Vacuity in synthesis

In reactive synthesis, one begins with a temporal specification φ\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varphi $$\end{document}, and automatically synthesizes a system M\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$M$$\end{document} such that M⊧φ\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$M\models \varphi $$\end{document}. As many systems can satisfy a given specification, it is natural to seek ways to force the synthesis tool to synthesize systems that are of a higher quality, in some well-defined sense. In this article we focus on a well-known measure of the way in which a system satisfies its specification, namely vacuity. Our conjecture is that if the synthesized system M satisfies φ\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varphi $$\end{document}non-vacuously, then M is likely to be closer to the user’s intent, because it satisfies φ\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varphi $$\end{document} in a more “meaningful” way. Narrowing the gap between the formal specification and the designer’s intent in this way, automatically, is the topic of this article. Specifically, we propose a bounded synthesis method for achieving this goal. The notion of vacuity as defined in the context of model checking, however, is not necessarily refined enough for the purpose of synthesis. Hence, even when the synthesized system is technically non-vacuous, there are yet more interesting (equivalently, less vacuous) systems, and we would like to be able to synthesize them. To that end, we cope with the problem of synthesizing a system that is as non-vacuous as possible, given that the set of interesting behaviours with respect to a given specification induce a partial order on transition systems. On the theoretical side we show examples of specifications for which there is a single maximal element in the partial order (i.e., the most interesting system), a set of equivalent maximal elements, or a number of incomparable maximal elements. We also show examples of specifications that induce infinite chains of increasingly interesting systems. These results have implications on how non-vacuous the synthesized system can be. We implemented the new procedure in our synthesis tool PARTY. For this purpose we added to it the capability to synthesize a system based on a property which is a conjunction of universal and existential LTL formulas.


Introduction
Given a temporal specification ϕ, the goal of reactive synthesis [9,17] is to build a transition system M such that M | ϕ. The motivation of synthesis is clear: rather than building a design and then checking whether it adheres to the specification, focus on the specification alone, and generate automatically a design that satisfies it. In recent years, the theory and especially the tools for synthesis have made significant progress [11].
As many systems can satisfy a given specification, it is natural to seek ways to force the synthesis tool to synthesize systems that are of a higher quality, in some well-defined sense. In this article we focus on a well-known measure of the way in which a system satisfies its specification, namely vacuity [2]. It is a standard concept in model-checking, for detecting errors in the specification itself, the model, or both. So far it has not been used in the context of synthesis, however. Our conjecture is that if the synthesized system M satisfies ϕ nonvacuously, then M is likely to be closer to the user's intent, because it satisfies ϕ in a more "meaningful" way. Narrowing the gap between the formal specification and the designer's intent in this way, automatically, is the topic of this article.
Consider, for example, the property A system M with one state satisfying grant (regardless of req) satisfies ϕ, and is indeed a legitimate outcome of synthesising (1). However, M also satisfies stronger properties such as GFgrant. When a system satisfies a property regardless of some of its subformulas, as in this example where the behavior of req is immaterial for the satisfaction of ϕ, the specification is said to be satisfied vacuously (see below a formal definition).
It is not likely that M captures the user's intent: the intent is probably that the system also permits a path π in which there are no grants from a point in which there are no requests. Such a path is called an interesting witness [2]: it is an execution that demonstrates non-vacuous satisfaction of the original property. However, the requirement that there exists an interesting witness cannot be expressed in LTL, since it implicitly relies on an existential quantifier.
Previous work addressing the lack of expressibility of LTL in specifying high-quality systems suggested the extension to quantitative specifications, in order to make it easier to specify certain properties [4], and to be able to synthesize systems that are robust against environment errors, even if the way to react to such errors has not been specified explicitly [3,18].
There are multiple definitions of vacuity in the literature [1,2,6,7,14,15]; the vast majority of them is based on the concept of strengthening the specification by changing a part of it and checking whether the strengthened version is still satisfied in the system; if not, then the system is considered to satisfy the specification non-vacuously. While the general method that we will describe in this paper is orthogonal to the chosen definition as long as the analysed formulas are still in LTL, for ease of exposition we will choose one definition and use it throughout the paper. Most commercially used vacuity-detection tools use the generalised definition by Kupferman and Vardi [14], which is what we will follow here: Let ψ be a subformula in ϕ. The strengthening of ϕ with respect to ψ is ϕ[ψ ← ⊥]. 1 If M | ϕ[ψ ← ⊥] then ψ is irrelevant for the satisfaction of ϕ in M, and we say that ϕ is satisfied in M vacuously with respect to ψ. It follows that M satisfies ϕ non-vacuously with respect to ψ iff M | E¬ϕ[ψ ← ⊥]. As shown in [14], it is sufficient to consider strengthenings of ϕ with respect to atomic propositions (literals, in fact) rather than all subformulas. We note that the definitions of vacuity in the literature, including [14], did not consider the division of the atomic propositions into inputs and outputs, as such division is immaterial in model-checking. As we argue later, in synthesis this division is in fact important.
Our synthesis method requires systems with at least one interesting witness for every possible strengthening of ϕ. More formally, if ϕ is a specification in LTL, a model M satisfies ϕ non vacuously if it satisfies a formula in a simple fragment of CTL * consisting of a conjunction of universal and existential formulas: where Lit (ϕ) denotes the literals of ϕ. One of the contributions of this article is the extension of the bounded synthesis [10] algorithm to handle this fragment, based on a new ranking function (the original bounded synthesis algorithm handles only universal formulas). Even when the system satisfies the specification non-vacuously, our tool is capable of improving it by synthesizing a system that has additional interesting witnesses. The users decides when the system reflects their intent. In Sect. 3 we define a partial order of vacuity on transition systems, stating that system M is less vacuous than M if it contains all of the interesting witnesses permitted by M and at least one more. This condition can be stated as a formula in the same fragment of CTL * mentioned above. We describe a synthesis procedure for generating increasingly non-vacuous systems for a given number of states.
In Sect. 4, we revisit the partial order of vacuity and prove that this partial order can be mapped to a partial order on subsets of input traces. This allows us to formally introduce the concept of equivalent systems w.r.t. their degree of vacuity and discuss cases where there is a single top element to the partial order of vacuity, multiple equivalent top elements, or multiple incomparable top elements. This is also the main addition to the paper compared to its conference version [5].
We have implemented the non-vacuous bounded synthesis algorithm on top of the PARTY synthesizer [13], which is available for download. 2 Given the informal goal we stated ("capturing the user's intent") naturally it is difficult to prove that our approach works, especially since there are no users in the industry that specify real system for the purpose of synthesis. Our experiments were based, then, on starting from previously published complete specifications, removing parts of them, and activating non-vacuous synthesis. In our experiments, which we describe in Sect. 5, the removed parts of the specification were compensated by our tool. In fact, the generated models not only satisfy the original, complete specifications, but they also realize them less vacuously.

