Alternating Tree Automata, Parity Games, and

Modal -Calculus
Thomas Wilke
Abstract
A coherent exposition of the connection of alternating tree automata and
modal -calculus is given, advocating an automaton model specically tailored
for working with modal -calculus. The advantage of the automaton model
proposed is that it can deal with arbitrary branching in a very natural way. It
is really equivalent to the modal -calculus with respect to expressive power,
just as the one proposed by Janin and Walukiewicz, but simpler. The main
focus is on the model checking and the satisability problem for -calculus.
Both problems are solved by reductions to corresponding problems on al-
ternating tree automata, namely to the acceptance and the (non-)emptiness
problem, respectively. These problems, in turn, are solved using parity games.
Resume
On donne une presentation coherente du lien entre les automates darbres
alternants et le mu-calcul modal, grace `a un mod`ele dautomate specialement
adapte au mu-calcul. Lavantage du mod`ele dautomate propose est quil
peut prendre en compte des branchements dordre arbitraire de mani`ere tr`es
naturelle. Il a un pouvoir dexpression equivalent `a celui du mu-calcul, tout
comme celui propose par Janin et Walukiewicz. mais il est plus simple. Laccent
est principalement mis sur la verication et le probl`eme de la satisabilite
du mu-calcul. Ces deux probl`emes sont resolus par reduction aux probl`emes
correspondants sur les automates darbres alternants, ` a savoir lacceptance et
le probl`eme du vide respectivement. Ces probl`emes sont `a leur tour resolus en
utilisant des jeux ` a parie.
Bull. Belg. Math. Soc. -1993 (0), 359391
360 Th. Wilke
1 Introduction
Since Dexter Kozens seminal paper in 1983, [12], modal -calculus has received
ever growing interest, mainly for two reasons: (1) its mathematical theory (model
theory) is very rich; (2) modal -calculus is well suited for specifying properties of
transition systems. The interest was further stimulated by Ken McMillans obser-
vation, [15], that specications in modal -calculus can be checked eciently for
nite transition systems when the state space and the transition relation are rep-
resented symbolically (by ordered binary decision diagrams). This is the basis for
numerous industrial-strength model checkers.
Modal -calculus is best investigated using an automata-theoretic approach. In
fact, most of the deep results on modal -calculus (such as the completeness of
Kozens axiom scheme, [12, 26, 27], the exact complexity of the satisability problem,
[6], and the strictness of the xed point alternation hierarchy, [1, 2, 3, 4, 13]) have
been (can be) obtained using automata theory.
The full beauty of the connection between modal -calculus and (alternating)
tree automata was rst revealed in the fundamental study [19] by Damian Niwi nski.
While in [19], a very general approach, applying to a wide range of lattices, is taken,
here the denitions are designed to work particularly well with modal -calculus.
A coherent exposition of the connection of alternating tree automata and modal
-calculus is given, advocating an automaton model specically tailored for working
with modal -calculus. The advantage of the automaton model proposed is that it
can deal with arbitrary branching in a very natural way. It is really equivalent to
the modal -calculus with respect to expressive power, just as the one used in [9],
but simpler.
The main focus is on the model checking and the satisability problem. The ap-
proach is modular in that the two problems are rst reduced to corresponding prob-
lems on alternating tree automata, the acceptance and the nonemptiness problem,
respectively. Then these two problems are in turn reduced to the winner problem
for parity games. The reduction from the acceptance problem is straightforward
while the reduction from the nonemptiness problem is quite involved and makes use
of Safras fundamental determinization result, [22, 17].
This paper resulted from an invited talk given at the Journees Montoises, Marne-
la-Vallee, March 2000. It has improved a lot through numerous discussions I had
with the participants of the GI Dagstuhl workshop on Automata, Logic and Innite
Games, held in Wadern in February, 2001.
Ordinals. Von Neumanns convention on ordinals is used, in particular, when n
denotes a natural number, then n = 0, . . . , n 1. Following this convention, the
set of natural numbers is denoted by .
Sequences. A nite sequence over some set M is a function n M where n
is a natural number; an innite sequence over some set M is a function M.
Sequence means nite or innite sequence. The length of a sequence u is denoted
by [u[. (Observe that [u[ coincides with dom(u), for von Neumanns convention
is used.) When u is a nite nonempty sequence, then u([u[ 1) denotes its last
element; for simplicity in notation, we will also write u() instead.
Alternating Tree Automata, Parity Games, and Modal -Calculus 361
Let f : M be any (possibly partial) function with an innite domain and a
nite image. Then the set of all elements occurring innitely often in the image, the
set given by n N [ [f
1
(n)[ = , is a nonempty nite set of natural numbers
and we denote its maximum by sup(f). Often, we will consider functions f that
result from composing several other functions; it will be convenient to write gh for
the composition of g and h, dened by gh(x) = h(g(x)).
Graphs. In this paper, the term graph means directed graph. That is, a graph is
a pair (V, E) where V is an arbitrary set of vertices and E is an arbitrary subset of
V V . The successors of a vertex v in a graph G will be denoted by Scs
G
(v). So
if G = (V, E), then Scs
G
(v) = v

V [ (v, v

) E.
A vertex v is a dead end of a graph G = (V, E) if Scs
G
(v) = . A path through
a graph G is a sequence over V satisfying ((i), (i + 1)) E for every i with
i + 1 < [[.
Let M be an arbitrary set. An M-vertex-labeled graph is a tuple (V, E, ) where
(V, E) is an ordinary graph and , V M is a so-called labeling function.
Structures. As usual, mathematical objects like graphs, trees, automata, etc.
will be dened as xed length tuples with certain components, just as a graph is
a pair (V, E). To refer to the individual components of a structure denoted S, the
superscript
S
is used. For instance, the vertex set of a graph G is denoted by V
G
.
Trees. In this paper, the term tree means directed tree. A branch of a tree T is a
maximum path through T starting in the root. So a branch is either a nite path
starting in the root and ending in a dead end or an innite path starting in the root.
The root of a tree T will be denoted by
T
.
We will use the following operations on trees. Assume T is an arbitrary tree.
Let V

be a subset of V
T
not containing the root of T. Then T V

is the tree
obtained from T by removing all vertices in V

from T and all their descendants.

Let v be some vertex in T. Then Tv is the subtree of T rooted at v. Let U be a
set of pairs (v, T

) where v is a vertex of T and T

a tree. Then T U is the tree

that is obtained from T by adding, for every (v, T

) U, a copy of T

to T at v
in such a way that an edge from v to the root of T

is inserted. If necessary, the

vertices of the trees T

are renamed.
We will use the following lemma about trees.
Lemma 1. Let T = (V, E) be a tree and U V . For every ordinal , dene U

as
follows.
U
0
= .
A vertex v belongs to U
+1
if v U and all descendants of v (excluding v)
belong to

(V U).
U

<
U

for every limit ordinal .

Then the following are equivalent for every v U.
There exists some ordinal such that v U

.
Every branch of Tv contains only a nite number of elements from U.
362 Th. Wilke
Projections. When t = (t
0
, . . . , t
n1
) is a tuple and i < n, then
i
(t) denotes the
i-th component of t, that is,
i
(t) = t
i
.
2 From Modal -Calculus to Alternating Tree Automata
Our rst goal is to understand the semantics of modal -calculus in terms of al-
ternating tree automata. We will prove that each modal -calculus formula can
be converted into an equivalent alternating tree automaton. In the rst subsec-
tion, the basics on modal -calculus are recalled and basic notation is explained.
In the second subsection, the model of alternating tree automaton used in this pa-
per is introduced. The third subsection presents the desired conversion from modal
-calculus to alternating tree automata and a correctness proof of this conversion.
2.1 Modal -Calculus
Modal -calculus is modal logic augmented by operators for least and greatest xed
points. For simplicity, this paper only deals with the unimodal case, but all the
denitions, results, and proofs given here extend canonically to the multi-modal
case. An extension to backward modalities as treated in [25] is not too dicult
either.
2.1.1 Kripke Structures
Modal -calculusjust as modal logicis a logic to express properties of Kripke
structures.
A Kripke structure is a directed graph together with an interpretation (or as-
signment) of propositional variables in each vertex of the graph. Once and for all,
we x a countably innite supply Q of propositional variables. Formally, a Kripke
structure is a tuple
K = (W, A, ) (1)
where
W, the universe of K, is a set of worlds,
A W W is an accessibility relation, and
: Q 2
W
is an interpretation of the propositional variables, which assigns
to each propositional variable the set of worlds where it holds true.
The class of all Kripke structures is denoted by K.
A pointed Kripke structure is a pair (K, w) where K is a Kripke structure and
w a world of it, which is called the distinguished world of (K, w). The class of all
pointed Kripke structures is denoted by P.
A Kripke structure or pointed Kripke structure K is nite if W
K
is nite and

K
(q) = for almost all q. Such a Kripke structure can easily be encoded as a
nite string and can thus serve as an input for decision procedures. This will be
important in the next section.
Alternating Tree Automata, Parity Games, and Modal -Calculus 363
A Kripke query
1
is a class of pointed Kripke structures, that is, a subclass of P.
There is a natural one-to-one correspondence between Kripke queries and mappings
assigning to each Kripke structure K a subset of W
K
, as explained in the next
paragraph.
With every Kripke query Q, one associates the mapping
K w W
K
[ (K, w) Q ; (2)
conversely, with every mapping Q: K Q(K) where Q(K) W
K
, one associates
the Kripke query
(K, w) P [ w Q(K) . (3)
For notational convenience, we will not make a distinction between a Kripke query
(a subclasses of P) and its mapping view as explained above, in (2). In particular,
a Kripke query may be dened as a mapping which assigns to every Kripke structure
K a subset of W
K
. Also, when Q denotes a Kripke query, we may write Q(K) for
w W
K
[ (K, w) Q.
2.1.2 Syntax
As stated above, modal -calculus is a unimodal logic augmented by least and
greatest xed points operators.
The formulas of modal -calculus are built from the constant symbols and
, the symbols from Q and their negations, using disjunction and conjunction, the
modalities 2 and 3, and operators for least and greatest xed points, and , with
some minor restriction on the use of the xed point operators.
2
Formally, the set of
all L

formulas is dened inductively as follows.

