Permutation Games for the Weakly Aconjunctive mu-Calculus

We introduce a natural notion of limit-deterministic parity automata and present a method that uses such automata to construct satisfiability games for the weakly aconjunctive fragment of the mu-calculus. To this end we devise a method that determinizes limit-deterministic parity automata of size n with k priorities through limit-deterministic B\"uchi automata to deterministic parity automata of size O((nk+2)!) and with O(nk) priorities. The construction relies on limit-determinism to avoid the full complexity of the Safra/Piterman-construction by using partial permutations of states in place of Safra-Trees. By showing that limit-deterministic parity automata can be used to recognize unsuccessful branches in pre-tableaux for the weakly aconjunctive mu-calculus, we obtain satisfiability games of size O((nk+2)!) with O(nk) priorities for weakly aconjunctive input formulas of size n and alternation-depth k. A prototypical implementation that employs a tableau-based global caching algorithm to solve these games on-the-fly shows promising initial results.


Introduction
The modal µ-calculus [14] is an expressive logic for reasoning about concurrent systems.Its satisfiability problem is ExpTime-complete [5].Due to nesting of fixpoints, the semantic structure of the µ-calculus is quite involved, which is reflected in the high degree of sophistication of reasoning algorithms for the µ-calculus.One convenient modular approach is the definition of suitable satisfiability games (e.g.[10]); solving such games (i.e.computing their winning regions) then amounts to deciding the satisfiability of the input formulas.A standard method for obtaining satisfiability games is to first construct a tracking automaton that accepts the bad branches in a pre-tableau for the input formula, i.e. those that infinitely defer satisfaction of a least fixpoint; this automaton then is determinized and complemented, and the satisfiability game is built over nodes from the pre-tableau that are annotated with states of the complemented deterministic automaton.The moves in the game correspond to applications of tableau-rules but also transform the automaton component of nodes according to the transition function of the automaton; the existence of a winning strategy in this game ensures the existence of a model, i.e. a locally coherent structure that does not contain bad branches.As they typically incur exponential blowup, good determinization procedures for automata on infinite words play a crucial role in standard decision procedures for the satisfiability problem of the µ-calculus and its fragments; in particular, better determinization procedures lead to smaller satisfiability games which are easier to solve.
The weakly aconjunctive µ-calculus [14,23] restricts occurrences of recursion variables in conjunctions but is still quite expressive, e.g. can define winning regions in parity games with bounded number of priorities [4].The key observation for the present paper is that in the weakly aconjunctive case, pre-tableau branches are made 'bad' by a single formula; this implies that the tracking automaton for such formulas is limit-deterministic, i.e. that is is sufficient to deterministically track a single formula from some point on.This motivates a notion of limit-deterministic parity automata in which all accepting runs are deterministic from some point on.Because the nondeterminism is restricted to finite prefixes of accepting runs in such automata, they can be determinized in a simpler way than unrestricted parity automata.We present a reformulation of a recent determinization method for limit-deterministic Büchi automata [6].The method is inspired by, but significantly less involved than the more general Safra/Piterman construction [19,18], essentially due to the fact that the tree structure of Safra trees collapses, leaving only the permutation structure.The resulting parity automaton can thus be described as a permutation automaton.The method yields deterministic parity automata with O((n + 2)!) states, compared to O((n!) 2 ) in the Safra/Piterman construction.Crucially, we show that we obtain a similarly simplified determinization for limit-deterministic parity automata by translating into Büchi automata.
As indicated above, limit-deterministic parity automata are able to recognize bad branches in pre-tableaux for weakly aconjunctive µ-calculus formulas.Employing them in the standard construction of satisfiability games, we obtain permutation games in which nodes from the pre-tableau are annotated with a partial permutation (i.e. a non-repetitive list) of (levelled) formulas.A parity condition is used to detect indices in the permutation that are active infinitely often without ever being removed from the permutation.The resulting parity games are of size O(nk + 2)! and have O(nk) priorities; as a side result, we thus obtain a new bound O(nk + 2)! on model size for weakly aconjunctive formulas.
The resulting decision procedure generalizes to the weakly aconjunctive coalgebraic µ-calculus, thus covering also, e.g., probabilistic and alternating-time versions of the µ-calculus.The generic algorithm has been implemented as an extension of the Coalgebraic Ontology Logic Reasoner (COOL) [11,12].Our implementation constructs and solves the presented permutation games on-the-fly, possibly finishing satisfiability proofs early, and shows promising initial results.The content of the paper is structured as follows: We describe the determinization of limit-deterministic automata in Section 2 and the construction of permutation games in Section 3, and discuss implementation and evaluation in Section 4. [16] give a tighter estimate O((n!) 2 ) for the number of states in Piterman's determinization [18].Schewe [20] simplifies Piterman's construction (establishing the same bound as Liu and Wang).Tian and Duan [22] further improve Schewe's construction.Fisman and Lustig [7] present a modularization of Büchi determinization that is aimed mainly at easing understanding of the construction.Parity automata can be determinized by first converting them to Büchi automata and then applying Büchi determinization.Schewe and Varghese [21] address the direct determinization of parity automata (via Rabin automata), and prove optimality within a small constant factor, and even absolute optimality for the Büchi subcase.All these constructions and estimates concern unrestricted Büchi or parity automata.Recently, Safra-less determinization of limit-deterministic Büchi automata has been described in the context of controller synthesis for LTL [6]; the determinization method that we present in Section 2.2.has been devised independently from [6] but employs a very similar construction (yielding essentially the same results on the complexity of the construction).

