Bounded Model Checking of ETL Cooperating with Finite and Looping Automata Connectives

Abstract

As a complementary technique of the BDD-based approach, bounded model checking (BMC) has been successfully applied to LTL symbolic model checking. However, the expressiveness of LTL is rather limited, and some important properties cannot be captured by such logic. In this paper, we present a semantic BMC encoding approach to deal with the mixture of ETL_𝑓 and ETL_𝑙. Since such kind of temporal logic involves both finite and looping automata as connectives, all regular properties can be succinctly specified with it. The presented algorithm is integrated into the model checker ENuSMV, and the approach is evaluated via conducting a series of imperial experiments.

1. Introduction

A crucial bottleneck of model checking is the state-explosion problem, and the symbolic model checking technique has proven to be an applicable approach to alleviate it. In the early 1990s, McMillan presented the BDD [1] based model checking technique [2]. It is first applied to CTL model checking and is later adapted to deal with LTL. With the rapid evolvement of SAT solvers, an entirely new approach, namely, bounded model checking (BMC), is presented in [3]. It rerpresents the problem “there is a path (with bounded length) violating the specification in the model” with a Boolean formula and then tests its satisfiability via a SAT solver. Usually, BMC is considered to be a complementary approach of the BDD-based approach: BMC is normally used for hunting bugs not for proving their absence. It performs better when handling a model having a large reachable state set but involving (relatively) shallow error runnings.

BMC has been successfully employed in LTL model checking. However, LTL has the drawback of limited expressiveness. Wolper was the first to complain about this by addressing the fact that some counting properties such as “𝑝 holds at every even moment” cannot be expressed by any LTL formula [4]. Indeed, LTL formulae are just as expressive as star-free 𝜔-expressions, that is, 𝜔-regular expressions disallowing arbitrary (in a star-free expression, Kleene-closure operators (•^∗ and •^𝜔) can only be applied upon Σ, which is the whole set of alphabet) use of Kleene-closure operators.

As pointed in [5, 6], it is of great importance for a specification language to have the power to express all 𝜔-regular properties—as an example, it is a necessary requirement to support modular model checking. Actually, such specification language like PSL [7] has been accepted as industrial standard.

For temporal logics within linear framework, there are several ways to pursue such an expressiveness. (1)The first way is to add fixed-point operators or propositional quantifiers to the logic, such as linear 𝜇-calculus [8] and QLTL [9]. (2)An alternative choice is to add regular expressions to LTL-like logics, as done in RLTL [10], FTL [11, 12], and PSL [7]. (3)The third approach is to cooperate infinitely many temporal connectives with the logic, just like various of ETLs [4, 9, 13].

The first extension requires finitely many operators in defining formulae. Meanwhile, the use of fixed-point operators and higher-order quantifiers tends to rise difficulties in understanding. In contrast, using regular expressions or automata as syntactical ingredients is much more intuitive in comprehension. To some extent, since nesting of automata connectives is allowed, the third approach generalizes the second one.

In [4], Wolper suggested using right linear grammars as connectives. Later, Wolper, Vardi, and Sistla consider taking various 𝜔-automata [9, 13]. Depending on the type of automata used as temporal connectives, we may obtain various ETLs. As a result, ETLs employing 𝜔-automata with looping, finite, and repeating (alternatively, Büchi [14]) acceptance are, respectively, named ETL_𝑙, ETL_𝑓, and ETL_𝑟, and all of them are known to be as expressive as 𝜔-regular expressions [13].

We have presented a BDD-based model checking algorithm for ETL_𝑓 in [15] and an algorithm for BDD-based model checking of an invariant of PSL in [16]. Jehle et al. present a bounded model checking algorithm for linear 𝜇-calculus in [17]. And in [18], a tester based symbolic model checking approach is proposed by Pnueli and Zacks to deal with PSL properties. Meanwhile, a modular symbolic Büchi automata construction is presented in [19] by Cimatti et al.

In this paper, we present a semantic BMC encoding for ETL employing both finite acceptance and looping acceptance automata connectives (we in the following refer to it as ETL_𝑙+𝑓). The reason that we study BMC algorithm for such kind of logic is for the following considerations.(1)The BDD-based symbolic model checking technique for ETL_𝑓 has been established in [15] by extending LTL construction [20]. Nevertheless, in a pure theoretical perspective, looping and finite acceptance, respectively, correspond to safety and liveness properties, and looping acceptance automata can be viewed as the counterparts of finite acceptance automata. Actually, both similarities and differences could be found in compiling the semantic models and translating Boolean representations when dealing with these two types of connectives. Since ETL_𝑙+𝑓 has a rich set of fragments, such as LTL, it is hopeful to develop a unified semantic BMC framework of such logics. (2)Practically, things would usually be much more succinct when employing both types of automata connectives, in comparison to merely using finite or looping ones. As an example, there is no direct encoding for the temporal operator 𝐆 just with finite acceptance automata—to do this with ETL_𝑓, we need to use a two-state and two-letter connective to represent the operator 𝐅 and then to dualize it. In contrast, with looping automata, we just need to define a one-state and one-letter connective. It would save much space overhead in building tableaux. (3)Lastly, unlike syntactic BMC encodings (such kind of encodings give inductive Boolean translations with the formulae’s structure, cf. [21, 22] for a survey), the semantic fashion [22] yields a natural completeness threshold computation approach, and it describes the fair path finding problem over the product model with Boolean formulae. In this paper, we give a linear semantic encoding approach (opposing to the original quadratic semantic encoding) for ETL_𝑙+𝑓. Moreover, the technique can also be tailored to semantic LTL BMC.

We have implemented the presented algorithm with our model checker ENuSMV (Ver. 1.2), and this tool allows end users to customize temporal connectives by defining automata. We have also justified the algorithm by conducting a series of comparative experiments.

The paper is structured as follows: Section 2 briefly revisits basic notions. Section 3 introduces semantic BMC encoding technique for ETL_𝑙+𝑓. In Section 4, experimental results of ETL_𝑙+𝑓 BMC are given. Finally, we conclude the whole paper with Section 5.

2. Preliminaries

An infinite word 𝑤 over the alphabet Σ is a mapping from ℕ to Σ; hence we may use 𝑤(𝑖) to denote the 𝑖th letter of 𝑤. For the sake of simplicity, we usually write 𝑤 as the sequence 𝑤(0)𝑤(1)⋯. A finite prefix of 𝑤 with length 𝑛 is a restriction of 𝑤 to the domain {0,…,𝑛−1}, denoted by 𝑤[𝑛].

A (nondeterministic) automaton is a tuple 𝒜=⟨Σ,𝑄,𝛿,𝑞,𝐹⟩, where: (i)Σ is a finite alphabet, (ii)𝑄 is a finite set of states, (iii)𝛿∶𝑄×Σ→2^𝑄 is a transition function, (iv)𝑞∈𝑄 is an initial state, and (v)𝐹⊆𝑄 is a set of accepting states.

An infinite run of 𝒜=⟨Σ,𝑄,𝛿,𝑞,𝐹⟩ over an infinite word 𝑤 is an infinite sequence 𝜎=𝑞₀𝑞₁⋯∈𝑄^𝜔, where 𝑞₀=𝑞 and 𝑞_𝑖+1∈𝛿(𝑞_𝑖,𝑤(𝑖)) for each 𝑖. In addition, we say that each prefix 𝑞₀⋯𝑞_𝑛+1 is a finite run over 𝑤[𝑛].

In this paper, we are concerned with two acceptance types for 𝜔-automata.  Looping. An infinite word 𝑤 is accepted if it has an infinite run over 𝑤.  Finite. An infinite word 𝑤 is accepted if it has a finite prefix 𝑤[𝑛], over which there is a finite run 𝑞₀⋯𝑞_𝑛+1 and 𝑞_𝑛+1 is an accepting state (call such a prefix accepting prefix).

In both cases, we denote by ℒ(𝒜) the set of infinite words accepted by 𝒜.

Given an automaton 𝒜=⟨Σ,𝑄,𝛿,𝑞,𝐹⟩ and a state 𝑟∈𝑄, we denote by 𝒜^𝑟 the automaton ⟨Σ,𝑄,𝛿,𝑟,𝐹⟩. That is, 𝒜^𝑟 is almost identical to 𝒜, except for that its initial state is replaced by 𝑟. Hence, 𝒜 and 𝒜^𝑞 are the same.

Given a set of atomic propositions 𝐴𝑃, the class of ETL_𝑙+𝑓 formulae can be inductively defined as follows. (i)Both ⊤ and ⟂ are ETL_𝑙+𝑓 formulae. (ii)Each proposition 𝑝∈𝐴𝑃 is an ETL_𝑙+𝑓 formula. (iii)If 𝜑 is an ETL_𝑙+𝑓 formula, then ¬𝜑 and ○𝜑 are ETL_𝑙+𝑓 formulae. (iv)If 𝜑₁, 𝜑₂ are ETL_𝑙+𝑓 formulae, then both 𝜑₁∧𝜑₂ and 𝜑₁∨𝜑₂ are ETL_𝑙+𝑓 formulae. (v)If 𝒜 is an automaton with the alphabet Σ={𝑎₁,…,𝑎_𝑛} and 𝜑₁,…,𝜑_𝑛 are ETL_𝑙+𝑓 formulae, then 𝒜(𝜑₁,…,𝜑_𝑛) is also an ETL_𝑙+𝑓 formula.

