCS ’02: Pre-Proceedings, Descriptional Complexity of Formal Systems, pages 174–187, 2002.
[Mas76] A.N. Maslov. Multilevel stack automata. Probl. Inf. Transm., 15:1170–
1174, 1976.
[May84] E. W. Mayr. An algorithm for the general Petri net reachability problem.
SIAM J. Comput., 13(3):441–460, 1984.
[May98] R. Mayr. Decidability and Complexity of Model Checking Problems forInfinite-State Systems. PhD thesis, TU-Munich, 1998.
[May00] R. Mayr. On the complexity of bisimulation problems for pushdown automata. In J. van Leeuwen, O. Watanabe, M. Hagiya, P. D. Mosses, and
T. Ito, editors, IFIP TCS, volume 1872 of Lecture Notes in Computer
Science, pages 474–488. Springer, 2000.
[May01] R. Mayr. Decidability of model checking with the temporal logic EF.
Theor. Comput. Sci., 256(1-2):31–62, 2001.
[McM93] K. L. McMillan. Symbolic Model Checking: An Approach to the State
Explosion Problem. Kluwer Academic Publishers, 1993.

Bibliography238[Mey90] A. R. Meyer, editor. Proceedings, Fifth Annual IEEE Symposium on
Logic in Computer Science, 4-7 June 1990, Philadelphia, Pennsylvania,
USA. IEEE Computer Society, 1990.
[Min67] M. L. Minsky. Computation: Finite and Infinite Machines. Prentice-Hall,Englewood Cliff, NJ, 1967.
[Mol96] F. Moller. Infinite results. In Montanari and Sassone [MS96], pages 195–
216.
[Mor00] C. Morvan. On rational graphs. In FOSSACS ’00, pages 252–266, 2000.
[MP71] M. McNaughton and S. Papert. Counter-Free Automata. MIT Press,
1971.
[MS85] D. E. Muller and P. E. Schupp. The theory of ends, pushdown automata,and second-order logic. Theor. Comput. Sci., 37:51–75, 1985.
[MS96] U. Montanari and V. Sassone, editors. CONCUR ’96, Concurrency Theory, 7th International Conference, Pisa, Italy, August 26-29, 1996, Proceedings, volume 1119 of Lecture Notes in Computer Science. Springer,
1996.
[MS10] J.-Y. Marion and T. Schwentick, editors. 27th International Symposiumon Theoretical Aspects of Computer Science, STACS 2010, March 4-6,
2010, Nancy, France, volume 5 of LIPIcs. Schloss Dagstuhl - LeibnizZentrum fuer Informatik, 2010.
[MW95] A. O. Mendelzon and P. T. Wood. Finding regular simple paths in graphdatabases. SIAM J. Comput., 24(6):1235–1258, 1995.
[Nil05] M. Nilsson. Regular Model Checking. PhD thesis, Uppsala Universitet,2005.
[Ome] Homepage Omega. http://www.cs.umd.edu/projects/omega/.
[Ong06] C.-H. L. Ong. On model-checking trees generated by higher-order recursion schemes. In LICS, pages 81–90. IEEE Computer Society, 2006.
[Pap81] C. H. Papadimitriou. On the complexity of integer programming. J. ACM,
28(4):765–768, 1981.

Bibliography

239[Pap94] C. H. Papadimitriou. Computational Complexity. Addison-Wesley, 1994.
[Par66] R. J. Parikh. On context-free languages. J. ACM, 13(4):570–581, 1966.
[Pél92] P. Péladeau. Logically defined subsets of Nk . Theor. Comput. Sci.,
93(2):169–183, 1992.
[PS98] C. H. Papadimitriou and K. Steiglitz. Combinatorial Optimization: Algorithms and Complexity. Dover Publications, 1998.
[PSW02] G. Pighizzini, J. Shallit, and M.-W. Wang. Unary context-free grammars
and pushdown automata, descriptional complexity and auxiliary spacelower bounds. J. Comput. Syst. Sci., 65(2):393–414, 2002.
[PT05] D. Peled and Y.-K. Tsay, editors. Automated Technology for Verification
and Analysis, Third International Symposium, ATVA 2005, Taipei, Taiwan, October 4-7, 2005, Proceedings, volume 3707 of Lecture Notes in
Computer Science. Springer, 2005.
[PV04] N. Piterman and M. Y. Vardi. Global model-checking of infinite-statesystems. In Alur and Peled [AP04], pages 387–400.
[Rab70] M. O. Rabin. Weakly definable relations and special automata. In Y. BarHillel, editor, Proc. Symp. Math. Logic and Foundations of Set Theory,
pages 1–23. North Holland, 1970.
[Rab07] A. Rabinovich. On compositionality and its limitations. ACM Trans.
Comput. Log., 8(1), 2007.
[Reh07] V. Rehak.

On Extensions of Process Rewrite Systems.

PhD thesis,

Masaryk University, 2007.
[Rub08] S. Rubin. Automata presenting structures: A survey of the finite stringcase. Bulletin of Symbolic Logic, 14(2):169–209, 2008.
[SC85] A. P. Sistla and E. M. Clarke. The complexity of propositional linear
temporal logics. J. ACM, 32(3):733–749, 1985.
[Sca84] B. Scarpellini. Complexity of subcases of Presburger arithmetic. Transactions of the American Mathematical Society, 284(1):203–218, 1984.

Bibliography

240[Sch02] Ph. Schnoebelen. The complexity of temporal logic model checking.
In P. Balbiani, N.-Y. Suzuki, F. Wolter, and M. Zakharyaschev, editors,
Advances in Modal Logic, pages 393–436. King’s College Publications,2002.
[Sem84] A. L. Semenov. Decidability of monadic theories. In M. Chytil and
V. Koubek, editors, MFCS, volume 176 of Lecture Notes in Computer
Science, pages 162–175. Springer, 1984.
[Ser06] O. Serre. Parity games played on transition graphs of one-counter processes. In L. Aceto and A. Ingólfsdóttir, editors, FoSSaCS, volume 3921
of Lecture Notes in Computer Science, pages 337–351. Springer, 2006.
[Sip97] M. Sipser. Introduction to the Theory of Computation. PWS Publishing
Company, 1997.
[SL10] C. Sánchez and M. Leucker. Regular linear temporal logic with past.
In G. Barthe and M. V. Hermenegildo, editors, VMCAI, volume 5944 of
Lecture Notes in Computer Science, pages 295–311. Springer, 2010.
[SM73] L. J. Stockmeyer and A. R. Meyer. Word problems requiring exponential
time: Preliminary report. In STOC, pages 1–9. ACM, 1973.
[SSM07] H. Seidl, Th. Schwentick, and A. Muscholl. Counting in trees. Texts in
Logic and Games, 2:575–612, 2007.
[SSMH04] H. Seidl, T. Schwentick, A. Muscholl, and P. Habermehl. Counting intrees for free. In J. Dı́az, J. Karhumäki, A. Lepistö, and D. Sannella, editors, ICALP, volume 3142 of Lecture Notes in Computer Science, pages
1136–1149. Springer, 2004.
[Sti98] C. Stirling. The joys of bisimulation. In L. Brim, J. Gruska, and J. Zlatuska, editors, MFCS, volume 1450 of Lecture Notes in Computer Science, pages 142–151. Springer, 1998.
[Sti01] C. Stirling. Modal and temporal properties of processes. Springer-Verlag
New York, Inc., New York, NY, USA, 2001.
[Sto74] L. J. Stockmeyer. The complexity of decision problems in automata theory and logic. PhD thesis, Department of Electrical Engineering, MIT,
1974.

Bibliography

241[SV00] H. Spakowski and J. Vogel. Theta2p-completeness: A classical approachfor new results. In Proc. of FST&TCS 2000, volume 1974 of LNCS, pages
348–360. Springer, 2000.
[Tho96] W. Thomas. Languages, automata, and logic. In Handbook of Formal
Languages, pages 389–455. Springer, 1996.
[Tho03] W. Thomas. Constructing infinite graphs with a decidable MSO-theory.
In B. Rovan and P. Vojtás, editors, MFCS, volume 2747 of Lecture Notes
in Computer Science, pages 113–124. Springer, 2003.
[TL08] A. W. To and L. Libkin. Recurrent reachability analysis in regular model
checking. In LPAR ’08: Proceedings of the 15th International Conference
on Logic for Programming, Artificial Intelligence, and Reasoning, pages
198–213, Berlin, Heidelberg, 2008. Springer-Verlag.
[TL10] A. W. To and L. Libkin. Algorithmic metatheorems for decidable LTL
model checking over infinite systems. In C.-H. Luke Ong, editor, FOSSACS, volume 6014 of Lecture Notes in Computer Science, pages 221–236. Springer, 2010.
[To09a] A. W. To. Model checking FO(R) over one-counter processes and beyond. In E. Grädel and R. Kahle, editors, CSL, volume 5771 of Lecture
Notes in Computer Science, pages 485–499. Springer, 2009.
[To09b] A. W. To. Unary finite automata vs. arithmetic progressions. Information
Processing Letters, 109(17):1010–1014, 2009.
[To10] A. W. To. Parikh images of regular languages: Complexity and applications. CoRR, abs/1002.1464, 2010.
[Var95] M. Y. Vardi. An automata-theoretic approach to linear temporal logic.
In F. Moller and G. M. Birtwistle, editors, Banff Higher Order Workshop, volume 1043 of Lecture Notes in Computer Science, pages 238–
266. Springer, 1995.
[Var01] M. Y. Vardi. Branching vs. linear time: Final showdown. In T. Margaria
and W. Yi, editors, TACAS, volume 2031 of Lecture Notes in Computer
Science, pages 1–22. Springer, 2001.

Bibliography

242[vD08] D. van Dalen. Logic and Structures. Springer, 4th edition, 2008.
[vLW01] J. H. van Lint and R. M. Wilson. A Course in Combinatorics. Cambridge
University Press, 2nd edition, 2001.
[VSS05] K. N. Verma, H. Seidl, and T. Schwentick. On the complexity of equational horn clauses. In R. Nieuwenhuis, editor, CADE, volume 3632 of
Lecture Notes in Computer Science, pages 337–352. Springer, 2005.
[VW86a] M. Y. Vardi and P. Wolper. An automata-theoretic approach to automatic
program verification (preliminary report). In LICS, pages 332–344. IEEE
Computer Society, 1986.
[VW86b] M. Y. Vardi and P. Wolper. Automata-theoretic techniques for modal
logics of programs. Journal of Computer and System Sciences, 32:183–
221, 1986.
[Wag87] K. W. Wagner. More complicated questions about maxima and minima,
and some closures of NP. Theor. Comput. Sci., 51(1-2):53–80, 1987.
[Wal96] I. Walukiewicz. Pushdown processes: Games and model checking. In
R. Alur and T. A. Henzinger, editors, CAV, volume 1102 of Lecture Notes
in Computer Science, pages 62–74. Springer, 1996.
[Wal00] I. Walukiewicz. Model checking CTL properties of pushdown systems.
In S. Kapoor and S. Prasad, editors, FSTTCS, volume 1974 of Lecture
Notes in Computer Science, pages 127–138. Springer, 2000.
[Wal01] I. Walukiewicz. Pushdown processes: Games and model-checking. Inf.
Comput., 164(2):234–263, 2001.
[Wal02] I. Walukiewicz.

Monadic second-order logic on tree-like structures.

Theor. Comput. Sci., 275(1-2):311–346, 2002.
[WB98] P. Wolper and B. Boigelot. Verifying systems with infinite but regularstate spaces. In Hu and Vardi [HV98], pages 88–97.
[WB00] P. Wolper and B. Boigelot. On the construction of automata from linear
arithmetic constraints. In Graf and Schwartzbach [GS00], pages 1–19.

Bibliography243[Wol00] P. Wolper. Constructing automata from temporal logic formulas: A tutorial. In E. Brinksma, H. Hermanns, and J.-P. Katoen, editors, European
Educational Forum: School on Formal Methods and Performance Analysis, volume 2090 of Lecture Notes in Computer Science, pages 261–277.
Springer, 2000.
[WT07] S. Wöhrle and W. Thomas. Model checking synchronized products ofinfinite transition systems. Logical Methods in Computer Science, 3(4),2007.
[Yen92] H.-C. Yen. A unified approach for deciding the existence of certain Petrinet paths. Inf. Comput., 96(1):119–137, 1992.
[YKB09] T. Yavuz-Kahveci and T. Bultan. Action Language Verifier: an infinitestate model checker for reactive software specifications. Formal Methods
in System Design, 35(3):325–367, 2009.
[YKBB05] T. Yavuz-Kahveci, C. Bartzis, and T. Bultan. Action Language Verifier,extended. In K. Etessami and S. K. Rajamani, editors, CAV, volume 3576
of Lecture Notes in Computer Science, pages 413–417. Springer, 2005.
[Zie07] G. M. Ziegler. Lectures on Polytopes. Springer, 2007.