Motivating example
The following example will be used in the rest of the article as a running example. It is a specification of an arbiter with two types of requests and two types of grants (i. e., ϕ 1 and ϕ 2 ) and a mutual exclusion between the grants (i. e., ϕ 3 ). The specification ϕ is a conjunction of the following three properties: where r 1 and r 2 are inputs (the 'requests') and g 1 and g 2 are outputs (the 'grants'). The smallest system M 0 satisfying ϕ, synthesised by our tool, is depicted in Fig. 1a. It consists of (a) (b) Fig. 1 Systems of the running example two states, s 0 and s 1 , where in each state exactly one of the grants is up. It is easy to see that M 0 satisfies ϕ vacuously. In particular where the ⊥ value for r 1 and r 2 is true in both ϕ 1 and ϕ 2 , respectively. The system generated by our tool in the next step is M 1 , depicted in Fig. 1b. 3 This system satisfies ϕ non-vacuously in all its subformulas. Indeed: , as the path π 1 = s ω 0 corresponding to the output trace {¬g 1 , g 2 } ω falsifies GFg 1 ; 2. M 1 | ϕ 2 [r 2 ← ⊥], as the path π 2 = s 0 s ω 1 corresponding to the output trace {¬g 1 , g 2 }, {g 1 , ¬g 2 } ω falsifies GFg 2 ; 3. The formulas obtained by replacing one of the grants with false are unrealisable, i. e., there is no system that can satisfy, for example, G(¬r 1 ), because we have no control over the inputs.

Labeled transition systems
For the remainder of the paper, let us fix an input alphabet I and a disjoint output alphabet O, and let us define AP = I ∪ O, ϒ = P(I ), = P(O), and = P(AP).