The symbols and are L

formulas.
For every q Q, q and q are L

formulas.
If and are L

formulas, then and are L

formulas.
If is an L

formula, then 2 and 3 are L

formulas.
If q Q and is an L

formula where q occurs only positive (that is, q does

not occur), then q and q are L

formulas.
The restriction on the application of the least and greatest xed point operator
expressed in the last rule above is imposed to justify the terminology: this restriction
ensures that the argument of a xed point operator can be viewed as a monotone
function and that a xed point actually exists (for details, see below).
Fixed point operators are viewed as quantiers, and the standard terminology
and notation used with quantiers is adopted. For instance, the set of all proposi-
tional variables occurring free in an L

formula is denoted by free().

1
The term query is (should be) reminiscent of the terminology used in nite model theory.
2
In this paper, no distinction is made between symbols for propositional constants and propos-
itional variables.
364 Th. Wilke
A xed point formula is an L

formula where a xed point operator is the out-

ermost connective, that is, a xed point formula is an L

formula of the form q

where = or = . The set of all xed point formulas is denoted F

. This set is
partitioned into two sets according to their prex: the set of all xed point formulas
starting with is denoted F

, while the set of all xed point formulas starting with

is denoted F

. We also speak of - and -formulas, respectively.

2.1.3 Substitution
Assume ,
0
, . . . ,
l1
are L

formulas and q
0
, . . . , q
l1
are distinct predicate sym-
bols whose free occurrences in are positive. Then
[
0
/q
0
, . . . ,
l1
/q
l1
] (4)
denotes the L

formula that is obtained from by substituting in parallel each free

occurrence of q
i
by
i
. As with predicate logic, a renaming of the bound variables
in takes place. Note that it is necessary to require that the free occurrences of the
q
i
s in are positive because otherwise the resulting syntactic object will not be an
L

formula.
2.1.4 Semantics
The formulas of modal -calculus are interpreted in Kripke structures. Inductively,
it is dened to which set of worlds an arbitrary L

formula is evaluated in a given

Kripke structure. More precisely, for every Kripke structure K and every L

formula
a set [[[[
K
W
K
is dened.
The semantics of the atomic formulas is determined by
[[[[
K
= , [[[[
K
= W
K
, (5)
[[q[[
K
=
K
(q) , [[q[[
K
= W
K

K
(q) . (6)
Disjunction and conjunction are interpreted as union and intersection, respectively,
[[
0

1
[[
K
= [[
0
[[
K
[[
1
[[
K
, (7)
[[
0

1
[[
K
= [[
0
[[
K
[[
1
[[
K
. (8)
The modal operators are interpreted in the usual way:
[[2[[
K
= w W
K
[ Scs
K
(w) [[[[
K
, (9)
[[3[[
K
= w W
K
[ Scs
K
(w) [[[[
K
,= . (10)
The denition of the semantics of the xed point operators needs a little preparation.
When K is a Kripke structure, q is a propositional variable, and W W
K
, then
K[q W] denotes the Kripke structure dened by
K[q W] = (W
K
, A
K
,
K
[q W])
where
K
[q W] itself is given by

K
[q W](q

) =
_
W if q

= q,

K
(q

) if q

,= q,
(11)
Alternating Tree Automata, Parity Games, and Modal -Calculus 365
that is,
K
[q W] is identical to
K
except at q where its value is W.
The semantics of the xed point operators is now dened by
[[q[[
K
=

W W
K
[ [[[[
K[qW]
W , (12)
[[q[[
K
=
_
W W
K
[ [[[[
K[qW]
W . (13)
Let be an arbitrary L

formula and K a Kripke structure. Then it is easy

to see that W [[[[
K[qW]
is a monotone function on 2
W
K
. Therefore, this
function has a least and a greatest xed point (with respect to set inclusion). By
the Knaster/Tarski Theorem, these xed points are identical with the sets denoted
by the right-hand sides of (12) and (13), respectively.
We also have the following characterization. Let f be the above function on
2
W
K
. For every ordinal , let W

W
K
be dened by
W
0
= ,
W
+1
= f(W

),
W

<
W

for every limit ordinal.

The set W

is called the -approximant of the least xed point of f. Then W

On
is a monotone sequence that at some point becomes stationary and reaches the least
xed point of f. A symmetric statement holds for the greatest xed point of f,
where approximation starts with W
0
= W
K
.
Given a pointed Kripke structure K, we will write (K, w) [= for w [[[[
K
.
Example 1. Consider the following simple formula,
0
= q
0
(2q
0
). In every Kripke
structure K, [[
0
[[
K
is the set of all worlds of K where no innite path starts.
Next, consider the formula
1
= q
1
(q
0
3q
1
). For every Kripke structure K,
[[
1
[[
K
is the set of all worlds of K from which, in a nite number of steps, possible
0, a world is reachable where q
0
holds. Similarly,

1
= 3
1
denes the property
that in a nite number of steps, but at least 1, a world is reachable where q
0
holds.
Thus,
2
= q
2
(

1
[q
2
q
0
/q
0
]) denes the property that there exists a path where
at innitely many positions q
0
holds.
2.1.5 Query-Based Semantics
It will be useful to have a dierent view of the semantics of L

. Clearly, when
is an L

formula, then K [[[[

K
is a Kripke query, which we denote by [[[[.
For every connective or operator of L

, we will dene a corresponding operation on

Kripke queries.
Disjunction and conjunction are easy to deal with. Clearly,
[[ [[ = [[[[ [[[[ , (14)
[[ [[ = [[[[ [[[[ , (15)
for arbitrary L

formulas and .
366 Th. Wilke
For the modalities 3 and 2 we dene two new operators on Kripke queries. For
every Kripke query Q, we dene
3Q: K w W
K
[ Scs
K
(w) Q(K) ,= , (16)
2Q: K w W
K
[ Scs
K
(w) Q(K) . (17)
Then,
[[3[[ = 3[[[[ , [[2[[ = 2[[[[ , (18)
for every L

formula .
Similarly, we dene operators on Kripke queries corresponding to the two xed
point operators. For every Kripke query Q and propositional variable q we dene
Kripke queries qQ and qQ by
qQ: K

W W
K
[ Q(K[q W]) W , (19)
qQ: K
_
W W
K
[ Q(K[q W]) W . (20)
Then,
[[q[[ = q[[[[ , [[q[[ = q[[[[ , (21)
for every L

formula .
Finally, we consider substitution, even though substitution is neither part of the
denition of the syntax of L

nor involved in the denition of its semantics. But it

will turn out to be useful to have a counterpart to substitution on the query side.
It will be enough to consider substitutions with one variable only.
Assume Q and Q

are Kripke queries and q is a propositional variable. The query

Q[q Q

] (22)
is dened by
K Q(K[q Q

(K)]) . (23)
Using a straightforward induction, one can now prove that if q is a propositional
variable, an L

formula positive in q, and L

, then
[[[/q][[ = [[[[[q [[[[] . (24)
This is the analogue of the substitution principle in predicate logic. Note that it
is necessary to require that be positive in q because otherwise the substitution is
not dened.
2.1.6 Fixed Point Alternation
Besides its length, the most important characteristic of a modal -calculus formula
is its xed point alternation depth, that is, the number of alternations between least
and greatest xed point operators. There are several ways to dene an appropriate
concept of xed point alternation. The simplest one is to count syntactic alternations
Alternating Tree Automata, Parity Games, and Modal -Calculus 367
between least and greatest xed point operators. A more involved one, which was
tailored specically for the purposes of ecient model-checking, was introduced by
Emerson and Lei, [7]. It gives rise to a coarser hierarchy. The one we use here
denes an even coarser hierarchy and was introduced by Damian Niwi nski, [18]. His
denition turned out to be the most useful one in the sense that it yields the best
complexity bounds.
We denote the relation is proper subformula of by <. Let be an L

formula.
An alternating -chain in of length l is a sequence
q
0

0
> q
1

1
> q
2

2
> > /q
l1

l1
(25)
where, for every i < l 1, the variable q
i
occurs free in every formula with

i

i+1
. The maximum length of an alternating -chain in is denoted by
m

(). Symmetrically, -chains and m

() are dened.
The alternation depth of an L

formula is the maximum of m

() and m

()
and is denoted by ().
Example 2. Let
0
,
1
,

1
, and
2
be the L

formulas from Example 1. Then

(
0
) = (
1
) = (

1
) = 1. On the other hand, (
2
) = 2.
A more interesting example is the formula
3
= q
1
(q
1
(q
0
3q
1
) 2q
1
). This
formula denes the property that on all paths eventually a world is reached where
an innite path starts on which q
0
holds generally. The alternation depth of
3
is 1.
Alternatively, the alternation depth of a formula can be dened using the notion
of the graph of an L

formula.
The graph of an L

formula , denoted G(), is the directed graph whose vertices

are the subformulas of and where the edges starting in a vertex are determined
as follows.
If = , = , = q, or = q and the occurrence of q is free in , then
has no outgoing edge.
If = q and the occurrence of q is bound in , say q binds q, then has
an edge to q.
If =

or =

, then has an edge to and to

.
If = 3, = 2, = q, or = q, then has an edge to .
Strictly speaking, one has to distinguish between a subformula and its occurrence.
In the denition of G(), we always mean the latter. This makes no dierence when
we assume is in normal form as explained in Subsection 2.2.2.
The alternation depth of a formula can now be determined as follows. If no
variable is bound in , then () = 0. If = q with q free in and without
xed point operators, then () = 1. In all other cases, suppose the alternation
depth of all proper subformulas of has already been determined. Let M be the
maximum of all these values. If is a xed point formula of the form q and there
exists a xed point formula

of alternation depth M in the strongly connected

component of in G() and ,=

holds, then () = M + 1. In all other cases,

() = M.
This also shows:
368 Th. Wilke
Remark 1. Let be an L

formula and a strongly connected subset of G().

