Proof
We show this by induction on the CTL formula \(\Phi \). In the following, let \(n\in \textsf {N} ^{all}\) be an arbitrary node.
For the base case, \(\Phi =a\) where \(a\in AP \) the statement clearly holds.
If \(\Phi =\lnot \phi _1\) and \([n\models \phi _1]_{{\underline{\gamma }}}={{\textbf {tt}}}\) we have that \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {ff}}\). By IH we have that \({\underline{\partial }}\) is consistent for formula \(\phi _1\) and thus it holds that \((\sigma ,n)\models \phi _1\), hence \((\sigma ,n)\not \models \Phi \) for all \(\sigma \in B^{*}\), which renders \({\underline{\partial }}\) to be consistent. Analogously we obtain consistency of \({\underline{\partial }}\) for \([n\models \phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\). If \([n\models \phi _1]_{{\underline{\gamma }}}={\textbf {??}}\) then \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {??}}\) and thus consistency of \({\underline{\partial }}\) is trivial, as both implications required to hold for consistency of \({\underline{\partial }}\) trivially hold as none of the preconditions are satisfied.
Now consider the case \(\Phi =\phi _1\vee \phi _2\). If \([n\models \phi _1]_{{\underline{\gamma }}}={{\textbf {tt}}}\) or \([n\models \phi _2]_{{\underline{\gamma }}}={{\textbf {tt}}}\) then \([n\models \Phi ]_{{\underline{\gamma }}}={{\textbf {tt}}}\). W.l.o.g. assume \([n\models \phi _1]_{{\underline{\gamma }}}={{\textbf {tt}}}\). Then by IH \((\sigma ,n)\models \phi _1\) and hence \((\sigma ,n)\models \Phi \) for all \(\sigma \in B^{*}\). Thus, \({\underline{\partial }}\) is consistent in this case. A similar argument holds when \([n\models \phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\) and \([n\models \phi _2]_{{\underline{\gamma }}}={\textbf {ff}}\). In the remaining cases where one of \([n\models \phi _1]_{{\underline{\gamma }}}\) and \([n\models \phi _2]_{{\underline{\gamma }}}\) is \({\textbf {??}}\) and the other is either \({\textbf {ff}}\) or \({\textbf {??}}\) we have \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {??}}\) and thus consistency of \({\underline{\partial }}\) is again trivial.
For existentially quantified formulas, first consider case \(\Phi =\exists {\textsf{X}}\phi _1\). If n is an exit node, \([n\models \Phi ]_{{\underline{\gamma }}}={\underline{\gamma }}(n,\Phi )\) and consistency trivially follows from the assumption that \({\underline{\gamma }}\) in consistent. If n is not an exit node, we follow a similar reasoning as in the disjunctive case. If \([n',\phi _1]_{{\underline{\gamma }}}={{\textbf {tt}}}\) for some \(n\mathbin {\longrightarrow }_{+}n'\) then \([n\models \Phi ]_{{\underline{\gamma }}}={{\textbf {tt}}}\) By IH \((\sigma ,n')\models \phi _1\) and thus \((\sigma ,n)\models \Phi \) for all \(\sigma \in B^{*}\). Hence \({\underline{\partial }}\) is consistent. Analogously again, if \([n',\phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\) for all \(n\mathbin {\longrightarrow }_{+}n'\) then \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {ff}}\) and again by IH and definition of \(\exists {\textsf{X}}\) we have \((\sigma ,n)\not \models \Phi \) for all \(\sigma \in B^{*}\) implying \({\underline{\partial }}\) is consistent. For the remaining cases we have \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {??}}\), which again is trivially consistent.
