#### Appendix B.1. Soundness

First, we show that the program constructed by Algorithm 3 never reaches a state in $m{s}_{1}$. Specifically,

**Lemma** **A5.** For any ${p}^{\prime}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation $\langle {s}_{0},{s}_{1},\dots \rangle $ where ${s}_{0}\in {S}^{\prime}$, there dose not exist ${s}_{i}$ such that ${s}_{i}$ is in $m{s}_{1}$.

**Proof.** Consider a computation $\langle {s}_{0},{s}_{1},\dots \rangle $ of ${p}^{\prime}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ where ${s}_{0}\in {S}^{\prime}$. We proof by induction that for all $i\ge 0$, ${s}_{i}\notin m{s}_{1}$:

**Base case**: $i\in \{0,1\}$

It is clear ${s}_{0}\notin m{s}_{1}$, because $m{s}_{1}\subseteq m{s}_{2}$ and ${s}_{0}\in {S}^{\prime}$ and by construction, we know ${S}^{\prime}\cap m{s}_{1}=\varnothing $ (see Line 33). Also, ${s}_{1}\notin m{s}_{1}$, because otherwise ${s}_{0}\in m{s}_{2}$ that is contradiction to ${S}^{\prime}\cap m{s}_{2}=\varnothing $.

**Induction hypothesis**: $\forall i:0\le i\le n:{s}_{i}\notin m{s}_{1}$

**Induction step**: ${s}_{n+1}\notin m{s}_{1}$

Suppose ${s}_{n+1}\in m{s}_{1}$. Then, $({s}_{n},{s}_{n+1})\in mt$. By construction, the program does not have any transition in $mt$. Thus, we have two cases for $({s}_{n},{s}_{n+1})$:

**Case 1**: $({s}_{n},{s}_{n+1})\in f$

In this case, ${s}_{n}\in m{s}_{1}$ (by Line 28) that is contradictory to the induction hypothesis.

**Case 2**: $({s}_{n},{s}_{n+1})\in {\delta}_{e}$

In this case, ${s}_{n}\in m{s}_{2}$. If $n=0$, then ${s}_{0}\in m{s}_{2}$ that is contradiction to ${S}^{\prime}\cap m{s}_{2}=\varnothing $. If $n>0$, then $({s}_{n-1},{s}_{n})\in mt$. By construction, the program does not have any transition in $mt$. Thus, we have two cases for $({s}_{n-1},{s}_{n})$

**Case 2.1**: $({s}_{n-1},{s}_{n})\in f$:

In this case, ${s}_{n-1}\in m{s}_{1}$ that is contradictory to the induction hypothesis.

**Case 2.2**: $({s}_{n-1},{s}_{n})\in {\delta}_{e}$:

In this case, as both $({s}_{n-1},{s}_{n})$ and $({s}_{n},{s}_{n+1})$ are in ${\delta}_{e}$, according to the fairness assumption, there does not exist a transition ${\delta}_{p}^{\prime}$ starting from ${s}_{n}$ and it means that ${s}_{n}$ is added to $m{s}_{1}$ by Line 28 which is in contradiction with the induction hypothesis. □

Since we never reach any state in $m{s}_{1}$ starting from ${S}^{\prime}$ and since any state in $\neg (R\cup {R}_{p})$ is in $m{s}_{1}$ by Line 23, we conclude we never reach $\neg (R\cup {R}_{p})$. Thus, we have the following corollary:

**Corollary** **A1.** $R\cup {R}_{p}$ in the last iteration of loop on Lines 6–43 is a f-span for the program resulted by Algorithm 3.

The following lemma states that in every computation of the repaired program that starts from its invariant (i.e., ${S}^{\prime}$), if the program reaches a state in R, in the rest of the computation it will reach ${S}^{\prime}$. Specifically,

**Lemma** **A6.** For every ${\delta}_{p}^{\prime}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation $\langle {s}_{0},{s}_{1},\dots \rangle $ such that ${s}_{0}\in {S}^{\prime}$, for ${S}^{\prime}$ and R in the last iteration of the loop on Lines 6–43, we have:

$\forall {s}_{i}:{s}_{i}\in R:(\exists j:j\ge i:{s}_{j}\in {S}^{\prime})$.

