Modal Mu-Calculi. Julian Bradfield and Colin Stirling. Contents

Transcription

1 Modl Mu-Clculi Julin Brdfield nd Colin Stirling Contents 1 Introduction 2 2 Contextul bckground Modl logics in progrm verifiction Precursors to modl mu-clculus The smll model property 5 3 Syntx nd semntics of modl mu-clculus Fixpoints s recursion Approximting fixpoints nd µ s finitely Syntx of Lµ Semntics of Lµ Exmples Fixpoint regenertion nd the fundmentl semntic theorem Modl eqution systems 12 4 Expressive power CTL nd friends s frgments of Lµ Bisimultion nd tree model property Lµ nd utomt Lµ nd gmes 15 5 Decidbility of stisfibility The conjunctive frgment Towrds utomt Alternting prity utomt Automton norml form 20 6 Complete xiomtiztion 21 7 Alterntion 21 8 Bisimultion invrince Lµ nd MSOL Multi-dimensionl Lµ nd Ptime Bisimultion quntifiers nd interpoltion 25 9 Generlized mu-clculi Lµ with pst Lest fixpoint logic Finite vrible fixpoint logics Gurded frgments Infltionry mu-clculus 27 References 28 Preprint submitted to 15 November 2005

2 1 Introduction Modl mu-clculus is logic used extensively in certin res of computer science, but lso of considerble intrinsic mthemticl nd logicl interest. Its defining feture is the ddition of inductive definitions to modl logic; thereby it chieves gret increse in expressive power, nd n eqully gret increse in difficulty of understnding. It includes mny of the logics used in systems verifiction, nd is quite strightforwrd to evlute. It lso provides one of the strongest exmples of the connections between modl nd temporl logics, utomt theory nd the theory of gmes. In this chpter, we survey rnge of the questions nd results bout the modl mu-clculus nd relted logics. For the most prt, we remin t survey level, giving only outlines of proofs; but in plces, determined prtly by our own interests nd prtly by our sense of which problems hve been or hd been the longeststnding thorns in the side of the mu-clculus community, we go into more detil. We strt with n ccount of the historicl context leding to the introduction of the modl mu-clculus. Then we define the logic formlly, describe some pproches to gining n intuitive understnding of formule, nd estblish the min theorem bout the semntics. Following tht, we discuss how the modl mu-clculus hs the tree model property nd reltes to some other temporl logics, to utomt nd to gmes. Next, n ccount of decidbility is given this is one of the thorns, t lest for those who find utomt prickly. We then consider briefly completeness, bisimultion invrince nd the concept of fixpoint lterntion, which plys prt in severl interesting questions bout the logic. Finlly, we look t some generliztions of the logic. Nottion: Lµ mens the modl mu-clculus, considered s logicl lnguge (not s theory). In generl, the nottion follows s much s possible the stndrds for this book, but becuse Lµ is mostly studied in setting with rther different trditions, nd becuse we lso need to notte severl other concepts, we hve mde some compromises. Few of these should cuse ny difficulty, but let us note the following. Since is often used to represent the trnsition reltion in models (lis the ccessibility reltion from modl logic), we use rther thn for boolen impliction. Structures, frmes nd models for Lµ re usully viewed s trnsition systems, nd so re usully clled T with stte spce S. Sttes within systems (i.e. worlds in the lnguge of modl logic) re typiclly s, t, wheres p, q, r re sttes in n utomton. Hence we write tomic propositions with cpitl P, Q,... rther thn p, q,..., nd similrly vribles rnging over sets of sttes re written X, Y. 2 Contextul bckground The modl mu-clculus comes not from the philosophicl trdition of modl logic, but from the ppliction of modl nd temporl logics to progrm verifiction. In this section, we outline the historicl context for Lµ. 2.1 Modl logics in progrm verifiction The ppliction of modl nd temporl logics to progrms is prt of line of progrm verifiction going bck to the 1960s nd progrm schemes nd Floyd Hore logic. Originlly the emphsis ws on proof : Floyd Hore logic llows one to mke ssertions bout progrms, nd there is proof system to verify these ssertions. This line of work hs, of course, continued nd flourished, nd tody there re highly sophisticted theories for proving properties of progrms, with eqully sophisticted mchine support for these theories. However, the use of proof systems hs some disdvntges, nd one hnkers fter more purely lgorithmic pproch to simple problems. One technique ws pioneered by Mnn nd Pnueli [48], who turned progrm properties into questions of stisfibility or vlidity in first order logic, which cn then be ttcked by mens tht re not just proof-theoretic; this ide ws lter pplied by them to liner temporl logics. During the 1970s, the theory of progrm correctness ws extended by investigting more powerful logics, nd studying them in mnner more similr to the trditions of mthemticl logic. A fmily of logics which 2

3 received much ttention ws tht of dynmic logics, which cn be seen s extending the ides of Hore logic [57]. Dynmic logics re modl logics, where the different modlities correspond to the execution of different progrms the formul α φ is red s it is possible for α to execute nd result in stte stisfying φ. The progrms my be of ny type of interest; the vriety of dynmic logic most often referred to is propositionl lnguge in which the progrms re built from tomic progrms by regulr expression constructors; henceforth, Propositionl Dynmic Logic, PDL, refers to this logic. PDL is interpreted with respect to model on Kripke structure, formlizing the notion of the globl stte in which progrms execute nd which they chnge ech point in the structure corresponds to possible stte, nd progrms determine reltion between sttes giving the chnges effected by the progrms. Once one hs the ide of modl logic defined on Kripke structure, it becomes quite nturl to think of the finite cse nd write progrms which just check whether formul is stisfied. This ide ws developed in the erly 80s by Clrke, Emerson, Sistl nd others. They worked with logic tht hs much simpler modlities thn PDL in fct, it hs just single next stte modlity but which hs built-in temporl connectives such s until. This logic is CTL, nd it nd its extensions remin some of the most populr logics for expressing properties of systems. Menwhile, the theory of process clculi ws being developed in the lte 70s, most notbly by Milner [50]. An essentil component ws the use of lbelled Kripke structures ( lbelled trnsition systems ) s rw model of concurrent behviour. An importnt difference between the use of Kripke structures here nd their use in progrm correctness ws tht the sttes re the behviour expressions themselves, which model concurrent systems, nd the lbels on the ccessibility reltion (the trnsitions) re simple ctions (nd not progrms). The criterion for behviourl equivlence of process expressions ws defined in terms of observtionl equivlence (nd lter in terms of bisimultion reltions). Hennessy nd Milner introduced primitive modl logic in which the modlities refer to ctions: φ it is possible to do n ction nd then hve φ be true, nd its dul []φ φ holds fter every ction. Together with the usul boolen connectives, this gives Hennessy Milner logic [31], HML, which ws introduced s n lterntive exposition of observtionl equivlence. However, s logic HML is obviously indequte to express mny properties, s it hs no mens of sying lwys in the future or other temporl connectives except by llowing infinitry conjunction. Using n infinitry logic is undesirble both for the obvious reson tht infinite formule re not menble to utomtic processing, nd becuse infinitry logic gives much more expressive power thn is needed to express temporl properties. In 1983, Dexter Kozen published study of logic tht combined simple modlities, s in HML, with fixpoint opertors to provide form of recursion. This logic, the modl mu-clculus, hs become probbly the most studied of ll temporl logics of progrms. It hs simple syntx, n esily given semntics, nd yet the fixpoint opertors provide immense power. Most other temporl logics, such s the CTL fmily, cn be seen s frgments of Lµ. Moreover, this logic lends itself to trnsprent model-checking lgorithms. Another root to understnding modl logics is the work in the 60s on utomt over infinite words nd trees by Büchi [13] nd Rbin [60]. The motivtion ws decision questions of mondic second-order logics. Büchi introduced utomt s norml form for such formule. This work founded new connections to logic nd utomt theory. Lter it ws relised tht modl logics re merely sublogics of pproprite mondic second-order logic, nd tht the utomt norml forms provide very powerful frmework within which to study properties of modl logic. A further development ws the use of gmes by Gurevich nd Hrrington [30] s n lterntive to utomt. There is lso n older gme-theoretic trdition due to Ehrenfeucht nd Frïssé, for understnding the expressive power of logics. These techniques re lso pplicble within process clculi. For instnce bisimultion equivlence cn be nturlly rendered s such gme, nd expressivity of modl logics cn be understood using gme-theoretic techniques. 3