Related Work Liu and Wang
The use of games in µ-calculus satisfiability checking goes back to Niwiński and Walukiewicz [17] and has since been extended to the unguarded µ-calculus [10] and the coalgebraic µ-calculus [2].Game-based procedures for the relational µ-calculus have been implemented in MLSolver [9], and for the alternation-free coalgebraic µ-calculus in COOL [12].

Limit-deterministic automata
We recall the basics of parity automata: A parity automaton is a tuple sequence of states v i such that v 0 = v and for all i ≥ 0, v i+1 ∈ δ(v i , a i ).We see runs ρ or words w as functions from natural numbers to states ρ(i) = v i ∈ V or letters w(i) = a i ∈ Σ.We denote the set of all runs of A on a word w starting at v by run(A, v, w), or just by run(A, w) if v = u 0 .A run ρ of A is accepting if the highest priority that occurs infinitely often in it (notation: max(Inf(α • ρ))) is even.A parity automaton A accepts an infinite word w if run(A, w) contains an accepting run and we denote by L(A) ⊆ Σ ω the set of all words that are accepted by A.
Given a set U ⊆ V and a letter a ∈ Σ, we put δ U (v, a) = δ(v, a)∩U ; for a finite word w = a 0 . . .a n , we then recursively define δ U (v, w) = δ U (δ U (v, a 0 ), a 1 . . .a n ), obtaining the set of all states reachable from v when reading w while only passing states from The automaton A is said to be deterministic if V is deterministic; the transition relation in deterministic automata hence is a partial function (since such automata can be transformed to equivalent automata with total transition function, this definition suffices for purposes of determinization).We put A Büchi automaton is a parity automaton with only the priorities 1 and 2; the set of accepting states is then F = α (2).For Büchi automata, we assume w.l.o.g. that every node v ∈ F is reachable from itself.We use the abbreviations (N/D)PA, (N/D)BA to denote the different types of automata.
Our notion of limit-determinism of automata is defined as a semantic property:

Definition 2 (Compartments).
Given a PA A = (V, Σ, δ, u 0 , α) with k priorities, and an even number Note that the union of all l-compartments is reach α ≤ (l) (α(l)).Compartments allow for a syntactic characterization of limit-determinism: Lemma 3. A PA is limit-deterministic if and only if all its compartments are internally deterministic.Corollary 4. It is decidable in polynomial time whether a given automaton is limit-deterministic.
Lemma 3 specializes to BA as follows: we have α(0) = ∅, α ≤ (2) = V and α(2) = F , so that the union of all 0-compartments is empty and that of all 2-compartments is reach(F ); thus a BA is limit-deterministic iff reach(F ) is deterministic.Such Büchi automata are also called semi-deterministic [3].

Determinizing Limit-Deterministic Büchi Automata
The Safra/Piterman construction [19,18] determinizes Büchi automata by means of so-called Safra trees, i.e. trees whose nodes are labelled with sets of states of the input automaton such that the label of a node is a proper superset of the union of all its children's labels.Additionally, the nodes are ordered by their age and upon each transition between Safra trees, the ages of the oldest nodes that are active after and/or removed during this transition determine the priority of the new Safra tree.In its original formulation, the Safra/Piterman construction adds new child nodes to the graph that are labelled with the accepting states in their parent's label.We observe that this step can be modified slighty -without affecting the correctness of the construction -by letting every accepting state from the parent's label receive its own separate child node; then the labels of newly created nodes are always singletons.Limit-determinism of the input automaton then implies that the node labels also remain singletons.Since singleton nodes do not have children in Safra trees, this leads to the collapse of their tree structure; the resulting data structure is essentially a partial permutation, i.e. a non-repetitive list, of states (ordered by their age).The arising modified Safra/Piterman construction for the limit-deterministic case boils down to the following method, which a) has a relatively short presentation and a simpler correctness proof than the full Safra/Piterman construction, and b) results in asymptotically smaller automata; the underlying idea of the construction has first been described in the context of controller synthesis for LTL [6].