**Proof.** We prove this lemma by induction as we expand set R:

**Base case**: $R={S}^{\prime}$

The proof is trivial.

**Induction hypothesis**: Theorem holds for current R.

**Induction step**:

For any state

${s}_{0}$ that is added to

R we have

Thus, any environment transition either reaches R or ${R}_{p}$. In the second case, since we have reached a state in ${R}_{p}$ by an environment transition, and since from any state in ${R}_{p}$ there is a program transition to R (cf. Line 17), based on the fairness assumption, the computation will reach R. Thus, in either case, we reach R. Since in the last iteration of loop on Lines 6–43, we do not change the set of transitions for states in R of the previous iteration, based on the induction hypothesis, the lemma is proved. □

The following lemma states that when the repaired program starts at its invariant ${S}^{\prime}$, if it reaches a state in ${R}_{p}-R$, in the rest of the its computation it will reach a state in ${S}^{\prime}$. Specifically,

**Lemma** **A7.** For every ${\delta}_{p}^{\prime}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation $\langle {s}_{0},{s}_{1},\dots \rangle $ such that ${s}_{0}\in {S}^{\prime}$, for ${S}^{\prime}$, ${R}_{p}$ and R in the last iteration of loop on Lines 6–43, we have:

$\forall {s}_{i}:{s}_{i}\in {R}_{p}-R:(\exists j:j\ge i:{s}_{j}\in {S}^{\prime})$.

**Proof.** Let ${s}_{i}\in ({R}_{p}-R)$. Any state that is not in R is in $m{s}_{2}$. Thus, $({s}_{i-1},{s}_{i})\in mt$. By construction, the program does not have any transition in $mt$. Thus, $({s}_{i-1},{s}_{i})\in f\cup {\delta}_{e}$. If $({s}_{i-1},{s}_{i})\in f$, then ${s}_{i-1}\in m{s}_{1}$ that is a contradiction to Lemma A5. Thus, $({s}_{i-1},{s}_{i})\in {\delta}_{e}$. Since we have reached ${s}_{i}$ by an environment transition and ${s}_{i}\in {R}_{p}$, the computation will reach R and according to Lemma A6, the computation will reach ${S}^{\prime}$. □

Based on Lemmas A6 and A7, we have the following corollary that guarantees recovery to the invariant from $R\cup {R}_{p}$.:

**Corollary** **A2.** For every ${\delta}_{p}^{\prime}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation $\langle {s}_{0},{s}_{1},\dots \rangle $ such that ${s}_{0}\in {S}^{\prime}$, for ${S}^{\prime}$, ${R}_{p}$ and R in the last iteration of loop on Lines 6–43, we have:

$\forall {s}_{i}:{s}_{i}\in R\cup {R}_{p}:(\exists j:j\ge i:{s}_{j}\in {S}^{\prime})$.

**Theorem** **A4.** Algorithm 3 is sound.

**Proof.** In order to show the soundness of our algorithm, we need to show that the three conditions of the problem statement are satisfied.

**C1**: Satisfaction of **C1** for Algorithm 3 is the same as that for Algorithm 2 stated in the proof of the Theorem A1.

**C2**: We need to show that ${p}^{\prime}$ is a masking fault-tolerant revision for p. Thus, we need to show the constraints of Definition 16 are satisfied. From **C1**, ${S}^{\prime}\subseteq S$, the assumption that $p{\left[\right]}_{2}{\delta}_{e}$ satisfies $spec$ from S, ${S}^{\prime}\ne \varnothing $ and ${S}^{\prime}$ is closed in ${p}^{\prime}\cup {\delta}_{e}$, all constraints of Definition 10 are satisfied. Thus, ${p}^{\prime}{\left[\right]}_{2}{\delta}_{e}$ 2-satisfies $spec$ from ${S}^{\prime}$.