Appendix A
Proofs from Chapter 4
A.1

Proposition 4.1.5 implies necessity in Lemma 4.1.4

We now complete the proof of necessity in Lemma 4.1.4 by inductively constructing
the desired sequences {αi }i∈N and {βi }i∈N by using Proposition 4.1.5 at every induction step. In the following, a sequence {ηi }i∈N of paths of A is said to be good if
η0 (0) = q0 and last(ηi ) = first(ηi+1 ) for all i ∈ N. In other words, the sequence ofpaths is good if they can be concatenated to form a run in A . The same notion cansimilarly be defined for sequences of paths of R . So, given a word v ∈ Σ∗ , supposethat v ∈ Rec։ (L (A )) = C HAIN (L (A ), L (R )).
Claim.

There exist two sequences {αi }i≥0 and {βi }i≥0 of words, a good sequence{ηi }i≥0 of paths of A , and a good sequence {θi }i≥0 of paths of R such that α0 = v,
η0 = q0 , θ0 = q′0 , and for all k ∈ N:
1. for all 0 < i ≤ k, |αi | > 0,
2. for all 0 ≤ i < k, |βi | = |αi |,3. for all 0 ≤ i ≤ k, πi := η0 ⊙ . . . ⊙ ηi is a run of A on β0 . . . βi−1 ,4. for all 0 ≤ i ≤ k, π′i := θ0 ⊙ . . . ⊙ θi is a run of R on (β0 ⊗ β0 ) . . . (βi−1 ⊗ βi−1 ),5. for all 0 < i ≤ k, A accepts αi from qi , where qi = last(πi ),6. for all 0 ≤ i < k, R accepts αi ⊗ βi αi+1 from q′i , where q′i = last(π′i ),′7. for all 0 ≤ i ≤ k, αi ∈ C HAIN (L (A qi ), L (R qi )), where qi = last(πi ) and q′i =last(π′i ).

245Appendix A. Proofs from Chapter 4

246

Observe that this claim immediately implies Lemma 4.1.4 as we may simply define
π = η0 ⊙ η1 ⊙ . . . and π′ = θ0 ⊙ θ1 ⊙ . . .. To prove this claim, we shall define thesefour sequences inductively. For each k ∈ N, we shall define four partial sequences{αi }0≤i≤k , {βi }0≤i<k , {ηi }0≤i≤k , and {θi }0≤i≤k satisfying the conditions in the claim.

We shall first deal with the base case k = 0. We define α0 = v, η0 = q0 , and θ0 = q′0 .

It is easy to see that statements (1),(2),(5), and (6) are vacuous. Statements (3)–(4)are also true because q0 (resp. q′0 ) is a run of A (resp. R ) on ε. Statement (7) is trueby assumption that v ∈ C HAIN (L (A ), L (R )). Assume now that k > 0 and the four
partial sequences have been defined satisfying the seven conditions in the claim for

all natural numbers up to k. We shall now extend these partial sequences by defining′

αk+1 , βk , ηk+1 , and θk+1 . By induction, we have αk ∈ C HAIN (L (A qk ), L (R qk )) andso Proposition 4.1.5 gives us a word v′ v′′ . We may set βk = v′ and αk+1 = v′′ . It is

immediate that condition (1) and (2) are satisfied. We define ηk+1 to be the prefix oflength |v′ | of the run ρ of A qk on v′ v′′ given by Proposition 4.1.5. We define θk+1′

to be the run ρ′ of R qk of length |v′ | given by Proposition 4.1.5. It is easy to see

now that condition (3)–(5) hold whenever i = k + 1 and condition (6) hold whenever′i = k. Proposition 4.1.5 also implies that αk+1 ∈ C HAIN (L (A qk+1 ), L (R qk+1 )), where
qk+1 := last(ρk+1 ) and q′k+1 := last(ρ′k+1 ). Finally, conditions (3)–(7) hold for othersmaller values of i by induction. This completes our proof for the claim and therefore
the proof of Lemma 4.1.4.

A.2

Proof of Lemma 4.2.2

Suppose that T1 = (D1 , τ1 ) and T2 = (D2 , τ2 ). Let us first prove existence. The context
tree T = (D, τ) is defined as follows. Let
D = (D1 ∩ D2 ) ∪ {vi ∈ D1 \ D2 : i ∈ ϒ, v ∈ D2 }.
In other words, the tree domain D contains all nodes that are both in D1 and D2 andadditionally the children of the nodes v ∈ D1 ∩ D2 with respect to the tree T1 but which
do not belong to D2 . The node labeling τ is defined as follows: for each v ∈ D1 ∩ D2 ,τ(v) := τ1 (v); for other nodes u1 , . . . , un ∈ D1 \ D2 , we assign τ(ui ) := xi . It is clear thatboth conditions are satisfied.

To prove uniqueness, consider another context tree T ′ = (D′ , τ′ ) satisfying the twoprescribed conditions. We shall now prove that T = T ′ up to relabeling of the context
leaves. We first show that D = D′ . To show D′ ⊆ D, observe that condition (2) implies

Appendix A. Proofs from Chapter 4247that D′ ⊆ D1 . Let v ∈ D′ . If v ∈ D2 , then we are done; otherwise, condition (1) implies
that v must be a context leaf in T ′ of the form ui for some u ∈ D2 and i ∈ ϒ. In any

case, we have v ∈ D.

Conversely, we also have D ⊆ D′ . To see this, observe that

D1 ∩ D2 ⊆ D′ ; for, otherwise, if u ∈ D1 ∩ D2 such that u ∈/ D′ and v is the longest prefixof u satisfying v ∈ D1 ∩ D2 ∩ D′ (which must exist since ε ∈ D′ ), both conditions imply
that v is a context leaf but then condition (1) implies that v ∈/ D2 , which results in acontradiction. Furthermore, each node vi ∈ D1 \ D2 such that i ∈ ϒ and v ∈ D2 must

be in D′ as a context leaf in T ′ by condition (2). Finally, we note that this proof also
implies that the context leaves of T are precisely the context leaves of T ′ . Therefore, τand τ′ coincide except when evaluated on the context leaves. This completes the proofof uniqueness.

A.3

Proof of Proposition 4.3.4

The proof is via a reduction from the nonemptiness problem for language intersectionsof DWAs, which is PSPACE-complete [GJ79]. More precisely, the problem is to decide
whether, given DWAs A1 , . . ., An over some alphabet Σ, the language L (A1 ) ∩ . . . ∩L (An ) is nonempty.

The proof is rather simple. From the input automata A1 , . . . , An , we construct a PDS
which simply guesses a word w ∈ Σ∗ which witnesses the intersection of the languages

L (A1 ), . . ., L (An ). More precisely, let P = (ACT, Γ, Q, δ) be the PDS defined as:• ACT = {α},• Γ = Σ ∪ {⊥},
• Q = {q1 , q2},

• δ = {((q1, α, a), (q1, ab)) : a ∈ Γ, b ∈ Σ} ∪ {(q, α, a), (q2, a)) : q ∈ Q, a ∈ Γ}.
For each Ai , let Bi be the DWA that recognizes the language {q2 ⊥ w : w ∈ L (Ai )}. It

is easy to see that each Bi can be constructed in polynomial time. Observe now that
/ iff q1 ⊥∈ Rec(L (B1 ), . . ., L (Bn )). This is because every infinite run
i=1 L (Ai ) 6= 0

Tnfrom q1 ⊥ in the transition system SP generated by P that visits L (B1 ), . . ., L (Bn)infinitely often must eventually self-loop at some configuration of the form q2 ⊥ w
for some word w ∈ Σ∗ . Conversely, the existence of a witness word w ∈Tn

i=1 L (Ai )implies the existence of a run in SP from q1 ⊥ which visits q2 ⊥ w, which then self-loops forever.

Appendix A. Proofs from Chapter 4

A.4

248

Proof of Proposition 4.3.7

The proof is via a reduction from the nonemptiness problem for language intersectionsof NTAs, which is EXP-complete [CDG+ 07]. More precisely, the problem is to decide
whether, given NTAs A1 , . . . , An over T REE 2 (Σ), the language L (A1 ) ∩ . . . ∩ L (An ) isnonempty.

The polynomial-time reduction is very similar to the proof of Proposition 4.3.4,
and hence we shall only sketch it. We shall construct a GTRS P over T REE 2 (Σ′ ),where Σ′ is the union of Σ with a set containing a special “guessing” node label q1 ,and a special “sink” node label q2 . The GTRS P will start at a tree with only a single
node labeled q1 , and “guesses” a tree T that witnesses nonemptiness of the language
intersection problem. At any given point, each leaf will either be labeled q1 or q2 . We
will also have rules of the form q1 → q2 and q2 → q2 . The input NTAs A1 , . . . , Anwill be slightly modified by attaching leaf nodes labeled q2 to the leaves of each tree
recognized by these automata. The rest is identical to the proof of Proposition 4.3.4.

Appendix B
Proofs from Chapter 5
B.1

Proof of Proposition 5.4.6

We show that model checking the negations of LTLdet formulas over GTRS is NPhard. Our reduction is from the problem HAMPATH of testing whether there exists
a hamiltonian path in a directed graph. Suppose the input is a graph G = (V, E) withvertices V = {1, . . ., n} and edges E ⊆ V ×V . Node labels for our trees in the output

GTRS P will draw from the set Σ := {X , root, eval} ∪ {1, . . ., n}. The initial tree t0 to
be evaluated against the input LTLdet formula is the tree drawn in Figure B.1. We haveaction labels ACT := {1, . . . , n} ∪ {eval, f in}. We now describe the transition rule of

P . For each i ∈ {1, . . ., n}, we have a rule X →i i. For each directed edge (u, v) ∈ E, wehave a transition rule eval(u, v) →eval u, where eval(u, v) is a notation for the tree withthree nodes with root labeled eval, left child labeled u, and right child labeled v. For

each i ∈ {1, . . ., n}, we also have a transition rule root(i) → f in root(i), where root(i)is the tree with two nodes with root labeled root and only child labeled i. Let ϕeval be
the formulaeval ∧ X(eval ∧ X(eval . . . ∧ X(eval ∧ f in)))where the number of eval n − 1. Let ϕ be the formula
1 ∧ X(2 . . . ∧ X(n ∧ Xϕeval )).
Claim B.1.1 (Λ(P ),t0) 6|= ¬ϕ iff G has a hamiltonian path.

It is not hard to see that the claim is true. A hamiltonian path π := i1 , i2 , . . . , in in G willcorrespond to the tree tπ where the jth leaf is “evaluated” as i j , and vice versa.

249

Appendix B. Proofs from Chapter 5

250

root

eval
X

eval
X

eval

X

eval
X

Figure B.1: The initial tree t0 with n leaf nodes.

Finally, it is not hard to see that the negation of ϕ is an LTLdet formula (and canbe computed in poly-time). To show this, it suffices to show that the negation ofψ := p ∧ X(ϕ) is an LTLdet formula, provided that ¬ϕ is an LTLdet formula. In fact, if

p ∈ ACT, the formula ψ is equivalent to p ∧ (¬p ∨ X(ϕ)), and hence ¬ψ is equivalentto ¬p ∨ (p ∧ X(¬ϕ)) which is an LTLdet (since ¬ϕ is an LTLdet formula).

Appendix C
Proofs from Chapter 7
C.1

Proof of Fact 7.3.3

The proof is by induction on the length |π| of the path π. Whenever |π| = 0 (it contains
only a single state), we may then take π′ = π and set h = 0. Then, we have P (π) =P (π′ ) + ∑hi=1 P (Ci ). Suppose that Fact 7.3.3 holds for all paths up to length k − 1 ≥ 0.

We shall now show that it also holds for all paths of length k. Let π be a path oflength k. If π is simple, then we may set π′ := π and h := 0, and the proof is complete.
Therefore, assume that π is not simple and let π = p0 . . . pk , where p0 = q and pk = q′ .
Let i ≥ 0 be any index such that the state pi appears in π more than once, say, at pi andp j . Then, consider the path

π1 := p0 p1 . . . pi−1 pi p j+1 p j+2 . . . pk
of length strictly smaller than k that is obtained by removing the segment π[i + 1, j]from π. We will now apply the induction hypothesis twice. Firstly, applying the induction hypothesis on the path π1 , we obtain a simple path π′ and finitely many simple
cycles C1 , . . .,Ch possibly with duplicates such thath

P (π1 ) = P (π ) + ∑ P (Ci ).
′i=1

We now apply the induction hypothesis again on the path π[i + 1, j] from pi to p j thatis of length smaller than k yielding a simple path pi of length 0 (since pi = p j ) andfinitely many simple cycles C1′ , . . . ,Cr′ such that
r

r

i=1

i=1

P (π[i + 1, j]) = P (pi ) + ∑ P (Ci′ ) = ∑ P (Ci′ ).
251

Appendix C. Proofs from Chapter 7

252

This clearly implies that
h

r

i=1

j=1

P (π) = P (π′ ) + ∑ P (Ci ) + ∑ P (C′j ),which extends the validity of Fact 7.3.3 to value k. Therefore, by mathematical induction, Fact 7.3.3 holds for all values of k, which completes the proof.