Definition 5 (Partial permutations).
Given a set U of states, let pperm(U ) denote the set of partial permutations over U , i.e. the set of non-repetitive lists l = [v 1 , . . ., v n ] with v i = v j for i = j and v i ∈ U , for all 1 ≤ i ≤ n.We denote the i-th element in l by l(i) = v i .The value l(i) of a partial permutation at index i may be undefined, in which case we write l(i) = * .We denote the empty partial permutation by [ ] and the length of a partial permutation l by |l|.Definition 6 (Determinization of limit-deterministic BA).We fix a limit- and for (U, l, p) ∈ W and a ∈ Σ, δ ′ ((U, l, p), a) = (δ(U, a) ∩ Q, l ′ , p ′ ), where l ′ is constructed from l = [v 1 , . . ., v m ] as follows: 1. Define a partial permutation t with m elements in which iteratively put t(j) = t(j + 1) for each i ≤ j ≤ |t|, starting at i. 4. For any w ∈ δ(U, a) ∩ Q that does not occur in t, add w to the end of t.If there are several such w, the order in which they are added to t is irrelevant. 5. Put l ′ = t.
Temporarily, t may contain duplicate entries, but Steps 2. and 3. ensure that in the end, t is a partial permutation.Let r (for 'removed') denote the lowest index i such that t(i) = * after Step 2. Let a (for 'active') denote the lowest index i

Corollary 8. Limit-deterministic Büchi automata of size n can be determinized to deterministic parity automata of size O((n + 2)!) and with O(n) priorities.
Example 9. Consider the limit-deterministic BA A depicted below and the determinized DPA B that is constructed from it by applying the method.Notice that by Lemma 3, A can easily be shown to be limit-deterministic: we have Notice that in B, there is a b-transition from the initial state to the sink state (∅, [ ], 1) and an a-transition to ({0, 2}, [1], 1); as 1 ∈ Q but 1 / ∈ F , 1 is added to the permutation component but its position in the permutation is not active so that the priority of the new macrostate is 1.A further b-transition leads from 1 to 3 in A; in B, we have a b-transition from ({0, 2}, [1], 1) to ({2}, [3], 4) since 3 ∈ F so that the first position in the permutation component is active.Yet another b-transition leads to ({2}, [3], 5).Since there is no b-transition starting at state 3, the first element in the permutation is removed in Step 1. of the construction.Since there is a b-transition from 2 to 3, it is added to the permutation again in Step 4. of the construction.Crucially, however, the priority of the macrostate is 5, since the first item of the permutation has been (temporarily) removed.The intuition is that the trace of 3 ends when the letter b is read; even though a new trace of 3 immediately starts, we do not consider it to be the same trace as the previous one.Thus the macrostate obtains priority 5 so that it may be passed only finitely often in an accepting run of B, i.e. accepting runs contain an uninterrupted trace that visits state 3 infinitely often.Thus two or more consecutive b's can only occur finitely often in any accepted word.

Determinizing Limit-Deterministic Parity Automata
To determinize limit-deterministic PA, it suffices to transform them to equivalent limit-deterministic BA and determinize the BA.This transformation from PA to BA is achieved by a construction which is inspired by Theorems 2 and 3 in [13]; we add the observation that the construction preserves limit-determinism.Definition 10.Given a limit-deterministic PA C = (V, Σ, δ, u 0 , α) with n = |V | and k > 2 priorities, we define the limit-deterministic BA D = (W, Σ, δ ′ , w 0 , F ): and for (v, l) ∈ W and a ∈ Σ, To see that D is limit-deterministic, it suffices by Lemma 3 to show that reach(F ) is deterministic.We observe that for each state (v, l) ∈ reach(F ), l = * so that (v, l) is deterministic by definition of δ ′ since C is limit-deterministic and v is contained in some 2l-compartment in C.