Let $spec=\langle Sf,Lv\rangle $. Consider prefix c of ${p}^{\prime}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ such that c starts from a state in ${S}^{\prime}$. If c does not satisfy $Sf$, there exists a prefix of c, say $\langle {s}_{0},{s}_{1},\dots ,{s}_{n}\rangle $, such that it has a transition in ${\delta}_{b}$. W.l.o.g., let $\langle {s}_{0},{s}_{1},\cdots ,{s}_{n}\rangle $ be the smallest such prefix. It follows that $({s}_{n-1},{s}_{n})\in {\delta}_{b}$. Hence, $({s}_{n-1},{s}_{n})\in mt$. By construction, ${p}^{\prime}$ does not contain any transition in $mt$. Thus, $({s}_{n-1},{s}_{n})$ is a transition of f or ${\delta}_{e}$. If it is in f then ${s}_{n-1}\in m{s}_{1}$ which is a contradiction to Lemma A5. If it is in ${\delta}_{e}$ then ${s}_{n-1}\in m{s}_{2}$ and $({s}_{n-2},{s}_{n-1})\in mt$. Again, by construction, we know that ${\delta}_{p}^{\prime}$ does not contain any transition in $mt$, so $({s}_{n-2},{s}_{n-1})$ is either in f or ${\delta}_{e}$. If it is in f then ${s}_{n-2}\in m{s}_{1}$ (contradiction to Lemma A5). If it is in ${\delta}_{e}$, as both $({s}_{n-2},{s}_{n-1})$ and $({s}_{n-1},{s}_{n})$ are in ${\delta}_{e}$, according to the fairness assumption, there does not exist a transition of ${\delta}_{p}^{\prime}$ starting from ${s}_{n-1}$ and it means that ${s}_{n-1}\in m{s}_{1}$, which is again a contradiction to Lemma A5. Thus, each prefix of c does not have a transition in ${\delta}_{b}$. Therefore, any prefix of ${p}^{\prime}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ satisfies $Sf$.

As ${p}^{\prime}$ 2-satisfies $spec$ from ${S}^{\prime}$ in environment ${\delta}_{e}$, any prefix of ${p}^{\prime}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ 2-satisfies $Sf$ and according to Corollary A1 and Corollary A2, ${p}^{\prime}$ is masking 2-f-tolerant to $spec$ from ${S}^{\prime}$ in environment ${\delta}_{e}$ with fault-span $R\cup {R}_{p}$ for R and ${R}_{p}$ in the last iteration of the loop on Lines 6–43.

**C3**: Any $({s}_{0},{s}_{1})\in {\delta}_{r}$, is in $mt$. By construction, ${p}^{\prime}$ does not have any transition in $mt$, so C3 holds. □

#### Appendix B.2. Completeness

Like the proof of the completeness of Algorithm 2, the proof of the completeness of Algorithm 3 is based on the analysis of states that are removed from S. For Algorithm 3, we focus on the iterations of the loop on Lines 6–43.

Similar to Observation 1, we have the following observation for Algorithm 3:

**Observation** **5.** In any given iteration i of loop on 6–43, let R, ${R}_{p}$ and $m{s}_{1}$ be R, ${R}_{p}$ and $m{s}_{1}$ at the end of iteration i. Then, for any ${s}_{0}$ such that ${s}_{0}\notin R$ and $\exists {s}_{1}::({s}_{0},{s}_{1})\in {\delta}_{e}$, we have

$(\exists {s}_{2}:{s}_{2}\in \neg (R\cup Rp)\cup m{s}_{1}:({s}_{0},{s}_{2})\in {\delta}_{e})\vee $

$(\exists {s}_{2}::({s}_{0},{s}_{2})\in {\delta}_{e}\cap {\delta}_{b})$.

We also note the following observation:

**Observation** **6.** For any ${s}_{0}$ such that ${s}_{0}\notin R$, either ${s}_{0}\in \neg (R\cup {R}_{p})$, or $\exists {s}_{2}:{s}_{2}\in \neg (R\cup Rp)\cup m{s}_{1}:({s}_{0},{s}_{2})\in {\delta}_{e}$.