Definition 1 (Labeled Transition System)
A finite, -labeled ϒ-transition system is a tuple M = (S, s 0 , τ, o), where S is nonempty set of states, s 0 ∈ S is the initial state, τ : S ×ϒ → S is a transition function, and o : S → is a labelling function.

Definition 2 (An LTS word)
A word p of a labeled transition system M, is a sequence Definition 3 (Path) A path of a word p is the sequence of states induced by p.
Definition 4 (Trace) A trace of a word p is the sequence of input/output pairs induced by p.

Temporal logic
Throughout the paper, we denote by ϕ an LTL formula in negation normal form (NNF), over the set AP of atomic propositions [16]. The semantics of LTL is defined over AP with respect to infinite paths of M in a standard way. In this paper, we synthesize systems that satisfy the following simple fragment of CTL * : where ϕ is an LTL formula. The semantics of the universal and existential quantifiers over LTL formulas are defined as expected: So far we denoted by traces (M) the set of traces of M, where a trace corresponds to a run, which in itself must start from an initial state of M (see Definition 2 and 4). We similarly use traces (M, s) to refer to runs that begin at an arbitrary state s ∈ S of M.

Definition 6
For a state s of a transition system M, A transition system M satisfies a formula ϕ, written M | ϕ, if all its initial states do.

Nondeterministic Büchi automata
An LTL formula can be represented by a nondeterministic Büchi automaton [19]: a tuple A = (Q, q 0 , ρ, α), where Q is a finite set of states, q 0 ∈ Q is the initial state, ρ : Q × ϒ × → P(Q) is the transition relation, and α is the set of accepting states; recall and ϒ are defined in Sect. 2.1.

Definition 8 (Accepting run)
An accepting run of A is a run that visits some accepting state infinitely often; a trace is accepted by A if it has a corresponding accepting run, and the language of A is the set of all accepted traces.
From this point forward, we denote by A ϕ the nondeterministic Büchi automata that accepts exactly the traces that satisfy ϕ.

Vacuity detection
Informally speaking, a transition system M satisfies a property ϕ vacuously if not all parts of ϕ are instrumental for the satisfaction of ϕ in M (in other words, M satisfies ϕ in an uninteresting way). As proved in [14], it is sufficient to check vacuity with respect to atomic propositions of ϕ, which, in case of an atomic proposition p appearing in ϕ in a pure polarity, amounts to model-checking ϕ[ p ← ⊥], that is, ϕ where p is replaced with its bottom value.
Hence, we use the following definition of vacuity that allows for efficient detection algorithm: Definition 9 (Vacuity [2,14]) A transition system M satisfies an LTL property ϕ vacuously iff M | ϕ and there exists a literal ψ of ϕ which is of pure polarity and M | ϕ[ψ ← ⊥].
The formula ϕ[ψ ← ⊥] is a strengthening of ϕ since ϕ[ψ ← ⊥] ⇒ ϕ and we call the negation ϕ ψ = ¬ϕ[ψ ← ⊥] of a strengthening a witness formula. A trace π of M that satisfies ϕ ψ is called an interesting witness for ψ, since it demonstrates that ψ is instrumental to the satisfaction of ϕ in M; π is an interesting witness of M if it is an interesting witness for The concept of witnesses and strengthenings is not restricted to Definition 9, and it lends itself, in theory, to other definitions of vacuity [1,7,8]. The framework proposed in this paper is orthogonal to the particular definition of vacuity, as long as the strengthenings are ω-regular.

Bounded synthesis
Bounded synthesis is a method to construct a finite-state labeled transition system that not only satisfies a given temporal specification ϕ, but also fulfills a constraint on its size [10]. The idea is to let an SMT solver synthesize a transition system M (i.e., choose the transitions and the labeling of the states), such that M × A ¬ϕ has an empty language.
The synchronous product G of a transition system M = (S, s 0 , τ, o) and a Büchi automaton 4 The states of G are annotated with two functions: a reachability function λ B : Q × S → B and a ranking function λ # : Annotations of G (i. e., λ # and λ B functions) are valid if they satisfy the following constraints. First, the initial state is reachable: Second, the reachability predicate and the transition system are compatible: Finally, the ranking function guarantees that the constraint is satisfiable only if the language of the run graph is empty: For accepting states, we require that the labelling on the target state is strictly larger than on the source (accepting) state: and for non-accepting states the labelling on the target states is larger or equal than on the source state: 2 We can assign a number to each state on the left automaton, that satisfies the inequality constraints, e.g., the 0/1 values labeling the states. Such a labeling is impossible for the automaton on the right, because it has an accepting state in a loop The intuition behind the ranking function is as follows: if the language is not empty, then there is an accepting path (i.e., a lasso-shaped path in the product automaton that includes an accepting state), and then it is impossible to satisfy these constraints over that path. This is because the ranks of states on the cycle cannot be strictly descending. The two automata in Fig. 2 illustrate this point-see caption. Hence, (5)- (8) are satisfiable if and only if the language of the product automaton is empty. The correctness of this construction was proven in [10]. Initially, the LTL specification ϕ is negated and translated to a Büchi automaton A ¬ϕ . In the next step, (5)-(8) are solved with an SMT solver based on A ¬ϕ . Being unknown, τ , λ B , λ # and o (the labeling function) are represented by uninterpreted functions; thus, the quest for finding M is reduced to the problem of satisfiability modulo finite integer arithmetic with uninterpreted functions, which is an NP-complete problem.

