EXPTIME Tableaux for the Coalgebraic mu-Calculus

The coalgebraic approach to modal logic provides a uniform framework that captures the semantics of a large class of structurally different modal logics, including e.g. graded and probabilistic modal logics and coalition logic. In this paper, we introduce the coalgebraic mu-calculus, an extension of the general (coalgebraic) framework with fixpoint operators. Our main results are completeness of the associated tableau calculus and EXPTIME decidability for guarded formulas. Technically, this is achieved by reducing satisfiability to the existence of non-wellfounded tableaux, which is in turn equivalent to the existence of winning strategies in parity games. Our results are parametric in the underlying class of models and yield, as concrete applications, previously unknown complexity bounds for the probabilistic mu-calculus and for an extension of coalition logic with fixpoints.


Introduction
The extension of a modal logic with operators for least and greatest fixpoints leads to a dramatic increase in expressive power [1].The paradigmatic example is of course the modal µ-calculus [14].In the same way that the µ-calculus extends the modal logic K, one can freely add fixpoint operators to any propositional modal logic, as long as modal operators are monotone.Semantically, this poses no problems, and the interpretation of fixpoint formulas can be defined in a standard way in terms of the semantics of the underlying modal logic.
This apparent simplicity is lost once we move from semantics to syntax: completeness and complexity even of the modal µ-calculus are all but trivial [27,7], and µ-calculi arising from other monotone modal logics are largely unstudied, with the notable exception of the graded µ-calculus [21].Here, we improve on this situation, not by providing a new complexity result for a specific fixpoint logic, but by providing a generic and uniform treatment allows us to determine satisfiability of a fixpoint formula by deciding the associated (parity) tableau game, and the announced Exptime upper bound for guarded formulas follows once we can ensure that legality of moves in the tableau game can be decided in exponential time.
Related Work.Our treatment is inspired by [17,26,24], but we note some important differences.In contrast to [17], we use parity games that directly correspond to tableaux, together with parity automata to detect bad traces.Moreover, owing to the generality of the coalgebraic framework, the model construction here needs to super-impose a coalgebra structure on the relation induced by a winning strategy.This construction is necessarily different from [24], since we cannot argue by induction on modal rank in the presence of fixpoints.Coalgebraic fixpoint logics are also treated in [26], where an automata theoretic characterisation of satisfiability is presented.We add to this picture by providing complexity results and a complete tableau calculus.Moreover, we use standard syntax for modal operators, which allows us to subsume for instance the graded µ-calculus that cannot be expressed in terms of the ∇-operator used in op.cit.

The Coalgebraic µ-Calculus
To keep our treatment fully parametric in the underlying (modal) logic, we define the syntax of the coalgebraic µ-calculus relative to a (fixed) modal similarity type, that is, a set Λ of modal operators with associated arities.Throughout, we fix a denumerable set V of propositional variables.We will only deal with formulas in negation normal form and abbreviate Λ = {♥ | ♥ ∈ Λ} and V = {p | p ∈ V}.The arity of ♥ ∈ Λ is the same as that of ♥.The set F(Λ) of Λ-formulas is given by the grammar A, B :: where p ∈ V ∪ V, ♥ ∈ Λ ∪ Λ is n-ary and p does not occur in A in the last two clauses.The sets of free and bound variables of a formula are defined as usual, in particular p is bound in µp.A and νp.A. Negation • : F(Λ) → F(Λ) is given inductively by p = p, A ∧ B = A ∨ B, ♥(A 1 , . . ., A n ) = ♥(A 1 , . . ., A n ) and µp.A = νp.A[p := p] and the dual clauses for ∨ and ν.If S is a set of formulas, then the collection of formulas that arises by prefixing elements of S by one layer of modalities is denoted by (Λ ∪ Λ)(S) = {♥(A 1 , . . ., A n ) | ♥ ∈ Λ ∪ Λ n-ary, A 1 , . . ., A n ∈ S}.A substitution is a mapping σ : V → F(Λ) and Aσ is the result of replacing all free occurrences of p ∈ V in A by σ(p).
On the semantical side, parametricity is achieved by adopting coalgebraic semantics: formulas are interpreted over T -coalgebras, where T is an (unspecified) endofunctor on sets, and we recover the semantics of a large number of logics in the form of specific choices for T .To interpret the modal operators ♥ ∈ Λ, we require that T extends to a Λ-structure and comes with a predicate lifting, that is, a natural transformation of type [[♥]] : 2 n → 2 • T op for every n-ary modality ♥ ∈ Λ, where 2 : Set → Set op is the contravariant powerset functor.In elementary terms, this amounts to assigning a set-indexed family of functions ([[♥]] X : P(X) n → P(T X)) X∈Set to every n-ary modal operator ♥ ∈ Λ such that (T f We usually denote a structure by the endofunctor T and leave the definition of the predicate liftings implicit.A Λ-structure is monotone if, for all sets X we have that [[♥]] X (A 1 , . . ., A n ) ⊆ [[♥]] X (B 1 , . . ., B n ) whenever A i ⊆ B i for all i = 1, . . ., n.
In the coalgebraic approach, the role of frames is played by T -coalgebras, i.e. pairs (X, γ) where X is a set (of states) and γ : X → T X is a (transition) function.A T -model is a triple (X, γ, h) where (X, γ) is a T -coalgebra and h : V → P(X) is a valuation of the propositional variables that we implicitly extend to V ∪ V by putting h(p) = X \ h(p).For a monotone Λ-structure T and a T -model M = (X, γ, h), the truth set [[A]] M of a formula A ∈ F(Λ) w.r.t.M is given inductively by where LFP(A M p ) and GFP(A M p ) are the least and greatest fixpoint of the monotone mapping A M p : P(X) → P(X) defined by A M p (U ) = [[A]] M ′ where M ′ = (X, γ, h ′ ) and h ′ (q) = h(q) for q = p and h ′ (p) = U .We write M, x |= A if x ∈ [[A]] M to denote that A is satisfied at x.A formula A ∈ F(Λ) is satisfiable w.r.t. a given Λ-structure T if there exists a T -model M such that [[A]] M = ∅.The mappings A M p are indeed monotone in case of a monotone Λ-structure, which guarantees the existence of fixpoints.
2. The syntax of the graded µ-calculus [21] is given (modulo an index shift) by the similarity type Λ = { n | n ≥ 0} where n = [n], and n A reads as "A holds in more than n successors".In contrast to op. cit.we interpret the graded µ-calculus over multigraphs, i.e. coalgebras for the functor B B(X) = {f : X → N | supp(f ) finite} where supp(f ) = {x ∈ X | f (x) = 0} is the support of f , that extends to a structure Note that this semantics differs from the Kripke semantics for both graded modal logic [10] and the graded µ-calculus.The change of the semantics is needed in order to fit graded modal logic into the coalgebraic framework, because in the standard semantics of graded modal logic we cannot interpret the modalities by natural transformations.Both types of semantics, however, induce the same satisfiability problem: image-finite Kripke frames are multigraphs where each edge has multiplicity one, and the unravelling of a multigraph can be turned into a Kripke frame by inserting the appropriate number of copies of each state.
The transformations preserve satisfiability.The fact that the two types of semantics induce the same satisfiability problem makes use of the fact that the graded µ-calculus has the tree-model property ( [21]): a formula of the graded µ-calculus is satisfiable on some Kripke frame iff it is satisfiable on a tree of finitely bounded branching degree.Alternatively, the fact that the two satisfiability problems are equivalent can be also obtained from the results in this paper by showing that the tableau calculus for the graded µ-calculus is sound over the class of all Kripke frames.3. The probabilistic µ-calculus arises from the similarity type Λ = { p | p ∈ [0, 1] ∩ Q} where p = [p] and p φ reads as "φ holds with probability at least p in the next state".
The semantics of the probabilistic µ-calculus is given by the structure where U ⊆ X and → f indicates maps with finite support.Coalgebras for D are precisely image-finite Markov chains, and the finite model property of the coalgebraic µ-calculus that we establish later ensures that satisfiability is independent of image-finite semantics.
4. Formulas of coalition logic over a finite set N of agents [18] arise via Λ = {[C] | C ⊆ N }, and are interpreted over game frames, i.e. coalgebras for the functor which is a class-valued functor, which however fits with the subsequent development.We think of S i as the set of strategies for agent i and f is an outcome function.The formula [C]A reads as "coalition C can achieve A", which is captured by the lifting The induced coalgebraic semantics is precisely the standard semantics of coalition logic, ie., the formula [C]A holds at a state x if all agents i in the coalition C can choose a strategy s i at x such that, for all possible strategy choices of agents in N \ C at position x, the play proceeds to a state x ′ that satisfies property A.
