Büchi Complementation: A Forty-Year Saga

The complementation problem for nondeterministic word automata has numerous applications in formal verification. In order to check that the language of an automaton A1 is contained in the language of a second automaton A2, one checks that the intersection of A1 with an automaton that complements A2 is empty. Many problems in verification and design are reduced to language containment. In model checking, the automaton A1 corresponds to the system, and the automaton A2 corresponds to the property we wish to verify [13, 22]. While it is easy to complement properties given in terms of formulas in temporal logic, complementation of properties given in terms of automata is not simple. Indeed, a word w is rejected by a nondeterministic automaton A if all the runs of A on w rejects the word. Thus, the complementary automaton has to consider all possible runs, and complementation has the flavor of determinization. For automata on finite words, determinization, and hence also complementation, is done via the subset construction [17]. Accordingly, if we start with a nondeterministic automaton with n states, the complementary automaton may have 2 states. The exponential blow-up that is caused by the subset construction is justified by a tight lower bound: it is proved in [19] that for every n > 1, there exists a language Ln that is recognized by a nondeterministic automaton with n states, yet a nondeterministic automaton for the complement of Ln has at least 2 states (see also [2]). For Büchi automata on infinite words, which are required for the modeling of liveness properties, optimal complementation constructions are quite complicated, as the subset construction is not sufficient (but see erroneous claim in [16]). Due to the lack of a simple complementation construction, the user is typically required to specify the property by a deterministic Büchi automaton [13] (it is easy to complement a deterministic Büchi automaton), or to supply the automaton for the negation of the property [9]. Similarly, specification formalisms like ETL [23], which have automata within the logic, involve complementation of automata, and the difficulty of complementing Büchi automata is an obstacle to practical use [1]. In fact, even when the properties are specified in LTL, complementation is useful: the translators from LTL into automata have reached a remarkable level of sophistication (c.f., [4, 21, 6, 7]). Even though complementation of the automata is not explicitly