Satisfiability Checking
Abstract
We consider here Linear Temporal Logic (LTL) formulas interpreted over finite traces. We denote this logic by . The existing approach for satisfiability checking is based on a reduction to standard LTL satisfiability checking. We describe here a novel direct approach to satisfiability checking, where we take advantage of the difference in the semantics between LTL and . While LTL satisfiability checking requires finding a fair cycle in an appropriate transition system, here we need to search only for a finite trace. This enables us to introduce specialized heuristics, where we also exploit recent progress in Boolean SAT solving. We have implemented our approach in a prototype tool and experiments show that our approach outperforms existing approaches.
1 Introduction
Linear Temporal Logic (LTL) was first introduced into computer science as a property language for the verification for nonterminating reactive systems [15]. Following that, many researches in AI have been attracted by LTL’s rich expressiveness. Examples of applications of LTL in AI include temporally extended goals in planning [1, 7, 5, 14], plan constraints [2, 9], and user preferences [3, 4, 19].
In a recent paper [10], De Giacomo and Vardi argued that while standard LTL is interpreted over infinite traces, cf. [15], AI applications are typically interested only in finite traces. For example, temporally extended goals are viewed as finite desirable sequences of states and a plan is correct if its execution succeeds in yielding one of these desirable sequences. Also in the area of businessprocess modeling, temporal specifications for declarative workflows are interpreted over finite traces [20]. De Giacomo and Vardi, therefore, introduced , which has the same syntax as LTL but is interpreted over finite traces.
In the formalverification community there is by now a rich body of knowledge regarding automatedreasoning support for LTL. On one hand, there are solid theoretical foundations, cf. [21]. On the other hand, mature software tools have been developed, such as SPOT [8]. Extensive research has been conducted to evaluate these tools, cf. [16]. While the basic theory for was presented at [10], no tool has yet to be developed for , to the best of our knowledge. Our goal in this paper is to address this gap.
Our main focus here is on the satisfiability problem, which asks if a given formula has satisfying model. This most basic automatedreasoning problem has attracted a fair amount of attention for LTL over the past few years as a principled approach to property assurance, which seeks to eliminate errors when writing LTL properties, cf. [16, 13].
De Giacomo and Vardi studied the computational complexity of satisfiability and showed that it is PSPACEcomplete, which is the same complexity as for LTL satisfiability [18]. Their proof of the upper bound uses a reduction of satisfiability to LTL satisfiability. That is, for an formula , one can create an LTL formula such that is satisfiable iff is satisfiable; furthermore, the translation from to involves only a linear blowup. The reduction to LTL satisfiability problem can, therefore, take advantage of existing LTL satisfiability solvers [17, 13]. On the other hand, LTL satisfiability checking requires reasoning about infinite traces, which is quite nontrivial algorithmically, cf. [6], due to the required faircycle test. Such reasoning is not required for satisfiability. A reduction to LTL satisfiability, therefore, may add unnecessary overhead to satisfiability checking.
This paper approaches the satisfiability problem directly. We develop a direct, and more efficient, algorithm for checking satisfiability of , leveraging the existing body of knowledge concerning LTL satisfiability checking. The finitetrace semantics for is fully exploited, leading to considerable simplification of the decision procedure and significant performance boost. The finitetrace semantics also enables several heuristics that are not applicable to LTL satisfiability checking. We also leverage the power of advanced Boolean SAT solvers in our decision procedure. We have implemented the new approach and experiments show that this approach significantly outperforms the reduction to LTL satisfiability problems.
The paper is organized as follows. we first introduce the definition of , the satisfiability problem, and the associated transition system in Section 2. We then propose a direct satisfiabilitychecking framework in Section 3. We discuss various optimization strategies in Section 4, and present experimental results in Section 5. Section 6 concludes the paper.
2 Preliminaries
2.1 LTL over Finite Traces
The logic is a variant of LTL. Classical LTL formulas are interpreted on infinite traces, whereas formulas are defined over the finite traces. Given a set of atomic propositions, an formula has the form:
where (strong Next), (weak Next), (Until), and (Release) are temporal operators. We have and . Note that in , is not true, which is the case in LTL.
For an atom , we call it or its negation () a literal. We use the set to denote the set of literals, i.e. . Other boolean operators, such as and , can be represented by the combination () or (), respectively, and we denote the constant true as and false as . Moreover, we use the notations (Global) and (Eventually) to represent and . We use to represent or LTL formulas, and for propositional formulas.
Note that standard has the same syntax as LTL, see [10]. Here, however, we introduce the operator, as we consider formulas in NNF (Negation Normal Form), which requires all negations to be pushed all the way down to atoms. So a dual operator for is necessary. In LTL the dual of is itself, while in it is .
Proviso: In the rest of paper we assume that all formulas (both LTL and ) are in NNF, and thus there are types of formulas, based on the primary connective: , , literal, , , (and in ), and .
The semantics of formulas is interpreted over finite traces, which is referred to as the interpretations [10]. Given an atom set , we define . Let with , we use to denote the length of . Moreover, for , we use the notation to represent , which is the prefix of before position ( is not included). Similarly, we also use to represent , which is the suffix of from position . Then we define models , i.e. in the following way:

and ;

If is a literal, then iff ;

If , then iff and ;

If , then iff and , or ;

If is an Until formula, then iff there exists such that , and for every it holds as well;

If is a Release formula, then iff either for every holds, or there exists such that and for all it holds as well;

If , then iff and ;

If , then iff or .
The difference between the strong Next () and the weak Next () operators is that requires a next state in the following while may not. Thus is always true in the last state of a finite trace, since no next state is provided. As a result, in is unsatisfiable, while is satisfiable, which is quite different with that in LTL, where neither nor are satisfiable.
Let be an formula, we use to represent the set of conjuncts in , i.e. if , where the root of is not a conjunction. (the set of disjuncts) is defined analogously.
2.2 The Satisfiability Problem
The satisfiability problem is to check whether, for a given formua , there is a finite trace such that :
Definition 1 ( Satisfiability Problem).
Given an formula over the alphabet , we say is satisfiable iff there is a finite trace such that .
One approach is to reduce the satisfiability problem to that of LTL. {theorem}[[10]] The Satisfiability problem for formulas is PSPACEcomplete. Proof Sketch: It is easy to reduce the satisfiability to LTL satisfiability:

Introduce a proposition “Tail”;

Require that Tail holds at position 0;

Require also that Tail stays until it turns into , and after that stays forever ().

The formula is translated into a corresponding LTL formula in the following way:

, where is a literal;

;

;

;

;

;

(The translation here does not require in NNF. Thus the and operators can be handled by the rules and .) Finally one can prove that is satisfiable iff is satisfiable.
The reduction approach can take advantage of existing LTL satisfiability solvers. But, there may be an overhead as we need to find a fair cycle during LTL satisfiability checking, which is not necessary in checking.
2.3 Transition System
In [13], Li et al. have proposed using transition systems for checking satisfiability of LTL formulas. Here we adapt this approach to . First, we define the normal form for formulas.
Definition 2 (Normal Form).
The normal form of an formula , denoted as , is a formula set defined as follows:

if is a propositional formula. If , we define ;

;

;

;

;

;
For each , we say it a clause of .
(Although the normal forms of and formulas are the same, we do distinguished bethween them through the accepting conditions introduced below.) Intuitively, each clause of indicates that the propositionl formula should hold now and then should hold in the next state. For , we can also compute its normal form. We can repeat this procedure until no new states are required.
Definition 3 ( Transition System).
Let be the input formula. The labeled transition system is a tuple where: 1). is the initial state; 2). is the set of conjunctive formulas over ; 3). the transition relation is defined by: iff there exists ; and 4). is the smallest set of formulas such that , and implies .
Note that in LTL transition systems the state can be deleted, as it can never be part of a fair cycle. This state must be kept in transition systems: a finite trace that reach may be accepted in , cf. . Nevertheless, edges are not allowed both in and LTL transition systems.
A run of on finite trace is a sequence such that and for every it holds . We say is reachable from iff there is a run of such that the final state is .
3 SatisfiabilityChecking Framework
In this section we present our framework for checking satisfiability of formulas. First we show a simple lemma concerning finite sequences of length .
Lemma 1.
For a finite trace and formula , if then holds iff:

and ;

If is a literal, then return true if . otherwise return false;

If , then return and ;

If , then return or ;

If , then return false;

If , then return true;

If or , then return .
Proof.
This lemma can be directly proven from the semantics of formulas by fixing . ∎
Now we characterize the satisfaction relation for finite sequences:
Lemma 2.
For a finite trace and formula ,

If , then iff there exists such that and ;

If , then iff there exists such that and ;

iff there exists a run in such that for every it holds that and .
Proof.

is treated to be a finite trace whose length is 1. We prove the first item by structural induction over .