4 2.2 Precursors to modl mu-clculus HML, Hennessy Milner Logic [31], is primitive modl logic of ction. The syntx of HML hs, in ddition to the boolen opertors, modlity φ, where is process ction. A structure for the logic is just lbelled trnsition system. Atomic formuls of the logic re the constnts nd. The mening of φ is it is possible to do n -ction to stte where φ holds. The forml semntics is given in the obvious wy by inductively defining when stte of trnsition system, or stte of process, hs property; for exmple, s = φ iff t.s t t = φ. We my lso dd some notion of vrible or tomic proposition to the logic, in which cse we provide vlution which mps vrible to the set of sttes t which it holds. The expressive power of HML in this form is quite wek: obviously given HML formul cn only mke sttements bout given finite number of steps into the future. HML ws introduced not so much s lnguge to express properties, but rther s n id to understnding process equivlence: two (imge-finite) processes re equivlent iff they stisfy exctly the sme HML formule. To obtin the expressivity desired in prctice, we need stronger logics. The logic PDL, Propositionl Dynmic Logic [57,25], s mentioned bove, is both development of Floyd Hore style logics, nd development of modl logics. Recently, it hs been used s bsis for description logics nd logics of informtion. PDL is n extension of HML in the circumstnce tht the ction set hs some structure. There is room for vrition in the mening of ction, but in the stndrd logic, progrm is considered to hve number of tomic ctions, which in process lgebric terms re just process ctions, nd α is llowed to be regulr expression over the tomic ctions:, α; β, α β, or α*. We my consider tomic ctions to be uninterpreted toms; but in the development from Floyd Hore logics, one would see the tomic ctions s, for exmple, ssignment sttements in while progrm. PDL enriches the lbels in the modlities of HML. An lterntive extension of HML is to include further modlities. The brnching time logic CTL, Computtion Tree Logic [14], cn be described in this wy s n extension of HML, with some extr temporl opertors which permit expression of liveness nd sfety properties. For the semntics we need to consider runs of system. A run from n initil stte or process s 0 is sequence s s1... which my hve finite or infinite length; if it hs finite length then its finl process is sink process which hs no trnsitions. A run s s1... hs the property φ U ψ, φ until ψ, if there is n i 0 such tht s i = ψ nd for ll j : 0 j < i, s j = φ. s i+1 s1... si... = =... = φ φ ψ The formul Fφ = ( U φ) mens φ eventully holds nd Gφ = ( U φ): φ lwys holds. For ech temporl opertor such s U there re two modl vrints, strong vrint rnging over ll runs of process nd wek vrint rnging over some run of process. We prefce strong version with nd wek version with. If HML is extended with the two kinds of until opertor the resulting logic is slight but inessentil vrint of CTL (CTL does not in its stndrd form mention ction lbels in modlities). The forml semntics is given by inductively defining when stte (process) hs property. For instnce s = [φ U ψ] iff every run of s hs the property φ U ψ. CTL hs vrints nd enrichments such s CTL* [24] nd ECTL* [70]. These llow free mixing of pth opertors nd quntifiers: for exmple, the CTL* formul [P U FQ] is lso CTL formul, but [P U FQ] is not, becuse the F is not immeditely governed by quntifier. Hence extensions lso cover trditionl temporl logics tht is, literlly logics of time s dvocted by Mnn nd Pnueli nd others. In this view, time is liner sequence of instnts, corresponding to the sttes of just one execution pth through the progrm. One cn define logic on pths which hs opertors φ in the next instnt (on this pth) φ is true, nd φuψ φ holds until ψ holds (on this pth) ; nd then system stisfies formul if ll execution pths stisfy the formul in CTL* terms, the specifiction is pth formul with single outermost universl quntifier. One 4

