On the Complexity of Resource-Bounded Logics

. We revisit decidability results for resource-bounded logics and use decision problems for vector addition systems with states (VASS) to characterise the complexity of (decidable) model-checking problems. We show that the model-checking problem for the logic RB ± ATL is 2 EXPTIME -complete by using recent results on alternating VASS. In addition, we establish that the model-checking problem for RBTL is decidable and has the same complexity as for RBTL ∗ (the extension of RBTL with arbitrary path formulae), namely EXPSPACE -complete, proving a new decidability result as a by-product of the approach. Finally, we establish that the model-checking problem for RB ± ATL ∗ is decidable by a reduction to parity games, and show how to synthesise values for resource parameters.

for a given set of agents can lead to undecidability, or decidability with a very high worst-case upper bound on the complexity of the model checking problem. The nature of the strategy modalities means that reasoning about resources has similarities to the analysis of runs of vector addition systems with states (a.k.a. VASS) [34], and more specifically to games on VASS, see e.g. [11]. VASS, and more generally counter machines, are well-known infinite-state systems with many applications in formal verification, see e.g. [10].
Model checking and games on VASS. This paper is an extended version of [2]. In our work, we show how existing results on VASS can be used to analyse the model checking problem for resource-bounded logics. As we recall below, model checking problems on VASS based on temporal logics and games are not always decidable; when they are decidable, they are quite difficult to solve, and complexity characterisations often exist. We briefly recapitulate some of these results below.
Temporal logics on VASS often lead to undecidable model checking problems, see e.g., [24,25], and this is even more true with branching-time temporal logics such as CTL [25], or when the atomic formulae can express properties about counter values [29]. There are exceptions, however. For instance, CTL model checking on onecounter VASS is PSPACE-complete [43,26] (see also [46]). The control state repeated reachability problem for VASS is shown to be decidable in [30]; this result is generalised to full LTL (for which the atomic formulae correspond exactly to the control states), and the model checking problem for LTL on VASS is shown to be EXPSPACEcomplete in [28]. In [30], a strict fragment of LTL restricted to the "infinitely often" temporal operator GF and atomic formulae stating properties on counter values is also shown decidable by a reduction to the reachability problem for VASS.
As far as games for VASS are concerned, the situation is even less encouraging. Indeed, two-player games on VASS in which each player can freely update the counter values are undecidable [11], even with simple winning conditions such as the reachability of a given control state. However, asymmetric VASS games in which at most one player can freely update the counter values and the winning conditions are simple are decidable [40]. For instance, the games on asymmetric VASS with reachability of a control state is shown to be 2EXPTIME-complete in [17], decidable with parity conditions in [1,31] and very recently, a 2EXPTIME upper bound was shown in [16]. The non-termination problem for games on asymmetric VASS is also 2EXPTIME-complete (the upper bound is from [33] and the lower bound is from [17]).
Our motivation. Our main goal in this paper is to establish formal relationships between model checking problems for resource-bounded logics and decision problems for VASS, so that new decidability results can be established for logical problems or new complexity characterisations can be inherited from problems on counter machines. Of course, this is not surprising; resource values and counter values are similar objects, and logics based on concurrent game structures inherently have games in their semantics. Moreover, earlier work has already explored the connections with counter machines, either to obtain undecidability results or to get complexity lower bounds, see e.g. [3]. In this paper, we extend these results to give optimal complexity upper bounds and new decidability results, even for resource-bounded logics with enriched path formulae such as those in CTL * [23] (see also [20]).
Our contributions. As explained above, our approach is to use results from decision problems for alternating VASS (or for its variants with single-sided VASS) to establish new decidability and complexity results for model checking problems on resourcebounded logics. So far, the reductions were rather in the other direction to establish undecidability results (for instance, by reducing the halting problem for Minsky machines).
• The model checking problem for RB±ATL is shown to be 2EXPTIME-complete (see Theorem 2 and Theorem 3). The restriction to a bounded number of resources is also shown to be in EXPTIME. The 2EXPTIME lower bound is obtained by a reduction from the state reachability problem for alternating VASS (AVASS) [17], where the upper bound is shown by a reduction to the state reachability and the non-termination problem for AVASS. We need to consider both target problems in order to reduce our logical problem to questions on AVASS, since the logics can express both reachability and non-termination or invariant properties. So far, the best known result was decidability established in [4] by taking advantage of the well-quasi-ordering (N r , ).
• The results for RB±ATL are obtained by using formal relationships between strategies in resource-bounded concurrent game structures and proofs in alternating VASS (the fact that only asymmetric VASS are needed here is the key observation). These relationships are also used to show that the model checking problem for RB±ATL * (a new logic extending RB±ATL as ATL * extends ATL [6]), is decidable, by a reduction to the parity game problem on single-sided VASS [1]. Note that the complexity characterisation of the parity game problem on single-sided VASS was left open in [1,17,33] and it has been recently solved in [16], which allows us to characterise the complexity of the model-checking problem for RB±ATL * . More importantly, we show that resource parameters can be effectively computed in the parameterised version of RB±ATL * thanks to the fact that the Pareto frontier for any parity game on single-sided VASS is computable [1,Theorem 4]. To the best of our knowledge, this is the first time that resource values have been synthesised in resource-bounded logics (see also [32]), and this is done for the rich new logic RB±ATL * .
• The model checking problem for RBTL [12] is shown to be EXPSPACE-complete. The restriction to a bounded number of resources is also shown to be in PSPACE. The model checking problem for RBTL * is shown to be decidable (a new result), and also EXPSPACE-complete (see Theorem 5).
In addition, we also provide complexity characterisations for various fragments of the logic that, e.g., bound the number the resources or the number of agents. For example, the model checking problem for RB±ATL restricted to a single agent is shown to be EXPSPACE-complete (Theorem 4).

Logical Preliminaries
We write N (resp. Z) for the set of natural numbers (including 0) (resp. integers) and [m, m ] with m, m ∈ Z to denote the set { j ∈ Z : m ≤ j ≤ m }. Given a dimension r ≥ 1 and a ∈ Z, we write a ∈ Z r to denote the vector with all values equal to a. For each x ∈ Z r , we write x(1), . . . , x(r) for the entries of x. For all x, y ∈ Z r , x y def ⇔ for every i ∈ [1, r], we have x(i) ≤ y(i). We also write x ≺ y when x y and x y.