Lemmas A8, A9, A10 and A11, Corollary A3 and Theorem A5 provided in the following, hold for any given iteration i of loop on Lines 6–43 assuming Algorithm 3 has declared failure. For these results, let ${p}^{\u2033}=\langle {S}_{p},{\delta}_{p}^{\u2033}\rangle $ with invariant ${S}^{\u2033}$ be any revision for program $p=\langle {S}_{p},{\delta}_{p}\rangle $ with invariant S such that ${S}^{\u2033}\subseteq {S}^{\prime}$, ${\delta}_{p}^{\u2033}\subseteq {\delta}_{p}^{\prime}$ and ${\delta}_{p}^{\u2033}\cap mt=\varnothing $. Consider ${S}^{\prime}$, ${\delta}_{p}^{\prime}$ and $mt$ at the beginning of iteration i and $m{s}_{1}$, $m{s}_{2}$, R and ${R}_{p}$ at the end of the iteration. Also, let f and ${\delta}_{e}$ be a set of fault transitions and a set of environment transitions for p (i.e., ${p}^{\u2033}$), respectively.

The following lemma focuses on the situation where a given revision ${p}^{\u2033}$ reaches a state that our algorithm marks as $\neg (R\cup {R}_{p})$.

**Lemma** **A8.** For every ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ prefix $\alpha =\langle {s}_{0},\dots ,{s}_{i}\rangle $ such that ${s}_{i}\in \neg (R\cup {R}_{p})$, there exists a suffix β such that $\alpha \beta $ is a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation and

$({s}_{i},{s}_{i+1})\in {\delta}_{b}$, or

${s}_{i+1}\in m{s}_{1}$, or

${s}_{i+1}\in \neg (R\cup {R}_{p})$, or

${s}_{i+1}\in ({R}_{p}-R)\wedge {s}_{i+2}\in \neg (R\cup {R}_{p})$.

**Proof.** There are two cases for ${s}_{i}$:

**Case 1**: ${s}_{i}$ is environment-enabled (see Definition 18) in prefix $\alpha =\langle {s}_{0},{s}_{1},\dots ,{s}_{i}\rangle $:

According to Observation 5, there exists $s\in \neg (R\cup {R}_{p})\cup m{s}_{1}$ such that $({s}_{i},s)\in {\delta}_{e}$, $({s}_{i},s)\in {\delta}_{e}\cap {\delta}_{b}$. Any suffix that starts from s proves the theorem.

**Case 2**: ${s}_{i}$ is not environment-enabled in prefix $\alpha =\langle {s}_{0},{s}_{1},\dots ,{s}_{i}\rangle $

The proof for this case is identical to the proof of Case 2 of Lemma 2. □

**Corollary** **A3.** For every ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ prefix $\alpha =\langle {s}_{0},\dots ,{s}_{i}\rangle $ such that ${s}_{i}\in \neg (R\cup {R}_{p})$, there exists a suffix β such that $\alpha \beta $ is a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation and

$\exists j:j\ge i:({s}_{j-1},{s}_{j})\in {\delta}_{b}$, or

$\exists j:j\ge i:{s}_{j}\in m{s}_{1}$, or

$\forall i:i\ge 0:{s}_{i}\notin {S}^{\prime}$.

The following lemma focuses on states that are marked as $m{s}_{2}$.

**Lemma** **A9.** If α is a prefix of a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation and $\alpha =\langle {s}_{i},\dots ,{s}_{m}\rangle $ such that ${s}_{i}\in m{s}_{2}$, or $\alpha =\langle {s}_{0}\dots ,{s}_{i-1},{s}_{i}\rangle $ such that ${s}_{i}\in m{s}_{2}$ and $({s}_{i-1},{s}_{i})\in f\cup {\delta}_{p}^{\u2033}$, then, there exists a suffix β such that $\alpha \beta $ is a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation and

$\exists j:j\ge i:(({s}_{j-1},{s}_{j})\in {\delta}_{b})$, or

$\exists j:j\ge i:({s}_{j}\in m{s}_{1})$, or

$\forall i:i\ge 0:{s}_{i}\notin {S}^{\prime}$.

