Certifying Inexpressibility

Different classes of automata on infinite words have different expressive power. Deciding whether a given language \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$L \subseteq \varSigma ^\omega $$\end{document}L⊆Σω can be expressed by an automaton of a desired class can be reduced to deciding a game between Prover and Refuter: in each turn of the game, Refuter provides a letter in \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varSigma $$\end{document}Σ, and Prover responds with an annotation of the current state of the run (for example, in the case of Büchi automata, whether the state is accepting or rejecting, and in the case of parity automata, what the color of the state is). Prover wins if the sequence of annotations she generates is correct: it is an accepting run iff the word generated by Refuter is in L. We show how a winning strategy for Refuter can serve as a simple and easy-to-understand certificate to inexpressibility, and how it induces additional forms of certificates. Our framework handles all classes of deterministic automata, including ones with structural restrictions like weak automata. In addition, it can be used for refuting separation of two languages by an automaton of the desired class, and for finding automata that approximate L and belong to the desired class.


Introduction
Finite automata on infinite objects were first introduced in the 60's, and were the key to the solution of several fundamental decision problems in mathematics and logic [8,32,41]. Today, automata on infinite objects are used for specification, verification, and synthesis of nonterminating systems. The automata-theoretic approach reduces questions about systems and their specifications to questions about automata [27,49], and is at the heart of many algorithms and tools. Industrial-strength property-specification languages such as the IEEE 1850 Standard for Property Specification Language (PSL) [14] include regular expressions and/or automata, making specification and verification tools that are based on automata even more essential and popular.
A run r of an automaton on infinite words is an infinite sequence of states, and acceptance is determined with respect to the set of states that r visits infinitely often. For example, in Büchi automata, some of the states are designated as accepting states, denoted by α, and a run is accepting iff it visits states from the accepting set α infinitely often [8]. Dually, in co-Büchi automata, a run is accepting if it visits the set α only finitely often. Then, in parity automata, the acceptance condition maps each state to a color in some set C = {j, . . . , k}, for j ∈ {0, 1} and some index k ≥ 0, and a run is accepting if the maximal color it visits infinitely often is odd.
The different classes of automata have different expressive power. For example, while deterministic parity automata can recognize all ω-regular languages, deterministic Büchi automata cannot [28]. We use DBW, DCW, and DPW to denote a deterministic Büchi, co-Büchi, and parity word automaton, respectively, or (this would be clear from the context) the set of languages recognizable by the automata in the corresponding class. There has been extensive research on expressiveness of automata on infinite words [48,20]. In particular, researchers have studied two natural expressiveness hierarchies induced by different classes of deterministic automata. The first hierarchy is the Mostowski Hierarchy, induced by the index of parity automata [34,50]. Formally, let DPW[0, k] denote a DPW with C = {0, . . . , k}, and similarly for DPW [1, k] [1,2].
While the Mostowski Hierarchy refines DPWs, the second hierarchy, which we term the depth hierarchy, refines deterministic weak automata (DWWs). Weak automata can be viewed as a special case of Büchi or co-Büchi automata in which every strongly connected component in the graph induced by the structure of the automaton is either contained in α or is disjoint from α, where α is depending on the acceptance condition the set of accepting or rejecting states. The structure of weak automata captures the alternation between greatest and least fixed points in many temporal logics, and they were introduced in this context in [35]. DWWs have been used to represent vectors of real numbers [6], and they have many appealing theoretical and practical properties [31,21]. In terms of expressive power, DWW = DCW ∩ DBW. The depth hierarchy is induced by the depth of alternation between accepting and rejecting components in DWWs. For this, we view a DWW as a DPW in which the colors visited along a run can only increase. Accordingly, each run eventually gets trapped in a single color, and is accepting iff this color is odd. We use DWW[0, k] and DWW [1, k] to denote weak-DPW[0, k] and weak-DPW [1, k], respectively. The picture obtained for the depth hierarchy is identical to that of the Mostowski hierarchy, with DWW[j, k] replacing DPW[j, k] [50]. At the bottom of the depth hierarchy we have co-safety and safety languages [2]. Indeed, co-safety languages are DWW[0, 1] and safety are DWW [1,2].
Beyond the theoretical interest in expressiveness hierarchies, their study is motivated by the fact many algorithms, like synthesis and probabilistic model checking, need to operate on deterministic automata [5,3]. The lower the automata are in the expressiveness hierarchy, the simpler are algorithms for reasoning about them. Simplicity goes beyond complexity, which typically depends on the parity index [16], and involves important practical considerations like minimization and canonicity (exists only for DWWs [31]), circumvention of Safra's determinization [26], and symbolic implementations [47]. Of special interest is the characterization of DBWs. For example, it is shown in [25] that given a linear temporal logic formula ψ, there is an alternation-free µ-calculus formula equivalent to ∀ψ iff ψ can be recognized by a DBW. Further research studies typeness for deterministic automata, examining the ability to define a weaker acceptance condition on top of a given automaton [19,21]. Our goal in this paper is to provide a simple and easy-to-understand explanation to inexpressibility results. The need to accompany results of decision procedures by an explanation (often termed "certificate") is not new, and includes certification of a "correct" decision of a model checker [24,44], reachability certificates in complex multiagent systems [1], and explainable reactive synthesis [4]. To the best of our knowledge, our work is the first to provide certification to inexpressibility results.
The underlying idea is simple: Consider a language L and a class γ of deterministic automata. We consider a turn-based two-player game in which one player (Refuter) provides letters in Σ, and the second player (Prover) responds with letters from a set A of annotations that describe states in a deterministic automaton. For example, when we consider a DBW, then A = {acc, rej}, and when we consider a DPW[0, k], then A = {0, . . . , k}. Thus, during the interaction, Refuter generates a word x ∈ Σ ω and Prover responds with a word y ∈ A ω . Prover wins if for all words x ∈ Σ ω , we have that x ∈ L iff y is accepting according to γ. Clearly, if there is a deterministic γ automaton for L, then Prover can win by following its run on x. Dually, a finite-state winning strategy for Prover induces a deterministic γ automaton for L. The game-based approach is not new, and has been used for deciding the membership of given ω-regular languages in different classes of deterministic automata [26]. Further, the game-based formulation is used in descriptive set theory to classify sets into hierarchies, see for example [39,Chapters 4 and 5] for an introduction that focuses on ω-regular languages. Our contribution is a study of strategies for Refuter. Indeed, since the above described game is determined [9] and the strategies are finite-state, Refuter has a winning strategy iff no deterministic γ automaton for L exists, and this winning strategy can serve as a certificate for inexpressibility. Example 1. Consider the language L ¬∞a ⊆ {a, b} ω of all words with only finitely many a's. It is well known that L cannot be recognized by a DBW [28]. In Figure 1 we describe what we believe to be the neatest proof of this fact. The figure describes a transducer R with inputs in {acc,rej} and outputs in {a, b} -the winning strategy of Refuter in the above described game. The way to interpret R is as follows. In each round of the game, Prover tells Refuter whether the run of her DBW for L ¬∞a is in an accepting or a rejecting state, and Refuter uses R in order to respond with the next letter in the input word. For example, if Prover starts with acc, namely declaring that the initial state of her DBW is accepting, then Refuter responds with a, and if Prover continues with rej, namely declaring that the state reachable with a is rejecting, then Refuter responds with b. If Prover continues with rej forever, then Prover continues with b forever. Thus, together Prover and Refuter generate two words: y ∈ {acc,rej} ω and x ∈ {a, b} ω . Prover wins whenever x ∈ L ¬∞a iff y contains infinitely many acc's. If Prover indeed has a DBW for L ¬∞a , then she can follow its transition function and win the game. By following the refuter R, however, Refuter can always fool Prover and generate a word x such that x ∈ L ¬∞a iff y contains only finitely many acc's.
We first define refuters for DBW-recognizability, and study their construction and size for languages given by deterministic or nondeterministic automata. Our refuters serve as a first inexpressibility certificate. We continue and argue that each DBWrefuter for a language L induces three words x ∈ Σ * and x 1 , x 2 ∈ Σ * , such that The triple x, x 1 , x 2 is an additional certificate for L not being in DBW. Indeed, we show that a language L is not in DBW iff it has a certificate as above. For example, the language L ¬∞a has a certificate , b, a . In fact, we show that Landweber's proof for L ¬∞a can be used as is for all languages not in DBW, with x 1 replacing b, x 2 replacing a, and adding x as a prefix.
We then generalize our results on DBW-refutation and certification in two orthogonal directions. The first is an extension to richer classes of deterministic automata, in particular all classes in the two hierarchies discussed above, as well as all deterministic Emerson-Lei automata (DELWs) [17]. For the depth hierarchy, we add to the winning condition of the game a structural restriction. For example, in a weak automaton, Prover loses if the sequence y ∈ A ω of annotations she generates includes infinitely many alternations between acc and rej. We show how structural restrictions can be easily expressed in our framework.
The second direction is an extension of the recognizability question to the questions of separation and approximation: We say that a language L ⊆ Σ ω is a separator for two languages L 1 , L 2 ⊆ Σ ω if L 1 ⊆ L and L ∩ L 2 = ∅. Studies of separation include a search for regular separators of general languages [11], as well as separation of regular languages by weaker classes of languages, e.g., FO-definable languages [40] or piecewise testable languages [12]. In the context of ω-regular languages, [2] presents an algorithm computing the smallest safety language containing a given language L 1 , thus finding a safety separator for L 1 and L 2 . As far as we know, besides this result there has been no systematic study of separation of ω-regular languages by deterministic automata.
In addition to the interest in separators, we use them in the context of recognizability in two ways. First, a third type of certificate that we suggest for DBW-refutation of a language L are "simple" languages L 1 and L 2 such that L 1 ⊆ L, L∩L 2 = ∅, and L 1 , L 2 are not DBW-separable. Second, we use separability in order to approximate languages that are not in DBW. Consider such a language L ⊆ Σ ω . A user may be willing to approximate L in order to obtain DBW-recognizability. Specifically, we assume that there are languages I ↓ ⊆ L and I ↑ ⊆ Σ ω \ L of words that the user is willing to underand over-approximate L with. Thus, the user searches for a language that is a separator for L \ I ↓ and Σ ω \ (L ∪ I ↑ ). We study DBW-separability and DBW-approximation, namely separability and approximation by languages in DBW. In particular, we are interested in finding "small" approximating languages I ↓ and I ↑ with which L has a DBW-approximation, and we show how certificates that refute DBW-separation can direct the search to for successful I ↓ and I ↑ . Essentially, as in counterexample guided abstraction-refinement (CEGAR) for model checking [10], we use certificates for non-DBW-separability in order to suggest interesting radius languages. While in CEGAR the refined system excludes the counterexample, in our setting the approximation of L excludes the certificate. As has been the case with recognizability, we extend our results to all classes of deterministic automata.
A (Σ/A)-transducer models a finite-state system that responds with letters in A while interacting with an environment that generates letters in Σ. Formally, a (Σ/A)transducer is T = Σ, A, ι, S, s 0 , ρ, τ , where ι ∈ {sys, env } indicates who initiates the interaction -the system or the environment, S is a set of states, s 0 ∈ S is an initial state, ρ : S ×Σ → S is a transition function, and τ : S → A is a labelling function on the states. Consider an input word x = x 0 ·x 1 ·x 2 · · · ∈ Σ ω . The run of T on x is the sequence s 0 , s 1 , s 2 . . . such that for all j ≥ 0, we have that s j+1 = ρ(s j , x j ). The annotation of x by T , denoted T (x), depends on ι. If ι = sys, then T (x) = τ (s 0 ) · τ (s 1 ) · τ (s 2 ) · · · ∈ A ω . Note that the first letter in A is the output of T in s 0 . This reflects the fact that the system initiates the interaction. If ι = env , then T (x) = τ (s 1 ) · τ (s 2 ) · τ (s 3 ) · · · ∈ A ω . Note that now, the output in s 0 is ignored, reflecting the fact that the environment initiates the interaction.
Consider a language L ⊆ (Σ ×A) ω . Let comp(L) denote the complement of L. Thus, comp(L) = (Σ × A) ω \ L. We say that a language L ⊆ (Σ × A) ω is (Σ/A)-realizable by the system if there is a (Σ/A)-transducer T with ι = sys such that for every word x ∈ Σ ω , we have that x ⊕ T (x) ∈ L. Then, L is (A/Σ)-realizable by the environment if there is an (A/Σ)-transducer T with i = env such that for every word y ∈ A ω , we have that T (y) ⊕ y ∈ L. When the language L is regular, realizability reduces to deciding a game with a regular winning condition. Then, by determinacy of games and due to the existence of finite-memory winning strategies [9], we have the following. Proposition 1. For every ω-regular language L ⊆ (Σ × A) ω , exactly one of the following holds.