5. Finally, the similarity type Λ = { } of monotone modal logic [2] has a single unary (we write = ♦) and interpret the ensuing language over monotone neighbourhood frames, that is, coalgebras for the functor / structure for U ⊆ X which recovers the standard semantics in a coalgebraic setting [12].It is readily verified that all structures above are indeed monotone.

The Model-Checking Game
We start by characterising the satisfaction relation between states of a model and formulas of the coalgebraic µ-calculus in terms of a two-player parity game that we call the model checking game.This characterisation will be the main technical tool for establishing soundness and completeness of an associated tableau calculus.
The game that we are about to describe generalises [25, Theorem 1, Chapter 6] to the coalgebraic setting, and is a variant of the game used in [6].We begin by fixing our terminology concerning parity games.
A parity game played by ∃ ( Éloise) and A strategy in G for a player P ∈ {∃, ∀} is a partial function that maps all plays that end in a position b ∈ B P of P with Intuitively, a strategy determines a player's next move, depending on the history of the game in all positions where the player can move.Given a strategy s for player P in G we say that a play (b 0 , . . ., b i , . . . ) of G is played according to s if for all proper prefixes b 0 . . .b i of π with b i ∈ B P we have s(b 0 . . .b i ) = b i+1 .A strategy for a player P ∈ {∃, ∀} is called history-free or positional if it only depends on the last position of a play.Formally, a history-free strategy for player P ∈ {∃, ∀} is a partial function s : and s is a winning strategy from position b ∈ B if P wins all plays with initial position b that are played according to s.
It is known that parity games are history-free determined [8,16] and that winning regions can be decided in UP ∩ co-UP [13].We will now introduce the model checking game as a parity game.The model checking game is played on pairs (A, x) where A is a formula and x is a state, and (informally) ∀ tries to demonstrate that x |= A whereas ∃ claims the opposite.The formulation of the game relies on formulas being clean (no variable occurs both free and bound, or is bound more than once) and guarded (bound variables only occur within the scope of modal operators).In the model checking game, we will only encounter a finite set of formulas, those that lie in the closure of the initial formula.The size of the closure will play a crucial role in our main complexity result because it yields an upper bound for the size of our tableau game that characterizes satisfiability of a formula.The formal definitions are as follows: A formula A ∈ F(Λ) is guarded if, for all subformulas ηp.B of A, p only appears in the scope of a modal operator within B, and A is clean if the sets of free and bound variables of a formula are disjoint and if no two distinct occurrences of fixpoint operators in A bind the same variable.A finite set of formulas Γ is guarded if every element of Γ is guarded and Γ is clean if the formula A∈Γ A is clean.
In the model checking game, the unfolding of fixpoint formulas gives rise to infinite plays, and we have to ensure that all infinite plays that cycle on an outermost µ-variable are lost by ∃ (who claims that the formula(s) under consideration are satisfied), as this would correspond to the infinite unfolding of a least fixpoint.This is where the parity map comes in: formulas of the form µp.A are assigned odd priorities and, dually, νA.p an even priority.To make sure that ∃ only looses those plays that cycle on the unfolding of an outermost µ-variable, we require that the assignment of priorities is compatible with the subformula ordering.Definition 3.3.A parity map for a finite, clean set of formulas Γ is a function Ω : Cl(Γ) → ω with finite range for which Ω(A) = 0 unless A is of the form ηp.B, η ∈ {µ, ν}, Ω(A) is odd (even) iff A is of the form µp.B (νp.B), and Ω(η It is easy to see that every clean set of formulas admits a parity function.Proof.By induction on the well-founded ordering generated by where subf(A) denotes the subformulas of A. If Γ contains a top-level conjunction, disjunction or propositional variable, then the claim follows by induction hypothesis.Now suppose that Γ = µp.A, Γ ′ .By induction hypothesis, we obtain a parity function Ω ′ : Cl(A, Γ ′ ) → ω that we may extend to a parity function Ω : Cl(Γ) → ω by putting where m is odd and m > Ω ′ (B) for all B ∈ Cl(A, Γ ′ ).The case Γ = νp.A, Γ ′ can be treated in a similar fashion.
Given a parity function, we can define the following parity game, the winning regions of which characterise satisfiability.We parametrise the model checking game in a set of formulas which will enable us to use it to prove soundness and completeness of the tableau calculus (which operates on sets of formulas) that we introduce later.
x ∈ X are states and U i ⊆ X are state sets.The parity function of MG Γ (M ) is given by Ω ′ (A, x) = Ω(A) for A ∈ Cl(Γ) and x ∈ X, and Ω ′ ( ) = 0 otherwise.
It is easy to see that any two parity functions for a given set of formulas induce the same winning region for both players.We therefore speak of the model checking game given by a set of formulas.Evidently, the model checking game is an extension of the boolean satisfiability game with fixpoints and modal operators.When the game reaches a fixpoint formula, that is, a position of type (ηp.A, x), this fixpoint is simply unfolded, and its nature (least or greatest fixpoint) and nesting depth of the formula fixpoint formula is recorded by the parity function.To show that a state x satisfies a modal formula ♥(A 1 , . . ., A n ), ∃ needs to select sets U 1 , . . ., U n (that we think of as a subset of the truth sets of the A i 's) so that the state x is being mapped by γ into the lifting of U 1 , . . ., U n .Subsequently, ∀ may challenge this choice and select an index 1 ≤ i ≤ n and require that ∃ demonstrates that the formula A i is satisfied at an aribitrary element of U i (and thus corroborate that we may think of U i as the truth set of A i ).To prove that the model checking game characterises satisfiability, we make crucial use of monotonicity, as the U i under-approximate the truth sets of the A i .The announced generalisation of [25,  ]] M ).Now assume that ∃ has a winning strategy from position (♥(A 1 , . . ., A n ), x) in MG Γ (M ) under which ∃ moves to position (♥(A 1 , . . ., A n ), (U 1 , . . ., U n )) from position (♥(A 1 , . . ., A n ), x).By induction hypothesis, we have that

Tableaux for the coalgebraic µ-calculus
In this section, we characterise satisfiability in terms of non-existence of closed tableaux.Given that our approach is parametric both in the model class over which we interpret formulas (embodied by the endofunctor) and the modal operators (given by the similarity type) that we use, our tableau system will be parametric in a set of modal tableau rules.Our tableaux will be constructed by applying the standard rules for deconstructing propositional connectives, the modal rules that are supplied as a parameter, and unfolding of fixpoints.To ensure soundness and completeness of the ensuing calculus, we need to ensure two properties: (1) the supplied set of modal rules has to describe the model class in a sound and complete way (2) topmost least fixpoints are only unfolded finitely often.For the first property, we introduce coherence conditions between the proof rules and the semantics that will guarantee completeness.For the second property, we need to consider traces of formulas along the paths of the tableau and again use a parity function to determine whether outermost µs are unfolded only finitely often.As the unfolding of fixpoints may create infinite branches, we conceptualise a tableau as a graph.A closed tableau is then constructed according to the given rules so that outermost least fixpoints are unfolded infinitely many times along any path through the tableau.
We begin by describing the coherence conditions that will guarantee soundness and completeness of the modal rules.These rules describe the relationship between states and (coalgebraic) successors, are of a particularly simple form, and are formulated in terms of sequents.