The µ-Calculus
We briefly recall the definition of the µ-calculus.We fix a set P of propositions, a set A of actions, and a set V of fixpoint variables.The set L µ of µ-calculus formulas is the set of all formulas φ, ψ that can be constructed by the grammar where p ∈ P , a ∈ A, and X ∈ V; we write |ψ| for the size of a formula ψ.Throughout the paper, we use η to denote one of the fixpoint operators µ or ν.We refer to formulas of the form ηX. ψ as fixpoint literals, to formulas of the form a ψ or [a]ψ as modal literals, and to p, ¬p as propositional literals.The operators µ and ν bind their variables, inducing a standard notion of free variables in formulas.We refer to a variable that is bound by a least (greatest) fixpoint operator as µ-variable (ν-variable).An occurrence of a µ-or ν-variable X in a formula ψ is an active µ-variable, if it is possible to obtain a formula that contains a free µ-variable by replacing X with its binding fixpoint literal, and repeatedly replacing any resulting new free fixpoint variables with their binding fixpoint literals.We denote the set of free variables of a formula ψ by FV(ψ).A formula ψ is closed if FV(ψ) = ∅, and open otherwise.We write ψ ≤ φ (ψ < φ) to indicate that ψ is a (proper) subformula of φ.We say that φ occurs free in ψ if φ occurs in ψ as a subformula that is not in the scope of any fixpoint operator.Throughout, we restrict to formulas that are guarded, i.e. have at least one modal operator between any occurrence of a variable X and an enclosing binder ηX.(This is standard although possibly not without loss of generality [10].)Moreover we assume w.l.o.g. that input formulas are clean, i.e. all fixpoint variables are distinct, and irredundant, i.e.X ∈ FV(ψ) for all subformulas ηX.ψ.
Formulas are evaluated over Kripke structures K = (W, (R a ) a∈A , π), consisting of a set W of states, a family (R a ) a∈A of relations R a ⊆ W × W , and a valuation π : P → P(W ) of the propositions.Given an interpretation i : V → P(W ) of the fixpoint variables, define [[ψ]] i ⊆ W by the obvious clauses for Boolean operators and propositions, [ , and µ, ν take least and greatest fixpoints of monotone functions, respectively.If ψ is closed, then [[ψ]] i does not depend on i, so we just write [[ψ]].We denote the Fischer-Ladner closure [15] of a formula φ 0 by F(φ 0 ), or just by F, if no confusion arises; intuitively, F is the set of formulas that can arise as subformulas when unfolding each fixpoint operator in φ 0 at most once.We note F ≤ |φ 0 | [15].
The aconjunctive fragment [14] of the µ-calculus is obtained by requiring that for all conjunctions that occur as a subformula, at most one of the conjuncts contains an active µ-variable.In the weakly aconjunctive fragment [23], this requirement is loosened to the constraint that all conjunctions that occur as a subformula and contain an active µ-variable, are of the shape ψ ∧♦ψ 1 ∧. ..∧♦ψ n ∧ (ψ 1 ∨. ..∨ψ n ), where ψ does not contain active µ-variables.For instance, for all n, the formula ηX n . . .µX 1 .νX0 .0≤i≤n (q i ∧ ♦X i ) is both aconjunctive and weakly aconjunctive.The permutation satisfiability games that we introduce work for the more expressive weakly aconjunctive fragment.
We will make use of the standard tableau rules (each consisting of one premise and a possibly empty set of conclusions): (for a ∈ A, p ∈ P ); we refer to the tableau rules by R and usually write rule applications with premise Γ and conclusion Σ = Γ 1 , . . ., Γ n sequentially: (Γ/Σ).
To track fixpoint formulas through pre-tableaux, we will use deferrals, that is, the decomposed form of formulas that are obtained by unfolding fixpoint literals.

Definition 13 (Deferrals). Given fixpoint literals χ
where we write ψ < f ηX.φ if ψ ≤ φ and ψ is open and occurs free in φ (i.e.σ unfolds a nested sequence of fixpoints in χ n innermost-first).We say that a formula χ is irreducible if for every substitution . A formula ψ belongs to an irreducible closed fixpoint literal θ n , or is a θ n -deferral, if ψ = ασ for some substitution σ = [X 1 → θ 1 ]; . . .; [X n → θ n ] that sequentially unfolds θ n and some α < f θ 1 .We denote the set of θ n -deferrals by dfr(θ n ).