Then the following is true.
1. There exists a xed point formula = q of alternation depth > 0 which is
maximal in (w. r. t. the subformula order).
2. Let

be any other xed point formula in . Then () (

) and,
moreover, the inequality is strict if ,=

.
2.2 Alternating Tree Automata
Alternating tree automata are used to dene Kripke queries, and we will later see
that they can dene every Kripke query which is denable by a modal -calculus
formula. The converse is true as well, but will not be proved in this paper. For
details, see [19].
2.2.1 Informal Description
Alternating tree automata are nite-state devices designed to accept or reject poin-
ted Kripke structures. The computation of an alternating tree automaton on a
pointed Kripke structure proceeds in rounds. At the beginning of every round there
are several copies of the alternating tree automaton in dierent worlds of the Kripke
structure, each of them in its own state; some worlds might be occupied by many
copies, others might not accommodate a single one. During a round, each copy
splits up in several new copies, which are sent to neighbored worlds and change
their states, all this done according to the transition function. Initially, there is only
one copy of the alternating tree automaton; it resides in the distinguished world
of the pointed Kripke structure and starts in the initial state of the alternating
tree automaton. To determine acceptance or rejectance of a computation of an
alternating tree automaton on a pointed Kripke structure the entire computation
tree is inspected; acceptance is then dened via path conditions for the innite
branches of the computation tree. Namely, every state will be assigned a priority
and an innite branch of the computation will be accepting if the maximum priority
occurring innitely often is even; a computation tree will be accepting if each of its
innite branches is accepting.
Example 3. A perfect example is the following automaton, A
0
, which accepts a
pointed Kripke structure (K, w
I
) if all paths starting in w
I
are nite. The automaton
has only one state, s, which is assigned priority 1. So, according to what was said
above, it allows no innite computation paths. The transition function is dened
by (s) = 2s, which determines that if a copy of the automaton reaches a world w
(in state s), then this copy splits up and every successor of w gets a copy in state
s. Clearly, the only situation where no innite computation paths emerge is when
there is no innite path starting in w
I
. In other words, this automaton is equivalent
to the formula
0
from Example 1.
Next, we construct an alternating tree automaton A
1
which accepts a pointed
Kripke structure (K, w
I
) if from w
I
a world is reachable where q
0
holds. The only
dierence with A
0
is that the transition function is dened by (s) = q
0
3s. This
is read as follows. If a copy of the automaton is in some world w (in state s), the
Alternating Tree Automata, Parity Games, and Modal -Calculus 369
automaton may stop if q
0
holds or a copy of the automaton is sent to a successor
and goes into state s. Since s is assigned priority 1 and we require that on every
innite computation path the maximum priority occurring innitely often be even,
no innite computation path is allowed. In other words, A
1
is equivalent to
1
from
Example 1.
Finally, we construct an automaton A
2
, which is equivalent to formula
2
from
Example 1. The automaton A
2
has two states, s and s, where s has priority 2 and
s has priority 1. Then an innite branch of the computation is accepted if s occurs
innitely often. The transition function of A
2
is designed in such a way that it simply
propagates whether q
0
holds or not in the current world to one of the successors,
that is, the transition function is given by (s) = ( s) = (q
0
3s) (q
0
3 s).
Clearly, this automaton works.
2.2.2 Formal Denition
Formally, an alternating tree automaton is a tuple
A = (S, s
I
, , ) (26)
where
S is a nite set of states,
s
I
S is an initial state,
is a transition function as specied below, and
: S is a priority function, which assigns a priority to each state.
The transition function maps every state to a transition condition over S where
the set of all transition conditions over S is dened by:
0 and 1 are transition conditions over S,
q and q are transition conditions over S, for every q Q,
s, 2s, and 3s are transition conditions over S, for every s S,
s s

and s s

are transition conditions over S, for s, s

S.
Example 4. Clearly, automaton A
0
from Example 3 is an alternating tree auto-
maton in the above sense. Strictly speaking, this is not true for the two other
automata from Example 3, for their transition conditions are too complicated. By
introducing additional states, however, this can be taken care of.
For instance, to turn A
1
into an equivalent alternating tree automaton according
to the above denition one would add new states s
l
and s
r
with priority 1 and dene
the transition function by (s) = s
l
s
r
, (s
l
) = q
0
, and (s
r
) = 3s.
370 Th. Wilke
2.2.3 Runs
The computational behavior of alternating tree automata is explained using the
notion of a run. Assume A is an alternating tree automaton and (K, w
I
) a pointed
Kripke structure. A run of A on (K, w
I
) is a (W S)-vertex-labeled tree
R = (V
R
, E
R
,
R
) (27)
such that
R
is labelled (w
I
, s
I
) and for every vertex v with label (w, s) the following
conditions are satised.
(s) ,= 0.
If (s) = q, then w
K
(q), and if (s) = q, then w /
K
(q).
If (s) = s

, then there exists v

Scs
R
(v) such that (v

) = (w, s

).
If (s) = 3s

, then there exists v

Scs
R
(v) such that s
R
(v

) = s

and w
R
(v

)
Scs
K
(w).
If (s) = 2s

, then for every w

Scs
K
(w) there exists v

Scs
R
(v) such that
(v

) = (w

, s

).
If (s) = s

, then there exists v

Scs
R
(v) such that (v

) = (w, s

) or
(v

) = (w, s

).
If (s) = s

, then there exist v

, v

Scs
R
(v) such that (v

) = (w, s

) and
(v

) = (w, s

).
The run is accepting if the state labeling of every innite branch through R
satises the parity acceptance condition determined by . This is formalized as
follows.
An innite branch of R is accepting if sup(
1
) is even. (Recall that
1
denotes the the state component of the labeling.) The run R is accepting if every
innite branch through R is accepting.
In other words, for every innite branch we consider the sequence of natural
numbers that is obtained from by extracting the state component of the labelings
of the vertices and applying the priority function ; we require that the maximum
natural number occurring innitely often is even.
A pointed Kripke structure is accepted by A if there exists an accepting run
of A on the Kripke structure. The query recognized by A, denoted [[A[[, contains
all pointed Kripke structures accepted by A. An L

formula is equivalent to an
alternating tree automaton if the formulas denes the query that the automaton
recognizes.
2.2.4 Index
Similar to the notion of alternation depth for L

formulas we now dene the notion

of index of an alternating tree automaton.
Alternating Tree Automata, Parity Games, and Modal -Calculus 371
Let A be an alternating tree automaton. The transition graph of A, denoted
G(A), is the directed graph with vertex set S and with an edge from a state s to a
state s

if s

occurs in (s). Let C

A
be the set of all strongly connected components
of the transition graph of A. For every C C
A
, let
m
A
C
= [
A
(s) [ s C[ (28)
denote the number of priorities used in C. The index of A, denoted ind(A), is the
maximum of all these values, that is,
ind(A) = max(m
A
C
[ C C
A
0) . (29)
2.2.5 Partial Priority Functions and Complex Transition Conditions
From now on we will also allow partial priority functions with alternating tree auto-
mata. The only thing we require of an alternating tree automaton A with a partial
priority function is that on every innite path through G(A) there must be a state
with a priority assigned. This also implies that on every innite path a state with
a priority assigned occurs innitely often.
Equivalently, the restriction of G(A) to the states with no priority must not
have a strongly connected component. By convention, a partial priority function is
extended to a total priority function by assigning to each state with no priority the
minimum priority assigned in the strongly connected component of G(A) the state
belongs to. Further, all states that do not belong to a strongly connected component
get priority 0. Note that this does not change the index of the automaton.
Acceptance for automata with partial priority functions can equivalently be
dened as follows. A run is accepting if on every innite branch innitely many
states with a priority occur and the maximum priority occurring innitely often is
even.
The transition conditions dened above are simpler than the ones used in Ex-
ample 1. The more restrictive denition of transition condition makes most of the
proofs easier and does not go along with a loss in expressiveness. In some situations
however, for instance, if one wants to show that a certain Kripke query is recogniz-
able by an alternating tree automaton, one would want to use a richer syntax.
The most general option is to allow any modal formula over Q and S as a
transition condition. (An adaption of the semantics is straightforward.) It is in
fact easy to see that even such a rich syntax does not lead to a more powerful
automaton model: every such automaton can be turned into an automaton according
to our denition by introducing additional states, namely a new state for every
subformula of a complex transition condition, and adapting the transition condition
appropriately, see Example 4.
So, henceforth, we willwithout loss of generalityallow complex transition
conditions.
2.3 The Translation
As we will see, it is straightforward to construct for every L

formula an alternating
tree automaton that recognizes the exact query that the formula denes. It is,
372 Th. Wilke
however, more complicated to prove the correctness of the construction.
2.3.1 Informal Description
Let be an arbitrary L

formula. An alternating tree automaton can check that

a given pointed Kripke structure (K, w) satises as follows. It simply unwinds
the formula, that is, the automaton will have a state ) for each subformula of
, and the transition condition for a state reects the outermost connective of the
corresponding subformula. For instance, if =
0