5 cn lso extend PDL with temporl opertors, s in process logic. There re extensions of ll these logics to cover issues such s time nd probbility. The introduction of such rel-vlued quntities poses number of problems, nd such logics re still under ctive development. 2.3 The smll model property A generl result bout mny modl logics is tht they hve the smll model property; tht is if formul is stisfible, then it is stisfible by model of some bounded size. Provided tht model-checking is decidble, which is the cse for lmost ll temporl logics, this immeditely gives decidbility of stisfibility for the logic, s one need simply check every trnsition system up to the size bound. The technique used to estblish the smll model property for PDL (nd therefore HML) is clssicl technique in modl logic, tht of filtrtion. Let s be stte, stisfying property φ, in possibly infinite trnsition system T. Let Γ be the set of ll subformuls of φ nd their negtions: in the cse of PDL one lso counts α ψ nd β ψ s subformuls of α β ψ, β ψ s subformul of α; β ψ nd α; α* ψ, nd α ψ s subformuls of α* ψ. The size of Γ is proportionl to φ (the length of φ). One then filters T through Γ by defining n equivlence reltion on the sttes of T, s t iff ψ Γ.s = ψ t = ψ. We define the filtered model to hve sttes T/ nd with tomic ction reltions given by [s] [t] iff s [s], t [t].s t. The number of equivlence clsses is t most 2 Γ nd so is O(2 φ ). The rest of the proof shows tht the filtered model is indeed model, in tht [s] = ψ iff s = ψ for ψ Γ. For PDL the only cse requiring comment is the cse α* ψ, which proceeds by n induction on the length of the witnessing sequence of α s. Consequently if φ is stisfible PDL formul, then it hs model with size O(2 φ ), nd in fct 2 φ suffices see [25] for full detils. In order to obtin n upper bound for stisfibility from the smll model property, we lso need to know the complexity of model-checking, tht is, determining whether s = φ. It is strightforwrd to define n inductive procedure for this, which is polynomil in the size of the formul nd of the system. For exmple, to determine the truth of α* φ, one computes the *-closure of the α reltion, nd then checks for n α*- successor stisfying φ. These results give n NTIME(c n ) (where c is constnt nd n the formul size) upper bound for the stisfibility problem. By reduction to lternting Turing mchines, [25] lso gve lower bound of DTIME(c n/ lg n ). A closer to optiml technique for stisfibility due to Prtt uses tbleux [58]. Although CTL, CTL* nd Lµ ll hve the finite model property, the filtrtion technique does not pply. If one filters T through finite set Γ contining FQ unintended loops my be dded. For instnce if T is s i s i+1 for 1 i < n nd Q is only true t stte s n then s i = FQ for ech i. But when n is lrge enough the filtered model will hve t lest one trnsition [s j ] [s i ] when i j < n, with the consequence tht [s i ] = FQ. The initil pproch to showing the finite model property utilized semntic tbleux where one explicitly builds model for stisfible formul which hs smll size. But such technique is very prticulr, nd more sophisticted methods bsed on utomt re used for optiml results, s we shll mention lter. 3 Syntx nd semntics of modl mu-clculus The defining feture of mu-clculi is the use of fixpoint opertors. The use of fixpoint opertors in progrm logics goes bck t lest to De Bkker, Prk nd Scott [56]. However, their use in modl logics of progrms dtes from work of Prtt, Emerson nd Clrke nd Kozen. Prtt s version [59] used fixpoint opertor like the minimiztion opertor of recursion theory; lthough this is only superficilly different, it seems to hve dissuded people from using the logic in tht form. Emerson nd Clrke dded fixed points to temporl logic to cpture firness nd other correctness properties [21]. Kozen s [35] pper introduced Lµ s we use it tody, nd estblished number of bsic results. Fixpoint logics re trditionlly considered hrd to understnd. Furthermore, their semntics requires fmilirity with mteril tht, lthough not difficult, is often omitted from undergrdute mthemtics or logic progrmmes. Whether for prcticl purposes, or to guide oneself through the forml proofs, it is therefore 5

6 worthwhile to spend little time on discussing n intuitive understnding of Lµ before going on to the definitions. 3.1 Fixpoints s recursion Suppose tht S is the stte spce of some system. For exmple S could be the set of ll processes rechble by rbitrry length sequences of trnsitions from some initil process. One wy to provide semntics of stte-bsed modl logic is to mp formule φ to sets of sttes, tht is to elements of S. For ny formul φ this mpping is given by φ 1. The ide is tht this mpping tells us t which sttes ech formul holds. If we llow our logic to contin vribles with interprettions rnging over S, then we cn view the semntics of formul with free vrible, φ(z), s function f: S S. If f(s) f(s ) whenever S S S then f is monotonic. If f(s) = S then S is fixed point of f (s repeted ppliction of f leves S unchnged). If we tke the usul lttice structure on S, given by set inclusion, nd if f is monotonic function, then by the Knster Trski theorem we know tht f hs fixed points, nd indeed hs unique mximl nd unique miniml fixed point. The mximl fixed-point is the union of post-fixed points, {S S S f(s)}, nd the miniml fixed-point is the intersection of pre-fixed points, {S S f(s) S}. So we could extend our bsic logic with miniml fixpoint opertor µ, so tht µz.φ(z) is formul whose semntics is the lest fixed point of f; nd similrly mximl fixpoint opertor ν, so tht νz.φ(z) is formul whose semntics is the gretest fixed point of f (when the semntics of φ(z) is monotonic). A good reson to do this is tht it provides semntics for recursion, nd dding recursion to the usul modl logics provides net wy of expressing ll the usul opertors of temporl logics. For exmple, consider the CTL formul Gφ, lwys φ. Another wy of expressing this is to sy tht it is property X such tht if X is true, then φ is true, nd wherever we go next, X remins true; so X stisfies the modl implictionl eqution X φ [ ]X. where [ ]X mens tht X is true t every immedite successor (see subsection 3.3). A solution to this eqution is precisely post-fixed point of the formul φ [ ]X. But which solution of the possibly mny is pproprite? The only cnonicl post-fixed point is the lrgest, nd this lso mkes sense, since if stte stisfies some solution, then it surely stisfies Gφ. Hence the mening of the formul is the lrgest post-fixed point, which by stndrd theory is exctly the lrgest fixed point, νx.φ [ ]Z. On the other hnd, consider the CTL property Fφ, there exists pth on which φ eventully holds. We could write this recursively s Y holds if either φ holds now, or there s some successor on which Y is true : Y φ Y. Here we hve pre-fixed point of φ Y ; the only cnonicl such is the lest, nd if stte stisfies Fφ, then it surely stisfies ny solution Y of the eqution. Hence we wnt the lest pre-fixed point, which is lso the lest fixed point, µy.φ Y. Finlly, we observe tht since we wnt the fixed points, we my replce the implictions by equlities in the modl equtions bove, nd get the sme nswers. It is therefore usul to cst modl fixpoint logics in terms of equtions, rther thn of implictions. 3.2 Approximting fixpoints nd µ s finitely The other key ide is tht of pproximnts nd unfolding. The stndrd theory tells us tht if f is monotonic function on lttice, we cn construct the lest fixed point of f by pplying f repetedly on the bottom element of the lttice to form n incresing chin, whose limit is the fixed point. The length of the itertion is in generl trnsfinite, but is bounded t worst by the crdinl fter crdinlity of the lttice, nd in the specil 1 The mpping cn be either given directly (inductively) or indirectly s the set {s S : s = Φ}. 6