Automata
A deterministic word automaton over a finite alphabet Σ is A = Σ, Q, q 0 , δ, α , where Q is a set of states, q 0 ∈ Q is an initial state, δ : Q×Σ → Q is a transition function, and α is an acceptance condition. We extend δ to words in Σ * in the expected way, thus for q ∈ Q, w ∈ Σ * , and letter σ ∈ Σ, we have that δ(q, ) = q and δ(q, wσ) = δ(δ(q, w), σ). A run of A on an infinite word σ 0 , σ 1 , · · · ∈ Σ ω is the sequence of states r = q 0 , q 1 , . . . , where for every position i ≥ 0, we have that q i+1 = δ(q i , σ i ). We use inf (r) to denote the set of states that r visits infinitely often. Thus, inf (r) = {q : q i = q for infinitely many i ≥ 0}.
The acceptance condition α refers to inf (r) and determines whether the run r is accepting. For example, in the Büchi, acceptance condition, we have that α ⊆ Q, and a run is accepting iff it visits states in α infinitely often; that is, α ∩ inf (r) = ∅. Dually, in co-Büchi, α ⊆ Q, and a run is accepting iff it visits states in α only finitely often; that is, α ∩ inf (r) = ∅. The language of A, denoted L(A), is then the set of words w such that the run of A on w is accepting.
A parity condition is α : Q → {0, . . . , k}, for k ≥ 0, termed the index of α. A run r satisfies α iff the maximal color i ∈ {0, . . . , k} such that α −1 (i) ∩ inf (r) = ∅ is odd. That is, r is accepting iff the maximal color that r visits infinitely often is odd. Then, a Rabin condition is Thus, there is a pair G i , B i such that r visits states in G i infinitely often and visits states in B i only finitely often.
All the acceptance conditions above can be viewed as special cases of the Emerson-Lei acceptance condition (EL-condition, for short) [17], which we define below. Let M be a finite set of marks. Given an infinite sequence π = M 0 · M 1 · · · ∈ (2 M ) ω of subsets of marks, let inf (π) be the set of marks that appear infinitely often in sets in π. Thus, inf (π) = {m ∈ M : there exist infinitely many i ≥ 0 such that m ∈ M i }. An EL-condition is a Boolean assertion over atoms in M. For simplicity, we consider assertions in positive normal form, where negation is applied only to atoms. Intuitively, marks that appear positively should repeat infinitely often and marks that appear negatively should repeat only finitely often. Formally, a deterministic EL-automaton is A = Σ, Q, q 0 , δ, M, τ, θ , where τ : Q → 2 M maps each state to a set of marks, and θ is an EL-condition over M. A run r of a A is accepting if inf (τ (r)) satisfies θ.
For example, a Büchi condition α ⊆ Q can be viewed as an EL-condition with M = {acc} and τ (q) = {acc} for q ∈ α and τ (q) = ∅ for q ∈ α. Then, the assertion θ = acc is satisfied by sequences π induced by runs r with inf (r) ∩ α = ∅. Dually, the assertion θ = ¬rej with M = {rej} is satisfied by sequences π induced by runs r with inf (r) ∩ α = ∅, and thus corresponds to a co-Büchi condition. In the case of a parity condition α : Q → {0, . . . , k}, it is not hard to see that α is equivalent to an ELcondition in which M = {0, 1, . . . , k}, for every state q ∈ Q, we have that τ (q) = {α(q)}, and θ = θ k expresses the parity condition, where θ k is inductively defined as: Lastly, a Rabin condition α = { G 1 , B 1 , . . . , G k , B k } is equivalent to an EL-condition with M = {G 1 , B 1 , . . . , G k , B k } and τ (q) = {m ∈ M : q ∈ m}. Note that now, the mapping τ is not to singletons, and each state is marked by all sets in α in which it is a member.
We use DBW, DCW, DPW, DRW, DELW to denote deterministic Büchi, co-Büchi, parity, Rabin, and EL word automata, respectively. For parity automata, we also use DPW[0, k] and DPW [1, k], for k ≥ 0, to denote DPWs in which the colours are in {0, . . . , k} and {1, . . . , k}, respectively. For Rabin automata, we use DRW[k], for k ≥ 0, to denote DRWs that have at most k elements in α. Finally, we use DELW[θ], to denote DELWs with EL-condition θ. We sometimes use the above acronyms in order to refer to the set of languages that are recognizable by the corresponding class of automata. For example, we say that a language L is in DBW if L is DBW-recognizable, thus there is a DBW A such that L = L(A). Consider a directed graph G = V, E . A strongly connected set of G (SCS) is a set C ⊆ V of vertices such that for every two vertices v, v ∈ C, there is a path from v to v . An SCS C is maximal if it cannot be extended to a larger SCS. Formally, for every nonempty C ⊆ V \ C, we have that C ∪ C is not an SCS. The maximal strongly connected sets are also termed strongly connected components (SCC). An automaton A = Σ, Q, Q 0 , δ, α induces a directed graph G A = Q, E in which q, q ∈ E iff there is a letter σ such that q ∈ δ(q, σ). When we talk about the SCSs and SCCs of A, we refer to those of G A . Consider a run r of an automaton A. It is not hard to see that the set inf (r) is an SCS. Indeed, since every two states q and q in inf (r) are visited infinitely often, the state q must be reachable from q.
A DBW A = Σ, Q, q 0 , δ, α is weak (DWW) if every SCC C of A is accepting, namely C ⊆ α, or rejecting, namely C ∩ α = ∅. Thus, each run of A eventually visits either states in α or only states not in α. It is easy to see that every DWW can be viewed as a DBW and as a DCW. In order to refer to the depth of the SCCs in A, we also refer to A also as a DPW. Indeed, a DPW A = Σ, Q, q 0 , δ, α is weak if for every transition q = δ(q, σ) we have α(q ) ≥ α(q), i.e., α is monotonically increasing along a run. We use DWW[0, k] and DWW [1, k] to denote weak DPW[0, k] and weak DPW [1, k], respectively. Finally, note that for each safety ω-regular language L, there exists a DWW [1,2] that recognises L and all DWW[1, 2] recognise a safety language. Dually, co-safety languages correspond to DWW[0, 1].