C.2

Proof of Lemma 7.3.5

We only show that if the Mv [ j, h] = 1, then so is the ( j, h)-component of the matrix
on the r.h.s. The converse can be proved by observing that all the steps below can beeasily reversed.
Let s = 1 + Σki=1 ri . Suppose that π = ql0 b1 ql1 . . . bs qls is a path from q j to qh with

P (π) = v. Thus, we have l0 = j and ls = h. We now decompose π as follows. Let t be
the first position where the letter ai occurs in π, i.e., bt = ai and bt ′ 6= ai for all t ′ < t.

Let π1 := ql0 b1 . . . qlt−1 , π2 := qlt−1 bt qlt , and π3 := qlt bt+1 . . . qls . Let u := P (π1 ) andw := P (π3 ). Notice that the ith entry of u is 0 and w = v − ei − u. Furthermore, wehave Mu [ j, lt−1] = Mei [lt−1 , lt ] = Mw [lt , h] = 1. It follows that the ( j, h)-component of
the matrix Mu • Mei • Mw is 1.

C.3

Proof of Lemma 7.3.6

This can be done using Lemma 7.3.5 and dynamic programming. The algorithm has
n + 1 stages. At stage j = 0, . . . , n, we compute all Mv where the components in v sum
up to j. These will be saved in the memory for subsequent stages of the iteration. Asbase cases, we would obtain M0 and Mei , for each 1 ≤ i ≤ k, directly from the input.
Notice that boolean matrix multiplication can be done in O(n3 ) and so each stage ofthe computation can be performed in O(n2k+4 ). Thus, the entire computation runs intime 2O(k log n) .

C.4

Proof of Proposition 7.3.10

The automaton An = (Σn , Qn , δn , q0 , qF ), where
Qn = {q0 , qF } ∪ {p0 , . . . , pn } ∪ {p′1 , . . . , p′n },Σn = {a, b, c} ∪ {ai , a′i : 1 ≤ i ≤ n}.

Appendix C. Proofs from Chapter 7

253

a′n
an
p′n

pn

a′2
a2
p′2

p2
a′1
a
p1 a1
a
q0

p′1

c

c

p0
b

c

qF
b

Figure C.1: A depiction of the DWA An

We specify the transition function δn in Figure C.1. Notice that An has an equivalent
regular expression en of size O(n). For example, when n = 2, we can define en to beb(a(a1 (a′1 )∗ c|aa2 (a′2 )∗ c))∗ b.
We now argue that the a-component of some vi must be at least n(n + 1)/2. Let mbe the maximum entry over all vectors in ri=1 Si . Define
n(n + 1)
m + 1.
N := max{|Si | : 1 ≤ i ≤ r}
2
S

For each 1 ≤ i ≤ n, let Ci be the cycle p0 ap1 a . . . pi ai p′i (a′i p′i )N cp0 . Consider the ac-

cepting path π = (q0 bp0 ) ⊙C1 ⊙C2 ⊙ · · · ⊙Cn ⊙ (p0 bqF ). We have P (π) ∈ P(vh ; Sh )for some 1 ≤ h ≤ r. Observe also that a occurs precisely Σni=1 i = n(n + 1)/2 times inπ.

Claim C.4.1 Each a′i -component of vh (1 ≤ i ≤ n) is nonzero.
We now prove this claim. Let Sh = {u1 , . . . , us } and P (π) = vh + Σsi=1ti ui . For

each i ∈ {1, . . ., n}, there exists a vector u ji with a positive a′j -component and t ji >n(n+1)
2 m < N, acontradiction. In particular, this implies that all α-component of u ji , where α 6= a′i forn(n + 1)/2; for, otherwise, the a′j -component of P (π) is at most |Sh|

Appendix C. Proofs from Chapter 7

254

all i ∈ {1, . . ., n}, is 0 as each such letter α occurs at most n(n + 1)/2 times in π. But

this means that each ai -component of vh is nonzero; for, otherwise, we could consider
the vector vh + u ji which would not correspond to any accepting path in An since atleast one letter ai needs to read by An if a′i is to occur in the path. This proves ourclaim.
Now consider each word w = w0 . . . wl ∈ L (An ) such that P (w) = vh . It is easy to

see that the number of occurences of a in w must be at least n(n + 1)/2. In fact, forevery 1 ≤ i ≤ n, define ji = min{ j : w j = ai }. For each i, the number of occurences of

a in wt . . . w ji , where t = max{ ji′ : ji′ < ji , 1 ≤ i′ ≤ n}, is at least i. The lower bound ofn(n + 1)/2 on the number of occurences of a in w immediately follows.

C.5

Proof of Proposition 7.4.2

DWA

We now give a poly-time reduction from the hamiltonian path problem to membershipproblem for Parikh images of DWAs. The hamiltonian path problem asks whether agiven graph G = hV = {v1 , . . . , vn }, Ei has a hamiltonian path from v1 to vn , i.e., apath from v1 to vn in G that visits each vertex in V exactly once. Given G, we define
the DWA AG = (Σ, Q, δ, q0, qF ) where Q := V , Σ := {a1 , . . . , an }, q0 := v1 , qF := vn ,and δ := {(vi , a j , v j ) : (vi , v j ) ∈ E}. Then, it is easy to see that G has a hamiltonian

path from v1 to vn iff the Parikh image P (a1 . . . an ) of the word a1 . . . an is in P (AG ) iff(0, 1, 1, . . ., 1) ∈ P (AG ). This completes the proof of NP-hardness of the membershipproblem for Parikh images of DWAs with unbounded alphabet size.
Regular expressions

One-in-three 3SAT is the following problem: given a boolean formula ϕ in 3-CNF,
does there exist a satisfying assignment for ϕ that additionally makes no more than
one literal true for each clause. We shall call such an satisfying assignment 1-in-3.
This problem is NP-complete (cf. see [GJ79]). We shall reduce this problem to themembership problem for Parikh images of regular expressions. Given ϕ = C1 ∧. . .∧Ck ,where Ci is a multiset over L := {x1 , ¬x1 . . . , xn , ¬xn } with |Ci | = 3, we define a function
f : L → {1, . . ., k}∗ as follows:• f (xi ) := a1 . . . ak where ai := i if xi ∈ C j , and ai := ε otherwise.

Appendix C. Proofs from Chapter 7255• f (¬xi ) := a1 . . . ak where ai := i if ¬xi ∈ C j , and ai := ε otherwise.
That is, the function f associates a literal with the indices of clauses that are satisfied
when the value 1 is assigned to the literal. The corresponding regular expression over
Σ = {1, . . ., k} iseϕ = ( f (x1 )| f (¬x1 )) . . . ( f (xn )| f (¬xn )).

Let 1 ∈ {1}k . We claim that ϕ is a positive instance of one-in-three 3SAT iff 1 ∈P (L (eϕ )). To prove this, suppose that ϕ is a positive instance with a 1-in-3 satisfying
assignment σ : L → {0, 1} (i.e. σ(xi ) = 1 iff σ(¬xi ) = 0). Consider the word w :=X1 . . . Xn ∈ Σ∗ , where

Xi :=

(

f (xi )

if σ(xi ) = 1,f (¬xi )if σ(xi ) = 0.

Observe that w ∈ L (eϕ). Since σ is a 1-in-3 satisfying assignment, it follows that

P (w) = 1 and, therefore, we have 1 ∈ P (L (eϕ )). The converse direction can be provedby reversing the above construction of the word w. Finally, observe that the construction of eϕ and 1 can be done in time polynomial in the size of ϕ.

C.6

Proof of Proposition 7.5.7

This result is almost immediate from the undecidability of the emptiness problem fordeterministic 0-reversal 3-counter systems that may test equality of the current valuesof two counters [ISD+ 02]. More precisely, such a counter system is of the form M =(ACT, X , Q, ∆) with X = {x, y, z} and instructions ((q, ϕ(X )), a, (q′, i1 , . . . , ik )) of theform:• for each j ≥ 1, i j ≥ 0, and• ϕ(X ) is the (guard) Presburger formula z ∼ x or z ∼ y, where ∼ is either = or 6=.
The semantics is similar to the usual notion of counter systems. For example, if the
instruction has a guard formula z = x, the machine simply tests whether the current
values held by these variables coincide and then the instructions can be executed if thetest was successful. The emptiness problem corresponds to the problem of deciding
whether the configuration (q0 , 0, 0, 0) of M , where q0 ∈ Q is a designated initial stateof M , may reach a designated final state qF ∈ Q.

We now give the reduction. On an input counter system M of the above form, ournew counter system M ′ = (ACT′ , X , Q′, ∆′ ) will be 1-reversal and not have comparison

Appendix C. Proofs from Chapter 7

256

tests between the values of two different counters. Intuitively, when simulating an
instruction in M of the form ((q, α ∼ β), a, (q′, i1 , i2 , i3 )), the new counter system M ′will move from the state q to the intermediate state (q, α ∼ β) and then move to thestate q′ while modifying the counters using i1 , i2 , i3 and ignoring the test α ∼ β. Our

CTL formula will later take care of the test α ∼ β using one extra reversal. Moreprecisely, the new counter system M ′ = (ACT′ , X , Q′, ∆′ ) is defined as follows:• ACT′ = {⋆, ⊖, success},• X = {x, y, z},• Q′ is a union of Q, {(q, ϕ(X )) : q ∈ Q, and ϕ is a guard formula in M }, and{(test, ϕ(X )) : ϕ is a guard formula in M }, where test is a new state (i.e. does
not occur in Q), and• ∆′ contains instructions of the form:– ((qF , ⊤), success, (qF , 0, 0, 0)).

– ((q, ⊤), ⊖, ((q, ϕ), 0, 0, 0)), if there is an instruction in M of the form((q, ϕ), a, (q′, i1 , i2 , i3)).
– (((q, ϕ), ⊤), ⊖, (q′, i1 , i2 , i3 )), if there is an instruction in M of the form((q, ϕ), a, (q′, i1 , i2 , i3 )).

– (((q, ϕ), ⊤), ⊖, ((test, ϕ), 0, 0, 0)).

– (test, α ∼ β) may loop on the same state with the action ⊖ while decrementing α and β by 1.

– (test, α = β) may test whether α = 0 and β = 0 and loop on the same statewith the action ⋆ without modifying the counters.
– (test, α ∼ β) may test whether α = 0 and β > 0 (or α > 0 and β = 0) andloop on the same state with the action ⋆ without modifying the counters.

The desired CTL formula isθ = E(h⊖i((test, ϕ) → EF⋆) U success),_ϕwhere ϕ is either x ∼ z or y ∼ z, where ∼ is either = or 6=. The formula makes sure thateach guess made by the counter system regarding the comparison tests between valuesof counters is correct. It is easy to check that SM ′ , (q, 0, 0, 0) |= θ iff hM , q0 , qF i is apositive instance of the original problem. This completes the reduction.

Appendix D
Proofs from Chapter 8
D.1

Proof of Lemma 8.2.2

Let α = (αi )i∈[l] be an extended MMA formula.

Define the set of (possibly) in-

voked pairs P ⊆ [l] × Z to be the set {(i, j) : i ∈ [l], j ∈ [−l + i, l − i]} ⊆ [l] × [−l, l].
Now associate the set P with the usual lexicographic ordering ≺Z×Z for Z × Z (i.e.

(x, y) ≺Z×Z (x′ , y′ ) iff (1) x < x′ , or x = x′ and y < y′ ). We will now construct a MMA
formulaβ = (β(i,d))(i,d)∈P
such that[[β(i,d)]] = {x ∈ N | x + d ≥ 0 ∧ x + d ∈ [[αi ]]} (∗)
for each (i, d) ∈ P.

Recall that we identify a dag ([l], ≺α) with α and its corresponding strict partial

order ≺+
α . In the following, we will give the definition of β(i,d) and directly prove that

equation (∗) holds, for each (i, d) ∈ P by induction on i with respect to ≺+α . The lemma(∗)

will follow from the latter, since we will have [[α]] = [[αl ]] = [[β(l,0)]] = [[β]].

For convenience, we will allow formulas of the form ∼ −k for positive integer k.

Such formulas, which are strictly speaking not MMA formulas by definition, serve
only as abbreviations. In particular, we can replace abbreviation ≤ −k by ¬(≥ 0) (notsatisfied by all k ∈ N) and ≥ −k by the formula ≥ 0 (satisfied by all k ∈ N). For the

induction base, assume i is minimal with respect to ≺+α . Take any d ∈ [−l, l] satisfying(i, d) ∈ P.