7 cse of powerset lttice S, by the crdinl fter the crdinlity of S. So if f is monotonic on S, we hve the incresing chin f( ) f 2 ( )... f α ( )... nd the lest fixed point is the limit of this chin µf = α<κ f α ( ) nd similrly s there is the nti-chin, S f(s) f 2 (S)... f α (S)..., νf = α<κ f α (S) or in terms of infinitry logic, µz.φ(z) = α<κ φα ( ) where κ is t worst S + 1 for finite S, or ℵ 1 for countble S (nd νz.φ(z) = α<κ φα ( )). So for miniml fixpoint µz.φ(z), if stte s stisfies the fixpoint, it stisfies some pproximnt, sy for convenience the β + 1 th so tht s = φ β+1 ( ). Now if we unfold this formul once, we get s = φ(φ β ( )). Tht is, the fct tht s stisfies the fixpoint depends, vi φ, on the fct tht other sttes stisfy the fixpoint t smller pproximnts thn s does. So if one follows chin of dependencies, the chin termintes. This is the strict mening behind the slogn µ mens finite looping, which, with little refinement, is sufficient to understnd Lµ. On the other hnd, for mximl fixpoint νz.φ(z), there is no such decresing chin: s = νz.φ(z) iff s = φ(νz.φ(z)), nd we my loop for ever, s in the process P def =.P, which repetedly does n ction, nd so stisfies νz. Z. (However, if stte fils mximl fixpoint, then there is descending chin of filures.) Insted, we hve the principle of fixpoint induction: if by ssuming tht set S = Z, we cn show tht S = φ(z), then we hve shown tht S = νz.φ (compre the recursive formultion of Gφ in the previous section). So in summry, one my understnd fixpoints by the slogn ν mens looping, nd µ mens finite looping. This slogn provides n lterntive mens of explining why miniml fixpoint is required in the trnsltion of Fφ. This formul mens tht there is pth on which φ eventully holds: tht is, on the chosen pth, φ holds within finite time. Hence the eqution Y = φ Y must only be pplied finite number of times, nd so by the slogn we should use miniml fixpoint. In the cse of formule with lternting fixpoints (which we shll exmine little lter), the slogn remins vlid, but requires little more cre in ppliction. It is essentil to lmost ll proofs bout Lµ: the notion of well-founded premodel with which Streett nd Emerson [64] proved the finite model property, is n exmple of the slogn; so re the tbleu model-checking pproches of Stirling nd Wlker [62], nd Brdfield nd Stirling [12]. 3.3 Syntx of Lµ Let Vr be n (infinite) set of vrible nmes, typiclly indicted by Z, Y,...; let Prop be set of tomic propositions, typiclly indicted by P, Q,...; nd let L be set of lbels, typiclly indicted by, b,.... The set of Lµ formule (with respect to Vr, Prop, L) is defined in prsimonious form s follows: P is formul. Z is formul. If φ 1 nd φ 2 re formule, so is φ 1 φ 2. If φ is formul, so is []φ. If φ is formul, so is φ. If φ is formul, then νz.φ is formul, provided tht every free occurrence of Z in φ occurs positively, i.e. within the scope of n even number of negtions. (The notions of free nd bound vribles re s usul, where ν is the only binding opertor.) If formul is written s φ(z), it is to be understood tht the subsequent writing of φ(ψ) mens φ with ψ substituted for ll free occurrences of Z. There is no suggestion tht Z is the only free vrible of φ. 7

8 The positivity requirement on the fixpoint opertor is syntctic mens of ensuring tht φ(z) denotes functionl monotonic in Z, nd so hs unique miniml nd mximl fixpoint. It is usully more convenient to introduce derived opertors defined by de Morgn dulity, nd work in positive form: φ 1 φ 2 mens ( φ 1 φ 2 ). φ mens [] φ. µz.φ(z) mens νz. φ( Z). Note the triple use of negtion in µ, which is required to mintin the positivity. A formul is sid to be in positive form if it is written with the derived opertors so tht only occurs pplied to tomic propositions. It is in positive norml form if in ddition ll bound vribles re distinct (nd different from free vribles). Any formul cn be put into positive norml form by use of de Morgn lws nd α-conversion. So we shll often ssume positive norml form, nd when doing structurl induction on formule will often tke the derived opertors s primitives. For the concrete syntx, we shll ssume tht modl opertors hve higher precedence thn boolen, nd tht fixpoint opertors hve lowest precedence, so tht the scope of fixpoint extends s fr to the right s possible. There re few extensions to the syntx which re convenient in presenting exmples, nd in prctice. The most useful is to llow modlities to refer not just to single ctions, but to sets of ctions. The most useful set is ll ctions except. So: s = [K]φ iff K.s = []φ, nd [, b,...]φ is short for [{, b,...}]φ. [ K]φ mens [L K]φ, nd set brces my be omitted. Thus [ ]φ mens just [L]φ Semntics of Lµ An Lµ structure T (over Prop, L) is lbelled trnsition system, nmely set S of sttes nd trnsition reltion S L S (s usul we write s t), together with n interprettion V Prop : Prop S for the tomic propositions. Given structure T nd n interprettion V: Vr S of the vribles, the set φ T V of sttes stisfying formul φ is defined s follows: P T V = V Prop(P ) Z T V = V(Z) φ T V = S φ T V φ 1 φ 2 T V = φ 1 T V φ 2 T V []φ T V = { s t.s t t φ T V } νz.φ T V = {S S S φ T V[Z:=S] } where V[Z := S] is the vlution which mps Z to S nd otherwise grees with V. If we re working in positive norml form, we my dd definitions for the derived opertors by dulity: φ 1 φ 2 T V = φ 1 T V φ 2 T V φ T V = { s t.s t t φ T V } µz.φ T V = {S S S φ T V[Z:=S] } 2 Bewre tht mny uthors use [ ]φ to men [L]φ, rther thn the (vcuous) [ ]φ tht it mens in our nottion. 8