Example 2.
For every language R ⊆ Σ * of finite words, the language R ω ⊆ Σ ω consists of infinite concatenations of words in R. It was recently shown that R ω may not be in DBW [29]. The language used in [29] is R = $ + (0 · {0, 1, $} * · 1). In Figure 2 below we describe a DBW-refuter for R ω .
Following R, Refuter starts by generating a prefix 0 · 1 and then responds to acc with 1 and responds with $ to rej. Accordingly, if Prover generates a rejecting run, Prover generates a word in 0 · 1 · (1 + $) * · $ ω , which is in R ω . Also, if Prover generates an accepting run, Prover generates a word in 0 · 1 · (1 + · $ * ) ω , which has a single 0 and infinitely many 1's, and is therefore not in R ω .
By Proposition 1, we have the following.
Exactly one of the following holds: -L is in DBW, in which case the language DBW(L) is (Σ/A)-realizable by the system, and a finite-memory winning strategy for the system induces a DBW for L. -L is not in DBW, in which case the language NoDBW(L) is (A/Σ)-realizable by the environment, and a finite-memory winning strategy for the environment induces a DBW-refuter for L.

Complexity
In this section we analyze the size of refuters. We start with the case where the language L is given by a DPW.
Theorem 1. Consider a DPW A with n states. Let L = L(A). One of the following holds.
1. There is a DBW for L with n states.
2. There is a DBW-refuter for L with 2n states.
Proof. If L is in DBW, then, as DPWs are Büchi type [19], a DBW for L can be defined on top of the structure of A, and so it has n states. If L is not in DBW, then by Proposition 2, there is a DBW-refuter for L, namely a ({acc, rej}/Σ)-transducer that realizes NoDBW(L). We show we can define a DRW U with 2n states for NoDBW(L). The result then follows from the fact a realizable DRW is realized by a transducer of the same size as the DRW [15]. We construct U by taking the union of the acceptance conditions of a DRW U 1 for {x ⊕ y : x ∈ L and y ∈ ∞acc} and a DRW U 2 for {x ⊕ y : x ∈ L and y ∈ ∞acc}. We obtain both DRWs by taking the product of A, extended to the alphabet Σ×{acc, rej}, with a 2-state automaton for ∞acc, again extended to the alphabet Σ × {acc, rej}.
We describe the construction in detail. Let A = Σ, Q, q 0 , δ, α . Then, the state space of U 1 is Q × {acc, rej} and its transition on a letter σ, a follows δ when it reads σ, with a determining whether U 1 moves to the acc or rej copy. Let α 1 be the Rabin condition equivalent to α. We obtain the acceptance condition of U 1 by replacing each pair G, B in α 1 by G × {rej}, B × {rej} ∪ Q × {acc} . It is not hard to see that a run of U 1 satisfies the latter pair iff its projection on Q satisfies the pair G, B and its projection on {acc, rej} has only finitely many acc. The construction of U 2 is similar, with α 2 being a Rabin condition that complements α, and then replacing each pair G, B in α 2 by G × {acc}, B × {acc, rej}) . Since U 1 and U 2 have the same state space, and we only have to take the union of the pairs in their acceptance conditions, the 2n bound follows. Now, when L is given by an NBW, an exponential bound follows from the exponential blow up in determinization [42]. If we are also given an NBW for comp(L), the complexity can be tightened. Formally, we have the following.
Theorem 2. Given NBWs with n and m states, for L and comp(L), respectively, one of the following holds.
Proof. If L is in DBW, then a DBW for L can be defined on top of a DPW for L, which has at most (1.65n) n states [45], or by dualizing a DCW for comp(L). Since the translation of an NBW with m states to a DCW, when it exists, results in a DCW with 3 m states [7], we are done. If L is not in DBW, then we proceed as in the proof of Theorem 1, defining U on the top of a DPW for either L or comp(L).