Monotone tableau rules do not contain negated propositional variables, which are not needed to axiomatise (the class of models induced by) monotone Λ structures.The restriction on occurrences of propositional variables is unproblematic, as variables that occur in a conclusion but not in the premise and multiple occurrences of variables in the premise can always be eliminated.The set of one-step tableau rules is the only parameter in the construction of tableaux for coalgebraic fixpoint logics.The coherence conditions relate rule sets with the interpretation of modal operators purely on the level of properties of states (subsets of a set X) and properties of successors (subsets of T X).Definition 4.2.Let V ⊆ V be a set of propositional variables.The interpretation of a propositional sequent Γ ⊆ V ∪ V with respect to a set X and a valuation τ : Informally speaking, a set R of one-step tableau rules is one-step tableau complete if a modalised sequent Γ is satisfiable whenever a rule that matches Γ has a satisfiable conclusion.Some care has to be taken to ensure monotonicity of one-step rules in concrete examples, in particular for the graded and the probabilistic µ-calculus.In order to obtain monotone rules for these logics, we need to insist that rule conclusions only contain prime implicants to avoid non-monotone occurrences of propositional variables.This ensures that we avoid a (non-monotone) conclusion consisting of e.g.Γ; p and Γ; p. Definition 4.3.Suppose I is a finite (index) set.A prime implicant of a boolean function f : {0, 1} I → {0, 1} is a partial valuation p : I ⇀ {0, 1} with minimal domain of definition so that f evaluates to 1 under all total extensions of p.Given a family (p i ) i∈I of propositional variables, every partial valuation p : I ⇀ {0, 1} (and hence every prime implicant) induces a sequent a family (r i ) i∈I of integers and a family (p i ) i∈I of propositional variables over the same index set.For I = I 0 ∪ I 1 , we let for the set of sequents induced by the prime implicants of the boolean function f : {0, In other words, the set of prime implicants of a boolean function corresponds to the reduced disjunctive normal form of the associated propositional formula.The notation i r i p i < k introduced above allows us to read a linear inequality involving propositional variables as a set of sequents (that we will later use as the conclusion of a one-step rule).If we think of the propositional variables p i as denoting subsets U i of some set X, then the set of all points x ∈ X that satisfy the inequality i ½ U i (x) ≤ k is precisely the set of points that satisfies the induced collection of sequents.(We write ½ U : X → {0, 1} for the characteristic function of a subset U ⊆ X).For one-step rules formulated in terms of linear inequalities, we need this property to establish completeness.Lemma 4.4.Suppose X is a set and τ : V → P(X) is a valuation of propositional variables.Then x satisfies one of the elements of i∈I 0 r i p We have that f (v) = 1 and therefore obtain a prime implicant p : This finishes our discussion of prime implicants and we are ready to have a look at several examples.We use the following one-step rules to axiomatise the model classes introduced in Example 2.1.
(2) the set of one-step rules associated with graded modal logic (and the graded µ-calculus, interpreted over finitely branching multigraphs) can be axiomatised by the rule schema The set of rules associated to the probabilistic µ-calculus comprises all instances of (P ) ) For coalition logic, we have all instances of . . .; p n ; q; r 1 ; . . .; r m where again m, n ≥ 0. Both rules are subject to the side condition that the C i are disjoint.For (C 2 ) we moreover require C i ⊆ D.
(5) Finally, the rule set associated to monotone modal logic contains the single rule (M ) p; ♦q p; q .
In the rule schemas (G) and (P ), we note that i r i a i < k is a set of (propositional) sequents, and therefore qualifies as the conclusion of a tableau rule.To ensure monotonicity, we have to ensure that no literal appears negatively.This is a direct consequence of the following: Lemma 4.6.Suppose that p is a prime implicant of the boolean function f : {0, 1} I → {0, 1} given by f (v) = 1 iff i∈I r i v i < k, where (r i ) i∈I is a sequence of nonzero integers.Then p(i) = 1 or undefined whenever r i < 0 and analogously, p(i) = 0 or undefined whenever r i > 0. In particular, all instances of (G) and (P ) are monotone.
Proof.We only demonstrate the first item, the second is analogous.Suppose, for a contradiction, that p(i) = 0 and r i < 0.Then, removing i from the domain of definition of p yields a function q : I ⇀ {0, 1} such that all total extensions e of q still satisfy f (e) = 1, contradicting the minimality of p.
It is easy to see that every Λ-structure admits a one-step sound and complete set of one-step tableau rules.While this demonstrates that our approach is applicable to all conceivable Λ-structures, the challenge of finding a tractable representation of the rule set remains, which is crucial for a complexity analysis.An adaptation of [22,Theorem 17] to the setting of monotone tableau rules shows that one-step complete rule sets always exist.Proposition 4.7.Every monotone Λ-structure admits a one-step tableau sound and onestep tableau complete set of monotone tableau rules.
Proof.Suppose that T is a monotone Λ-structure.We show that there exists a set R of monotone tableau rules so that R is one-step tableau sound and one-step tableau complete for T , essentially by showing that the set of all monotone one-step sound rules is indeed one-step complete.We let R consist of all monotone tableau rules Γ 0 /Γ 1 , . . ., Γ n that satisfy for all sets X and valuations τ : V → P(X).We claim that R is one-step tableau sound and one-step tableau complete.
First, for one-step tableau soundness, suppose that τ : V → P(X) is given and For one-step tableau completeness, we directly show the contrapositive.Assume that [[Γ]] T X,τ = ∅ for some set X and some valuation τ : V → P(X).We show that, in this case, there exists Γ 0 /Γ 1 . . ., Γ n ∈ R and σ : So suppose that [[Γ]] T X,τ = ∅ and consider the set where V Γ denotes the set of propositional variables occurring in Γ.If we let S = {Γ 1 , . . ., Γ n }, it suffices to show that Γ/Γ 1 , . . ., Γ n ∈ R.So suppose ρ : To this effect, we claim that there exists a function f : Y → X such that y ∈ ρ(p) =⇒ f (y) ∈ τ (p) for all p ∈ V Γ .For if not, there exists y ∈ Y for which a suitable f (y) cannot be found, i.e. for all x ∈ X we may find By construction, the function f satisfies ρ(p) ⊆ f −1 (τ (p)) for all p ∈ V Γ , which gives, by monotonicity of the Λ-structure T , that as required, where the second equality is by naturality of predicate liftings.
In the examples, we can find concrete (and tractable) representations of one-step complete rule sets.Proof.It is straightforward to see that a set of monotone rules is one-step tableau complete iff the set of proof rules arising by negating and swapping premise and conclusion is one-step sound and strictly one-step complete in the sense of [24], where soundness and completeness is established for the dual rule sets.The case of graded and probabilistic modal logic additionally requires to invoke Lemma 4.4 together with Lemma 3.18 of op.cit.
We now introduce the set of tableau rules that we are using to axiomatise the coalgebraic µ-calculus.As to be expected, these rules are parametric in a set of one-step rules, and we will instantiate our results to the logics introduced in Example 2.1 with help of the previous proposition.Along with the tableau rules, we also introduce rule blueprints and rule representations that will aid us in the definition of paths through a tableau later on.Definition 4.9.The set TR of tableau rules induced by a set R of one-step rules contains the propositional and fixpoint rules, the modal rules (m) and the axiom (rule) below: where ♯ denotes cardinality.The formulas A ∧ B, A ∨ B and ηp.A are called principal in the rules (∧), (∨) and (f).A rule blueprint is of the form A ∧ B, A ∨ B, ηp.A, (A, A) or (r, σ), where r ∈ R and σ : V 0 → F(Λ) is a substitution satisfying ♯(Γ 0 ) = ♯(Γ 0 σ) and V 0 ⊆ V is the set of variables occurring in r.We write B(R) for the set of rule blueprints over the set R of one-step rules.A rule representation is a tuple (Γ, ♭) where Γ ∈ S(Λ) and ♭ is a rule blueprint that satisfies Each rule representation (Γ, ♭) induces a tableau rule ρ(Γ, ♭) ∈ TR given by where Γ ′ = Γ \ {♭} in the first three clauses, and r = Γ 0 /Γ 1 . . .Γ n in the fourth clause.
The restriction ♯(Γ 0 σ) = ♯(Γ 0 ) on instances of one-step rules ensures that the substitution does not identify literals in the premise of a one-step rule, which implies that only finitely many modal rules are applicable to any sequent.Similarly, because of the restriction ♯(Γ 0 σ) = ♯(Γ 0 ) on substitutions and on the size of the domain of such substitutions in rule representations, it is also easy to see that for any Γ ∈ S(Λ) the set of rule representations (Γ, ♭) is finite.This will enable us to deduce decidability, and indeed complexity bounds later.We will, however, need to require that the set of modal rules is contraction closed in order to ensure completeness of the restricted calculus.
Remark 4.10.Alternatively, we could also prove soundness and completeness for the tableau calculus without the restriction ♯(Γ 0 σ) = ♯(Γ 0 ) and without requiring contraction closure for the set of modal rules.In this case, in order to obtain decidability, we would have to require contraction-closedness of the modal rules.This is essential for proving that we can restrict the calculus to (finitely many) instances (r, σ) of modal rules with non-identifying substitutions σ.