9 We drop T nd V whenever possible; nd write s = φ for s φ. We hve discussed informlly the importnce of pproximnts; let us now define them. If µz.φ(z) is formul, then for n ordinl α, let µz α.φ nd µz <α.φ be formule, with semntics given, with simultneous induction on α, by: µz <α.φ T V = µz β.φ T V β<α µz α.φ T V = φ T V[Z:= µz <α.φ T V ] The pproximnts of mximl fixpoint re defined dully: νz <α.φ T V = νz β.φ T V β<α νz α.φ T V = φ T V[Z:= νz <α.φ T V ] Note tht µz <0.φ nd νz <0.φ. By buse of nottion, we write Z α or φ α to men µ ν Zα. φ; of course this only mkes sense when one knows which fixpoint nd vrible is ment. We should remrk here tht most literture on Lµ uses slightly different definition, putting µz 0.φ =, µz α+1.φ = φ(µz α.φ), nd µz λ.φ = β<λ µzβ.φ for limit λ which in effect is writing α for our <α. Tht nottion is tken from set theory; its dvntge is tht limit pproximnt is the limit of pproximnts. Our nottion is tken from more recent set theoretic prctice; its dvntges re tht it sometimes reduces the number of trivil cse distinctions in inductive proofs. However, the difference is not significnt. Sometimes, we re interested in rooted structures (T, s 0, V Prop ) for Lµ formule tht hve designted initil stte s 0 : φ is true of such structure if s 0 = φ. We cn, therefore, exmine the set of ll rooted structures where φ is true which llows comprison between Lµ nd other nottions for clssifying structures. 3.5 Exmples We hve seen, both informlly nd in the forml semntics, the mening of the fixpoint opertors, nd we hve seen some simple exmples of Lµ trnslting CTL. We now consider some exmples of Lµ formule in their own right, which express properties one might meet in prctice. There is well-known clssifiction [42] of bsic properties into sfety nd liveness. In terms of Lµ, it is not unresonble to sy tht µ is liveness nd ν is sfety. Consider first simple ν formule. For exmple: νz.p []Z is reltivized lwys formul: P is true long every -pth. Slightly more complex is the reltivized while formul νz.q (P []Z) on every -pth, P holds while Q fils. Both formule cn be understood directly vi the fixpoint construction, or vi the ide of ν s looping : for exmple the second formul is true if either Q holds, or if P holds nd wherever we go next (vi ), the formul is true, nd..., nd becuse the fixpoint is mximl, we cn repet forever. So in prticulr, if P is lwys true, nd Q never holds, the formul is true. µ formule, in contrst, require something to hppen, nd thus re liveness properties. For exmple µz.p []Z is on ll infinite length -pths, P eventully holds ; nd µz.q (P Z) is on some -pth, P holds until Q holds (nd Q does eventully hold). Agin, these cn be understood by µ s finite looping : in the second cse, we re no longer llowed to repet the unfolding forever, so we must eventully bottom out in the Q disjunct. 9

10 This level of complexity suffices to trnslte CTL, since we hve µz.q (P Z) s trnsltion of [P U Q], nd µz.q (P [ ]Z ) s trnsltion of [P U Q] (the conjunct ensures tht Q is ctully reched, since [ ]Z is true t dedlock sttes); nd obviously we cn nest formule inside one nother, such s νz.(µy.p Y ) [ ]Z it is lwys possible tht P will hold, or G( FP ). Eqully obviously, we cn write formule with no CTL trnsltion, such s µz.[] Z which sserts the existence of mximl -pth of even length; formul which is, incidentlly, expressible in PDL. This is, however, firly simple extension; much more interesting is the power one gets from mixing fixpoints tht depend on one nother. Consider the formul µy.νz.(p []Y ) ( P []Z). This formul usully gives puse for thought, but it hs simple mening, which cn be seen by using the slogns. µy.... is true if νz.... is true if (P []Y ) ( P []Z), which is true if either P holds nd t the next ()-sttes we loop bck to µy...., or P fils, nd t the next sttes we loop bck to νz..... By the slogn µ mens finitely, we cn only loop through µy.... finitely mny times on ny pth, nd hence P is true only finitely often on ny pth. We shll see in lter section tht this so-clled lterntion of fixpoint opertors does indeed give ever more expressive power s the number of lterntions increses. It lso ppers to increse the complexity of model-checking: ll known lgorithms re exponentil in the lterntion, but whether this is necessrily the cse is the min remining open problem bout Lµ. 3.6 Fixpoint regenertion nd the fundmentl semntic theorem In the informl description of the mening of fixpoints, we used the ide of the dependency of s t φ on t t ψ. We now mke this precise. Assume structure T, nd formul φ. Suppose tht we nnotte the sttes with sets of subformule, such tht the sets re loclly consistent: tht is, s is nnotted with conjunction iff it is nnotted with both conjuncts; s is nnotted with disjunction iff it is nnotted with t lest one disjunct; if s is nnotted with []ψ (resp. ψ), then ech (resp. t lest one) -successor is nnotted with ψ; if s is nnotted with fixpoint or fixpoint vrible, it is nnotted with the body of the fixpoint. We cll such n nnotted structure qusi-model. A choice function f is function which for every disjunctive subformul ψ 1 ψ 2 nd every stte nnotted with ψ 1 ψ 2 chooses one disjunct f(s, ψ 1 ψ 2 ); nd for every subformul ψ nd every stte s nnotted with ψ chooses one -successor t = f(s, ψ) nnotted with ψ. A pre-model is qusi-model equipped with choice function. Given pre-model with choice function f, the dependencies of stte s tht stisfies subformul ψ re defined thus: s@ψ 1 ψ 2 s@ψ i for i = 1, 2; s@[]ψ t@ψ for every t such tht s t; s@ψ 1 ψ 2 s@f(s, ψ 1 ψ 2 ); s@ ψ f(s, ψ)@ψ; s@ µ ν Z. ψ s@ψ; s@z s@ψ where Z is bound by µ ν Z. ψ. A tril is mximl chin of dependencies. If every tril hs the property tht the highest (i.e. with the outermost binding fixpoint) vrible occurring infinitely often is ν-vrible, the pre-model is well-founded. (Equivlently: in ny tril, µ-vrible cn only occur finitely often unless higher vrible is encountered.) The fundmentl theorem on the semntics of Lµ cn now be stted: Theorem 3.1 A well-founded pre-model is model: in well-founded pre-model, if s is nnotted with ψ, then indeed s = ψ. The theorem in this form is due to Streett nd Emerson in [64], from which the term well-founded pre-model 10