Certifying DBW-Refutation
Consider a DBW-refuter R = {acc, rej}, Σ, env , S, s 0 , ρ, τ . We say that a path s 0 , . . . , s m in R is an rej + -path if it contains at least one transition and all the transitions along it are labeled by rej; thus, for all 0 ≤ j < m, we have that s j+1 = ρ(s j , rej). Then, a path s 0 , . . . , s m in R is an acc-path if it contains at least one transition and its first transition is labeled by acc. Thus, s 1 = ρ(s 0 , acc). Proof. Let s i ∈ S be a reachable state that belongs to an ergodic component in the graph of R (that is, s i ∈ C, for a set C of strongly connected states that can reach only states in C). Since R is responsive, in the sense it can read in each round both acc and rej, we can read from s i the input sequence rej ω . Hence, R has a rej + -path s i , . . . , s l , . . . , s k with s l = s k , for l < k. It is easy to see that the claim holds with s = s l . In particular, since R is responsive and C is strongly connected, there exists an acc-cycle from s l to itself. Theorem 3. An ω-regular language L is not in DBW iff there exist three finite words x ∈ Σ * and x 1 , x 2 ∈ Σ + , such that Proof. Assume first that L is not in DBW. Then, by Theorem 2, there exists a DBWrefuter R for it. Let p = s 0 , s 1 , . . . s m , p 1 = s 1 0 , s 1 1 , . . . , s 1 m1 , and p 2 = s 2 0 , s 2 1 , . . . , s 2 m2 , be the path, rej + -cycle, and acc-cycle that are guaranteed to exist by Lemma 1. Let x, x 1 , and x 2 be the outputs that R generates along them. Formally, ). Note that as the environment initiates the interaction, the first letter in the words x, x 1 , and x 2 , are the outputs in the second states in p, p 1 , and p 2 . We prove that x, x 1 , and x 2 satisfy the two conditions in the theorem.
Let y ∈ {acc, rej} * , and y 1 , y 2 ∈ {acc, rej} + be the input sequences read along p, p 1 , and p 2 , respectively. Thus, y = a 0 , a 1 , . . . , a m−1 is such that for all 0 ≤ j < m, we have that s j+1 = ρ(s j , a j ), and similarly for y 1 and y 2 with p 1 and p 2 .
Consider a word w ∈ x·(x 1 +x 2 ) * ·x ω 1 . Let a ∈ y·(y 1 +y 2 ) * ·y ω 1 be such that R(a) = w. Note we can obtain a from w by replacing each subword x by y, x 1 by y 1 , and x 2 by y 2 . Since p 1 is a rej + -cycle, we have that a ∈ (acc + rej) * · rej ω , and so a ∈ ¬∞acc. Since R is a refuter for L, it follows that R(a) ∈ L. Hence, Since p 1 is an acc-cycle, we have that a ∈ (rej * acc) ω , and so a ∈ ∞acc. Since R is a refuter for L, it follows that R(a) / ∈ L. Hence, x · (x * 1 · x 2 ) ω ∩ L = ∅, and we are done. For the other direction, we adjust Landweber's proof [28] for the non-DBW-recognizability of ¬∞a to L. Essentially, ¬∞a can be viewed as a special case of x·(x 1 +x 2 ) * ·x ω 1 , with x = , x 1 = b, and x 2 = a. Assume by way of contradiction that there is a DBW A with L(A) = L. Let A = Σ, Q, q 0 , δ, α . Consider the infinite word w 0 = x · x ω 1 . Since w 0 ∈ x · (x 1 + x 2 ) * · x ω 1 , and so w ∈ L, the run of A on w 0 is accepting. Thus, there is i 1 ≥ 0 such that A visits α when it reads the In a similar fashion we can continue to find indices i 1 , i 2 , . . . such for all j ≥ 1, we have that A visits α when it reads the Since Q is finite, there are iterations j and k, such that 1 ≤ j < k ≤ |Q| + 1 and there is a state q is not empty and at least one state in α is visited when A loops in q while reading it. It follows that the run of A on the word We refer to a triple x, x 1 , x 2 of words that satisfy the conditions in Theorem 3 as a certificate to the non-DBW-recognizability of L.
Note that obtaining certificates according to the proof of Theorem 3 may not give us the shortest certificate. For example, for L in Example 3, the proof would give us x = 01$, x 1 = $, and x 2 = 1$, with 01$·($+1$) * ·$ ω ⊆ L and 01$·($ * ·1$) ω ∩L = ∅. The problem of generating smallest certificates is related to the problem of finding smallest witnesses to DBW non-emptiness [22] and is harder. Formally, defining the length of a certificate x, x 1 , x 2 as |x| + |x 1 | + |x 2 |, we have the following: Proof. We start with membership in NP. Let n be the number of states in A. By Theorem 1 and the construction in Theorem 3 we can bound the length of a certificate to be at most 6n, since these are constructed from simple paths. Given a witness certificate x, x 1 , x 2 of length at most l (the latter can be checked in polynomial time, regardless of how l is given), checking the conditions in Theorem 3 involves checking x·(x 1 +x 2 ) * ·x ω 1 ⊆ L(A), namely containment of a DCW of size linear in the certificate in the language of a DPW, which can be done in polynomial time, and checking x · (x * 1 · x 2 ) ω ∩ L(A) = ∅, namely emptiness of the intersection with a DBW, which again can be done in polynomial time.
For the NP-hardness, we describe a reduction from the Hamiltonian-cycle problem on directed graphs. Formally, given a directed graph G = V, E , we describe a DPW that is not in DBW and which has a certificate of length |V | + 1 iff G has a Hamiltonian cycle, namely a cycle that visits each vertex in V exactly once. The proof elaborates on the NP-hardness proof of the problem of finding a shortest witness to DBW nonemptiness [22].
Let V = {1, . . . , n}, and assume that n ≥ 2 and E is not empty. We define a DPW A = E, (V × V ) ∪ { 1, 1 err }, { 1, 1 }, δ, α , where α( n, n ) = 1, α( 1, 1 err ) = 2, α(q) = 0 for all other states q, and Intuitively, A interprets a word w ∈ E ω , as an infinite path starting in vertex 1, and it verifies that the path is valid on G. Whenever A encounters an edge that does not match the current state, which is tracked in the first component of the state space, it resets and moves to 1, 1 err . The second component of a state i, j is the vertex the path owes a visit in order to visit all vertices infinitely often. It is easy to see that w ∈ L(A) iff there is a suffix w of w that describes a valid path in G that visits every vertex infinitely often. Notice that L(A) is not DBW-recognizable and that A is polynomial in the size of G.
For the other direction, assume that x, x 1 , x 2 is a certificate of size (at most) n + 1. Then, x · x ω 1 ∈ L(A) and as x 2 is not empty, it must be that |x| + |x 1 | ≤ n. Let r be the corresponding accepting run and thus r visits n, n infinitely often. By the definition of δ, the run r also visits the states i, i , for all 1 ≤ i ≤ n. Since the transitions to each of these states are labelled differently, x 1 must contain at least n different letters. Hence, |x 1 | must be n and thus G has a Hamiltonian cycle.