Remark 1. In the original definition of various ETLs (say ETL_𝑙, ETL_𝑓, and ETL_𝑟), the “next operator” (○) is not explicitly declared. However, this operator is extremely important in building the semantic BMC encodings for ETL_𝑙+𝑓. Hence, we explicitly use this operator in our definition, and it would not change the expressiveness of the logic.

Remark 2. Since we employ both finite and looping acceptance automata connectives, our logic is a mixture of ETL_𝑙 and ETL_𝑓. On the one hand, ETL_𝑙+𝑓 generalizes both of these two logics; on the other hand, it can be embedded into ETL_𝑟; hence this logic is also as expressive as omega-regular expressions.

The satisfaction relation of an ETL_𝑙+𝑓 formula 𝜑 with respect to an infinite word 𝜋∈(2^𝐴𝑃)^𝜔 and a position 𝑖∈ℕ is inductively given as follows. (i)𝜋,𝑖⊨⊤ and 𝜋,𝑖⊭⟂.(ii)𝜋,𝑖⊨𝑝 if and only if 𝑝∈𝜋(𝑖). (iii)𝜋,𝑖⊨¬𝜑 if and only if 𝜋,𝑖⊭𝜑.(iv)𝜋,𝑖⊨○𝜑 if and only if 𝜋,𝑖+1⊨𝜑. (v)𝜋,𝑖⊨𝜑₁∧𝜑₂ if and only if 𝜋,𝑖⊨𝜑₁ and 𝜋,𝑖⊨𝜑₂. (vi)𝜋,𝑖⊨𝜑₁∨𝜑₂ if and only if 𝜋,𝑖⊨𝜑₁ or 𝜋,𝑖⊨𝜑₂. (vii)If 𝒜 is a looping acceptance automaton with the alphabet {𝑎₁,…,𝑎_𝑛}, then 𝜋,𝑖⊨𝒜(𝜑₁,…,𝜑_𝑛) if and only if: there is an infinite word 𝑤∈ℒ(𝒜), and, for each 𝑗∈ℕ, 𝑤(𝑗)=𝑎_𝑘 implies 𝜋,𝑖+𝑗⊨𝜑_𝑘. (viii)If 𝒜 is a finite acceptance automaton with the alphabet {𝑎₁,…,𝑎_𝑛}, then 𝜋,𝑖⊨𝒜(𝜑₁,…,𝜑_𝑛) if and only if: there is an infinite word 𝑤∈ℒ(𝒜) with an accepting prefix 𝑤[𝑛], such that, for each 𝑗<𝑛, 𝑤(𝑗)=𝑎_𝑘 implies 𝜋,𝑖+𝑗⊨𝜑_𝑘.

As usual, we directly use 𝜋⊨𝜑 in place of 𝜋,0⊨𝜑.

To make a better understanding of ETL_𝑙+𝑓 formulas, we here give some examples of the use of automata connectives. (1)Considering the LTL formula 𝜑₁𝐔𝜑₂, it can be described with an ETL_𝑙+𝑓 formula 𝒜_𝐔(𝜑₁,𝜑₂), where 𝒜_𝐔 is the finite acceptance automaton ⟨{𝑎₁,𝑎₂},{𝑞₁,𝑞₂},𝛿_𝐔,𝑞₁,{𝑞₂}⟩, and we let 𝛿_𝐔(𝑞₁,𝑎₁)={𝑞₁}, 𝛿_𝐔(𝑞₁,𝑎₂)={𝑞₂}, and 𝛿_𝐔(𝑞₂,𝑎₁)=𝛿_𝐔(𝑞₂,𝑎₂)=∅. (2)The LTL formula 𝐆𝜑 is equivalent to the ETL_𝑙+𝑓 formula 𝒜_𝐆(𝜑), where 𝒜_𝐆=⟨{𝑎},{𝑞},𝛿_𝐆,𝑞,∅⟩ is a looping acceptance automaton and 𝛿_𝐆(𝑞,𝑎)={𝑞}.

Remark 3. The order of letters is important in defining automata connectives. Hence, the alphabet should be considered as a vector, rather than a set.

We use sub(𝜑) to denote the set of subformulae of 𝜑. A formula 𝜑 is in negation normal form (NNF) if all negations in 𝜑 are adjacent to atomic propositions or automata connectives. One can achieve this by repeatedly using De Morgan’s law and the schemas of ¬○𝜑≡○¬𝜑 and ¬¬𝜑≡𝜑. In addition, we call a formula 𝜑 being of the form 𝒜(𝜑₁,…,𝜑_𝑛) an automaton formula.

Given a formula 𝜑 (in NNF), we use a two-letter-acronym to designate the type of an automaton subformula of 𝜑: the first letter is either “P” or “N,” which means “positive” or “negative”; and the second letter can be “F” or “L,” which describes the acceptance type. For example, NL-subformulae stand for “negative automata formulae with looping automata connectives,” such as ¬𝒜^𝑞(𝜑₁,𝜑₂), where 𝒜 is a two-letter looping automaton.

A model or interchangeably a labeled transition system (LTS) is a tuple ℳ=⟨𝑆,𝜌,𝐼,𝐿,ℱ⟩, where: (i)𝑆 is a finite set of states, (ii)𝜌⊆𝑆×𝑆 is a transition relation (usually, we require 𝜌 to be total; that is, for each 𝑠∈𝑆, there is some 𝑠^′∈𝑆 having (𝑠,𝑠^′)∈𝜌), (iii)𝐼⊆𝑆 is the set of initial states, (iv)𝐿∶𝑆→2^𝐴𝑃 is the labeling function, and (v)ℱ⊆2^𝑆 is a set of fairness constraints.

A path of ℳ is an infinite sequence 𝜎=𝑠₀𝑠₁⋯∈𝑆^𝜔, where 𝑠₀∈𝐼 and (𝑠_𝑖,𝑠_𝑖+1)∈𝜌 for each 𝑖∈ℕ. In addition, 𝜎 is a fair path if 𝜎 visits each 𝐹∈ℱ infinitely often. Formally, 𝜎 is a fair path if inf(𝜎)∩𝐹≠∅ for each 𝐹∈ℱ, where inf(𝜎) denotes the set of states occurring infinitely many times in 𝜎.

An infinite word 𝜋=𝑎₀𝑎₁⋯ is derived from a path 𝜎 of ℳ (denoted by 𝜋=𝐿(𝜎)) if 𝑎_𝑖=𝐿(𝑠_𝑖) for each 𝑖∈ℕ. We use ℒ(ℳ) to denote the set of infinite words derived from fair paths of ℳ.

Given an ETL_𝑙+𝑓 formula 𝜑 and an LTS ℳ, we denote by ℳ⊨𝜑 if 𝜋⊨𝜑 for each 𝜋∈ℒ(ℳ). The model checking problem of ETL_𝑙+𝑓 is just to verify if ℳ⊨𝜑 holds for the given LTS ℳ and the given ETL_𝑙+𝑓 formula 𝜑.

3. Semantic BMC Encoding for ETL𝑙+𝑓

In this section, we will give a detailed description of the semantic BMC encoding for ETL_𝑙+𝑓. Firstly, we show how to extend the tableau construction of LTL [20] to that of ETL_𝑙+𝑓, and hence a product model can also be constructed. Subsequently, we interpret the fairness path finding problem (upon the product model) into SAT, and the size blow-up of this encoding is linear with the bound.

For the sake of convenience, in this section, we always assume that the given ETL_𝑙+𝑓 formulae have been normalized into NNF.

3.1. The Tableaux of ETL𝑙+𝑓 Formulae

Given an ETL_𝑙+𝑓 formula 𝜑, we first inductively define its elementary formula set el(𝜑) as follows. (i)el(⊤)=el(⟂)=∅. (ii)el(𝑝)=el(¬𝑝)={𝑝} for each 𝑝∈𝐴𝑃. (iii)el(𝜑₁∧𝜑₂)=el(𝜑₁∨𝜑₂)=el(𝜑₁)∪el(𝜑₂). (iv)el(○𝜑)=el(𝜑)∪{○𝜑}. (v)If 𝜑=𝒜^𝑞(𝜑₁,…,𝜑_𝑛) or 𝜑=¬𝒜^𝑞(𝜑₁,…,𝜑_𝑛) and the states set of 𝒜 is 𝑄, then el𝜑=_{1≤𝑘≤𝑛}el𝜑_𝑘∪○𝒜^𝑞′𝜑₁,…,𝜑_𝑛∣𝑞^′∈𝑄. (1)

Hence, if 𝜓∈el(𝜑), then 𝜓 is either an atomic proposition or a formula rooted at the next operator.