The logic RB±ATL and its variants
We consider the logics RB±ATL and RB±ATL * . The logic RB±ATL was introduced in [4,5], and extends ATL [6] with resources. RB±ATL * extends RB±ATL to allow path formulae to be any LTL-like formula (see Section 6 for a complete formal definition).
Let PROP be a countably infinite set of atomic propositions. The models for the logics RB±ATL and RB±ATL * are the structures introduced in Definition 1 below. These are concurrent game structures for the logics ATL or ATL * (see e.g. [6]) but enriched with a cost function that specifies how resources are produced or consumed. Intuitively, a concurrent game structure is equipped with r counters and state transitions update their values with increments or decrements. Definition 1. A resource-bounded concurrent game structure M is a tuple M = (Agt, S, Act, r, act, cost, δ, Lab) such that: • Agt is a non-empty finite set of agents (by default Agt = [1, k] for some k ≥ 1); • S is a non-empty set of states; • Act is a non-empty set of actions with a distinguished action idle; • r ≥ 1 is the number of resources; • act : S × Agt → P(Act) \ {∅} is the action manager function, such that for all s and a, act(s, a) is non-empty and furthermore we have idle ∈ act(s, a) (some variants of the main logic will give up the existence of idle while obeying the non-emptiness of act(s, a)); • cost : S × Agt × Act → Z r is the (partial) cost function; that is, cost(s, a, a) is defined only when a ∈ act(s, a), 1 and moreover, we stipulate cost(s, a, idle) = 0; • δ : S×(Agt → Act) → S is the (partial) transition function such that δ is defined for a state s and a map f : Agt → Act whenever for all agents a ∈ Agt, we have f(a) ∈ act(s, a); = Agt, we have f(i) = a i . We say that M is finite whenever S and Act are finite sets and Lab is restricted to a finite subset of PROP. The size of a finite M is understood as the size of its encoding when integers are encoded in binary and the maps and sets are encoded in extension, i.e. without any succinct encoding. For example, the size of the part of M dedicated to the transition function δ is polynomial in O(card(S) × card(Act) card(Agt) × card(S)). Here, we use the standard encoding as in [6] and we do not consider compact encodings in this paper. Figure 1 presents a finite concurrent game structure (costs are omitted).
The idle action was introduced in [4,5], where motivations for requiring a distinguished 0-cost action can be found (in Section 6.5 below, we explain why the idle action is not essential for decidability). Given a coalition A ⊆ Agt and a state s, a joint action by A is a map f : A → Act such that for all agents a ∈ A, we have f(a) ∈ act(s, a). The set of joint actions by A is denoted D A (s). A joint action by Agt is a special case of a joint action by A ⊆ Agt. Given a state s, the set of joint actions by Agt is simply denoted D(s) (instead of D Agt (s)) and the map δ is defined only for such joint actions. We write f g whenever g is a conservative extension of f (for agents a in the domain of f, g(a) = f(a), and the domain of g contains at least the agents in the domain of f).
Given a joint action f ∈ D A (s), we write out(s, f) to denote the set below: For instance, out(s, f) is a singleton set when f ∈ D(s), i.e. if an action is specified for each agent, since δ is a map and not a relation. Given a joint action f ∈ D A (s) and a state s, the cost of a transition from s by f (restricted to A by definition) is defined as follows: cost A (s, f) def = a∈A cost(s, a, f(a)).
Note that the value cost A (s, f) does not depend on the costs of the actions by the agents in the opponent coalition (Agt \ A) (or equivalently, the cost of actions by agents in (Agt \ A) is zero). More generally, given g ∈ D(s), we have , g(a)).
So, the definition of cost A (s, g) can be viewed as a generalisation of the definition of A computation λ is a finite sequence or an ω-sequence of the form s 0 2 Here, |λ| denotes the length of λ, each s i is a state and each f i belongs to D(s i ). For instance, |s 0 and |s 0 − → · · · | = ω for any infinite computation. A strategy F A for the coalition A is a map from the set of finite computations to the set of joint actions of A such that The notion of strategy we define here is somewhat stronger than in ATL, agents can make their strategy dependent on actions. So, even if the sequence of states is the same, actions assigned by a strategy can be different depending on the sequence of actions. This does not make a difference if purely qualitative ATL formulae are considered.
. A computation λ that respects F A is maximal whenever it cannot be extended further while respecting the strategy. Note that maximal computations respecting F A are infinite. The set of all maximal computations that respect the strategy F A that start at the state s is denoted by Comp(s, F A ). So far, no resource value has been involved in computations. Below, we shall quantify over maximal computations that respect a strategy, and therefore for defining a strategy we can restrict ourselves to finite computations that respect it so far.
Given a bound b ∈ (N ∪ {ω}) r and a computation λ = s 0 , let the resource availability at step i < |λ| be defined as follows: v 0 def = b and for all i+1 < |λ|, v i+1 def = cost A (s i , f i )+ v i (assuming that n+ω = ω for any n ∈ Z). Then, λ is b-consistent iff for all i < |λ|, v i ∈ (N∪{ω}) r . If b(i) = ω, we have an infinite supply of the ith resource and effectively disregard what happens on the ith resource. Since the resource availability of the sequence depends only on the agents in A, this is called the proponent restriction condition. This condition is very similar to that found in runs of VASS with the sequence of update vectors cost A (s 0 , f 0 ), cost A (s 1 , f 1 ), . . .. Note also that the above condition is slightly different from the one in [5] but equivalent. We have decided to use our notation in order to more easily show the relationships with VASS decision problems.
The set of all the b-consistent (infinite) computations is denoted by Comp(s, This definition also differs slightly from that given in [5]; the notion of b-strategy in [5] is not relative to a state and therefore the equality should hold for all states. With the main definitions of resource-bounded concurrent game structures and strategies in hand, we can now present the logic RB±ATL. Given a set of agents Agt = {1, . . . , k} and r ≥ 1, we write RB±ATL(Agt, r) to denote the resource-bounded logic with k agents and r resources whose models are resource-bounded concurrent game structures with the same parameters. Formulae of RB±ATL(Agt, r) are defined according to the grammar below: The meaning of A b Xφ is that A have a strategy which can be executed within the resource bound b to enforce φ in the next state (essentially, A have a joint action which consumes less than b resources and is guaranteed to achieve a φ-state whatever the opponents do). A b Gφ means that A have a strategy which can be executed within the resource bound b to maintain φ forever. A b φ 1 Uφ 2 means that A have a strategy which can be executed within the resource bound b to reach a φ 2 -state while maintaining φ 1 . Since resource bounds may include ω, which means that there is no resource bound on the strategy, RB±ATL includes ATL. Similarly to ATL, the language of RB±ATL includes G rather than the release operator R, even though R is not expressible in ATL [35] (hence also not in RB±ATL). The main reason for the choice of operators is consistency with ATL as defined in [6] and RB±ATL as defined in [4], and the fact that this choice of operators appears to be sufficient to describe properties of interest in verification problems. An example property that can be expressed in RB±ATL is 'Agents a and b have a strategy which requires at most 100 units of energy to reach a position where a can stay in orbit forever without requiring any additional energy, and while they are reaching this position they can also always abort the mission, again with no energy requirement'. This can be expressed as The size of a formula is computed from a DAG representation and the integers are encoded in binary. Note that forthcoming hardness results do not use the conciseness of the DAG representation (with respect to the tree representation). The satisfaction relation | = is defined inductively as follows assuming that M is an RB±ATL(Agt, r) model (we omit the obvious cases for the Boolean connectives): Standard semantics for temporal operators. It is worth noting that since all the maximal computations are infinite, the index i involved for clauses related to A b G or A b U can take any value in N. The temporal operators X, G and U have their standard meaning from linear-time temporal logic LTL. CTL formulae can be expressed by RB±ATL formulae (as it is also classically the case with ATL) if resources are omitted from resource-bounded concurrent game structures thanks to correspondences of the form Agt ω Gp ≈ EGp, ∅ ω p 1 Up 2 ≈ A(p 1 Up 2 ) and ∅ ω Gp ≈ AGp, etc.
Ability to safely extend any finite strategy. The presence of the idle action allows a (partially defined) strategy to be extended to an infinite strategy as soon as a formula is satisfied along the computations. For instance, M, s | = A b Xφ is equivalent to the existence of f ∈ D A (s) such that for all g f, we have M, s | = φ with δ(s, g) = s and b + cost A (s, f) 0.
Upward closure. Observe also that a strategy modality A b reduces the impact of the function cost in two ways. If the ith component of b is equal to ω, then there are no constraints on the ith resource along the computation. Moreover, the restriction of cost to proponent agents in A means that the actions of the opponents cost nothing and are always available. In addition, it is worth noting that A b φUψ ⇒ A b φUψ and A b Gφ ⇒ A b Gφ are valid (with φ 1 ⇒ ψ 2 an abbreviation for ¬(ψ 1 ∧ ¬ψ 2 )) whenever b b , and therefore whenever M, s | = A b φUψ there is a finite set of minimal elements m ∈ (N ∪ {ω}) r (with respect to ) such that M, s | = A m φUψ, similarly for A b Gφ (by Dickson's Lemma [22] every upward closed set of (N ∪ {ω}) r admits a finite basis of minimal elements; see also the notion of Pareto frontier in Section 6).
Alternative semantics. In the definition of the satisfaction relation | = for RB±ATL, in the clauses for a strategy modality followed by a temporal formula, there is an existential quantification over a b-strategy F A with respect to a state s followed by a universal quantification over all the computations in Comp(s, F A ). By definition, Comp(s, F A ) = Comp(s, F A , b), and therefore all the computations involved in the universal quantification are maximal and infinite, and, of course, all the underlying resource availabilities along the computations are non-negative. Alternative definitions have been considered in the literature that separate maximality from infinity, leading sometimes to different decidability results. For instance, with the infinite semantics, the existential quantification is over a strategy (that is not necessarily a b-strategy), and the universal quantification is made only over infinite computations that respect the strategy (typically nothing is required on maximal and finite computations). Under certain assumptions, this may lead to undecidability, see e.g. [5,Section 6]. Similarly, with the finite semantics, the existential quantification is over a strategy (that is not necessarily a b-strategy), and the universal quantification is made only over maximal (either finite or infinite) computations that respect the strategy. In this paper, we shall not investigate logics with these alternative semantics, as from our technical developments of alternating VASS, we can easily derive new decision problems on alternating VASS that correspond to such logical variants. Another way to define alternative semantics is to change the notion of resource-bounded concurrent game structures; for example, by assuming that there is no distinguished idle action, or requiring that the action manager function is of the form act : S × Agt → P(Act), i.e. an agent may be unable to choose an action from a given state (because the action manager returns an empty set of actions in that state). In what follows, we shall investigate these variants by simply adapting the techniques for RB±ATL with the standard semantics defined above.
The model checking problem for RB±ATL is defined as follows: A key contribution of this paper is characterising the computational complexity of the model checking problem for RB±ATL. Obviously, RB±ATL is a quantitative extension of ATL, and whereas the satisfaction of ATL formulae can be restricted to positional strategies (i.e., actions are chosen based on the current state rather than histories), the satisfaction of RB±ATL formulae may require non-positional strategies in order to keep the amount of each resource above zero.

Problems on Vector Addition Systems with States (VASS)
In this section, we recall known complexity/decidability results for model checking and games on VASS, and state necessary complexity characterisations that will be used in the sequel. We then show that using optimal decision procedures for VASS problems as black boxes leads to optimal decision procedures for model checking problems of resource-bounded logics.

Alternating VASS
A binary tree T, which may contain nodes with (only) one child, is a non-empty subset of {1, 2} * such that, for all n ∈ {1, 2} * and i ∈ {1, 2}, n · i ∈ T implies n ∈ T and, n · 2 ∈ T implies n · 1 ∈ T. The nodes of T are its elements. The root of T is ε, the empty word. All notions such as parent, first child, second child, subtree and leaf, have their standard meanings. The height of T is the length, i.e. the number of nodes, of the longest simple path from the root to a leaf. An alternating VASS (AVASS) [17] is a tuple A = (Q, r, R 1 , R 2 ) such that: • Q is a non-empty finite set of locations (a.k.a. control states) and r ≥ 0 is the number of resource values; • R 1 is a finite subset of Q × Z r × Q (unary rules); • R 2 is a (finite) subset of Q 3 (fork rules).
A derivation skeleton of A is a labelling D : T → (R 1 ∪ R 2 ∪ {⊥}) such that: • T is a binary tree; • if n has one child in T, then D(n) ∈ R 1 ; • if n has two children in T, then D(n) ∈ R 2 ; • if n is a leaf in T, then D(n) =⊥; • if D(n) = (q, u, q ) and D(n · 1) ∈ R 1 ∪ R 2 , then the first location of D(n · 1) is q ; • if D(n) = (q, q 1 , q 2 ) and D(n · i) ∈ R 1 ∪ R 2 for some i ∈ {1, 2}, then the first location of D(n · i) is q i .
A derivation of A based on D is a labellingD : T → Q × Z r such that: • if n has one child n in T, D(n) = (q, u, q ) andD(n) = (q, v), thenD(n ) = (q , u + v); • if n has two children n and n in T, D(n) = (q, q 1 , q 2 ) andD(n) = (q, v), then Note that fork rules do not update the resources, and therefore there is an asymmetry between unary rules and fork rules. This will be a very useful feature later, when dealing with the proponent restriction condition in RB±ATL. Unlike branching VASS (see e.g., [45,21]), the fork rules have no effect on the counter values. A derivationD based on D is admissible wheneverD : T → Q × N r , i.e., only natural numbers occur in it. An admissible derivation is also called a proof . Above, we introduced the primitive notion of computations and their restriction to b-consistent computations. Similarly, the primitive notion of derivations can be restricted to proofs (a kind of " 0-consistency").
Before presenting the decision problems on AVASS, we state a simple property that will be used in the sequel.
Indeed, once the rules are provided by D, the root value (q, b) determines all the values of the derivation since the wayD(n) is defined remains essentially deterministic. The state reachability problem for AVASS is defined as follows: Input: An alternating VASS A and control states q 0 and q f .
Question: Is there a finite proof of A whose root is equal to (q 0 , 0) and each leaf belongs to {q f } × N r ?
When A has no fork rules, A is essentially a VASS [34] and the above problem is an instance of the coverability problem known to be EXPSPACE-complete [37,39] (see also [8,19]). The non-termination problem for AVASS is defined as follows: Input: An alternating VASS A and a control state q 0 .
Question: Is there a proof of A whose root is equal to (q 0 , 0) and all the maximal branches are infinite?
The decidability of these problems was first established in [40] by using monotonicity of the games. The 2EXPTIME upper bound is preserved if we assume that the root is labelled by (q 0 , b) with b ∈ N r encoded with a binary representation (see Lemma 7 below).
In the sequel, we shall also admit fork rules of any arity β ≥ 1 and therefore in such slightly extended AVASS, the set of fork rules R 2 is a finite subset of β≥2 Q β . The notions of derivation skeleton, derivation and proof are also changed to refer to general trees T ⊆ (N \ {0}) * . The set of finite words T ⊆ (N \ {0}) * is a (not necessarily binary) tree iff for all n ∈ (N \ {0}) * and i ∈ (N \ {0}), n · i ∈ T implies n ∈ T, and n · i ∈ T and i > 1 imply n · (i − 1) ∈ T. In the remainder of the paper, by AVASS we mean such an extended AVASS with fork rules of arbitrary arity.