11 is tken. Stirling nd Wlker [63] presented tbleu system for model-checking on finite structures, nd the soundness theorem for tht system is essentilly finite version of the fundmentl theorem using more relxed notion of choice; the lter infinite-stte version of [12,7] is the fundmentl theorem, gin with slight relxtion on choice. A converse is lso true: Theorem 3.2 If in some structure s = φ, then there is loclly consistent nnottion of the structure nd choice function which mke the structure well-founded pre-model. The fundmentl theorem, in its vrious guises, is the precise sttement of the slogn µ mens finite looping. To explin why it is true, nd to define the term loclly consistent, we need to mke finer nlysis of pproximnts. Assume structure T, vlution V, nd formul φ in positive norml form. Let Y 1,..., Y n be the µ- vribles of φ, in n order comptible with formul inclusion: tht is, if µy j.ψ j is subformul of µy i.ψ i, then i j. If Y i is some inner fixpoint, then its denottion depends on the mening of the fixpoints enclosing it: for exmple, in the formul µy 1. µy 2.(P Y 1 ) b Y 2, to clculte the inner fixpoint µy 2 we need to know the denottion of Y 1. We my sk: wht is the lest pproximnt of Y 1 tht could be plugged in to mke the formul true? Hving fixed tht, we cn then sk wht pproximnt of Y 2 is required. This ide is the notion of signture. A signture is sequence σ = α 1,..., α n of ordinls, such tht the i lest fixpoint will be interpreted by its α i th pproximnt (clculted reltive to the outer pproximnts). The definition nd use of signtures inevitbly involves some slightly irritting book-keeping, nd they pper in severl forms in the literture. In [64], the Fischer Ldner closure of φ ws used, rther thn the set of subformule. The closure is defined by strting with φ nd closing under the opertions of tking the immedite components of formule with boolen or modl top-level connectives, together with the rule tht if µ ν Z. ψ(z) cl(φ), then ψ( µ ν Z. ψ) cl(φ). The signtures were defined by syntcticlly unfolding fixpoints, rther thn by semntic pproximnts. In [63] nd following work, notion of constnt ws used, which llows some of the book-keeping to be moved into the logic. Although ll the notions nd proofs using them re interconvertible, the constnt vrint is perhps esier to follow, nd hs the dvntge tht it dpts esily to the modl eqution system presenttion of Lµ, which we shll see below. Indeed, it rises more nturlly from tht system. Add to the lnguge countble set of constnts U, V,.... Constnts will be defined to stnd for mximl fixpoints or pproximnts of miniml fixpoints. Specificlly, given formul φ, let Y 1,..., Y n be the µ-vribles s bove, let Z 1,..., Z m be the ν-vribles, let σ = α 1,..., α n be signture, nd let U 1,..., U n, V 1,..., V m be constnts, which will be ssocited with the corresponding vribles. They re given semntics thus: if Y i is bound by µy i.ψ i, then U i σ is µy α i i.ψ i σ, where ψ i is obtined from ψ i by substituting the corresponding constnts for the free fixpoint vribles of µy i.ψ i. If Z i is bound by νz i.ψ i, its semntics is νz i.ψ i σ. Given n rbitrry subformul ψ of φ, we sy stte s stisfies ψ with signture σ, written s = σ ψ, if s ψ σ, where ψ is ψ with its free fixpoint vribles substituted by the corresponding constnts. Order signtures lexicogrphiclly. Now, given pre-model for φ, extend the nnottions so tht ech subformul t s is ccompnied by signture write s@ψ[σ]. Such n extended nnottion is sid to be loclly consistent if the signture is unchnged or decreses by pssing through boolen, modl, or ν-vrible dependencies, nd when pssing through s@y i it strictly decreses in the ith component nd is unchnged in the 1,..., i 1 th components. It cn now be shown, by slightly delicte but not too difficult induction on ψ nd σ, tht if s@ψ[σ], then s = σ ψ. The proof proceeds by contrdiction: suppose tht s@ψ[σ] nd s = σ ψ. If ψ is ψ 1 ψ 2 (ψ 1 ψ 2 ) then for some i {1, 2}, s@ψ 1 [σ] nd s = σ ψ i. If ψ is []ψ ( ψ ) then for some s, s s, [σ] nd s = σ ψ. If ψ is lest fixpoint vrible Y i, then we pss through the unfolding rule to s@ψ i [σ ] where σ < σ nd s = σ ψ i. (Hence we cn only pss through lest fixpoints finitely often.) The key cse is when ψ 11

12 is gretest fixpoint vrible Z i. In this cse, the hypothesis is tht s@z i [σ] nd s = σ Z i. Then s fils some pproximnt Z β i (nd s@z β i [σ]); nd then pssing through the unfolding rule gives s fils ψβ i for β < β (nd s@ψ β i [σ]). Continuing to chse the flsehood down the pre-model, we eventully rrive t stte filing the zero th pproximnt of gretest fixpoint formul, which is impossible. Furthermore, given well-founded pre-model, one cn construct loclly consistent signture nnottion essentilly, the Y i component of σ in s@ψ[σ] is the mximum number (in the trnsfinite sense) of Y i occurrences without meeting higher vrible in trils from s@ψ, nd so on; the well-foundedness of the pre-model gurntees tht this is well-defined. This gives the fundmentl theorem. The converse is quite esy: given model, nnotte the sttes by the subformule they stisfy; for s@ψ ssign the lest σ such tht s = σ ψ; nd choose choice function tht lwys chooses the successor with lest signture. It is esy to show tht this is well-founded pre-model nd signture ssignment. 3.7 Modl eqution systems The presenttion of Lµ so fr is trditionl logicl formultion. However, in severl circumstnces it cn be useful to think in terms of systems of recursive equtions for the fixpoint vribles, s follows. A modl eqution system comprises sequence B 0 ;... ; B n of blocks; ech B i my be µ-block (we write B µ i ) or ν-block (we write Bν µ/ν µ/ν i ). Ech block Bµ/ν i is sequence of equtions X i0 = φ i0,..., X iki = φ iki, where ech φ ij is modl formul which my contin ny of the vribles X i j positively. Thus ech block B i defines functionl on vectors (S i0,..., S iki ) ( S) k i. This functionl is reltive to vlutions of the vribles in erlier blocks, nd refers to the solutions of lter blocks. If B µ i, then tke the lest fixpoint (in the componentwise ordering) of this functionl, nd if Bi ν, tke the gretest. Conventionlly, the solution of the entire eqution system is tken to be the solution for the first vrible X 00. There is n obvious trnsformtions from Lµ to modl eqution systems: for exmple, µx.p νy.[]y [b]x trnsltes to X 00 µ = P X10 ; X 10 ν = []X10 [b]x 00. Similrly, there is resonbly obvious reverse trnsformtion: for exmple, the eqution system X 00 µ = X10 [b]x 10 ; X 10 ν = P [](X00 X 10 ) trnsltes to µx. (νy.p [](X Y )) [b](νy.p [](X Y )). These trnsltions, known from finite model theory, show tht modl eqution systems nd Lµ re equi-expressive. Note tht in the second exmple, the formul duplictes the second eqution: by extending such exmples, one cn see tht the trnsltion from eqution systems to formule my introduce n exponentil blow-up. However, this blow-up results in formule with mny identicl sub-formule, which cn in ny cse be optimized wy during model-checking, nd in generl problems in modl eqution systems re of the sme complexity s in Lµ. A block in modl eqution system is to be understood s simultneous fixpoint. Lµ could be directly presented with simultneous fixed points: for instnce, s = µz 1... Z n.(φ 1,..., φ n ) iff s S 1 where (S 1,..., S n ) = {(S 1,..., S n) S j φ j T V[Z 1 :=S 1,...,Zn:=S n] }. One of the min pplictions of modl eqution systems is in the development of fst model-checking lgorithms: modl eqution systems cn be esily trnslted to boolen eqution systems (defined s bove, but with boolen vribles nd just propositionl equtions) by hving one boolen vrible for ech (modl vrible, stte) pir. Then grph-theoretic or mtrix-theoretic techniques cn be employed to solve the boolen eqution systems. For more on this topic, see [46]. 4 Expressive power As we noted erlier in this rticle, there re mny temporl logics used in prctice, some of which re lso historicl precursors to Lµ. We sid tht most of them could be seen s frgments of Lµ. In this section we 12