Non-vacuous bounded synthesis
In this section we describe non-vacuous bounded synthesis-our method for constructing a finite-state labeled transition system that fulfils a constraint on its size and satisfies a given temporal specification non-vacuously.

A specification for non-vacuous satisfaction
A specification ϕ is satisfied non-vacuously in M if and only if M contains a witness for each strengthening of ϕ. In other words, as we stated earlier in (2), (note that (9) is based on our choice of definition for vacuity-see 9). We call ϕ ψ = ¬ϕ[ψ ← ⊥] the witness formulas for non-vacuity of ϕ with respect to ψ. Note that not all witness formulas add usable information. For instance, for ϕ as defined in (3), the witness formula ϕ g 1 (i. e., ¬ϕ 1 [g 1 ← ⊥] = Fr 1 ) is clearly satisfied by a trace of any system, and the same holds for any satisfiable witness formula that contains only input signals.
We continue in the next subsection by showing how existentially-quantified formulas can be synthesized. Then, we can use this technique to synthesise formulas of the form defined in (9). On the left there is no accepting run, and indeed there is no ranking function that can satisfy the constraints. On the right there is an accepting run (the λ * predicate is marked with '*'), and the fact that there is no constraint on the outgoing edge of the accepting state allows to find a ranking function, namely the numbers 0,1,2,3,4,5 that are marked inside the states

Bounded synthesis for existential formulas
Our goal is to synthesize a finite-state labeled transition system with a bound on its size, in which there exists an execution path that satisfies a given temporal specification ϕ. We will define a set of constraints that is different than the case described in Sect. 2.5 to achieve this. Initially, we translate ϕ to a nondeterministic Büchi automaton A ϕ and create the run graph G of A ϕ on M. Then, we use a Boolean marking function λ * : Q × S → B to indicate that a state is on our selected path in G. On that selected path, we impose a ranking function that can only be satisfied if it corresponds to an accepting run.
First, the initial state is marked: Next, if a non-accepting state is marked, then at least one of its successors is marked, and the ranking of the destination state is strictly smaller: On the other hand if an accepting state is marked, then we only require that one of its successors is marked (but in contrast to the previous case, here there is no restriction on the ranking of its successor): The two automata in Fig. 3 illustrate our construction-see caption. The following theorem states that these constraints are correct. A = (Q, q 0 , ρ, α) constructed from a formula ϕ , a transition system M = (S, s 0 , τ, o) satisfies Eϕ iff it corresponds to a solution to constraints (10)- (12).

Proof (⇒)
There is a unique run graph G = (G, E) for A on M. Assume M is accepted by A; therefore, G contains at least one lasso-shaped path π = (q 0 , s 0 )(q 1 , s 1 ) . . . [(q n , s n ) . . . (q m , s m )] ω such that q i is accepting for some i ∈ [n, m]. We have to show that in such a case (10)- (12) are satisfiable. Marking all the states on the path clearly satisfies (10), and the λ * predicate is true along this path as required by constraints (11) and (12). It is left to show that there exists a ranking function that satisfies (11). Indeed the following function, which annotates each state on π by its distance to q i , is a valid ranking function: all ((q j , s j )(q k , s k )) ∈ π, unless j = i. Recall that only non-accepting states are bound by constraint (11). The figure below demonstrates this ranking for n = 3, m = 6, and i = 5.
(⇐) Assume that (10)-(12) are satisfiable. The set of marked states must include a lassoshaped path beginning from the initial state, and the fact that (11) is satisfied means that there exists an accepting state in the loop. Hence the run graph must contain an accepting path.
Finally, synthesising a non-vacuous system-a system that satisfies (2)-amounts to solving the conjunction of the constraints that were described in Sect. 2.5 (for the universal part), and the constraints in Sect. 3.2 for each ψ ∈ Lit (ϕ) (for the existential part). A separate discrete ranking function is required for ϕ and each of its witness formulas. We note that the addition of (10)- (12) to the bounded synthesis formula, does not change the asymptotic complexity of the problem.