Model checking problems
A VASS can be defined as an alternating VASS without any fork rules, and therefore we write it V = (Q, r, R) where R is a finite set of unary rules. Given a VASS V, its transition system TS(V) def = (W, − →, Lab) is such that: • Lab is a labelling with elements of Q also understood as propositional variables and Lab(q) def = {q} × N r (the truth value of the atomic formula q on a configuration in Q × N r only depends on the control state); As usual, we also write * − → to denote the reflexive and transitive closure of − →. Since TS(V) is a Kripke-style structure, it can be used to interpret modal or temporal formulae where the atomic formulae refer to locations, e.g., formulae of the temporal logics LTL or CTL (see also [18]). Recall that LTL and CTL are both fragments of CTL * . Alternating-time temporal logics ATL or ATL * strictly extend CTL or CTL * respectively. Hence complexity hardness results for temporal logics can be lifted to alternating-time logics. We adopt this approach.
We first recall some results that will be useful in the sequel.
Proposition 3. The model checking problem for LTL on VASS is EXPSPACE-complete (the atomic formulae are control states) and it is in PSPACE for a fixed number of resources [28].
EXPSPACE-hardness of model checking on VASS already follows from EXPSPACEhardness of the state reachability problem for VASS [37], as state reachability is a subproblem of the model checking problem for VASS (consider the LTL formula Fq f ).

On the Complexity of RB±ATL
In this section, we show how to solve the model checking problem for RB±ATL by solving instances of decision problems for alternating VASS using a labelling algorithm. The size of the AVASS problem instance is linear in the input resource-bounded concurrent game structure, and the number of calls to the algorithms solving instances of decision problems for AVASS is also linear in the size of the input formulae. As far as worst-case complexity bounds are concerned, this is probably the best we can hope for. At a high level, our results relate model checking problems for resource-bounded logics in AI and verification games. Even though this first correspondence, as stated, does not provide a good intuition, at a technical level, this reduces to three key correspondences. First, the proponent restriction condition in RB±ATL corresponds to the fact that, in AVASS, only unary rules can update the counter values. This is crucial to our results, but alone it is not sufficient. Second, each b-strategy F A generates a set of computations that can be represented as a finitely branching tree with infinite branches, which corresponds precisely to the proofs in AVASS (see e.g., Theorem 1 below). Third, roughly speaking, temporal formulae in the scope of a strategy modality correspond to acceptance conditions on branches of the proofs (admissible computations) extracted from the AVASS. In the remainder of this section, we develop these correspondences (summarised in the table below) in detail.

RB±ATL
Alternating VASS Logic in AI Verification games proponent restriction condition updates in R 1 / no update in R 2 computation tree for F A proof formulae in the scope of A b monotone objectives

Structural analysis of strategies and proofs
We first establish the necessary formal relationships between strategies in resourcebounded concurrent game structures, and proofs in alternating VASS. The technical developments are not conceptually difficult, but they allow us to derive results that are helpful in solving the model checking problem for RB±ATL using decision procedures on AVASS. Our approach also allows us to pose and solve new model checking problems (see e.g. Section 6 and Section 6.6).
Let M be a finite resource-bounded concurrent game structure, A ⊆ Agt be a coalition and s be a state. We construct an alternating VASS A M,A,s such that the set of computations starting in s and respecting some strategy F A corresponds precisely to a derivation skeleton whose root is labelled by a unary rule with first state s . Moreover, if F A is a b-strategy w.r.t. s , then the derivation skeleton can be turned into a proof whose root is labelled by (s , b). This implies that fork rules can have any arity greater than one, and components can have the value ω, where ω is a value that remains constant. Nevertheless, note that below, the construction of A M,A,s does not depend on any strategy.
Given M = (Agt, S, Act, r, act, cost, δ, Lab) and a distinguished state s ∈ S, the AVASS A M,A,s def = (Q, r, R 1 , R 2 ) is built as follows: • The set of unary rules R 1 contains the following elements: • The set of fork rules R 2 contains the following elements.
In order to define the rule unambiguously, we assume an arbitrary linear ordering on the set Q and on the set of joint actions g : Agt → Act.  Figure 2: Transitions and its associated unary and fork rules.
The following observations shall be useful in the sequel. • s has a special status in Q simply because any proof whose root configuration contains s has no predecessor configuration.
• By construction, any derivation skeleton from A M,A,s has to alternate the rules in R 1 and the rules in R 2 . This property will be used to slightly simplify developments below.
• For every (s , f) in Q, there is a unique fork rule starting from (s , f).
• The construction also applies in degenerated cases, i.e., when A = Agt or when A = ∅ (assuming that cost(s , f) = 0 for the unique f ∈ D ∅ (s )).
In Figure 2, we illustrate how transitions from the state s are turned into unary rules and fork rules (in the example, Given an infinite computation λ = s 0 . . starting in s = s 0 and respecting F A , we can associate it with an infinite sequence (which we call an extended computation) where s 0 = s , and for all n ≥ 0, F A (s 0 − → s i+1 in the computation λ is decomposed into two parts: It is worth noting that the definition of ext(λ, F A ) essentially uses the set of agents A. However, in the paper, such an infinite sequence is needed only when the computation respects a strategy. That is why, we emphasize this with the notation ext(λ, F A ). Similar considerations are followed in the sequel. The computations in Comp(s , F A ) can be organised as an infinite tree that corresponds to a derivation skeleton for A M,A,s . Below we define an infinite tree T F A , a labelling function L : T F A → S and a partial map R : The tree T F A is defined by saturation of the above rules, and the maps L and R are defined accordingly. The structure (T F A , R, L) is a labelled transition system with a tree-like structure encoding all the infinite computations respecting the strategy F A . A maximal branch w of (T F A , R, L) is understood as an element of (N \ {0}) ω , such that any (strict) finite prefix of w belongs to T F A . The label of w, written lab(w), is defined as follows: where w = k 1 k 2 k 3 · · · . By construction, lab(w) is a maximal computation.