13 consider questions of expressivity nd relted topics, nd strt by showing how number of other logics cn be trnslted into Lµ. 4.1 CTL nd friends s frgments of Lµ PDL cn be esily trnslted into Lµ by unpcking the modl opertors α : α β ψ = α ψ β ψ, α; β ψ = α β ψ nd α * ψ = µz.ψ α Z. The logic CTL is one of the simplest temporl logics, nd its trnsltion is lso simple. Recll the syntx nd semntics of CTL from 2.2. The two bsic opertors re [φ U ψ] nd [φ U ψ]. Assuming tht there re no dedlocked sttes, these cn be simply trnslted s: µz.ψ [ ]φ nd µz.ψ φ with the proof of the equivlence being strightforwrd ppliction of the semntics. For both PDL nd CTL, only frgment of Lµ is necessry where there is no essentil lterntion of fixpoints (s described in 7). A much less trivil cse is the logic CTL*. CTL* is the logic obtined by removing the syntctic constrint of CTL tht requires every U to be immeditely quntified by or, so tht in CTL* one cn write formule such s [(φuψ) (φ Uψ )]. Consequently, not ll CTL* formule hve menings purely in terms of sttes, nd the question of trnsltion into purely stte-bsed logic like Lµ becomes problemtic. However, one cn sk the question, is every stte formul of CTL* (tht is, boolen combintions of toms nd quntified formule) equivlent to n Lµ formul? The nswer is yes, but it is hrder problem. Wolper, in n unpublished note from the erly 1980s, noted tht stte formuls of CTL* cn be trnslted vi utomt theory into PDL over single lbel with looping (which, in turn, is directly trnsltble into Lµ). The first explicit trnsltion ws given by Dm [17], but the trnsltion is very difficult, nd gives doubly exponentil blowup in the formul size. The ltter mens tht the trnsltion is of no use for model-checking, s existing CTL* lgorithms re much fster thn double exponentil blowup of Lµ model-checking. A few yers lter, Bht nd Clevelnd [6] gve single exponentil trnsltion into the equtionl vrint of Lµ. Although still quite complex, utilising so-clled Büchi tbleu utomton s n intermediry, this trnsltion is efficient enough to give competitive model-checking of CTL* vi trnsltion. 4.2 Bisimultion nd tree model property Bisimultion or bck-nd-forth equivlence or zig-zg equivlence is the equivlence ssocited with modl logic. In our setting, bisimultion between two Lµ structures T 1 nd T 2 over the sme proposition set Prop nd lbel set L is reltion R such tht for ll propositions P, if P (s 1 ) nd s 1 Rs 2, then P (s 2 ), nd conversely; nd if s 1 Rs 2, nd s 1 s 1, then for some s 2, s 2 s 2 nd s 1 Rs 2, nd conversely. Two sttes s 1 nd s 2 re bisimilr if there is some bisimultion R such tht s 1 Rs 2. Recll tht HML is the fixpoint-free prt of Lµ. The following is esily shown by structurl induction on formule: Theorem 4.1 If two sttes (in the sme or different systems) re bisimilr, they stisfy the sme HML formule. By n induction on pproximnts, it is lso strightforwrd to extend this to Theorem 4.2 If two sttes (in the sme or different systems) re bisimilr, they stisfy the sme Lµ formule. A system is imge-finite if for ll sttes s nd lbels, the set { s s theorem holds: s } is finite. The following Theorem 4.3 If two sttes in imge-finite systems stisfy the sme HML (or Lµ) formule, then they re bisimilr. To prove this, one observes tht bisimultion itself is mximl fixpoint, nmely the mximl fixpoint of the mp R { (s 1, s 2 ) (s 1 s 1 s 2.s 2 s 2 (s 1, s 2 ) R) (s 2 s 2 s 1.s 1 s 1 (s 1, s 2 ) 13

14 R) } (ignoring the propositions, which cn be delt with by n dditionl cluse); shows tht in n imge-finite system the pproximnts to this fixpoint close t ω; nd then deduce tht if two sttes re not bisimilr, there is finite modl formul distinguishing them. The ltter theorem does not hold for generl systems: there re systems which stisfy the sme Lµ formule, but re not bisimilr. The following exmple is bsed on one by Roope Kivol. Let φ 1, φ 2,... be n enumertion of ll Lµ formule over some finite lbel set L. Let T i, with initil stte s i, be finite model for φ i, with ll T i disjoint. Let T 0 be constructed by tking n initil stte s 0 nd mking s 0 s i for ll i > 0. Let T 0 be T 0 with the ddition of trnsition s 0 s 0. T 0 nd T 0 re clerly not bisimilr, becuse in T 0 it is possible to defer indefinitely the choice of which T i to enter. On the other hnd, suppose tht ψ is formul, nd w.l.o.g. ssume the topmost opertor is modlity. If the modlity is [b], ψ is true of both T 0 nd T 0 ; if it is b, ψ is flse of both; if ψ is ψ, then ψ is flse t both T 0 nd T 0 iff ψ is unstisfible, nd true t both otherwise; if ψ is []ψ, then ψ is true t both T 0 nd T 0 iff ψ is vlid, nd flse t both otherwise. A simple corollry of theorem 4.2 is tht Lµ hs the tree model property. Proposition 4.4 If formul hs model, it hs model tht is tree. Just unrvel the originl model, thereby preserving bisimultion. This cn be strengthened to the bounded brnching degree tree model property (just cut off ll the brnches tht re not ctully required by some dimond subformul; this leves t most (number of dimond subformule) brnches t ech node). 4.3 Lµ nd utomt Lµ is intimtely relted to utomt theory, nd the equivlence between vrious utomt, prticulrly lternting prity utomt, s described in section 5, nd Lµ is key technique in mny results. The first connexion between Lµ nd utomt ws tree utomt, which we now briefly review. Let us strt with the notion of n utomton fmilir from introductory computer science courses. A finite utomton A = (Q, Σ, δ, q 0, F ) consists of finite set of sttes Q, finite lphbet Σ, trnsition function δ, n initil stte q 0 Q nd n cceptnce condition F. Clssicl nondeterministic utomt recognise lnguges, subsets of Σ *, where the trnsition function δ : Q Σ Q. Given word w = 0... n Σ *, run of A on w is sequence of sttes q 0... q n tht trverses w, so q i+1 δ(q i, i+1 ). The run is ccepting if the sequence q 0... q n obeys F : clssiclly, F Q nd q 0... q n is ccepting if the lst stte q n F. There my be mny different runs of A on w, some ccepting the others rejecting, or no runs t ll. The lnguge recognised by A is the set of words for which there is t lest one ccepting run. A simple extension is to llow recognition of infinite length words. A run of A on w = 1... i... is n infinite sequence of sttes π = q 0... q i... tht trvels over w, so q i+1 δ(q i, i+1 ) nd it is ccepting if it obeys the condition F. Let inf(π) Q contin exctly the sttes tht occur infinitely often in π. Clssiclly, F Q nd π is ccepting if inf(π) F which is the Büchi cceptnce condition. Büchi utomt re n lterntive nottion for chrcterizing infinite runs of systems. Assume Prop is finite set. The lphbet Σ = Prop. If π = s s1... is n infinite run, then π = A if the utomton ccepts the word Prop(s 0 ) Prop(s 1 )... where Prop(s i ) is the subset of Prop tht is true t s i. For exmple, if Prop = {P }, Q = {p, q}, δ(p, {P }) = {q}, δ(p, ) = {p}, δ(q, {P }) = {q} nd δ(q, ) = {q}, q 0 = p nd F = {q}, then this utomton is equivlent to the temporl formul FP. (In fct, Büchi utomt coincide with the liner-time µ-clculus where fixpoints re dded to simple next time temporl logic tht hs the sole modlity.) When formule re equivlent to utomt, stisfibility checking reduces to the non-emptiness problem for the utomt: tht is, whether the utomton ccepts something. If A is Büchi utomton, then it is non-empty if there is trnsition pth q 0 * q F nd cycle q * q (equivlent to n eventully cyclic model). The notion of bounded brnching tree utomton extends the definition of utomton to ccept n-brnching infinite trees whose nodes re lbelled with elements of Σ. Previously, sttes q belonged to δ(q, ); now it is 14

