A Complete Axiom System for Propositional Interval Temporal Logic with Infinite Time

Interval Temporal Logic (ITL) is an established temporal formalism for reasoning about time periods. For over 25 years, it has been applied in a number of ways and several ITL variants, axiom systems and tools have been investigated. We solve the longstanding open problem of finding a complete axiom system for basic quantifier-free propositional ITL (PITL) with infinite time for analysing nonterminating computational systems. Our completeness proof uses a reduction to completeness for PITL with finite time and conventional propositional linear-time temporal logic. Unlike completeness proofs of equally expressive logics with nonelementary computational complexity, our semantic approach does not use tableaux, subformula closures or explicit deductions involving encodings of omega automata and nontrivial techniques for complementing them. We believe that our result also provides evidence of the naturalness of interval-based reasoning.


Introduction
Intervals and discrete linear state sequences offer a natural and flexible way to model both sequential and parallel aspects of computational processes involving hardware or software. Interval Temporal Logic (ITL) [Mos86] (see also [ITL12]) is an established formalism for rigorously reasoning about such intervals. ITL has a basic construct called chop for the sequential composition of two arbitrary formulas as well as an analogue of Kleene star for iteration called chop-star. Although originally developed for digital hardware specification [Mos83a,Mos83b,HMM83,Mos85], ITL is suitable for logic-based executable specifications [Mos86], compositional reasoning about concurrent processes [Mos94,Mos95,Mos98,Mos11], refinement [CZ97], as well as for runtime analysis [ZZC99].
Until now, in spite of research over many years involving ITL and its applications, there was no known complete axiom system for quantifier-free propositional ITL (PITL) with infinite time. We present one and prove completeness by a reduction to our earlier complete PITL axiom system for finite time [Mos04] (see also [BT03]) and conventional propositional linear-time temporal logic (PTL). We do not use subformula closures, tableaux, or explicit deductions involving encodings of omega automata and nontrivial techniques for complementing them. Such encodings are typically found in completeness proofs for comparable logics discussed later on (see §11.1), which like PITL have omega-regular expressiveness.
See Thomas [Tho90,Tho97] for more about omega-regular languages, omega automata and some associated logics. Our simple axiom system avoids complicated inference rules and proofs such as axiom systems for an equally expressive version of PITL with restricted sequential iteration [Pae89] and a less expressive version of PITL lacking sequential iteration [RP86]. In the future we plan to use our axiom system as a hierarchical basis for obtaining completeness for some PITL variants. We also believe it can be applied to some other logics and discuss this in Section 12.
Our earlier completeness proof for a larger, more complicated axiom system for quantified ITL with finite domains and infinite time [Mos00] does not work if variables are limited to being just propositional. So that result, while serving as a stepping stone for further research on ITL, even fails to establish axiomatic completeness for a quantified version of PITL (QPITL) with infinite time! For these reasons, we feel justified in regarding the problem of showing axiomatic completeness for full PITL with infinite time as a previously open problem.
We now mention some recent publications by others as evidence of ITL's continuing relevance. None specifically motivate our new completeness proof. Nevertheless, they arguably contribute to making a case for the study of ITL's mathematical foundations, which naturally include axiomatic completeness.
The KIV interactive theorem prover [RSSB98] has for a number of years included a slightly extended version of ITL for interactive theorem proving via symbolic execution both by itself (e.g., see [BBN + 10, BSTR11]) and also as a backend notation which supports Statecharts [TSOR04] and UML [BBK + 04]. KIV can employ ITL proof systems such as ours. The concluding remarks of [BSTR11] note the following advantages of ITL: Our ITL variant supports classic temporal logic operators as well as program operators.
The interactive verifier KIV allows us to directly verify parallel programs in a rich programming language using the intuitive proof principle of symbolic execution. An additional translation to a special normal form (as e.g. in TLA [Temporal Logic of Actions [Lam02]]) using explicit program counters is not necessary. Axiomatic completeness of PITL is not an absolute requirement for the KIV tool but does offer some benefits. This is because some axioms, inference rules and associated deductions employed to prove completeness can be exploited in KIV, thereby reducing the number of adhoc axioms and inference rules. 1 Various imperative programming constructs are expressible in ITL and operators for projecting between time granularities are available (but not considered here). ITL influenced an assertion language called temporal 'e' [Mor99] which is part of the IEEE Standard 1647 [IEE08] for the system verification language 'e'.
The Duration Calculus (DC) of Zhou, Hoare and Ravn [ZHR91] is an ITL extension for real-time and hybrid systems. The books by Zhou and Hansen [ZH04] and Olderog and Dierks [OD08] both employ DC with finite time and discuss relatively complete axiom systems for it. The second book utilises DC with timed automata to provide a basis for specifying, implementing and model checking suitable real-time systems. Indeed, Olderog and Dierks explain how they regard an interval-oriented temporal logic as being better suited for these tasks than more widely used point-based ones and timed process algebras. Concerning point-based logics, they make this comment (on page 23): "In our opinion this leads to complicated reasoning similar to that . . . based on predicate logic." As for timed process algebras, they note the following (on page 25): "A difficulty with these formalisms is that their semantics are based on certain scheduling assumptions on the actions like urgency, which are difficult to calculate with." Within the last ten years, other complete axiom systems for versions of propositional and first-order ITL with infinite time have been presented. These include two by Wang and Xu [WX04] for first-order variants with restricted quantifiers and no sequential iteration as well as a probabilistic extension of theirs by Guelev [Gue07] which all build on an earlier completeness result of Dutertre [Dut95] for first-order ITL restricted to finite time. Like Dutertre, Wang and Xu and also Guelev use a nonstandard abstract-time semantics (e.g., without induction over time) instead of ITL's standard discrete-time one. Their proofs employ Henkin-style infinite sets of maximal consistent formulas. Duan et al. [DZ08,DZK12] give a tableaux-like completeness proof for a related omega-regular logic called Propositional Projection Temporal Logic (PPTL). The only primitive temporal operators in PPTL for sequential composition have varying numbers of operands and concern multiple time granularities. However, both chop and chop-star can be derived. The proof system has over 30 axioms and inference rules, some rather lengthy and intricate. The completeness proof itself involves the nontrivial task of complementing omega-regular languages which can be readily expressed in the logic but it is not discussed. Furthermore, the authors omit much of the prior work in the area developed in the course of over forty years (which we later survey in Section 11). More significantly, they do not explain how they bypass the associated hurdles faced by previous completeness proofs for logics with comparable expressiveness and nonelementary computational complexity. These points make checking the proof's handling of the complementation of omega-regular languages, liveness and other issues rather challenging. Mo, Wang and Duan [MWD11] describe promising applications of Projection Temporal Logic to specifying and verifying asynchronous communication. Zhang, Duan and Tian [ZDT12] investigate the modelling of multicore systems in Projection Temporal Logic. In view of this, the foundational issue of axiomatic completeness for PPTL should be addressed in the future more thoroughly and systematically and better related to other approaches. Incidentally, we already showed in [Mos95] that axiomatic completeness for a version of PITL with a standard version of temporal projection can be simply and hierarchically reduced to axiomatic completeness for PITL without temporal projection. Duan et al. [DZ08,DZK12] however make no mention of this by now long established and powerful technique in their review of prior work.
Here is the structure of the rest of this presentation: Section 2 overviews PITL and the new axiom system. Section 3 concerns a class of PITL theorems from which we can also deduce suitable substitution instances needed later on. Section 4 gives some infrastructure for systematically replacing formulas by other equivalent ones in deductions arising in the completeness proof. Section 5 introduces some useful PITL subsets for later use in the completeness proof. Section 6 reduces completeness for PITL with a kind of infinite sequential iteration to completeness for a subset without this. Section 7 shows how to represent deterministic finite-state semi-automata and automata in PITL. Section 8 employs semiautomata to test a given PITL formula in a finite interval's suffix subintervals. Section 9 shows completeness for the PITL subset without infinite sequential iteration. Section 10 includes some observations about the completeness proof. Section 11 reviews existing complete axiom systems for omega-regular logics. Section 12 discusses some topics for future research.
Below is the syntax of PITL formulas in BNF, where p is any propositional variable: The last two constructs are called chop and chop-star, respectively. The boolean operators false, A ∧ B, A ⊃ B (implies) and A ≡ B (equivalence) are defined as usual. We refer to A ⌢ B as strong chop, since a weak version A; B also exists. In addition, A ⋆ (strong chop-star) slightly differs from ITL's conventional weak chop-star A * , although the two are interderivable. The strong variants of chop and chop-star taken as primitives here are chosen simply because, without loss of generality, they help streamline the completeness proof. We use p, q, r and variants such as p ′ for propositional variables. Variables A, B, C and variants such as A ′ denote arbitrary PITL formulas. Let w and w ′ denote state formulas without the temporal operators skip, chop and chop-star. We have V denote a finite set of propositional variables. Also, V A denotes the finite set of the formula A's variables.
Time within PITL is discrete and linear. It is represented by intervals each consisting of a sequence of one or more states. More precisely, an interval σ is any finite or ω-sequence of one or more states σ 0 , σ 1 , . . . . Each state σ i in σ maps each propositional variable p to either true and false. This mapping is denoted as σ i (p). An interval σ has an interval length |σ| ≥ 0, which, if σ is finite, is the number of σ's states minus 1 and otherwise ω. So if σ is finite, it has states σ 0 , . . . , σ |σ| . This (standard) version of PITL, with state-based propositional variables, is called local PITL.
A subinterval of σ is any interval which is a contiguous subsequence of σ's states. This includes σ itself.
The notation σ |= A, defined shortly by induction on A's syntax, denotes that interval σ satisfies formula A. Moreover, A is valid, denoted |= A, if all intervals satisfy it.
Below are the semantics of the first five constructs: • True: σ |= true trivially holds for any σ.
Below are semantics for the versions of chop and chop-star found most suitable for the completeness proof. As already noted, other versions can be readily derived.
• Chop: σ |= A ⌢ B iff for some natural number i : 0 ≤ i ≤ |σ|, both σ 0:i |= A and σ i↑ |= B. This is called strong chop because both A and B must be true. • Chop-star: σ |= A ⋆ iff one of the following holds: − Interval σ has only one state (i.e., it is empty). − σ is finite and either itself satisfies A or can be split into a finite number of (finitelength) subintervals which share end-states (like chop) and all satisfy A. − |σ| = ω and σ can be split into ω finite-length intervals sharing end-states (like chop) and each satisfying A. In this version of chop-star, each iterative subinterval has finite length. The third case is called chop-omega and denoted as A ω .
As an example, we depict the behaviour of variable p in some 5-state interval σ and denote true and false by t and f, respectively: This interval satisfies the following formulas: For instance, the formula skip ⌢ ¬p is true because σ 0 σ 1 satisfies skip and σ 1 . . . σ 4 satisfies ¬p since σ 1 (p) = false. The fourth formula is true because both σ 0 . . . σ 2 and σ 2 . . . σ 4 satisfy p ∧ (skip ⌢ skip). The interval does not satisfy the formulas below: ¬p skip ⌢ p true ⌢ (¬p ∧ ¬(true ⌢ p)).  Table 1 perhaps requires some more explanation. Its purpose is to specify that the value of A in a 6 B. MOSZKOWSKI Axioms: Table 2: Axiom system for PITL with finite and infinite time finite interval's last state equals the value of B for the interval. For example, the formula p ← ✷ q is true on an interval iff either (a) the interval is infinite or (b) it is both finite and has one of the following hold for the propositional variables p and q: • The (finite) interval's last state has p true and all states have q true.
• The (finite) interval's last state has p false and at least one state has q false.
Below are some sample valid PITL formulas: . Let PTL be the subset of PITL with just skip and the (derived) temporal operators and ✸ shown in Table 1. We use X and X ′ for PTL formulas.
Although we do not need existential quantification in our proof, it is convenient to define here since it helps the exposition concerning automata-based ways to represent PITL formulas in §7.2, §7.4 and §10.2 and also assists us when we compare our approach with related proofs for logics with quantification in Section 11. The syntax is ∃p. A for any propositional variable p and formula A. We let σ |= ∃p. A be true iff σ ′ |= A is true for some interval σ ′ identical to σ except possibly for p's behaviour. Existential quantification together with PITL yields QPITL and together with PTL yields QPTL.
2.1. PITL Axiom System. Table 2 shows the PITL axiom system with finite and infinite time. Axiom VPTL permits PITL substitution instances of valid PTL formulas with skip, and ✸. For instance, from the valid PTL formula p ⊃ ✸ p follows ⊢ A ⊃ ✸ A, for any PITL formula A. Axiom P10 gives an inductive way to introduce chop-omega. Our new Inference Rule ✷ f Aux permits auxiliary variables to capture behaviour in finite-length prefix intervals and is only needed for infinite time.