Remark 2.
[Relation with existing characterizations] By [28], the language of a DPW A = Σ, Q, q 0 , δ, α is in DBW iff for every accepting SCS C ⊆ Q and SCS C ⊇ C, we have that C is accepting. The proof of Landweber relies on a complicated analysis of the structural properties of A. As we elaborate below, Theorem 3, which relies instead on determinacy of games, suggests an alternative proof. Similarly, [50] examines the structure of a deterministic Muller automaton, and Theorem 3 can be viewed as a special case of Lemma 14 there, with a proof based on the game setting.
We use certificates in order to prove that a DPW A = Σ, Q, q 0 , δ, α is in DBW iff for every accepting SCS C ⊆ Q and SCS C ⊇ C, we have that C is accepting. First, an accepting SCS C ⊆ Q and a rejecting SCS C ⊇ C induce a certificate x, x 1 , x 2 . Indeed, taking a state s ∈ C, we can define x to be a word that leads from q 0 to s, x 1 to be a word that traverses C, and x 2 a word that traverses C . Then, the set of states traversed infinitely often in a run on a word in x · (x 1 + x 2 ) * · x ω 1 is C, and the set of states traversed infinitely often in a run on a word in x · (x * 1 · x 2 ) ω is C . For the other direction, a certificate x, x 1 , x 2 induces an accepting SCS C ⊆ Q and a rejecting SCS C ⊇ C as follows. Consider a graph G = Q, E , where E(s, s ) iff δ(s, x 1 ) = s or δ(s, x 2 ) = s . We consider an ergodic SCC that is reachable from δ(q 0 , x) in G. In this ergodic SCC, we can traverse both words in x · (x 1 + x 2 ) * · x ω 1 along an accepting cycle C, and words in x · (x * 1 · x 2 ) ω along a rejecting cycle, whose union with C can serve as C .
Being an (A/Σ)-transducer, every DBW-refuter R is responsive and may generate many different words in Σ ω . Below we show that we can leave R responsive and yet let it generate only words induced by a certificate. Formally, we have the following.
Proof. Intuitively, R first ignores the inputs and outputs x. It then repeatedly outputs either x 1 or x 2 , according to the following policy: in the first iteration, R outputs x 1 . If during the output of x 1 all inputs are rej, then R outputs x 1 also in the next iteration.
If an input acc has been detected, thus the prover tries to accept the constructed word, the refuter outputs x 2 in the next iteration, again keeping track of an acc input. If no acc has been input, R switches back to outputting x 1 .
Proof. The paths p, p 1 , and p 2 that induce x, x 1 and x 2 in the proof of Theorem 3 are simple, and so they are all of length at most n. Also, while these paths may share edges, we can define them so that each edge appears in at most two paths. Indeed, if an edge appears in all three path, we can shorten p. Hence, |x| + |x 1 | + |x 2 | ≤ 2 · n, and we are done.
Theorem 5. Consider a language L ⊆ Σ ω not in DBW. The length of a certificate for the non-DBW-recognizability of L is linear in a DPW for L and is exponential in an NBW for L. These bounds are tight.
Proof. The upper bounds follow from Theorem 1 and Lemma 3, and the exponential determinization of NBWs. The lower bound in the NBW case follows from the exponential lower bound on the size of shortest non-universality witnesses for non-deterministic finite word automata (NFW) [33]. We sketch the reduction: Let L n ⊆ {0, 1} * be a language such that the shortest witness for non-universality of L n is exponential in n, but L n has a polynomial sized NFW. We then define L n = (L n ·$·(0 * ·1) ω )+((0+1) * ·$·(0+1) * ·0 ω ). It is clear that L n has a NBW polynomial in n and is not DBW-recognizable. Note that for every word w ∈ L n , we have w ·$·(0+1) ω ⊆ L n . Thus, in order to satisfy Theorem 3, every certificate x, x 1 , x 2 needs to have w · $ as prefix of x, for some w / ∈ L n . Hence, it is exponential in the size of the NBW.

Remark 3. [LTL]
When the language L is given by an LTL formula ϕ, then DBW(ϕ) = ϕ ↔ GFacc and thus an off-the-shelf LTL synthesis tool can be used to extract a DBWrefuter, if one exists. As for complexity, a doubly-exponential upper bound on the size

Separability and Approximations
Consider three languages L 1 , L 2 , L ⊆ Σ ω . We say that L is a separator for L 1 , L 2 if L 1 ⊆ L and L 2 ∩ L = ∅. We say that a pair of languages L 1 , L 2 is DBW-separable iff there exists a language L in DBW such that L is a separator for L 1 , L 2 .
Consider a language L ⊆ Σ ω , and suppose we know that L is not in DBW. A user may be willing to approximate L in order to obtain DBW-recognizability. Specifically, we assume that there is a language I ⊆ Σ ω of words that the user is indifferent about. Formally, the user is satisfied with a language in DBW that agrees with L on all words that are not in I. Formally, we say that a language L approximates L with radius I if L\I ⊆ L ⊆ L∪I. It is easy to see that, equivalently, L is a separator for L\I, comp(L∪ I) . Note that the above formulation embodies the case where the user has in mind different over-and under-approximation radiuses, thus separating L \ I ↓ , comp(L ∪ I ↑ ) for possibly different I ↓ and I ↑ . Indeed, by defining I = (I ↓ ∩ L) ∪ (I ↑ \ L), we get L \ I, comp(L ∪ I) = L \ I ↓ , comp(L) \ I ↑ ) .
It follows that by studying DBW-separability, we also study DBW-approximation, namely approximation by a language that is in DBW, possibly with different over-and under-approximation radiuses.