Now consider \(\Phi =\exists {\textsf{G}}\phi _1\). Here, we can have two ways for \([n_0,\Phi ]_{{\underline{\gamma }}}={{\textbf {tt}}}\): The first possibility is that there is a cycle \(n_0\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}n_2\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_l\mathbin {\longrightarrow }_{+}n_0\) for which \([n_i,\phi _1]_{{\underline{\gamma }}}={{\textbf {tt}}}\) for all \(i\in \{0,1,\dots ,l\}\). Then by IH for each node \(n_i\) on the cycle we have \((\sigma ,n_i)\models \phi _1\) and thus \((\sigma ,n)\models \Phi \) for all \(\sigma \in B^{*}\). Hence, \({\underline{\partial }}\) is consistent. The second possible reason for \([n_0,\Phi ]_{{\underline{\gamma }}}={{\textbf {tt}}}\) is if there is a path \(n_0\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}n_2\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_l\) for which \([n_i,\phi _1]_{{\underline{\gamma }}}={{\textbf {tt}}}\) for all \(i\in \{0,1,\dots ,l\}\) and \(n_l\in Ex \) with \({\underline{\gamma }}(n_l,\Phi )={{\textbf {tt}}}\). Then by IH for each node \(n_i\) on the path we have \((\sigma ,n_i)\models \phi _1\) for all \(\sigma \in B^{*}\). Additionally, by consistency of \({\underline{\gamma }}\) and \({\underline{\gamma }}(n_l,\Phi )={{\textbf {tt}}}\) we have a \((\sigma ,n_l)\models \Phi \). Be definition of \(\exists {\textsf{G}}\) we thus have \((\sigma ,n)\models \Phi \) for all \(\sigma \in B^{*}\) and hence consistency of \({\underline{\partial }}\). We again give a similar argument in case \([n_0,\Phi ]_{{\underline{\gamma }}}={\textbf {ff}}\). This can only happen if for every cycle \(n_0\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}n_2\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_l\mathbin {\longrightarrow }_{+}n_0\) there is an \(n_i\) for which \([n_i,\phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\) and additionally for every path \(n_0\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}n_2\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_l\) with \(n_l\in Ex \) there is an \(n_i\) for which \([n_i,\phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\), or \({\underline{\gamma }}(n_l,\Phi )={\textbf {ff}}\). In either case, by definition of \(\exists {\textsf{G}}\) we obtain that \((\sigma ,n_i)\not \models \Phi \) for all \(\sigma \in B^{*}\) and thus \({\underline{\partial }}\) is consistent. Lastly, if \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {??}}\) consistency of \({\underline{\partial }}\) is trivial.
The argumentation for \(\Phi =\exists \phi _1\,{\textsf{U}}\,\phi _2\) is analogous to the case \(\Phi =\exists {\textsf{G}}\phi _1\) except that we do not consider cycles, but finite paths that lead up to a state in which \(\phi _2\) holds. \(\square \)
Proof
This lemma is shown mainly by an inductive case distinction on ternary semantics definitions. Let us first consider the case where
\(n\in \textsf {N} ^{all}\) and
\(\phi \in Subf (\Phi ){\setminus }\{\Phi \}\). As we set
\({\underline{\partial }}'(n,\phi )={\underline{\partial }}(n,\phi )\) in Line
2, and because
\({\underline{\partial }}'(n,\phi )\) is never modified after, from our assumption it follows that
\(ctxi'(n,\phi )={\underline{\partial }}(n,\phi )=[n\models \phi ]_{{\underline{\gamma }}}\) and thus the statement holds.
Knowing that the statement holds for all \(\phi \in Subf (\Phi )\setminus \{\Phi \}\), we now show that the statement also holds for \(\Phi \) itself.
Case I: \(\Phi \) is propositional or \(\Phi =\exists {\textsf{X}}\phi _1\).
If \(\Phi \) is a propositional formula, i.e, an atomic proposition, a negation or a disjunction, we can immediately see that \(\textsc {RefineTernary}\) follows the ternary semantics by definition. Similarly, if \(\Phi =\exists {\textsf{X}}\phi _1\) we also simply compute \({\underline{\partial }}'(n,\phi )\) by definition by either copying \({\underline{\gamma }}(n,\Phi )\) if n is an exit node, or else taking the maximum of \({\underline{\partial }}(n',\phi _1)=[n',\phi _1]_{{\underline{\gamma }}}\) over all \(\mathbin {\longrightarrow }_{+}\)-successors \(n'\).
Case II: \(\Phi =\exists {\textsf{G}}\phi _1\).
Case II.1: \(n\in Ex \).