Our definition of rule blueprints and rule representations may seem a bit bureaucratic at first sight, so some comments are in order.If we understand a tableau as a two-player game where ∀ plays a tableau rule and ∃ selects a conclusion, the winning condition for ∃ stipulates that least fixpoints are not unfolded infinitely often.This condition is formalised in terms of the evolution of formulas along a path in a tableau, which in turn necessitates that we can re-construct the rules applied to tableau nodes.This is achieved by annotating each tableau node with a rule blueprint.Together with the node label, the blueprint forms a rule representation which in turn induces a rule.We use this mechanism for two reasons: • for propositional rules and the fixpoint rule, the rule blueprint records the principal formula, that we need to track to define traces later.Moreover, we can distinguish between the different conclusions of the induced rule, and • for modal rules, the rule blueprint is an unsubstituted one-step rule, which allows us to track (unsubstituted) propositional variables, which is again needed for the definition of traces.The usefulness of the blueprints and rule representations will become clearer in Definition 4.12 where we define the set of traces through a tableau path.We are now ready to introduce the notion of tableau that we will use throughout the paper.As fixpoint rules generate infinite paths, we formalise tableaux as finite, rooted graphs.As a consequence, closed tableaux are finitely represented proofs of the unsatisfiability of the root formula.Definition 4.11.A tableau for a clean, guarded sequent Γ ∈ S(Λ) is a finite, directed, rooted and labelled graph (N, K, R, ℓ, α) where N is the set of nodes, K ⊆ N × N is the set of edges, R is the root node and ℓ : N → S(Γ) is a labelling function such that ℓ(R) = Γ and α : N ⇀ B(R) is a partial function (that we think of as an annotation) satisfying • α(n) is defined iff there exists a tableau rule with premise ℓ(n In other words, tableaux are sequent-labelled graphs where a rule has to be applied at a node if the node label matches a rule premise, and no rule may be applied otherwise.The purpose of the annotation α is to record which rule (if any) has been applied at a particular node.To keep track of whether least fixpoints are unfolded infinitely often, we record the unsubstituted one-step rule (together with a substitution) at modal nodes, as we need to track the evolution of formulas along one-step rules, where propositional variables may become identified by a substitution.Moreover, it may be the case that two different one-step rules generate the same rule instance: both rules ♥p/p and ♥p, ♥q/p generate the instance ♥A/A.As we will be required to traverse infinite loops in a tableaux to ensure that only greatest fixponits are unfolded infinitely often, we need to ensure that the identity of a rule does not change when nodes are encountered multiple times.
The reader might wonder why we make a distinction between nodes in a tableau and their labels.The technical reason for this is that we need to run an automaton in parallel to the tableau, so that the same sequent may be associated with different automata states (see the definition of the tableau game in Section 5).Informally speaking, we have to allow for enough paths through a tableau to ensure completeness.We can view a tableau as a strategy of ∀ in this tableau game, where ∀ tries to prove that a given sequent is not satisfiable.Accordingly, a closed tableau will correspond to a winning strategy for him in the tableau game.An identification of nodes and sequents in a tableau would mean that the corresponding strategy of ∀ in the tableau game would only depend on the set of formulas with which a position of ∀ is labeled.We cannot guarantee, however, that ∀ has a winning strategy of this special kind, even if he has some winning strategy.Therefore, in order to be able to represent arbitrary strategies of ∀ in the tableau game as tableaux, we have to have the possibility to distinguish between nodes and their labels.The only restriction we make is that the tableau graph is finite, i.e. we only consider strategies of ∀ with bounded memory.
Our goal is to show that a formula A ∈ F(Λ) is satisfiable iff no tableau for A ever closes.In a setting without fixpoints, a tableau is closed iff all leaves are labelled with axioms.Here we also need to consider infinite paths, and ensure that only greatest fixpoints are unfolded infinitely often at the top level of an infinite path.As in [17], this necessitates to consider the set of traces through a given tableau.Informally, a trace records the evolution (by application of tableau rules) of a single formula through a tableau.Formally, we associate binary relations with tableau rules, and traces arise by sequencing these relations.Definition 4.12.Suppose that T = (N, K, R, ℓ, α) is a tableau for Γ.A path through T is a finite or infinite sequence π : n 0 A trace through a path π is a finite or infinite sequence of formulas (A 0 , A 1 , . . . ) such that A i ∈ ℓ(n i ) and (A i , A i+1 ) ∈ Tr(ℓ(n i ), α(n i ), c i ) where the relations Tr(Γ, ♭, i) ⊆ F(Λ) × F(Λ) are given as follows: where r = Γ 0 /Γ 1 . . .Γ n .Here Diag(X) = {(x, x) | x ∈ X} is the diagonal on a set X.The triples (Γ, ♭, i) where (Γ, ♭) is a rule representation, i ∈ N and ρ(Γ, ♭), the rule represented by (Γ, ♭), has at least i conclusions, are called trace tiles.Finally, a tableau T with root node labelled by Γ is closed, if the end node of all finite paths through T of maximal length that starts in the root node is labelled with a tableau axiom, and every infinite path starting in the root node carries at least one bad trace with respect to a parity function Ω for Γ.
Informally, a path through a tableau is a sequence of nodes, together with the information which rule has been applied to nodes, and we cannot have a path that ends in a node to which (Ax) was applied.As for the construction of tableaux, the construction of traces requires that we pick the same conclusion every time a node is traversed.While in the instance A ∨ B, A, B/A, B of (∨), both conclusions are identified, they are not equivalent from the point of view of traces, as the 'left' conclusion continues the trace from A ∨ B to A whereas the right conclusion continues the same trace to B. This difficulty does not arise in [17] where tableaux are formalised as sibling-ordered trees, and the rule blueprints used here serve essentially the same purpose.The traces through a path are calculated using the so-called trace tiles.A trace tile records which rule has been applied in a node that is visited by the path and through which of the successors of the node that path is continuing.It should be noted that for Γ ∈ S(Λ) the set is finite because, as remarked after Definition 4.9, for each ∆ ∈ S(Γ) there are only finitely many rule representations (Γ, ♭).We stress this fact, because later on we will use Σ Γ as alphabet of the parity automaton that is essential for the definition of our tableau game.We now continue the development of the general theory and first establish soundness of the tableau calculus: satisfiable sequents cannot have closed tableaux.This relies on Theorem 3.6, as a winning strategy for ∃ in the model checking game can be used to construct a path through any tableau that carries a bad trace.
Theorem 4.14.Let R be a one-step tableau complete set of monotone rules for the modal similarity type Λ, and let Γ ∈ S(Λ) be clean and guarded.If Γ is satisfiable in some model M = (X, γ, h), then no closed tableau for Γ exists.
Proof.Consider a model M = (X, γ, h) and x ∈ X such that M , x |= Γ and let T = (N, K, R, ℓ, α) be a tableau for Γ.As M , x |= Γ, Theorem 3.6 implies that ∃ has a historyfree winning strategy g in MG Γ = MG Γ (M ) from all positions (B, x) of the game board with B ∈ Γ.We now establish that there exists a complete path and an associated sequence of model states satisfying the formulas on this path that can be contracted to a play in the model checking game.More precisely, we establish the existence of a path π = n 0 c 0 n 1 c 1 . . .n l c l . . .through T and a sequence χ = x 0 x 1 . . .x l . . . of states that satisfy (i) n 0 = R and x 0 = x and M , x i |= ℓ(n i ) whenever n i is defined, (ii) for each trace τ = B 0 B 1 . . .B l . . .through π there exists a play (A 0 , y 0 )(A 1 , y 1 ) . . .(where we do not record the positions that have subsets of the model as second component) that is played according to g and there is an increasing sequence 0 = s 0 < s . .where B i = B s j and x i = x s j whenever s j ≤ i < s j+1 .Once this claim is established, it follows that T cannot be closed: consider the path π just constructed.If π is finite, the label ∆ of the last node of π cannot be a tableau axiom, as ∆ is satisfiable by construction.In case π is infinite, every trace τ through π induces a MG Γ -play that is played according to ∃'s winning strategy g which implies that τ is not bad.Taken together, this shows that T cannot be closed, so it remains to establish the claim.
We construct the required path π and the sequence χ of states in a step-by-step fashion, starting at the root of the tableau and at the state x, i.e. we put n 0 = R and x 0 = x.So suppose that a path π = n 0 c 0 . . .c j−1 n j and a sequence of model states x 0 . . .x j satisfying (i) and (ii) above have already been constructed, and π is not yet complete.We distinguish cases on the rule r = ρ(ℓ(n j ), α(n j )) applied at (the last) node n j .