Limit-Deterministic Tracking Automata
As a first step towards deciding the satisfiability of a weakly aconjunctive µcalculus formula φ 0 , we now construct a tracking automaton that takes branches of (that is, infinite paths through) standard pre-tableaux for φ 0 as input and accepts a branch if and only if it contains a least fixpoint formula whose satisfaction is deferred indefinitely on that branch.To this end, we import the following notions of threads and tableaux from [10]: Definition 15.A pre-tableau for a formula φ is a graph the nodes of which are labelled with subsets of the Fischer-Ladner closure F(φ); the graph structure L of a pre-tableau is constructed by applying tableau rules from R to the labels of nodes with the requirement that for each rule application (Γ/Σ) to the label Γ of a node v, there is a w with (v, w) ∈ L s.t. the label of w is contained in Σ. Formulas are tracked through rule applications by the connectedness relation ⊆ (P(F) × F) 2 that is defined by putting Φ, φ Ψ, ψ iff Ψ is conclusion of an application of a rule from R to Φ s.t.φ ∈ Φ, ψ ∈ Ψ , and the rule application transforms φ to ψ; if the rule application does not change φ, then φ = ψ.E.g. we have Φ, ψ 1 ∧ ψ 2 Ψ, ψ i , where i ∈ {1, 2} and Ψ is obtained from Φ by applying the rule (∧) to ψ 1 ∧ ψ 2 .A branch Ψ 0 , Ψ 1 . . . in a pre-tableau is a sequence of labels s.t. for all i > 0, Ψ i+1 is conclusion of the application of a tableau rule from R to Ψ i .A thread on an infinite branch Ψ 0 , Ψ 1 , . . . is an infinite sequence of formulas t = ψ 0 , ψ 1 . . .with Ψ 0 , ψ 0 Ψ 1 , ψ 1 . ... A µ-thread is a thread t s.t.min(Inf(al • t)) is odd and s.t.there is a single closed irreducible fixpoint literal χ with Inf(t) ⊆ dfr(χ).A bad branch is an infinite branch that contains a µ-thread; we denote the set of all bad branches in pre-tableaux for φ by BadBranch(φ).A tableau for φ is a pre-tableau for φ that does not contain bad branches.
It is well-known that the existence of tableaux in the sense defined above coincides with the satisfiability of formulas:

Theorem 16 ([10]). A µ-calculus formula ψ is satisfiable if and only if there is a tableau for ψ.
Given a formula φ, we define the alphabet Σ φ to consist of letters that each identify a rule R ∈ R, a principal formula from F(φ) and one of the conclusions of R. E.g. the letter ((∨), 0, p ∨ ♦q) identifies the application of the disjunction rule to a principal formula p ∨ ♦q and the choice of the left conclusion; thus this letter identifies the transition from p ∨ ♦q to p by use of rule (∨).We note As a crucial result, we now show that limit-deterministic automata are expressive enough to exactly recognize the bad branches in pre-tableaux for weakly aconjunctive formulas.Lemma 17.Let φ 0 be a weakly aconjunctive formula.Then there is a limitdeterministic PA A = (V, Σ φ0 , δ, φ 0 , α) with |V | ≤ |φ 0 | and idx(A) ≤ ad(φ 0 ) + 1 s.t.L(A) = BadBranch(φ 0 ).

Proof (Sketch).
The automaton nondeterministically guesses formulas to be tracked through pre-tableaux, one at a time; the set of states of the automaton is the Fischer-Ladner closure of φ 0 .The priorities of the states in the automaton are derived from the alternation level of the respective formula.Once a deferral is tracked, the weak aconjunctivity of fixpoint arguments implies that the compartment for the tracked formula is internally deterministic, since for conjunctions ψ = ψ 0 ∧ ♦ψ 1 ∧ . . .∧ ♦ψ n ∧ (ψ 1 ∨ . . .∨ ψ n ) -the only case that can introduce nondeterminism -each next modal step determines just one of the formulas ψ i that has to be tracked; the conjunct ψ 0 does not contain active µ-variables, so tracking it leads the automaton to leave the al(ψ)-compartment of ψ.Thus the automaton is limit-deterministic.
⊓ ⊔ Example 18.We consider the aconjunctive formula and observe that we have the φ-deferrals φǫ, ψ : We consider a pre-tableau P φ for φ and like in the proof of Lemma 17, we construct the limit-deterministic tracking automaton A φ , depicted below: As ad(φ) = 2 is even, we put k = ad(φ) All other formulas have alternation level 2 and obtain priority 1 in the tracking automaton.As expected, the tracking automaton accepts exactly those branches in P φ that start at node 1 and take the loop through node 9 infinitely often; in these branches, φ can be tracked forever and evolves to φ infinitely often, i.e. their dominating formula is the least fixpoint formula φ.All other branches loop through node 7 without passing node 9 from some point on; their dominating fixpoint formula is θ, a greatest fixpoint formula.We observe that due to the aconjunctivity of φ, A φ is limit-deterministic since the only two nondeterministic states ψ and ς each have only one successor with priority less than k = 3.
Given a weakly aconjunctive formula φ, we use Lemma 17 to construct a limitdeterministic tracking automaton A φ with L(A φ ) = BadBranch(φ) and then put Lemma , where U is a set of non-deferral formulas and l is a partial permutation of levelled deferrals, i.e. pairs (φ, q) consisting of a deferral φ and an odd number q, the level of the pair (φ, q); the level results from the transformation of A φ to a Büchi automaton during the construction of B φ .If p = 2(n − a) + 1, then a is the lowest number s.t.al(φ) = q, where l(a) = (φ, q) (i.e.p references the oldest currently active levelled deferral in l) and if p = 2(n − r) + 2, then p references the index of the oldest levelled deferral (φ, q) that has been finished (i.e. has been removed from l) in the latest transition of the automaton B φ which means that the latest read letter made φ leave its qcompartment in A φ .For a state v = (U, l, p) of C φ , we let Γ (l) = {ψ | (ψ, q) ∈ l} denote the set of deferrals that occur (with some level q) in l; furthermore, we define the label Γ (v) of v as Γ (v) = U ∪ Γ (l).