If , then iff and hold, where is actually in ;

If , then holds iff and hold, and iff by induction hypothesis, there exists in such that and (). Let and , then according to Definition 2 we know is in , and and hold; The proof for the case when is similar;

Note that is always false, and if then from Lemma 1 it is always true that iff and ;


The second item is also proven by structural induction over .

If or , then iff and hold, where is actually in ;

If or , since so it is obviously true that iff and hold according to semantics, and obviously is in ;

If , then iff and , and iff by induction hypothesis, there exists such that and hold, and iff and hold, in which is indeed in ; The case when is similar;

If , then iff or . If holds, then by induction hypothesis iff there exists such that and . According to Definition 2 we know is also . On the other hand, if holds, the proofs for formulas are already done. Thus, it is true that iff there exists such that and ; The case when is similar to prove.


Applying the first item if and recursively applying the second item if , we can prove the third item.
∎
Lemma 2 states that, to check whether a finite trace satisfies the formula , we can find a run of on such that can finally reach the transition and satisfies , and moreover . Now we can give the main theorem of this paper.
Given an formula and a finite trace , we have that holds iff there exists a run of on which ends at the transition satisfying .
Proof.
Combine the first and third items in Lemma 2, and we can easily prove this theorem. ∎
We say the state in is accepting, if there exists a transition such that . Theorem 3 implies that, the formula is satisfiable if and only if there exists an accepting state in which is reachable from the initial state . Based on this observation, we now propose a simple onthefly satisfiabilitychecking framework for as follows:

If equals , return is satisfiable;

The checking is processed on the transition system onthefly, i.e. computing the reachable states step by step with the DFS (Depth First Search) manner, until an accepting one is reached: Here we return satisfiable;

Finally we return unsatisfiable if all states in the whole transition system are explored.
The complexity of our algorithm mainly depends on the size of constructed transition system. The system construction is the same as the one for LTL proposed in [13]. Given an formula , the constructed transition system has at worst the size of , where is the set of subformulas of .
4 Optimizations
In this section we propose some optimization strategies by exploiting SAT solvers. First we study the relationship between the satisfiability problems for and LTL formulas.
4.1 Relating to LTL Satisfiability
In this section we discuss some connections between and LTL formulas. We say an formula is free iff does not have the operator. Note that formulas may contain the operator, while standard LTL ones do not. Here consider free formulas, in which and LTL have the same syntax. First the following lemma shows how to extend a finite trace into an infinite one but still preserve the satisfaction from to LTL:
Lemma 3.
Let and an formula which is free, then implies when is considered as an LTL formula.
Proof.
We prove it by structural induction over :

If is a literal , then implies . Thus is true; And if is , then is obviously true;

If , then implies and . By induction hypothesis we have and . So ; The proof is similar when ;

If , then according to Lemma 1 we know cannot happen; And since is free, so cannot be a formula;

If , then implies according to Lemma 1. By induction hypothesis we have . Thus is true from the LTL semantics; Similarly when , we know for every it is true that . Thus holds from the LTL semantics; The proof is done.
∎
We showed earlier that satisfiability can be reduced to LTL satisfiability problem. We show that the satisfiability of some formulas implies satisfiability of LTL formulas: {theorem} Let be an free formula. If is satisfiable as an formula, then is also satisfiable as an LTL formula.
Proof.
Equivalently, if is an LTL formula and is unsatisfiable, then the formula is also unsatisfiable. Note here the formula is free since it can be considered as an LTL formula.
Example 1.

Consider the free formula , whose transition system is shown in Figure 2. If is treated as an LTL formula, then we know that the infinite trace satisfies . However, if is considered to be an formula, then we know from that no accepting state exists in the transition system, so it is unsatisfiable. It is due to the fact that no transition in satisfies the condition .