Lemma 2.
(I) For every maximal computation λ starting at s and respecting F A , there is a maximal branch w in (T F A , R, L) such that λ = lab(w).
(II) For every maximal branch w in (T F A , R, L), there is a maximal computation λ starting at s and respecting F A such that lab(w) = λ.
The (omitted) proof simply reflects that (T F A , R, L) contains all the computations from s that respect the strategy F A .
We build a derivation skeleton D : as follows, where all the maximal branches of T F A are infinite (we therefore do not need to include ⊥ in the range of D) .
is the unique fork rule starting from (s 0 , F A (s 0 )).
• Let n = 1k 1 1 · · · 1k β . By construction we can assume that we already have that . Let g be equal to R(k 1 · · · k β , k 1 · · · k β · 1) and f be the restriction of g to A (so f g ). Then, Note that D(n) is indeed a valid unary rule.
Given an infinite branch w of D (resp. w of the derivationD based on D), say w = 1k 1 1k 2 1k 3 · · · ∈ N ω , we define the extended computation ext(w, F A ) as follows. Suppose that the label of such a branch is characterised by the values below: • . . .
(I) For every maximal computation λ starting at s and respecting F A , there is a maximal branch w in D such that ext(λ, F A ) = ext(w, F A ).
(II) For every maximal branch w in D, there is a maximal computation λ starting at s and respecting F A such that ext(w, The reduction can be easily verified. Note, however, that the proponent restriction is essential for its correctness. s whose root is labelled by (s , b) and every maximal branch is infinite.
Proof. First suppose that there is a b-strategy F A w.r.t. s = s 0 in M. Let us consider the structures (T F A , R, L) and D : T → (R 1 ∪ R 2 ) as defined above. By Lemma 1, there is a unique derivationD of A M,A,s based on D such thatD(ε) = (s , b). It remains to show thatD is indeed a proof. Let w = 1k 1 1k 2 1 · · · be a maximal branch ofD (we use the previous notations about D such as those about the u i 's). We have: By Lemma 3, there is a maximal computation λ starting at s and respecting F A such that ext(w, F A ) = ext(λ, F A ). Since F A is a b-strategy, λ is b-consistent and therefore for all i ≥ 0, we have 0 i−1 j=1 u j + b, which implies thatD is a proof. For the proof of the other direction, assuming that there is a proofD whose root is labelled by (s , b) and every maximal branch is infinite, we can extract from the underlying derivation D a strategy F A (see the similar construction in the proof of Theorem 3 below). Lemma 3 and the fact thatD is admissible entail that F A is a b-strategy w.r.t. s (details are omitted).
Transitions in M can be defined as triples (s , g, s ) such that δ(s , g) = s . A transition is also denoted by the expression s An ω-word w ∈ Σ ω M is said to be with contiguous transitions whenever at any position, the second state of the transition is equal to the first state of the next position.
Given an infinite branch of the proof corresponding to the extended computation The statements below are equivalent.
2. There is a proof in A M,A,s whose root is labelled by (s , b), every maximal branch is infinite and its Σ M -projection belongs to L.
Lemma 4 is a consequence of Theorem 1, and Lemma 3 is key to establishing formal correspondences between M and A M,A,s . The main challenge is to determine classes of languages for which decidability can be obtained by using only the decidability (and complexity characterisation) of the state reachability and non-termination problems for AVASS.
• The set of unary rules R 1 contains the following elements. - • The set of fork rules R 2 contains the following elements.
(Otherwise, nothing is added.) So, there is at most one fork rule starting from (s , f) (possibly zero).
Lemma 5. Assuming that s ∈ S , the statements below are equivalent.
1. There is a b-strategy F A w.r.t. s in M such that the set of computations Comp(s , F A ) only visit states in S .
2. There is a proof in A S M,A,s whose root is labelled by (s , b) and every maximal branch is infinite (a positive instance of the non-termination problem for AVASS).
Note that the way b-strategies are defined, in Lemma 5(1), F A generates maximal and infinite computations in which only states in S are visited. Similarly, the proof in Lemma 5(2) contains only maximal and infinite branches and its root is precisely We write Σ M to denote the alphabet {s 1 g − → s 2 : s 1 , s 2 ∈ S and δ(s 1 , g) = s 2 } and L to denote the ω-regular language in (Σ M ) ω made of infinite sequences of contiguous transitions such that only states in S can occur.
(1) → (2). Suppose there is a b-strategy F A w.r.t. s in M such that the set of computations Comp(s , F A ) only visit states in S , which amounts to having the set of computations included in L. By Lemma 4, there is a proof in A M,A,s whose root is labelled by (s , b), every maximal branch is infinite and it belongs to L. Since s ∈ S , all the rules in R 1 ∪ R 2 only involve states in S and the above proof only visits such states, we have that there is a proof in A S M,A,s whose root is labelled by (s , b) and every maximal branch is infinite.
(2) → (1). Suppose that there is a proof in A S M,A,s whose root is labelled by (s , b) and every maximal branch is infinite. Since A S M,A,s is defined as a restriction of A M,A,s with Q ⊆ Q, R 1 ⊆ R 1 and R 2 ⊆ R 2 , there is also a proof in A M,A,s whose root is labelled by (s , b), every maximal branch is infinite and only states in S are visited. Equivalently, there is a proof in A M,A,s whose root is labelled by (s , b), every maximal branch is infinite and it belongs to L. By Lemma 4, there is a b-strategy w.r.t. s in M such that the set of computations Comp(s , F A ) is included in L, hence only states in S are visited.
Lemma 5 is useful to handle formulae of the form A b Gφ. Let us consider a similar treatment that will be useful to handle formulae of the form A b φ 1 Uφ 2 . Given S 1 , S 2 ⊆ S with s ∈ S 1 ∪ S 2 , let L S 1 ,S 2 be the set of all ω-words with contiguous transitions such that the projection under S belongs to S * 1 · S 2 · S ω . As usual, the projection of (s 0 Lemma 6. The statements below are equivalent: 2. There is a finite proof in A S 1 ∪S 2 M,A,s whose root is labelled by (s , b) and each leaf contains a control state in {(g, s ) ∈ Q | s ∈ S 2 }∪(S 2 ∩{s }) (a positive instance of the state reachability problem for AVASS).
Note that S 2 ∩ {s } is {s } if s ∈ S 2 and ∅ otherwise. The proof of Lemma 6 below relies on the fact that, in resource-bounded concurrent game structures, idle ∈ act(s, a) for all agents a and states s.
Proof. The proof is similar to the proof of Lemma 5 except that we need to relate finite proofs to infinite ones, and in doing so we take advantage of the presence of the idle action in concurrent game structures.
(1) → (2). Suppose there is a b-strategy F A w.r.t. s in M such that the computations in Comp(s , F A ) visit a state in S 1 until a state in S 2 is visited, which amounts to having the set of computations included in L S 1 ,S 2 . By Lemma 4, there is a proofD in A M,A,s whose root is labelled by (s, b), every maximal branch is infinite and it belongs to L S 1 ,S 2 . LetD be the finite proof obtained fromD by pruning any subtree as soon as a node is labelled by a control state in S 2 . Existence of such a finite proof is guaranteed by König's Lemma. It is easy to check thatD is a finite proof in A S 1 ∪S 2 M,A,s whose root is labelled by (s , b) and each leaf contains a control state in {(g, s ) ∈ Q | s ∈ S 2 } ∪ (S 2 ∩ {s }).
(2) → (1). Suppose that there is a finite proofD in A S 1 ∪S 2 M,A,s whose root is labelled by (s , b) and each leaf contains a control state in {(g, s ) ∈ Q | s ∈ S 2 } ∪ (S 2 ∩ {s }). One can extendD in order to obtain an infinite proofD such that every maximal branch is infinite and it belongs to L S 1 ,S 2 . Any leaf labelled by the control state (g, s ) is further extended by application of the unary rule (g, s ) 0 − → (s , f) where f is the idle joint action (with the control state s , a similar method applies). Similarly, any leaf labelled by the control state (s , f) is further extended by application of the unique fork rule starting by (s , f). It is easy to check that this not only leads to a derivation but also to a proof, because the extension only deals with the update vector 0. By Lemma 4, there is a b-strategy w.r.t. s in M such that the set of computations Comp(s , F A ) is included in L S 1 ,S 2 .

2EXPTIME upper bound
The upper bound is established by giving a labelling algorithm as done in [5] or for standard temporal logics such as CTL and CTL * . The main difference with [5] is that the treatment of the cases with strategy modalities is not performed in an ad-hoc fashion using the fact that (N r , ) is a well-quasi-ordering by Dickson's Lemma [22] but rather we explicitly call subroutines that solve decision problems on AVASS. The existence of such subroutines is due to [40] for monotonic games, and their complexity upper bounds are due to [33,Theorem 3.4] and [17,Theorem 3.1]. The proof of the 2EXPTIME upper bound is divided into three main steps: 1. we introduce a slight extension of AVASS such that the decision problems remain in 2EXPTIME; 20 2. we show that the cases for the strategy modalities can be faithfully reduced to subroutines for problems on such extended AVASS (a consequence of developments from Section 4.1); 3. finally, we design a labelling algorithm and establish the complexity upper bound from it.
First, let us introduce a slight extension of decision problems for AVASS.
Lemma 7. In the following extension of AVASS the state reachability and non-termination problems remain in 2EXPTIME: • Fork rules can be α-ary for any α ≥ 1 (but there is only a finite number of them).
• Reachability is related to a subset Q f ⊆ Q (instead of a singleton set).
• The initial configuration is (q 0 , b) with b ∈ N r instead of the fixed tuple 0.
• The value ω in b is allowed and absorbs any other value in Z (a means to ignore components, i.e. to reduce the dimension).
The proof is fairly standard, and consists in using Proposition 2 by simulating a non-binary fork by a linear-size gadget made of unary and binary forking rules, and by adding binary forking rules from states in Q f to a new single final state.
Proof. The lemma states four ways to extend the decision problems on AVASS, either by slightly extending the notion of AVASS, or by considering more general inputs for the problems. For each extension, we show how this can be encoded into the state reachability and the non-termination problems on AVASS using only polynomial-time reductions. The proof of the lemma is then obtained by composition of the reductions (polynomial-time reductions are also known to be closed under compositions) and by invoking Proposition 2 to get the 2EXPTIME upper bound.
• Let A = (Q, r, R 1 , R 2 ) be an alternating VASS, q 0 , q f ∈ Q, and r = (q 1 , . . . , q α+1 ) be an (extended) α-ary rule. If α = 1, the rule can be treated as a unary rule with the update vector 0, whereas if α = 2, it can be treated as a standard binary fork rule. So assume α ≥ 3. Let R 2 be the following set of binary fork rules derived from r where q 2 , . . . , q α−1 are new control states: It is easy to show that the statements below are equivalent: there is a finite proof in (Q, r, R 1 , R 2 {r}) whose root is equal to (q 0 , 0) and each leaf belongs to {q f } × N r ; there is a finite proof in (Q {q j | j ∈ [2, α − 1]}, r, R 1 , R 2 R 2 ) whose root is equal to (q 0 , 0) and each leaf belongs to {q f } × N r .
If there is more than one extended fork rule, we apply the above reduction as many times as necessary, leading eventually to a reduction to an instance of the state reachability problem for AVASS. The same reduction also works for the non-termination problem.
It is easy to show that the statements below are equivalent: there is a finite proof in A whose root is equal to (q 0 , 0) and each leaf belongs to Q f × N r ; there is a finite proof in A whose root is equal to (q 0 , 0) and each leaf belongs to {q new . It is easy to show that the statements below are equivalent: there is a finite proof in A whose root is equal to (q 0 , b) and each leaf belongs to {q f } × N r ; there is a finite proof in A whose root is equal to (q 0 , 0) and each leaf belongs to {q f } × N r .
Similarly, the statements below are equivalent: there is a proof in A whose root is equal to (q 0 , b) and all the maximal branches are infinite; there is a proof in A whose root is equal to (q 0 , 0) and all the maximal branches are infinite.
• Let A = (Q, r, R 1 , R 2 ), q 0 , q f ∈ Q and b ∈ (N ∪ {ω}) r . We are looking for proofs whose root is labelled by (q 0 , b) and any occurrence of ω in b remains in the proof for all the descendant nodes, which amounts to ignoring some components. Indeed, if ω occurs in a component at the root of the proof, the value ω is propagated to all descendant nodes in that component.
The set of unary rules R 1 is defined from R 1 as follows: It is easy to show that the statements below are equivalent: there is a finite proof in A whose root is equal to (q 0 , b) and each leaf belongs to {q f } × N r ; there is a finite proof in A whose root is equal to (q 0 ,h( b)) and each leaf belongs to {q f } × N γ .
The same reduction also works for the non-termination problem.
Lemma 8 below relates the satisfaction of a formula with the outermost connective A b U and the state reachability problem for AVASS.
Lemma 8. The statements below are equivalent: M,A,s whose root is equal to (s , b) and each leaf has a control state in This is a direct consequence of Lemma 6. Lemma 9 relates to the satisfaction of a formula with outermost connective A b G and the non-termination problem for AVASS. (II) there is a proof in A S M,A,s with S = {s | M, s | = φ 1 } whose root is equal to (s , b) and every maximal branch is infinite.
is a positive instance of the non-termination problem for AVASS. This is a direct consequence of Lemma 5.
Theorem 2. The model checking problem for RB±ATL is in 2EXPTIME.
Proof. Algorithm 1 is a global model checking algorithm that takes as input a resourcebounded concurrent game structure M and a formula φ (both built on the same set of agents and with the same number of resources) and returns the set of states that satisfies the formula. By structural induction, one can show that GMC(M, ψ) = {s ∈ S | M, s | = ψ} by using Lemma 8 and Lemma 9. We use the fact that the state reachability and the non-termination problems for extended AVASS are decidable by [40] and by Lemma 7 (for the extension). Let us show how the proof by induction works.
The statements below are equivalent: • s ∈ S 1 and there is a proof in A S 1 M,A,s whose root is equal to (s, b) and every maximal branch is infinite (by Lemma 9).
• s ∈ S 1 and there is a proof in A S 1 M,A,s whose root is equal to (s, b) and every maximal branch is infinite with S 1 = GMC(M, ψ ) (by induction hypothesis).
• s ∈ S 1 and A S 1 M,A,s , (s, b) is a positive instance of the non-terminating problem for AVASS (by definition).
Case ψ = A b ψ 1 Uψ 2 . The statements below are equivalent: • there is a finite proof in A S 1 ∪S 2 M,A,s whose root is equal to (s, b) and each leaf has a control state in • there is a finite proof in A S 1 ∪S 2 M,A,s whose root is equal to (s, b) and each leaf has a control state in {(g, s ) ∈ Q | s ∈ S 2 } ∪ (S 2 ∩ {s}) with S i = GMC(M, ψ i ) i ∈ {1, 2} (by the induction hypothesis).
• A S 1 ∪S 2 M,A,s , (s, b), S 2 is a positive instance of the state reachability problem for AVASS with The statements below are equivalent: • M, s | = ψ.
• there is a b-strategy F A w.r.t. s such that for all s 0 • there is a b-strategy F A w.r.t. s such that for all s 0 • there is f ∈ D A (s) such that for all s 1 ∈ out(s, f), we have M, s 1 | = ψ and 0 cost A (s, f) + b.
• there is f ∈ D A (s) such that for all g f, we have M, δ(s, g) | = ψ and 0 • there is f ∈ D A (s) such that for all g f, we have δ(s, g) ∈ GMC(M, ψ ) and 0 cost A (s, f) + b (by induction hypothesis).
As far as complexity is concerned, GMC(M, ψ) can be solved by using a recursion depth that is linear in the size of ψ, and the state reachability and the non-termination problems for AVASS can be solved in 2EXPTIME by [33,Theorem 3.4] and [17, Theorem 3.1]. Note also the instances of such problems can be built in polynomial time in the respective sizes of M and φ. Consequently, the model checking problem for RB±ATL is in 2EXPTIME.