By assumption, there exists a corresponding MG Γ -play, played according to g, that ends in position (♥(p 1 , . . ., p n )σ, x j ).This play can now be extended by ∃ moving to g(♥(p 1 , . . ., p n )σ, x j ) = (♥(p 1 , . . ., p n )σ, (U 1 , . . .U n )).We extend this play letting ∀ move to (A, x j+1 ).The latter move is legitimate as σ(p k ) = A and because It remains to note that for every formula A ′ ∈ ∆ i there exists a trace through π ′ that ends in A ′ , and therefore also a possibly partial MG Γ -play according to ∃'s winning strategy g ending at (A ′ , x j+1 ).This implies that for all A ′ ∈ ∆ i , (A ′ , x j+1 ) is a winning position for ∃ in MG Γ , and hence M , x j+1 |= A ′ for all A ′ ∈ ∆ i .This finishes the proof of the claim and hence that of the theorem.p;q , σ) where σ : {p, q} → {A, B} is a substitution with σ(p) = B and σ(q) = A.
Any finite path through this tableau ends in an axiom, and the only infinite path contains the trace where the overlined sequence is repeated ad infinitum.This trace is bad with respect to Ω, as Ω(A) = 1 and A is the only fixpoint formula that occurrs infinitely often.

The Tableau Game
We now introduce the tableau game associated to a clean and guarded sequent Γ, and use it to characterise the (non-)existence of closed tableaux in terms of winning strategies in the tableau game.For the entire section, we fix a modal similarity type Λ and a set R of monotone tableau rules that is both one-step sound and complete.The idea underlying the tableau game is that ∀ intends to construct a closed tableau for a given set of formulas Γ, while ∃ wants to demonstrate that any tableau constructed by ∀ contains a path π that violates the closedness condition.As infinite plays of the tableau game correspond to paths through a tableau, an infinite play should be won by ∃ if it does not carry a bad trace, that is, outermost least fixpoints are only unfolded finitely often.To be able to see this tableau game as a parity game, we therefore need a mechanism to detect bad traces, and we employ parity word automata for this task.Board positions in the ensuing tableau game will therefore be sequent / automata state pairs, with the priority of a board position being determined by the parity function of the automaton.In particular, this will ensure that winning strategies of ∃ in the tableau game do not generate bad traces.We start our discussion of the tableau game by recalling some basic notions concerning parity word automata.
Definition 5.1.Let Σ be a finite alphabet.A non-deterministic parity Σ-word automaton is a quadruple A = (Q, a I , δ : Q × Σ → P(Q), Ω) where Q is the set of states of A, a I ∈ Q is the initial state, δ is the transition function, and Ω : Q → ω is a (parity) function.Given an infinite word γ = c 0 c 1 c 2 c 3 . . .over Σ, a run of A on γ is a sequence ρ = a 0 a 1 a 2 . . .∈ Q ω such that a 0 = a I and for all i ∈ ω we have a i+1 ∈ δ(a i , c i ).A run ρ is accepting if ρ is not a bad sequence with respect to Ω.We say that A accepts an infinite Σ-word γ if there exists If not explicitly stated otherwise, we will only consider G Γ -plays that start at (Γ, a Γ ) where a Γ is the initial state of the automaton A. In particular, we say that a player has a winning strategy in G Γ if (s)he has a winning strategy in G Γ at position (Γ, a Γ ).
The easier part of the correspondence between satisfiability and winning strategies in G Γ is proved by constructing a closed tableau based on a winning strategy for ∀.To show that this tableau is indeed closed, we need to show that every infinite path carries at least one bad trace, which follows from the fact that ∀ wins in the tableau game.To make this formal, we consider a notion of path and trace also relative to plays in the tableau game.
An underlying path of a G Γ -play is very similar to the notion of a tableau path.This is due to the correspondence between tableaux and strategies of ∀ in the tableau game.This correspondence is crucial in the proof of the following theorem.Proof.Suppose that ∀ has a winning strategy f in G Γ at position (Γ, a Γ ).As G Γ is a parity game we can assume that ∀'s strategy is history-free, i.e. it can be encoded as a partial function f : S(Γ) × Q ⇀ S(Γ) × B(Γ) × Q.In order to prove the claim we are going to define a closed tableau T = (N, K, R, ℓ, α) for Γ.We define N to be the set of positions in S(Γ) × Q for which f is a winning strategy (in particular, this entails that f is defined at all positions in N ).Obviously we have (Γ, a Γ ) ∈ N and we put R = (Γ, a Γ ).The labelling function on N is the first projection map, i.e. ℓ(∆, a) = ∆ for all (∆, a) ∈ N ⊆ S(Γ) × Q.
For all (∆, a) ∈ N the set of K-successors is defined using ∀'s strategy by putting is the set of possible moves of ∃ at f (∆, a).Finally we define the annotation α of T by putting α(∆, a) = π 2 (f (∆, a)) where π 2 : S(Γ) × B(Γ) × Q → B(Γ) denotes the second projection map.
It is an easy consequence of the definition of the tableau game that T is a well-defined tableau.We now show that T is a closed tableau.To this aim consider first a finite complete that is played according to ∀'s winning strategy f .In order to see this, note that for all 0 ≤ i < n we have (Γ i+1 , a i+1 ) ∈ E(f (Γ i , a i )), i.e. (Γ i+1 , a i+1 ) is a legal answer to ∀'s move at (Γ i , a i ) if ∀ is playing according to his strategy f .Since π was assumed to be complete, and since ∀ has a winning strategy at the last position (Γ n , a n ) of the corresponding G Γ -play, it follows that ∃ cannot move in the position obtained by ∀ playing according to his strategy at (Γ n , a n ).This can only be the case if ∀ moves to (Γ n , (A, A), a n ) at (Γ n , a n ) for some A ∈ F(Λ), which in turn is only possible if Γ n is a tableau axiom.
Consider now an infinite path π = (Γ 0 , a 0 )c 0 (Γ 1 , a 1 )c 1 (Γ 2 , a 2 ) . . .through T starting with (Γ 0 , a 0 ) = (Γ, a Γ ).As in the previous case, this induces an infinite G Γ -play P of the form P = (Γ 0 , a 0 )(Γ 0 , ♭ 0 , a 0 )(Γ 1 , a 1 )(Γ 1 , ♭ 1 , a 1 )(Γ 2 , a 2 ) . . .(Γ n , a n ) . . .that is played according to ∀'s winning strategy f .By the definition of the game board of G Γ , this means that the infinite sequence ρ = a 0 a 1 a 2 . . .∈ Q ω can be seen as a run of By assumption f was winning for ∀ and therefore P does not satisfy the parity condition Ω ′ of G Γ .This implies that ρ = a Γ a 1 a 2 . . .∈ Q ω does not fulfil the parity condition Ω of the automaton A Γ .In other words, as ρ is the run of A Γ on w, there must be a sequence In other words, β is also a trace through the path π, which implies that there exists a trace through π that is bad w.r.t.Ω as required.This finishes the proof that T is closed.
The converse of the above theorem is established later as Theorem 5.18.The challenge there is to construct a model for Γ based on a winning strategy for ∃ in the Γ-tableau game.As we only allow substitution instances of modal (one-step) rules that do not duplicate literals (we require that substitutions do not decrease the cardinality of premises in onestep rules in Definition 4.9), we need to require that the set of tableau rules to be closed under contraction.Definition 5.6.A set R of monotone one-step rules is closed under contraction, if for all rules Γ 0 /Γ 1 , . . ., Γ n ∈ R and all σ : V → V, there exists a rule ∆ 0 /∆ 1 , . . ., ∆ k ∈ R and a renaming τ : V → V such that Aτ = Bτ for A, B ∈ ∆ 0 implies that A = B, ∆ 0 τ ⊆ Γ 0 σ and, for each 1 ≤ i ≤ n, there exists 1 ≤ j ≤ k such that Γ i σ ⊆ ∆ j τ .
In other words, instances of one-step rules which duplicate literals in the premise may be replaced by instances for which this is not the case.
Remark 5.7.Every monotone Λ-structure admits a one-step tableau sound and one-step tableau complete set of monotone tableau rules that is closed under contraction.This follows from the fact that the set of one-step rules from the proof of Proposition 4.7 is closed under contraction: Consider a rule Γ 0 /Γ 1 , . . ., Γ n ∈ R and any renaming σ.Then, by the definition of the set of one-step rules R in Prop.4.7 we can easily show that ∆ 0 /∆ 1 , . . ., ∆ n ∈ R with ∆ i = Γ i σ for i = 0, . . ., n. Closure under contraction follows from the fact that ∆ 0 /∆ 1 , . . ., ∆ n together with τ = id V satisfy the conditions of Definition 5.6.