Remark 4. [From recognizability to separation]
It is easy to see that DBW-separability generalizes DBW-recognizability, as L is in DBW iff L, comp(L) is DBWseparable. Given L ⊆ Σ ω , we say that a pair of languages L 1 , L 2 is a no-DBW-witness for L if L is a separator for L 1 , L 2 and L 1 , L 2 is not DBW-separable. Note that the latter indeed implies that L is not in DBW.
A simple no-DBW witness for L can be obtained as follows. Let R be a DBW refuter for L. Then, we define L 1 = {R(y) : y ∈ ¬∞acc} and L 2 = {R(y) : y ∈ ∞acc}. By the definition of DBW-refuters, we have L 1 ⊆ L and L 2 ∩ L = ∅, and so L 1 , L 2 is a no-DBW witness for L. It is simple, in the sense that when we describe L 1 and L 2 by a tree obtained by pruning the Σ * -tree, then each node has at most two children -these that correspond to the responses of R to acc and rej.
Example 5. Consider the language L ¬∞a = (a + b) * · b ω , which is not DBW. Let I = a * · b ω + b * · a ω , thus we are indifferent about words with only one alternation between a and b. In Figure 5 we describe a DBW-sep refuter for L ¬∞a \ I, comp(L ¬∞a ∪ I) . Note that the refuter generates only words in a · b · a · (a + b) ω , whose intersection with I is empty. Consequently, the refutation is similar to the DBW-refutation of L ¬∞a .
By Proposition 1, we have the following extension of Proposition 2.
Proposition 3. Consider two languages L 1 , L 2 ⊆ Σ ω . Let A = {acc, rej}. Exactly one of the following holds: -L 1 , L 2 is DBW-separable, in which case the language SepDBW(L 1 , L 2 ) is (Σ/A)realizable by the system, and a finite-memory winning strategy for the system induces a DBW for a language L that separates L 1 and L 2 . -L 1 , L 2 is not DBW-separable, in which case the language NoSepDBW(L) is (A/Σ)realizable by the environment, and a finite-memory winning strategy for the environment induces a DBW-sep-refuter for L 1 , L 2 .
As for complexity, the construction of the game for SepDBW(L 1 , L 2 ) is similar to the one described in Theorem 1. Here, however, the input to the problem includes two DPWs. Also, the positive case, namely the construction of the separator does not follow from known results. Theorem 6. Consider DPWs A 1 and A 2 with n 1 and n 2 states, respectively. Let L 1 = L(A 1 ) and L 2 = L(A 2 ). One of the following holds.
Proof. We show that SepDBW(L 1 , L 2 ) and NoSepDBW(L 1 , L 2 ) can be recognised by DRWs with at most 2 · n 1 · n 2 states. Then, by [15], we can construct a DBW or a DBWsep-refuter with at most 2·n 1 ·n 2 states. The construction is similar to the one described in the proof of Theorem 1. The only technical challenge is the fact SepDBW(L 1 , L 2 ) is defined as the intersection, rather than union, of two languages. For this, we observe that we can define SepDBW(L 1 , L 2 ) also as {x ⊕ y : (y ∈ ∞acc and x / ∈ L 2 ) or (y / ∈ ∞acc and x / ∈ L 1 )}. With this formulation we then can reuse the union construction as seen in Theorem 1 to obtain DRWs with at most 2 · n 1 · n 2 states.
As has been the case with DBW-recognizability, one can generate certificates from a DBW-sep-refuter. The proof is similar to that of Theorem 3, with membership in L 1 replacing membership in L and membership in L 2 replacing being disjoint from L. Formally, we have the following.

Theorem 7.
Two ω-regular languages L 1 , L 2 ⊆ Σ ω are not DBW-separable iff there exist three finite words x ∈ Σ * and x 1 , x 2 ∈ Σ + , such that We refer to a triple x, x 1 , x 2 of words that satisfy the conditions in Theorem 7 as a certificate to the non-DBW-separability of L 1 , L 2 . Observe that the same way we generated a no-DBW witness in Remark 4, we can extract, given a DBW-sep-refuter R for L 1 , L 2 , languages L 1 ⊆ L 1 and L 2 ⊆ L 2 that tighten L 1 , L 2 and are still not DBW-separable.

Certificate-Guided Approximation
In this section we describe a method for finding small approximating languages I ↓ and I ↑ such that L \ I ↓ , comp(L) \ I ↑ is DBW-separable. If this method terminates we obtain an approximation for L that is DBW-recognizable. As in counterexample guided abstraction-refinement (CEGAR) for model checking [10], we use certificates for non-DBW-separability in order to suggest interesting approximating languages. Intuitively, while in CEGAR the refined system excludes the counterexample, here the approximation of L excludes the certificate.
Consider a certificate x, x 1 , x 2 for the non-DBW-separability of L 1 , L 2 . We suggest the following five approximations: First, it is easy to verify that x, x 1 , x 2 is indeed not a certificate for the non-DBWseparability of the obtained candidate pairs L 1 , L 2 . If L 1 , L 2 is DBW-separable, we are done (yet may try to tighten the approximation). Otherwise, we can repeat the process with a certificate for the non-DBW-separability of L 1 , L 2 . As in CEGAR, some suggestions may be more interesting than others, in some cases the process terminates, in some it does not, and the user takes part directing the search. Example 6. Consider again the language L = (a+b) * ·b ω and the certificate x, x 1 , x 2 = , b, a . Trying to approximate L by a language in DBW, we start with the pair L, comp(L) . Our five suggestions are then as follows.
Candidates C 0 , C 1 , and C 3 induce trivial approximations. Then, C 2 suggests to over-approximate L by setting I ↑ to (a * · b) ω , which we view as a nice solution, approximating "eventually always b" by "infinitely often b". Then, the pair derived from C 4 is not DBW-separable. We can try to approximate it. Note, however, that repeated approximations in the spirit of C 4 are going to only extend the prefix of x in the certificates, and the process does not terminate.
Let us now consider the slightly different certificate x, x 1 , x 2 = a, b, a and the derived candidates: One can easily verify that x, x 1 , x 2 = b · a, b, a is a certificate showing that none of the suggested pairs are DBW-separable. In fact x, x 1 , x 2 = b i · a, b, a , for i = 0, 1, 2, . . . , describes an infinite sequence such that no refinement obtained after a finite number of steps is DBW-separable.