Permutation Games
The automaton C φ can now be combined with applications of tableau rules from R to form a satisfiability game for φ.We progress by defining parity games and some ensuing basic notions.A parity game is a graph G = (V, E, α) that consists of a set of nodes V , a set of edges E ⊆ V × V and a priority function α : V → N.
We assume

won by
Eloise iff ρ is finite and ends in a node that belongs to Abelard or ρ is infinite and max(Inf(α•ρ)) is even (again, we use ρ as a function with ρ(i) = v i ); Abelard wins a play ρ iff Eloise does not win ρ.A (memoryless) strategy s : V → V assigns moves to states.A play ρ conforms to a strategy s if for all ρ(i) ∈ dom(s), Eloise has a winning strategy for a node v if there is a strategy s : V ∃ → V s.t.every play of G that starts at v and conforms to s is won by Eloise; we have a dual notion of winning strategies for Abelard.The winning regions win ∃ (G) and win ∀ (G) are the sets of those nodes for which Eloise and Abelard have winning strategies, respectively.Solving a parity game G (locally) for a particular node v ∈ V amounts to computing the winner of v. Now we are ready to define permutation games for weakly aconjunctive formulas φ, using the DPA C φ = (W, Σ φ , δ, φ, α) from the previous section.

Definition 19 (Permutation games).
Let φ be a weakly aconjunctive formula.We define the permutation game G(φ) = (W, E, α) to be a parity game that has the carrier of C φ as set of nodes and uses the same priority function as C φ .For every node v ∈ W for which Γ (v) is not a state (i.e.contains top-level propositional operators), we fix a single rule that is to be applied to Γ (v) and a single principal formula ψ v ∈ Γ (v) to which the rule is to be applied.If (∨) is to be applied to Γ (v), then we put v ∈ W ∃ ; otherwise, v ∈ W ∀ ; in particular, all state nodes are contained in W ∀ .It remains to define E. For v ∈ W , we put E(v) = {δ(v, a) | a ∈ Σ v }, where Σ v ⊆ Σ φ consists of all letters a that encode the application of some rule to Γ (v) with the condition that the principal formula of the rule application must be ψ v if v is not a state node.

⊓ ⊔
Due to the relatively simple structure and the asymptotically smaller size of the determinized automata C φ , the resulting permutation games are somewhat easier to construct and can be solved asymptotically faster than the structures created by standard satisfiability decision procedures for the full µ-calculus (e.g.[10,5]) which employ the full Safra/Piterman-construction; note however, that our method is restricted to the weakly aconjunctive fragment.
Corollary 21.The satisfiability of weakly aconjunctive µ-calculus formulas can be decided by solving parity games of size O((nk + 2)!) and O(nk) priorities.
The winning strategies for Eloise or Abelard in these games define models for or refutations of the respective formulas, so that we have Corollary 22. Satisfiable weakly aconjunctive µ-calculus formulas have models of size O((nk + 2)!).