• In case αi = (≡ m mod n) for some m, n ∈ N. Let ν = (m − d) mod n. Then,257

Appendix D. Proofs from Chapter 8258

we putβ(i,d) = (≥ −d) ∧ (≡ ν mod n).
It is obvious to see that equation (∗) holds for (i, d).
• In case αi = (∼ n), where ∼∈ {≤, ≥} and where n ∈ N. Define the integerν = n − d. Then we put

β(i,d) = (≥ −d) ∧ (∼ ν).
Again, it is obvious to see that equation (∗) holds (i, d).
For the induction step, assume i is not minimal with respect to ≺+α . Take any

number d ∈ [−l, l] satisfying (i, d) ∈ P. Again, we make a case distinction according

to αi .

• Assume αi = ¬α j for some j ∈ [i − 1]. Then, we put
β(i,d) = (≥ −d) ∧ (¬β( j,d)).
Observe that this is possible, since ( j, d) ∈ P. By induction hypothesis, we have[[β( j,d)]] = {x ∈ N | x + d ≥ 0 ∧ x + d ∈ [[α j ]]}.
Hence,[[¬β( j,d) ]] = {x ∈ N | x + d < 0 ∨ x + d 6∈ [[α j ]]}which equals{x ∈ N | x + d < 0 ∨ x + d ∈ [[αi ]]}.
The latter and the definition of β(i,d) yields that [[β(i,d)]] equals{x ∈ N | x + d ≥ 0 ∧ (x + d < 0 ∨ x + d ∈ [[αi ]])}.
which equals{x ∈ N | x + d ≥ 0 ∧ x + d ∈ [[αi ]]}.
delivering (∗) for (i, d) as required.
• Assume αi = α j ∧ αk for some j, k ∈ [i − 1]. Then we put
β(i,d) = β( j,d) ∧ β(k,d) .
Again, this is possible, since ( j, d), (k, d) ∈ P. That equation (∗) holds for (i, d)follows directly from induction hypothesis.

Appendix D. Proofs from Chapter 8259• Assume αi = n ∼ min α j for some ∼∈ {≤, ≥}, j ∈ [i − 1], and n ∈ N. Then, we
put

β(i,d) = (≥ −d) ∧ n ∼ min β( j,0) .
Then, (∗) is immediate by induction hypothesis.
• Assume αi = n ∼ max(α j , n′ ) for some ∼∈ {≤, ≥}, j ∈ [i − 1], and n, n′ ∈ N.
Then, we put

β(i,d) = (≥ −d) ∧ n ∼ max(β( j,0), n′ ).
Then, (∗) is immediate by induction hypothesis.
• Assume αi =∼ min α j for some ∼∈ {≤, ≥} and for some j ∈ [i − 1]. Then weput β(i,d) as(≥ −d ∧ d > min β( j,0) ∧ ∼ −1) ∨(≥ −d ∧ d ≤ min β( j,0) ∧ ∼ min β( j,d) ).
To see why this definition is correct, we first inspect the right hand side of theequation (∗). Observe that for all k ∈ N, we have k + d ∼ [[α j ]] and k + d ≥ 0 iff

either of the following two statements hold: (1) k + d ≥ 0, d > [[α j ]] and k ∼ −1,or (2) k + d ≥ 0, d ≤ [[α j ]], and k ∼ min[[α j ]] − d. This is clearly because for allk ∈ N and a negative integer k′ we have k ∼ −1 iff k ∼ k′ . Our definition of β(i,d)
now implies that [[β(i,d)]] is a union of the set{k ∈ N : k + d ≥ 0 ∧ d > min[[β( j,0)]] ∧ x ∼ −1}
and the set of all k ∈ N such thatk + d ≥ 0 ∧ d ≤ min[[β( j,0)]] ∧ k ∼ min[[β( j,d)]].
By induction, we may assume that[[β( j,d)]] = {k ∈ N : k + d ≥ 0 ∧ k + d ∈ [[α j ]]}.
Similarly, by induction, we have [[β( j,0)]] = [[α j ]]. Furthermore, we havemin[[α j ]] − d = min{k − d ∈ Z : k ∈ [[α j ]]}= min{k ∈ Z : k + d ∈ [[α j ]]}.
These imply that min[[α j ]] − d = [[β( j,d)]] if min[[α j ]] ≥ d. That (∗) holds is then

immediate.

Appendix D. Proofs from Chapter 8260• αi =∼ max(α j , c) for some ∼∈ {≤, ≥}, j ∈ [i − 1], and a constant c ∈ N. Then,letting ν = c − d, we put β(i,d) as(≥ −d ∧ d > max(β( j,0), c)∧ ∼ −1) ∨(≥ −d ∧ d ≤ max(β( j,0), c)∧ ∼ max(β( j,d), ν).
The proof is identical to the previous case.
• Assume αi = α j − 1 for some j ∈ [i − 1]. Then we put
β(i,d) = β( j,d+1) .
Notice that ( j, d + 1) ∈ P since j < i and (i, d) ∈ P. By induction hypothesis,[[β( j,d+1)]] equals{x ∈ N | x + d + 1 ≥ 0 ∧ x + d + 1 ∈ [[α j ]]}.
which is equivalent to{x ∈ N | x + d + 1 ≥ 0 ∧ x + d ∈ [[α j − 1]]}.
It follows now that [[β(i,d)]] equals{x ∈ N | x + d ≥ 0 ∧ x + d ∈ [[αi ]]}.
and thus (∗) follows for (i, d).
• Assume αi = α j + 1 for some j ∈ [i − 1]. We put
β(i,d) = (≥ −d) ∧ β( j,d−1) .
Notice that ( j, d − 1) ∈ P since j < i and (i, d) ∈ P. By induction hypothesis wehave that [[β( j,d−1)]] is{x ∈ N | x + d − 1 ≥ 0 ∧ x + d − 1 ∈ [[α j ]]}.
By definition of β(i,d) we have that[[β(i,d)]] = {x ∈ N | x + d ≥ 0 ∧ x ∈ [[β( j,d−1)]]}
which hence equals{x ∈ N | x + d ≥ 0 ∧ x + d ≥ 1 ∧ x + d − 1 ∈ [[α j ]]}which equals{x ∈ N | x + d ≥ 0 ∧ x + d ∈ [[αi + 1]]}delivering (∗) for (i, d) as required. 2

Appendix D. Proofs from Chapter 8

D.2

261

Proof of Lemma 8.3.1(1) ⇒ (2): Follows trivially since P ′ is obtained from P by adding λ-transitions.

(2) ⇒ (3): Let π = s1 →P ′ s2 · · · →P ′ sk be a path in S′P . Formally, we call π normalized if

s 1 ↓ P ′ · · · ↓P ′ s i ↑ P ′ · · · ↑P ′ s k
for some i ∈ [k]. We claim that every shortest path from s to t is normalized. To prove
the implication, assume, by contradiction, that there is a shortest path π = (q1 , n1 ) →P ′(q2 , n2 ) · · · →P ′ (qk , nk ) with s = (q1 , n1 ) and t = (qk , nk ) that is not normalized. Then
there exists a subpath ρ(qi , ni ) ↑P ′ (qi+1 , ni+1 ) ↑P ′ · · · ↑P ′ (q j , n j ) ↓P ′ (q j+1 , n j+1 )in π such that ni+1 = ni+2 = · · · = n j and ni = n j+1 = n j + 1. If, on the one handi + 1 = j, then by rule (R2), it follows that (qi , ni ) →P ′ (q j+1, n j+1 ) by which ρ canbe replaced, contradicting the minimality of |π|. On the other hand, if i + 1 < j, thenby successively applying rules (R1) and (R4), we obtain that (qi+1 , ni+1) →P ′ (q j , n j ).

Finally, by applying rule (R3), we obtain that (qi , ni ) →P ′ (q j+1 , n j+1 ) by which ρ canbe replaced, contradicting the minimality of |π|.

(3) ⇒ (1): We prove that (q, n) →P ′ (q′ , n) for some q, q′ ∈ Q implies the existenceof a mountain path from (q, n) to (q′ , n) in SP . For proving the implication, this issufficient since δ′0 (resp. δ′>0 ) only differs from δ0 (resp. δ>0 ) by adding transitionsof the kind (q, λ, q′, 0). So let n ∈ N be arbitrary and let δ′ = δ′0 (resp. δ = δ0 ) if

n = 0 and δ′ = δ′>0 (resp. δ = δ>0 ) if n > 0. We show that (q, λ, q′, 0) ∈ δ′ implies theexistence of a mountain path from (q, n) to (q′ , n) in SP by induction on the height hof the shortest proof tree for applying the rules (R1) to (R4) to deduce (q, λ, q′, 0) ∈ δ′ .

For the induction base, assume h = 1. Then, there are two cases. Firstly, in case
we applied rule (R1), we have (q, a, q′, 0) ∈ δ and thus clearly (q, n) →P (q′ , n) is a
mountain path. Secondly, in case we applied rule (R2), we have (q, a1, q1 , +1) ∈ δand (q1 , a2 , q′ , −1) ∈ δ>0 for some q1 ∈ Q and some a1 , a2 ∈ ACT. Hence (q, n) →P(q, n + 1) →P (q, n) is a mountain path in SP . For the induction step, firstly assume
some shortest proof tree of height h > 1 witnessing (q, λ, q′, 0) ∈ δ′ has rule (R3) at its

root. Then (q, a1, q1 , +1) ∈ δ,(q1 , λ, q2 , 0) ∈ δ′>0 , and (q2 , a2 , q′ , −1) ∈ δ>0 for some

q1 , q2 ∈ Q and some a1 , a2 ∈ ACT. By induction hypothesis, there exists a mountainpath from (q1 , n + 1) to (q2 , n + 1) in SP . Thus, in SP , we have a mountain path of
the kind(q, n) →a1 (q1 , n + 1) →P (q2 , n + 1) →a2 (q′ , n).

Appendix D. Proofs from Chapter 8

262

Secondly, assume that some shortest proof tree witnessing (q, λ, q′, 0) ∈ δ′ has rule (R4)

at its root. Then (q, λ, q1, 0) ∈ δ′ and (q1, λ, q′ , 0) ∈ δ′ for some q1 ∈ Q. By induction

hypothesis, there is a mountain path from (q, n) to (q1 , n) and from (q1 , n) to (q′ , n) in
SP . Hence, there is a mountain path from (q, n) to (q′ , n) in SP .

D.3

Proof of Lemma 8.3.3>0
By definition, ∇(q1 , q2 ) equals the minimal d +1 such that d ∈ ∆>0↓ (q1 , q3 )∩∆↑ (q3 , q2 )for some q3 ∈ Q. By applying Lemma 8.3.2, we compute in polynomial time for eachq3 ∈ Q the two unions arithmetic progressions {ai + bi N | i ∈ [k]} (resp.
SS{ci + di N |>0
i ∈ [l]}) that equal ∆>0↓ (q1 , q3 ) and (resp. ∆↑ (q3 , q2 )), where moreover with k, l ∈O(|Q|2), ai , c j ∈ O(|Q|2 ), and bi , d j ∈ O(|Q|) for each i ∈ [k] and each j ∈ [l]. Definea = max{ai | i ∈ [k]}, b = max{bi | i ∈ [k]}, c = max{ci | i ∈ [l]}, and d = max{di | i ∈[l]}. Thus, for each q3 , it boils down to computingmin[{ai + bi N | i ∈ [k]} ∩[{ci + di N | i ∈ [l]}which is easy, since it either equals ∞ or it is less than or equal tomax{a, c} + b · d
and hence is bounded by O(|Q|2).

D.4

Proof of Theorem 8.4.3

We shall now prove that, for every fixed one-counter process P = (Q, δ0 , δ>0 ), thefollowing problem is in P: given a state (q, n) ∈ Q × N, where n is given in binary andan EF dag-formula ϕ, decide whether (SP , (q, n)) |= ϕ.