1
, then ()) =
0
)
1
).
The most interesting case is when = q. If the occurrence of q in is free, then
(q)) = q, that is, the automaton simply checks if q holds in the current world. But
if the occurrence is bound, then it is bound by a xed point operator, say is the
corresponding subformula, and the automaton will expand the variable q in that it
replaces state q) by ). The intuition behind this is that it starts a recursion on
it expands the xed point.
Clearly, least and greatest xed points have to be dealt with dierently. For a
greatest xed point it is ok if it is expanded innitely often, but for a least xed point
only a nite number of expansions should be allowed. If xed point subformulas are
nested and expanded over and over again, the outermost xed point is the most
relevant one. To account for this, the priority function is chosen appropriately.
Example 5. Consider
1
from Example 1 again. The automaton corresponding
to
1
will have the following states: q
1
(q
0
3q
1
)), q
0
3q
1
), q
0
), 3q
1
), and
q
1
). The initial state is q
1
(q
0
3q
1
)) and all states get priority 0 except for
q
1
(q
0
3q
1
)), which gets priority 1. The transition function is given by
(q
1
(q
0
3q
1
))) = q
0
3q
1
) , (30)
(q
0
3q
1
)) = q
0
) 3q
1
) , (31)
(q
0
)) = q
0
, (32)
(3q
1
)) = 3q
1
) , (33)
(q
1
)) = q
1
(q
0
3q
1
)) . (34)
From this transition table, we see that q
0
3q
1
), q
0
), and q
1
) are not really
necessary in the sense that we can take shortcuts. In fact, we can shorten the
denition of the transition function:
(q
1
(q
0
3q
1
))) = q
0
) 3q
1
) , (35)
(q
0
)) = q
0
, (36)
(3q
1
)) = 3q
1
(q
0
3q
1
)) . (37)
This automaton is exactly the same automaton (modulo renaming of the states) as
the one in Example 4.
The details of the general construction follow.
2.3.2 Formal Denition
Given a formula , we dene an alternating tree automaton A() as follows. The
subformulas of build the states of A(); the formula itself is the initial state, the
Alternating Tree Automata, Parity Games, and Modal -Calculus 373
transition function reects the structure of the formula, and the priority function
reects the alternation structure of the formula. This is explained in detail in what
follows.
We rst dene a normal form for L

formulas. An L

formula is in normal form

if every propositional variable q is only quantied at most once and if in this case
all occurrences of q are in the scope of this quantication. Clearly, every formula
is equivalent to a formula in normal form of the same size and alternation depth.
So, henceforth, we willwithout loss of generalityassume that all formulas are in
normal form.
Given an L

formula in normal form and a propositional variable q occurring

in , exactly one of the following two conditions is true.
1. Every occurrence of q in is free.
2. Every occurrence of q in is quantied by the same xed point operator, that
is, it is bound in the same subformula q.
In the second case, we denote the formula q by
q
.
Let be an L

formula in normal form. The alternating tree automaton A()

is dened by
A() = (S, s
I
, , ) (38)
where
S is the set which contains for each subformula of (including itself) a
state denoted ),
the initial state is given by s
I
= ),
the transition function is dened by
()) = 0 , ()) = 1 , (39)
(q)) =
_
q if q free(),

q
) if q / free(),
(q)) = q , (40)
( )) = ) ) , ( )) = ) ) , (41)
(3)) = 3) , (2)) = 2) , (42)
(q)) = ) , (q)) = ) , (43)
for every F

with () > 0, ()) = 2()/2| 1, and

for every F

with () > 0, ()) = 2()/2|.

This concludes the denition of A().
From Remark 1 it follows:
Remark 2. Let be an L

formula and a set of subformulas of such that

) [ is strongly connected in the transition graph of A(). Then the
following is true.
1. There exists a xed point formula of alternation depth > 0 which is maximal
in (w. r. t. the subformula order).
2. For every element , we have () ().
374 Th. Wilke
Another important observation is the following.
Remark 3. Let be an L

formula. Then () = ind(A()).

The main theorem of this section is:
Theorem 1. Let be an arbitrary L

formula. Then and A() are equivalent,

that is,
[[[[ = [[A()[[ . (44)
2.3.3 Proof of Correctness
The proof of the above theorem goes by induction on the size of . As a preparation,
we prove a series of lemmas, which show how the operators and connectives of L

can be modeled by automata. In fact, the constructions discussed are exactly as in

the translation described above.
Disjunction and Conjunction. We start with disjunction and conjunction. Let
A and A

be alternating tree automata. Further, let s

I
be some new state and m
the maximum of
A
(s
A
I
) and
A

(s
A

I
). Then A+A

and A A

are dened by
A+A

= (S
A
S
A

s
I
, s
I
,
A

A

(s
I
, s
A
I
s
A

I
),
A

A

) , (45)
A A

= (S
A
S
A

s
I
, s
I
,
A

A

(s
I
, s
A
I
s
A

I
),
A

A

) , (46)
where S
A
and S
A

are made disjoint beforehand.

The rst thing we observe is the following. If and are L

formulas, then A(
) = A() +A(), and, similarly, A( ) = A() A() (up to isomorphism).
In addition, we have:
Lemma 2. Let A and A

be alternating tree automata. Then

[[A+A

[[ = [[A[[ [[A

[[ , [[A A

[[ = [[A[[ [[A

[[ . (47)
Proof. We only prove the claim for ; the proof for is similar. First, assume
(K, w) is accepted by A + A

. Let R be a minimal accepting run of A+ A

on
(K, w). Then, by denition of the transition function of A+A

, the root of R has

exactly one successor v, which is labeled with (w, s
A
I
) or (w, s
A

I
). Clearly, Rv (the
subtree of R rooted at v) is an accepting run of A or A

. So (K, w) [[A[[ [[A

[[.
For the converse containment, assume R is an accepting run of A or A

on some
pointed Kripke structure (K, w). Consider the following tree. It has a root v labeled
(w, s
I
) with exactly on successor v

and the subtree rooted at v

is identical with R.
Then this tree is an accepting run of A+A

on (K, w). Hence, (K, w) [[A+A

[[.
The requirement that the state sets of Aand A

are made disjoint is very strong.

Clearly, the following would be enough. The transition functions of Aand A

as well
as their priority functions agree on every joint state. So, overlapping state spaces
can be tolerated to a certain extent.
Alternating Tree Automata, Parity Games, and Modal -Calculus 375
Modal operators. Next, we consider the modal operators. For an arbitrary al-
ternating tree automaton A, we set
3A = (S
A
s
I
, s
I
,
A
(s
I
, 3s
A
I
),
A
) , (48)
2A = (S
A
s
I
, s
I
,
A
(s
I
, 2s
A
I
),
A
) , (49)
where s
I
is some new state.
Similar to above, we rst note that if is an L

formula, then 3A() = A(3)

and 2A() = A(2). In addition to this, we have:
Lemma 3. Let A be an alternating tree automaton. Then
[[3A[[ = 3[[A[[ , [[2A[[ = 2[[A[[ . (50)
Proof. We only prove the claim for 3; the proof for 2 is analogous.
Let (K, w) be an arbitrary pointed Kripke structure. First, assume (K, w) is
accepted by 3A. Let R be a minimal accepting run of 3A on (K, w). Then, by
denition of the transition function of 3A, the root of R has exactly one successor
v with s
R
(v) = s
A
I
and w
R
(v) Scs
K
(w). Clearly, the subtree of R rooted at this
vertex is an accepting run of A on (K, w
R
(v)). So (K, w) 3[[A[[.
For the converse containment, assume (K, w) 3[[A[[. Then there exists w

Scs
K
(w) such that (K, w) [[A[[. Let R be an accepting run of A on (K, w

).
Consider the following tree. It has a root v labeled (w, s
I
) with exactly one successor
v

and the subtree rooted at v

is identical with R. Then this tree is an accepting

run of 3A on (K, w). Thus, (K, w) [[3A[[.
Composition. An alternating tree automaton A is positive in the propositional
variable q if q does not occur in any transition condition
A
(s). Observe that
whenever A is such an alternating tree automaton, then
[[A[[(K[q W]) [[A[[(K[q W

]), (51)
for every Kripke structure K and sets W, W

with W W

W
K
.
Let q be an arbitrary propositional variable, A an alternating tree automaton
positive in q, and A

an arbitrary alternating tree automaton. We dene an altern-

ating tree automaton A[A

/q] by
A[A

/q] = (S
A
S
A

, s
A
I
, ,
A

A

) (52)
where the state sets are made disjoint beforehand and is obtained from
A

A

by replacing q in every transition condition

A
(s) by s
A

I
. Just as above it is not
really necessary to make the state sets disjointit suces to make them disjoint
where the transition functions or the priority functions do not agree.
Here, we have:
Lemma 4. Let q be a propositional variable, A an alternating tree automaton pos-
itive in q, and A

an arbitrary alternating tree automaton. Then

[[A[A

/q][[ = [[A[[ [q [[A

[[] . (53)
376 Th. Wilke
Proof. Let (K, w) be a pointed Kripke structure and assume (K, w) is accepted by
A[A

/q]. Let R be a minimal accepting run of this alternating tree automaton on

(K, w). Let V

be the set of all vertices v of R with s

R
(v) = s
A

I
and W

= w
R
(v) [
v V

.
Let T = R V

. By construction, this tree is an accepting run of A on the

pointed Kripke structure (K[q V

], w). Since A is positive in q, it is enough to

show that W

[[A

[[(K). But this is trivial, as for every v V

, the tree Rv is
an accepting run of A

on (K, w
K
(v)).
For the converse, assume (K, w) [[A[[ [q [[A

[[]. Then (K[q W], w)

[[A[[ where W = w

W
K
[ (K, w

) [[A

[[. For every w

W, let R
w
be a
minimal accepting run of A

on (K, w

). Further, let R be a minimal accepting run

of A on (K[q W], w).
Consider the tree R

= R (v, R
w
K
(v)
) [ w
K
(v) W. Clearly, this tree is an
accepting run of A[A

/q] on (K, w).