Other Classes of Deterministic Automata
In this section we generalise the idea of DBW-refuters to other classes of deterministic automata. For this we take again the view that a deterministic automaton is a Σ, Atransducer over a suitable annotation alphabet A. We then characterize each class of deterministic automata by two languages over A: -The language L acc ⊆ A ω , describing when a run is accepting. For example, for DBWs, we have A = {acc, rej} and L acc = ∞acc. -The language L struct ⊆ A ω , describing structural conditions on the run. For example, recall that a DWW is a DBW in which the states of each SCS are either all accepting or all rejecting, and so each run eventually get trapped in an accepting or rejecting SCS. Accordingly, the language of runs that satisfy the structural condition is L struct = A * · (acc ω + rej ω ).
We now formalize this intuition. Let A be a finite set of annotations and let γ = L acc , L struct , for L acc , L struct ⊆ A ω . A deterministic automaton A = Σ, Q, q 0 , δ, α is a deterministic γ automaton (DγW, for short) if there is a function τ : Q → A that maps each state to an annotation such that a run r of A satisfies α iff τ (r) ∈ L acc , and all runs r satisfy the structural condition, thus τ (r) ∈ L struct . We then say that a language L is γ-recognizable if there a DγW A such that L = L(A).
Before we continue to study γ-recognizability, let us demonstrate the γ-characterization of common deterministic automata. We first start with classes γ for which L struct is trivial; i.e., L struct = A ω . Note that the characterizations for Büchi, co-Büchi, and parity are special cases of the characterization for DELW. In a similar way, we could define a language L acc for DRW[k] and other common special cases of DELWs. We continue to classes in the depth hierarchy, where γ includes also a structural restriction: -DWW: The set A and the language L acc are as for DBW or DCW. In addition, L struct = A * · (acc ω + rej ω ). -DWW[j, k], for j ∈ {0, 1}: The set A and the language L acc are as for DPW [j, k].
In addition, L struct = {y 0 · y 1 · · · ∈ A ω : for all i ≥ 0, we have that y i ≤ y i+1 }. -Bounded Languages: A language L is bounded if it is both safety and co-safety.
Let Σ be an alphabet, let A be an annotation alphabet, and let γ = L acc , L struct , for L acc , L struct ⊆ A ω . We define the language Real(L, γ) ⊆ (Σ × A) ω of words with correct annotations.
Note that the language DBW(L) can be viewed as a special case of our general framework. In particular, in cases L struct = A ω , we can remove the y ∈ L struct conjunct from Real(L, γ). Note that comp(Real(L, γ)) is the language NoReal(L, γ) = {x ⊕ y : y ∈ L struct or (x ∈ L iff y ∈ L acc )}.
Proposition 4. Consider an ω-regular language L ⊆ Σ ω , and a pair γ = L acc , L struct , for ω-regular languages L acc , L struct ⊆ A ω . Exactly one of the following holds: 1. L is in DγW, in which case the language Real(L, γ) is (Σ/A)-realizable by the system, and a finite-memory winning strategy for the system induces a DγW for L.
2. L is not in DγW, in which case the language NoReal(L, γ) is (A/Σ)-realizable by the environment, and a finite-memory winning strategy for the environment induces a γ-refuter for L.
Note that every DELW can be complemented by dualization, thus by changing its acceptance condition from θ to ¬θ. In particular, DBW and DCW dualize each other. As we argue below, dualization is carried over to refutation. For example, the ({acc, rej}/Σ)-transducer R from Figure 1 is both a DBW-refuter for ¬∞a and a DCW-refuter for ∞a. Formally, we have the following. While dualization is nicely carried over to refutation, this is not the case for all expressiveness results. For example, while DWW=DBW∩DCW, and in fact DBW and DCW are weak type (that is, when the language of a DBW is in DWW, an equivalent DWW can be defined on top of its structure, and similarly for DCW [21]), we describe below a DWW-refuter that is neither a DBW-nor a DCW-refuter. Intuitively, this is possible as in DWW refutation, Prover loses when the input is not in A * ·(acc ω +rej ω ), whereas in DBW and DCW refutation, Refuter has to respond correctly also for these inputs.
Example 7. Let Σ = {a, b, c, d}, and A = {acc, rej}. Consider the language L = (a + · b · c * · d) * · a ω + (a · b · d) ω . Note that L is in DCW, but not in DBW, and hence also not in DWW. The (A/Σ)-transducer R in Figure 6 is a DWW-refuter for L. To see this, recall that for DWWs, we have that L struct = A * · (acc ω + rej ω ), and so all input sequences y ∈ A ω that satisfy L struct eventually gets trapped in the a ω loop, generating a rejecting run on a word in the language, or gets trapped in the c ω loop, generating an accepting run on a word not in the language.
On the other hand, while L is not in DBW, the transducer R is not a DBWrefuter for L. To see this, observe that the DBW A in the figure suggests a winning strategy for Prover in the game corresponding to DBW. Indeed, when Prover generates (rej · acc · rej) ω , which is accepting, then by following R, Refuter responds with (a · b · d) ω , which is in L, and so Prover wins. Note that, unsurprisingly, the input generated by Prover does not satisfy L struct .
On the other hand, as every DWW is also a DBW and a DCW, every DBW-refuter or DCW-refuter is also a DWW-refuter.
Note that the language SepDBW(L 1 , L 2 ) can be viewed as a special case of our general framework and as before in cases L struct = A ω , we can remove the y ∈ L struct conjunct from Sep. A γ-sep-refuter for L is an (A/Σ)-transducer with ι = env that realizes NoSep(L 1 , L 2 , L acc , L struct ). By Proposition 1, exactly one of the following holds: Proposition 5. Consider ω-regular languages L 1 , L 2 ⊆ Σ ω , and a characterization γ = L acc , L struct , for ω-regular languages L acc , L struct ⊆ A ω . Exactly one of the following holds: 1. L 1 , L 2 are γ-separable, in which case the language Sep(L 1 , L 2 , γ) is (Σ/A)-realizable by the system, and a finite-memory winning strategy for the system induces a DγW for some L such that L 1 ⊆ L and L ∩ L 2 = ∅. 2. L 1 , L 2 are not γ-separable, in which case the language NoSep(L 1 , L 2 , γ) is (A/Σ)realizable by the environment, and a finite-memory winning strategy for the environment induces a γ-sep-refuter for L 1 , L 2 .

Certifying DγW-Refutation
In this section we extend the three-word certificates for non-DBW-recognizability to richer classes of deterministic automata. The idea is similar (and in fact a little tedious): each DγW-refuter embodies a structure (analogous to the one in Lemma 1) from which we can extract finite words that constitute the corresponding certificate (analogous to the one in Theorem 3). We describe here the details for classes in the Mostowski hierarchy and well as for classes of the depth-hierarchy. We also restrict ourselves to word-certificates for non-recognizability and do not show the word-certificates for nonseparability which have an identical structure.