Subsequently, we define the function sat, which maps each subformula 𝜓 of 𝜑 to a set of members in 2^el(𝜑). Inductively the following hold. (i)sat(⊤)=2^el(𝜑); sat(⟂)=∅. (ii)sat(𝑝)={Γ⊆el(𝜑)∣𝑝∈Γ} and sat(¬𝑝)={Γ⊆el(𝜑)∣𝑝∉Γ}. (iii)sat(○𝜓)={Γ⊆el(𝜑)∣○𝜓∈Γ}. (iv)sat(𝜑₁∧𝜑₂)=sat(𝜑₁)∩sat(𝜑₂) and sat(𝜑₁∨𝜑₂)=sat(𝜑₁)∪sat(𝜑₂). (v)Suppose that 𝒜=⟨{𝑎₁,…,𝑎_𝑛},𝑄,𝛿,𝑞,𝐹⟩. (1)If 𝒜 is a looping acceptance automaton or a finite acceptance automaton and 𝑞∉𝐹, then sat𝒜^𝑞𝜑₁,…,𝜑_𝑛=_{1≤𝑘≤𝑛}sat𝜑_𝑘∩_{𝑞′∈𝛿𝑞,𝑎𝑘}sat○𝒜^𝑞′𝜑₁,…,𝜑_𝑛. (2)(2)If 𝒜 is a finite acceptance automaton and 𝑞∈𝐹, then sat(𝒜^𝑞(𝜑₁,…,𝜑_𝑛))=2^el(𝜑). (vi)sat(¬𝒜^𝑞(𝜑₁,…,𝜑_𝑛))=2^el(𝜑)⧵sat(𝒜^𝑞(𝜑₁,…,𝜑_𝑛)).

Recall the tableau construction for LTL [20], an “until subformula” would generate a fairness constraint to the tableau. Indeed, such a subformula corresponds to a “least-fixpoint subformula” if we translate the specification into a logic employing higher-order quantifiers, such as 𝜇-calculus. Similarly, for ETL_𝑙+𝑓, the PF- and NL-subformulae also impose fairness constraints. For this reason, we need to define the following two auxiliary relations before giving the tableau construction.

For a PF-subformula 𝜓=𝒜(𝜑₁,…,𝜑_𝑛) of 𝜑, where 𝒜=⟨{𝑎₁,…,𝑎_𝑛},𝑄,𝛿,𝑞,𝐹⟩, we define a relation Δ⁺_𝜓⊆(2^el(𝜑)×2^𝑄)×(2^el(𝜑)×2^𝑄) as follows: suppose that Γ,Γ^′⊆el(𝜑) and 𝑃,𝑃^′⊆𝑄; then ((Γ,𝑃),(Γ^′,𝑃^′))∈Δ⁺_𝜓 if and only if the following hold. (i)When 𝑃≠∅, then, for each 𝑞∈𝑃⧵𝐹, there exists some 1≤𝑘≤𝑛 such that Γ∈sat(𝜑_𝑘) and 𝑃^′∩𝛿(𝑞,𝑎_𝑘)≠∅. (ii)When 𝑃=∅, then 𝑞∈𝑃^′ if and only if Γ^′∈sat(𝒜^𝑞(𝜑₁,…,𝜑_𝑛)) for each 𝑞∈𝑄.

Likewise, for each NL-subformula 𝜓=¬𝒜(𝜑₁,…,𝜑_𝑛) of 𝜑, we also define a relation Δ⁻_𝜓⊆(2^el(𝜑)×2^𝑄)×(2^el(𝜑)×2^𝑄). In detail, for any Γ,Γ^′⊆el(𝜑) and 𝑃,𝑃^′⊆𝑄, we have ((Γ,𝑃),(Γ^′,𝑃^′))∈Δ⁻_𝜓 if and only if the following hold. (i)When 𝑃≠∅, then, for each 𝑞∈𝑃 and 1≤𝑘≤𝑛, we have: Γ∈sat(𝜑_𝑘) implies 𝛿(𝑞,𝑎_𝑘)⊆𝑃^′. (ii)When 𝑃=∅, then 𝑞∈𝑃^′ if and only if Γ^′∉sat(𝒜^𝑞(𝜑₁,…,𝜑_𝑛)), for each 𝑞∈𝑄.

We now describe the tableau construction for 𝜑. Suppose that 𝜓₁,…,𝜓_𝑚 and ¬𝜂₁,…,¬𝜂_𝑛 are, respectively, all the PF-subformulae and NL-subformulae occurring in 𝜑 then the tableau 𝒯_𝜑 is such an LTS ⟨𝑆_𝜑,𝜌_𝜑,𝐼_𝜑,𝐿_𝜑,ℱ_𝜑⟩, where:(i)𝑆_𝜑 consists of tuples like ⟨Γ;𝑃₁,…,𝑃_𝑚;𝑅₁,…,𝑅_𝑛⟩, where Γ⊆el(𝜑) and each 𝑃_𝑖 (resp., 𝑅_𝑖) is a subset of 𝜓_𝑖’s (resp., 𝜂_𝑖’s) connective’s state set. (ii)For two states 𝑠=⟨Γ;𝑃₁,…,𝑃_𝑚;𝑅₁,…,𝑅_𝑛⟩ and 𝑠^′=⟨Γ^′;𝑃^′₁,…,𝑃^′_𝑚;𝑅^′₁,…,𝑅^′_𝑛⟩, (𝑠,𝑠^′)∈𝜌_𝜑 if and only if the following three conditions hold. (1)Γ∈sat(○𝜓) if and only if Γ^′∈sat(𝜓) for each ○𝜓∈el(𝜑). (2)((Γ,𝑃_𝑖),(Γ^′,𝑃^′_𝑖))∈Δ⁺_𝜓𝑖 for each 1≤𝑖≤𝑚. (3)((Γ,𝑅_𝑗),(Γ^′,𝑅^′_𝑗))∈Δ⁻_¬𝜂𝑗 for each 1≤𝑗≤𝑛. (iii)𝐼_𝜑={⟨Γ;𝑃₁,…,𝑃_𝑚;𝑅₁,…,𝑅_𝑛⟩∈𝑆_𝜑∣Γ∈sat(𝜑)}. (iv)𝐿_𝜑(⟨Γ;𝑃₁,…,𝑃_𝑚;𝑅₁,…,𝑅_𝑛⟩)=Γ∩𝐴𝑃. (v)ℱ_𝜑={𝐹⁺_𝑖∣1≤𝑖≤𝑚}∪{𝐹⁻_𝑗∣1≤𝑗≤𝑛}, where 𝐹⁺_𝑖=Γ;𝑃₁,…,𝑃_𝑚;𝑅₁,…,𝑅_𝑛∈𝑆_𝜑∣𝑃_𝑖,𝐹=∅_−𝑗=Γ;𝑃₁,…,𝑃_𝑚;𝑅₁,…,𝑅_𝑛∈𝑆_𝜑∣𝑅_𝑗=∅. (3)

The below two theorems (Theorems 4 and 5) reveal the language property of ETL_𝑙+𝑓 tableaux. To remove the lengthiness, we here just provide the proof sketches, and rigorous proofs of them are postponed to the appendices.

Theorem 4. For each 𝜋∈(2^𝐴𝑃)^𝜔, if 𝜋∈ℒ(𝒯_𝜑), then 𝜋⊨𝜑.

Proof (sketch). Just assume that 𝜎=𝑠₀𝑠₁⋯∈𝑆^𝜔_𝜑 is the corresponding fair path of 𝒯_𝜑 such that 𝜋=𝐿_𝜑(𝜎), where 𝑠_𝑖=⟨Γ_𝑖;𝑃_1,𝑖,…,𝑃_𝑚,𝑖;𝑅_1,𝑖,…,𝑅_𝑛,𝑖⟩. We may inductively prove the following claim.
“For each 𝜓∈sub(𝜑)∪𝑒𝑙(𝜑), we have: Γ_𝑖∈sat(𝜓) implies 𝜋,𝑖⊨𝜓.”
Because we require that Γ₀∈sat(𝜑), hence we have 𝜋,0⊨𝜑.

Theorem 5. For each 𝜋∈(2^𝐴𝑃)^𝜔, if 𝜋⊨𝜑, then 𝜋∈ℒ(𝒯_𝜑).

Proof (sketch). Suppose that 𝜋⊨𝜑; to show 𝜋∈ℒ(𝒯_𝜑), we need to first construct an infinite state sequence 𝜎=𝑠₀𝑠₁⋯∈𝑆^𝜔_𝜑 guided by 𝜋 (the detailed construction is given in Section A.2), and then we will subsequently show that 𝜎 is a fair path of 𝒯_𝜑 and 𝜋=𝐿_𝜑(𝜎).

The following theorem is immediate from Theorems 4 and 5.

Theorem 6. The model ℳ violates the ETL_𝑙+𝑓 property 𝜑 if and only if ℒ(ℳ)∩ℒ(𝒯_¬𝜑)≠∅, equivalently; there exists some fair path in ℳ×𝒯_¬𝜑.

Theorem 7. For an ETL_𝑙+𝑓 formula 𝜑, its tableau 𝒯_𝜑 has at most 4^|el(𝜑)| states.

Proof. Observe that a state should be of the form ⟨Γ;𝑃₁,…,𝑃_𝑚;𝑅₁,…,𝑅_𝑛⟩. For Γ, there are 2^|el(𝜑)| possible choices. Suppose that 𝜓_𝑗=𝒜_𝑗(𝜑₁,…,𝜑_𝑘) (resp., ¬𝜂_𝑖=¬𝒜_𝑖(𝜑^′₁,…,𝜑^′_𝑟)) and the state set of 𝒜_𝑗 is 𝑄_𝑗 (resp., 𝒜_𝑖 with 𝑄^′_𝑖). According to the construction, each 𝑞∈𝑄_𝑗 (resp., 𝑞∈𝑄^′_𝑖) corresponds to a unique elementary formula ○𝒜^𝑞_𝑗(𝜑₁,…,𝜑_𝑘) (resp., ○𝒜^𝑞_𝑖(𝜑^′₁,…,𝜑^′_𝑟)), and such a mapping is an injection. Hence we have _{1≤𝑗≤𝑚}𝑄_𝑗+_{1≤𝑖≤𝑛}𝑄^′_𝑖≤el𝜑⧵𝐴𝑃. (4) Note that 𝑃_𝑗⊆𝑄_𝑗 (resp., 𝑅_𝑖⊆𝑄^′_𝑖), and hence we have |𝑆_𝜑|≤(2^|el(𝜑)|)²=4^|el(𝜑|).