Beyond vacuity
In the introduction we argued that non-vacuous systems are preferable to vacuous systems because they are more likely to fulfill the designer's intent. This guarantees that for specifications like ϕ = G(r → Fg), there will be at least one path on which GFg does not hold. Intuitively, this corresponds to the idea that an input r should trigger the output g. However, the definition of vacuity is somewhat too coarse for our purpose. We need a more refined notion, which will enable us to distinguish between non-systems that are non-vacuous. In the following subsection we introduce a partial order between systems realizing a given specification. We consider a system A strictly less vacuous (or, equivalently, more interesting) than another system B if the set of interesting witnesses in A properly contains the set of interesting witnesses in B. For the property above, for example, this corresponds to additional witnesses to ¬GFg, i.e., additional traces in which g does not occur without first being 'triggered' by r . For some specifications, there exist least vacuous systems, that is, maximal systems in the partial order of vacuity. In Sect. 4.2, however, we show that for some other specifications the partial order gives rise to infinite vacuity chains, i.e., infinite chains of ever less vacuous systems.
In Sect. 4.3 we show that given a system, we can use a variant of bounded synthesis to synthesize a less vacuous one, which naturally leads to a most interesting (least-vacuous) system of a given size, when such a system exists. Finally, in Sect. 4.4, we show that for our running example there exists such a least-vacuous system.

Partial order on non-vacuous systems
Let M 1 and M 2 be transition systems that satisfy ϕ. Given a witness formula ϕ ψ , we define a relation M 1 ψ M 2 to indicate that M 2 has at least the same set of interesting witnesses according to ϕ ψ as M 1 . Formally, given a specification ϕ and a witness formula ϕ ψ of ϕ, we define We say that M 2 is strictly less vacuous than M 1 if in addition there is at least one input sequence that leads to an interesting witness only in M 2 : If M 1 ψ M 2 and M 2 ψ M 1 , we say that M 1 and M 2 are equivalent in the partial order of vacuity with respect to ψ, denoted M 1 ≡ ψ M 2 .
By extending the relation ≺ ψ to the set of all witness formulas, we can compare two transition systems in terms of vacuity. Let be the set of all witness formulas for ϕ. We define the partial order ϕ as and the strict partial order ≺ ϕ as In other words, M 2 is at least as non-vacuous as M 1 w.r.t. all possible witnesses and is strictly less vacuous than M 1 w.r.t. at least one witness formula. Similarly to the above, we say that M 1 is equivalent to M 2 in the partial order of vacuity, denoted M 1 ≡ ϕ M 2 , if M 1 ϕ M 2 and M 2 ϕ M 1 .
Since there is a finite number of transition systems of any size N , for a given LTL formula ϕ, there exists at least one least vacuous system M ϕ N of size N , according to ≺, assuming that ϕ is realizable by a system with N states. This system may not be unique. Moreover, if there are several least-vacuous systems of size N , they can be equivalent or incomparable.
It is easier to reason about equivalent and incomparable systems if we re-define the partial order on systems as follows. We can view the above partial order on systems realizing ϕ as a partial order on subsets of the (infinite) set of all input traces V = {υ : υ ∈ ϒ ω }. A system M realizing ϕ can be mapped to the set of input traces V (M, ϕ) that induce interesting witness traces in M with respect to some subformula of ϕ. We can similarly denote by V (M, ϕ ψ ) the set of input traces that induce interesting witness traces in M with respect to a particular witness formula ϕ ψ . Then, it is easy to see that (13) is equivalent to and the strict inequality holds if the set V (M 1 , ϕ ψ ) is a strict subset of V (M 2 , ϕ ψ ). Also, Similarly, (15) can be rewritten as and the strict inequality holds if the set V (M 1 , ϕ ψ ) is a strict subset of V (M 2 , ϕ ψ ) for some ϕ ψ ∈ . Two systems M 1 and M 2 realizing ϕ are equivalent with respect to ϕ (i.e., M 1 ≡ ϕ M 2 ) if and only if the following holds: Finally, if M 1 ϕ M 2 and M 2 ϕ M 1 , we say that M 1 and M 2 are incomparable.
The following theorem clarifies the difference between incomparable and equivalent leastvacuous systems using (18) and (19).