The observant reader might have noticed that I have not made the following
claim (in analogy to the other operations on automata that we have considered
before): if and are L

formulas and q a variable occurring positive in , then

A([/q]) = A()[A()/q] (up to isomorphism). The reason is this is not true;
the priority function would have to be dened in a more sophisticated way. But we
dont have to make this eort, for the above lemma will not be used directly in the
proof of Theorem 1, only in the proof of the lemma below about the xed point
operators.
Fixed point operators. Finally, we model least and greatest xed point op-
erators. Let q be an arbitrary propositional variable and A an alternating tree
automaton positive in q. We want to construct alternating tree automata that re-
cognize q[[A[[ and q[[A[[, respectively. The only dicult part in the construction
is the denition of the priority function.
The alternating tree automata qA and qA are dened by
qA = (S
A
s
I
, s
I
, ,
A
(s
I
, m

)) , (54)
qA = (S
A
s
I
, s
I
, ,
A
(s
I
, m

)) , (55)
where s
I
is a new state, is as
A
(s
I
, s
A
I
) except that every occurrence of q is
replaced by s
I
, and m

and m

are yet to be dened.

Let M be the maximum priority in A. If s
I
does not belong to a strongly
connected component of G(A), then m

= m

= 0. If it belongs to a strongly
connected component of G(A) and this component contains a state with priority
M, then m

[m

] is the least odd [even] number M. In all other cases, m

[m

]
is the greatest odd [even] number M. The last rule is not well-dened for m

if
M = 0; by convention, in this case, we set m

= 1.
We rst note that A(q) = qA() and A(q) = qA() (up to isomorph-
ism).
Lemma 5. Let q be a propositional variable and A an alternating tree automaton
positive in q. Then
[[qA[[ = q[[A[[ , [[qA[[ = q[[A[[ . (56)
Alternating Tree Automata, Parity Games, and Modal -Calculus 377
Proof. Let K be an arbitrary Kripke structure. Let f : 2
W
K
2
W
K
be dened by
f : W [[A[[(K[q W]) . (57)
We want to show that [[qA[[(K) and [[qA[[(K) are, respectively, the least and
greatest xed point of f. We denote these xed points by W

and W

, respectively.
We rst show that W

and W

are xed points of f and consider only ; the

argument is similar for . Clearly, (accepting) runs of qA and A[qA/q] are in a
natural one-to-one correspondence. Thus,
W

= [[qA[[(K) (58)
= [[A[qA/q][[(K) (59)
= [[A[[(K[q [[qA[[(K)]) (60)
= [[A[[(K[q W

]) (61)
= f(W

) , (62)
where (58) and (61) use the denition of W

, (59) is due to the above observation,

(60) is Lemma 4, and (62) is just the denition of f.
So for the rest it is enough to show:
1. Every element of W

belongs to some approximant for the least xed point of

f.
2. Whenever [[A[[(K[q W]) = W for some W W
K
, then W W

.
First, assume w W

. Let R be a minimal accepting run for qA on (K, w)

and U the set of all vertices v with s
R
(v) = s
I
. For every ordinal , let U

be dened
as explained in Lemma 1. Since R is assumed to be accepting, only a nite number
of elements from U occur on every branch through R. Lemma 1 then implies that
for every v U there exists an ordinal
v
such that v U

. Using transnite
induction, it is easy to show that for every ordinal and every v U

, w
R
(v) is in
the -approximant of f from below. In particular, w is in the
v
-approximant of f
from below where v is the root of R.
Second, suppose W is a xed point of f. Just as above, we can argue that for
every w W there exists an accepting run of A on (K[q W], w). Pick such an
accepting run for every w W and denote it by R
w
. Further, assume all the R
w
s
are minimal.
Fix an arbitrary w W. We dene a sequence T
0
, T
1
, . . . of trees where each
tree T
i
is a subgraph of T
i+1
. The limit of this sequence, which we denote by T,
will be an accepting run of qA on (K, w).
The inductive denition of the T
i
s is as follows. First, for every w

W let R

be the tree that results from R

w
by adding a new root labeled (w

, s
I
). Second,
let T
0
= R

w
. Third, assume T
i
has already been dened and let B
i
= v V
T
i
[
w
T
i
(v) W. Then T
i+1
is dened by
T
i+1
= T
i
(v, R

w
T
i (v)
) [ v B
i
. (63)
Clearly, T is a run of qA on (K, w). We only need to show that it is accepting.
Assume is an innite branch of T. We distinguish two cases. First, suppose
is a branch of some tree T
i
. Then, just as before, there is some w

W such that a
sux of is an innite branch of R
w
and is therefore accepting. Second, suppose
378 Th. Wilke
is not a branch of any T
i
. Then s
I
occurs innitely often on , but
A
(s
I
) is the
maximum priority occurring in a strongly connected component of the transition
graph of qA and
A
(s
I
) is even. So is an accepting branch.
Proof of Theorem 1. As stated above, the proof of Theorem 1 goes by induction.
Clearly, [[A()[[ = [[[[ whenever is of the form , , q, or q. If is a com-
posite formula, we distinguish several cases according to the outermost connective
or operator. If the outermost connective is disjunction or conjunction, the claim
follows from Lemma 2. Similarly, if the outermost operator is a modal operator, the
claim follows from Lemma 3. Finally, if the outermost connective is a xed point
operator, the claim follows from Lemma 5.
3 Model-Checking
In this section, we look at a rst application of the main theorem of the last section:
we investigate the complexity of the model checking problem for L

. This is the
following problem.
ModelChecking: given a nite pointed Kripke structure (K, w) and an L

formula , determine whether or not (K, w) [= .

Now that we know that for every L

formula there exists an equivalent alternating

tree automaton, the model checking problem can be reduced to the acceptance
problem for alternating tree automata, which is the following problem.
Accepts: given a nite pointed Kripke structure (K, w) and an alternating tree
automaton A, determine whether A accepts (K, w).
The acceptance problem for alternating tree automata itself will be reduced to
the winner problem for parity games.
In the rst subsection, the fundamentals about parity games are briey recalled.
In the second subsection, the reduction from the model checking problem for the
modal -calculus to the winner problem for parity games is described. This also
yields the desired upper bound for the complexity of the model checking problem
for modal -calculus.
3.1 Parity Games
Parity games are a special form of two-player innite games on graphs.
3.1.1 Informal Description
A parity game is played by two players, the male Player 0 and the female Player 1.
It is played on a game board which shows circles, Player 0s locations, and boxes,
Player 1s locations. The circles and boxes are connected by arrows. One of the
locations is a distinguished initial location, and every location is assigned a number
from a nite set of natural numbers, its priority.
A parity game is played using a pebble, which during a play of the game is moved
by the players from location to location along the arrows on the game board.
Alternating Tree Automata, Parity Games, and Modal -Calculus 379
A play of a game proceeds in rounds. At the beginning of each round, the pebble
is in some location, the current location. In the rst round, the current location is
the initial location. The rules for playing a round are as follows. If the current
location is a dead end, then the play is over and the player who owns the locations
looses. If the current location is no dead end the player who owns the current
location moves the pebble from this location along an arrow to another location and
thereby completes the round. (Note that there is no restriction on the arrows. So
it can very well be that there are self arrows and the new current location will be
the old current location and the same player goes again in the next round.)
If a play does not stop after a nite number of rounds an innite number of
locations is visited during the course of the play and the play can be viewed as an
innite sequence of locations. In this case, the winner is determined as follows. One
considers (the bounded) sequence of natural numbers that is obtained by replacing
every location of the above sequence by its priority. Player 0 wins if the maximum
number occurring innitely often in this sequence is even, else Player 1 wins.
3.1.2 Formal Denition
Formally, a parity game is a tuple
P = (L
0
, L
1
, l
I
, M, ) (64)
where
L
0
and L
1
are disjoint sets, the sets of Player 0s and Player 1s locations,
respectively,
l
I
L
0
L
1
is an initial location,
M (L
0
L
1
) (L
0
L
1
) is a set of moves, and
: (L
0
L
1
) is a priority function with a nite range.
The set of all locations, L
0
L
1
, is denoted by L. Clearly, the ordered pair (L, M)
is a directed graph, which is denoted G(P) and called the game graph of P.
A partial play of P is a path through G(P) starting with l
I
. A play of P is a
maximum path through G(P) starting with l
I
. A play p is winning for Player 0 if
it is innite and sup(p) is even or if it is nite and p() L
1
. Symmetrically, a
play is winning for Player 1 if it is innite and sup(p) is odd or if it is nite and
p() L
0
.
A Player 0 wins a game (as opposed to a play) if he has a way to move such that
regardless of how his opponent moves he wins each of the resulting plays. This is
formalized as follows.
A strategy tree for Player 0 in P is a tree T satisfying the following conditions.
The root of T is labeled l
I
.
Every v V
T
with
T
(v) L
0
has a successor in T labeled with a successor
of
T
(v) in G(P), that is, Player 0 must move when it is his turn.
380 Th. Wilke
Every v V
T
with
T
(v) L
1
has, for every successor l of
T
(v) in G(P) a
successors in T labeled l, that is, all options for Player 1 have to be taken into
account.
A branch v of a strategy tree T is winning if its labeling, which is a play, is winning.
A strategy tree T for Player 0 is winning if every branch through T is winning.
Player 0 wins a game P if there exists a winning strategy tree for him. Symmetric-
ally, it is dened what it means for Player 1 to win a play or a game.
Example 6. First, suppose P is a game where
P
(l) = 0 for every l L
P
. Then,
clearly, Player 0 wins P if and only if he has a way to avoid to run into a dead end
where it is his move.
Second, suppose
P
(l) = 1 for every l L
P
. Then Player 0 wins P if and only
if he has a way to force the game into a dead end where it is Player 1s move.
Next, suppose
P
(l) 1 and that there are no dead ends. Then Player 0 wins
if and only if he can play in such a way that only a nite number of locations with
priority 1 are visited.
Example 7. Let P be an arbitrary parity game with
P
: L
P
0, 1, . . . , b 1.
Let (K, w
I
) be the pointed Kripke structure where W
K
= L
P
, A
K
= M
P
, w
I
= l
I
,
(q) = L
P
0
and, for every i < b, (q
i
) = l L
P
[
P
(l) = i. That is, we view P
as a pointed Kripke structure.
It is now easy to design an alternating tree automaton A
b
which accepts (K, w
I
)
if and only if Player 0 wins P. The automaton A
b
has a state s
i
with priority i for
every i < b. The transition function is given by
(s
j
) =