Assume Q = {q1 , . . ., qk } and ϕ = (ϕi )i∈[l] . We directly refer to the translation pre-sented earlier in this section that allows us to compute in polynomial time an extended
MMA dag-formula α = (α(i, j))i∈[k]×[l] such that [[α(i, j)]] = {n ∈ N | (SP , (qi , n)) |=ϕ j }. Note that in our translation, we liberately allowed the definitions α(i, j) to becomplex. It is straightforward to see that we can compute an equivalent formula β =(βi )i∈[r] , where the definitions βi are not complex along with a mapping ϕ : [k] × [l] →[r] such that [[α(i, j)]] = [[βϕ(i, j)]] for each (i, j) ∈ [k] × [l]. Firstly, let us estimate r. For

this, we look at the translation from P and ϕ to α more carefully. It will suffice toestimate the definitions α(i, j) when ϕ j = EFϕ j′ for some j′ ∈ [ j − 1]. A simple analysis

Appendix D. Proofs from Chapter 8263

shows that rewriting the complex definition α(i, j) in terms of non-complex definitions
requires an extended MMA formula of length (not size) at most the product of thefollowing• O(k) (disjunction over all i′ ∈ k),• O(k) (disjunction over all q′′ ∈ Q for each βs (i, i′ ), s = 1, 2, 3), and• O(k3 ) (disjunction over all arithmetic progressions in ∆-sets determined eitherby (qi , q′′ ) or by (q′′ , qi′ ) with offsets bounded by O(k2 ) and periods bounded byO(k).
Since there are k · l such pairs (i, j), we obtain that r ∈ O(l · k6). One can easily observefrom the translation that all natural numbers n such that either x ≡ m mod n or x ∼ noccurs in any definition of β is bounded by O(k2 ), since it is at most n∇ plus the
maximal offset of any arithmetic progression that appears in any of the ∆-sets. Since
k is fixed, we obtain that Li is a constant for each i ∈ [r]. Similarly, one verifies thatthe largest offset that occurs in β, that we denote by kβ , is also constantly bounded byO(k2 ), since it is less than or equal to the maximal offset of any arithmetic progressionthat appears in any of the ∆-sets. Hence there is some constant c = c(P ) such that,by Lemma 8.2.1, we can compute in polynomial time a threshold ti ≤ i · c + νi and a

period pi ≤ c such that for all n1 , n2 > ti the following implication holds
n1 ≡ n2 mod pi ⇒ (n1 ∈ [[βi ]] ⇔ n2 ∈ [[βi ]])for each i ∈ [r]. Next, we aim at estimating ti for each i ∈ [r]. A precise analysis of

the definition of α shows that any constant that will occur in any definition in βi is lessthan or equal to c plus the maximal periodicity p j of any β j with j ∈ [i − 1]. Hence wehaveνi ≤ max{t j + c | j ∈ [i − 1]}andt i ≤ i · c + νi .
We claim that ti ≤ i2 · c by induction on i. For the induction base, i.e. i = 1, observe

Appendix D. Proofs from Chapter 8

264

that ti = 0 since α1 = ⊤. For the induction step, assume i ≥ 2. Then, we havet i ≤ i · c + νi
= i · c + max{t j + c | j ∈ [i − 1]}≤ i · c + (i − 1)2 · c + c(by induction hypothesis)= (i + i2 − 2i + 2) · c≤ i2 · c

The latter inequality holds since i ≥ 2. Hence, since i ∈ [r] and r ∈ O(l · k6 ), we

have ti ∈ O(l 2 ) and thus ti ∈ O(|ϕ|2 ). Thus, logarithmically many bits in |ϕ| suffice

to represent the periods ti . Moreover, recall that each period pi is at most c. It is
now straightforward to construct an alternating logspace Turing machine that checks
if (SP , (q, n0)) |= ϕ.

D.5

Proof of Proposition 8.6.2

We will reduce DSAT to the weak-bisimulation checking problem. Without loss ofgenerality, we assume that each Fi is in 3-CNF and every assignment makes at least
one clause of Fi true (this can be done by adding the clause (x ∨ ¬x) for some newvariable x). Furthermore, we assume that each Fi is not a tautology (this actually meansthat some clauses of Fi do not contain two contradicting literals). We also assume that

all the formulas Fi s have the same number of clauses; this can be done by duplicating
clauses.
We are given an instance F1 , . . . , Fn of DSAT with variables x1 , . . . , xn and set Z ={y1 , . . . , ym′ } of variables such that Fi take only variables in {x1 , . . . , xi−1 } ∪ Z. Supposethat Fi = C1i ∧ . . . ∧ Cmi , where Cij = (l ij,1 ∨ l ij,2 ∨ l ij,3 ) such that l ij,1 , l ij,2, l ij,3 are literals

over the variables {x1 , . . ., xn } ∪ Z. As we will use Gödel encoding technique, for each

integer l > 0 let us define a function νl mapping boolean formulas over the variables{x1 , . . . , xn } ∪ Z to {⊤, ⊥}. If G(l) = j1 j2 . . ., then define νl (ϕ) to be the truth value
obtained by replacing yi by ji and xi by σ(xi ). It is easy to see that each σ(xi ) = 1 iff

there exists an integer l > 0 such that νl (Fi ) = ⊤.

The one-counter net and the finite system that we will construct will use the action

symbols a, b, c, d, x1 , x1 , . . . , xm , xm , τ. Note that we abuse variable names xi to also referto action symbols; however, the meaning is clear from the context. In the following,a finite system G = (S, {→a: a ∈ ACT}) is also abbreviated as a tuple (S, δG ), whereAppendix D. Proofs from Chapter 8265qδG (q, a)qδG (q, b)qδG (q, d)

P1{A, A}A{C}

C{T, T , Xi , Xi : 1 ≤ i ≤ n}

P2

{A}

A

{C,C}

C

{T , Xi , Xi : 1 ≤ i ≤ n}

Table D.1: Definition of δG on input a, b, d

δG : S × ACT → 2S is a function such that s →a s′ iff s′ ∈ δG (s). We construct a finite

system G = (S, δG ) as follows:• S = {P1 , P2 , A, A,C,C, T, T , D} ∪ {Xi , Xi : 1 ≤ i ≤ n},• The transition function δG is defined as follows. On input a, b and d, δG isdefined in Table D.1. We also define that

δG (q, c) = {q}, ∀q ∈ {T, T , Xi , Xi : 1 ≤ i ≤ n},δG (q, τ) = {D}, ∀q ∈ {T, Xi, Xi : 1 ≤ i ≤ n},δG (q, xi ) = {P1 }, ∀q ∈ {T, T , X j : 1 ≤ j ≤ n} ∪{X j : 1 ≤ j ≤ n, j 6= i},

δG (q, xi ) = {P2 }, ∀q ∈ {T, T , X j : 1 ≤ j ≤ n} ∪{X j : 1 ≤ j ≤ n, j 6= i},

δG (Xi , xi ) = {P2 }δG (Xi , xi ) = {P1 }We construct a one-counter net P = (Q, δ0 , δ>0 ) as follows. Initially, Q, δ0 , andδ>0 are empty. For every 1 ≤ i ≤ n, we add all the states in
Q′i = {sFi , ri , cij : 1 ≤ j ≤ m}.
If there is a literal yk or ¬yk appearing in the clause Cij , then we add all the states in{hCij , yk , hi : 0 ≤ h < pk },where ph is the hth prime number. We also add the states in{Xi , Xi : 1 ≤ i ≤ n}.
In addition, we add an isomorphic copy G′ of the above finite system G such that eachstate in G is renamed with an extra prime symbol (e.g. A becomes A′ ). Now we add
the following transitions for each 1 ≤ i ≤ n:

Appendix D. Proofs from Chapter 8266• add (sFi , τ, sFi , ±1) to δ>0• add (sFi , τ, sFi , 1) δ0 ,• add (sFi , a, ri, 0) to δ>0 ,• add (ri , b, cij , 0) to δ>0 for every 1 ≤ j ≤ m,′′

• if q ∈ {T , Xi′, Xi : 1 ≤ i ≤ n}, then we add the transition (cij , d, q, 0) to δ>0 ,• if the literal xk (resp. ¬xk ) appears in the clause Cij , then we add the transition(cij , d, Xk , 0) to (resp. (cij , d, Xk , 0)) to δ>0 ,• if the literal yk (resp. ¬yk ) appears in the clause Cij , then we add the transition(cij , d, hCij , yk , 0i, 0) to δ>0 ,• add (hCij , yk , hi, c, hCij , yk , hi, 0) to δ>0 for all j, k, h,• add (hCij , yk , hi, τ, hCij , yk , (h − 1) mod pk i, −1) to δ>0 for all j, k, h,• if yk does not appear positively in Cij , then add (hCij , yk , 0i, c, hCij , yk , 0i, 0) to δ0 ,• if yk does not appear negatively in Cij , then add (hCij , yk , hi, c, hCij , yk , hi, 0) to δ0for every 1 ≤ h < pk

• add (hCij , yk , hi, xk′ , P1′ , 0) for each k′ ∈ [n] to δ>0 ,• add (hCij , yk , hi, xk′ , P2′ , 0) for each k′ ∈ [n] to δ>0 ,• if (hCij , yk , hi, 0) has a self-loop with action label c, then add (hCij , yk , hi, xk′ , P1′ , 0)and (hCij , yk , hi, xk′ , P2′ , 0) for each k′ ∈ [n] to δ0 ,• add (Xk , x j , P1′ , 0) to δ>0 for all j 6= k, add (Xk , xk , sFk , 0) to δ>0 , and add the rule
(Xk , x j , P2′ , 0) to δ>0 for all 0 ≤ j, k ≤ n,

• add (Xk , x j , P1′ , 0) to δ>0 for all 0 ≤ j, k ≤ n, add (Xk , x j , P2′ , 0) to δ>0 for all j 6= k,
and add (Xk , xk , sFk , 0) to δ>0 .

• add all the transitions in G′ to δ>0 and δ0 , which are interpreted as internaltransitions.

Appendix D. Proofs from Chapter 8267

We claim that hF1 , . . ., Fn i ∈ DSAT iff P1 ≈ sFn (0) iff P2 is not weakly bisimilar tosFn (0). We prove a stronger version of this claim. In the following, we define sF0 to
be the state P1′ , and use the convention that the empty sequence hi of formulas is an

instance of DSAT.

Claim D.5.1 For every 0 ≤ i ≤ n, the following statements are equivalent:• hF1 , . . ., Fi i ∈ DSAT.
• P1 ≈ sFi (l) for all l ∈ N.
• P2 is not weakly bisimilar to sFi (l) for all l in N.
We prove this claim by induction on i. Consider the base case i = 0. Our convention
implies that hi ∈ DSAT. Observe also that each state in G is obviously bisimilar to thecorresponding state in G′ after renaming with any given counter value (e.g. A ≈ A′ ( j)for any j ∈ N). This is because no states in G′ ever reach a state that modifies thecounter values. In particular, we have P1 ≈ P1′ (0) = sF0 (0). Furthermore, it is easy to

see that P1 is not weakly bisimilar to P2 . This also means that P2 is not weakly bisimilar

to sF0 (0).
We now consider the inductive case i > 0. We shall use the function νl that we
defined earlier in the proof. We now give several obvious facts (one easily follows
from the previous ones):τ• For each l > 0, if the variable yk appears in the clause Cij , then hCij , yk , 0i(l) ⇒hCij , yk , hi(0) iff l ≡ h (mod pk ).

• For each 1 ≤ j < i, it is the case that T ≈ X j (l) for each l > 0 iff the uniqueassignment σ : {x1 , . . ., xn } → {0, 1} for hF1 , . . ., Fn i satisfies σ(x j ) = 1. To see

this, observe first that Attacker cannot start the game by playing any moves withaction labels other than x j , which will take a pebble to either G or G′ , as Defenderthen has a response in the isomorphic copy in the other system. So, Attacker isthen forced to make x j -move in either of the system, which does not matter asboth of the states X j and X j (l) has exactly one unique x j -successor. Defender hasa unique response which set up the next configuration hP1 , sFj (l)i. By induction,
Defender now wins iff P1 ≈ sFj (l) iff σ(x j ) = 1.

• For each 1 ≤ j < i, it is the case that T ≈ X j (l) for each l > 0 iff σ(x j ) = 0. The
proof is identical to the previous item.

Appendix D. Proofs from Chapter 8268• νl (Cij ) = ⊤ iff C ≈ cij (l). To see this, observe first that Attacker cannot make a d′′

move to any of the states in {T , Xk , Xk : 1 ≤ k ≤ n} in G or {T , Xk′ , Xk : 1 ≤ k ≤ n}in G′ , as Defender then has a response in the isomorphic copy in the other system.
Attacker then has only two choices: (1) a d-move to T in G, or (2) a d-move tothe states in S corresponding to the literals in Cij . Suppose that C ≈ cij (l). Then,

Defender has a response in S for Attacker’s move of type (1): either one of thestate hCij , yk , hi(l ′ ), or a state Xk , or a state X k . For the first case, there is a literal(¬)yk that makes Cij true under νl . For the second (resp. third) case, xk (resp.

¬xk ) is a literal in Cij with σ(xk ) = 1 (resp. σ(xk ) = 0). Conversely, supposethat νl (Cij ) = ⊤. We shall prove that C ≈ cij (l). For Attacker’s move of type(1), Defender has a winning strategy that is similar to the converse case. Let

us consider Attacker’s move of type (2). Suppose that a variable yk appears in
Cij and Attacker makes a d-move to hCij , yk , 0i. Suppose first that yk does notappear positively in Cij . If νl (¬yk ) = ⊥, Defender plays a d-move to T ; and ifνl (¬yk ) = ⊤, Defender plays a d-move to T . Similarly, Defender has a responsewhen yk does not appear negatively in Cij . Suppose now that a literal xk appears

in Cij and Attacker makes a d-move to Xk . If σ(xk ) = 1, it is easy to see that
Defender can make a d-move to T and wins. If σ(xk ) = 0, Defender can make ad-move to Xk in G and wins since the unique xk -successor from Xk is P2 insteadof P1 (i.e. state Xk “inverts” the outcome of the state T under the action xk ).
Similarly, if the literal xk is contained in Cij and Attacker makes a d-move to X k ,then Defender has a winning response.
• νl (Cij ) = ⊥ iff C ≈ cij (l). The proof is similar to the previous case.
• νl (Fi ) = ⊤ iff A ≈ ri (l). To see this, observe that νl (Fi ) = ⊤ iff νl (Cij ) = ⊤ forall j. By the previous items, this in turn is true iff C ≈ cij (l) for all j.