2EXPTIME-hardness
In this section, we show a 2EXPTIME-hardness result by reduction from the state reachability problem for AVASS. This improves the EXPSPACE-hardness result in [5].
Theorem 3. The model checking problem for RB±ATL is 2EXPTIME-hard.
Proof. The proof is by reduction from the state reachability problem for AVASS (see Proposition 2 or [17, Theorem 4.1]). It is divided into three main parts.
(1) We consider a restriction of the state reachability problem for AVASS that remains 2EXPTIME-hard but that simplifies the definitions in the second part of the proof. Roughly speaking, the set of control states is divided in two disjoint sets, one from which unary rules start, and the other one from which fork rules start.
(2) We then define the reduction from the restriction, taking care of the details of the resource-bounded concurrent game structures; essentially, we follow ideas similar to those in the proof of [5, Lemma 6].
(3) Finally, we establish the correctness of the reduction.
(1) Given an instance A = (Q, r, R 1 , R 2 ), q 0 , q f of the state reachability problem, we further assume that there is a partition Q = Q 1 Q 2 such that • there is no rule starting from q f and there is at least one unary rule starting from q 0 .
The strict alternation between the control states in Q 1 and those in Q 2 can be obtained by duplicating the control states (in case a control state can start both a unary rule and a fork rule), and by adding new intermediate rules to enforce the alternation. In order to have no rule from q f , it is sufficient to duplicate it, leading to the new state q f . So, q f behaves now as q f in the original AVASS and in the new AVASS, no rule starts by q f . The details follow. Let A = (Q, r, R 1 , R 2 ) be an alternating VASS. Without loss of generality, we can assume that no rule starts from q f . Otherwise, we can introduce a new control state q new f that behaves almost as q f : copy all the rules where q f occurs in second or in third position by replacing q f by q new f but no rule starting from q f is copied (details are omitted). We can guarantee that ( ) there is a finite proof whose root is equal to (q 0 , 0) and each leaf belongs to {q f } × N r iff with the new AVASS there is a finite proof whose root is equal to (q 0 , 0) and each leaf belongs to {q new f } × N r . Similarly, without loss of generality, we can assume that there is a rule in R 1 that starts from q 0 . Otherwise, we add the dummy unary rule (q 0 , 0, q 0 ).
Let us build the alternating VASS A = (Q , r, R 1 , R 2 ) verifying the above conditions with Q = Q 1 Q 2 such that ( ) iff there is a finite proof whose root is equal to ((q 0 , 1), 0) and each leaf belongs to {(q f , 1)} × N r . The set Q is a subset of Q × {1, 2} defined by the clauses below plus auxiliary states introduced with the definition for rules: • (q, 1) ∈ Q def ⇔ there is a rule in R 1 that starts from q or q = q f . So (q 0 , 1), (q f , 1) ∈ Q .
• (q, 2) ∈ Q def ⇔ there is a rule in R 2 that starts from q.
We now define the sets of rules R 1 and R 2 .
• For all r = q u − → q ∈ R 1 such that (q , 1) ∈ Q (alternation needs to be enforced), we add the rules below: (q, 1) u − → q new ∈ R 1 (q new is new and depends on r) and (q new , (q , 1), (q , 1)) ∈ R 2 . Moreover, q new ∈ Q 2 . This amounts to adding an intermediate fork rule leading twice to (q , 1) in order to guarantee that • For all r = (q 1 , q 2 , q 3 ) ∈ R 2 such that either (q 2 , 2) ∈ Q or (q 3 , 2) ∈ Q (again, alternation needs to be enforced). If (q 2 , 2), (q 3 , 2) ∈ Q , then we add the rules below: are new and depend on the fork rule r. Moreover, these two new control states belong to Q 1 .
One can show that A = (Q , r, R 1 , R 2 ) satisfies the above assumption and ( ) iff there is a finite proof whose root is equal to ((q 0 , 1), 0) and each leaf belongs to {(q f , 1)}×N r .
(2) Given an instance A = (Q, r, R 1 , R 2 ), q 0 and q f with the restriction above, we build the game structure M = (Agt, S, Act, r, act, cost, δ, Lab) with Q 1 ⊆ S such that M, q 0 | = {1} 0 Uq f iff there is a finite proof of AVASS whose root is equal to (q 0 , 0) and each leaf belongs to {q f } × N r . Here, q f is also understood as a propositional variable.
Before providing a formal definition of M, we illustrate the construction using a simple example. Assume that A contains the unary rule r 1 = q 1 (−1,+3) − −−− → q 0 and the binary rule r 2 = q 0 − → q 3 , q 2 . M contains two agents. An inference with r 1 followed by an inference with r 2 is simulated using the transitions shown in Figure 3, where the cost of the action (r 1 , r 2 ) is precisely equal to (−1, +3) and both idle and its twin action idle have no cost. So, two subsequent rule applications are encoded by one action, which is relevant as the set of control states is made of two disjoint sets of control states that determine striclty whether a unary rule or a fork rule can be applied from them. Note also the presence of a bad state that forbids the choice of the idle action by the first agent, assuming that the objective is to reach the state q f (with q 2 = q f presently).
The complete definition of M is as follows.
• Agt def = {1, 2}. So, the number of agents is independent of the input AVASS. • A pair of rules (r 1 , r 2 ) ∈ R 1 × R 2 is connected iff the last control state of r 1 is equal to the first control state of r 2 . The set of actions Act is equal to the set of connected pairs of rules plus the action idle and its twin action idle .
• For each control state q in Q 1 , act(q, 1) is the set of connected pairs of rules whose unary rule starts from q plus the idle action. So agent 1 can choose a unary rule immediately followed by a fork rule. act(q f , 1) is restricted to {idle}, because no rule starts from q f in A.
• As far as agent 2 is concerned, for all q ∈ Q 1 , act(q, 2) def = {idle, idle }. So agent 2 can perform two actions that have no effect on resources, which amounts to simulating the effects of fork rules.
• Only the idle action can be performed from the state bad: • The cost of the action (r 1 , r 2 ) is simply the update vector of the unary rule r 1 . Formally, for all q ∈ Q 1 , we have cost(q, 1, (r 1 , r 2 )) def = u when r 1 = (q, u, q ) for some q . Furthermore, cost(q, a, idle) def = cost(bad, a, idle) def = 0 for all a ∈ {1, 2}, and cost(q, 2, idle ) def = 0.
• When δ can be defined, we have -Whenever q ∈ (Q 1 \ {q f }), f(1) = (r 1 , r 2 ) with r 1 starting from q and r 2 = (q inter , q , q ), • There is a unique propositional variable q f and Lab(q f ) (3) We now establish the correctness of the construction. Without loss of generality, we can assume q 0 q f .
, there is an i ≥ 0 such that q i = q f (so by construction of M, for all j ≥ i, we have q j = q f and bad does not occur in λ). Since {1} is a singleton set, we assume below that F {1} returns an action for agent 1 (instead of returning a joint action with respect to the single agent 1) and D {1} (q) is viewed as an action.
From M, q 0 and F {1} , let (T F {1} , R, L) be the labelled transition system defined in Section 4.1. We have Note the specific structure of (T F {1} , R, L): • For all w ∈ T F {1} such that L(w) = q f , w · 1 is the unique successor of w, L(w · 1) = q f and R(w, w · 1) is the constant joint action equal to idle.
• For all w ∈ T F {1} such that w has exactly two successors w · 1 and w · 2, there are q inter ∈ Q and u ∈ Z r such that and (r 1 , r 2 ) is connected. Consequently, the unique derivation based on D with root labelled by (q 0 , 0) is a finite proof with leaves labelled by q f . Indeed, by construction for all q ∈ Q 1 , we have cost(q, 1, (r 1 , r 2 )) = u when r 1 = (q, u, q ) for some q . For the converse direction, let us assume the existence of a finite proofD based on the derivation skeleton D : T → (R 1 ∪ R 2 ∪ {⊥}) such thatD(ε) = (q 0 , 0) and each leaf is labelled by a pair in {q f } × N r . Let us define a strategy F {1} . First, we require the following properties: D(1)). Since q 0 q f , we know that 1 ∈ T.
• For all the finite computations λ ending at the state q f (we have Q 1 ⊆ S and − → q n be a finite computation respecting (so far) F {1} and q n q f (since this case is already treated above). Below we define F {1} (λ).
First, we assume that bad does not occur in λ. Each joint action g j can be written The derivation skeleton D verifies the properties below: • D(ε) = r 0 1 with r 0 1 = (q 0 , u 0 , q 0 inter ).
• D(1k 0 1 · · · k j 1) = r • D(1k 0 1 · · · k n−2 1) = r n−1 2 with r n−1 2 = (q n−1 inter , q n−1 1 , q n−1 2 ) and q n−1 k n−1 = q n . Since q n is different from q f , 1k 0 1 · · · k n−2 1k n−1 and 1k 0 1 · · · k n−2 1k n−1 1 exist. We stipulate F {1} (λ) def = (D(1k 0 1 · · · k n−2 1k n−1 ), D(1k 0 1 · · · k n−2 1k n−1 1)). Consequently, any ex- → q n+1 respecting (again so far) F {1} verifies the above correspondence with D and the state bad cannot be visited. So, the strategy F {1} can be defined by using the approach above (more formally, an induction hypothesis should be stated and we should prove that after each step, the property is preserved). One can also check that F {1} is 0-consistent w.r.t q 0 , and, for all λ = s 0 there is i ≥ 0 such that q i = q f . The 0-consistency is due to the fact thatD is a proof and the reachability condition is a consequence of the fact that every leaf ofD is labelled by q f because of the correspondences between computations respecting F {1} and nodes in T.
The hardness proof above would also work if the proponent restriction is not satisfied, or if no distinguished idle action is assumed in the game structures, or if act may return an empty set of actions. Indeed, the construction of M in the proof of Theorem 3 assumes the proponent restriction condition but this condition is actually useless as all the actions for the agent 2 have zero cost. Similarly, the construction of M takes into account the existence of a special action idle (and this entails a few complications) but more generally, idle can be also viewed as a non-distinguished action and therefore the hardness proof is not sensitive to the existence of a distinguished idle action. Last but not least, allowing that act may return an empty set of actions is compatible with the current construction of M (this extra freedom is therefore not used to build M). By construction of M, it is also worth observing that one propositional variable and two agents are sufficient to get 2EXPTIME-hardness.
In the corollary below, we use [33,Theorem 3.4] and [17,Theorem 3.1], which show that for a bounded number of resources, the state reachability and the nontermination problems for AVASS can be solved in EXPTIME. When r ≥ 4, the state reachability problem for AVASS is EXPTIME-hard [33], which leads to the result below.
Corollary 1. For any fixed r ≥ 1, the model checking problem for RB±ATL restricted to at most r resources is in EXPTIME. For r ≥ 4, the problem is EXPTIME-hard.
Moreover, if r is fixed but greater than two, then the model checking problem for RB±ATL restricted to at most r resources is PSPACE-hard, since the state reachability problem for VASS of dimension two is PSPACE-complete [9]. When r = 1, the model checking problem for RB±ATL is NP-hard since the state reachability for VASS of dimension one is NP-complete [27]. (Note that the NP-completeness result does not apply because the model checking problem for RB±ATL involves not just the reachability problem but also the non-termination problem. ) We have seen that the model checking problem for RB±ATL restricted to two agents is 2EXPTIME-hard; below we show that the restriction to a single agent is only EXPSPACE-complete.
Theorem 4. The model checking problem for RB±ATL restricted to a single agent is EXPSPACE-complete.
Proof. In order to show the EXPSPACE upper bound, we sketch how to solve the model checking problem for RB±ATL restricted to a single agent, by solving instances of the model checking problem for LTL on VASS or instances of the model checking problem for CTL, known to be EXPSPACE-complete (see e.g. [28]) and P-complete (see e.g. [42]) respectively. The labelling algorithm has exactly the same form as the algorithm for full RB±ATL. The size of the instances of the problems is linear in the size of the input resource-bounded concurrent game structures, and the number of calls is also linear in the size of the input formulae. This leads to the EXPSPACE upper bound.
The following two properties are essential for the proof. Given a path formula Φ of the form Xp, Gp or p 1 Up 2 , one can show that M, s | = ∅ b Φ iff M , s | = AΦ in CTL, where M is obtained from M by removing the costs and actions from the transitions. Note that the empty coalition ∅ allows us to quantify over all computations, and therefore the value of the bound b is irrelevant. Similarly, one can show that M, s | = {1} b Φ iff there is an infinite run from the initial configuration (s, b) in the VASS V that satisfies the LTL formula Φ, where V is obtained from M by removing the actions while keeping the costs in Z r on the transitions. If b has components with the value ω, then we reduce the dimension in b and in V so that only the components with finite values in b remain.
In order to get the EXPSPACE lower bound, we reduce the state reachability problem for VASS to the model checking problem for RB±ATL restricted to a single agent, and use the EXPSPACE-hardness established in [37]. Let V = (Q, r, R) be a VASS and q 0 , q f be locations. One can show that there is a run from (q 0 , 0) to some Up, where M = (Agt, S, Act, r, act, cost, δ, Lab) is defined from V as follows (for all q, q ∈ Q): • Lab is defined so that p holds true exactly on q f and cost(1, q • Finally, δ(q, q u − → q ) = q , δ(q, idle) = bad and δ(bad, idle) = bad.