Axioms:
The axiom system in Table 2 for both finite and infinite time is adapted from our earlier one [Mos04] for just finite time (see Table 3), itself based on a previous one we originally presented in [Mos94]. That axiom system contains some axioms of Rosner and Pnueli [RP86] for PITL without chop-star and our own axioms and inference rule for the operators ✷ i (defined using weak chop in Table 1) and chop-star. The new PITL axiom system in Table 2 adapts the axioms for ✷ i to use ✷ f instead to shorten the completeness proof since ✷ f works better with the strong chop operator ⌢ .
For consistency with our usage here, the version of the earlier axiom system for just finite time given in Table 3 uses strong chop ⌢ instead of weak chop ";" and likewise uses ✷ f instead of ✷ i . It therefore very slightly differs from the original one in [Mos04] in an inessential way since for finite time the two pairs of operators are indistinguishable. In [Mos04] we prove completeness by reduction to PTL.
Appendix A contains a large variety of representative PITL theorems, derived rules and their proofs. Many are used directly or indirectly in our completeness proof.
Note that Inference Rule ✷ f FGen in Table 2 for ✷ f mentions finite in it, whereas the analogous Inference Rule ✷Gen for ✷ does not. A version of ✷ f FGen without finite and called ✷ f Gen can be deduced (see the derived inference rule DR4 in Appendix A). If just finite time is permitted, the two variants ✷ f FGen and ✷ f Gen for ✷ f are in practice identical since finite is valid and hence deducible by Axiom VPTL. In fact, our earlier axiom system for PITL with just finite time in Table 3 uses the version without finite. 2.2. Theoremhood, Soundness and Axiomatic Completeness. A formula A deducible from the axiom system is a theorem, denoted ⊢ A. Additionally, a formula A is consistent if ¬A is not a theorem, i.e., ⊢ ¬A. We claim the axiom system is sound, that is, ⊢ A implies |= A. A logic is complete if each valid formula is deducible as a theorem in the logic's axiom system. In other words, if |= A, then ⊢ A. Our goal is to show completeness for PITL. However, we actually prove a stronger result which requires some further definitions and we therefore defer the formal statement until Theorem 3.2 in Section 3. We also make use of the following variant way of expressing axiomatic completeness: Lemma 2.1 (Alternative notion of completeness). A logic's axiom system is complete iff each consistent formula is satisfiable.
We often use the next Theorem 2.2 about finite time: Theorem 2.2 (Completeness of PITL Axiom System for Finite Time). Any valid PITL implication finite ⊃ A is deducible as a PITL theorem ⊢ finite ⊃ A using the axiom system for PITL with both finite and infinite time in Table 2.
Proof.. This readily follows by deducing the axioms and inference rules of our earlier complete axiom system for PITL with just finite time [Mos04] in Table 3. The axiom system and proofs of theorems are easily relativised to make finite time explicit and deduced with the new axiom system for both finite and infinite time already presented in Table 2. The relativisation can use the fact that the two axiom systems are quite similar.
One can alternatively disregard Theorem 2.2 and instead treat our presentation as a self-contained proof reducing completeness for PITL with both finite and infinite time to that for PITL with just finite time.
2.3. Summary of the Completeness Proof. Our proof of axiomatic completeness for PITL establishes that any consistent PITL formula is satisfiable (see the earlier Lemma 2.1). The completeness proof makes use of a PITL subset called PTL u (defined later in §5.2) which is a version of PTL having an until operator. As we discuss in §5.2, axiomatic completeness for PTL u readily follows from axiomatic completeness for basic PTL so any consistent PTL u formula is satisfiable.
The PITL completeness proof can be roughly summarised as ensuring that for any consistent PITL formula A, there exists a consistent PTL u formula Y 0 , which possibly contains auxiliary propositional variables, such that the PITL implication Y 0 ⊃ A is deducible. Completeness for PTL u guarantees that Y 0 is satisfiable. The soundness of the PITL axiom system then ensures that any model of Y 0 also satisfies A thereby showing axiomatic completeness for PITL. Note that in the actual proof, we use make use of a PTL u conjunction Y ∧ X in place of Y 0 .
In the course of the PITL completeness proof, we also employ another PITL subset called PITL k (defined later in §5.3). It is a version of PITL without omega-iteration and serves as a kind of bridge between full PITL and PTL u . The PITL completeness proof first obtains from the PITL formula A a PITL k formula K such that we can deduce A ≡ K. We then show how to obtain the PTL u formula Y 0 such that the implication Y 0 ⊃ K is deducible. We further show that if A is consistent, so are K and Y 0 . Axiomatic completeness for PTL u ensures that the consistent PTL u formula Y 0 is satisfiable. The implication Y 0 ⊃ K together with the deduced equivalence A ≡ K guarantees the deducibility of the previously mentioned PITL implication Y 0 ⊃ A. Hence, any model of Y 0 also satisfies A, thereby establishing completeness for PITL since every consistent PITL formula is indeed satisfiable.
Here is a very brief summary of the main reductions: Only the reduction from PITL k to PTL u requires some explicit automata-theoretic constructions which involve finite words and are expressed in temporal logic. Below is the structure of our reduction from PITL to PTL u : • In Section 3 we describe a class of PITL theorems with useful substitution instances.
• In Section 4 we present lemmas for systematically replacing some of a formula's subformulas by others in proofs. • In Section 5 we formally introduce the very simple PTL subset NL 1 as well as the subsets PTL u and PITL k . Although PITL k lacks chop-omega, it still has the same expressiveness as PITL. We also describe three other classes of formulas called right-chops, chainformulas and auxiliary temporal assignments. • In Section 6 we show that any PITL formula is deducibly equivalent to one in PITL k .
• In Section 7 we show how to represent semi-automata and automata in PITL.
• Section 8 utilises the material in the previous section to test for a given PITL formula in suffixes of a finite interval. Sections 7 and 8 provide a basis for introducing suitable auxiliary variables via auxiliary temporal assignments. • In Section 9 we use the constructed auxiliary variables to reduce an arbitrary consistent PITL k formula K to one in PTL u . Axiomatic completeness for PITL with infinite time then readily follows from this. A large portion of the reasoning is done at the semantic level (for example, all of Section 8). We then employ axiomatic completeness for restricted versions of PITL (such as PITL with finite time) to immediately deduce the theoremhood of key properties expressible as valid formulas in these versions. This significantly shortens the completeness proof by reducing the amount of explicit deductions.

Right-Instances, Right-Variables and Right-Theorems
Before proceeding further, we need to introduce a class of PITL theorems for which suitable substitution instances are themselves deducible as theorems. Now in the completeness proof for PITL later on, if a deducible PITL formula has propositional variables not occurring in the left of chops or in chop-stars (e.g., p in the formula p ⊃ ✸ p), then in each step of the formula's deduction these particular variables likewise do not occur in the left of chops or chop-stars. We define more generally for any PITL formula A and subformula B in A, a right-instance of B in A to be an instance of B which does not occur within the left of a chop or within some chop-star. Consider for example the disjunction below: (3.1) The subformulas ¬q, and (p ⌢ ¬q) as well as the leftmost occurrence of p ⌢ p ′ are rightinstances in the overall formula (3.1). However, all three occurrences of p and the rightmost occurrences of p ′ and p ⌢ p ′ are not right-instances in We now look at why the concept of right-variable is needed. In the formula p ⊃ ✸ p, the variable p is a right-variable. Therefore, from the validity of p ⊃ ✸ p, we can infer the validity of the substitution instance skip ⊃ ✸ skip. Lemma 3.1, which is shortly presented, formalises this idea. However, if a variable is not a right-variable in a valid formula, we might incorrectly infer that a substitution instance of the formula is also valid. For instance, the variable p is not a right-variable in the formula p ⊃ ✷ f p which is an instance of Axiom P7 in Table 2. This formula is valid but the substitution instance skip ⊃ ✷ f skip is not. Now all propositional variables in a propositional formula with no temporal operators are right-variables of that formula. More generally, all propositional variables in a PTL formula are right-variables. In contrast, a chop-star formula has no right-variables.
The next simple lemma concerns substitution into right-variables in valid formulas: Lemma 3.1 (Substitution Instances into Right-Variables). Suppose A is a PITL formula, p is one of A's right-variables (i.e., in RV (A)) and B is some PITL formula. Then if A is valid, so is the substitution instance A B p . Proof by contradiction.. Let q be a variable not occurring in A or B and let C be a variant of A with all instances of p replaced by q (i.e., A q p ). The variable p is a rightvariable of A so q is similarly a right-variable of C. It follows by induction on A's syntax that A B p and C B q denote exactly the same PITL formula. Consequently, in our reasoning about A B p , we can assume without loss of generality that p itself does not occur in B. This is because we can view A B p as being C B q . Now suppose by contradiction that A B p is not valid. By our previous discussion, also assume that p does not occur in B. Then some interval σ satisfies ¬(A B p ). We construct a variant σ ′ in which the value of variable p in each state σ ′ i equals true iff the suffix subinterval σ i↑ satisfies B. Hence σ ′ |= ✷(p ≡ B) and σ ′ |= ¬(A B p ). It readily follows from this and p being a right-variable that σ ′ satisfies ¬A since A B p only examines B in suffix subintervals. From σ ′ |= ¬A we have that A is not valid.
Later in Section 6, our completeness proof will need a deductive analogue of the semantically oriented Lemma 3.1 to permit us to infer from a theorem A and right-variable p in RV (A) another theorem A B p . One way to achieve this is by adding the next inference rule to the PITL axiom system in Table 2 for any formula A and variable p in RV (A): Another possibility is an analogue of Inference Rule ✷ f Aux in Table 2: where the propositional variable p does not occur in A or B. However, it turns out that these are unnecessary since the axiom system in its current form is already sufficient to allow a suitable class of such substitutions. We now present a formal basis for this. A PITL formula A which is theorem (i.e., ⊢ A) is called a right-theorem (denoted ⊢ rt A) if there exists a deduction of A in which A's right-variables never occur on the left of chop or in chop-star in any proof steps. However, any of A's variables not in RV (A) as well as any subsequently introduced auxiliary variables in the deductions are permitted to appear in some deduction steps in the left of chops or chop-stars. For example, if p is a right-variable of A, then no proof step can use p with Axiom P7 (e.g., ⊢ p ⊃ ✷ f p) since p is not a right-variable here owing to ✷ f p.
The completeness proof for PITL will ensure that any valid PITL formula A is indeed deducible as a right-theorem. We will refer to this here as right-completeness. Below is our main theorem for axiomatic completeness of PITL using right-completeness: Theorem 3.2 (Right-Completeness of PITL Axiom System). Any valid PITL formula A is a right-theorem of the axiom system, that is, if |= A, then ⊢ rt A.
The proof of this, our main result, is described later and concludes in Section 9. Right-theoremhood naturally yields the dual notion of right-consistency of a PITL formula A, that is, not ⊢ rt ¬A. Our completeness proof for PITL can therefore be regarded as not only showing that valid PITL formulas are right-theorems but also that any rightconsistent PITL formula is satisfiable (compare with Lemma 2.1).
As already pointed out, the main reason we are interested in right-theorems is that suitable substitution instances of them are PITL theorems. Our need for this occurs when in Section 6 we reduce right-completeness for PITL to right-completeness for its subset PITL k without chop-omega. The lemma below formalises the substitution process: Lemma 3.3 (Substitution Instances of Right-Theorems). Let A and B 1 , . . . , B n be P IT L formulas and p 1 , . . . , p n be some of A's right-variables. If A is a right-theorem, then so is the substitution instance A B 1 ,...,Bn p 1 ,...,pn , that is, ⊢ rt A B 1 ,...,Bn p 1 ,...,pn . Proof.. We assume that auxiliary variables in A's proof (i.e., ones not in V A ) do not occur in B 1 , . . . , B n . In each step of A's proof, we replace each p i by B i to obtain ⊢ rt A B 1 ,...,Bn p 1 ,...,pn . Many PITL theorems in Appendix A can be checked to be right-theorems by inspection of the proof steps. For example, those with no right-variables are immediate right-theorems. We have not indicated in the appendix which theorems are right-theorems and will normally only designate formulas as right-theorems in the completeness proof when this is needed.
The next lemma concerns the relationship between derived rules and right-theorems: Lemma 3.4 (Right-Theorems from Some Derived Rules). Suppose the assumptions of a derived rule which deduces some PITL formula A are right-theorems. Furthermore, suppose that in the derived rule's own proof of A, none of A's right-variables occur on the left of chop or in chop-star (including in any nested deduced PITL theorems and derived rules). If A's right-variables are a subset of the union of the assumptions' right-variables, then A itself is a right-theorem.
We omit the proof. For example, Derived Rule DR13 in Appendix A (see also the abbreviated Table 4 found later in §7.4) lets us infer from the theorem ⊢ ✷A ⊃ B the theorem ✷A ⊃ ✷B. It only requires the kind of reasoning mentioned in Lemma 3.4. Consequently, from ⊢ rt ✷A ⊃ B we can infer ⊢ rt ✷A ⊃ ✷B.
Readers are strongly encouraged to initially try to understand our completeness proof without consideration of right-theoremhood by simply viewing it as ordinary theoremhood and ignoring the prefix "right-". This can even be rigorously done by assuming that the optional inference rule (3.2) is part of the PITL axiom system. A subsequent, more thorough study of the material can then better take right-theoremhood into account. Indeed, we can then regard our completeness proof as two parallel proofs, a simpler one with (3.2) and another more sophisticated one which is based on right-theoremhood and Lemma 3.3 and hence does not assume (3.2). Incidentally, our completeness proof ultimately ensures that (3.2) is obtainable as a derived inference rule even if it is not in the axiom system.