Consider another example formula , whose transition system is shown in Figure 2. Here we can find an accepting state (, as and hold). Thus we know that is satisfiable, interpreted over both finite or infinite traces.
4.2 Obligation Formulas
For an LTL formula , Li et al. [13] have defined its obligation formula and show that if is satisfiable then is satisfiable. Since is essentially a boolean formula, so we can check it efficiently using modern SAT solvers. However this cannot apply to directly, which we illustrate in the following example.
Example 2.
Consider , where is a satisfiable propositional formula. It is easy to see that it is satisfiable if it is an LTL formula (with respect to some word ), while unsatisfiable when it is an formula (because no finite trace can end with the point satisfying ). From [12], the obligation formula of is , which is obviously satisfiable. So the satisfiability of obligation formula implies the satisfiability of LTL formulas, but not that of formulas.
We now show how to handle of Next operators ( and ) after the Release operators. For a formula , we define three obligation formulas:
Definition 4 (Obligation Formulas).
Given an formula , we define three kinds of obligation formulas: global obligation formula, release obligation formula, and general obligation formula–denoted as , and , by induction over . (We use ofx as a generic reference to ofg, ofr, and off.)

if ; and if ;

If is a literal, then ;

If , then ;

If , then ;

If , then , and ;

If , then , and ;

If , then .

If , then , and
For example in the third item, the equation represents actually three: , and .
For , the changes in comparison to [12] are the definition for release formulas, and introducing the operator. For example, we have that is rather than . Moreover, since the formula is satisfiable, the definition of is required to identify this situation. (Below we show a fast satisfiabilitychecking strategy that uses global obligation formulas.)
The obligationacceleration optimization works as follows: {theorem}[Obligation Acceleration] For an formula , if is satisfiable then is satisfiable.
Proof.
Since is satisfiable, there exists such that . We prove that there exists where such that , by structural induction over . Note the cases or are trivial. For other cases:

If , then from Definition 4. So is satisfiable implies that there exists and . By induction hypothesis there exists () such that (). Assume , then let . Then, .

If or , then is satisfiable iff is satisfiable. So there exists models . By induction hypothesis, there exists such that , thus according to semantics, we know ;

If, then . Thus is also satisfiable. So there exists , based on which we can show that by structural induction over by a similar proof. Thus Let and according to Lemma 1 we know implies . The case for Until can be treated in a similar way, thus the proof is done.
∎
4.3 A Complete Acceleration Technique for Global Formulas
The obligationacceleration technique (Theorem 4.2) is sound but not complete, see the formula , in which is unsatisfiable, while is, in fact, satisfiable. In the following, we prove that both soundness and completeness hold for the global formulas, which are formulas of the form of , where is an arbitrary formula.
[Obligation Acceleration for Global formulas] For a global formula , we have that is satisfiable iff is satisfiable.
Proof.
For the forward direction, assume that is satisfiable. It implies that there is a finite trace satisfying . According to Theorem 3, can run on and reaches an accepting state , i.e., and . Since is a global formula and is reachable from , it is not hard to prove that from Definition 3. So is also true. Since is a global formula so holds from Lemma 1. Then one can prove that by structural induction over (it is left to readers here), which implies that is satisfiable.
For the backward direction, assume is satisfiable. So there exists such that . Then one can prove is also true by structural induction over (). For paper limit, this proof is left to readers. So is satisfiable. The proof is done. ∎
4.4 Acceleration for Unsatisfiable Formulas
5 Experiments
In this section we present an experimental evaluation. The algorithms are implemented in the LfSat tool^{1}^{1}1Tool will be released upon paper publication.. We have implemented three optimization strategies. They are 1). off: the obligation acceleration technique for (Theorem 4.2); 2). ofg: the obligation acceleration for global formula (Theorem 4.3); 3). ofp: the acceleration for unsatisfiable formulas (Section 4.4). Note that all three optimizations can benefit from the power of modern SAT solvers.
We compare our algorithm with the approach using offtheshelf tools for checking LTL satisfiability. We choose the tool Polsat, a portfolio LTL solver, which was introduced in [11]. One main feature of Polsat is that it integrates most existing LTL satisfiability solvers; consequently, it is currently the bestofbreed LTL satisfiability solver. The input of LfSat is directly an formula , while that of Polsat should be , which is the LTL formula that is equisatisfiable with the formula .
The experimental platform of this paper is a cluster that consists of 47 IBM Power 755 nodes, each of which contains four eightcore POWER7 processors running at 3.86GHz. In our experiments, both LfSat and Polsat occupy a unique node, and Polsat runs all its integrated solvers in parallel by using independent cores of the node. The time is measured by Unix time command, and each test case has the maximal limitation of 60 seconds.
Since LTL formulas are also formulas, we use existing LTL benchmarks to test the tools. We compare the results from both tools, and no inconsistency occurs.
5.1 Schuppancollected Formulas
We consider first the benchmarks introduced in previous works [17]. The benchmark suite there include earlier benchmark suites (e.g., [16]), and we refer to this suite as Schuppancollected. The Schuppancollected suite has a total amount of 7448 formulas. The different types of benchmarks are shown in the first column of Table 1.
Formula type  LfSat(sec.)  Polsat(sec.)  Polsat/LfSat 