3.2. The Linear Semantic Encoding

Practically, a model’s state space is determined by the evaluation of a set of variables. Further, we may assume that each of them is a “Boolean variable” (which corresponds to a proposition belonging to 𝐴𝑃), because every variable over finite domain could be encoded with several Boolean variables.

Let 𝒞=⟨𝑆,𝜌,𝐼,𝐿,ℱ⟩ be an arbitrary LTS, and we also assume that the corresponding variable set is 𝑉={𝑝₁,…,𝑝_𝑛}; then each state 𝑠∈𝑆 uniquely corresponds to an assignment of such 𝑝_𝑖s.

If we use 𝑠(𝑝_𝑖) to denote the value of 𝑝_𝑖 at 𝑠, then each subset 𝑍⊆𝑆 can be represented by a Boolean formula Φ_𝑍 over 𝑉. In detail, it fulfills 𝑠∈𝑆⟺𝑠⊩Φ_𝑍, (5) where 𝑠⊩Φ_𝑍 means that Φ_𝑍 is evaluated to be true if we assign each 𝑝_𝑖 with the value 𝑠(𝑝_𝑖).

Let 𝑉^′={𝑝^′₁,…,𝑝^′_𝑛}, and each binary relation 𝜆⊆𝑆×𝑆 also has a Boolean representation Φ_𝜆 over the variable set 𝑉∪𝑉^′. That is, 𝑠₁,𝑠₂∈𝜆⟺𝑠₁,𝑠₂⊩Φ_𝜆, (6) where (𝑠₁,𝑠₂)⊩Φ_𝜆 means that Φ_𝜆 is evaluated to be true if we assign each 𝑝_𝑖 with 𝑠₁(𝑝_𝑖) and assign each 𝑝^′_𝑖 with 𝑠₂(𝑝_𝑖).

Hence, all components of ℳ can be encoded: 𝐼 and 𝜌 can be represented by two Boolean formulae Φ_𝐼 and Φ_𝜌, respectively; we subsequently create a Boolean formula Φ_𝐹 for each 𝐹∈ℱ; note that the labeling function 𝐿 is not concerned any longer, because the sates labeled with 𝑝 can be captured by the Boolean formula 𝑝.

For example, from Theorem 7, we have that the symbolic representation of 𝒯_𝜑 requires 2×|el(𝜑)⧵𝐴𝑃|  new Boolean variables—because variables in el(𝜑)∩𝐴𝑃 can be shared with the encoding of the original model.

A canonical Boolean encoding of fair path existence detection upon LTSs is presented in [22]: given a model 𝒞=⟨𝑆,𝜌,𝐼,𝐿,ℱ⟩ and a bound 𝑘∈ℕ, one may use the formula Φ_𝐼⁽⁰⁾∧_{0≤𝑖<𝑘}Φ_𝜌^{(𝑖,𝑖+1)}∧_{0≤ℓ≤𝑘}Φ_𝜌^(𝑘,ℓ)∧_{𝐹∈ℱℓ≤𝑗≤𝑘}Φ_𝐹^(𝑗), (7) where Φ_𝐼^(𝑗) and Φ_𝐹^(𝑗) are, respectively, the Boolean formulae obtained from Φ_𝐼 and Φ_𝐹 by replacing each variable 𝑝 with a new copy 𝑝^(𝑗), and Φ_𝜌^(𝑖,𝑗) is obtained from Φ_𝜌 by replacing each 𝑝 with 𝑝^(𝑖) and replacing each 𝑝^′ with 𝑝^(𝑗).

It can be seen that this formula is satisfiable if and only if 𝒞 involves a fair path of the form 𝑠₀𝑠₁⋯𝑠_ℓ−1(𝑠_ℓ⋯𝑠_𝑘)^𝜔 (call it is of the lasso shape). Since that ℒ(𝒞)≠∅ if and only if 𝒞 contains some lasso fair path (note that from each fair path we may derive another fair path of lasso shape), hence we may convert the fair path detection into the satisfiability problem of the above Boolean formula.

However, a closer look shows that the size of such encoding is quadratic with the bound. To reduce the blow-up in size, we need to introduce the following new variables (the linearization can also be done with the syntactic fashion presented in [23, 24]. We would draw a comparison of these two approaches in Section 4.).  (1) For each 0≤ℓ≤𝑘, we introduce a new variable 𝑟_ℓ. Intuitively, 𝑟_ℓ indicates that 𝑠_ℓ is a successor of 𝑠_𝑘. (2) For each fairness constraint 𝐹∈ℱ and each 0≤ℓ≤𝑘, we introduce a variable 𝑓_𝐹^(ℓ), and this variable is evaluated to be true only if there is some Φ_𝐹^(𝑗) which is evaluated to true, where ℓ≤𝑗≤𝑘.

And the new encoding (with the bound 𝑘∈ℕ) can be formulated as Φ_𝐼⁽⁰⁾∧_{0≤𝑖<𝑘}Φ_𝜌^{(𝑖,𝑖+1)}∧_{0≤ℓ≤𝑘}𝑟_ℓ,Ψ_𝒞^(𝑘)=∧_{0≤ℓ≤𝑘}𝑟_ℓ⟶Φ_𝜌^(𝑘,ℓ)∧_𝐹∈ℱ𝑓_𝐹^(ℓ)∧_{𝐹∈ℱ0≤𝑖<𝑘}𝑓_𝐹^(𝑖)⟶𝑓_𝐹^(𝑖+1)∨Φ_𝐹^(𝑖)∧𝑓_𝐹^(𝑘)⟶Φ_𝐹^(𝑘). (8)

Hence, both the number of variables and the size of this encoding are linear with 𝑘. Moreover, the following theorem guarantees the correctness of such encoding.

Theorem 8. ℒ(𝒞)≠∅ if and only if  Ψ_𝒞^(𝑘) is satisfiable for some 𝑘.

Proof. We begin with the “if” direction: suppose that the variable set is {𝑝₁,…,𝑝_𝑚}; if there is some 𝑘 such that Ψ^𝑘_𝒞 is evaluated to 1 (i.e., true) under the assignment 𝑒, then we denote 𝑠_𝑖=(𝑒(𝑝₁^(𝑖)),…,𝑒(𝑝_𝑚^(𝑖))) for each 1≤𝑖≤𝑚. Hence, each 𝑠_𝑖 is a state of 𝒞. (i)Since the truth value of Φ_𝐼⁽⁰⁾ is 1 under 𝑒, then we have 𝑠₀⊩Φ_𝐼⁽⁰⁾; this implies that 𝑠₀∈𝐼. (ii)For each 0≤𝑖<𝑘, we have (𝑠_𝑖,𝑠_𝑖+1)⊩Φ_𝜌^{(𝑖,𝑖+1)}, and thus (𝑠_𝑖,𝑠_𝑖+1)∈𝜌. (iii)Because we have the conjunct ⋁_0≤ℓ𝑟_ℓ, then there is some 0≤ℓ≤𝑘 such that 𝑒(𝑟_ℓ)=1. In the following, we fix this specific value ℓ for the discussion. (iv)According to the constraint 𝑟_ℓ→(Φ_𝜌^(𝑘,ℓ)∧⋀_𝐹∈ℱ𝑓_𝐹^(ℓ)), we have the following. (1) 𝑒(Φ_𝜌^(𝑘,ℓ))=1, which indicates that (𝑠_𝑘,𝑠_ℓ)∈𝜌. (2)For each 𝐹∈ℱ, we have 𝑒(𝑓_𝐹^(ℓ))=1. (v)For each fairness constraint 𝐹∈ℱ and 0≤𝑖≤𝑘, we now inductively show that “𝑒(𝑓_𝐹^(𝑖))=1 implies 𝑒(Φ_𝐹^(𝑗))=1 (alternatively, 𝑠_𝑗∈𝐹) for some 𝑖≤𝑗≤𝑘.” First of all, it holds in the case of 𝑖=𝑘, because we have the constraint 𝑓^(𝑘)→Φ_𝐹^(𝑘). In addition, the fact of “when 𝑖=𝑐, it holds” can be immediately inferred from the hypothesis “when 𝑖=𝑐+1, it holds,” according to the conjunct 𝑓_𝐹^(𝑖)→(𝑓_𝐹^(𝑖+1)∨Φ_𝐹^(𝑖)). Since we have shown that 𝑒(𝑓_𝐹^(ℓ))=1, we can conclude that there exists some ℓ≤𝑗≤𝑘 such that 𝑠_𝑗∈𝐹.
The above shows that 𝑠₀𝑠₁⋯𝑠_ℓ−1(𝑠_ℓ⋯𝑠_𝑘)^𝜔 is a fair path of 𝒞, and hence ℒ(𝒞)≠∅.
Conversely, for the “only if” direction, it suffices to find some 𝑘 and some assignment 𝑒 evaluating Ψ_𝒞^(𝑘) to be true. Since ℒ(𝒞)≠∅, there must exist some fair path of lasso shape in 𝒞. Without loss of generality, assume that 𝜎=𝑠₀𝑠₁⋯𝑠_ℓ−1(𝑠_ℓ⋯𝑠_𝑘)^𝜔 is such a path; just let 𝑘 be this value, and we now illustrate how the assignment 𝑒 is constructed. (i)For each variable 𝑝_𝑗 and each 𝑖≤𝑘, let 𝑒(𝑝_𝑗^(𝑖))=𝑠_𝑖(𝑝_𝑗). Since 𝑠₀ is an initial state, according to the definition, we have 𝑒(Φ_𝐼⁽⁰⁾)=1. Meanwhile, because each (𝑠_𝑖,𝑠_𝑖+1)∈𝜌, we have that the conjunction ⋀_{0≤𝑖≤𝑘}Φ_𝜌^{(𝑖,𝑖+1)} is satisfied under 𝑒. (ii)For each 0≤𝑖≤𝑘, we let 𝑒𝑟_𝑖=1,𝑖=ℓ,0,𝑖≠ℓ. (9) Then it can be seen that 𝑒(⋁_{0≤𝑖≤𝑘}𝑟_𝑖)=1. (iii)For each 𝐹∈ℱ and each 0≤𝑖≤𝑘, we let 𝑒𝑓_𝐹^(𝑖)=1,ifthereissome𝑗≥𝑖suchthat𝑠_𝑗∈𝐹,0,otherwise. (10) Then it can be directly checked that the conjunct _{𝐹∈ℱ0≤𝑖<𝑘}𝑓_𝐹^(𝑖)⟶𝑓_𝐹^(𝑖+1)∨Φ_𝐹^(𝑖)∧𝑓_𝐹^(𝑘)⟶Φ_𝐹^(𝑘) (11) is evaluated to be true under 𝑒. (iv)Since (𝑠_𝑘,𝑠_ℓ)∈𝜌, we have 𝑒(Φ_𝜌^(𝑘,ℓ))=1. Also note that 𝜎 is a fair path; then for each 𝐹∈ℱ there is some 𝑠_𝑗∈𝐹, where ℓ≤𝑗≤𝑘. According to the previous definition, we can infer that 𝑒(⋀_𝐹∈ℱ𝑓_𝐹^(ℓ))=1. Thus the conjunct _{0≤𝑖≤𝑘}𝑟_𝑖⟶Φ_𝜌^(𝑘,𝑖)∧_𝐹∈ℱ𝑓_𝐹^(𝑖) (12) is also satisfied under 𝑒 (recall that we have assigned 𝑒(𝑟_𝑖)=0 in the case of 𝑖≠ℓ).