Resource-bounded temporal logics RBTL and RBTL *
In this section, we present the logic RBTL introduced in [12] and its extension RBTL * and we characterise the computational complexity of the model-checking problem. The proof can be seen as a simpler version of the proof for RB±ATL and a more complex version of the standard proof for CTL * .

The logic RBTL * and its variants
The models of the logic RBTL * are structures of the form (Q, r, R, Lab) where (Q, r, R) is a VASS and Lab is a labelling built on elements of Q understood as propositional variables, so that Lab(q) = {q} (see e.g., [12,Section 3]). "RBTL" stands for 'resource-bounded temporal logic' and the logic RBTL defined below (a fragment of RBTL * ) has been introduced in [12]. For consistency with standard terminology, an infinite proof in (Q, r, R) is called a path or run, and is represented by v 1 ) . . .. We write λ(i) to denote the ith configuration (q i , v i ), and λ[+i, +∞) to denote the suffix of λ starting from (q i , v i ).
The state formulae φ and the path formulae Φ of RBTL * are defined mutually recursively by the following grammar (relative to a set of locations Q and number of resources r, which is not a significant restriction since we are only interested in model checking) where q ∈ Q. Syntactically, every state formula is also a path formula according to this grammar, reflecting the fact that a path uniquely identifies a location in which a formula is interpreted (its starting location).
In presenting the semantics of RBTL * , we make an explicit distinction between state formulae and path formulae. The two satisfaction relations | = s and | = p are defined as follows (standard clauses for the Boolean connectives are again omitted): As usual, we write [ b]φ to denote the formula ¬ b ¬φ, and therefore M, q | = s [ b]Φ iff for all the infinite runs λ starting at (q, b), we have M, λ | = p Φ.
The model checking problem for RBTL * is defined as follows: Input: A model M = (Q, r, R, Lab), a control state q and a state formula φ.
As CTL is a syntactic fragment of CTL * , RBTL is defined as the syntactic fragment of RBTL * in which any subformula with an outermost connective in {U, X, G} is immediately preceded by a modality of the form either b or [ b]. Observe that the model checking problem for RBTL is already EXPSPACE-hard, since the state reachability problem for VASS can be reduced to a question of the form M, q 0 | = 0 q f . We consider the computational complexity of the model checking problems for RBTL * and RBTL in Section 5.2.
It is worth noting that the definition of RBTL above is taken from [12] and other variants would be possible, for instance to interpret the formulae on other classes of counter machines (arbitrary transition systems are not possible as b provides initial conditions based on counter values). As for CTL * , path quantifiers quantify over all possible paths but path formulae are interpreted on a single path, which explains why the notion of runs in VASS is essential to define the semantics of RBTL * .

On the complexity of the model-checking problem for RBTL *
In this section, we study the model checking problem for resource-bounded logics in which the path formulae are arbitrary, i.e., they can be any LTL-like formulae rather than being restricted to path formulae of the form Gψ, Xψ and ψ 1 U ψ 2 as in RB±ATL. We have already seen that the model checking problem for RBTL is EXPSPACE-hard (see Section 5.1) and therefore the lower bound also applies to RBTL * . Below, we show that the model checking problem for RBTL * is not only decidable (a new result) but also in EXPSPACE. The arguments for establishing the EXPSPACE upper bound for RBTL and RBTL * are identical, and the EXPSPACE lower bound for the model checking problem for RBTL can be matched with the upper bound for RBTL * .
Theorem 5. The model checking problem for RBTL * is in EXPSPACE.
In [12], the problem for RBTL is shown to be decidable by reduction to the reachability problem for VASS. However the best known upper bound for the reachability problem is quite high, see e.g. [36]. Hence, the EXPSPACE upper bound is a substantial improvement. Moreover, the decidability of the model checking problem for RBTL * was left open in [12].
The proof of Theorem 5 is inspired from the proof of the PSPACE upper bound for CTL * model checking based on LTL model checking. The main difference rests on the fact that, herein, the subroutine involving LTL is performed for VASS instead of for finite-state transition systems.
Proof. (sketch) The algorithm to obtain the EXPSPACE upper bound first computes the states in which subformulae hold before dealing with larger formulae. The algorithm is a renaming algorithm. However, there is a caveat: when dealing with subformulae of the form b Ψ where Ψ is an LTL formula, we are entitled to use the model checking algorithm for LTL formulae on VASS that is in EXPSPACE [28] (having ω in one component amounts to ignoring that position). However, in order to systematically consider such subformulae b Ψ when the outermost connective is a path quantifier, we need to perform renamings on-the-fly.
Let us provide a simple example with the formula and an arbitrary model M. Let us consider some innermost state formula prefixed by a path quantifier, say b 1 (qUq ) (actually here there is only one such a subformula).
With the help of a decision procedure for solving the LTL model checking problem on VASS, we determine for which control states q we have M, q | = s b 1 (qUq ). Say, we obtain the set {q 1 , . . . , q α }. Now, in φ, we replace b 1 (qUq) by q 1 ∨ · · · ∨ q α , and we get φ 1 = b 0 GF (q 1 ∨ · · · ∨ q α ). So, we have performed a renaming step by replacing a subformula by a disjunction of propositional variables. This process can be repeated until there are no more path quantifiers. To do this, we substitute some innermost state formula prefixed by a path quantifier in φ 1 , say b 0 GF (q 1 ∨ · · · ∨ q α ), by a new disjunction of locations (possibly empty) with the help of a decision procedure for solving the LTL model checking problem on VASS. We obtain the manageable formula Since φ 2 is a propositional formula, we are done with the renaming process and it is easy to show that for every control state q , we have M, q | = s φ iff M, q | = s q 1 ∨ · · · ∨ q β . The above example can be easily generalised to any state formula. Note that the number of renamings is bounded by the size of the input formula, and at each step a subroutine is invoked at most card(Q) times and requires EXPSPACE, whence we obtain the EXPSPACE upper bound.
Corollary 2. For any fixed r ≥ 1, the model checking problem for RBTL * restricted to at most r resources is in PSPACE.
The PSPACE upper bound is a consequence of [28]. The model checking problem for LTL on VASS is in PSPACE when the number of counters is bounded [28,Theorem 4.1], and the renaming algorithm briefly described in the proof of Theorem 5 makes only a linear number of calls to the model checking problem for LTL on VASS and the number of counters is preserved when such calls are performed. If r is fixed but greater than two, then the model checking problem for RBTL * restricted to at most r resources is PSPACE-hard, since the state reachability problem for VASS of dimension two is PSPACE-complete [9]. When r = 1, the model checking problem for RBTL * is NP-hard, since the state reachability problem for VASS of dimension one is NP-complete [27].