Theorem 3 The following claims hold for any LTL formula ϕ.
(a) If there exists a system M max realizing ϕ such that  (18), for any other M realizing ϕ, we have M ϕ M max , hence M max is a least-vacuous system realizing ϕ. Now assume that there is another system M that is a least-vacuous system realizing ϕ.
(as M is one of the systems in the union), hence M ϕ M max . Therefore, M and M max are not incomparable. Since M is least vacuous, it also holds that M M max , and hence they are equivalent in the vacuity preorder. (b) Assume that there is no system that satisfies (20) and let M 1 be a least-vacuous system realizing ϕ (if there is no such M 1 , then there is an infinite vacuity chain, and the claim holds trivially). In particular, since M 1 does not satisfy (20), we have for at least one witness formula ϕ ψ of ϕ. Consider an input trace Assume that there exists M 2 realizing ϕ that contains an interesting witness trace for ϕ ψ induced by υ. By construction, M 1 and M 2 are incomparable. Hence, either M 2 is also a least-vacuous system, which is incomparable to M 1 (which concludes the proof), or there exists another system M 3 such that M 2 ≺ ϕ M 3 and M 3 is a least-vacuous system realizing ϕ (recall that we assumed that there are no infinite vacuity chains). Then, M 1 and M 3 are two incomparable least-vacuous systems realizing ϕ.
The following examples illustrate the notion of least-vacuous systems. Example 1 shows a specification for which there exist two equivalent least-vacuous systems. Example 2 and the example in "Appendix 1" show specifications for which there are two incomparable least-vacuous systems.

Example 1 [Equivalent least-vacuous systems]
Consider the following specification: where the sole interesting witness formula is ϕ r = FG(¬g). Figure 4 demonstrates two systems of size 2 realizing ϕ. It is easy to see that On the other hand, the run of M 1 on the same input trace is: Proposition 1 M 0 and M 1 are least-vacuous systems realizing ϕ.
Proof As M 0 ≡ ϕ M 1 , it suffices to prove that M 0 is a least-vacuous system realizing ϕ. Let M be an arbitrary system that realizes ϕ. For an input sequence υ ∈ ϒ ω , assume that υ induces a path in M that satisfies ϕ r = FG(¬g). Since this path, in particular, satisfies ϕ, it also satisfies FG(¬r ) (otherwise there would have been requests that are never granted). Observing Fig. 4, it is easy to see that the same input sequence υ would induce a path in M 0 with an infinite suffix {s 0 } ω , hence, in particular, it satisfies FG(¬g). Hence, M is not less vacuous than M 0 .
The following is an example of two incomparable least-vacuous systems, illustrating the second case in 3(b).
In any system that realizes ϕ, satisfying the witness formula X(¬g 1 ) implies that the second state must be labelled with ¬g 1 ∧ g 2 if ¬r is its input (because of ϕ 3 ). At the same time in order to satisfy X(¬g 2 ) the second state of this system must be labelled with g 1 ∧¬g 2 , which clearly contradicts the previous requirement.
On the other hand, least-vacuous systems for ϕ exist. For example, consider the two systems in Fig. 5: the left satisfies EX(¬g 1 ) and the right satisfies EX(¬g 2 ), but neither

Infinite vacuity chains
For some formulas, there is an infinite chain of ever less vacuous (and ever larger) systems.
As an example, consider the following LTL specification: The only useful witness formula for ϕ is Figure 6 depicts an abstract transition system M k of arbitrary size (i. e., k + 3) that realizes specification ϕ non-vacuously for any k.
Proof We have to show that M k+1 is as non-vacuous as M k and that there exists an input trace that makes M k+1 less vacuous w.r.t. ϕ r .
To see that ∀k. M k ≺ ψ M k+1 holds, note that the input trace r k+1 (¬r ) ω leads to an interesting trace in M k+1 but not in M k .