Under the condition of closure under contraction (cf.Remark 4.10), we prove: Theorem 5.8.Suppose that Γ ∈ S(Λ) is clean and guarded and R is one-step tableau complete and contraction closed.If ∃ has a winning strategy in G Γ , then Γ is satisfiable in a model of size O(2 p(n) ) where n is the cardinality of Cl(Γ) and p is a polynomial.
The proof of Theorem 5.8 constructs a model for Γ out of the game board of G Γ using a winning strategy f for ∃ in G Γ .We use one-step tableau completeness to impose a T -coalgebra structure on those ∀-positions in G Γ that are reachable through f -conform G Γ -plays, with the resulting coalgebra satisfying the truth lemma.We then equip this T -coalgebra with a valuation that makes Γ satisfiable in the resulting model.While our construction shares some similarities with the shallow model construction of [24], it is by no means a simple adaptation of op.cit., as we are dealing with fixpoint formulas and thus cannot employ induction over the modal rank of formulas to construct satisfying models.Our proof of satisfiability is also substantially different from the corresponding proof for the modal µ-calculus (cf.[17]) -we show satisfiability by directly deriving a winning strategy for ∃ in the model-checking game from a winning strategy of ∃ in the tableau game.
We now turn to the details of the proof of Theorem 5.8.Throughout the proof, we assume that Γ ∈ S(Λ) is a clean, guarded sequent and f : S(Γ) × B(Γ) × Q ⇀ S(Γ) × Q is a history-free winning strategy for ∃ in G Γ .The construction of a supporting Kripke frame for a model of Γ is based on ∀-positions of G Γ where only modal rules can be applied.This is formalised through the notion of atomic sequent.Definition 5.9.A Λ-formula is atomic if it is either a propositional variable p ∈ V, a negated propositional variable p ∈ V, or a formula of the form ♥(A 1 , . . ., A n ) or ♥(A 1 , . . ., A n ).A sequent ∆ ∈ S(Λ) is atomic if all its elements are atomic.We write At(Γ) for the set of atomic sequents in S(Γ), and call a G Γ -position (∆, a) ∈ B ∀ atomic if ∆ is atomic.
The state set of the satisfying model that we are about to construct are the atomic G Γpositions (∆, a) that are reachable from (Γ, a Γ ) through G Γ -play that is played according to f .As the propositional rules are invertible, we may assume that ∀ applies them in any fixed, given order.This simplifies the model construction as it implies -together with ∃'s strategy -that every sequent is unfolded to an atomic sequent in a unique way.Fixing the order in which ∀ applies propositional rules can be seen as a strategy, that we call propositional: Definition 5.10.A propositional strategy for ∀ in the tableau game G Γ is a function ) is a rule representation for all ∆ ∈ S(Γ) \ At(Γ).A G Γ -play is played according to g if ∀ moves at any position of the form (∆, a) ∈ (S(Γ) \ At(Γ)) × Q that occurs in the play to the position (∆, g(∆), a).
For the remainder of this section we fix a propositional strategy g for ∀.As annonced informally in the beginning, this dictates that plays proceed to atomic positions in a unique way, and in fact induces a function from arbitrary positions to atomic ones in the tableau game.
Lemma and Definition 5.11.Let f be a strategy for ∃ in G Γ .For any position (∆, a) ∈ S(Γ) × Q there exists precisely one position (∆ ′ , a ′ ) ∈ At(Γ) × Q and one partial G Γ -play that is played according to f and g and which does not contain an instance of a modal rule.We let For the construction of a satisfying model for Γ we are going to define a relation on the set of atomic positions of G Γ where two atomic positions are related if the second position is selected by ∃'s strategy in response to ∀ playing a modal rule.In the case of Kripke frames, this relation would already define the satisfying model, but in the general case, we need to impose a coalgebra structure on top of this relation in a coherent way.To achieve this, we single out specific states (the A-successors) that we take as under-approximation of the semantics of a formula A. Informally speaking, an A-successor of an atomic state arises by ∀ playing a modal rule, and ∃ selecting a conclusion containing A that is then reduced to another atomic position.Formally, we introduce the notions of A-children (conclusions selected by ∃ that contain A) and A-successors (reductions of A-children to atomic form), both relative to a strategy for ∃.Definition 5.12.Suppose that f is a history-free strategy of ∃ in G Γ , and let (∆, a) ∈ At and write Chld f (∆, a) for the collection of all A-children of (∆, a) along f .An atomic position (∆ ′′ , a ′′ ) is an A-successor of (∆, a) along f if (∆ ′′ , a ′′ ) = σ f (∆ ′ , a ′ ) for some Achild (∆ ′ , a ′ ) of (∆, a) along f .This is denoted by for the collection of all A-successors of (∆, a).
In other words, an atomic position (∆ ′′ , a ′′ ) is a successor of (∆, a) if it is reachable from (∆, a) by a play that is played according to ∃'s strategy f and the (fixed) propositional strategy g that involves precisely one modal rule.The position (∆ ′′ , a ′′ ) is an A-successor of (∆, a) if the conclusion of this modal rule that is picked by f contains the formula A. This allows us to introduce coherent coalgebra structures, i.e. those structures on atomic positions that satisfy the truth lemma.Definition 5.13.Suppose that f is a history-free strategy for ∃ in G Γ and let In other words, the carrier of a coherent coalgebra is the set of atomic positions that are reachable from the initial position via ∃'s strategy f , and the coalgebra structure is so that we can establish the truth lemma, together with monotonicity of the modal operators: the A-successors of an atomic position contain an element of the disjunctive normal form of A and hence serve as an under-approximation of the truth-set of A. We note that a position cannot be both an A-successor and an A-successor of the same position.Lemma 5.14.Let f be a history-free winning strategy for ∃ in G Γ and let (∆ 1 , a 1 ) and (∆ 2 , a 2 ) be atomic G Γ -positions such that f is a winning strategy for ∃ at (∆ 1 , a 1 ).Then for all formulas A we have Proof.Suppose for a contradiction that (∆ 2 , a 2 ) ∈ Suc f (A, ∆ 1 , a 1 ) as well as (∆ 2 , a 2 ) ∈ Suc f (A, ∆ 1 , a 1 ) for some formula A. Then, by the definition of Suc f , there must exist (∆ ′ , a ′ ) and (∆ ′′ , a ′′ ) in A straightforward induction argument shows that in this case there must exist a formula B such that B, B ∈ ∆ 2 .Therefore (∆ 2 , a 2 ) is a winning position for ∀.But this contradicts the fact that there exists a G Γ -play from (∆ 1 , a 1 ) to (∆ 2 , a 2 ) played according to f , and our assumption that f is winning at (∆ 1 , a 1 ).
We now show that if ∃ has a winning strategy f in the tableau game for Γ, then a coherent model for Γ exists.This is where contraction closure is needed as the application of modal rules may not identify elements in the premise of a rule.
Now suppose for a contradiction that there is no γ : Y → T Y such that (Y, γ) is a coherent coalgebra structure for Γ.Then there exists some (∆, a) ∈ Y such that we cannot find a t ∈ T Y that satisfies the condition in Definition 5.13.Consider the set of formulas where for any formulas of the form ♥(A 1 , . . ., A n ) or ♥(A 1 , . . ., A n ) in ∆ we associate a unique propositional variable p A i to the formula A i , for i ∈ {1, . . ., n}.Let V Θ be the set of propositional variables occurring in Θ.We define a valuation τ : Using our assumption on (∆, a) it is not difficult to see that [[Θ]] T Suc f (∆,a),τ = ∅.Therefore one-step tableau completeness implies that there exists a rule Γ 0 /Γ 1 • • • Γ n and a substitution σ : V → V such that Γ 0 σ ⊆ Θ and [[Γ i σ]] Suc f (∆,a),τ = ∅ for all i ∈ {1, . . ., n}.Because of contraction closure of R we can assume w.l.o.g. that ♯(Γ 0 σ) = ♯(Γ 0 ).
To begin with, note that by assumption on (A 0 , (∆ 0 , a 0 )) we have σ f (Γ, a Γ ) = (∆ 0 , a 0 ) and A 0 ∈ Γ.Hence, we let (∆ ′ 0 , a ′ 0 ) = (Γ, a Γ ) be the first position of π, let Γ be the first position of π ′ , and let τ 0 = A 0 ∈ Γ.Now assume that π, π ′ and τ have been constructed up to a position (∆ ′ i , a ′ i ), with σ f (∆ ′ i , a ′ i ) = (∆ i , a i ) and ∆ ′ i ∋ A i .We extend the partial G Γ -play π with a segment starting in (∆ ′ i , a ′ i ) and ending in some Here (∆ i+1 , a i+1 ) represents the position obtained as a result of ∃ moving in (∆ i , a i ), based on the additional information provided by (∆ ′ i , a ′ i ), according to the strategy defined earlier.At the same time, we extend the underlying path π ′ of π with a segment ∆ ′ i . . .∆ ′ i+1 , and the trace τ with a segment A i , . . ., A i , A i+1 .These constructions are carried out by case analysis on A i .