i<b
(q q
i
3s
i
)

i<b
(q q
i
2s
i
) , (65)
for every j < n. So A
b
simply propagates the priorities of the locations in exactly
the right way: if it is Player 0s move, the priority is propagated to one successor, if
it is Player 1s move, the priority is propagated to all successors.
Example 8. [6] The previous example also helps us to come up with an L

formula

b
that holds in (K, w
I
) if and only if Player 0 wins P. We simply set

b
= /s
b1
/s
b2
/s
b3
. . . s
0
_
_

i<b
(q q
i
3s
i
)

i<b
(q q
i
2s
i
)
_
_
(66)
where the sequence of xed point operators starts with if b 1 is odd and
otherwise. To see that this formula is correct one constructs the automaton A

b
and compares it with A
b
as constructed in the previous example.
3.1.3 Complexity
There is a basic question about parity games that we need to answer before we can
try to solve the model-checking problem: How dicult is it to determine whether
or not Player 0 wins a nite parity game?
Formally, this problem is dened as follows.
Alternating Tree Automata, Parity Games, and Modal -Calculus 381
Wins: given a nite parity game P, determine whether or not Player 0 wins the
game P.
To describe the actual complexity of solving Wins, we need some more deni-
tions; we need to dene a notion of index for a parity game. The index of a nite
parity game P is determined as follows, very similar to the index of an alternating
tree automaton. Let C
P
be the set of all strongly connected components of the game
graph of P reachable from l
P
I
. For every C C
P
, let m
P
C
= max
P
(l) [ l C.
The index of P, denoted ind(P), is the maximum of these numbers, that is,
ind(P) = max(m
P
C
[ C C
P
0) . (67)
The best known upper bounds for the time complexity of Wins are listed in the
following theorem.
Theorem 2. [10, 11]
1. Wins, the winner problem for nite parity games, is solvable in time
O
_
m
_
2n
b
_
b/2
_
(68)
where m is the number of moves in a given game, n the number of locations,
and b its index, that is, n = [L
P
[, m = [M
P
[, and b = ind(P).
2. Wins is in UP co-UP.
Wins is easily seen to be P-hard.
3.2 Reduction of the Acceptance Problem
The objective of this subsection is to solve Accepts as specied earlier. This is
done by a reduction from Accepts to Wins.
Given an alternating tree automaton A and a pointed Kripke structure (K, w
I
)
we want to construct a game P(A, K, w
I
) that Player 0 wins if and only if Aaccepts
(K, w
I
). The basic idea is that the choices Player 0 makes correspond to the choices
A has to make when in a transition condition it has to satisfy a disjunction or a 3
requirement. Symmetrically, the moves for Player 1 correspond to conjunctions and
2 requirements. Recall that a winning strategy for Player 0 has to make sure that
whatever Player 1 does in a play, it will be a win for Player 0.
Formally, the game P(A, K, w
I
) associated with A and (K, w
I
) is dened by
P(A, K, w
I
) = (L
0
, L
1
, (w
K
I
, s
A
I
), M, ) (69)
where the individual components are as follows. The set L
0
is the set of all pairs
(w, s) where (s) is of the form 0, q with q /
K
(w), q with q
K
(w), s

, or
3s

. This also determines L

1
. The successors of a location (w, s) are determined by
the following rules.
If (s) 0, 1 or (s) = q or (s) = q for some q Q, then (w, s) has no
successors.
If (s) = s

, then (w, s) has only one successor, namely (w, s

).
382 Th. Wilke
If (s) = s

or (s) = s

, then (w, s) has two successors, namely (w, s

)
and (w, s

).
If (s) = 3s

or (s) = 2s

, then (w, s) has a successor (w

, s

) for every
w

Scs
K
(w).
Finally, the priority function maps (w, s) to
A
(s).
The desired theorem is the following.
Theorem 3. Let (K, w) be a pointed Kripke structure and A an alternating tree
automaton. The alternating tree automaton A accepts (K, w) if and only if Player 0
has a winning strategy in the game P(K, A, w).
Proof. Just observe that accepting runs of A on (K, w) and winning strategy trees
for Player 0 in P(K, A, w) are identical.
In view of Theorem 2, this yields the following about the complexity of the word
problem for alternating tree automata. Observe that ind(P(K, A, w)) = ind(A).
Theorem 4. 1. Accepts, the word problem for alternating tree automata, is
solvable in time
O
_
_
ln
_
2kn
b
_
b/2
_
_
(70)
where k is the number of worlds of the Kripke structure, l is the size of the
accessibility relation, n is the number of states of the automaton, and b is the
index of the automaton.
2. Accepts is in UP co-UP.
As a consequence, we obtain the following complexity bounds on the model-
checking problem for modal -calculus.
Theorem 5. [10, 23, 14]
1. ModelChecking, the model-checking problem for modal -calculus, is solv-
able in time
O
_
_
ln
_
2kn
b
_
b/2
_
_
(71)
where k is the number of worlds of the Kripke structure, l is the size of the
accessibility relation, n is the number of subformulas of the formula, and b is
the alternation depth.
2. ModelChecking is in UP co-UP.
4 Satisability
In this section, we consider the second application of the main theorem of Section 2:
we investigate the complexity of the satisability problem, which is the following
problem.
Satisfiability: given an L

formula , determine whether or not there exists

a pointed Kripke structure (K, w) such that (K, w) [= .
Alternating Tree Automata, Parity Games, and Modal -Calculus 383
We will attack this problem just as the model-checking problem. Since we know
that every L

formula is equivalent to the alternating tree automaton A(), we

only need to check whether or not A() accepts some pointed Kripke structure, that
is, we reduce Satisfiability to the following problem.
NonEmptiness: given an alternating tree automaton A, determine whether or
not A accepts some pointed Kripke structure.
We solve this problem using parity games. The supercial analogy is the fol-
lowing. Solving the nonemptiness problem for alternating tree automata amounts
to nding a tree that is accepted. Solving the winner problem for a parity game
amounts to nding a winning strategy tree. So in both cases we need to nd a tree.
A direct reduction to the winner problem is, however, quite complicated. Therefore,
we will proceed in several steps.
4.1 Memoryless Strategies and Tree-Like Witnesses
In order to prove that an alternating tree automaton accepts some pointed Kripke
structure it is enough to exhibit a pointed Kripke structure together with an accept-
ing run for it. Eventually, we would like to combine the two into a single object,
more precisely, into a single tree. The rst two steps in this direction are carried
out in this subsection.
First, we show that if there exists an accepting run of an alternating tree auto-
maton on some pointed Kripke structure there also exists an accepting run which is
structurally very similar to the pointed Kripke structure in question. In fact, we use
a deep theorem from the theory of parity games to show that there always exists an
accepting run that can be thought of as a directed graph put on top of the Kripke
structure. This leads to the notion of a tree-like prewitness for nonemptiness.
Second, we show that if there exists a tree-like prewitness at all, then there exists
one which is not too arbitrary in the following sense. When we consider a world of
the underlying Kripke structure together with its successors and the corresponding
subgraph of the accepting run put on top of it, then this structure can be chosen
from a small (exponential in the size of the automaton) set. This leads to the notion
of a tree-like witness for nonemptiness.
For the rest of this chapter, we x an alternating tree automaton A = (S, s
I
, , ).
By , we denote the set of all propositional variables occurring in the transition con-
ditions of A. Only these are relevant to the behavior of the automaton.
4.1.1 Memoryless Strategies
We start with the aforementioned result from the theory of parity games. A game
won by Player 0 is called memoryless if the moves Player 0 has to make in order to
win the game are independent of the history of the game, that is, if Player 0 does not
need to remember anything about the past of a play in order to be able to take the
right decision. This can be easily described formally by looking at strategy trees.
A memoryless strategy tree for Player 0 is a strategy tree T satisfying the following
additional condition. Whenever v, v

V
T
are such that
T
(v) =
T
(v

) L
0
, then
there is a bijection between Scs
T
(v

) and Scs
T
(v

) which preserves the labeling. This

384 Th. Wilke
obviously implies that if
T
(v) =
T
(v

) L
0
, then Tv and Tv

are isomorphic.
Theorem 6. [6, 16] For the winner of any parity game, there exists a memoryless
winning strategy tree.
4.1.2 Kripke Trees and Tree-like Prewitnesses
Next, we dene the notions of a Kripke tree and a tree-like prewitness. A Kripke
tree is a pointed Kripke structure (K, w) where (W
K
, A
K
) is a tree with root w.
For notational convenience, we will omit w and denote it by
K
.
A tree-like prewitness for (the nonemptiness of) A is a pair (K, W) consisting
of a Kripke tree K and a graph W = (V, E) satisfying the following conditions.
(A) The vertex set V is a subset of W
K
S
A
.
(B) For every edge ((w, s), (w

, s

)) E we have w

Scs
K
(w) or w = w

.
(C) Every v V is reachable from (
K
, s
A
I
), which belongs to V .
(D) In every (w, s) V , the transition condition (s) is satised. (For instance,
if (s) = 3s

, then there must exist w

Scs
K
(w) such that (w

, s

) V and
((w, s), (w

, s

)) E.) This will be denoted by (w, s) [= (s).