The Logic RB±ATL * and its Parameterised Variant
We have seen that the model checking problem for RB±ATL is 2EXPTIME-complete. Below, we show that the model checking problem for RB±ATL * is also decidable. The arguments for establishing the respective decidability of RB±ATL and RB±ATL * both rest on the decidability of decision problems for alternating VASS. However for the model checking problem for RB±ATL * we need to invoke the decidability of parity games on alternating VASS, which is stronger than the decidability of the state reachability and non-termination problems for AVASS. This more complex reduction, which uses ingredients such as the standard equivalence of expressive power of Büchi automata and deterministic parity automata on ω-words, is nevertheless rewarding, as it allows us to synthetise concrete values for resource parameters, something which has heretofore not been possible for resource-bounded logics.
Below, we introduce RB±ATL * , an extension of RB±ATL in which the path formulae are unconstrained, i.e. they can be any LTL-like formula. Although RB±ATL * is a new logic, its definition follows a standard schema for branching-time temporal logics.

Definition
Given a set of agents Agt = {a 1 , . . . , a k } and r ≥ 1, we write RB±ATL * (Agt, r) to denote the resource-bounded logic with k agents and r resources whose models are resource-bounded concurrent game structures with the same parameters. Formulae of RB±ATL * (Agt, r) are defined according to the grammar below (as in CTL * or for RBTL * , we distinguish between state formulae φ and path formulae Φ) where p ∈ PROP, A ⊆ Agt and b ∈ (N ∪ {ω}) r . The set of state formulae φ for RB±ATL * (Agt, r) extends the set of formulae for RB±ATL(Agt, r). 3 In presenting the semantics for RB±ATL * , we make an explicit distinction between state formulae and path formulae. The two satisfaction relations | = s and | = p are defined as follows.
Again, all the maximal computations are infinite, i.e., the index i in the clauses for G or U can take any value in N. The model checking problem for RB±ATL * is defined as follows: Input: k, r ≥ 1 (in unary), a state formula φ in RB±ATL * ([1, k], r), a finite model M and a state s, Below, we show that the model checking problem for RB±ATL * is decidable by reduction to the parity game problem for single-sided VASS [1, Corollary 2]. The latter problem will play a role similar to LTL model checking in CTL * model checking, see e.g. [42,20]. In addition, [1,Theorem 4] allows us to synthetise resource bounds. We begin by defining a variant of the problem.

A parameterised variant
We first introduce a parameterised version of RB±ATL * , denoted by ParRB±ATL * . The formulae of ParRB±ATL * are the same as those of RB±ATL * , except that the concrete values b ∈ (N ∪ {ω}) r that decorate strategy modalities are replaced by tuples of variables taken from the set VAR = {x 1 , x 2 , . . .}, for example: By 'compute the set of maps', we mean being able to characterise the set of maps v such that M, s | = s v(φ), by using a symbolic representation with nice computational properties. More precisely, we shall consider constrained formulae following the grammar below: where x ∈ VAR and c ∈ N. Given such contraints, it is easy to check non-emptiness or to check the satisfaction of M, s | = s v(φ) for a specific map v. To synthetise such parameters we use a remarkable result from single-sided VASS: the Pareto frontier for any parity game on single-sided VASS is computable [1, Theorem 4].

Parity acceptance condition
Below, we consider AVASS with a finite set of fork rules included in β≥2 Q β , and where the proofs are trees with nodes labelled by elements in Q × (N ∪ {ω}) r . Given an AVASS A = (Q, r, R 1 , R 2 ), a colouring col (a.k.a. a priority function) is defined as a map Q → [0, p − 1] for some p ≥ 1 (number of priorities). The parity game problem for AVASS is defined as follows: Question: Is there a proof whose root is equal to (q 0 , b), all the maximal branches are infinite and the maximal colour that appears infinitely often is even (the colour of each configuration is induced by col) ?
To be precise, [1,Corollary 2] states the result for single-sided VASS. A singlesided VASS can be viewed as an alternating VASS where the set Q of control states can be partitioned into Q = Q 1 Q 2 , unary rules start from states in Q 1 , fork rules start from states in Q 2 and there is at most one fork rule starting from the same control state (necessarily, it belongs to Q 2 ). The construction of two disjoint sets Q 1 and Q 2 with alternation of unary rules and fork rules can be done as in part (1) in the proof of Theorem 3. However, the colour of the new control states is equal to zero so that it has no influence on the acceptance parity condition. In order to guarantee the uniqueness of fork rules starting from a given control state, it is sufficient to replace any unary rule q u − → q and fork rule r = (q , q 1 , q 2 ) by the unary rule q u − → (q , r) and the fork rule ((q , r), q 1 , q 2 ). The colour of (q , r) is the colour of q . With such a transformation, decidability for single-sided VASS can be lifted to alternating VASS (this also implies a reduction for the computation of the Pareto frontier below).
It is not difficult to show that the state reachability and non-termination problems for AVASS are subproblems of the parity game problem, and therefore their decidability also follows from [1]. The decidability result for the parity game problem for AVASS is strenghtened in [1] with the computation of Pareto frontiers, as briefly explained below. Given A, q 0 and col : Q → [0, p − 1], the set of tuples b ∈ (N ∪ {ω}) r for which there is a proof such that the root is equal to (q 0 , b), all the maximal branches are infinite, and for each infinite branch the maximal colour that appears infinitely often is even, is upward closed and computable. This means that it can be represented effectively by a Boolean combination of atomic constraints of the form x i ≥ c where i ∈ [1, r] and c ∈ N, and x i = ω. Since the set is upward closed, by Dickson's Lemma, it has a finite set of minimal elements (with respect to the well-quasi-ordering slightly extended to accommodate the addition of the value ω), allowing the symbolic representation in terms of atomic constraints of the form x ≥ c to be easily defined. The Pareto frontier of A, q 0 and col : Q → [0, p − 1] is defined as the set of minimal elements in (N ∪ {ω}) r for which there is a positive solution to the parity game problem.
Proposition 5. [1, Theorem 4] The Pareto frontier for any parity game on single-sided VASS is computable.

A synchronised product
Before defining the reduction from the model checking problem for RB±ATL * to the parity game problem, we need to introduce a few more definitions, and in particular a notion of synchronisation that will be useful in the sequel.
Let M = (Agt, S, Act, r, act, cost, δ, Lab) be a resource-bounded concurrent game structure. Given the propositional variables p 1 , . . . , p n , we write Σ n def = P({p 1 , . . . , p n }) to denote the finite alphabet and Lab n (s ) Let A M,A,s = (Q, r, R 1 , R 2 ) be the AVASS defined from M, A and s (see Section 4.1), and A = (Q , q 0 , ∆ : Q × Σ n → Q , col : Q → [0, p − 1]) be a deterministic parity automaton over the alphabet Σ n . We recall that in A, • Q is a finite set of states, • q 0 is the initial state, • ∆ : Q × Σ n → Q is the transition function and, • col : Q → [0, p − 1] is the priority function that induces the acceptance condition and p is the number of priorities.
An ω-word σ = a 0 a 1 a 1 · · · ∈ Σ ω n is accepted by A (also written σ ∈ L(A)) iff there is a run q 0 The principle of the synchronised product A M,A,s ⊗ A defined below is the following. Any (infinite) branch of a proof of A M,A,s contains control states of the form s , (s , f) or (g, s ) where s is a distinguished state of M, s is any state, f ∈ D A (s ) and g is joint action in D(s ) with δ(s , g) = s . By construction, (s , f) is preceded by a state of the form either (g, s ) or s (if s = s ). So an infinite branch of the form (s 0 , u 0 ) ((s 0 , f 0 ), u 1 ) ((g 1 , s 1 ), u 1 ) ((s 1 , f 1 ), u 2 ) ((g 2 , s 2 ), u 2 ) · · · leads to the ω-word Lab n (s 0 ) Lab n (s 1 ) Lab n (s 2 ) · · · that corresponds to a unique run in A (because A is deterministic and complete and Lab n (s 0 ) Lab n (s 1 ) Lab n (s 2 ) · · · is in Σ ω n ). 4 The control states of A M,A,s ⊗ A are pairs in Q × Q and the second components are therefore control states in Q for the run on Lab n (s 0 ) Lab n (s 1 ) Lab n (s 2 ) · · · .
Let us define the AVASS A M,A,s ⊗ A def = (Q , r, R 1 , R 2 ) such that: • For each fork rule ((s , f), (g 1 , s 1 ), . . . , (g α , s α )) ∈ R 2 , and for each q ∈ Q , in R 2 we have the fork rule (((s , f), q), ((g 1 , s 1 ), q ), . . . , ((g α , s α ), q )), with q = ∆(q, Lab n (s )). So, firing a fork rule from A M,A,s does change the second component in a unique way depending on q and on the letter Lab n (s ). Again, there is a unique fork rule starting from the control state ((s , f), q).
Let us define the colouring col : Q → [0, p − 1] such that for all (q, q ) ∈ Q , we have col ((q, q )) def = col(q ). This is the most natural way to inherit colours from A to A M,A,s ⊗ A. (I) A M,A,s has a proof whose root is equal to (s , b), all the maximal branches are infinite and the Lab n -projection of each infinite branch belongs to L(A).
(II) A M,A,s ⊗ A has a proof whose root is equal to ((s , q 0 ), b), all the maximal branches are infinite and for all infinite branches, the maximal colour that appears infinitely often is even (based on the colouring function col ) In Lemma 10, let us explain what we mean by 'Lab n -projection'. Given an infinite branch in a proof of A M,A,s , its Lab n -projection is simply defined as the ω-word in Σ ω n below: Lab n (s 0 ) Lab n (s 1 ) Lab n (s 2 ) Lab n (s 2 ) · · · By assumption onD, the maximal colour that appears infinitely often is even, and therefore q 0 Lab n (s 1 ) − −−− → q 2 · · · is an accepting run of A and Lab n (s 0 ) Lab n (s 1 ) Lab n (s 2 ) Lab n (s 3 ) · · · ∈ L(A), which concludes the proof.