Some Lemmas for Replacement
We now consider some techniques used in the completeness proof to replace selected rightinstances in a PITL formula by other formulas.
Lemma 4.1. Let A 1 , A 2 , B 1 and B 2 be PITL formulas. If A 2 can be obtained from A 1 by replacing zero or more right-instances of B 1 in A 1 by B 2 , then the next implication is deducible as a right-theorem: Proof.. The proof involves induction on the syntax of formula A 1 , with each instance of B 1 regarded as atomic. We consider the cases when A 1 is B 1 itself, true, a propositional variable p, ¬C, C 1 ∨ C 2 , skip, C 1 ⌢ C 2 , and C ⋆ . The first three of these involve quite routine conventional propositional reasoning. The case for skip is trivial since A 1 and A 2 are identical. The case for chop-star is likewise trivial since this lemma does not permit replacement in its scope.
For the case for chop, assume A 1 and A 2 have the forms C 1 ⌢ C 2 and C 1 ⌢ C ′ 2 , respectively. Note that no replacements are done in the left of chop. By induction on A 1 's syntax, we deduce the next implication: 2 . This and PTL reasoning (see Derived Rule DR13 in Appendix A and also in the abbreviated Table 4 found later in §7.4) yields the implication below: . Lemma 3.4 ensures that our use here of Derived Rule DR13 indeed yields a right-theorem.
We can also deduce the next implication using Axiom P8 and some further temporal reasoning (see PITL Theorem T3 in Appendix A and also in Table 4 in §7.4): . These two implications together yield our goal below: . This concludes Lemma 4.1's proof.
Lemma 4.1 yields a derived inference rule for Right Replacement of formulas: Lemma 4.2 (Right Replacement Rule). Let A 1 , A 2 , B 1 and B 2 be PITL formulas. Suppose that A 2 can be obtained from A 1 by replacing zero or more right-instances of B 1 in A 1 by B 2 . If B 1 and B 2 are deducibly equivalent as a right-theorem (i.e., ⊢ rt B 1 ≡ B 2 ), then so are A 1 and A 2 .

Useful Subsets of PITL
We now describe five subsets of PITL and some associated properties which will be extensively used later on in different parts of the PITL completeness proof. We have chosen to collect material about the subsets here instead of introducing each subset as the need arises. This should make it easier for readers to review the definitions and features when required and also make the main steps of the completeness proof shorter and more focused. In addition, when taken as a whole, the combined presentation of the PITL subsets enables us to give a technical overview of some of the proof steps encountered. Table 5 later lists variables used for the subsets and other subsequently defined categories. 5.1. PTL with only Unnested Next Constructs. Let NL 1 denote the subset of PTL formulas in which the only temporal operators are unnested s (e.g., p ∨ ¬p but not p ∨ ¬p). It is not hard to see that NL 1 formulas only examine an interval's first two states. They are therefore useful for describing automata transitions from one state to the next. The variables T and T ′ denote formulas in NL 1 .
Below are some theorems which contain NL 1 formulas and are required in the completeness proof. None of these theorems are themselves in NL 1 . The proofs are in Appendix A. T62 Recall that for our purposes we define PTL to be the subset of PITL with just skip and the derived temporal operators and ✸ shown in Table 1.
We also use a more expressive version of PTL denoted here as PTL u with a strong version of the standard temporal operator until , derivable in PITL: We limit until 's lefthand operand to be a formula in NL 1 (defined previously in §5.1). Note that this definition of until using chop and chop-star results in any variable in the left operand of until not being a right-variable. Let Y and Y ′ denote PTL u formulas.
We establish right-completeness for PITL by a reduction to PTL u , instead of directly to PTL. It is not hard to show that our axiom system is complete for PTL u formulas. This is because we can deduce the next two PTL u axioms known to capture this kind of until 's behaviour (the PITL proofs are in Appendix A): Consequently, we can reduce completeness for PTL u to it for PTL. In fact every PTL u theorem is a right-theorem. This is because the right-variables in T until A remain so in T70 and T71, Hence, the two PTL u axioms ensure that these variables remain rightvariables in the proof steps for deducing a PTL u theorem in the PITL axiom system. See Kröger and Merz [KM08] for more about axioms for a variety of such binary temporal operators. Table 1)  Here ∅ denotes the omega-language with no elements. Let PITL K denote the PITL subset in which chop-star only occurs on the left of chops (like (3) in Thomas' theorem above) and is therefore restricted to finite intervals. The K in PITL k stands for "Kleene star". For example, the next two formulas are in PITL k :

PITL without Omega-Iteration. Our completeness proof includes a step in which any chop-omega (defined in
In contrast, the two formulas below are not in PITL k : Observe that a PITL k formula can contain chop-star subformulas, which by the definition of PITL k are not themselves in it. An example is ( With just finite time, any PITL formula A is easily re-expressed in PITL k as A ⌢ empty (compare with Axiom P6 in Table 2). However this technique does not work for infinite time. We also need Thomas' theorem (Theorem 5.1) to ensure that any PITL formula A has a semantically equivalent PITL k formula K for both finite and infinite time (i.e., |= A ≡ K). For example, one way to re-express the PITL formula (skip ∧ p) ⋆ in PITL k is ✷(more ⊃ p). It follows that any chop-omega formula is re-expressible in PITL k . For instance, for any PITL formula B, the formula (skip ∧ B) ω is semantically equivalent to ✷ ✸ f (skip ∧ B).
Later on in Section 6 we employ Thomas' theorem to easily reduce axiomatic completeness for PITL to that for PITL k . More precisely, we will formally establish there that for any PITL formula A, there exists a semantically equivalent PITL k formula K such that the formula A ≡ K is deducible as a PITL theorem. Hence, by simple propositional reasoning, if A is consistent, so is K and any model for K is also one for A. The remainder of the overall completeness proof then reduces completeness for PITL k to it for PTL u .
Choueka and Peleg [CP83] give a simpler proof of Thomas' theorem using standard deterministic omega automata. Readers favouring an automata-theoretic perspective can therefore regard the theorem in the context of PITL as a basis for implicitly determinising the original PITL formula, resulting in a semantically equivalent one in PITL k .

Right-Chops and Chain
Formulas. For any PITL formula A, we call a chop formula in A a right-chop if it is not in another chop's left operand or in a chop-star. Rightchops help reduce PITL k to PTL u . We illustrate them with the formula below: (5.1) The following three formulas all occur as right-chops in this: Only the second instance of p ⌢ p ′ in formula (5.1) is a right-chop. In contrast, the first instance of p ⌢ p ′ is not a right-chop since it is within the left operand of another chop.
Observe that the right-chops of a PITL formula A are exactly those subformulas in A, including possibly A itself, which have chop as their main operator and are right-instances (previously defined in Section 3).
In addition to right-chops, the reduction of a PITL k formula to PTL u employs a class of PTL u formulas involving disjunctions and sequential chains of restricted constructs. Let a chain formula be any PTL u formula with the syntax below, where w is a state formula, T is an NL 1 formula and G and G ′ are themselves chain formulas: The operator until in chain formulas involves a quite limited version of the PITL operator chop-star which is much easier to reason about than full chop-star. The next lemma exploits this and shows that a chop in which the left operand is a chain formula and the right one is in PTL u can be re-expressed as a deducibly equivalent PTL u formula.

Lemma 5.2. For any chain formula
Proof.. We do induction on G's syntax using the deducible equivalences below in which w is a state formula, T is an NL 1 formula and G ′ and G ′′ are themselves chain formulas: The first of these is an instance of PITL Axiom P5. The second and third are respective instances of PITL Theorems T42 and T18 in Appendix A (see also the abbreviated Table 4 found later in §7.4). The fourth uses the earlier ITL-based definition of the temporal operator until in §5.2 and Axiom P2 which itself concerns chop's associativity.
For example, the left chop operand in the PITL formula p ∧ (q until empty)) ⌢ skip is a chain formula. The chop itself is deducibly equivalent to the PTL u formula p ∧ (q until skip).
Our completeness proof will ultimately apply Lemma 5.2 when in Section 9 we later replace the left operands of a consistent PITL k formula's right-chops with chain formulas. For this to work, we will also need auxiliary variables of the kind now described. 5.5. Auxiliary Temporal Assignments. When we later represent automata runs in PITL, it is convenient to generalise formulas of the form p ← B (the temporal assignment construct defined in Table 1) to conjunctions of several of these. Please refer back to Section 2 for a brief explanation about the meaning of temporal assignment. We call such a conjunction an Auxiliary Temporal Assignment (ATA). It has the form given below: for some n ≥ 0, where each A i is a PITL formula, there are n distinct auxiliary propositional variables q 1 , . . . q n and the only ones of them permitted in each A i are q 1 , . . . q i−1 . All other propositional variables are allowed in any A i . Here is a sample ATA with one nonauxiliary variable r and two auxiliary variables p and q: Variables such as D and D ′ denote ATAs. Two ATAs are disjoint if they have distinct auxiliary variables.
Let us now look at how to formally introduce ATAs containing auxiliary variable into deductions for later use within the completeness proof in §9.2.
Lemma 5.3 readily generalises to reduce a formula's right-consistency to that for a conjunction of it and a suitable ATA: Lemma 5.4 (The Temporal Operator ✷ f , ATAs and Right-Consistency). Let A be a PITL formula and D an ATA with no auxiliary variables in A.
Proof.. For some n ≥ 0, the ATA D contains n auxiliary variables and has the form 1≤i≤n (q i ← B i ). We first apply Lemma 5.3 n times to reduce the formula A's rightconsistency to that for the next formula: The conjunction of ✷ f -formulas is then re-expressed with a single ✷ f (see PITL Theorem T28 found in Appendix A and also included in the more abbreviated Table 4 later in §7.4) to obtain the formula below which is deducibly equivalent to (5.2): . This is the same as our goal A ∧ ✷ f D.
5.6. Overview of Role of PITL Subsets in Rest of Completeness Proof. The PITL completeness proof can now be summarised using the PITL subsets just presented. Some readers may prefer to skip this material and proceed directly to the proof which starts in Section 6. Our goal here is to show that any right-consistent PITL formula A is satisfiable.
Here is an informal sequence of the transformations involved: where K is a PITL k formula, K ′ is a PITL k formula in which the left operands of all right chops are chain formulas, D ′ is an ATA and Y and X are respectively in PTL u and PTL. If A is right-consistent, then so are the formulas in all steps. From the completeness of the PTL u axiom system as discussed in §5.2 we have that the conjunction Y ∧ X is satisfiable. Furthermore, our techniques ensure that the models of a formula obtained from one of the transformations also satisfy the immediately preceding formula and hence by transitivity the original PITL formula A as well.
Important automata-theoretic techniques presented in Sections 7 and 8 help with the reductions to K ′ ∧ ✷ f D ′ and Y ∧ X in Section 9. We show in Section 9 that the formulas Note that in the actual completeness proof (in Lemma 9.4 in §9.2), which for technical reasons involves a sequence of transformations from K to K ′ , we make use of a PITL k formula denoted K ′ m+1 rather than simply K ′ .