/acacia/example  1.5  3.3  2.2 
/acacia/demov3  1.4  604.7  431.9 
/acacia/demov22  2.0  1.3  0.65 
/alaska/lift  23.0  7319.6  318.2 
/alaska/szymanski  1.2  7.3  6.1 
/anzu/amba  2120.9  2052.9  0.97 
/anzu/genbuf  3606.9  3717.9  1.0 
/rozier/counter  1840.3  3009.3  1.6 
/rozier/formulas  552.9  467.0  0.8 
/rozier/pattern  22.9  49.9  2.1 
/schuppan/O1formula  2.9  7.1  2.4 
/schuppan/O2formula  3.1  1265.0  408.1 
/schuppan/phltl  226.3  602.5  2.6 
/trp/N5x  10.5  42.0  4.0 
/trp/N5y  2764.9  2777.4  1.0 
/trp/N12x  22.8  24061.1  1055.3 
/trp/N12y  4040.2  4049.2  1.0 
Total  15244.2  50038.2  3.2 
Table 1 shows the experimental results on Schuppancollected benchmarks. The fourth column of the table shows the speedup from LfSat to Polsat. One can see that the results from LfSat outperforms those from Polsat, often by several orders of magnitudes. We explain some of them.
The formulas in “Schuppancollected/alaska/lift” are mostly unsatisfiable, which can be handled by the ofg technique of LfSat. On the other side, Polsat needs more than 300 times to finish the checking. The same happens on the “Schuppancollected/trp/N12x” patterns, in which LfSat is more than 1000 times faster. For the “Schuppancollected/schuppan/O2formula” pattern formulas, LfSat scales better due to the ofp technique.
Among the results from LfSat, totally 5879 out of 7448 formulas in the benchmark are checked by using the off technique. This indicates the off technique is very efficient. Moreover, 84 of them are finished by exploring whole system in the worst time, which requires further improvement. Overall, we can see Polsat is three times slower on this benchmark suite than LfSat.
5.2 Random Conjunction Formulas
Random conjunction formulas have the form of , where is randomly selected from typical small pattern formulas widely used in model checking [13]. By randomly choosing the that atoms the small patterns use, a large number of random conjunction formulas can be generated. More specially, to evaluate the performance on global formulas, we also fixed the selected by a random global pattern, and thus create a set of global formulas. In our experiments, we test 10,000 cases each for both random conjunction and global random conjunction formulas, with the number of conjunctions varying from 1 to 20 and 500 cases for each number.
Figure 4 shows the comparison results on random conjunction formulas. On average LfSat earns about 10% improving performance on this kind of formulas. Among all the 10,000 cases, 8059 of them are checked by the off technique; 1105 of them are obtained by the ofg technique; 508 are acquired by the ofp technique; and another 107 are from an accepting state. There are also 109 formulas equivalent to or , which can be directly checked. In the worst case, 76 formulas are finished by exploring the whole transition system. About 36 formulas fail to be checked within 60 seconds by LfSat. Statistics above show the optimizations are very useful.
Moreover, one can conclude from Figure 4 that, LfSat dominates Polsat when performing on the global random conjunction formulas. As the ofg technique is both sound and complete for global formulas and invokes SAT solvers only once, so LfSat performs almost constant time for checking both satisfiable and unsatisfiable formulas. Compared with that, Polsat takes an ordinary checking performance for this kind of special formulas. Indeed, the ofg technique is considered to play the crucial role on checking global formulas.
6 Conclusion
In this paper we have proposed a novel satisfiabilitychecking framework based on the transition system. Meanwhile, three different optimizations are introduced to accelerate the checking process by using the power of modern SAT solvers, in which particularly the ofg optimization plays the crucial role on checking global formulas. The experimental results show that, the checking approach proposed in this paper is clearly superior to the reduction to LTL satisfiability checking.
References