Mostowski Hierarchy
First, by Theorem 8, certificates for a class and its dual class are related. For example, dualizing Theorem 3, we obtain certificates for non-DCW-recognizability as follows.
Theorem 9. An ω-regular language L is not in DCW iff there exist three finite words x ∈ Σ * and x 1 , x 2 ∈ Σ + , such that Handling DPWs, we first define the analogue of a rej + -path, and then point to the desired structure and the certificate it induces. Consider a DPW[i, k]-refuter R = {i, . . . , k}, Σ, env , S, s 0 , ρ, τ with i ∈ {0, 1} and i ≤ k. Let ∈ {i, . . . , k}. We say that a path s 1 , . . . , s m in R is an + ≤ -path if its first transition is labelled and all its other transitions are labeled by colors in {i, . . . }. Thus, s 2 = ρ(s 1 , ) and, for all 1 ≤ j < m, we have that s j+1 = ρ(s j , ), for some ≤ . Proof. Let R ≤j denote the transducer that we obtain from R when we restrict δ to transitions labelled by at most j. Note that R is R ≤k . We proceed by induction on j with i ≤ j ≤ k and show that in the transducer R ≤j for every state s ∈ S there exists a state s ∈ S, a (possibly empty) path p = s 1 , . . . s m with s = s 1 , and that for each ∈ {i, . . . , j} there exists a + ≤ -cycle p = s 1 , s 2 . . . s m , such that s m = s 1 = s m = s . The base case for j = i follows immediately from the fact that R ≤i is responsive on {i} and by reading i ω we obtain a lasso with the required properties.
Let j > i and let s ∈ S be an arbitrary state. Further, let s j ∈ S be a reachable state from s that belongs to an ergodic component in the graph of R ≤j (that is, s j ∈ C, for a set C of strongly connected states that can reach only states in C). By induction hypothesis there exists s ∈ S, a (possibly empty) path p = s j , s j+1 , . . . s m , and for each ∈ {i, . . . , j −1} there exists a + ≤ -cycle p = s 1 , s 2 . . . s m , such that s m = s 1 = s m = s for every ∈ {i, . . . , j − 1}. Since R ≤j is responsive on {i, . . . , j} we can take from s a transition labelled and since C is ergodic we can find a path back to s . Thus we obtain the missing j + ≤ -cycle and by concatenating the path from s to s j and the path p, we show that s can be reached from s. Theorem 10. Let i ∈ {0, 1} and i ≤ k. An ω-regular language L is not in DPW[i, k] iff there exist finite words x ∈ Σ * and x i , . . . , x k ∈ Σ + , such that for every even i ≤ ≤ k, we have x · (x i + · · · + x k ) * · ((x i + x i+1 + · · · + x −1 ) * · x ) ω ⊆ L, and for every odd i ≤ ≤ k, we have Proof. Assume first that L is not in DPW[i, k]. Then, by Proposition 4, there exists a DPW[i, k]-refuter R for it. From this refuter we can extract via Lemma 4 a path p and + ≤ -cycles. We then construct the postulated finite words in the exact same way as in the proof of Theorem 3. For the other direction, we first simplify the presentation by assuming i = 0. The proof for i = 1 is analogous. Assume by way of contradiction that there is a DPW[0, k] A with L(A) = L. Let A = Σ, Q, q 0 , δ, α . Let n = |Q| and consider the following sequence of words w 0 = x n 0 , w 1 = (w 0 · x 1 ) n , . . . , w k = (w k−1 · x k ) n . Let q = δ(q 0 , w) be a state that is reached after reading w ∈ x · (x i + x i+1 + . . . x k ) * . Since w · w ω 0 ∈ L, there must be a state p 0 that is visited infinitely often and α(p 0 ) is odd. Since |w 0 | ≥ |Q|, this state must have been visited while reading w 0 . Now, consider w · w ω 1 . This word is rejected and by the same reasoning as before there must be some p 1 such that α(p 1 ) is even, it is visited while reading w 1 , and for every p 0 that belongs to a w 0 subsequences we have α(p 1 ) > α(p 0 ). We continue and obtain a sequence α(p k ) > · · · > α(p 0 ) with k strict inequalities. Since α(p 0 ) is odd, we have α(p 0 ) > 0 and thus α(p k ) > k, which contradicts the fact that A is a DPW[0, k].
Note that, by [38], the "flower"-structure that induces the certificate exists also in DPWs for L. Specifically, while Lemma 4 shows that every DPW[i, k]-refuter contains a "flower" with k − i + 1 petals, it is shown in [38] that for every ω-language L not in DPW[1, k + 1], there exists a DPW for L that contains a flower with k + 1 petals and this flower occurs in some accepting run. Finally, the Streett and generalized acceptance conditions are dual to Rabin and generalized Rabin, and certificates for them can be obtained dually.
Proof. Such a structure can be found by constructing a sequence of lassos. Start by reading i ω from s 0 to construct an i + -path p i and an i + -cycle c i . s i is then the last state of c i , respectively. Then, continue by reading (i + 1) ω from s i to find the next lasso and continue until all lassos are found.
Theorem 11. Let i ∈ {0, 1} and i ≤ k. An ω-regular language L is not in DWW[i, k] iff there exist finite wordsx i ,x i+1 , . . . ,x k ∈ Σ * and x i , x i+1 , . . . , x k ∈ Σ + , such that for every even i ≤ ≤ k, we havê x ω ⊆ L, and for every odd i ≤ ≤ k, we havê Proof. Assume first that L is not in DWW[i, k]. Then, by Proposition 4, there exists a DWW[i, k]-refuter R for it. From this refuter we can extract via Lemma 5 a sequence of states with the corresponding paths and cycles. We then obtain words in the same manner as in the proof of Theorem 3.
Proof. Let s ∈ S be state in an ergodic SCC of the graph of R. Then the acc + -and rej + -cycle are obtained from the lassos formed by reading from s the words acc ω and rej ω , respectively. Since s belongs to an ergodic SCC, there exist paths connecting the first states of these cycles.
Recall that DWW=DBW∩DCW, so one would define a DWW certificate by disjuncting the certificates for DBW and DCW in Theorems 3 and 9. Theorem 12, however, suggests a different certificate, and it is interesting to relate it to the ones for DBW and DCW. Also note that while the DBW, DCW, and DPW certificates are covered by [50, Lemma 14], this is not the case for the DWW certificate in Theorem 12. Recall that at the bottom of the depth hierarchy we have safety and co-safety languages, whose intersection is the set of bounded languages.
Theorem 13. An ω-regular language L is not a bounded language iff there exist six finite wordsx 0 ,x 1 ,x 2 ∈ Σ * and x 0 , x 1 , x 2 ∈ Σ + , such that Proof. Assume first that L is not bounded. Then, by Proposition 4, there exists a L bounded acc , L bounded struct -refuter R for it. From this refuter we can extract three lassos: a ?-labeled lasso from which we obtainx 0 and x 0 ; a rej-labeled lasso starting at the entry-point of the first lasso from which we obtainx 1 and x 1 ; and a acc-labeled lasso starting at the entry-point of the first lasso from which we obtainx 2 and x 2 .
For the other direction assume by way of contradiction that there is a deterministic L bounded acc , L bounded struct -automaton A = Σ, Q, q 0 , δ, τ, γ with L(A) = L. Assume that x 0 · x ω 0 ∈ L. Thus after reading |Q| letters one state has been repeated and by the constraint it must be accepting. Thusx 0 · x |Q| 0 ·x 2 · x ω 2 ∈ L which is a contradiction. The other case is analogous.

Discussion and Directions for Future Research
The automation of decision procedures makes certification essential. We suggest to use the winning strategy of the refuter in expressiveness games as a certificate to inexpressibility. We show that beyond this state-based certificate, the strategy induces a word-based certificate, generated from words traversed along a "flower structure" the strategy contains, as well as a language-based certificate, consisting of languages that under-and over-approximate the language in question and that are not separable by automata in the desired class.
While our work considers expressive power, one can use similar ideas in order to question the size of automata needed to recognize a given language. For example, in the case of a regular language L of finite words, the Myhill-Nerode characterization [36,37] suggests to refute the existence of deterministic finite word automata (DFW) with n states for L by providing n + 1 prefixes that are not right-congruent. Using our approach, one can alternatively consider the winning strategy of Refuter in a game in which the set of annotations includes also the state space, and L struct ensures consistency of the transition relation. Even more interesting is refutation of size in the setting of automata on infinite words. Indeed, there, minimization is NP-complete [46], and there are interesting connections between polynomial certificates and possible membership in co-NP, as well as connections between size of certificates and succinctness of the different classes of automata.
Finally, while the approximation scheme we studied is based on suggested over-and under-approximating languages, it is interesting to study approximations that are based on more flexible distance measures [13,18]. The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.