Thus, the formula Ψ_𝒞^(𝑘) is satisfiable.

For bounded model checking, an important issue is the completeness threshold, which is the specific value 𝑘 such that we may declare ℒ(𝒞)=∅ in the case that Ψ_𝒞^(𝑘) is not satisfiable, and we denote it by CT(𝒞) in this paper.

Since we need only to concern about fair paths of the form 𝜎₁(𝜎₂)^𝜔, as pointed in [22], a possible candidate for the completeness threshold CT(𝒞) is 𝐷^𝐼(𝒞)+|ℱ|×𝐷(𝒞), (13) where 𝐷 and 𝐷^𝐼 are, respectively, the diameter and the initialized diameter (cf. [22]). Since [22] just considers LTSs having only one fairness constraint, we here add the factor |ℱ|.

Observe that the part 𝜎₂ must be enclosed in some SCC (i.e., strongly connected component) of 𝒞, and we may replace 𝐷(𝒞) with 𝐷(𝒮), where 𝒮 is the largest SCC that intersects all fairness constraints. Therefore, we may get a more compact upper bound of the completeness threshold.

Then, for a given LTS ℳ and the given ETL_𝑙+𝑓 formula 𝜑, since we have shown that ℳ⊭𝜑 if and only if ℳ×𝒯_¬𝜑 involves some fair path, we now just need to test if there is some 𝑘 making Ψ^(𝑘)_{ℳ×𝒯¬𝜑} satisfiable, where 𝑘≤CT(ℳ×𝒯_¬𝜑).

Remark 9. In the case that 𝒞=𝒞₁×𝒞₂, where 𝒞=⟨𝑆,𝜌,𝐼,𝐿,ℱ⟩ and 𝒞_𝑖=⟨𝑆_𝑖,𝜌_𝑖,𝐼_𝑖,𝐿_𝑖,ℱ_𝑖⟩ for 𝑖=1,2, we have Φ_𝐼=Φ_𝐼1∧Φ_𝐼2, Φ_𝜌=Φ_𝜌1∧Φ_𝜌2, and Φ_ℱ=Φ_ℱ1∪Φ_ℱ1, and in addition, the variable set of 𝒞 is just the union of the variable sets of 𝒞₁ and 𝒞₂.

Remark 10. Actually, for an ETL_𝑙+𝑓 formula 𝜑, the symbolic representation of 𝒯_𝜑 can be directly given without the detour of explicit construction of the LTS. Because, the relation sat could be inductively constructed if we introduce corresponding new variables in el(𝜑). Subsequently, encodings of Φ_Δ⁺_𝜓 or Φ_Δ⁻_𝜂 could be naturally obtained from the underlying Boolean variables corresponding to states of automata connectives. Hence, the Boolean representation of Φ_𝜌𝜑 is obtained. And, encodings of other components are as routine.

4. Experimental Results

To justify our idea, we have integrated (the tool is available at https://sourceforge.net/projects/enusmv12/) the ETL_𝑙+𝑓 BMC algorithm into ENuSMV (Ver. 1.2). This tool is completely compatible with NuSMV [25], and it allows end-users to customize new temporal connectives by defining automata.

For example, Figure 1 illustrates how to declare a finite acceptance automata connective (to define a looping acceptance automata connective, just replace the keyword FIN with LOOP), namely, A. Since it has three states q1, q2, and q3 (where q1 is the initial state and q3 is an accepting state), then A[q1], A[q2], and A[q3] are also connectives—for example, A[q2] just replaces the initial state with q2. Subsequently, one may define ETL_𝑙+𝑓 specifications; for example, ETLSPEC A(p,A[q2]  (q,p))is a proper declaration.

Figure 1 

An automata connective declaration in ENuSMV.

In this redistribution, both BDD-based and bounded model checkings for ETL_𝑙+𝑓 are supported. To perform (semantic encoding based) BMC, we need to use the command option bmc_tab.

We have conducted some experiments to test the correctness and efficiency of our algorithm. In this paper, we are especially concerned with the following issues. (1)The comparison of BDD-based symbolic model checking and bounded model checking. (2)The overhead contrast in verifications of ETL_𝑓 and ETL_𝑙+𝑓 upon both star-free and nonstar-free properties. (3)The comparison of performances with syntactic/semantic BMC of LTL and semantic BMC of ETL_𝑙+𝑓.

To compare the efficiencies between BDD-based MC and BMC, we chose the (distributed mutual exclusion) DME circuit as the model (which involves a buggy design), as described in [3]. It consists of 𝑛 cells for 𝑛 users that want to have exclusive access to a shared resource. We conducted the experiment by describing the liveness property that “a request for using the resource will eventually be acknowledged” (with ETL_𝑙+𝑓 formula). The max bound are set to 100, and the comparative results are shown in Table 1, where “C.L." stands for the length of counterexample.

Table 1 

Comparative results of BDD-based and BMC approaches.

As a previous work, we have implemented the symbolic model checking algorithm for ETL_𝑓 in ENuSMV 1.0. To justify that in general ETL_𝑙+𝑓 could be more effectively checked, we would make a comparison of BMC for ETL_𝑓 and ETL_𝑙+𝑓.

To draw the comparison upon non-start-free regular properties, we use a “mod 2^𝑛 counter” as the model. The model consists of 𝑛 “cells” bit_0,…,bit_n-1. Each cell is a (mod2) counter having an input carry_in and an output signal carry_out. These cells are connected in a serial manner; that is, bit_0’s carry_in is set to 1, and bit_i’s carry_in is connected to bit_i−1’s carry_out as described in Figure 2.

Figure 2 

The circuit of MOD 2𝑛 counter.

We, respectively, describe the periodicity property that “bit_0 carries out at every even (except for 0) moment” with ETL_𝑓 and ETL_𝑙+𝑓. We set the time bound to 1 hour, and Table 2 provides the max bounds (together with related information) which can be handled by the SAT solver within the time bound. From it, we can see that a deeper search could be done when specifications are described with ETL_𝑙+𝑓.

Table 2 

Comparison of ETL_𝑓 and ETL_𝑙+𝑓 with periodicity properties.

To compare the overhead of ETL_𝑓 and ETL_𝑙+𝑓 upon star-free properties, we would first use the DME model to check the safety property: “no two cells will be simultaneously acknowledged.” The results are shown in Table 3, and the time bound is also set to 1 hour.

Table 3 

Comparison of ETL_𝑓 and ETL_𝑙+𝑓 with safety properties.

At the same time, we can also compare the verification performances of the DME model upon the aforementioned liveness property that “each request will be acknowledged in the further.” Note that for this property, the verification could be accomplished within the given time bound, and a counterexample could be detected at the bound 𝑘=39. The comparative results are given in Table 4.