Assume
\({\underline{\gamma }}(n,\Phi )={{\textbf {tt}}}\). Then
\(n\in Sat _{pes}\) and
\(n\in Sat _{opt}\) after the initialization in Line
15 and Line
15, respectively. In the following while loop, only
\(n\notin Ex \) are considered and thus we still have
\(n\in Sat _{pes}\) and
\(n\in Sat _{opt}\) and hence
\({\underline{\partial }}'(n,\Phi )={{\textbf {tt}}}\). Analogously, if
\({\underline{\gamma }}(n,\Phi )={\textbf {ff}}\) then initially
\(n\notin Sat _{pes}\) and
\(n\notin Sat _{opt}\) and they are never added as we never add any elements to either
\( Sat _{opt}\) or
\( Sat _{pes}\) in the
\(\exists {\textsf{G}}\)-branch and thus
\({\underline{\partial }}'(n,\Phi )={\textbf {ff}}\). Similarly, if
\({\underline{\gamma }}(n,\Phi )={\textbf {??}}\) then
\(n\notin Sat _{pes}\) but
\(n\in Sat _{opt}\) and hence
\({\underline{\partial }}'(n,\Phi )={\textbf {??}}\). We can summarize these three statements as
\({\underline{\partial }}'(n,\Phi )={\underline{\gamma }}(n,\Phi )\). As by definition of RSMs, exit node do not have any successors, there are no
\(n'\) where
\(n\mathbin {\longrightarrow }_{+}n'\) and thus the only path starting in
n is the trivial path of length 1 consisting of only
n itself. In this case the ternary semantics simplifies to
\([\cdot ,\Phi ]_{{\underline{\gamma }}}={\underline{\gamma }}(n,\Phi )\), matching
\({\underline{\partial }}'\).
Case II.2: \(n\notin Ex \).
Case II.2.1: \([n\models \Phi ]_{{\underline{\gamma }}}={{\textbf {tt}}}\).
This implies that either there is a path \(n\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_i \mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_i\) such that \([\cdot ,\phi _1]_{{\underline{\gamma }}}={{\textbf {tt}}}\) for all nodes on the path, or a path \(n\mathbin {\longrightarrow }_{+}n'_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}ex\) such that \(ex\in Ex \) with \({\underline{\gamma }}(ex,\Phi )={{\textbf {tt}}}\) and \([\cdot ,\phi ]_{{\underline{\gamma }}}={{\textbf {tt}}}\) for all other nodes on the path. In \(\textsc {RefineTernary}\), initially all nodes on this path are included in \( Sat _{pes}\) and \( Sat _{opt}\). As witnesses by this path, each non-exit node on the path has a \(\mathbin {\longrightarrow }_{+}\)-successor in \( Sat _{pes}\) and \( Sat _{opt}\) and is thus never removed. Additionally, exit nodes are never removed from \( Sat _{pes}\) and \( Sat _{opt}\) anyway. Hence we set \({\underline{\partial }}'(n,\Phi )={{\textbf {tt}}}=[n\models \Phi ]_{{\underline{\gamma }}}\).
Case II.2.2: \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {ff}}\).
To be in this case, we must have that all paths \(n\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_i \mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_i\) contain at least one node \(n_j\) with \([n_j,\phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\) and for all paths \(n\mathbin {\longrightarrow }_{+}n'_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}ex\) with \(ex\in Ex \) we either have \({\underline{\gamma }}(ex,\Phi )={\textbf {ff}}\) or some other node \(n'_j\) on the path with \([n'_j,\phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\).
If \([n\models \phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\), then n is never added to \( Sat _{opt}\) and trivially \({\underline{\partial }}'(n,\Phi )={\textbf {ff}}\). Otherwise, if \({\underline{\partial }}'(n,\Phi )\ne {\textbf {ff}}\), then n is still in \( Sat _{opt}\) initially. However, we now show that it is removed from \( Sat _{opt}\) after a finite number of iterations of the while-loop in the optimistic run. As there is no cycle on which \([\cdot ,\phi _1]_{{\underline{\gamma }}}\ne {\textbf {ff}}\) and no path to an exit node ex for which \({\underline{\gamma }}(ex,\Phi )\ne {\textbf {ff}}\) and \([\cdot ,\phi _1]_{{\underline{\gamma }}}\ne {\textbf {ff}}\) for all other nodes on the path, there is a finite path \(n\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_l\) that is maximal in its length for which \([\cdot ,\phi _1]_{{\underline{\gamma }}}\ne {\textbf {ff}}\) on all nodes on the path and that does not contain any exit nodes.