• νl (Fi ) = ⊥ iff A ≈ ri (l). This can be proved in the same way as in the previous
item. Here, we need the extra assumption that every assignment makes at least
one clause of Fi true so that the transition A →a C can be matched in ri (l).
Finally, it is easy to deduce the above Claim from the last two items. This is because
we assumed that none of the formulas in F1 , . . . , Fn is a tautology.

Appendix D. Proofs from Chapter 8

D.6

269

Proof of Proposition 8.6.3

To prove this lower bound, we will make use of an algorithm given by Kuĉera [Kuc00]
as a subroutine:
Lemma.([Kuc00]) There exists a fixed finite system F ′ with states P1 and P2 suchthat, given a boolean formula ϕ, we can compute in P a one-counter net O and an
initial configuration (q0 , 0) such that (q0 , 0) ≈ P1 iff ϕ is satisfiable, and (q0 , 0) ≈ P2
iff ϕ is unsatisfiable.

The proof is by a polynomial time reduction from the problem INDEX-ODD: given alist F1 , . . . , Fn of boolean formulas in 3-CNF, does there exist an odd index 1 ≤ i ≤ nsuch that F1 , . . . , Fi are all satisfiable and Fi+1 , . . ., Fn are all unsatisfiable? This problem is PNP[log] -complete. A PNP[log] upper bound is immediate by a simple binary
search in the list F1 , . . ., Fn by invoking an NP oracle at each step to determine therightmost satisfiable formula Fi . A PNP[log] -hardness for INDEX-ODD is also immediate from Wagner’s sufficient conditions for PNP[log] -hardness [Wag87, Theorem 5.2]
(see also [SV00, Lemma 7]). For notational convenience, we assume that INDEXODD accepts only lists of formulas ψ1 , . . . , ψn satisfying the following extra restrictions: (1) n ≥ 3 is odd, and (2) ψn is unsatisfiable. It is easy to see that the problem

remains PNP[log] -complete, e.g., by adding at most two extra formulas ⊥ to the endof the input list of formulas. Therefore, we may assume that the given input is thelist ψ1 , . . ., ψ2k , ψ2k+1 , where ψ2k+1 = ⊥. Initially, we run Kučera’s algorithm sequen-

tially on inputs ψ1 , . . ., ψ2k to obtain the one-counter nets P1 , . . . , P2k+1 with respective

initial states q1 , . . ., q2k+1 such that, for all i ∈ [2k + 1], the following conditions holdfor the states P1 and P2 in the finite system F ′ = (QF ′ , δF ′ ) given by the above lemma.
1. (qi , 0) ≈ P1 iff ψi is satisfiable (*)
2. (qi , 0) ≈ P2 iff ψi is unsatisfiable (**)
We will now define a one-counter net P = (Q, δ>0 , δ0 ) and a fixed finite system F =(S, δF ). We start with the definition of F . We define S = {t0 } ∪ {ti, j : i, j ∈ [3]} ∪ QF ′ .
Intuitively, if we pick an index h ∈ [2k − 1], then obviously the formulas ψ1 , . . . , ψh areeither: (1) all satisfiable, (2) all unsatisfiable, or (3) some are satisfiable and the rest are
unsatisfiable. These three split cases correspond to the three possible left indices i forti, j . We have also three similar split cases if we inspect the formulas ψh+1 , . . . , ψ2k+1 .

Appendix D. Proofs from Chapter 8

270[Actually, one of these cases are impossible as we always assume that ψ2k+1 is unsatisfiable.] Hence, the right indices j of ti, j similarly correspond to the these three possible
split cases. We now define the transitions for F accordingly:• add each transition (t0 , e,ti, j ) to δF for each i, j ∈ [3].
• add each transition (ti, j , L, P1 ) to δF for each i ∈ {1, 3} and j ∈ [3].
• add each transition (ti, j , L, P2 ) to δF for each i ∈ {2, 3} and j ∈ [3].
• add each transition (ti, j , R, P1) to δF for each i ∈ [3] and j ∈ {1, 3}.
• add each transition (ti, j , R, P2) to δF for each i ∈ [3] and j ∈ {2, 3}.
• add each transition in δF ′ to δF .
We continue now with the definition of P . We assume that P initially has neither states
nor transitions, and continue adding states/transitions as follows:• Add the initial state q0 and the states in {si : 1 ≤ i < 2k and i is odd }.
• Add the transition (q0 , e, si , 0) to δ>0 and δ0 for each si ,• Assume that the states of P1 , . . ., P2k+1 are disjoint and add the states and transitions of these one-counter nets into P .

• Add the transition (si , L, q j , 0) to δ>0 and δ0 for each si and j ∈ [i].
• Add the transition (si , R, q j , 0) to δ>0 and δ0 for each si and 2k + 1 ≥ j > i.
• Add an isomorphic copy S of F into P ; each new state in S is renamed with an

extra prime symbol so as to distinguish from the states of F (e.g. t1,2 in F is

′ in S ).
renamed to t1,2

• Add each transition (q0 , e,ti, j , 0) to δ>0 and δ0 for each i, j ∈ [3], except for(i, j) = (1, 2).

We want to prove that (q0 , 0) ≈ t0 iff ψ1 , . . . , ψ2k+1 is an instance of INDEX-ODD,

which suffices to deduce our theorem.

We first make a simple observation. For each si ∈ Q, (si , 0) ≈ t1,2 iff the formulas

ψ1 , . . ., ψi are all satisfiable and the formulas ψi+1 , . . ., ψ2k+1 are all unsatisfiable. To

see this, note that by definition action L can only take t1,2 in F to P1 (i.e. assertingAppendix D. Proofs from Chapter 8271

satisfiability), while action R can only take t1,2 to P2 (i.e. asserting unsatisfiability).
Also, by definition, action L can only take si to q j with j ≤ i, while action R can only

take si to q j with j > i. This observation is then an immediate consequence of property(*) and (**).
We now prove that (q0 , 0) ≈ t0 iff there exists an odd index i < 2k + 1 such that

ψ1 , . . ., ψi are all satisfiable and ψi+1 , . . . , ψ2k+1 are all unsatisfiable. This suffices todeduce our theorem. Let us first prove necessity. Assume that (q0 , 0) ≈ t0. Then,

Attacker can move the pebble from t0 to t1,2 . Note that there is no transition from q0 to′ in P . This means that Defender’s winning strategy must choose one of the states s .
t1,2iThat is, we have (si , 0) ≈ t1,2 and the rest follows from the previous simple observation.

Conversely, given the odd index i, we want to show that (q0 , 0) ≈ t0 . If Attacker

chooses t1,2 , then Defender can move the pebble from (q0 , 0) to (si , 0) and win as in
the converse case. If Attacker chooses other ti, j with (i, j) 6= (1, 2), then Defender canmove the pebble from (si , 0) to (ti,′ j , 0) and win as obviously (ti,′ j , l) ≈ ti, j for all l ∈ N.

Defender has a similar winning response if Attacker moves the pebble from (q0 , 0) to(ti,′ j , 0) with (i, j) 6= (1, 2). The remaining possible moves for Attacker are moves from(q0 , 0) to (si′ , 0) for some odd index i′ < 2k + 1. If i′ = i, then Defender can move fromt0 to t1,2 and win. If i′ 6= i, then we can look at the formulas ψ1 , . . ., ψi′ and the formulas
ψi′ +1 , . . ., ψ2k+1 . Each of these lists contain either (1) all satisfiable formulas, (2) all

unsatisfiable formulas, or (3) both satisfiable and unsatisfiable formulas. Considering
these two lists separately, this gives rise to nine possible combinations, which are all
covered by the successors of t0 in F . Therefore, by picking the appropriate successorof t0, Defender can win.

Appendix E
Proofs from Chapter 9
E.1

Proof of Proposition 9.2.1

We shall now sketch a reduction from model checking FOS (Reach) and FO2 (Reach)over ΠOCP to, respectively the logic L and L′ . We will first deal with atomic propositions. To this end, we will state a lemma, whose proof immediately follows from
Lemma 8.3.1, Lemma 8.3.4, and Lemma 8.3.5.
Lemma E.1.1 Given an OCP P = (Q, δ0 , δ>0 ) over ACT with Q = {q0 , . . . , qk } anda subset ACT′ ⊆ ACT, one can compute in poly-time a quantifier-free L′ -formula

ϕACT′ (x1 , x2 , y1 , y2 ) in disjunctive normal form (DNF) such that for all a1 , a2 , b1 , b2 ∈N,

N |= ϕ(a1 , a2 , b1, b2 ) ⇔ (qa1 , a2 ) →∗ACT′

(qb1 , b2 ).

Although Lemma 8.3.1, Lemma 8.3.4, and Lemma 8.3.5 discuss only the reachability
relation →∗ without any labeling constraints, this lemma can be obtained by first re-moving transitions with labels in ACT − ACT′ from the given OCP (in the same way wedeal with EFACT′ in the proof of Theorem 8.4.1). Note that formulas in DNF are ofalternation rank 2. Since the synchronization constraints =i, j over transition systemsof the form SSP introduce only self-loops, the following lemma can be directly deduced
from this by taking a conjunction, which increases the alternation rank by 1.
Lemma E.1.2 Let P be an asynchronous product of r OCPs P1 , . . . , Pr . Let Q ={q0 , . . . , qk } be the union of their control states. Suppose that SSP has action la-bels ACT. Then, for each ACT′ ⊆ ACT, one can compute in poly-time a quantifier-free L′ -formula ϕACT′ (x, y) with alternation rank 3, where x = (x1 , . . . , x2r ) and y =273

Appendix E. Proofs from Chapter 9274(y1 , . . . , y2r ), such that for all two tuples a = (a1 , . . ., a2r ) and b = (b1 , . . . , b2r ) of natural numbers, it is the case thathN, +i |= ϕACT′ (a, b) ⇔ ((qa1 , a2 ), . . ., (qa2r−1 , a2r )) →∗Σ′ ((qb1 , b2 ), . . ., (qb2r−1 , b2r ))in the transition system SSP .
This lemma shows that atomic propositions of the form ReachACT′ (x, y) can be dealt
with. Furthermore, it is not hard to give a quantifier-free L′ -formula ϕa (x, y) (resp.
ϕ=i, j (x, y)) with alternation rank at most 3 representing the atomic propositions of theform Ea (x, y) (resp. x =i, j y). For example, for formulas of the form Ea (x, y), one
simply needs to check only local transitions in each OCP and distinguish the casewhere the initial counter value is zero or not, all of which can be encoded in L as a big
disjunction of these cases. An extra big conjunction in the outermost layer is needed
to encode the asynchronous product.
The inductive cases can be dealt with easily. The case of boolean combinations isimmediate. An existential quantifier for an FOS (Reach) (resp. FO2 (Reach)) can be
replaced by a block of r existential quantifiers, where r is the number of OCPs in thegiven asynchronous product. Finally, it is easy to see that the alternating rank of theoutput formula equals the alternating rank of the input formula up to an addition by asmall constant factor c (from our proof, c = 3).

E.2

Missing proofs from Subsection 9.3.2

Definition E.2.1 Given i ∈ N, p, m ∈ Z>0 , and two 2n-tuples (a, b), (c, d) ∈ N2n , wherea = (a1 , . . . , an ), b = (b1 , . . . , bn ), c = (c1 , . . . , cn ), and d = (d1 , . . . , dn ), we write(a, b) ∼ip,m (c, d)
iff for all j ∈ [1, n] the following statements hold1. d(a j , b j ) ≤ pm implies d(a j , b j ) = d(c j , d j ),2. d(c j , d j ) ≤ pm implies d(a j , b j ) = d(c j , d j ),3. d(a j , b j ) > pm iff d(c j , d j ) > pm,
4. a j ≤ 2(i + 1)pm implies a j = c j ,5. b j ≤ 2(i + 1)pm implies b j = d j ,Appendix E. Proofs from Chapter 9275

6. c j ≤ 2(i + 1)pm implies a j = c j ,7. d j ≤ 2(i + 1)pm implies b j = d j ,8. a j ≡ c j (mod p) and b j ≡ d j (mod p), and
9. a j ≤ b j iff c j ≤ d j .
From this definition, it follows that (a, b) ∼ip,m (c, d) iff, for each j ∈ [1, n], it is thecase that (a j , b j ) ∼ip,m (c j , d j ).