, played according to f and g, that has an underlying path Γ 0 c 0 . . .c k−1 Γ k such that (A i , A i ) ∈ Tr(Γ j , ♭ j , c j ) for 0 ≤ j < k.Also, by definition of ∃'s move in (A i , (∆ i , a i )) we obtain A i+1 = B j and (∆ i+1 , a i+1 ) ∈ Suc f (B j , ∆ i , a i ) for some j ∈ {1, . . ., n}.It follows that there exists a position (∆ ′′ , a ′′ ) such that (∆ ′′ , a ′′ ) ∈ Chld f (∆ i , a i ), B j ∈ ∆ ′′ and (3) A = ♥(B 1 , . . ., B n ).According to the definition of ∃'s strategy f , the last position of the play must be a ∀-position of type (♥(B 1 , . . ., B n ), (U 1 , . . ., U n )) with U i = ∅ for i = 1, . . ., n (as ∃ can always play in positions of type (♥(B 1 , . . ., B n ), (∆, a))).Thus, (A, (∆, a)) is a winning position for ∃.It therefore follows that ∃ wins all finite MG Γ (Y)-plays that start at (A 0 , (∆ 0 , a 0 )) and are played according to f .Now consider an infinite MG Γ (Y)-play starting at (A 0 , (∆ 0 , a 0 )) and played according to f , and let π be the infinite G Γ -play and τ be the associated trace through π provided by Lemma 5.16.It follows from the statement of the lemma that τ is contractable to the sequence of formulas appearing in the given MG Γ (Y)-play.Since the strategy f was winning for ∃ in G Γ , it follows that any trace through π, and therefore also τ , satisfies the parity condition of G Γ .As a result, the parity condition of MG Γ (Y) is satisfied by the given infinite MG Γ (Y)-play, which is thus won by ∃.
Theorem 5.8 now follows from Theorem 5.17 and the observation that the sizes of both Q and S(Γ) are bounded by an exponential in the size of Cl(Γ) (by Lemma 5.2 and respectively the definition of S(Γ)).
Putting everything together, we obtain a complete characterisation of satisfiability in the coalgebraic µ-calculus.
Theorem 5.18.Suppose that Γ ∈ S(Λ) is a clean, guarded sequent and R is one-step tableau complete and contraction closed.Then Γ is satisfiable iff no tableau for Γ is closed iff ∃ has a winning strategy in the tableau game G Γ .
As a by-product, we obtain the following small model property.
Corollary 5.19.A satisfiable, clean and guarded formula A is satisfiable in a model of size O(2 p(n) ) where n is the cardinality of Cl(A) and p is a polynomial.
Proof.The statement follows immediately from Theorems 4.14, 5.5 and 5.8 together with the determinacy of two player parity games.

Complexity
We now show that -subject to a mild condition on the rule set -the satisfiability problem for guarded formulas of the coalgebraic µ-calculus is decidable in exponential time.By Theorem 5.18, the satisfiability problem is reducible to the existence of winning strategies in parity games.Given any guarded sequent Γ, we thus construct a parity game of exponential size (measured in the size of Γ), the parity function of which has polynomial range (again measured relative to the size of Γ).This will ensure Exptime-decidability if we can decide legal moves in this game in exponential time.According to Definition 5.3, the game board consists of the disjoint union of • S(Γ) × Q (the positions owned by ∀) where Q is the state set of a Γ-parity automaton and S(Γ) are the sequents that we can form in the closure of Γ, and • S(Γ) × B(Γ) × Q where B(Γ) are the blueprints of rules with premise in S(Γ).
We know that the state set Q of the Γ-parity automaton is exponential in the size of Cl(Γ) by Lemma 5.2 and it is easy to see that S(Γ) is exponentially bounded.The crucial step for obtaining an overall exponential bound is thus the ability to treat rule blueprints.While this is simple for many logics (where it is easy to see one only has exponentially many applicable rule/substitution pairs that are of polynomial size), more care is needed for the rules of the probabilistic and the graded µ-calculus.The main difficulty lies in the fact that the conclusions of these rules (Example 4.5) are sets of sequents that may be exponentially large.On the other hand, the conclusions can be represented by (small) linear inequalities, as in fact we did in Example 4.5 for presentational purposes, and leads to an obvious solution.Instead of representing rule blueprints associated with modal rules directly, we use a coding of modal rules that can be decided efficiently, to obtain an exponential representation of the game board.This approach has been used previously in [24] to give Pspace-bounds for coalgebraic logics, and we will refer to op.cit.for some of the technical points.
In order to be able to speak about the complexity of the satisfiability problem a meaningful way, we begin by formalising the notion of size of formulas and sequents.To do this, we assume that the underlying similarity type Λ is equipped with a size measure s : Λ → N and measure the size of a formula A in terms of the number of subformulas counted with multiplicities, adding s(♥) for every occurrence of a modal operator ♥ ∈ Λ in A. In the examples, we code numbers in binary, that is, s( k ) = s([k]) = ⌈log 2 k⌉ for the graded µ-calculus and s( p/q ) = s([p/q]) = ⌈log 2 p⌉ + ⌈log 2 q⌉ + 1 for the probabilistic µ-calculus, and s([a 1 , . . ., a k ]) = 1 for coalition logic.Note that in the latter case, the overall number of agents is fixed, so there will only be finitely many coalitions which allows us to assign unit size to every operator.The definition of size is extended to sequents by size(Γ) = A∈Γ size(A) for Γ ∈ S(Λ) and size({Γ 1 , . . ., Γ n }) = n i=1 size(Γ i ) for sets of sequents.
We continue by discussing the mechanism to encode rule blueprints that we did describe informally at the beginning of this section.In order to obtain an exponential bound, we require that blueprints of modal rules can be encoded by strings of polynomial length.In order to have a uniform treatment, we make the following definition.Definition 6.1.Suppose that Γ ∈ S(Λ).A set R of one-step rules is exponentially tractable if there is an alphabet Σ and a polynomial p such that every ♭ = (r, σ) with r = Γ 0 /Γ 1 . . .Γ n can be encoded as a string of length ≤ p(size(Γ 0 σ)) and the relations Exponential tractability gives an upper bound on the size of the board of the tableau game and the complexity of both the parity function and the relation determining legal moves.The proof of this result requires the following auxiliary lemmas thate establish bounds on the closure of the root sequent, and the size of the sequents in the closure, respectively.Proof.The closure of Γ has at most size(Γ) many elements, each of which may be larger than size(Γ) as a result of substituting µp.A for p in A if µp.A ∈ Γ.The result follows as this can happen at most size(Γ)-many times.
We can now formulate, and prove, the annonced encoding of the tableau game as follows.Lemma 6.4.Suppose that R is exponentially tractable.Then every position in the tableau game G Γ = (B ∃ , B ∀ , E, Ω) of Γ ∈ S(Λ) can be represented by a string of polynomial length in size(Γ).Under this coding, the relation (b, b ′ ) ∈ E is decidable in exponential time.
Proof.We know that the state set A of the parity automaton A associated with G Γ is exponential in size(Γ), hence every a ∈ A can be represented by a string of polynomial length in size(Γ).
As we are now working with the encoding of the game board we think of the automaton as operating on encodings of rule blueprints rather than on the rule blueprints itself.More precisely, we run the automaton not on trace tiles (∆, ♭, i) but on encoded trace tiles (code(∆), code(♭), i) where code(∆) is the given encoding of sequents in S(Γ) and code(♭) is the encoding of ♭ = (r, σ) according to Definition 6.1 if ♭ encodes a modal rule or code(♭) is the principal formula of the (non-modal) rule represented by ♭ otherwise.
Every element of the set S(Γ) can be encoded by a string of polynomial length in size(Γ) by Lemma 6.3.Thus every position (∆, a) of B ∃ can be encoded by a string of polynomial length.
By exponential tractability, every rule blueprint ♭ can be encoded as a string of polynomial length, leading premise, leading to a polynomial bound on the size of the positions (∆, ♭, a) of B ∀ .