We inductively show that after m iterations of the while-loop in the optimistic run, the longest \(\mathbin {\longrightarrow }_{+}\)-path in \( Sat _{opt}\) starting in n has length \(l+1-m\). For \(m=0\) this trivially holds as the maximal path on which \([\cdot ,\phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\) holds has length \(l+1\) and only nodes for which \([n_i,\phi _1]_{{\underline{\gamma }}}={\textbf {ff}}\) are initially added to \( Sat _{opt}\). After m iterations, let \(n\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_{l-m}\) be a longest \(\mathbin {\longrightarrow }_{+}\)-path in \( Sat _{opt}\). We show that after \(m+1\) iterations, be longest \(\mathbin {\longrightarrow }_{+}\)-path in \( Sat _{opt}\) has length \(l-m\). Notice that \(n_{l-m}\) cannot have any non-exit node successor in \( Sat _{opt}\) as otherwise we could have found a longer path. Further, \(n_{l-m}\) can also not have an exit node ex as successor in \( Sat _{opt}\) as the inclusion of ex in \( Sat _{opt}\) would imply \({\underline{\gamma }}(ex,\Phi )\ne {\textbf {ff}}\). But then \(n\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_{l-m}ex\) would be a path from n to an exit node ex with \({\underline{\gamma }}(ex,\Phi )\ne {\textbf {ff}}\) and \([\cdot ,\phi _1]_{{\underline{\gamma }}}\ne {\textbf {ff}}\) for all other nodes on the path, which we assumed does not exist. This means \(n_{l-m}\) has no successors in \( Sat _{opt}\) and is thus removed in the \(m+1\)-th iteration of the while loop. This argument holds for all paths of length \(l-m\), should there be multiple. Thus, after the \(m+1\)-th iteration of the while loop, the longest path in \( Sat _{opt}\) starting in n has length \(l-m\), finishing the proof.
This means that after l iterations, the longest \(\mathbin {\longrightarrow }_{+}\)-path in \( Sat _{opt}\) starting in n has length 1, i.e., is just n itself. This means n has no \(\mathbin {\longrightarrow }_{+}\)-successors in \( Sat _{opt}\) and thus is removed from \( Sat _{opt}\) in the \(l+1\)-th iteration. Hence, \({\underline{\partial }}'(n,\Phi )={\textbf {ff}}\).
Case II.2.3: \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {??}}\).
For this, two assumptions must hold:
(1) all paths starting in n reaching a cycle contain at least one node \(n_j\) with \([n_j,\phi _1]_{{\underline{\gamma }}}\ne {{\textbf {tt}}}\) and all paths from n to an arbitrary exit node \(ex\in Ex \) either have \({\underline{\gamma }}(ex,\Phi )\ne {{\textbf {tt}}}\) or some other node \(n_j\) on the path with \([n_i,\phi _1]_{{\underline{\gamma }}}\ne {{\textbf {tt}}}\), but
(2) there is a path \(n\mathbin {\longrightarrow }_{+}n_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_i \mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}n_i\) such that \([\cdot ,\phi _1]_{{\underline{\gamma }}}\ne {\textbf {ff}}\) for all nodes on the path, or a path \(n\mathbin {\longrightarrow }_{+}n'_1\mathbin {\longrightarrow }_{+}\dots \mathbin {\longrightarrow }_{+}ex\) such that \(ex\in Ex \) with \({\underline{\gamma }}(ex,\Phi )={{\textbf {tt}}}\) and \([\cdot ,\phi ]_{{\underline{\gamma }}}={{\textbf {tt}}}\) for all other nodes on the path.
By the same argument as in Case II.2.1, assumption (2) implies that
n is initially added to
\( Sat _{opt}\) and never removed. On the other hand by the same inductive argument as in Case II.2.2, assumption (1) implies that
n is removed from
\( Sat _{pes}\) after finitely many iterations of the while-loop in the pessimistic run. This means we set
\({\underline{\partial }}'(n,\Phi )={\textbf {??}}\) in Line
3 and never modify it afterward, which finally ensures that
\({\underline{\partial }}'(n,\Phi )=[n\models \Phi ]_{{\underline{\gamma }}}\) if
\(\Phi =\exists {\textsf{G}}\phi _1\).
Case III: \(\Phi =\exists \phi _1\,{\textsf{U}}\,\phi _2\).