(E) For every innite path through W, the number sup(p
1

A
) is even.
From Theorem 6 we can now conclude:
Proposition 1. The automaton A accepts some pointed Kripke structure if and
only if there is a tree-like prewitness for A.
Proof. First, note that if A accepts some pointed Kripke structure it also accepts a
Kripke treejust unravel any pointed Kripke structure it accepts. Now, reconsider
the proof of Theorem 3. Assume a Kripke tree (K, w) is accepted by A. Then
there exists a winning strategy tree for Player 0 in P(A, K, w). By Theorem 6,
there exists a memoryless winning strategy tree for Player 0 in this game. Consider
the run that corresponds to this strategy tree. It can be viewed as an accepting
witness. One only needs to identify all vertices with the same labeling and replace
each vertex by its label.
4.1.3 Tree-like Witnesses
Reconsider the denition of a tree-like prewitness; (D) says:
(w, s) [= (s) for every (w, s) V . (72)
In this subsection, we will rephrase this in graph-theoretic terms, and using this
new formulation, we will be able to simplify the notion of a tree-like prewitness as
indicated above.
Let

, S

S, S
2
S, and S
3
S. We dene a (complex) transition
condition by
(

, S

, S
2
, S
3
) =

q\

sS

sS3
3s

sS2
2s . (73)
Alternating Tree Automata, Parity Games, and Modal -Calculus 385
It is now important to observe that every transition condition of A is equivalent
to a disjunction of transition conditions of this form. We will soon see what this
implies.
We need some more notation. Let (K, W) be as above and w W
K
. Further,
assume w

Scs
K
(w). We set
(w) = q [ w
K
(q) , (74)
S(w) = s S
A
[ (w, s) V
W
, (75)
G(w) = (s, s

) [ ((w, s), (w, s

)) E
W
, (76)
G(w, w

) = (s, s

) [ ((w, s), (w

, s

)) E
W
. (77)
So (w) is the set of propositions from holding true in w, the set S(w) is the set of
states assumed in w, the relation G(w) describes the subgraph of W restricted to the
vertices with rst component w, and the relation G(w, w

) describes the subgraph

of W restricted to the edges from vertices with rst component w to vertices with
rst component w

. Observe that (K, W) is implicit in the notation.

Assume (K, W) is a tree-like prewitness for A. Fix w W
K
. Consider an
arbitrary state s S(w). Since W is a tree-like prewitness, we know there exist
sets S

, S
2
, S
3
such that ((w), S

, S
2
, S
3
) implies (s) and
(w, s) [= ((w), S

, S
2
, S
3
) . (78)
Clearly, this must hold for every s S(w), with possibly dierent sets S

, S
2
,
and S
3
. This leads to the following denition. An admissible tile is a tuple
(

, S

, H, H
2
, H
3
) (79)
where

, S

S, H S

, and H
2
, H
3
S

S such that for every s S

the transition condition (

, sH, sH
2
, sH
3
) implies (s). Here, sH denotes the set
of all s

such there exists an s with (s, s

) H and similar for sH

2
and sH
3
.
So (D) from the denition of tree-like prewitness can now be rephrased as follows.
(D
1
) For every w W
K
, there exists an admissible tile ((w), S(w), H, H
2
, H
3
)
such that H G(w), and for every (s, s

) H
3
, there exists w

Scs
K
(w)
with H
2
(s, s

) G(w, w

).
We want to keep witnesses as simple as possible. A tree-like prewitness (K, W) is
called a tree-like witness if:
(D
2
) For every w W, there exists an admissible tile ((w), S(w), H, H
2
, H
3
)
such that H = G(w) and for every (s, s

) H
3
, there exists exactly one
w

Scs
K
(w) with H
2
(s, s

) = G(w, w

).
The dierence is that we require equality instead of containment and unique suc-
cessors.
By replicating subtrees in a given tree-like prewitness and removing unnecessary
vertices, we can obviously turn it into a tree-like witness. So, as a consequence of
Proposition 1, we note:
Corollary 1. The automaton A accepts some pointed Kripke structure if and only
if there exists a tree-like witness for A.
386 Th. Wilke
4.2 Automata on Innite Words and Tree Witnesses
Recall that we want to view a nonemptiness witness as a winning strategy tree in
an appropriate game. The problem with tree-like witnesses is that we require of
a tree-like witness (K, W) that the parity conditions holds on every innite path
through W rather than on every branch of K (cf. (E)). In this subsection, we show
there exists an exponential size -automaton that checks on every branch of K that
all paths of W put on top of this path satisfy the parity condition. This leads to
the notion of a tree witness.
4.2.1 Using Automata on Innite Words
Let (K, W) be a tree-like witness and = w
0
w
1
. . . a branch of W. With , we
associate the graph G() = (V, E) where
V = (i, s) [ (w
i
, s) V
W
, (80)
E = ((i, s), (i, s

)) [ (s, s

) G(w
i
)
((i, s), (i + 1, s

)) [ (s, s

) G(w
i
, w
i+1
) . (81)
So G() is the graph put on top of . Condition (E) from the denition of a
tree-like prewitness can now be rephrased as follows.
(E
1
) For every branch = w
0
w
1
. . . and every innite path

through G() the

parity condition of A holds, that is, sup(

1
) is even.
There are two types of innite paths (s
0
, i
0
)(s
1
, i
1
)(s
2
, i
2
) . . . through a branch
as above:
1. There exists j such that i
j
= i
j+1
= i
j+2
= . . .
2. For every i there exists j with i
j
i.
Paths of the rst type get stuck in some world of and are easy to deal with. In the
following, we will focus on paths of second type, which are called diverging paths.
Let be as above. The graph G() is determined by the sequence
p() = (G(w
0
), G(w
0
, w
1
))(G(w
1
), G(w
1
, w
2
))(G(w
2
), G(w
2
, w
3
)) . . . (82)
Such a sequence can be viewed as an -word over the alphabet = 2
SS
2
SS
.
We will construct an -automaton of exponential size that accepts exactly those
-words over that correspond to graphs where every innite sequence satises the
parity condition of A. We will then be able to rephrase (E
1
) more conveniently.
We start with some denitions. Let g = (B
0
, C
0
)(B
1
, C
1
)(B
1
, C
1
) . . . be any -
word over . The graph of g, denoted G(g), is the graph whose edge set is given
by
((i, s), (i, s

)) [ i((s, s

) B
i
) ((i, s), (i + 1, s

)) [ i((s, s

) C
i
) . (83)
A branch of g is a maximum path through G(g) starting with (0, s
I
) and diverging
in the above sense. The -word g is even if sup(
1
) is even for every innite
branch of g.
We next show that there exists an exponential size deterministic parity -
automaton that accepts all even -words over .
Alternating Tree Automata, Parity Games, and Modal -Calculus 387
Proposition 2. There exists a deterministic parity -automaton C with 2
O(|S|
4
log |S|)
states and priorities bounded by O([S[
4
) that recognizes the set of all even -words
over .
Proof. Let n be the number of states of A. Without loss of generality, we assume
: S 0, . . . , n.
We rst construct a nondeterministic -automaton B recognizing the comple-
ment. This automaton will then be transformed into the deterministic -automaton
we are looking for.
Let (B, C) . We write (B, C) for the set of all triples (s, s

, i) where there
exists a state s

S and a path from s to s

in the graph (S, B) with maximum

priority j and where (s

, s

) C and i = max(j, (s

)).
Consider the nondeterministic parity -automaton
B = (S 0, . . . , [S[, (s
I
, (s
I
)), ,
B
) ,
where is given by
= ((s, i), (B, C), (s

, i

)) [ (s, s

, i

) (B, C) , (84)
and
B
((s, i)) = i + 1 for every s S. Clearly, B recognizes the set of all even
-words over .
The automaton C is constructed as follows.
1. B is converted into an equivalent nondeterministic B uchi automaton B
1
.
2. B
1
is converted into an equivalent deterministic Rabin automaton B
2
.
3. B
2
is transformed into the deterministic Streett automaton B
3
dual to B
2
.
It recognizes the complement of what B
2
recognizes.
4. B
3
is converted into an equivalent deterministic parity automaton C.
Clearly, C recognizes the set of all even -words over .
Let m = n(n+1) be the number of states of B. The rst step is simple and yields
an automaton with O(m
2
) states. The second step can be carried out using Safras
construction, [22], and thus yields an automaton with 2
O(m
2
log m)
states and O(m
2
)
accepting pairs. The third step neither changes the number of states nor the number
of pairs. The fourth step can be implemented using B uchis index appearance record
with hit, [24], and yields an automaton with a larger number of states but still with
2
O(m
2
log m)
many states and priorities bounded by O(m
2
).
Using the automaton C from the previous theorem, we can replace (E
1
) by:
(E
2
) (a) For every innite branch of K, the -word p() is accepted by C from
above.
(b) There is no w W
K
such that G(w) contains a strongly connected set
where the maximum priority is odd.
The rst part takes care of diverging paths, the second one of nondiverging paths.
4.2.2 Tree Witnesses
We put everything together what we have obtained thus far. Let R be the set
of all admissible tiles (

, S

, H, H
2
, H
3
) where there exists no strongly connected
component in H with a maximum priority which is odd. A tree witness is a tree
T = (V, E, ) with labels in R 2
SS
such that the following conditions hold.
388 Th. Wilke
1. The root of T is labelled with some tile (