Synthesizing a less vacuous system
We now discuss how to synthesize a less vacuous system M 2 given a correct system M 1 . We do this by expressing the partial order defined above in the simple fragment of CTL * defined in (4). Fig. 7 The final non-vacuous system M 2 Given a formula ϕ or a system M, we use a primed version (ϕ or M , respectively) to denote the formula/system obtained by replacing all output literals by primed versions. Given a system M 1 that satisfies ϕ, we have Equation (25) follows directly from Eq. (14) after renaming the variables of M 1 with their primed versions. Note that ϕ and ϕ ψ refer to the outputs of M 2 and ϕ ψ refers to the outputs of M 1 , while both systems receive the same inputs. The following theorem generalizes (25) to all subformulas of ϕ.

Theorem 4 M 1 is strictly less vacuous than M
Note that this equation has the form of Eq. (2) and can thus be solved as described in Sect. 3.
We iteratively synthesize less and less vacuous systems by applying (26) where M 2 is the existing system. The result is M 1 , which then becomes M 2 of the next iteration. We repeat this process until (26) becomes unrealizable with the current bound on the number of states. We can then either stop or increase the bound. Every such step adds a linear number of variables. Since the asymptotic complexity has an exponential dependence on the number of variables, eventually this formula may become too hard to solve in practice.

A least-vacuous system for the running example
Consider once again our running example from the introduction. Figure 7 shows a leastvacuous system M 2 with the bound 4 on the number of states (one of the intermediate iterations resulted in M 1 depicted in Fig. 7).
System M 2 is strictly less vacuous than M 1 . Recall that the two witness formulas are ϕ r 1 = FG¬g 1 and ϕ r 2 = FG¬g 2 . It is not hard to verify that all interesting paths in M 1 w.r.t. to ϕ r 1 (w.r.t. to ϕ r 2 ) are also interesting w.r.t. to ϕ r 1 (w.r.t. to ϕ r 2 , resp.) in M 2 . Also, the trace that results from leaving r 1 and r 2 low all the time is interesting w.r.t. ϕ r 2 in M 2 but not in M 1 .
Proof Let M be an arbitrary system that realizes ϕ. For an input sequence υ ∈ ϒ ω , assume that υ induces a path in M that satisfies ϕ 1 [r 1 ← ⊥] = FG¬g 1 . Since this path, in particular, satisfies ϕ, it also satisfies FG¬r 1 (otherwise there would have been requests that are never granted). Observing Fig. 7, it is easy to see that the same input sequence υ would induce a path in M 2 with an infinite suffix {s 0 , s 2 } ω , hence, in particular, it satisfies FG¬g 1 . A similar argument holds for ϕ 2 [r 2 ← ⊥]. Hence, M is not less vacuous than M 2 .
The question whether a given system is a least-vacuous one (again, such systems may not be unique) is equivalent to asking whether a less vacuous one exists, which, by (26) can be reduced to a CTL * realizability question.

Experimental evaluation
We implemented the described technique in the PARTY synthesizer [13]. We cannot check directly whether non-vacuous synthesis leads to a system which is closer to 'the user intent'. However, we can check something with a similar flavor: the ability of this technique to guess missing parts of a specification. Hence, we conducted the following experiment: first, we synthesized models for three complete and correct specifications; then, we made them incomplete by removing some of the conjuncts in the specification; finally, we ran nonvacuous synthesis on these incomplete specifications, and checked whether the resulting system satisfies the original, complete specification; A positive answer indicates that nonvacuous synthesis can accelerate the convergence towards the desired system.
Indeed, in the three experiments that we conducted, non-vacuous synthesis was able to synthesize a system that satisfies the original, full specification, although we emphasize that this is not guaranteed in general. The synthesized system in all three cases is not identical to the one synthesized according to the full specification, which reflects the fact that many systems can satisfy the same specification. It is up to the user to choose between them.
More details about the experimental setting, as well as a performance comparison, is given in 1. It is evident from the comparison that, as expected, on average non-vacuous bounded synthesis takes more time than bounded synthesis.