The argumentation for this case is at many places very similar to Case II. As such, we only go briefly over the different cases and highlight the differences.
Case III.1: \(n\in Ex \).
For this case, the argument is similar as for the analogous case where \(\Phi =\exists {\textsf{G}}\phi _1\). The difference is that for \({\underline{\gamma }}(n,\Phi )={\textbf {ff}}\) we see n is not initially added to \( Sat _{pes}\) or \( Sat _{opt}\). Since we add states to \( Sat _{pes}\) and \( Sat _{opt}\) in the respective while-loops, we need to ensure n is never added. This however trivially holds, since n being an exit node implies it does not have any successors and thus will never indeed not be added to \( Sat _{pes}\) or \( Sat _{opt}\).
Case III.2: \(n\notin Ex \).
Case III.2.1: \([n\models \Phi ]_{{\underline{\gamma }}}={{\textbf {tt}}}\).
Here, we must have a path \(n\mathbin {\longrightarrow }_{+}n_1\dots \mathbin {\longrightarrow }_{+}n_l\) such that either \([n_l,\phi _2]_{{\underline{\gamma }}}={{\textbf {tt}}}\) or \(n_l\in Ex \) and \({\underline{\gamma }}(n_l,\Phi )={{\textbf {tt}}}\), and additionally \([\cdot ,\phi _1]_{{\underline{\gamma }}}={{\textbf {tt}}}\) for all other nodes on the path.
Similar to Case II.2.2 we can inductively prove that after finitely many iterations of the respective while-loop, n is an element of both \( Sat _{pes}\) and \( Sat _{opt}\). For this, first notice that \(n_l\) is in both \( Sat _{pes}\) and \( Sat _{opt}\) initially. After m iterations of the respective while-loop we can in the same inductive fashion as before prove that \(n_{l-m}\) is in \( Sat _{pes}\) and \( Sat _{opt}\). In particular this implies that \(n\in Sat _{pes}\cap Sat _{opt}\) after l iterations. Hence, we set \({\underline{\partial }}(n,\Phi )={{\textbf {tt}}}\).
Case III.2.2: \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {ff}}\).
Toward a contradiction, assume that
\(n\in Sat _{opt}\) after the while-loop. As
\([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {ff}}\) we must have
\([n\models \phi _2]_{{\underline{\gamma }}}={\textbf {ff}}\). This implies that
n was not added to
\( Sat _{opt}\) initially in Line
28, but after finitely many iterations of the while-loop. Hence, we must have
\([n\models \phi _1]_{{\underline{\gamma }}}\ne {\textbf {ff}}\) there must have been an
\(n_1\in Sat _{opt}\) in the previous iteration with
\(n\mathbin {\longrightarrow }_{+}n_1\). For
\(n_1\in Sat _{opt}\) we must have that it was added to
\( Sat _{opt}\) initially in Line
28, or
\([n_1,\phi _1]_{{\underline{\gamma }}}\ne {\textbf {ff}}\) and
\(n_1\) itself has a successor that was in
\( Sat _{opt}\) in the previous iteration. Inductively, we can see that this implies the existence of a finite path
\(n\mathbin {\longrightarrow }_{+}n_1\dots \mathbin {\longrightarrow }_{+}n_l\) such that
\(n_l\) was initially added to
\( Sat _{opt}\) in Line
28 and
\([\cdot ,\phi _1]_{{\underline{\gamma }}}\ne {\textbf {ff}}\). But
\(n_l\) being in
\( Sat _{opt}\) initially implies that either
\([n_l,\phi _2]_{{\underline{\gamma }}}\ne {\textbf {ff}}\) or
\(n_l\in Ex \) with
\({\underline{\gamma }}(n_l,\Phi )\ne {\textbf {ff}}\). I either case, this is a contradiction to the assumption
\([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {ff}}\).
Hence, we showed \(n\notin Sat _{opt}\) after the while-loop and thus \({\underline{\partial }}(n,\phi )={\textbf {ff}}\).
Case III.2.3: \([n\models \Phi ]_{{\underline{\gamma }}}={\textbf {??}}\).
Analogously to the argument for \(\exists {\textsf{G}}\phi _1\), by combining the arguments from Cases III.2.1 and III.2.2 we can deduce that \({\underline{\partial }}(n,\Phi )={\textbf {??}}\). \(\square \)