Implementation and Benchmarking
We have implemented the permutation satisfiability games as an extension of the Coalgebraic Ontology Logic Reasoner (COOL) [11], a generic reasoner for coalgebraic modal logics1 .COOL achieves its genericity by instantiating an abstract reasoner that works for all coalgebraic logics to concrete instances of logics; to incorporate support for the aconjunctive coalgebraic µ-calculus, we have extended the global caching algorithm that forms the core of COOL to generate and solve the corresponding permutation games, with optional on-the-fly solving; games are solved using either our own implementation of the fixpoint iteration algorithm for parity games (as in [1]) or PGSolver [8], which supports a range of game solving algorithms.Instance logics implemented in COOL currently include linear-time, relational, monotone, and alternating-time logics, as well as any logics that arise as combinations thereof.In particular, this makes COOL, to our knowledge, the only implemented reasoner for the aconjunctive fragments of the alternating-time µ-calculus and Parikh's game logic.
Although our tool supports the aconjunctive coalgebraic µ-calculus, we concentrate on the standard relational aconjunctive µ-calculus for experiments, as this allows us to compare our implementation with the reasoner MLSolver [9], which constructs satisfiability games using the Safra/Piterman-construction and hence supports the full relational µ-calculus; MLSolver uses PGSolver for game solving.
To test the implementations, we devise two series of hard aconjunctive formulas with deep alternating nesting of fixpoints.The following formulas encode that each reachable state in a Kripke structure has one of n priorities (encoded by atoms q i for 1 ≤ i ≤ n) and belongs to either Eloise (q e ) or Abelard (q a ): Here we use AG ψ to abbreviate νX.(ψ ∧ X).Then the non-emptyness regions in parity automata and Eloise's winning region in parity games can be specified by the following aconjunctive formulas (where ♥ ∈ {♦, }): Furthermore, we define (for ♥ ∈ {♦, }) The following series of valid formulas states that parity automata with n priorities can be transformed to nondeterministic parity automata with three priorities without affecting the non-emptyness region: Similarly, winning strategies in parity games with n priorities guarantee that in each play, each odd priority 1 ≤ i ≤ n is visited only finitely often, unless a priority greater than i is visited infinitely often (the converse does not hold in general [4]):  Additionally, we devise two series of unsatisfiable formulas that exhibit the advantages of COOL's global gaching and on-the-fly-solving capabilities.These formulas are inspired by the CTL-formula series early(n, j, k) and early gc (n, j, k) from [12] but contain fixpoint-alternation of depth 2 k inside the subformula θ:  where c(x, m) encodes an m-bit counter using atoms x 0 , . . ., x m−1 and bin(r, i) denotes the binary encoding of the number i using atoms r 0 , . . ., r k−1 .The formulas early-ac(n, j, k) specify a loop p of length 2 n that branches after j steps to a second loop r of length 2 k on which the highest value of the counter (which counts from 0 to 2 k − 1 and then restarts at 0) is required to be an even number.For constant k, the contradiction on loop r yields a sub-exponential refutation which can be found early, using on-the-fly solving.The formulas early-ac gc (n, j, k) extend this specification by stating that a third loop q of length 2 n is started from loop p infinitely often.Procedures with sufficient caching capabilities will have to (partially) explore this loop at most once.We compare the runtimes of MLSolver and COOL on the formulas described above (with favourable results for COOL); for the series θ 1 (n) and θ 2 (n), we let both reasoners solve games using the local strategy improvement algorithm stratimprloc2 provided by PGSolver.For the early-ac and the early-ac gc formulas however, we allowed COOL to use our own implementation of the fixpoint iteration algorithm to solve the games; for COOL, we have conducted all experiments with and without on-the-fly solving.For MLSolver, we enabled the optimizations -opt litpro and -opt comp.Tests have been run on a system with Intel Core i7 3.60GHz CPU with 16GB RAM.

Conclusion
We have presented a method to obtain satisfiability games for the weakly aconjunctive µ-calculus.The game construction uses determinization of limit-deterministic parity automata, avoiding the full complexity of the Safra/Piterman construction a) in the presentation of the procedure and its correctness proof and b) in the size of the obtained DPA (which comes from O((nk)! 2 ) to O((nk + 2)!)).The resulting permutation satisfiability games for the weakly aconjunctive µ-calculus are of size O((nk+2)!), have O(nk) priorities, and yield a new bound of O((nk + 2)!) on the model size for this fragment.We have implemented this decision procedure in coalgebraic generality and with support for on-the-fly solving as part of the coalgebraic satisfiability solver COOL; initial experiments show favourable results.run ρ ∈ run(A, l(q), post(w, i)).We note ρ ⊆ Q.Since the q-th position in l is stationary but active infinitely often, Inf(ρ) contains at least one state from F (notice that a position in l is active iff the corresponding state is contained in F ). Observe that κ; ρ ∈ run(A, w) is an accepting run of A.