, S

, H, H
2
, H
3
) where s
I
S

.
2. If v is a vertex labelled C S S, then it has a successor v

labelled with an
element (

, S

, H, H
2
, H
3
) such that s

[ s((s, s

) C) S

.
3. If v is a vertex labelled (

, S

, H, H
2
, H
3
), then v has a successor labelled
H
2
(s, s

) for every (s, s

) H
3
.
4. For every innite branch of T labelled T
0
C
1
T
1
. . . with
T
i
= (
i
, S
i
, H
i
, H
2,i
, H
3,i
),
the -automaton C accepts (H
0
, C
0
)(H
1
, C
1
) . . .
From Corollary 1 and Proposition 2, we can conclude:
Corollary 2. The automaton A accepts some pointed Kripke structure if and only
if there exists a tree witness for A.
4.3 Reduction to Parity Games
Corollary 2 enables us to carry out the last step in our reduction from the nonempti-
ness problem for alternating tree automata, for a tree witness can easily be inter-
preted as a winning strategy tree in a suitable parity game.
Assume C from above is given as C = (U, u
I
,
C
,
C
). Consider the parity game
P = (2
SS
U, RU, ((s
I
, s
I
), u
I
), M,
P
) (85)
where M is dened as below and
P
is dened by
P
((x, u)) =
C
(u) for every
x 2
SS
R. The set M contains two types of moves.
1. Let t = (

, S

, H, H
2
, H
3
) be any element from R and u U. Further, let
(s, s

) H
3
and C = H
2
(s, s

). Then there is a move from (t, u) to

(C,
C
(u, (H, C))).
2. Let C S S, u U, and (

, S

, H, H
2
, H
3
) R with s

[ s((s, s

)
C) S

. Then there is a move from (C, u) to (t, u).

From Corollary 2, we can nally conclude:
Proposition 3. The automaton A accepts some pointed Kripke structure if and
only if Player 0 wins the game P.
Proof. We only need to show that there exists a tree witness for A if and only if
Player 0 wins the game P. This is straightforward, and we only show one direction.
Assume T = (V, E, ) is a tree witness for A. To construct a winning strategy tree
T

= (V

, E

) for P, we let C run over T. We set V

= V v
I
for some new
vertex v
I
, and E

= E (v
I
,
T
). The vertex v
I
is labelled ((s
I
, s
I
), u
I
). The
rest of the labeling is determined as follows. Let (v, v

) E

. If

(v) = (t, u) with

t = (

, S

, H, H
2
, H
3
) and if (v

) = C, then

(v

) = (C,
C
(u, (H, C))). Similarly,
if

(v) = (C, u) and (v

) = t, then

(v

) = (t, u). Clearly, in view of the above

denition of P, the resulting tree is a winning strategy tree for P.
This gives the desired upper bound for the complexity of the satisability prob-
lem for L

:
Alternating Tree Automata, Parity Games, and Modal -Calculus 389
Corollary 3. [5]
1. NonEmptiness, the nonemptiness problem for alternating tree automata, is
in EXP.
2. Satisfiability, the satisability problem for modal -calculus, is in EXP.
Proof. From the previous proposition we can conclude that for every alternating
tree automaton A one can construct a parity game P with the following properties.
The number of locations of P is 2
d
2
O(n
4
log n)
where d is the number of
propositional variables occurring in
A
and n = [S
A
[.
The priority function of P is bounded by cn
4
for some constant c.
Player 0 wins P if and only if A accepts some pointed Kripke structure.
Further, P can easily be constructed, that is, in time polynomial in its size. The rst
claim now follows from Theorem 2. The second claim is an immediate consequence
of the rst claim in view of Theorem 1.
Conclusion
We have seen how the proposed model of alternating tree automata, together with
parity games, can be used to understand -calculus. It should be noted that many
other results concerning the -calculus can be obtained and phrased using the same
automaton model. For instance, Niwinskis important result, [19], that every Kripke
query recognizable by an alternating tree automaton can be dened by a modal -
calculus formula.
References
[1] Andre Arnold. The mu-calculus alternation-depth hierarchy is strict on binary
trees. Theoretical Informatics and Applications, 33:329339, 1999.
[2] Julian C. Bradeld. The modal mu-calculus alternation hierarchy is strict. In
Ugo Montanari and Vladimiro Sassone, editors, CONCUR 96: Concurrency
Theory, 7th International Conference, volume 1119 of LNCS, pages 232246,
Pisa, Italy, 1996.
[3] Julian C. Bradeld. The modal mu-calculus alternation hierarchy is strict.
Theoretical Computer Science, 195(2):133153, 1998.
[4] Julian C. Bradeld. Simplifying the modal mu-calculus alternation hierarchy.
In Michel Morvan, Christoph Meinel, and Daniel Krob, editors, STACS 98:
15th Annual Symposium on Theoretical Aspects of Computer Science, volume
1373 of LNCS, pages 3949, Paris, France, 1998.
[5] E. Allen Emerson and Charanjit S. Jutla. The complexity of tree automata
and logics of programs (extended abstract). In 29th Annual Symposium on
Foundations of Computer Science, pages 328337, White Plains, New York,
1988.
390 Th. Wilke
[6] E. Allen Emerson and Charanjit S. Jutla. Tree automata, mu-calculus and
determinacy. In 32nd Annual Symposium on Foundations of Computer Science,
pages 368377, San Juan, Puerto Rico, 1991.
[7] E. Allen Emerson and Chin-Laung Lei. Ecient model checking in fragments of
the propositional mu-calculus (extended abstract). In 1st IEEE Symposium on
Logic in Computer Science, pages 267278, Cambridge, Massachusetts, 1986.
[8] Yuri Gurevich and Leo Harrington. Trees, automata, and games. In 14th ACM
Symposium on the Theory of Computing, pages 6065, San Francisco, 1982.
[9] David Janin and Igor Walukiewicz. On the expressive completeness of the
propositional mu-calculus with respect to monadic second order logic. In Ugo
Montanari and Vladimiro Sassone, editors, CONCUR 96: Concurrency The-
ory, 7th International Conference, volume 1119 of Lecture Notes in Computer
Science, pages 263277, Pisa, Italy, 1996.
[10] Marcin Jurdzi nski. Deciding the winner in parity games is in UP co-UP.
Information Processing Letters, 68(3):119124, 1998.
[11] Marcin Jurdzi nski. Small progress measures for solving parity games. In Horst
Reichel and Sophie Tison, editors, STACS 2000: 17th Annual Symposium on
Theoretical Aspects of Computer Science, volume 1770 of Lecture Notes in Com-
puter Science, pages 290301, Lille, France, 2000.
[12] Dexter Kozen. Results on the propositional -calculus. Theoretical Computer
Science, 27:333354, 1983.
[13] Giacomo Lenzi. A hierarchy theorem for the -calculus. In F. Meyer auf der
Heide and B. Monien, editors, Automata, Languages and Programming: 23rd
International Colloquium, ICALP 96, volume 1099 of LNCS, pages 8797,
Paderborn, Germany, 1996.
[14] David E. Long, Anca Browne, Edmund M. Clarke, Somesh Jha, and Wilfredo R.
Marrero. An improved algorithm for the evaluation of xpoint expressions.
In David L. Dill, editor, Computer Aided Verication, 6th International Con-
ference, CAV 94, volume 818 of Lecture Notes in Computer Science, pages
338350, Stanford, California, 1994.
[15] Kenneth L. McMillan. Symbolic Model Checking. Kluwer, Boston, 1993.
[16] Andrzej W. Mostowski. Hierarchies of weak automata and weak monadic for-
mulas. Theoretical Computer Science, 83(2):323335, 1991.
[17] David E. Muller and Paul E. Schupp. Alternating automata on innite trees.
Theoretical Computer Science, 54(2-3):267276, 1987.
[18] Damian Niwi nski. On xed point clones. In Laurent Kott, editor, Automata,
Languages and Programming: 13th International Colloquium, volume 226 of
Lecture Notes in Computer Science, pages 464473, Rennes, France, 1986.
Alternating Tree Automata, Parity Games, and Modal -Calculus 391
[19] Damian Niwi nski. Fixed point characterization of innite behavior of nite-
state systems. Theoretical Computer Science, 189:169, 1997.
[20] Damian Niwi nski and Helmut Seidl. On distributive xed-point expressions.
RAIRO Informatique Theorique, 33(4/5):427446, 1999.
[21] Michael Ozer Rabin. Decidability of second-order theories and nite automata
on innite trees. Trans. Amer. Math. Soc., 141:135, 1969.
[22] Shmuel Safra. On the complexity of -automata. In 29th Annual Symposium
on Foundations of Computer Science, pages 319327, White Plains, New York,
1988.
[23] Helmut Seidl. Fast and simple nested xpoints. Information Processing Letters,
59(6):303308, 1996.
[24] W. Thomas. Languages, automata and logic. In A. Salomaa and G. Rozenberg,
editors, Handbook of Formal Languages, volume 3, Beyond Words, pages 389
455. Springer-Verlag, Berlin, 1997.
[25] Moshe Y. Vardi. Reasoning about the past with two-way automata. In
Kim Guldstrand Larsen, Sven Skyum, and Glynn Winskel, editors, Automata,
Languages and Programming: 25th International Colloquium, volume 1443 of
Lecture Notes in Computer Science, pages 628641, Aalborg, Denmark, 1998.
[26] Igor Walukiewicz. Completeness of Kozens Axiomatization of the Propositional
-Calculus. In 10th IEEE Symposium on Symposium on Logic in Computer
Science, pages 1424, San Diego, California, 1995.
[27] Igor Walukiewicz. Completeness of Kozens axiomatisation of the propositional
-calculus, 2000. Information and Computation 157:142182, 2000.
Christian-Albrechts-Universit at zu Kiel
Institut f ur Informatik und Praktische Mathematik
phone: +49 431 880-7511, fax: +49 431 880-7614
email: [email protected]