15 tuples (q 1,..., q n) tht belong to δ(q, ). A tree utomton trverses the tree, descending from node to ll n- child nodes, so the utomton splits itself into n copies, nd proceeds independently. A run of the utomton is then n n-brnching infinite tree lbelled with sttes of the utomton. A run is ccepting if every pth through this tree stisfies the cceptnce condition F. In the cse of Rbin cceptnce F = {(G 1, R 1 ),... (G k, R k )} where ech G i, R i Q nd π obeys F if there is j such tht inf(π) G j nd inf(π) R j =. A vrint definition is prity cceptnce first introduced (not under tht nme) by Mostowski [52] where F mps ech stte q of the utomton to priority F (q) N. We sy tht pth stisfies F if the lest priority seen infinitely often is even. It is not hrd to see tht prity condition is specil cse of Rbin condition; it is lso true, though somewht trickier, tht Rbin utomton cn be trnslted to n equivlent prity utomton. Assuming Prop is finite, tree utomt chrcterize rooted n-brnching infinite tree models (T, s 0, V Prop ) for Lµ formule where s 0 is the root of the tree: (T, s 0, V Prop ) = A if A ccepts the behviour tree T tht replces ech stte s T with Prop(s). For exmple, let Prop = {P }, Q = {p, q}, δ(p, {P }) = {(p, p)}, δ(p, ) = {(q, q)}, δ(q, {P }) = {(p, p)} nd δ(q, ) = {(q, q)} nd q 0 = p. This utomton A with prity cceptnce F (p) = 1 nd F (q) = 2 is equivlent to µy.νz.(p []Y ) ( P []Z) over infinite binry-tree models: the fixed point µy is coded by p nd νz is coded by q. The use of priorities looks very much like the definition of well-founded pre-model from section 3.6, if we ssign priorities to the subformule of n Lµ formul in such wy tht the priority of fixpoint formul is lower thn ny of its subformule (nd the priority of lest fixpoint is odd). Indeed, it is essentilly the sme thing. Tree utomt nd Lµ re equivlent [64]: Theorem 4.5 A fmily of n-brnching infinite tree models is defined by some tree utomton iff it is the set of n-brnching infinite tree models of some corresponding Lµ formul. Consequently, determining whether system stisfies n Lµ formul is equivlent to determining whether its behviour trees re ccepted by the corresponding utomton. Decidbility of stisfibility of Lµ formule reduces to the non-emptiness problem for tree utomt. This problem is more difficult thn for Büchi utomt. However, there is n exponentil decision procedure tht is inductive in the index of the utomton (which is the number of prities or pirs in F, in the cse of Rbin utomton). This illustrtes the potency of the utomt-theoretic pproch to temporl logic tht hs become populr in recent yers. Stisfibility of formule is reduced to the non-emptiness problem for clss of utomt. There is lso the virtue tht utomt sustin combintoril trnsformtions, such s determiniztion, nd closure opertions, such s intersection, tht re not in the logicl repertoire. Occsionlly, logics re esier: one of the hrdest utomt-theoretic proofs is tht tree utomt re closed under complementtion. We shll see more of utomt in lter sections. 4.4 Lµ nd gmes Lµ is lso intimtely relted to gmes, s re utomt. We cn view the reltionship t different levels. The fundmentl semntic theorem cn be presented s simple two plyer model-checking gme. Assume rooted model (T, s 0, V) nd formul φ 0 in positive norml form. The gme G(s 0, φ 0 ) is defined on n ren tht is set of pirs (s, ψ) where s is stte of T nd ψ is subformul of φ 0. The initil position is (s 0, φ 0 ). There re two plyers, whom we will cll simply nd. (Other populr nmes include Plyer II/Plyer I, Abelrd/Eloise, Opponent/Proponent, Refuter/Verifier.) is responsible for mking move from position (s, φ ψ), the vilble choices re {(s, φ), (s, ψ)}, nd from position (s, []φ) whose vilble choices re {(t, φ) s t T}. Similrly, is responsible for (s, φ ψ) nd (s, φ). There re finl positions (s, ψ) where ψ {P, P, []φ, φ}: (s, []ψ) nd (s, φ) re only finl if there is no stte t such tht s t. A finl position (s, ψ) is winning for if s = ψ; otherwise it is winning for. A ply of G(s 0, φ 0 ) is finite or infinite sequence of positions strting with (s 0, φ 0 ). wins finite ply if the finl position is winning for. She wins n infinite ply if the outermost fixed point vrible Y tht occurs 15