Reduction of Chop-Omega
If we assume right-completeness for PITL k (later proved as Lemma 9.4 in §9.2), then obtaining from a PITL formula a deducibly equivalent PITL k one is relatively easy. We first look at re-expressing chop-omega formulas in PITL k and then extend this to arbitrary PITL formulas.
Lemma 6.1 (Deducible Re-Expression of Chop-Omega in PITL k ). Suppose we have rightcompleteness for PITL k . Then for any PITL formula B, there exists a PITL k formula K with the same variables and no right-variables and for which the equivalence K ≡ B ω is a right-theorem (i.e., ⊢ rt K ≡ B ω ).
Proof.. Thomas' theorem (Theorem 5.1) ensures that there exists some PITL k formula which is semantically equivalent to B ω and contains the same variables. From that formula we obtain one denoted here as K which has no right-variables by conjoining a trivially true ✸ f -formula containing a disjunction of all of B's variables and their negations. We therefore The first step involves an instance of Axiom P10: In addition, the next formula is valid: From this and |= K ≡ B ω , we have |= K ⊃ (B ∧ more ) ⌢ K. We then use the assumed right-completeness of PITL k to deduce the implication as a right-theorem. Now invoke ✷-generalisation (Axiom ✷Gen) on this to obtain ⊢ rt ✷(K ⊃ (B ∧ more) ⌢ K). Simple propositional reasoning involving that and the earlier deduced implication (6.1) establishes our immediate goal ⊢ rt K ⊃ B ω . Case for showing ⊢ rt B ω ⊃ K: Let p be a propositional variable not in B ω or K. The next formula is valid (and an instance of Axiom P10): We then replace B ω by the semantically equivalent K: Now K is a PITL k formula and furthermore (B ∧ more) ⌢ p is as well since even if B does contain some chop-stars, B is located within the left of a chop. The valid formula (6.2) is in PITL k and hence a right-theorem by the assumed right-completeness for PITL k : Therefore, we can use Lemma 3.3 to obtain the theoremhood of the next PITL implication which has the formula B ω substituted into the right-variable p: We also deduce the following from the definition of chop-omega in terms of chop-star together with Axiom P9 and some simple temporal reasoning: We now do ✷-generalisation (Axiom ✷Gen) on this and then use propositional reasoning on it with the previous formula (6.3) to obtain the right-theorem ⊢ rt B ω ⊃ K, which is our immediate goal.
Lemma 6.2 (Reduction of PITL to PITL k ). If right-completeness holds for PITL k , then for any PITL formula A, there exists an equivalent PITL k formula K with exactly the same propositional variables and right-variables such that ⊢ rt A ≡ K.
Proof.. We first re-express each of A's chop-stars B ⋆ i not in the left of chop or another chopstar using the next deducible equivalence (see PITL Theorem T58 found in Appendix A and also included in the more abbreviated Table 4 in §7.4): This splits B ⋆ i into cases for finite and infinite time. Note that there there are no rightvariables in (6.4) since any variables occur in a chop-star. Hence the equivalence, once deduced, is trivially a right-theorem.
Lemma 6.1 ensures some PITL k formula K ′ i exists with the same variables as B i , no right-variables and the right-theorem ⊢ rt K ′ i ≡ B ω i . Hence like (6.4), the next equivalence is a right-theorem and both sides have the same variables and no right-variables: i yields a PITL k formula K which the same variables as A and equivalent to it (i.e., ⊢ rt A ≡ K). No rightvariables in A are in any replaced B ⋆ i . Hence A and K have the same right-variables.

Deterministic Finite-State Semi-Automata And Automata
The remainder of our axiomatic completeness proof for PITL mostly concerns reducing PITL k to PTL u . Now PITL with finite time expresses the regular languages and can readily encode regular expressions (see for example [Mos04] which reproduces our results with J. Halpern in [Mos83a]). We can therefore employ some kinds of deterministic finite-state semi-automata and automata which provide a convenient low-level framework for finite time to encode the behaviour of an arbitrary PITL formula. Our completeness proof utilises these semi-automata and automata to build a variant semi-automaton discussed in the next Section 8 to assist in reducing PITL formulas on the left of right-chops to chain formulas in PTL u . The reduction applying these techniques to go from PITL k to PTL u is presented in Section 9. After introducing the semi-automata and automata, we will consider various semantically equivalent ways to represent them in temporal logic, each with its benefits. Some require PITL and others just PTL. The representations in PITL are at a higher level and fit well with our proof system, especially since we can assume completeness for PITL with finite time. In some later sections, we consider deducing some of the properties as theorems.
In order to define an alphabet for our semi-automata and automata, we introduce a special kind of state formula which serves as a letter and is called here an atom. An atom is any finite conjunction in which each conjunct is some propositional variable or its negation and no two conjuncts share the same variable. The Greek letters α and β denote an individual atom. For any finite set of propositional variables V, let Σ V be some set of 2 |V | logically distinct atoms containing exactly the variables in V. For example, if V = {p, q}, we can let Σ V be the set of the four atoms shown below: One simple convention is to assume that the propositional variables in an atom occur from left to right in lexical order. If V is the empty set, then Σ V contains just the formula true.
A finite, nonempty sequence of atoms form a word. Each possible word corresponds to some collective state-by-state behaviour of the selected variables in a finite interval. For our interval-oriented application of words we never utilise the word containing no letters (commonly denoted ǫ in the literature).
7.1. Deterministic Finite-State Semi-Automata. We define a deterministic finitestate semi-automaton S to be a quadruple (V S , Q S , q I S , δ S ) consisting of a finite set of propositional variables V S , together with a finite, nonempty set of control states Q S = {q 1 , . . . , q m }, an initial control state q I S ∈ Q S and a deterministic transition function δ S : Q S × Σ V S → Q S . The sets V S and Q S must be disjoint, i.e., V S ∩ Q S = ∅. We use propositional variables q 1 , . . . , q m to denote control states since this helps when expressing the semi-automaton's behaviour in PITL. A run on a finite word for each i : 1 ≤ i < k. Hence the semi-automaton makes just k − 1 transitions and consequently ignores the details of the last atom α k . Therefore the semi-automaton differs from a conventional automaton which would have a run with k + 1 control states involving k transitions and the examination of all k atoms. Furthermore, the definition of a semi-automaton has no set of final control states and hence no acceptance condition. We abbreviate the set of atoms Σ V S as Σ S since the elements of Σ V S serve as S's letters. The semi-automaton S's behaviour is expressible in temporal logic by regarding each control state q i to be a propositional variable which is true when q i is S's current control state. Before showing how S's runs are expressed in PTL, we first define a state formula init S which ensures that the initial control state is q I S and also a transitional formula T S in NL 1 which captures the behaviour of δ S : If we assume finite time, then a run starting at S's initial control state is expressed as the PTL formula init S ∧ ✷(more ⊃ T S ) or alternatively as the chain formula init S ∧ (T S until empty) in PTL u .
7.2. Deterministic Finite-State Automata. Semi-automata do not have an acceptance test and hence do not have associated accepting runs. We therefore now define a deterministic finite-state automaton which includes an acceptance test. As we shortly illustrate, this can be constructed to recognise a given PITL formula in a finite interval. Let M be a quintuple (V M , Q M , q I M , δ M , τ M ). The first four entries are as for a semi-automaton. The last entry τ M : Q M → 2 Σ M is a conditional acceptance function from control states to sets of letters. A run is the same as for a semi-automaton. Our notion of acceptance of a word does not use a conventional set of final control states but instead has the function τ M make all control states conditionally final. An accepting run on a finite word α 1 . . . α k in Σ + M with k atoms is any run of k control states q ′ 1 . . . q ′ k with q ′ k ∈ τ M (α k ). Therefore, a control state q ∈ Q M is regarded as a final one only when the automaton sees an atom α with α ∈ τ M (q). A test for this is expressible as the state formula acc M defined below: If we assume finite time, an accepting run of M starting at M 's initial control state is expressed as the PTL formula init M ∧ ✷(more ⊃ T M ) ∧ fin acc M or alternatively as the chain formula init M ∧ (T M until (acc M ∧ empty)) in PTL u . As a result of our convention for runs and accepting runs, the automaton M 's operation requires one state less than a conventional one to accept a word. For example, it can accept one-letter words without the need for any state transitions. In fact, such an automaton M only recognises words with at least one letter (i.e., in Σ + M ). This is perfect when we utilise semi-automata and automata to mimic PITL formulas since ITL intervals have at least one state.
The regular expressiveness of PITL with finite time ensures that any PITL formula B can be recognised by some M . The set V B of propositional variables in B and the set Q M of M 's control states are assumed to be distinct. Formally, we have the next valid formula expressed in QPITL (defined in Section 2): For instance, below is a sample automaton M to recognise finite intervals satisfying the formula (skip ∧ p) ⌢ skip ⌢ skip ⋆⌢ (empty ∧ ¬p), which is semantically equivalent to the PTL formula p ∧ ✸(empty ∧ ¬p): Here is an accepting run for the 5-letter word p ¬p p p ¬p: q 1 q 2 q 3 q 3 q 3 : Below are the values of q 1 , . . . , q 4 over an associated 5-state interval in which p has the behaviour p ¬p p p ¬p: (q 1 , ¬q 2 , ¬q 3 , ¬q 4 ) (¬q 1 , q 2 , ¬q 3 , ¬q 4 ) (¬q 1 , ¬q 2 , q 3 , ¬q 4 ) (¬q 1 , ¬q 2 , q 3 , ¬q 4 ) (¬q 1 , ¬q 2 , q 3 , ¬q 4 ). (7.2) In each tuple, we show the unique active control state in boldface. For instance, q 2 is true in the second interval state since q 1 ∧ p is true in the first one.
7.3. ATAs for Semi-Automata and Automata. The runs of a deterministic semiautomaton or deterministic automaton from the initial control state can alternatively be expressed with an ATA (defined in §5.5). We will consider the case for a semi-automaton S, but the technique is identical for an automaton M . Now PITL with finite time can express all regular languages in Σ + S . For each control state q of S, the set of words in Σ + S for which S starts in the initial control state q I S and ends in q is regular. The regular expressiveness of PITL with finite time ensures that there exists some corresponding PITL formula C S,q which only has variables in the set V S and expresses this set of words. In principle, such a formula can be obtained by adapting standard techniques for constructing a regular expression from a conventional finite-state automaton. Now let the ATA D S denote the conjunction q∈Q S (q ← C S,q ). We express finite runs in PITL using finite ∧ ✷ f D S . Here is such an ATA for the earlier sample automaton in (7.1): Note that the case for q 3 simplifies to q 3 ← (p ∧ true). The 5-tuple sample run in (7.2) reflects behaviour in prefix subintervals for the previous illustrative word p ¬p p p ¬p. For example, q 2 is true in just the second interval state since the 2-state prefix subinterval is the only prefix subinterval satisfying the formula skip ∧ p.
For any deterministic automaton M , let D M denote some ATA obtained from M in exactly the same way as for a semi-automaton. 7.4. Formal Equivalence of the Two Representations of Runs. For finite time, the PITL formula ✷ f D S expresses all runs of S starting from its initial control state. Hence for finite time this formula is semantically equivalent to the previous formulas for this behaviour (e.g., the PTL formula init S ∧ ✷(more ⊃ T S )). Consequently, the next valid formula relates the two ways of expressing S's runs: The use of a single example (7.1) for both representations of S's runs can be justified from this. An automaton M 's accepting runs can be expressed with finite ∧ (✷ f D M ) ∧ fin acc M . The QPITL formula below is valid for any PITL formula B and automaton M which recognises B: The valid PITL k formula (7.3) just given relates two ways of representing in temporal logic the runs of a finite-state semi-automaton (that is, ✷ f D S and init S ∧ ✷(more ⊃ T S )). It includes an explicit assumption about finite time. The next Lemma 7.1 eliminates this requirement and provides a way to re-express ✷ f D S as an equivalent PTL formula in deductions concerning infinite time. The proof of Lemma 7.1 only involves temporal logic and requires no explicit knowledge about omega automata.
For the convenience of readers studying our deductions here and later on in Section 9, Table 4 lists every PITL theorem and derived rule explicitly mentioned somewhere prior to Appendix A. The appendix itself contains all needed PITL theorems and derived rules and as well as their individual proofs.