Decision procedures for RB±ATL * model checking
In this section, we provide an analysis leading to optimal decision procedures for solving the model checking problem for RB±ATL * , as far as worst-case computational complexity is concerned.
Theorem 6. The model checking problem for RB±ATL * is decidable.
Proof. The model checking problem for RB±ATL * is solved by using the algorithm for the parity game problem for alternating VASS (with a simple renaming technique) as a subroutine. The algorithm uses a dynamic programming approach that first computes in which states the subformulae hold before dealing with larger formulae. However, there is a caveat: when dealing with subformulae of the form A b Φ where Φ is a path formula without any strategy modality, we are entitled to use the algorithm to solve the parity game problem for alternating VASS. However, in order to systematically consider such subformulae A b Φ when the outermost connective is a strategy modality, we need to perform renamings on-the-fly.
Let φ be a formula built over the propositional variables {p 1 , . . . , p n } and A b Φ be one of its subformulae such that no strategy modality occurs in Φ. Without loss of generality, we can assume that there is an injective map nom : S → [1, n], such that for every s ∈ S, Lab(p nom(s) ) = {s}. As a result, each propositional variable p nom(s) is true in a single state, namely in s. So, even though we assume that φ is built over {p 1 , . . . , p n }, we do not require that all the propositional variables in {p 1 , . . . , p n } necessarily occur in φ (some of the propositional variables are only used to name states). Given a finite concurrent game structure M, it is always possible to enrich it so that each state can be named by a dedicated propositional variable (also called a nominal in hybrid logics, see e.g. [7]). This can be done in linear time.
Since Φ is an LTL formula built over {p 1 , . . . , p n }, there is a Büchi automaton A over the alphabet Σ n such that L(A) is equal to the set of models of Φ (over the set of propositional variables {p 1 , . . . , p n }), see e.g. [44]. Say that A has N states and N ≤ 2 |Φ| . Since Büchi automata and deterministic parity automata both recognize the set of ω-regular languages, there is deterministic parity automaton B with initial location q 0 , O(N! 2 ) states and 2N priorities such that L(A) = L(B) [41]. The automaton B can be effectively computed from A. 5 Let X ⊆ S be the set of states s such that A M,A,s ⊗ B has a proof whose root is equal to ((s , q 0 ), b), all the maximal branches are infinite and the maximal colour that appears infinitely often is even. We update the formula φ by replacing every occurrence of A b Φ by ψ = s ∈X p nom(s ) . The set X can be computed thanks to Proposition 4, and this is a correct step thanks to Lemma 10 and Lemma 4. Indeed, for all s ∈ S, we have M, s | = s A b Φ iff M, s | = s s ∈X p nom(s ) , and, therefore, for all s ∈ S, is obtained from φ by substituting every occurrence of A b Φ by ψ. We update φ until there are no more strategy modalities, and therefore eventually φ is a Boolean combination of propositional variables, which is then easy to evaluate on a given state. It is worth noting that the total number of calls to the parity game problem for AVASS is linear in the size of the formula, each instance of the problem has a doubly-exponential number of locations, and the colouring map has an exponential number of priorities in the size of the input formula.
The proof of Theorem 6 uses a synchronised product between an alternating VASS and a deterministic parity automaton recognising ω-words. This is reminiscent of the proof of a 2EXPTIME upper bound for ATL * model checking problem [6,Theorem 5.6]. However, the Rabin tree automata in the proof of [6, Theorem 5.6] are replaced by deterministic parity automata for encoding the LTL formulae, and by alternating VASS (with counters) as outcome of the synchronisation.
Moreover, using the very recent developments in [16], a 2EXPTIME upper bound can be obtained too.
Theorem 7. The model checking problem for RB±ATL * is in 2EXPTIME.
Proof. The complexity upper bound is obtained by using the algorithm described in the proof of Theorem 6, by analysing the size of the instances solved for the parity game problem for AVASS and then to invoke [16,Corollary 5.7], briefly recalled below.
Let us make a few simple observations from the proof of Theorem 6.
1. The number of calls to the subroutine solving the parity game problem for AVASS is linear in the size of the input formula.
2. Each AVASS A M,A,s ⊗ B built in the proof verifies the following quantitative properties.
(a) The size of A M,A,s is polynomial in the size of the input concurrent game structure M.
(b) As far as the deterministic parity automaton B is concerned, the number of states is doubly-exponential in the size of the input formula and the number of priorities is exponential in the size of the input formula.
(c) The number of states in A M,A,s ⊗B is doubly-exponential in the size of the inputs (including M and φ) and each vector has values at most exponential in the size of M.
We have seen that instances of the parity game problem for AVASS can be reduced to instances of the parity game problem for single-sided VASS, which itself can be turned into instances of the energy parity game, see e.g. [1,Lemma 4] and these two reductions can be performed without changing significantly the size of the instances as well as the maximal values in vectors. According to [16,Corollary 5.7], an instance of the energy game problem with initial credit c, with game graph (V, E, r) (V = V 1 V 2 and E is a finite set of edges in V × Z r × V) and priority function π : V → N with p = card({π(v) | v ∈ V}), is solvable in time (card(V)× || E ||) 2 O(r×log(r+p)) + O(r × log || c ||), where • || w ||= max{| w(i) | : i ∈ [1, r]} for all w ∈ Z r , So, all the instances of the energy parity games that we consider in the decidability satisfy the following properties: • card(V) is doubly-exponential in the size of the inputs, • || E || is exponential in the size of the input concurrent game structure, • r is unchanged, • p is exponential in the size of the input formula, • || c || is exponential in the size of the input formula.
Consequently, each instance of the energy parity game problem can be solved in doublyexponential time, and therefore each instance of the parity game problem for AVASS can be solved in doubly-exponential time, which leads to a total doubly-exponential time since the number of calls is linear in the size of the input formula.
Note that although RB±ATL and RB±ATL * have identical worst-case computational complexity (namely 2EXPTIME-completeness) in order to solve the model-checking problem for RB±ATL, we only need to call subroutines for the state reachability and non-termination problems for AVASS whereas RB±ATL * requires calls to subroutines to the more general parity game problem for AVASS. The restriction to a single agent also leads to an EXPSPACE upper bound and this is optimal.
Theorem 8. The model checking problem for RB±ATL * restricted to a single agent is The proof is similar to the proof of Theorem 4. Again, the upper bound is obtained by solving instances of the model checking problem for LTL on VASS (when the coalition is a singleton set) or instances of the model checking problem for CTL * (when the coalition is the empty set), which are known to be EXPSPACE-complete (see e.g. [28]) and PSPACE-complete (see e.g. [42]) respectively.
Note also that resource-bounded concurrent game structures can be seen as generalisations of VASS and, the logic RB±ATL * is clearly a generalisation of CTL * , by using the correspondences Agt ω Φ ≈ E Φ, and ∅ ω Φ ≈ A Φ. It may seem surprising that the model checking problem for RB±ATL * is decidable, given that the model checking problem for CTL * on VASS is known to be undecidable, see e.g. [25]. However this can be explained by the different satisfaction relations in the two problems. In the case of RB±ATL * , formulae are evaluated on states of a concurrent game structure, not on configurations made of states and counter values, and this makes all the difference.
It is also remarkable that the proof of Theorem 6 does not use the fact that the idle action is always among the action(s) returned by the action manager. In contrast, the proofs in Section 4 use the idle action in order to extend finite computations to infinite ones, by choosing the idle action for all the agents after the finite part of the computation that, e.g., witnesses the satisfaction of a next or an until formula (see, e.g., Lemma 8). This difference can be explained by the fact that to solve the modelchecking for RB±ATL * , we use a subroutine to a more general decision problem (the parity game problem for alternating VASS) and therefore one can be a bit more liberal on the conditions satisfied by the concurrent game structures. As a consequence, we get the following decidability result (and the results in Section 6.6 below also hold for RB±ATL * without idle actions).
Corollary 3. The model checking problem for the variant of RB±ATL * in which no idle action is assumed in the resource-bounded concurrent game structures (and the action manager always returns a non-empty set of actions) is in 2EXPTIME.
The proof is the same as for Theorem 6 and Theorem 8. The restriction to a single agent can be also shown EXPSPACE-complete, by using analogous arguments from the proof of Theorem 8 (EXPSPACE-hardness proof is even simpler).
By combining our results from previous sections and those from [1], we have shown that the model checking problem for RB±ATL * is decidable. However, by exploiting techniques for the effective computation of the Pareto frontiers from [1], we can go further, and actually synthesise values for parameters. This is the subject of the next section.

Symbolic representations for sets of resource values
Let M = (Agt, S, Act, r, act, cost, δ, Lab) be a resource-bounded concurrent game structure and φ be a ParRB±ATL * formula such that its resource variables are among x 1 , . . . , x m and its propositional variables are among p 1 , . . . , p n .
The proof of (P1) is quite standard but it is worth noting that the formulae φ, ψ and ψ need to be state formulae. The proof of (P2) uses the induction hypothesis in a straightforward way. Let S 1 , . . . , S β ⊆ S and I ⊆ [1, r]. We write φ i to denote the formula obtained from φ i replacing every occurrence of the formula ϕ j γ by So, even though this is not explicit in the notation, the formula φ i obviously depends on S 1 , . . . , S β . Like the base case, the formula φ i is an LTL formula built over {p 1 , . . . , p n }, and one can compute a deterministic parity automaton A such that the models of φ i on Σ n are precisely L(A). Again, we can construct a constrained formula ψ s I,S 1 ,...,S β characterising the Pareto frontier of A M,A i ,s ⊗ A, with initial state (s, q 0 ) and the values at the positions in I are equal to ω at the root, see [1,Theorem 4].
Reasoning in the same way as in the base case (basically replace φ i by φ i ), we can show that, for all concretisations v such that for all j ∈ [1, r] v(t j i ) = ω iff j ∈ I, we have v | = ψ s I,S 1 ,...,S β iff M, s | = s v( A t i i φ i ) ( †). However, the formula that is important to us is A t i i φ i (rather than A t i i φ i ), and this is the place where the induction hypothesis is again invoked.
First, let us introduce an auxiliary notion. A concretisation v is said to be compatible with I, S 1 , . . . , S β iff the conditions below hold: Assuming that v is compatible with I, S 1 , . . . , S β , we have that: • By induction hypothesis, for all γ ∈ [1, β], S γ = {s ∈ S | v | =φ s j γ }.
• By using the compatibility of v, we get that v | = ψ s I,S 1 ,...,S β ∧( γ∈ [1,β] The formulaφ s i is defined as a generalised disjunction parameterised by all the possible values for I, S 1 , . . . , S β , and it is easy to check that for all v, we have v | =φ s i equivalent to M, s | = s v( A t i i φ i ).
Theorem 9. The parameterised model checking problem for ParRB±ATL * can be solved.
It is worth noting that the size of the symbolic representations is very large in the worst case since the construction of the representation of the Pareto frontier for parity games on single-sided VASS in [1] is based on some algorithm that is similar to Karp-Miller algorithm for Petri nets.