Table 4 

Comparison of ETL_𝑓 and ETL_𝑙+𝑓 with liveness properties.

The last group of experiments aims at comparing the efficiencies of (syntactic/semantic) LTL BMC and ETL_𝑙+𝑓 BMC. First of all, for LTL BMC, we are also concerned with two types of encoding approaches. (1)The Syntactic Approach. We here adopt the linear incremental syntactic encoding proposed in [26]—to the best of our knowledge, this is the most effective syntactic encoding for full LTL. (2)The Semantic Approach. ENuSMV 1.2 also supports semantic encoding for LTL—this is tailored from our linear encoding presented in Section 3.2.

We still use the DME circuit as the model and the liveness property as specification; Table 5 provides the experimental results on LTL BMC based on syntactic and semantic encodings. From that, we can see that, with semantic encoding, it tends to generate less clauses and tends to terminate earlier than that with the syntactic encoding, whereas the latter requires fewer variables.

Table 5 

Comparison of syntactic/semantic LTL BMC with liveness properties.

Meanwhile, we can also make a comparison between Tables 4 and 5; we may find that the variable numbers of semantic ETL BMC and LTL BMC are almost at a fixed ratio—for this experiment, the ratio is 1.09 (approximately).

5. Concluding Remarks

The logic ETL_𝑙+𝑓 is a variant of extended temporal logic, it employs both finite and looping acceptance automata connectives, and it can be considered a mixture of ETL_𝑙 and ETL_𝑓. Thus, any omega-regular properties can be succinctly described with this kind of logic, particularly for safety and liveness properties.

We have presented the semantic bounded model checking algorithm for ETL_𝑙+𝑓. The central part of this approach is the tableau construction. Meanwhile, we also illustrate how to give a linear BMC encoding for it. To justify it, we have implemented the presented algorithm (in ENuSMV 1.2). Experimental results show that ETL_𝑙+𝑓 could be more efficiently verified via BMC (in comparison to our previous implementation for ETL_𝑙+𝑓).

In this paper, verification of ETL_𝑟, namely, extended temporal logic using Büchi (alternatively, repeating) automata as connectives, has not been studied. This is partly because of the inherited difficulties of Büchi complementation [27]. Indeed, we may mimic the ranking complementing technique of Büchi automata [28–30]. However, this would cause an asymptotically quadratic blow-up of variable number in building the tableaux. Hence, a further work is about to study the semantic BMC encodings of ETL_𝑟.

Appendix

A. Omitted Proofs

A.1. Proof of Theorem 4

Just assume that 𝜎=𝑠₀𝑠₁⋯∈𝑆^𝜔_𝜑 is the corresponding fair path of 𝒯_𝜑 having 𝜋=𝐿_𝜑(𝜎), where 𝑠_𝑖=⟨Γ_𝑖;𝑃_1,𝑖,…,𝑃_𝑚,𝑖;𝑅_1,𝑖,…,𝑅_𝑛,𝑖⟩. We now inductively prove the following claim.  “For each 𝜓∈sub(𝜑)∪el(𝜑), we have: Γ_𝑖∈sat(𝜓) implies 𝜋,𝑖⊨𝜓.”

(i) The basic cases are trivial. (a) 𝜓=⊤, or 𝜓=⟂. Since 𝜋,𝑖⊨⊤ holds trivially, the case Γ_𝑖∈sat(⟂) never happens. (b) 𝜓=𝑝, or 𝜓=¬𝑝, where 𝑝∈𝐴𝑃. Because Γ_𝑖∈sat(𝑝) if and only if 𝑝∈Γ_𝑖 if and only if 𝑝∈𝜋(𝑖) if and only if 𝜋,𝑖⊨𝑝. Similar to show it when 𝜓=¬𝑝.

(ii) The following inductions are as routine. (a)For the case 𝜓=𝜓₁∧𝜓₂, or 𝜓₁∨𝜓₂. For the first case, we have Γ_𝑖∈sat(𝜓) if and only if Γ_𝑖∈Sat(𝜓₁) and Γ_𝑖∈sat(𝜓₂); by induction, we have 𝜋,𝑖⊨𝜓₁ and 𝜋,𝑖⊨𝜓₂; hence 𝜋,𝑖⊨𝜓; similar to the case of 𝜓=𝜓₁∨𝜓₂. (b)In the case of 𝜓=○𝜓^′, we have Γ_𝑖∈sat(𝜓) if and only if Γ_𝑖+1∈sat(𝜓^′), according to the definition of Δ_𝜑 (note that in this case 𝜓 is an elementary formula of 𝜑). By induction, we have 𝜋,𝑖+1⊨𝜓^′; hence 𝜋,𝑖⊨𝜓.

(iii) If 𝜓=𝒜^𝑞(𝜑₁,…,𝜑_𝑘) is a PF-subformula, without loss of generality, assume 𝜓=𝜓_𝑗 (i.e., the 𝑗th PF-subformula of 𝜑), where 1≤𝑗≤𝑚 and 𝒜^𝑞=⟨{𝑎₁,…,𝑎_𝑘},𝑄,𝛿,𝑞,𝐹⟩, then the proof is given as follows.

Since 𝜎 is a fair path, there exists 𝑖₂>𝑖₁>𝑖, such that 𝑃_𝑗,𝑖1=𝑃_𝑗,𝑖2=∅ and 𝑃_𝑗,𝑐≠∅ for each 𝑖₁<𝑐<𝑖₂. (a)First, let 𝑞₀=𝑞; then we have Γ_𝑖∈sat(𝒜^𝑞0(𝜑₁,…,𝜑_𝑘)). (b)For each 𝑡≤𝑖₁−𝑖, if 𝑞_𝑡∉𝐹 and Γ_𝑖+𝑡∈sat(𝒜^𝑞𝑡(𝜑₁,…,𝜑_𝑘)), then, according to the definition of sat, there is some 1≤𝑘_𝑡≤𝑘 and a 𝑞^′ such that Γ_𝑖+𝑡∈sat(𝜑_𝑘𝑡), 𝑞^′∈𝛿(𝑞_𝑡,𝑎_𝑘𝑡), and Γ_𝑖+𝑡∈sat(○𝒜^𝑞′(𝜑₁,…,𝜑_𝑘)) (equivalently, Γ_𝑖+𝑡+1∈sat(𝒜^𝑞′(𝜑₁,…,𝜑_𝑘)), as discussed above). Now, we let 𝑞_𝑡+1=𝑞^′.

Till now, if there is some 𝑡 having 𝑞_𝑡∈𝐹, we stop the processing. Otherwise, we go on with the following processing. (a)When 𝑡=𝑖₁−𝑖+1, we have Γ_𝑡∈sat(𝒜^𝑞𝑡(𝜑₁,…,𝜑_𝑘)). Since 𝑃_𝑗,𝑖1=∅, according to the definition of Δ⁺_𝜓𝑗, we have 𝑞_𝑡∈𝑃_𝑗,𝑖1+1=𝑃_{𝑗,𝑖+𝑡}. (b)For each 𝑖₁−𝑖<𝑡≤𝑖₂−𝑖, if 𝑞_𝑡∈𝑃_{𝑗,𝑖+𝑡} and 𝑞_𝑡∉𝐹, according to Δ⁺_𝜓𝑗, there is some 1≤𝑘_𝑡≤𝑘, such that Γ_𝑖+𝑡∈sat(𝜑_𝑘𝑡), and there is some 𝑞^′∈𝑃_{𝑗,𝑖+𝑡+1}∩𝛿(𝑞_𝑡,𝑎_𝑘𝑡). Now, we let 𝑞_𝑡+1=𝑞^′.

Notice that 𝑃_𝑗,𝑖2=∅, and we have the inductive assertion that 𝑞_𝑡∉𝐹 implies 𝑞_𝑡∈𝑃_{𝑗,𝑖+𝑡}; hence there must exist some 𝑞_𝑡∈𝐹.

Thus, 𝒜 have some accepting prefix 𝑎_𝑘0𝑎_𝑘1⋯𝑎_𝑘ℓ of some infinite word. On the other hand, by induction, Γ_𝑖+𝑡∈sat(𝜑_𝑘,𝑡) implies 𝜋,𝑖+𝑡⊨𝜑_𝑘𝑡. Hence, we have 𝜋,𝑖⊨𝜓 by definition.

(iv) If 𝜓=¬𝒜^𝑞(𝜑₁,…,𝜑_𝑘) is an NF-subformula of 𝜑 and assume that 𝒜^𝑞=⟨{𝑎₁…,𝑎_𝑘},𝑄,𝛿,𝑞,𝐹⟩, then the proof is given as below.

Assume by contradiction it is not the case; then 𝜋,𝑖⊨𝒜^𝑞(𝜑₁,…,𝜑_𝑘) holds. Therefore, there exist some accepting prefix 𝑎_𝑘0𝑎_𝑘1⋯𝑎_𝑘ℓ of some infinite word and a state sequence 𝑞₀𝑞₁⋯𝑞_ℓ𝑞_ℓ+1 such that (a)𝑞₀=𝑞,  𝑞_ℓ+1∈𝐹 and each 𝑞_𝑡+1∈𝛿(𝑞_𝑡,𝑎_𝑘𝑡), (b)for each 𝑡≤ℓ, we have 𝜋,𝑖+𝑡⊨𝜑_𝑘𝑡.