To see that E is decidable in exponential time, note that it follows from exponential tractability that the moves of ∀ from (∆, a) to (∆, ♭, b) are decidable in Exptime by Definition of tractability.To ensure Exptime decidablity of a move from (∆, ♭, a) to (∆ ′ , a ′ ) where ♭ is a blueprint of a modal rule, note that the rule represented by (∆, ♭) has at most exponentially many conclusions (measured in the size of ∆), and as we can check whether ∆ ′ is the i-th conclusion of ρ(∆, ♭) in exponential time, we conclude that E is decidable in Exptime overall.
We now obtain an Exptime upper bound for satisfiability.Corollary 6.5.Suppose T is a monotone Λ-structure and R is exponentially tractable, contraction closed and one-step tableau complete for T .Then the problem of deciding whether ∃ has a winning strategy in the tableau game for a clean, guarded sequent Γ ∈ S(Λ) is in Exptime.As a consequence, the same holds for satisfiability of any guarded formula A ∈ F(Λ).
Proof.The first assertion follows from Lemma 6.4 as the problem of deciding the winner in a parity game is exponential only in the size of the parity function of the game (Theorem 3.1) which is polynomial in the size of Γ (Lemma 5.2).The second statement now follows with the help of Theorem 5.18.Example 6.6.It is easy to see that the rule sets for the modal µ-calculus, the coalitional µ-calculus and the monotone µ-calculus are exponentially tractable, as the number of conclusions of each one-step rule is bounded.To establish exponential tractability for the rule sets for the graded and probabilistic µ-calculus, we argue as in [24] where tractability of the (dual) proof rules has been established.We encode a rule with premise n i=1 r i a i < k as (r 1 , a 1 , . . ., r n , a n , k) and Lemma 6.16 of op.cit.provides a polynomial bound on the size of the solutions for the linear inequalities that combine conclusion and side condition of both the (G) and (P )-rule.Exponential tractability follows, once we agree on a fixed order on the set of prime implicants.In all cases, contraction closure is immediate.

Conclusions
In this paper, we have introduced the coalgebraic µ-calculus that provides a generic and uniform framework for modal fixpoint logics.The calculus takes three parameters: • an endofunctor T : Set → Set that defines the class of T -coalgebras over which the calculus is interpreted • a collection Λ of modal operators that defines the syntax of the calculus, and • the interpretation of the modal operators over T -coalgebras, which is given by predicate liftings for T .In this general setting, our main results are soundness and completeness of of the calculus and Exptime decidability of the satisfiability problem for guarded formulas.Technically, completeness was achieved by tracking the evolution of fixpoint formulas in a tableau, and for a closed tableau we require that an outermost least fixpoint is unfolded along every infinite branch.To detect these infinite unfoldings of least fixpoints, we use a parity automaton that we run in parallel with the tableau, so that the existence of closed tableaux can be characterised by winning strategies in a parity game that is played on pairs consisting of a sequent and an automaton state.Our treatment borrows from by [17] and [26], but there are some important differences.In contrast to [17], we use parity games that directly correspond to tableaux, together with parity automata to detect bad traces.Moreover, our model construction super-imposes a coalgebra structure on the relation induced by a winning strategy for ∃.This model construction is substantially more involved than that given in [24], since we cannot argue in terms of modal rank in the presence of fixpoints.Compared with [26] (where no complexity results are presented), we use standard syntax for modal operators, which allows us to subsume for instance the graded µ-calculus that cannot be expressed in terms of the ∇-operator used in op.cit..By instantiating the generic approach to specific logics, that is, by providing instances of the endofunctor T , the set Λ of modal operators and the one-step rules R, we • reproduce the complexity bound for the modal µ-calculus [9], together with the completeness of a slight variant of the tableau calculus presented in [17], • lead to a new proof of the known Exptime bound for the graded µ-calculus [21], • establish previously unknown Exptime bounds for the probabilistic µ-calculus, for coalition logic with fixpoints and for the monotone µ-calculus.We note that these bounds are tight for all logics except possibly the monotone µ-calculus, as the modal µ-calculus can be encoded into all other logics.Given that the coalgebraic framework is inherently compositional [6,3,5,23], our results also apply to (coalgebraic) logics that arise by combining various features, such as strategic games and quantitative uncertainty.
As mentioned before we would like to stress that we established the EXPTIME bound only for the guarded formulas of the above listed logics.Under the frequently used assumption that one can transform an arbitrary formula into an equivalent guarded one in polynomial or even linear time, we could extend our results to the full logics.In particular, note that in [21] precisely this assumption has been used for the graded µ-calculus.For the modal µ-calculus a tableau-based EXPTIME-procedure that works for arbitrary formulas as input has been presented recently in [11].After careful inspection of our calculus we conjecture that our tableau calculus is also sound and complete for arbitrary formulas and formula sequents.We have to leave the details of the substantially more complicated completeness proof for this general case as future work.
the disjoint union of positions owned by ∃ and ∀, respectively, E ⊆ B × B indicates the allowed moves, and Ω : B → ω is a (parity) map with finite range.An infinite sequence (b 0 , b 1 , b 2 , . . . ) of positions is called bad if max{k | k = Ω(b i ) for infinitely many i ∈ ω} is odd.A play in G is a finite or infinite sequence of positions (b 0 , b 1 , . . . ) with the property that (b i , b i+1 ) ∈ E for all i, i.e. all moves are legal, and b 0 is the initial position of the play.A full play is either infinite, or a finite play ending in a position b n where E[b n ] = {b ∈ B | (b n , b) ∈ E} = ∅, i.e. no more moves are possible.A finite play is lost by the player who cannot move, and an infinite play (b 0 , b 1 , . . . ) is lost by ∃ (and won by ∀) iff (b 0 , b 1 , . . . ) is bad.

Theorem 3 . 1 .
[13] At every position b ∈ B ∃ ∪ B ∀ in a parity game G = (B ∃ , B ∀ , E, Ω) one of the players has a history-free winning strategy.Furthermore, for every b∈ B ∃ ∪ B ∀ , it can be determined in time O d • m • n ⌊d/2⌋ ⌊d/2⌋which player has a winning strategy from position b, where n, m and d are the size of B, E and the range of Ω, respectively.

Lemma 3 . 4 .
If Γ ⊆ F(Λ) is finite and clean, then Γ admits a parity function whose range is bounded by the cardinality of Cl(Γ).

Proposition 4 . 8 .
The rule sets introduced in Example 4.5 are both one-step tableau sound and one-step tableau complete with respect to the corresponding structures defined in Example 2.1.

Example 4 . 15 .
Consider the following formula of the coalitional µ-calculus [C]νX.(p∧ [N ]X) ∧ [D]µY.(p∨ [D]Y ) stating that "coalition C can achieve that, from the next stage onwards, p holds irrespective of the strategies used by other agents, and coalition D can ensure (through suitable strategies used in the long term) that p holds after some finite number of steps".Here, we assume that C, D ⊆ N are such that C ∩ D = ∅.Define a parity map Ω for the above formula by Ω(νX.(p ∧ [N ]X)) = 2, Ω(µY.(p∨ [D]Y )) = 1 and Ω(A) = 0 otherwise.The unsatisfiability of this formula is witnessed by the following closed tableau: [C]B ∧ [D]A [C]B ; [D]A B ; A p ∧ [N ]B ; A p ∧ [N ]B ; p ∨ [D]A p ; [N ]B ; p ∨ [D]A p ; [N ]B ; p p ; [N ]B ; [D]A BC ED o o where B = νX.(p∧ [N ]X), A = µY.(p∨ [D]Y ) and where we omitted the annotation α because in this case α can be easily deduced from the structure of the tableau.For example, the annotation for the root node is equal to [C]B ∧ [D]A and for the child of the root the annotation is equal to ( [C]p;[D]q

Theorem 5 . 5 .
Let Γ ∈ S(Λ) be clean and guarded.If ∀ has a winning strategy in G Γ , then Γ has a closed TR-tableau.
However, one can show that both ways of treating fixpoint formulas in the model-checking game are equivalent.We only treat the case A = ♥(A 1 , . . ., A n ); all others are as in loc.cit. .First suppose that M, x |= ♥(A 1 , . . ., A n ).By induction hypothesis, ∃ has a winning strategy from position (A, x ′ ) if and only if M, x ′ |= A for all subformulas A of {A 1 , . . ., A n }.These winning strategies can be extended to provide a winning strategy from ♥(A 1 , . . ., A n ) by stipulating that ∃ move to (♥(A 1 , . . ., A n ), ([[A 1 ]] M , . . ., [[A n