Full Proof of Lemma 17
The automaton nondeterministically guesses formulas to be tracked through pretableaux, one at a time; the set of states of the automaton is the Fischer-Ladner closure of φ 0 .The priorities of the states in the automaton are derived from the alternation level of the respective formula.Once a deferral is tracked, the weak aconjunctivity of fixpoint arguments implies that the compartment for the tracked formula is internally deterministic, since for conjunctions ψ = ψ 0 ∧♦ψ 1 ∧ . . .∧ ♦ψ n ∧ (ψ 1 ∨ . . .∨ ψ n ) -the only case that can introduce nondeterminism -each next modal step determines just one of the formulas ψ i that has to be tracked; the conjunct ψ 0 does not contain active µ-variables, so tracking it leads the automaton to leave the al(ψ)-compartment of ψ.Thus the automaton is limitdeterministic.In detail, we put V = F(φ) and recall that any letter from Σ φ identifies a rule application and a conclusionary formula of the rule application.
If ad(φ) is odd, then put k = ad(φ), otherwise put k = ad(φ) + 1; then k is odd.The priority function α is defined as α(ψ) = k − al(ψ), for ψ ∈ F. The bounds on the size and index of A follow.For ψ ∈ F, a = (R, i, φ) ∈ Σ φ , we put δ(ψ, a) = {ψ} if φ = ψ and δ(ψ, a) = R(ψ, i) if φ = ψ.Here, R({ψ}, i) denotes the set of formulas that ψ changes to when rule R is being applied to it and the i-th conclusion is selected.Since φ is weakly aconjunctive, all conclusions of rule applications to deferrals contain at most one deferral, in particular, for a deferral ψ = ψ 0 ∧ ♦ψ 1 ∧ . . .∧ ♦ψ n ∧ (ψ 1 ∨ . . .∨ ψ n ) with al(ψ) = l, ((∧), ψ, 0) = {ψ 0 , ♦ψ 1 ∧ . . .∧ ♦ψ n ∧ (ψ 1 ∨ . . .∨ ψ n )}; between this rule application and the next application of modal rules, we consider θ = ♦ψ 1 ∧. ..∧♦ψ n ∧ (ψ 1 ∨. ..∨ψ n ) to be a single compound formula to which no more propositional rules can be applied.Upon the next application of modal rules, each application of a modal rule chooses just one of the ψ i which needs to be tracked; thus we have that for all a ∈ Σ φ , |δ(θ, a)| ∩ α(l) ≤ 1 and since ψ 0 contains no active µ-variables and hence al(ψ 0 ) < l, |δ(ψ, a)|∩α(l) ≤ 1.Thus A indeed is limit-deterministic.We also have L(A) = BadBranch(φ): To see L(A) ⊇ BadBranch(φ), we show that A accepts every bad branch in a pre-tableau for φ.We know that every bad branch induces the list w ∈ Σ ω φ of rule applications and selections of conclusions that encode the branch.Since the branch contains a µ-thread, the automaton can guess the corresponding formula and follow the single deferral through the thread; this defines a limit deterministic run ρ ∈ run(A, w).To see that ρ is accepting, it remains to show that Inf(α • ρ) is even.This follows since the tracked thread is a µ-thread, i.e. we have a formula ψ with odd alternation level l s.t.ψ occurs infinitely often in the thread and no formula with lower alternation level than l occurs.As both k and l are odd, Inf(α • ρ) = k − l is even, as required.For the converse direction, we have to show that every word that is accepted by the automaton encodes a bad branch.So let w ∈ L(A); then there is a limitdeterministic accepting run ρ ∈ run(A, w); hence there is some i s.t. for all j > i, we have α(ρ(j)) < k and δ(ρ(j), w(j)) ∩ α(k) = {ρ(j + 1)}.We observe that ρ(i) is a deferral that can be tracked through the branch w forever.Since ρ is accepting, there is a numbers m s.t.this deferral evolves to formulas ρ(j ′ ) with al(ρ(j ′ )) = 2m + 1, j ′ > j infinitely often but never evolves to a formula ρ(j ′ ) with al(ρ(j ′ )) > 2m + 1, j ′ > j.Thus w contains a µ-thread.

Lemma 11 .
We have L(C) = L(D) and |W | ≤ n( k 2 + 1) ≤ nk.By Theorem 7, D can be determinized to a DPA E of size at most e(nk + 2)!, of index at most 2nk + 1 and with L(D) = L(E).Corollary 12. Limit-deterministic parity automata of size n with k priorities can be determinized to deterministic parity automata of size O((nk + 2)!) and with O(nk) priorities.