 [1] F. Bacchus and F. Kabanza, ‘Planning for temporally extended goals’, Ann. of Mathematics and Artificial Intelligence, 22, 5–27, (1998).
 [2] F. Bacchus and F. Kabanza, ‘Using temporal logic to express search control knowledge for planning’, Artificial Intelligence, 116(1–2), 123–191, (2000).
 [3] M. Bienvenu, C. Fritz, and S. McIlraith, ‘Planning with qualitative temporal preferences’, in International Conference on Principles of Knowledge Representation and Reasoning (KR06), pp. 134–144, Lake District, UK, (June 2006).
 [4] M. Bienvenu, C. Fritz, and S. A. McIlraith, ‘Specifying and computing preferred plans’, Artificial Intelligence, 175(7¨C8), 1308 – 1345, (2011).
 [5] D. Calvanese, G. De Giacomo, and M.Y. Vardi, ‘Reasoning about actions and planning in LTL action theories’, in Proc. 8th Int’l Conf. on the Principles of Knowledge Representation and Reasoning, pp. 593–602. Morgan Kaufmann, (2002).
 [6] C. Courcoubetis, M.Y. Vardi, P. Wolper, and M. Yannakakis, ‘Memory efficient algorithms for the verification of temporal properties’, Formal Methods in System Design, 1, 275–288, (1992).
 [7] G. De Giacomo and M.Y. Vardi, ‘Automatatheoretic approach to planning for temporally extended goals’, in Proc. European Conf. on Planning, Lecture Notes in AI 1809, pp. 226–238. Springer, (1999).
 [8] A. DuretLutz and D. Poitrenaud, ‘SPOT: An extensible model checking library using transitionbased generalized büchi automata’, in Proc. 12th Int’l Workshop on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, pp. 76–83. IEEE Computer Society, (2004).
 [9] A. Gabaldon, ‘Precondition control and the progression algorithm’, in Proceedings of the 9th International Conference on Knowledge Representation and Reasoning (KR, pp. 634–643. AAAI Press, (2004).
 [10] G. De Giacomo and M. Vardi, ‘Linear temporal logic and linear dynamic logic on finite traces’, in Proceedings of the TwentyFourth International Joint Conference on Artificial Intelligence, IJCAI’13, pp. 2000–2007. AAAI Press, (2013).
 [11] J. Li, G. Pu, L. Zhang, M. Y. Vardi, and J. He, ‘Polsat: A portfolio LTL satisfiability solver’, CoRR, abs/1311.1602, (2013).
 [12] J. Li, G. Pu, L. Zhang, M. Y. Vardi, and J. He, ‘Fast LTL satisfiability checking by sat solvers’, CoRR, abs/1401.5677, (2014).
 [13] J. Li, L. Zhang, G. Pu, M. Vardi, and J. He, ‘LTL satisfibility checking revisited’, in The 20th International Symposium on Temporal Representation and Reasoning, pp. 91–98, (2013).
 [14] F. Patrizi, N. Lipoveztky, G. De Giacomo, and H. Geffner, ‘Computing infinite plans for LTL goals using a classical planner’, in Proceedings of the TwentySecond International Joint Conference on Artificial Intelligence, IJCAI’11, pp. 2003–2008. AAAI Press, (2011).
 [15] A. Pnueli, ‘The temporal logic of programs’, in Proc. 18th IEEE Symp. on Foundations of Computer Science, pp. 46–57, (1977).
 [16] K.Y. Rozier and M.Y. Vardi, ‘LTL satisfiability checking’, Int’l J. on Software Tools for Technology Transfer, 12(2), 1230–137, (2010).
 [17] V. Schuppan and L. Darmawan, ‘Evaluating LTL satisfiability solvers’, in Proceedings of the 9th international conference on Automated technology for verification and analysis, AVTA’11, pp. 397–413. SpringerVerlag, (2011).
 [18] A.P. Sistla and E.M. Clarke, ‘The complexity of propositional linear temporal logic’, Journal of the ACM, 32, 733–749, (1985).
 [19] S. Sohrabi, J. A. Baier, and S. A. McIlraith, ‘Preferred explanations: Theory and generation via planning’, in Proceedings of the 25th Conference on Artificial Intelligence (AAAI11), pp. 261–267, San Francisco, USA, (August 2011). Accepted as both oral and poster presentation.
 [20] W. M. P. van der Aalst, M. Pesic, and H. Schonenberg, ‘Declarative workflows: Balancing between flexibility and support.’, Computer Science  R&D, 99–113, (2009).
 [21] M.Y. Vardi, ‘An automatatheoretic approach to linear temporal logic’, in Logics for Concurrency: Structure versus Automata, eds., F. Moller and G. Birtwistle, volume 1043 of Lecture Notes in Computer Science, pp. 238–266. Springer, (1996).