Lemma E.2.1 Suppose i ∈ Z>0 and a, b, c, d ∈ Nn . If (a, b) ∼ip,m (c, d), then the following statements hold:′1. For all a′ ∈ Nn , there exists c′ ∈ Nn such that (a′ , b) ∼i−1
p,m (c , d).
′
2. For all b′ ∈ Nn , there exists d ′ ∈ Nn such that (a, b′ ) ∼i−1
p,m (c, d ).

Proof. We prove the first statement; the second statement can be proved in the sameway. Suppose that a′ = (a′1 , . . ., a′n ). For each j ∈ [1, n] we shall define c′j ∈ N satisfying
i−1 ′
′
′
′
(a′j , b j ) ∼i−1
p,m (c j , d j ). This suffices for showing (a , b) ∼ p,m (c , d). Furthermore, c will

be at most max(d) + 2pm. There are two possibilities:• Either b j ≤ 2(i + 1)pm or d j ≤ 2(i + 1)pm holds. In this case, our assumptionthat (a, b) ∼ip,m (c, d) implies that b j = d j . If a′j ≤ 2(i + 2)pm, then choose′′c′j = a′j , which would show that (a′j , b j ) ∼i−1
p,m (c j , d j ). Otherwise, we have a j >2(i + 2)pm and choose(2(i + 1)pm + pm + (a′j mod p)c′j =2(i + 1)pm + pm + p, if p6 |a′j

, if p|a′j .

′Then, it is easy to check that (a′j , b j ) ∼i−1
p,m (c j , d j ). This also shows that our

choice of c′j does not have to exceed 2(i + 1)pm + 2pm.

• Both b j > 2(i + 1)pm and d j > 2(i + 1)pm hold. First consider the case whend(a′j , b j ) ≤ pm. In this case, choose c′j := d j +(a′j −b j ). Observe that c′j > 2ipm,

and we have a j ≤ b j ⇔ c j ≤ d j . Furthermore, using our assumption (a, b) ∼ip,m′(c, d), it is easy to use check that (a′j , b j ) ∼i−1
p,m (c j , d j ). Consider now the casewhen d(a′j , b j ) > pm. There are several further possibilities:

Appendix E. Proofs from Chapter 9276– a′j ≤ 2ipm. Choose c′j = a′j and so we have d(a′j , b j ), d(c′j , d j ) > pm. Together with our assumption that (a, b) ∼ip,m (c, d), we have (a′j , b j ) ∼i−1p,m(c′j , d j ).

– a′j > 2ipm. In this case, if a′j < b j , we choose c′j := d j − p(m + 1) + [(a′j −b j ) mod p]. We have c′j > 2(i + 1)pm − p(m + 1) ≥ 2ipm and d(c′j , d j ) >′pm. It is easy now to check that (a′j , b j ) ∼i−1
p,m (c j , d j ). On the other hand,

if a′j > b j , we choose c′j := d j + p(m + 1) − [(b j − a′j ) mod p]. It follows′
that d(c′j , d j ) > pm. It is easy to check that (a′j , b j ) ∼i−1
p,m (c j , d j ).

2
Suppose i > 0. Let C and C′ be, respectively, a ∼ip,m -equivalence class and a ∼i−1p,m -equivalence class. We say that C′ is x-consistent with C if there exist tuples a, b, a′ ∈ Nsuch that (a, b) ∈ C and (a′ , b) ∈ C′ . Similarly, C′ is y-consistent with C if there exist
tuples a, b, b′ ∈ N such that (a, b) ∈ C and (a, b′ ) ∈ C′ .

Lemma E.2.2 Let a, b ∈ Nn and C be the ∼ip,m -equivalence class of (a, b). Define
A := {(a′1, a′2 . . . , a′n , b) : ∀ j ∈ [1, n] 0 ≤ a′j ≤ max(b) + 2pm}

B := {(a, b′1 , b′2 . . . , b′n ) : ∀ j ∈ [1, n] 0 ≤ b′j ≤ max(a) + 2pm}
Then, the set A (resp. B) contains a representative of every ∼i−1
p,m -equivalence classx-consistent (resp. y-consistent) with C.

Proof. This follows from the proof of Lemma E.2.1, where c′j (resp. d ′j ) was always
chosen to be at most max(d) + 2pm (resp. max(c) + 2pm). 2
Lemma E.2.3 Let p, m, n ∈ Z>0 and k ∈ N. Let a, b, c, d ∈ Nn . If (a, b) ∼kp,m (c, d),then for each formula ϕ ∈ L′p,m (n) with quantifier rank at most k we havehN, +i |= ϕ(a, b) ⇔ hN, +i |= ϕ(c, d).

Proof. The proof is by induction on ϕ. First consider the base cases:• x j ∼ y j + c and y j ∼ x j + c for ∼∈ {≤, ≥, =}. Same as in the proof of Lemma
9.3.5.

Appendix E. Proofs from Chapter 9277• x j ∼ c. If a j ≤ 2(i + 1)pm or c j ≤ 2(i + 1)pm, then a j ∼kp,m c j implies thata j = c j , and so a j ∼ c iff c j ∼ c. If a j > 2(i + 1)pm and c j > 2(i + 1)pm, thenwe also obviously have a j ∼ c iff c j ∼ c since c ≤ m < 2(i + 1)pm.

• y j ∼ c. Same as previous item.
• x j ≡ y j +c (mod d), y j ≡ x j +c (mod d), x j ≡ c (mod d), and y j ≡ c (mod d).
Same as in the proof of Lemma 9.3.5.

We now turn to the inductive cases. Boolean combinations are easy. So, let ϕ be aformula of the form ∃x j ψ. We now prove that hN, +i |= ϕ(a, b) implies hN, +i |=ϕ(c, d); the converse is symmetric. If hN, +i |= ϕ(a, b), then there exists a′j ∈ N suchthat hN, +i |= ϕ(a′ , b), where a′ = (a1 , . . . , a j−1, a′j , a j+1 , . . ., an ). Since (a, b) ∼kp,m(c, d), Lemma E.2.1 now implies that there exists c′j such that, wheneverc′ = (c1 , . . . , c j−1 , c′j , c j+1 , . . . , cn ),′we have (a′ , b) ∼k−1
p,m (c , d). The quantifier rank of ψ is at most k − 1 and the induction

hypothesis implies hN, +i |= ψ(c′ , d), which in turn means hN, +i |= ϕ(c, d). If ϕ is of

the form ∃y j ψ, the proof is also the same. 2

Lemma E.2.4 Let a, b ∈ Nn . Then, there exists c, d ∈ [0, 2(i + 3)pm]n such that(a, b) ∼ip,m (c, d).
Furthermore, for fixed p, m, n > 0, on inputs a and b (represented in binary), and i(represented in unary), a logspace machine can compute c and d and store them in its
working tape.
Proof. We first show the existence of c and d. For this, it suffices to show that, for eachj ∈ [1, n], there exists c j , d j ∈ [0, 2(i + 3)pm] such that (a j , b j ) ∼ip,m (c j , d j ). It suffices

to consider the case where either a j > 2(i + 3)pm or b j > 2(i + 3)pm holds. If a j = b j ,then it is easy to show that setting c j = d j = 2(i + 1)pm + p + (a j mod p) satisfies(a j , b j ) ∼ip,m (c j , d j ). Now consider the case when a j < b j ; the case when a j > b j issimilar.

First, consider the case d(a j , b j ) ≤ pm. In this case, we have a j > 2(i + 1)pm;

for, otherwise, b j = a j + (b j − a j ) ≤ 2(i + 1)pm + pm < 2(i + 3)pm, contradicting

our assumption. Therefore, we set c j = 2(i + 1)pm + p + (a j mod p) and d j = 2(i +1)pm + p + (a j mod p) + (b j − a j ). It is easy to check that c j , d j ∈ [0, 2(i + 3)pm] and(a j , b j ) ∼ip,m (c j , d j ).

Appendix E. Proofs from Chapter 9278

Now consider the case when d(a j , b j ) > pm. If a j ≤ 2(i + 1)pm, then our assump-tion implies that b j > 2(i + 3)pm. So, we set c j = a j and d j = 2(i + 1)pm + pm + p +(b j mod p). It is easy to see that d j ∈ [0, 2(i+3)pm] and (a j , b j ) ∼ip,m (c j , d j ). Finally,

if a j > 2(i + 1)pm, we set c j = 2(i + 1)pm + p + (a j mod p) and d j = c j + pm + p −[(a j − b j ) mod p]. This means that d j ≤ 2(i + 1)pm + 3p + pm ≤ 2(i + 3)pm. Since it

is easy to check that a j ≡ c j (mod p), it follows that b j ≡ d j (mod p). Furthermore,

it is easy to check that (a j , b j ) ∼ip,m (c j , d j ).

To show that there is a logspace machine computing c and d and store them in

the working tape, observe first that fixing the parameters p, m, n means that the sizeof binary representations of c and d is O(log |i|), since i is represented in unary, andso can be stored in the working tape of a logspace machine. To see that one requires

only logspace for actual the computation, recall that checking whether s|t, given thenumbers s and t as inputs represented in binary, can be done in L (e.g. see the survey[All01]). Therefore, since p is fixed, to compute the number (s mod p) one can simply
sequentially go through j = 0, . . . , p − 1 and check whether p|(s − j). Finally, observethat the rest of the arithmetic operations above (i.e. additions, multiplications, and(in)equality tests) can easily be done by a logspace machine. So, the proof can bedirectly translated into the desired logspace machine. 2
Proof of Proposition 9.3.7. We give an alternating logspace Turing machine M forsolving the membership problem of L′p,m (n). Given a, b ∈ Nn and a formula ϕ(x, y) ∈L′p,m (n) as input, note that the quantifier rank of ϕ is bounded above by i := kϕk, i.e.,

the number i is represented in unary on the input tape. So, using Lemma E.2.4 ourmachine computes c, d ∈ [0, 2(i + 3)pm]n such that (a, b) ∼ip,m (c, d). Therefore, byLemma E.2.3, M needs only check whether hN, +i |= ϕ(c, d). The machine M checks

this by a (single) one-way top-down traversal of the parse tree of ϕ in the input tapestarting at the root, which is the formula ϕ. At each step, M keeps track of a valuatione, g of the variables in x, y, where e = (e1 , . . . , en ) and g = (g1 , . . . , gn ). Initially, e (resp.
g) is set to c (resp. d). Suppose that the subformula of ϕ being traversed is α. If α is anatomic proposition, then M can check ϕ easily since all the required numbers are logarithmically bounded (or fixed). If α is of the form ψ ∨ ψ′ , then M existentially chooses

the next subformula α′ to be either ψ or ψ′ , and checks whether hN, +i |= α′ (e, g).
If α is of the form ¬ψ, then M simply makes a transition into a not-state and checks

whether hN, +i |= ψ(e, g). If α is of the form ∃xi ψ, then M will existentially guess anumber e′j ≤ g j + 2pm. Letting e′ = (e1 , . . . , e j−1 , e′j , e j+1 , . . . , en ), the machine M thenchecks whether hN, +i |= ψ(e′ , g). The machine M needs not guess a number bigger

Appendix E. Proofs from Chapter 9279

than g j + 2pm due to Lemma E.2.2. The case when ϕ is of the form ∃y j ψ is similar.

At each step, the machine M requires to keep track of: 1) which subformula of ϕ themachine M is currently at, for which we need O(log i) bits, and 2) the current valuationse, g for the variables x, y. Notice that at each step max(e, g) ≤ max(c, d) + 2ipm, which
requires O(log i) bits as well to represent. 2

E.3

Proof of Lemma 9.4.1

We first show upper bounds. Given an arena A = (v, k, ϕ) and two positive integers s,t,
we write s ∼A t iff s ≡ t (mod ∏Kj=1 p j ), where pK is the largest prime appearing in ϕ.

Then, each equivalence class in ∼A has a representative that is at most ∏Kj=1 pi , whose

size when represented in binary does not exceed p(|A |) for some fixed polynomial
p not depending on the input arena (recall that each number in A is given in unary).