A 'next' arbiter
The 'next' arbiter of two clients issues a grant for each client in the next step if and only if the client sends a request. The assumption is that clients never send requests simultaneously; thus, issued grants should be mutually exclusive. The complete and incomplete specification of this arbiter for two clients is shown in Fig. 8. The specification should be interpreted as 'every run that satisfies the assume predicates should also satisfy the guarantee predicates'.
As depicted in Fig. 9a, b, even a slight modification in the specification results in a large gap in the behaviors of the synthesized systems. On the other hand starting from the system depicted in Fig. 9b, three iterations of the non-vacuous synthesis process result in the system shown in Fig. 9c, which satisfies the original, full specification. Figure 10 depicts the runtime (a) (b) (c) Fig. 9 Synthesized arbiters of the complete and incomplete specifications of the 'next' arbiter that appeared in Fig. 8 (a) (b) Fig. 10 Runtime breakdown of synthesis of the 'next' arbiter breakdown of bounded synthesis and non-vacuous bounded synthesis for both the complete and incomplete versions of the 'next' arbiter.

A 'full' arbiter
A 'full' arbiter of two clients eventually issues a grant for each client if the client sends a request. The complete specification appears in Fig. 11 (left), and a partial specification appears in Fig. 11 (right). The properties that are removed in the partial specification state that grants are never given "unnecessarily". The transition systems that are synthesized for the full and partial specification appear in Fig. 12a, b respectively. On the other hand, starting from the partial specification, after four iterations of the non-vacuous synthesis the system we get is as shown in Fig. 12c, which again satisfies the full specification. Figure 10 depicts the runtime breakdown of bounded synthesis and non-vacuous bounded synthesis for both the complete and incomplete versions of the 'full' arbiter (Fig. 13).

A 'Pnueli' arbiter
A 'Pnueli' arbiter of two clients is a handshake mechanism such that whenever a client sets a request the arbiter will set and keep the corresponding grant high as long as the request is high [12]. The complete and incomplete specification of a 'Pnueli' arbiter of two clients is shown in Fig. 14. The incomplete specification allows the arbiter to set a grant and never unset it; therefore, the synthesized system may issue vacuous grants for each client infinitely often unless the other client sends a request-see Fig. 15b. The result of our non-vacuous synthesis from the partial specification again satisfies the full specification, as shown in Fig. 15c, and is synthesized in one step. This system also satisfies the specification in a less vacuous way than the system synthesized from the complete specification using the previous version of PARTY, without the new functionality of nonvacuity. Figure 10 depicts runtime breakdown of both synthesis methods for complete and incomplete versions of the 'Pneuli' arbiter ( Fig. 16).

Conclusion
In synthesis, it is hard to expect the designer to think of a complete specification. As a result, the large range of possible systems that satisfy the specification permits designs that stand in contrast to the designer's intent. We proposed in this article to apply the concept of vacuity to address this problem. Our method narrows down the range of legitimate synthesised system to those that satisfy the (partial) specification in a meaningful way, a well-known concept from using vacuity in model-checking. But as we argued, we do not have to commit to the Boolean nature of the classical definition of vacuity: we showed how a system can be made less vacuous, even if it already satisfies the specification non-vacuously. Our experiments showed that our method is capable of synthesising better designs, in the sense that they even satisfy parts of the specification that we deliberately removed and were hence inaccessible to the synthesis algorithm. Perhaps in the future synthesis will be used in the industry, and then our conjecture that this process can save time to the designer will be tested with a user-study. Our solution is based on a novel bounded synthesis technique that combines universal and existential properties; It paves the way for generalizing our technique to full CTL * . Our tool PARTY is available on the web to try and improve.

B: Performance comparison
Here we compare the performance of non-vacuous bounded synthesis to 'normal' bounded synthesis, using a benchmark set of 164 specifications. The set includes the LTL-Real benchmarks of synthcomp 2020, lily, genbuf, acacia+, and party-elli. Our implementation uses Z3 4.8.10 and SPOT 2.9. It is worth mentioning that our implementation uses integer encoding of co-büchi automata for both methods. We ran each experiment twice and each time for a total of 60 minutes. In both runs, 70 experiments timed out, 85 were realizable, and 9 were unrealizable. We averaged the run-time profile of both runs and computed the performance loss in making the synthesis non-vacuous.
Of all realizable experiments the non-vacuous bounded synthesis gained negligible performance in three cases. Meanwhile, non-vacuous bounded synthesis timed out on 3 experiments that were realizable through bounded synthesis. Table 1 gives a more detailed comparison.
The biggest factor in the performance loss is the solver time. This is evident in the plots shown in Figs. 18 and 19. Other than the solver time, much of the run-time is spent on translating each specification to a co-büchi automaton, which is shared by both synthesis methods; thus, the total performance loss is typically less than the solver performance loss.