T1
⊢ Proof.. The validity of implication (7.3), together with completeness for PITL with finite time ensures that (7.3) is also a deducible theorem: We then deduce from that and Inference Rule ✷ f FGen the next theorem: From this and some interval-based temporal reasoning about ✷ f (using properties of the underlying modal system K -see Appendix A.2) we can then deduce the equivalence below: Let us now re-express ✷ f init S as the equivalent state formula init S (see PITL Theorem T37): We also want to re-express ✷ f ✷(more ⊃ T S ) as the PTL formula ✷(more ⊃ T S ). This can be done by first re-expressing ✷ f ✷ as ✷ ✷ f (see PITL Theorem T55) to yield the equivalence below: Let us now consider how to eliminate the operator ✷ f in the subformula ✷ ✷ f (more ⊃ T S ). The fact that any NL 1 formula T only sees an interval's first two states ensures that the next equivalence is valid and also deducible (see PITL Theorem T62): A dual form (see PITL Theorem T63) is readily deduced for use with T S : We employ this with Derived Rule DR12 to obtain an equivalence for eliminating the ✷ f operator in ✷ ✷ f (more ⊃ T S ): (7.6) Equivalence (7.4)'s theoremhood, which is our immediate goal, then readily follows by simple propositional reasoning from the deduced equivalences (7.5) and (7.6).

Compound Semi-Automata for Suffix Recognition
Let a compound semi-automaton R be a vector of semi-automata S 1 , . . . , S n for some n ≥ 1 with disjoint sets of control states. We take V R to be the set of propositional variables in the semi-automata S 1 , . . . , S n which are not also control states. The purpose of R is to perform what we call suffix recognition. This is a way to determine which of an finite interval's suffix subintervals satisfy some given PITL formula B. Suffix recognition is a stepping stone enabling us to subsequently perform the infix recognition already briefly mentioned in §5.6. Later on in Section 9 this feature of R ensures that for a given PITL k formula K with m right-chops (previously defined in §5.4), we can utilise m such compound semi-automata to obtain an ATA for infix recognition to replace the left sides of K's rightchops with PTL u chain formulas (also introduced in §5.4). The n individual semi-automata S 1 , . . . , S n in R are meant to operate lockstep in parallel and so simultaneously make state transitions. For each i : 1 ≤ i < n, we require for the set V S i+1 , which contains propositional variables examined by S i+1 , that V S i+1 ⊆ V S i ∪ Q S i . Hence the control states of S i are allowed occur within the letters for S i+1 and any semi-automata of higher index but not vice versa. This enables each semi-automaton to optionally observe control states of all semi-automata with lower index when it makes transitions. In our particular construction of R, the set V R simply equals the set V B of propositional variables in the PITL formula B and also equals the lowest-indexed semi-automata S 1 's set V S 1 of propositional variables used to form the atoms Σ S 1 . Let R's ATA D R be a conjunction of the ATAs for the semiautomata S 1 , . . . , S n . It is not hard to check that D R obeys the ATA requirement limiting where auxiliary variables can occur (as specified in the definition of ATAs in §5.5) and is therefore well-formed. We perform suffix recognition by exploiting standard techniques originally developed by McNaughton [McN66] to construct deterministic omega automata. Choueka [Cho74] later applied McNaughton's insights to some constructions for automata on finite words. Our discussion here likewise concerns finite-time behaviour and avoids omega automata. Furthermore, this section deals with semantic issues but not deductions. wil 24 B. MOSZKOWSKI 8.1. Overview of Construction of Compound Semi-Automaton. The compound semi-automaton R to suffix recognise B is built from several modified copies of a deterministic automaton running lockstep in parallel. We also define an associated chain formula G R . Here is a summary: • We initially construct R and G R to just check whether B is true in any given finite suffix subinterval of the overall finite interval in which R is run. Consequently, G R can be used to mimic B. • We first construct a deterministic finite-state automaton M (discussed in §7.2) to recognise the regular language associated with B in finite time. Let n be the number of control states, that is, n = |Q M |. • We do not use M directly but instead construct n + 1 semi-automata S 1 , . . . , S n+1 based on M . The compound semi-automaton R is a vector of them. • Our construction ensures that always at least one semi-automaton is in (its copy of) M 's initial control state and so available to start testing for B in the suffix subinterval commencing at the current state.
• A suffix subinterval satisfies B iff there is exists a simulation of an accepting run of M which starts in the subinterval's first state, ends in its last one (the same as the overall interval's final state) and is formed by combining up to n + 1 pieces of runs of the semiautomata S 1 , . . . , S n+1 . The successive partial runs are performed on semi-automata of decreasing index.

Construction of the Individual Semi-Automata.
Let us now consider the details of the n + 1 semi-automata variants S 1 , . . . , S n+1 of M . A semi-automaton S k has its own disjoint set Q S k = {q S k 1 , . . . , q S k n } of copies of the n control states in M and is initialised exactly as M would be and hence starts in (its copy of) M 's initial control state. We let S k examine the control states of semi-automata with lower index (i.e., S 1 , . . . , S k−1 ) when it makes its transitions in lockstep with them. Hence, the set of propositional variables V S k is the union of V M and 1≤j<k Q S j and all propositional variables in an atom α in Σ S k are therefore either in V M or are control states in the semi-automata S 1 , . . . , S k−1 .
We now define the transition function δ S k of each semi-automaton S k in R for use when all of the semi-automata operate in lockstep. The transition function δ S k : Q S k ×Σ S k → Q S k is deterministic like M 's, but more complicated. For each pair q S k i , α in Q S k × Σ S k , there are two distinct possible cases based on the values of q S k i and α. We now define these cases and the associated transitions: • The pair q S k i , α is active: This occurs when for every j < k, the pair's atom α assigns the control variable q S j i to be false. It corresponds to a situation where S k is the semi-automaton of lowest index in R currently in (its own copy q S k i of) M 's control state q M i and itself also called active. Let β ∈ Σ M be the atom in Σ M obtained from α by only using the propositional variables in V M and thereby ignoring the control variables in α. Now we have that δ M (q M i , β) = q M j for some q M j ∈ Q M . Define the transition δ S k (q S k i , α) to be the corresponding q S k j ∈ Q S k . • The pair q S k i , α is inactive: If the first case does not apply, then S k shares (its copy of) M 's control state q M i with some semi-automaton of lesser index as seen by S k via the atom α. We define the transition δ S k (q S k i , α) to equal the initial control state of S k . Hence S k makes a transition from its current control state to (its copy of) M 's initial control state so in effect reinitialises itself. Our construction of R ensures that some other semi-automaton with lower index which is both active and presently in (its own copy of) the same control state q M i of M now indeed takes over from S k . We also say that S k is inactive and that the two semi-automata merge. Figure 1 gives an example of an deterministic automaton M with four states and a run of an associated compound semi-automaton with five semi-automata S 1 , . . . , S 5 .
Recall that our representation of M 's n control states using n propositional variables q M 1 , . . . , q M n has exactly one of the variables being true at any time. Hence we represent the n control states for a semi-automata S k using n propositional variables q k 1 , . . . , q k n . Therefore the subset of atoms in Σ S k extracted from R's composite runs always have exactly one variable q j i true for each semi-automaton S j with j < k. This property of the runs follows by induction on k. In contrast, the full set of atoms for Σ S k includes for each index j with j < k some pathological atoms in which none or more than one of the q j i are true. Nevertheless, actual runs of S k in R never encounter such atoms so we need not concern ourselves with the precise way δ S k is defined to handle them in transitions.

Formalisation of Suffix Recognition in PITL.
The following lemma formalises the finite-time behaviour of the compound semi-automaton R in PITL and uses an associated chain formula G R in PTL u which we construct in the proof: Lemma 8.1. For any PITL formula B, there exists a compound semi-automaton R with V R = V B and associated ATA D R and chain formula G R such that R's control variables are not in B and the next implication is valid: This lemma provides a way to replace right-instances of a PITL formula B by a chain formula G R in formulas restricted to finite time. However, it serves as basis for later replacing lefthand sides of chops with chain formulas. The lemma is entirely semantic and so does not depend on any particular axiom system or deductions. We will later readily deduce the lemma's implication (8.1) by invoking the completeness for PITL with finite time to obtain immediate theoremhood of the implication and some valid variants of it. Hence, from the standpoint of axiom systems and deductions, there is no need to know Lemma 8.1's proof or even any further details of R, D R and G R .
Proof of Lemma 8.1.. The construction for R ensures that the set union Q S 1 ∪· · ·∪Q S n+1 of control variables of the semi-automata S 1 , . . . , S n+1 contains no elements of the set V B of propositional variables occurring in B.
We will obtain the chain formula G R by mimicking an accepting run of M . This involves combining together pieces of runs from the some of the semi-automata S 1 , . . . , S n+1 . It needs at most n merges since when two semi-automata merge, only the one of lesser index continues testing. The chain formula G R , when suitably combined with the compound semiautomaton R's ATA, will capture the needed behaviour which we previously formalised in the implication (8.1).
We first define state formulas to test for active and merging semi-automata and also introduce a modified acceptance test: Sample automaton M for B (already presented in (7.1)): Control state behaviour of each S k in sample 8-state interval σ: Value of acc ′ k for each S k at end in state σ 7 : false true false false false Some explanations about the sample 8-state interval σ 0 . . . σ 7 : Only control states' indices are shown (e.g., 1 for q 1 ). Active semi-automata are shown in boldface. All control states used in any accepting runs of M are underlined. "S 2 ←" shows merge into semi-automaton S 2 in accepting run for M .
It follows from the definition of an active semi-automaton that j < k. • acc ′ k : Let us also define a propositional test acc ′ k based on the state formula acc M for checking M 's conditional acceptance test τ M . We use a substitution instance of acc M to adapt it to S k and its own copies of M 's control states.
Note that a semi-automaton S has no conditional acceptance test τ S and indeed the role of acc ′ k here somewhat differs from that of acc M . As usual, for an individual semi-automaton S k in the compound semi-automaton R, the state formula init S k tests for the initial control state of S k and the NL 1 formula T S k expresses the transition function δ S k of S k in temporal logic.
Let us now inductively define for each pair j, k : 1 ≤ j ≤ k ≤ n + 1 a chain formula G ′ k,j to be true iff a run segment starts with currently active semi-automaton S k in some unspecified control state, involves exactly j active automata (i.e., j − 1 mergers) and ends with acceptance of the word seen.
For example, the chain formula init S 1 ∧ active 1 ∧ G ′ 1,1 corresponds to an accepting run of M in which the semi-automaton S 1 recognises B on its own. The conjunction init S 2 ∧ active 2 ∧ G ′ 2,2 corresponds to an accepting run of M involving first semi-automaton S 2 and then semi-automaton S 1 . The semi-automaton S 2 starts recognising B and eventually merges with semi-automaton S 1 which completes the accepting run. Now let us construct from the chain formulas G ′ k,j the chain formula G R specifying an accepting run involving some of the n + 1 semi-automata to recognise the PITL formula B. Like in the examples, we start in some active copy of M 's initial control state: The construction of the compound semi-automaton R together with D R and G R ensures the desired validity of implication (8.1).
To assist readers, we list in Table 5 a variety of variables and where they are introduced.