As each atomic proposition in ϕ is only a divisibility test of the form p|x with p ≤pK , it is easy to check that a polynomial-time alternating Turing machine M solving

the buffer game need only simulate the game, while considering only the smallest
representative modulo ∏Kj=1 pi of each equivalence classes in ∼A . For each guessing
step, the machine M will ensure that the important information from the earlier roundis not “overwritten”. When a representative [mk ] of the last buffer value has beenobtained, the machine M will check whether hN, +i |= ϕ([mk ]). Checking these canbe done in polynomial time as divisibility of numbers represented in binary can bechecked in polynomial time. Finally, observe that the number of alternations used by
M on input A is exactly k + 1 (starting with existential guess). This shows that BUFFER
p

is in PSPACE, and BUFFERk is in Σk+1 .
To show lower bounds, we give a polynomial-time reduction from the well-known
PSPACE-complete problem QBF. We assume that the leading quantifier of the input
formulas is ∃. Moreover, if the input quantifier boolean formula ϕ has k + 1 quantifier

alternations, the resulting output arena is of the form (v, k, ϕ). In particular, this willp

prove that BUFFERk is Σk+1 -hard, as the restricted QBF problem with a fixed numberpk + 1 of quantifier alternations starting with the quantifier ∃ is Σk+1 -complete. Supposethat the input is the formulaθ = Q1 x1 . . . Qn xn ψ
where ψ is a boolean formula over the variables x1 , . . ., xn and Q1 = ∃. If θ has kquantifier alternations, parition the sequence Q1 , . . ., Qn into k + 1 alternating blocks ofidentical quantifiers accordingly. For each i ∈ [1, k + 1] we choose numbers ri > 0 such

Appendix E. Proofs from Chapter 9280

that the last variable quantified in ith block is xri . In this case, we have rk+1 = n. For
each i ∈ [1, k], we also let Qi be the quantifier type of the ith block of quantifiers (e.g.

Q1 = ∃ by assumption). Let v := (r1 , . . . , rk ). Define ϕ to be the LDIV -formula obtainedby replacing each occurence of the boolean variable xi in ψ by the atomic propositionpi |x. It is then easy to check that θ is true iff Player ∃ has a winning strategy in the

input arena (v, k, ϕ). [That is, for each truth evaluation f : {x1 , . . ., xn } → {0, 1} andeach m ∈ Z>0 satisfying G(m) ∈ f (x1 ) . . . f (xn )(0 + 1)ω, it is easy to check that ψ istrue under f iff hN, +i |= ϕ(m). To complete the proof, observe that the vector v isdefined in such a way that the quantifiers in θ are faithfully simulated in the buffer

game.]

E.4

Proof sketch of Proposition 9.4.4

The proof is similar to the proof of Proposition 9.4.2 with the following modification.
We store the buffer values chosen by the Player ∃ and ∀ in two different counters. At

the round r where Player ∃ acts, suppose that the current buffer value is n0 and n1 .
Player ∃ rewrites the first counter with a new value n′0 , while making sure that for eachprime number p ∈ [1, vr ] and any number j ∈ [0, p) it is the case that n0 ≡ j (mod p)

iff n1 ≡ j (mod p). It is not hard to encode this as an EF-formula (with respect to two
appropriate OCPs), whose size depends (polynomially) on vr .

E.5

Proof of Proposition 9.4.5

We show that checking FO4 (Reach) sentences with equality over (N, succ) is PSPACEhard. We shall only make use of the variables x, y, u, v. Since it is easy to construct an
OCP generating (N, succ), it follows that the expression complexity of FO4 (Reach)over OCPs is PSPACE-hard. To deduce the lower bound for FO4 (Reach) without
equality, observe first that we can define a strict inequality relation in FO4 (Reach)(without equality) over (N, succ) as follows:
x < y ⇔ ∃u(succ(x, u) ∧ Reach( u, y)).
Therefore, the equality relation x = y can simply be expressed as ¬(x < y ∨ y < x).

In the following, we shall give a poly-time reduction from QBF. Given a formulaϕ = Q1 x1 . . . Qn xn ψAppendix E. Proofs from Chapter 9281

where each Qi is either ∃ or ∀, Q1 is ∃, and ψ is a boolean formula over x1 , . . . , xn ,we shall compute a FO4 (Reach) sentence α over (N, succ) such that ϕ is true iff
hN, succi |= α.

To prove this, we shall first show how to succinctly encode the relation
DIFFi = {(a, b) ∈ N × N : |a − b| = 2i },for each i ∈ N, using only four variables. The technique is adapted from Grohe andSchweikardt [GS05]. We show how to define DIFFi in FO4 (Reach) by induction on i.
For the base case, we shall define DIFFi (x, y) and DIFFi (u, v) to be, respectively, theformulas succ(x, y) ∨ succ(y, x) and succ(u, v) ∨ succ(v, u). For i > 0, we define
DIFFi (x, y) := x 6= y ∧ ∃u∀v[(v = x ∨ v = y) → DIFFi−1 (u, v)],
which says that there exists a midpoint u in the region [x, y] or [y, x] (depending onwhether x < y or y < x) whose distance from x and y is 2i−1 . Similarly, we can define
DIFFi (u, v) by interchanging every occurence of x (resp. y) with u (resp. v). Noticethat the size of the formula DIFFi grows only linearly i.
From the relation DIFFi , we can now succinctly define some simple arithmetic onlarge numbers. Define the relation
PLUS2i (x, y) ⇔ x < y ∧ DIFFi (x, y),which asserts that y = x + 2i . We shall also define the weak minus relation
WMIN2i (x, y) = ∃uPLUS2i (u, x) → PLUS2i (y, x)∧¬∃uPLUS2i (z, x) → x = ywhich is true if either y = x − 2i and y ≥ 0, or x − 2i < 0 and x = y. It is easy to see thatthe size of the formulas PLUS2i and WMIN2i grows only linearly in i.

We now construct the formula α encoding the quantified boolean formula ϕ. In
the following, the (meta)variable zi with odd (resp. even) indices will refer to x (resp.
y). We first define a FO4 (Reach) formula β(zn ) such that, for each truth valuationf : {x1 , . . . , xn } → {0, 1}, it is the case that ψ is true under f iff (N, succ) |= β(m),where m is the number with binary representation f (xn ) f (xn−1 ) . . . f (x1 ). For this, itsuffices to show how to succinctly define the relationj

BITi (z j ) ⇔ a ∈ [0, 2 j ) and the ith bit of z j is 1.

Appendix E. Proofs from Chapter 9282

for each j = (i, n]. This is because if this is the case, then we can obtain β(zn ) bysimply replacing each occurrence of xi in ψ by BITni (zn ). We first show how to define
BITi+1for each i ∈ [0, n). This relation can simply be defined asi
BITi+1i (zi+1 ) := ¬∃zi PLUS2i+1 (zi , zi+1 )) ∧ ∃zi (PLUS2i (zi , zi+1 ).
Now for each j > i + 1, we may simply definejj−1

BITi (z j ) := ∃z j−1 [WMIN2 j (z j , z j−1 ) ∧ BITi(z j−1 )].

Notice that BITni (zn ) grows polynomially in n.
Now to define the formula α, we shall define a sequence {αi (zi )}ni=0 of FO4 (Reach)

formulas with one free variable such that, for each valuation f : {x1 , . . . , xi } → {0, 1},

the formula Qi+1 xi+1 . . . Qn xn ψ is true under f iff (N, succ) |= αi (m), where m is thenumber with binary representation f (xi ) f (xi−1 ) . . . f (x1 ). [If this sequence is empty,
then the number m associated with it is 0.] In this case, we shall set α := α0 (y) ∧ y = 0,

where y = 0 is a shorthand for ¬∃xsucc(x, y). We construct the formulas {αi (zi )}ni=0recursively. We obviously start by setting αn (zn ) := β(zn ). For each i < n, assume that
we have defined αi+1 (zi+1 ). Then, if Qi = ∃, we define
αi (zi ) := ∃zi+1 [(PLUS2i (zi , zi+1) ∨ zi+1 = zi ) ∧ αi+1 (zi+1 )].
If Qi = ∀, we define
αi (zi ) := ∀zi+1 [(PLUS2i (zi , zi+1) ∨ zi+1 = zi ) → αi+1 (zi+1 )].
It is now easy to see that, for each valuation f : {x1 , . . ., xi } → {0, 1}, the formula
Qi+1 xi+1 . . . Qn xn ψ is true under f iff (N, succ) |= αi (m), where m is the number withbinary representation f (xi ) f (xi−1 ) . . . f (x1 ). This is simply because assigning 1 to xi+1
corresponds to adding 2i to zi , as reflected in the definition of αi (zi ).
Finally, it is easy to see that our construction above runs in polynomial time.

E.6

Proof of Proposition 9.4.6

Given each ϕ(x, y) ∈ FO2 (Reach) and each OCP P = (Q, δ0 , δ>0 ) over actions ACT,

we compute in poly-time an EFS -logic formula ϕ′ , an OCP P1 = (Q1 , δ10 , δ1>0 ) over
ACT1 , and an OCP P2 = (Q2 , δ20 , δ2>0 ) over ACT2 , and a poly-time computable function

Appendix E. Proofs from Chapter 9283

f (resp. f ′ ) mapping configurations of P to configurations of P1 (resp. P2 ), such thatfor any pair of P -configurations (q, n) and (q′ , n′ )SP |= ϕ((q, n), (q′, n′ )) ⇔ SP1 ×P2 , ( f (q, n), f (q′, n′ )) |= ϕ′ .
Therefore, by Theorem 9.4.2, there exists a fixed ϕk such that model checking ϕk overp

ΠOCP is Σk -hard.
Suppose that ACT = {σ1 , . . ., σl }. Let ACT1 = {a1 , . . . , al }∪{c1 , loop1 } and ACT2 ={b1 , . . . , bl } ∪ {c2 , loop2 } be two disjoint alphabets. Define Q1 = Q2 = Q ∪ {g}. The
purpose of adding a new state g is to define a “global modality”. As we shall see, forevery (q, n), (q′, n′ ) ∈ Q1 × N we have (q, n) →∗{c1 ,loop } (q′ , n′ ); a similar statement1

also holds for P2 . We now define the transition functions. The transition functions δ1>0

(resp. δ2>0 ) can be obtained from δ>0 by first renaming each action σi with ai (resp.
bi ), and then adding extra transitions (q, c1 , g, 0), (g, loop1 , g, +1), (g, loop1 , g, −1),and (g, c1 , q, 0) (resp. (q, c2 , g, 0), (g, loop2 , g, +1), (g, loop2 , g, −1), and (g, c2, q, 0)),for each q ∈ Q. Similarly, the transition functions δ10 (resp. δ20 ) can be obtained from

δ0 by first renaming each action σi with ai (resp. bi ), and then adding extra transitions (q, c1 , g, 0), (g, loop1 , g, +1), and (g, c1 , q, 0) (resp. (q, c2 , g, 0), (g, loop2 , g, +1),and (g, c2 , q, 0)), for each q ∈ Q.

Also, define ACT′1 := Σ1 − {c1 , loop1 }, ACT′2 :=ACT2 − {c2 , loop2 }, ACT′′1 := {c1 , loop1 }, and ACT′′2 := {c2 , loop2 }.

We now define our formula ϕ′ by induction on ϕ. In particular, we shall construct

a function λ mapping formulas of FO2 (Reach) to EFS -logic formulas such that, foreach ψ(x, y) ∈ FO2 (Reach) and (q, n), (q′, n′ ) ∈ Q × N,
SP |= ψ((q, n), (q′, n′ )) ⇔ SP1 ×P2 , ((q, n), (q′, n′ )) |= λ(ψ)(∗)

We then need only set ϕ′ = λ(ϕ). In the following, recall that the formula ∃xψ(x, y)

can be thought of as ∃x(ψ(x, y)) ∧ x = x, and so the variables x and y always occur

freely in the formula. First consider the base cases:• ψ := Reach( x, y). We set λ(ψ) := hRACT′ i(=1,2 ).
1• ψ := Reach( y, x). We set λ(ψ) := hRACT′ i(=1,2 ).
2• ψ := Eσi (x, y). We set λ(ψ) := hai i(=1,2 ).
• ψ := Eσi (y, x). We set λ(ψ) := hbi i(=1,2 ).
It is easy to check that (*) hold for these. Now consider the inductive cases:

Appendix E. Proofs from Chapter 9284• ψ := α(x, y) ∧ β(x, y). We set λ(ψ) := λ(α) ∧ λ(β).
• ψ := ¬α(x, y). We set λ(ψ) := ¬λ(α).
• ψ := ∃xα(x, y). We set λ(ψ) := hRACT′′ i(λ(α) ∧ ¬hloop1 i). We show that (*)
1

holds. Given (q, n), (q′, n′ ) ∈ Q × N, we have SP |= ψ((q, n), (q′, n′ )) iff there

exists (q′′ , n′′ ) ∈ Q × N such that SP |= α((q′′, n′′ ), (q′, n′ )) iff (by induction hypothesis) there exists (q′′, n′′ ) ∈ Q × N such that SP1 ×P2 , ((q′′, n′′ ), (q′ , n′ )) |=λ(α) iff SP1 ×P2 , ((q, n), (q′, n′ )) |= λ(ψ) since hRACT′′ i is a global modality.
• ψ := ∃yα(x, y). We set λ(ψ) := hRACT′′ i(λ(α) ∧ ¬hloop2 i).
2Finally, observe that our reduction runs in polynomial time.