Then, we have the following facts. (a)Γ_𝑖+ℓ+1∈sat(𝒜^𝑞ℓ+1(𝜑₁,…,𝜑_𝑘))=2^el(𝜑), because 𝑞_ℓ+1∈𝐹. (b)Assume that Γ_𝑖+𝑡+1∈sat(𝒜^𝑞𝑡+1(𝜑₁,…,𝜑_𝑘)), where 𝑡≤ℓ; then Γ_𝑖+𝑡∈sat(○𝒜^𝑞𝑡+1(𝜑₁,…,𝜑_𝑘)). In addition, 𝜋,𝑖+𝑡⊨𝜑_𝑘𝑡 implies that Γ_𝑖+𝑡∈sat(𝜑_𝑘𝑡)—otherwise (it is not hard to show that if there is an infinite path in 𝒯_𝜑 starting from 𝑠_𝑖+𝑡, then, for each 𝜂, either Γ_𝑖+𝑡∈sat(𝜂) or Γ_𝑖+𝑡∈sat(¬𝜂) holds), Γ_𝑖+𝑡∈sat(¬𝜑_𝑘𝑡); then we have 𝜋,𝑖+𝑡⊨¬𝜑_𝑘𝑡 by induction contradicts! Hence, by the definition of sat, we have Γ_𝑖+𝑡∈sat(𝒜^𝑞𝑡(𝜑₁,…,𝜑_𝑘)).

Then, we have Γ_𝑖∈sat(𝒜^𝑞0(𝜑₁,…,𝜑_𝑘)) when 𝑡=0. However, it contradicts the premiss Γ_𝑖∈sat(¬𝒜^𝑞(𝜑₁,…,𝜑_𝑛)), because 𝑞₀=𝑞. Therefore, the assumption 𝜋,𝑖⊨𝒜^𝑞(𝜑₁,…,𝜑_𝑘) is a falsity, and this implies that 𝜋,𝑖⊨𝜓 holds.

(v) If 𝜓=𝒜^𝑞(𝜑₁,…,𝜑_𝑘) is a PL-subformula of 𝜑, where 𝒜^𝑞=({𝑎₁,…,𝑎_𝑘},𝑄,𝛿,𝑞,𝐹), then we have the following proof in the case that Γ_𝑖∈sat(𝜓). (a)Let 𝑞₀=𝑞, and Γ_𝑖∈sat(𝒜^𝑞0(𝜑₁,…,𝜑_𝑘)). (b)For each 𝑡≥0, assume that Γ_𝑖+𝑡∈sat(𝒜^𝑞𝑡(𝜑₁,…,𝜑_𝑘)); then by the definition of sat, there is some 1≤𝑘_𝑡≤𝑘, such that Γ_𝑖+𝑡∈sat(𝜑_𝑘𝑡), and there is some 𝑞^′∈𝛿(𝑞_𝑡,𝑎_𝑘𝑡) such that 𝑠𝑎𝑡(○𝒜^𝑞′(𝜑₁,…,𝜑_𝑘)) (equivalently, Γ_𝑖+𝑡+1∈sat(𝒜^𝑞′(𝜑₁,…,𝜑_𝑘)) holds). Now, we let 𝑞_𝑡+1=𝑞^′.

Hence, we have an accepting run of 𝒜^𝑞 over the infinite word 𝑎_𝑘0𝑎_𝑘1⋯. Meanwhile, by induction, Γ_𝑖+𝑡∈sat(𝜑_𝑘𝑡) implies that 𝜋,𝑖+𝑡⊨𝜑_𝑘𝑡. By definition, we have 𝜋,𝑖⊨𝜓 in this case.

(vi) Lastly, consider the case 𝜓=¬𝒜^𝑞(𝜑₁,…,𝜑_𝑘), where 𝒜^𝑞=⟨{𝑎₁,…,𝑎_𝑘},𝑄,𝛿,𝑞,𝐹⟩ is a looping acceptance automaton.

Suppose that Γ_𝑖∈sat(𝜓), and assume by contradiction that 𝜋,𝑖⊭𝜓; then there is an infinite word 𝑤=𝑎_𝑘0𝑎_𝑘1⋯∈ℒ(𝒜^𝑞) and 𝜋,𝑖+𝑡⊨𝜑_𝑘𝑡 for each 𝑡≥0. Also, let the corresponding run of 𝒜^𝑞 on 𝑤 is 𝑞₀𝑞₁⋯, where 𝑞₀=𝑞.

Without loss of generality, suppose that 𝜓=¬𝜂_𝑗 (i.e., the 𝑗th NL-subformula); since 𝜎 is a fair path, there must exist some 𝑖₂>𝑖₁>𝑖 such that 𝑅_𝑗,𝑖1=𝑅_𝑗,𝑖2=∅ and 𝑅_𝑗,𝑐≠∅ for each 𝑖₁<𝑐<𝑖₂. Then(a)Γ_𝑖∈sat(¬𝒜^𝑞0(𝜑₁,…,𝜑_𝑘)), because 𝑞₀=𝑞, (b)as discussed before (in the case of NF-subformula), 𝜋,𝑖+𝑡⊨𝜑_𝑘𝑡 implies that Γ_𝑖+𝑡∈sat(𝜑_𝑘𝑡). For each 𝑡>0, if Γ_𝑖+𝑡∈sat(¬𝒜^𝑞𝑡(𝜑₁,…,𝜑_𝑘)) holds, according to the definition of sat, for each 𝑞^′∈𝛿(𝑞_𝑡,𝑎_𝑘𝑡), we have Γ∈_𝑖+𝑡^╱sat(○𝒜^𝑞′(𝜑₁,…,𝜑_𝑘)). Note that 𝑞_𝑡+1∈𝛿(𝑞_𝑡,𝑎_𝑘); hence Γ_𝑖+𝑡+1∈sat(¬𝒜^𝑞𝑡+1(𝜑₁,…,𝜑_𝑘)).

Therefore, we have Γ_𝑖+𝑡∈sat(¬𝒜^𝑞𝑡(𝜑₁,…,𝜑_𝑘)) for each 𝑡≥0.

According to the definition of Δ⁻_¬𝜂𝑗, we have (a)𝑞_{𝑖1+1−𝑖}∈𝑅_𝑗,𝑖1+1, since 𝑅_𝑗,𝑖1=∅, (b)for each 𝑡 having 𝑞_𝑡∈𝑅_{𝑗,𝑖+𝑡}, since Γ_𝑖+𝑡∈sat(𝜑_𝑘𝑡), then 𝑞^′∈𝛿(𝑞_𝑡,𝑎_𝑘𝑡) implies 𝑞^′∈𝑅_{𝑗,𝑖+𝑡+1}. Therefore, 𝑞_𝑡+1∈𝑅_{𝑗,𝑖+𝑡+1}.

The above induction implies that 𝑞_𝑡∈𝑅_{𝑗,𝑖+𝑡} for each 𝑡≥𝑖₁−𝑖+1. However, it is impossible since 𝑅_𝑗,𝑖2=∅. Hence, the assumption 𝜋,𝑖⊨𝒜^𝑞(𝜑₁,…,𝜑_𝑘) is incorrect, which implies that 𝜋,𝑖⊨𝜓 also holds in this case.

Clearly, the above induction is complete. Because we require that Γ₀∈sat(𝜑), we have 𝜋,0⊨𝜑.

A.2. Proof of Theorem 5

Suppose that 𝜋⊨𝜑 to show 𝜋∈ℒ(𝒯_𝜑), we need to first construct an infinite state sequence 𝜎=𝑠₀𝑠₁⋯, where 𝑠_𝑖=⟨Γ_𝑖;𝑃_1,𝑖,…,𝑃_𝑚,𝑖;𝑅_1,𝑖,…,𝑅_𝑛,𝑖⟩∈𝑆_𝜑, and then we will show that 𝜎 is a fair path of 𝒯_𝜑 and 𝜋=𝐿_𝜑(𝜎).

(i) The construction of Γ_𝑖 is as follows.

For each 𝑖≥0, we let Γ_𝑖={𝜓∈el(𝜑)∣𝜋,𝑖⊨𝜓}. We will now show the following claim. “For each 𝜓∈sub(𝜑)∪el(𝜑), we have Γ_𝑖∈sat(𝜓) if and only if 𝜋,𝑖⊨𝜓.”