Reduction of PITL to PTL with Until
Most of the remaining part of the PITL completeness proof concerns using compound semiautomata to show right-completeness for PITL k by reduction to PTL u . Recall from §5.4 that any chop construct in a formula A is a right-chop iff it does not occur in another chop's left operand or in a chop-star.
The PITL theorems mentioned here in proofs are found in Table 4 in §7.4 and also Appendix A.  .1, which employs the compound semi-automaton R, generalises suffix recognition to infix recognition for checking which of a (possibly infinite-time) interval's finitetime infix subintervals satisfy some given PITL formula by instead using a chain formula.
Lemma 9.1. For any PITL formula B, there exists a compound semi-automaton R with V R = V B , associated ATA D R and chain formula G R such that R's control variables are not in B and the next formula is a PITL theorem: Proof.. Lemma 8.1 ensures the validity of the implication below for some compound semiautomaton R, associated ATA D R and chain formula G R : This and completeness for PITL with finite time (Theorem 2.2) ensures the next implication's theoremhood: This and Inference Rule ✷ f FGen yield the next formula: Simple reasoning about ✷ f (see PITL Theorem T25) results in the following: We re-express ✷ f ✷ f D R as ✷ f D R and commute ✷ f ✷ (see PITL Theorems T46 and T55) to obtain our goal (9.1).
The lemma below later plays a key role in reducing right-chops in a PITL k formula to PTL u formulas by first replacing their left sides with chain formulas in PTL u : Lemma 9.2. For any PITL formulas B and C, there exists a compound semi-automaton R with V R = V B , associated ATA D R and chain formula G R such that R's control variables are not in B or C and the next formula is deducible as a right-theorem: Proof.. Lemma 9.1 yields R, D R , G R and the next implication for infix recognition of B: Note that this has no right variables. We also employ the next implication which is an instance of PITL Theorem T30 and concerns interval-based reasoning about the left of chop: (9.4) Inference Rule ✷Gen then obtains from implication (9.4) the formula below: This with PTL-based reasoning involving the valid PTL formula ✷(p ⊃ q) ⊃ (✷ p) ⊃ (✷ q) with Axiom VPTL, where p is replaced by ✷ f (B ≡ G R ) and q by (B ⌢ C) ≡ (G R ⌢ C), together with modus ponens results in the following: (9.5) Implications (9.3) and (9.5) and simple propositional reasoning yield our goal (9.2).
Lemma 9.3. Any PITL k formula K in which the left sides of all right chops are chain formulas is deducibly equivalent to some PTL u formula Y , that is, Proof.. Starting with K's right-chops not nested in other right-chops, we inductively replace them by equivalent PTL u formulas. More precisely, if n is the number of K's right chops, then we use n applications of Lemma 5.2 and the Right Replacement Rule (Lemma 4.2) to show that K is deducibly equivalent to some PTL u formula Y (i.e., ⊢ rt K ≡ Y ).

B. MOSZKOWSKI
For example, suppose K is (G 1 ⌢ skip) ∨ G 2 ⌢ (G 3 ⌢ w) and hence has 3 right-chops. We could start by first re-expressing either G 1 ⌢ skip or G 3 ⌢ w by an equivalent PTL u formula. For instance, if G 2 is the chain formula p until empty and G 3 is the chain formula q until empty, then G 3 ⌢ w will be replaced by the equivalent PTL u formula q until w. After this, G 2 ⌢ (G 3 ⌢ w) will first reduce to G 2 ⌢ (q until w) and finally to the PTL u formula p until (q until w).

9.2.
Proof of the Main Completeness Theorem. We now establish right-completeness for PITL k and then use this to obtain right-completeness for PITL.
Lemma 9.4. Any valid PITL k formula can be deduced as a right-theorem.
Proof.. We show that a right-consistent PITL k formula K is satisfiable. Our proof transforms K to a PTL u formula. Let m equal the number of K's right-chops. We employ m compound semi-automata to obtain ATAs for systematically replacing the left operands of K's right-chops by PTL u chain formulas. Note that if m = 0, then K has no chops but perhaps skip so K itself is in PTL. We will construct a sequence of m + 1 PITL k formulas K ′ 1 , . . . , K ′ m+1 . In the final one K ′ m+1 , left operands of all right-chops are chain formulas so K ′ m+1 is deducibly equivalent to some PTL u formula by Lemma 9.3. For example, suppose K has the form ( . Then K has 3 right-chops so m equals 3 and This has the form B i ⌢ K ′′ i for some PITL formula B i and PITL k formula K ′′ i . Lemma 9.2 yields a compound semi-automaton R ′ i , ATA D R ′ i and a chain formula G R ′ i for which the next right-theorem is deducible: We employ Lemma 4.1 concerning replacement of right-instances to relate K ′ i and K ′ i+1 by replacing the selected . This and implication (9.6) together ensure the right-theorem . Without loss of generality, assume the control variables in the compound semi-automata ) just mentioned the next right-theorem: The left operand of each right-chop in K ′ m+1 is a chain formula. Hence by Lemma 9.3, we can deduce the equivalence of K ′ m+1 and some PTL u formula Y to obtain the PITL right-theorem ⊢ rt K ′ m+1 ≡ Y . By this and implication (9.7), the next implication is a right-theorem: (9.8) Right-variables in the original formula K do not occur in any D R ′ i since the construction of each D R ′ i only involves the left sides of K's right-chops. The right-variables in K are still right-variables in Y and implication (9.8). Now K's right-consistency and m applications of Lemma 5.4 ensure the right-consistency of K ∧ 1≤i≤m (✷ f D R ′ i ). This is re-expressible as K ∧ ✷ f D ′ , where the ATA D ′ is the conjunction of the ATAs D R ′ 1 , . . . , D R ′ m (we use PITL Theorem T28). Hence the formula K ∧ ✷ f D ′ is right-consistent. We deduce the equivalence of ✷ f D ′ and some PTL formula X as ⊢ X ≡ ✷ f D ′ by invoking Lemma 7.1 on the individual basic semi-automata in each R ′ i to re-express each one's runs in PTL and then forming the conjunction of results. Now D ′ and X have the same variables. Hence the equivalence X ≡ ✷ f D ′ has no right-variables because of ✷ f D ′ and is a right-theorem (i.e., ⊢ rt X ≡ ✷ f D ′ ). This with the equivalence ⊢ rt ✷ f D ′ ≡ 1≤i≤m (✷ f D R ′ i ) and implication (9.8) then yield the equivalence of formulas K ∧ ✷ f D ′ and Y ∧ X as a right-theorem. Therefore the PTL u formula Y ∧ X, like K ∧ ✷ f D ′ , is right-consistent and by right-completeness for PTL u (discussed in §5.2) is satisfiable as is K.
We now prove our main result Theorem 3.2 about right-completeness for PITL: Proof of Theorem 3.2.. Let A be a right-consistent PITL formula. Lemma 9.4 ensures right-completeness for PITL k . Hence by this and Lemma 6.2, there exists some PITL k formula K having the same variables and right-variables as A and with the deducible equivalence ⊢ rt A ≡ K. Now K like A is right-consistent and so satisfiable by right-completeness for PITL k (Lemma 9.4). Hence A is satisfiable.
As we already remarked in Section 3, the completeness proof can be regarded as two parallel proofs. The simpler one uses the extra inference rule (3.2) mentioned there to avoid right-theorems and right-completeness. The more sophisticated proof uses righttheoremhood instead of the inference rule and ensures that any valid PITL formula is not just a theorem but a right-theorem.
This concludes the PITL completeness proof.

Some Observations about the Completeness Proof
We now consider various issues concerning the new PITL axiom system and techniques employed in the completeness proof. Most of the points address questions previously raised by others.
10.1. Alternative Axioms for PTL. Axiom VPTL in Table 2 can optionally be replaced by four lower level axioms. Readers may wish to skip over the details now given. One of the lower level axioms is Taut in Table 3 permitting PITL formulas which are substitution instances of conventional (nonmodal) tautologies. For example, from the valid propositional formula p ⊃ (p ∨ q) follows ⊢ A ⊃ (A ∨ B), for any PITL formulas A and B. The other three axioms involve PTL. These are Axioms F10 and F11 found in Table 3 and also ⊢ skip ⊃ finite. The three Axioms Taut, F10 and F11 together with the remaining PITL axioms and inference rules in Table 2 then suffice to derive a slight variant proposed by us in [Mos04] of the complete PTL axiom system D 0 X for and ✸ (and ✷) of Gabbay et al. [GPSS80], itself based on an earlier one DX of Pnueli [Pnu77]. We denote our D 0 X variant here as D 0 X ′ . It permits both finite and infinite time, whereas D 0 X assumes infinite time. We previously did an explicit deduction of D 0 X ′ in our completeness proof for PITL with just finite time as described in [Mos04]. However, for infinite time we need the additional axiom ⊢ skip ⊃ finite because Axiom P6 (unlike Axiom F6 in Table 3) does not suffice on its own to deduce ⊢ skip ≡ empty to re-express skip using . Without ⊢ skip ⊃ finite, we can only deduce the PITL theorem ⊢ finite ⊃ (skip ≡ empty) from Axiom P6 together with the definition of in terms of skip and chop. In addition, from D 0 X ′ (once deduced), we can obtain ⊢ ( empty) ⊃ finite. These two implications combined with ⊢ skip ⊃ finite and simple propositional reasoning (involving Axiom Taut and modus ponens) yield our goal ⊢ skip ≡ empty.
10.2. Feasibility of Reduction from PITL to PTL. Some people have expressed serious doubts about our proof's technical feasibility owing to the significant gap in expressiveness between PITL and PTL. We therefore believe it is worthwhile to emphasis that in spite of this gap, any PITL formula can be represented by some PTL formula containing auxiliary variables. This is because conventional semantic reasoning about omega-regular languages and omega automata ensures that for any PITL formula A, there exist conventional nondeterministic omega automata (such as Büchi automata) which recognise A. For example, we present in [Mos00] a decidable version of quantified ITL which includes QPITL (defined earlier in Section 2) as a subset and then show how to encode formulas in Büchi automata. Various deterministic omega automata (e.g., with Muller, Rabin and Streett acceptance conditions) are also suitable for this. Such an automaton's accepting runs can be trivially encoded by some PTL formula X with auxiliary variables p 1 , . . ., p n representing the automaton's control state. Hence the PITL formula A and the QPTL formula ∃p 1 . . . p n . X are semantically equivalent, where ∃ is defined earlier in Section 2. Furthermore, the (quantifier-free) PITL implication X ⊃ A is valid and consequently any model of X can also serve as one for A. Indeed the technique of re-expressing formulas in omegaregular logics by means of nondeterministic and deterministic omega automata expressed in versions of PTL (subsequently enclosed in a simple sequence of existential quantifiers) is central to the completeness proofs for QPTL variants by Kesten and Pnueli [KP02] and French and Reynolds [FR03]. A related approach can be used to reduce decidability of PTL with the (full) until operator to PTL without until . This works in spite of the fact that PTL with until is strictly more expressive as proved by Kamp [Kam68] (see also Kröger and Merz [KM08]). We replace each until in a formula with an auxiliary variable which mimics its behaviour along the lines of the two axioms for until previously mentioned in §5.2. For example, when testing the satisfiability of the formula p ∧ (p until q) ∧ ¬(p until q), we transform it into the formula below with an extra auxiliary variable r:

Benefits of Restricted Chop-Stars in Chain
Formulas. Lemma 9.4 states that any valid PITL k formula can be deduced as a right-theorem. Within the proof of this lemma, all chop-star formulas found in the PITL k formula K ′ m+1 only occur in chain formulas. Such chop-star formulas therefore have the very restricted form (skip ∧ T ) ⋆ for expressing the PITL-based version of until defined earlier in §5.2 for PTL u . The simplicity of these chop-star constructs greatly helps us to reduce K ′ m+1 to the semantically equivalent PTL u formula Y and show that their equivalence is a deducible theorem. Incidentally, in [Mos07] we prove that any PITL formula (skip ∧ T ) ⋆ can be expressed in PTL as ✷(more ⊃ T ) and make extensive use of this equivalence. In contrast, arbitrary chop-star formulas cannot necessarily be re-expressed as semantically equivalent PTL formulas. 10.4. Thomas' Theorem and the Size of Deductions. Section 6 uses Thomas' theorem to re-express a PITL formula A as a semantically equivalent PITL k formula K. The two known proofs of Thomas' theorem by Thomas himself [Tho79] and Choueka and Peleg [CP83] unfortunately do not ensure that K is in some sense natural and succinct or even obtainable in a computationally feasible way. Therefore our completeness proof does not guarantee simple deductions. The main problem concerns the difficulties in nontrivial transformations on the underlying omega automata representing PITL formulas. Other established completeness proofs for comparable omega-regular logics with nonelementary complexity such as QPTL [KP95,KP02,FR03] currently share a similar fate. However, our proof bypasses an explicit embedding of the intricate process of complementing nondeterministic omega automata.
10.5. Justification for Using ATAs in the Completeness Proof. Some readers will wonder why we need ATAs introduced in §7.3 and do not just use the PTL-based representation of semi-automata and automata presented in §7.1 and §7.2. The main reason is that, as far as we currently know, this requires a more intricate inference rule than our PITLbased one ✷ f Aux. In particular, a PTL-based rule suitable for our purposes must permit the simultaneous introduction of multiple auxiliary propositional variables analogous to the one French and Reynolds [FR03] were compelled to employ for QPTL without past time (see also [KM08]).

Existing Completeness Proofs for Omega-Regular Logics
We now compare our axiomatic completeness proof with related ones for other omegaregular logics. Here is a list of a number of such formalisms:  [Eme90]. Like S1S and QPTL, PITL has nonelementary complexity (e.g., see our results in collaboration with J. Halpern in [Mos83a] (reproduced in [Mos04])). In contrast, ETL and νTL have only elementary complexity. 11.1. Omega-Regular Logics with Nonelementary Complexity. Let us consider axiomatic completeness for omega-regular logics which, like PITL, have nonelementary complexity. We later discuss some with elementary complexity in §11.2.
We are not the first to consider a version of quantifier-free PITL with infinite time. Paech [Pae89] in a workshop paper presents completeness proofs for Gentzen-style axiom systems for versions of a Regular Logic with branching-time and linear-time and both finite and infinite time (see also [Pae88]). The linear-time variant LRL can be regarded as PITL with the addition of a binary temporal operator unless. Paech's framework is presented in a rather different way from ours to accommodate both branching-time and linear-time models of time, with the overwhelming emphasis on the branching-time one. Perhaps more significantly, the chop-star operator A * in LRL is limited, like Kleene star, to finitely many iterations (we look at a closely related PITL subset, called by us PITL k , in §5.3). Due to a theorem of Thomas [Tho79] (which we discuss and use in §5.3 and Section 6), LRL has omega-regular expressiveness, although it is less succinct than full PITL. Paech's restricted chop-star does not support chop-omega's infinite iteration. Indeed, Thomas' theorem is not at all mentioned in the completeness proof and does not serve as a bridge in the way we apply it in Section 6. Paech's stimulating and valuable presentation is quite detailed, especially in the extended version [Pae88]. Nevertheless, in our opinion (based on many years of experience with doing proofs in ITL), its treatment of LRL needs some clarification, as the following points demonstrate: • The unwinding of chop-star does not take into account that for induction over time to work in PITL, individual iterations need to take at least two states. This contrasts with our Axioms P9 and P10 in Table 2 and an analogous one which Bowman and Thompson use in [BT03]. Kono's tableaux-based decision procedure for PITL [Kon95] likewise ensures that iterations have more than one state. • The proof system includes nonconventional rules requiring some temporal formulas to be in a form analogous to regular expressions. • The main proof concerns a branching-time semantics. In contrast, only a couple of sentences are devoted to extending the proof to a linear-time interval framework appropriate for LRL. • The completeness proof uses constructions involving deterministic automata for finite words. It also mentions Thomas' theorem which ensures omega-regular expressiveness of LRL. Now the proof by Choueka and Peleg [CP83] of Thomas' theorem using standard deterministic omega automata quite clearly shows the link between LRL and these automata. However Paech does not discuss how the LRL completeness proof relates to techniques previously developed by McNaughton [McN66] and others for building deterministic omega automata from deterministic automata for finite words in order to recognise omega-regular languages. Some kind of explicitly described adaptation of such methods seems to us practically unavoidable. In contrast, our proof quite clearly benefits from this work as we discuss in detail in §8. • Except for the LRL construct L 0 (the same as empty in PITL), no derived intervaloriented operators are defined (e.g, to examine prefix subintervals or to perform a test in a finite interval's final state). Moreover, it does not appear that the LRL proof system was ever used for anything. • One minor puzzling feature of the LRL axiom system is that in its stated form, the linear-time proof rules for Paech's unary construct A (which is actually the weak-next operator w mentioned by us in Table 3) ensure that every state has a successor state.
This clearly forces the linear-time variant to be limited to infinite state sequences. In practice, such a requirement is counterproductive for LRL, which permits finite time and in particular has a primitive finite-time construct L 1 that is identical to our own construct skip for two-state intervals. The LRL formula L * 1 is used in rules to force finite intervals. The LRL proof rules for which impose infinite time clash with rules containing the formula L * 1 and likewise with rules having L 0 to specify one-state intervals. However, the difficulty with the LRL operator and infinite intervals seems to be an easily correctable oversight. Unfortunately, no subsequent versions of Paech's completeness proof for LRL with more explanations and clarifications have been published. Indeed, the difficulties faced at the time by Paech and others such as Rosner and Pnueli [RP86] (discussed below) when attempting to develop complete axiomatisations of versions of ITL with infinite time were such that subsequent published work in this area did not appear until over ten years later. Incidentally, the manner of Paech's proof based on Propositional Dynamic Logic (PDL) [FL79,HKT00] and the associated Fischer-Ladner closures suggests that it could have connections with much later research by Henriksen and Thiagarajan [HT99] on axiomatising Dynamic Linear Time Temporal Logic, a formalism combining PTL and PDL which we shortly mention in §11.2. On the other hand, our own PITL completeness proof here and our earlier one for PITL with just finite time [Mos04] do not involve Fischer-Ladner closures.
Completeness proofs for logics such as S1S [Sie70], QPTL with past time [KP95,KP02] and without past time [FR03] and one by us for quantified ITL with finite domains [Mos00] use quantified formulas encoding omega automata and explicit deductions involving nontrivial techniques to complement them. As we already noted in Section 1, our earlier axiomatic completeness proof [Mos00] for quantified ITL with finite domains requires the use of quantifiers and does not work when formulas were limited to have just propositional variables. French and Reynold's [FR03] axiom system for QPTL without past time contains a nontrivial inference rule for introducing a variable number of auxiliary variables. This inference rule is required by the automata-based completeness proof.
The axiomatic completeness proofs for the logics with quantification just mentioned with nonelementary complexity involve using quantified auxiliary variables to re-express a formula A as another semantically equivalent formula ∃p 1 . . . p n . X, where ∃ for QPITL and QPTL is defined earlier in Section 2. Here p 1 , . . . , p n are the auxiliary variables and X is a formula in a much simpler logical subset, such as some version of (quantifier-free) PTL. Axiomatic completeness for the subset is much easier to show than for the original logic. Completeness is then proved by the standard technique of demonstrating that any consistent formula A (i.e., not deducibly false) in the full logic is also satisfiable. In particular, we deduce as a theorem the equivalence A ≡ ∃p 1 . . . p n . X. Now from this, the assumed logical consistency of A and simple propositional reasoning, we readily obtain consistency for ∃p 1 . . . p n . X. Standard reasoning about quantifiers then ensures X is consistent. Completeness for the logical subset yields a model for X which can also serve as one for A. Normally in such completeness proofs, the formula X encodes some kind of omega automaton such as a nondeterministic Büchi automata. The details are not relevant for our purposes here. The deduction of the equivalence A ≡ ∃p 1 . . . p n . X in these proofs has always involved explicitly embedding nontrivial techniques for manipulating such omega automata.
In contrast to our approach, most of the established axiomatic completeness proofs for logics with nonelementary complexity need quantifiers. The one exception is Paech's Regular Logic, which does not have quantifiers and in linear time is like our PITL k , the subset of PITL without chop-omega defined earlier in §5.3. Our quantifier-free proof also benefits from the hierarchical application of some previously obtained semantic theorems and related techniques expressible as valid formulas in restricted versions of PITL (such as PITL with just finite time). This largely spares us from explicit, tricky reasoning about complementing omega automata. Once we have ensured axiomatic completeness for these versions of PITL, valid formulas in them can be immediately deduced as theorems. For example, we invoke (without proof) the theorem of Thomas at the end of [Tho79] to show that PITL k has the same expressiveness as full PITL. Our completeness proof then combines this result with completeness for PITL k to demonstrate that any PITL formula is deducibly equivalent to one in PITL k .
Our completeness proof for PITL with both finite and infinite time does not actually require a proof of the axiomatic completeness of a version of PTL with this time model because Axiom VPTL in Table 2 includes all substitution instances of valid PTL formulas. For our purposes, even axiomatic completeness for PTL u can be based on a reduction to PTL which invokes Axiom VPTL. However, as we noted in §10.1, some alternative, lower level axioms for the PITL axiom system can be used which would actually involve the reliance on a complete PTL axiom system. Our older axiom system for PITL with just finite time in Table 3 includes explicit axioms of this sort but of course can be readily modified to similarly use just a version of Axiom VPTL for finite time.
Even if we choose to use the alternative axioms and therefore explicitly rely on some provably complete PTL axiom system, the proofs are fairly easy to obtain via tableaux and other means (e.g., see Gabbay et al. [GPSS80], Lichtenstein and Pnueli [LP00], Kröger and Merz [KM08] and Moszkowski [Mos07]). Such methods often have associated practical decision procedures which in many cases are not so hard to implement. This contrasts with the explicit encoding in deductions of much more difficult automata-theoretic and combinatorical techniques to complement omega-regular languages in completeness proofs for other omega-regular logics with nonelementary complexity such as S1S [Sie70] and two versions of QPTL [KP02,FR03]. Furthermore, the completeness proofs for QPTL in any case also rely on reductions to some form of axiomatic completeness for PTL (which, like in our presentation, can be used without reproving it). Those QPTL axiom systems could alternatively be modified to include a suitable version of our Axiom VPTL. So even if we add a few extra axioms for PTL, we still feel justified in regarding our approach, which is partly based on invoking Thomas' theorem without having to encode a proof of it in deductions, as indeed being much more implicit than previous completeness proofs for omega-regular logics with nonelementary complexity such as S1S and QPTL.
Remark 11.1. As noted above, unlike previous automata-based approaches, ours avoids explicitly defining omega automata and embedding various associated explicit deductions concerning complicated proofs of some known results about them. Nevertheless, omega automata can be used in a simple semantic argument ensuring that for any satisfiable PITL formula, there exists some satisfiable PTL formula which implies it. This is because any omega-regular language can be recognised by such an automaton which itself is encodable in a QPTL formula of the form ∃p 1 . . . p n . X ′ , for some PTL formula X ′ . So for any PITL formula, there is some semantically equivalent QPTL formula of this kind and its quantifierfree part therefore implies the PITL formula. Clearly, the PITL formula is satisfiable iff the PTL subformula is.
Rosner and Pnueli's version of PITL [RP86] with infinite time and without chop-star is not an omega-regular logic since it has the (more limited) expressiveness of conventional PTL. Nevertheless, it in common with S1S, QPTL and PITL has nonelementary computational complexity. Rosner and Pnueli's complete axiom system includes a complicated inference rule which requires the construction of a  [Kai95] subsequent less complicated completeness proof for just νTL uses a partially semantic approach which has some similar aims to ours for PITL, but is nevertheless technically quite different. It involves a clever normal form and tableaux. Every formula is shown to be deducibly equivalent to one in the normal form. We believe that our proof, although longer, is in certain respects more natural and straightforward than even Kaivola's at the deductive level.
Dynamic Linear Time Temporal Logic combines PTL and Propositional Dynamic Logic (PDL) [FL79,HKT00] in a linear-time framework with infinite time. The axiom system for this formalism has axioms concerning a variety of transitions [HT99]. The completeness proof is an adaptation of an earlier one for PDL by Kozen and Parikh [KP81]. It uses consistent sets of formulas.

Future Work
Our plans include using the axiom system as a hierarchical basis for completeness of PITL variants with weak chop and chop-star taken as primitives as well as quantification. Further possibilities include multiple time granularities (see our work [Mos95] for finite time), a temporal Hoare logic and also logics such as QPTL (by encoding within QPTL a complete axiom system for quantified PITL instead using of omega automata). The last would show interval logics can be applied to point-based ones.
In [Mos04], we used semantic techniques to prove axiomatic completeness for PITL with finite time by a simple reduction to an equally expressiveness subset called by us Fusion Logic and closely related to Propositional Dynamic Logic (PDL) [FL79,HKT00]. Fusion Logic, like some variants of PDL, uses discrete linear sequences of states instead of binary relations as its semantic basis. Some of the semantic techniques we presented in Section 6 for reducing PITL to its expressively equivalent subset PITL k by eliminating instances of chop-omega could shorten the completeness proof for Fusion Logic in [Mos04], since that proof contains a similar elimination of chop-star by reduction down to PTL. Furthermore, our completeness proof for PITL with just finite time in [Mos04] uses a separate complete axiom system for Fusion Logic. This now seems unnecessary for the overall completeness proof for PITL with finite time. Instead, the PITL axiom system should also suffice for Fusion Logic in view of our positive experiences with the current much more streamlined approach for PITL with infinite time.
The PITL operators ✸ f and ✷ f for finite prefix subintervals play a major role in our new completeness proof and appear worthy of more consideration. For example, we have recently studied techniques for reasoning about them with time reversal [Mos11]. This is a natural mathematical way to exploit the symmetry of time in finite intervals. We can show the validity of suitable finite-time formulas concerning ✷ f and prefix subintervals from the validity of analogous ones for ✷ and suffix subintervals which themselves might even be in conventional PTL with the operator until . The time symmetry considered here only applies to finite intervals. However, a valid finite-time formula obtained in this way can sometimes then be generalised to infinite intervals. One potential use of time reversal is to provide an algorithmic reduction of suitable higher-level PITL formulas to lower-level PTL ones for model checking. It also helps extend compositional techniques we described in [Mos94,Mos96,Mos98].

Conclusions
We have presented a simple axiom system for PITL with infinite time and proved completeness using a semantic framework and reductions to finite time and PTL. Our axiom system is demonstrably simpler than the one which Paech presents for LRL, even though we support omega-iteration and LRL does not. Moreover, the explicitly stated deductions in our proof can be regarded as being technically less complex then others for quantified omega-regular logics with nonelementary complexity such as S1S and QPTL. This is because known completeness proofs for those logics involve an explicit deductive embedding of proofs of theorems about complementing omega-regular languages and require reasoning about nontrivial algorithms (typically utilising quantifier-based encodings of omega automata). Such completeness proofs therefore do not merely use one such theorem but incorporate significant aspects of its complicated proof, in effect reproving it. In contrast, we simply invoke Thomas' theorem without referring to how it is proved. In our opinion, this conforms much more to the conventional mathematical practice of using previously established theorems, even hard-to-prove ones, as modular "black boxes". However, we appreciate that some readers will argue about the significance of this technical point.
The overall results we have described in our new completeness proof seem to complement our recent analysis of PTL using PITL [Mos07]. One surprise during the development of our completeness proof concerned how much explicit deductions could be minimised by application of valid properties proved with semi-automata and automata on finite words. Another unexpected benefit arose from the insights into time reversal.
In principle, ⊃-chain and ≡-chain are subsumed by Prop but are used here to make the reasoning more explicit.
• PITLF: Our assumption of axiomatic completeness for PITL with just finite time permits any valid implication of the form finite ⊃ A.
A.1. Some Basic Properties of Chop.
We now consider deducing various simple properties of chop and the associated operators ✸ f , ✷ f , ✸ and ✷ which have a wide range of uses.
The following derived variant of Inference Rule ✷ f FGen omits the subformula finite: The derived inference rule DR4 can also be referred to as ✷ f Gen (analogous to the inference rule ✷Gen).

DR5
⊢ The proof for ⊃ is immediate from axiom P3. Here is the proof for ⊂: Some Properties of ✷ f involving the Modal System K and Axiom D.
The two pairs of operators ✷ and ✸ and ✷ f and ✸ f obey various standard properties of modal logics. Axiom VPTL helps streamline reasoning involving ✷ and ✸. The situation with ✷ f and ✸ f is quite different since they lack a comparable axiom. Therefore, it is especially beneficial to review some conventional modal systems which assist in organising various useful deductions involving ✷ f and ✸ f . Table 6 summarises some relevant modal systems, various associated axioms and inference rules. Chellas [Che80] and Hughes and Cresswell [HC96] give more details.
Within PITL, as in PTL, the operator ✷ can be regarded as the conventional unary necessity modality L and the operator ✸ as the dual possibility operator M . The two operators together fulfil the requirements of the modal system S4. We do not need to explicitly prove versions of the S4 axioms in Table 6 for ✷ and ✸. Rather, any PITL formula which is a substitution instance of a valid S4 formula involving ✷ and ✸ can be readily deduced using the PITL proof system's Axiom VPTL. Similarly, inference rules

System
Axiom or inference rule Axiom or rule name K plus 4 and ⊢ L A ⊃ M A D Table 6: Some standard modal systems based on S4 can be obtained with Axiom VPTL, Inference Rule ✷Gen (which corresponds to the inference rule N of S4 ) and modus ponens. Moreover, the PITL proof system's Axiom VPTL permits using any PITL formula which is a substitution instance of some valid PTL formula which can also contain the PTL operator . In view of all this, we do not give much further consideration to aspects of S4 with ✷ and ✸.
In contrast to ✷, the PITL operator ✷ f does not have a comprehensive axiom analogous to VPTL. Therefore, we need to explicitly prove in the PITL axiom system various modal properties of ✷ f and its dual ✸ f . If only finite time is allowed, then ✷ f and ✸ f act as an S4 system. However, ✷ f with infinite time permitted does not fulfil the requirements of S4, or even those of the weaker modal system T, because Axiom T fails. Instead, ✷ f with infinite time fulfils the requirements of the modal system KD4 which is strictly weaker than S4.
Here is a list of KD4 's axioms and inference rules and related PITL proofs for ✷ f : If only finite time is allowed, then the implication D does not need to be regarded as an explicit axiom since it can be inferred from any proof system for S4.
Remark A.1. It is also worth noting that the related operators ✷ i and ✸ i (defined using weak chop in Table 1 in Section 2) obey the modal system S4 even when infinite time is permitted. However, we prefer to work with ✷ f and ✸ f since the use of strong chop simplifies the overall PITL completeness proof.
Conventional model logics usually take L, not M , to be primitive. When we deduce standard modal properties for ✷ f and ✸ f in our PITL axiom system, we let M , which corresponds to ✸ f , be primitive and define L to be M 's dual (i.e., L A def ≡ ¬M ¬A). This M -based approach goes well with the PITL axioms for chop. Chellas [Che80] discusses some alternative axiomatisations of modal systems with M as the primitive although none correspond directly to ours. For the system K, we can deduce implication (A.1) below for ✷ f and ✸ f (see Theorem T23 later on) and then obtain from it together some other reasoning the more standard axiom K just presented which only mentions L: (A.1) The operators ✷ and ✷ f together yield a multi-modal logic with two necessity constructs L and L ′ which are commutative: This corresponds to our Theorem T55 given later on.
Below are various theorems and derived inference rules about ✷ f and ✸ f for obtaining the axioms M-def (Theorem T22) and K (Theorem T25) found in the modal system K. The associated inference rule N was already proved above as Derived Inference Rule DR4. We also prove the modal axiom D (Theorem T33).
In the next proof's final step, recall that ≡-chain indicates a chain of equivalences: A.3. Some Properties of Chop, ✸ f and ✷ f with State Formulas. T36 The following lets us move a state formula into the left side of chop: 2,3,⊃-chain We can easily combine this with theorem T39 to deduce the equivalence below: Below is a useful corollary of T41 used in decomposing the left side of chop: A.4. Some Properties of ✷ f involving the Modal System K4.
We now consider how to establish for the PITL operator ✷ f the axiom "4" (PITL Theorem T47) found in the modal systems K4 and S4.
We make use of the following analogue of Theorem T44 for ✸ and ✷: A.7. Some Properties of Chop-Star.
We now consider some theorems and derived rules concerning chop-star. We now present some derived inference rules which come in useful when completeness for PITL with finite time is assumed (see Theorem 2.2). Recall that any valid implication of the form finite ⊃ A is allowed and that we designate such a step by using PITLF. PITL Theorem T61 below illustrates this technique.

DR59
⊢ The next theorem's proof involves the application of the previous derived inference rule together with completeness for PITL with just finite time: 2,4,5,7,≡-chain An alternative proof of Theorem T61 can be given without PITLF by first deducing the dual equivalence ✸ f ✸(empty ∧ w) ≡ ✸ w, for any state formula w.
A.9. Some Properties of Skip, Next And Until. Recall from §5.1 that NL 1 formulas are exactly those PTL formulas in which the only temporal operators are unnested s (e.g., p ∨ ¬p but not p ∨ ¬p). The next theorem holds for any NL 1 formula T : T62 ⊢ ✸ f (more ∧ T ) ≡ more ∧ T Proof.. We use Axiom VPTL to re-express more ∧ T as a logically equivalent disjunction 1≤i≤n (w i ∧ w ′ i ) for some natural number n ≥ 1 and n pairs of state formulas w i and w ′ i : Now by Theorem T50 any conjunction w ∧ w ′ is deducibly equivalent to ✸ f (w ∧ w ′ ). Therefore the disjunction in (A.2) can be re-expressed as Then by n − 1 applications of Theorem T34 and some simple propositional reasoning, the righthand operand of this equivalence is itself is deducibly equivalent to ✸ f 1≤i≤n (w The chain of the three equivalences (A.2)-(A.4) yields the following: We then apply Derived Rule DR8 to the first equivalence (A.2): The last two equivalences with simple propositional reasoning yield our goal T62.