By induction of the structure of 𝜓 the following hold. (a)Cases are trivial when 𝜓=⟂ or 𝜓=⊤. (b)If 𝜓=𝑝∈𝐴𝑃, then 𝜓∈el(𝜑). Thus, Γ_𝑖∈sat(𝑝) if and only if 𝑝∈Γ_𝑖 if and only if 𝑝∈𝜋(𝑖) if and only if 𝜋,𝑖⊨𝑝. Similar to show the case of 𝜓=¬𝑝.(c)Another basic case is 𝜓=○𝜓^′: note that in this case we also have 𝜓∈el(𝜑); hence Γ_𝑖∈sat(○𝜓^′) if and only if 𝜓∈Γ_𝑖 if and only if 𝜋,𝑖⊨𝜓. (d)If 𝜓=𝜓₁∧𝜓₂, then Γ_𝑖∈sat(𝜓) if and only if Γ_𝑖∈sat(𝜓₁) and Γ_𝑖∈sat(𝜓₂). By induction, we have 𝜋,𝑖⊨𝜓₁ and 𝜋,𝑖⊨𝜓₂ that is, 𝜋,𝑖⊨𝜓. Similar to show the case of 𝜓=𝜓₁∨𝜓₂.(e)If 𝜓=𝒜^𝑞(𝜑₁,…,𝜑_𝑘), where 𝒜^𝑞=⟨{𝑎₁,…,𝑎_𝑘},𝑄,𝛿,𝑞,𝐹⟩ and if 𝒜 is a looping acceptance automaton or a finite acceptance automaton, but 𝑞∈^╱𝐹, it is not difficult to show that 𝒜^𝑞𝜑₁,…,𝜑_𝑘⟷_{1≤𝑡≤𝑘}𝜑_𝑡∧_{𝑞′∈𝛿𝑞,𝑎𝑡}○𝒜^𝑞′𝜑₁,…,𝜑_𝑘. (A.1) Then by induction and according to the scheme sat(𝜓^′∨𝜓^′′)=sat(𝜓^′)∪sat(𝜓^′′) and sat(𝜓^′∧𝜓^′′)=sat(𝜓^′)∩sat(𝜓^′′), we have 𝜋,𝑖⊨𝜓 if and only if Γ_𝑖∈_{1≤𝑡≤𝑘}sat𝜑_𝑡∩_{𝑞′∈𝛿𝑞,𝑎𝑡}sat○𝒜^𝑞′𝜑₁,…,𝜑_𝑘=sat𝒜^𝑞𝜑₁,…,𝜑_𝑘. (A.2) Otherwise, if 𝒜 is a finite acceptance automaton and 𝑞∈𝐹, then 𝒜^𝑞𝜑₁,…,𝜑_𝑘⟷⊤. (A.3) In this case, sat(𝒜^𝑞(𝜑₁,…,𝜑_𝑘))=2^el(𝜑), and hence the claim “𝜋,𝑖⊨𝜓 if and only if Γ_𝑖∈sat(𝜓)” also holds. (f)If 𝜓=¬𝒜^𝑞(𝜑₁,…,𝜑_𝑘), then Γ_𝑖∈sat(𝜓) if and only if Γ∈_𝑖^╱sat(𝒜^𝑞(𝜑₁,…,𝜑_𝑘)) if and only if 𝜋,𝑖⊭𝒜^𝑞(𝜑₁,…,𝜑_𝑘) if and only if 𝜋,𝑖⊨𝜓.

Now, we have the following properties. (1)Since 𝜋,0⊨𝜑, we have Γ₀∈sat(𝜑), and hence 𝑠₀∈𝐼_𝜑. (2)For each 𝑖 and each ○𝜓∈el(𝜑), we have Γ_𝑖∈sat(○𝜓) if and only if 𝜋,𝑖⊨○𝜓 if and only if 𝜋,𝑖+1⊨𝜓 if and only if Γ_𝑖+1∈sat(𝜓). (3)For each 𝑝∈𝐴𝑃 and each 𝑖, we have 𝑝∈𝜋(𝑖) if and only if 𝜋,𝑖⊨𝑝 if and only if 𝑝∈Γ_𝑖. Hence, 𝜋(𝑖)=Γ_𝑖∩𝐴𝑃.

(ii) The construction of 𝑃_𝑗,𝑖, for 1≤𝑗≤𝑚 is as follows.

Assume that the 𝑗th PF-subformula 𝜓_𝑗=𝒜^𝑞(𝜑₁,…,𝜑_𝑘) and the automata connective 𝒜^𝑞=⟨{𝑎₁,…,𝑎_𝑘},𝑄,𝛿,𝑞,𝐹⟩; then the construction is as follows. (a)We will find a series of “key positions” ℓ₀,ℓ₁,…, having 𝑃_𝑗,ℓ𝑡=∅ for each ℓ_𝑡. First, let ℓ₀=0, and, for each 𝑡≥0, once ℓ_𝑡 has been determined, we use the following two steps to determine ℓ_𝑡+1 and each 𝑃_𝑗,𝑐 for ℓ_𝑡<𝑐<ℓ_𝑡+1. (b)Let 𝑃_𝑗,ℓ𝑡=∅, and let 𝑃_{𝑗,ℓ𝑡+1}={𝑞^′∣𝜋,ℓ_𝑡+1⊨𝒜^𝑞′(𝜑₁,…,𝜑_𝑘)}. For each 𝑞^′∈𝑃_{𝑗,ℓ𝑡+1}, there must exit a finite word 𝑤_𝑞′=𝑎_𝑘0𝑎_𝑘1⋯𝑎_𝑘𝑠 and a finite state sequence 𝜒_𝑞′=𝑞₀𝑞₁⋯𝑞_𝑠+1 such that 𝑞₀=𝑞^′, 𝑞_𝑠+1∈𝐹, and, for each 𝑐≤𝑠, we have 𝑞_𝑐+1∈𝛿(𝑞_𝑐,𝑎_𝑘𝑐) and 𝜋,ℓ_𝑡+𝑐+1⊨𝜑_𝑘𝑠 (equivalently, Γ_{ℓ𝑡+𝑐+1}∈sat(𝜑_𝑘𝑠)). (c)Now, let ℓ_𝑡+1=ℓ_𝑡+max{|𝜒_𝑞′|∣𝑞^′∈𝑃_{𝑗,ℓ𝑡+1}}+1. And we let 𝑃_𝑗,𝑐=𝜒_𝑞′𝑐−ℓ_𝑡−1𝜒_𝑞′>𝑐−ℓ_𝑡−1 (A.4) for each ℓ_𝑡+1<𝑐<ℓ_𝑡+1, where 𝜒_𝑞′(𝑠) is the 𝑠th element of 𝜒_𝑞′.

Now, it is not hard to check that ((Γ_𝑖,𝑃_𝑗,𝑖),(Γ_𝑖+1,𝑃_𝑗+1))∈Δ⁺_𝜓𝑗 for each 𝑖. Moreover, for each 𝑡, we have 𝑃_𝑗,ℓ𝑡=∅.

(iii) The construction of 𝑅_𝑗,𝑖 for each 1≤𝑗≤𝑛 is as follows.

Assume that the 𝑗th NL-subformula ¬𝜂_𝑗=¬𝒜^𝑞(𝜑₁,…,𝜑_𝑘) and the automata connective 𝒜^𝑞=⟨{𝑎₁,…,𝑎_𝑘},𝑄,𝛿,𝑞,𝐹⟩; then the construction is as follows. (a)First, let ℓ₀=0, and, for each 𝑡≥0, once ℓ_𝑡 is decided, we use the following steps to determine ℓ_𝑡+1 and each set 𝑅_𝑗,𝑐 for ℓ_𝑡<𝑐<ℓ_𝑡+1. (b)Let 𝑅_𝑗,ℓ𝑡=∅, and let 𝑅_{𝑗,ℓ𝑡+1}={𝑞^′∣Γ_ℓ𝑡+1∈sat(¬𝒜^𝑞′(𝜑₁,…,𝜑_𝑘))}. For each 𝑐≥ℓ_𝑡+1, let 𝑅_𝑗,𝑐+1=_{𝑞′∈𝑅𝑗,𝑐}𝛿𝑞^′,𝑎_𝑠∣1≤𝑠≤𝑘,Γ_𝑐∈sat𝜑_𝑠. (A.5)(c)Since we have shown that Γ,𝑖⊨𝜓 if and only if 𝜋,𝑖⊨𝜓 for every 𝜓∈sub(𝜑)∪el(𝜓), it is not hard to show that if 𝑅_{𝑗,ℓ𝑡+1}≠∅, then there is some 𝑐>ℓ_𝑡+1 such that 𝑅_𝑗,𝑐=∅—otherwise (because, if 𝑅_𝑗,𝑐≠∅ for each 𝑡>ℓ_𝑡, using König’s lemma, we may find a run of 𝒜^𝑞′ over some infinite word), we can show 𝜋,ℓ_t+1⊨𝒜^𝑞′(𝜑₁,…,𝜑_𝑘) for some 𝑞^′∈𝑅_{𝑗,ℓ𝑡+1}, and this implies that Γ_ℓ𝑡+1∈sat(𝒜^𝑞′(𝜑₁,…,𝜑_𝑘)), which is contradiction!

If 𝑅_{𝑗,ℓ𝑡+1}=∅, let ℓ_𝑡+1=ℓ_𝑡+1; otherwise, let ℓ_𝑡+1=𝑐.

According to the construction, it can be examined that ((Γ_𝑖,𝑅_𝑗,𝑖),(Γ_𝑖+1,𝑅_𝑗,𝑖+1))∈Δ⁻_¬𝜂𝑗 for each 𝑖. In addition, we have 𝑅_𝑗,ℓ𝑡=∅ for each 𝑡≥0.

Taking all the above into account, by definition, we may conclude that (𝑠_𝑖,𝑠_𝑖+1)∈𝜌_𝜑 for every 𝑖≥0; hence 𝜎 is a fair path of 𝒯_𝜑. According to the construction of Γ_𝑖s, we have that 𝜋=𝐿_𝜑(𝜎); hence 𝜋∈ℒ(𝒯_𝜑).

Acknowledgments

The authors thank the anonymous reviewers for their helpful comments on a previous version of this paper. This work is supported by the NSFC in China under grant number 61103012, 61272335, 61133007, 91118007, 61120106006, the 863 Program 2011AA010106, 2012AA011201, and the Program for New Century Excellent Talents in University.