**Proof.** We prove this lemma by looking at lines where we expand $ms2$:

**Line 4**: $m{s}_{2}=m{s}_{1}\cup \left\{{s}_{0}\right|\exists {s}_{1}:({s}_{0},{s}_{1})\in {\delta}_{e}\cap {\delta}_{b}\}$

In this case, we add ${s}_{0}$ to $m{s}_{2}$ if either it is in $m{s}_{1}$, or it has a $({s}_{0},{s}_{1})$ transition that is in ${\delta}_{b}$. If ${s}_{0}\in m{s}_{1}$, any computation starting from ${s}_{0}$ proves the theorem. Otherwise, any computation $\langle {s}_{0},{s}_{1},\dots \rangle $ proves the theorem.

**Line 24**: $m{s}_{2}=m{s}_{2}\cup \neg R$:

According to Observation 6, there is a suffix (possibly $\langle \rangle $) that reaches $\neg (R\cup {R}_{p})$. According to Corollary A3 there is a computation that either reaches $m{s}_{1}$, or never reaches ${S}^{\prime}$.

**Line 29**: $m{s}_{2}=m{s}_{2}\cup m{s}_{1}\cup \left\{{s}_{0}\right|\exists {s}_{1}:{s}_{1}\in m{s}_{1}:({s}_{0},{s}_{1})\in {\delta}_{e})\}$

In this case, we add state ${s}_{0}$ to $m{s}_{2}$, if ${s}_{0}$ is in $m{s}_{1}$ or can reach state ${s}_{1}\in m{s}_{1}$ with an environment transition. If ${s}_{0}\in m{s}_{1}$, any computation starting from ${s}_{0}$ proves the theorem. Otherwise, any computation $\langle {s}_{0},{s}_{1},\dots \rangle $ proves the theorem. Note that, since we have started the computation from ${s}_{0}$, or we have reached ${s}_{0}$ with a fault or program transition, even with the fairness assumption, the environment transition $({s}_{0},{s}_{1})$ can execute. □

The following lemma states that reaching any state in $m{s}_{1}$ will result in bad consequences that can be either executing a bad transition or never recovering to the invariant. Specifically,

**Lemma** **A10.** If $\alpha =\langle {s}_{0},\dots ,{s}_{i-1},{s}_{i}\rangle $ where ${s}_{i}\in m{s}_{1}$ is a prefix of a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation, then, there exists a suffix $\beta =\langle {s}_{i+1},{s}_{i+2},\dots \rangle $ such that $\alpha \beta $ is a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation and

$\exists j:j\ge i:({s}_{j},{s}_{j+1})\in {\delta}_{b}$, or

$\forall j:j\ge 0:{s}_{j}\notin {S}^{\prime}$.

**Proof.** We prove this theorem inductively based on where we expand $m{s}_{1}$:

**Base Case**: $m{s}_{1}=\left\{{s}_{0}\right|({s}_{0},{s}_{1})\in f\cap {\delta}_{b}\}$

Let $\beta $ be any ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation starting from ${s}_{1}$. Since fault transitions can execute in any state, $\alpha \beta $ is a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}\left[\right]f$ computation such that $({s}_{0},{s}_{1})\in {\delta}_{b}$.

**Induction hypothesis**: Theorem holds for current $m{s}_{1}$.

**Induction step**: We look at lines where we add a state to ${s}_{0}$:

**Line 23**: $m{s}_{1}=m{s}_{1}\cup \neg (R\cup {R}_{p})$

According to Corollary A3, there is a suffix that either runs a transition in ${\delta}_{b}$, never reaches ${S}^{\prime}$, or reaches a state in $m{s}_{1}$. Thus, the theorem is proved by the induction hypothesis.

**Line 28**: $m{s}_{1}=m{s}_{1}\cup \left\{{s}_{0}\right|\phantom{\rule{4pt}{0ex}}\exists {s}_{1}:{s}_{1}\in m{s}_{2}:({s}_{0},{s}_{1})\in f\}\cup \left\{{s}_{0}\right|\left(\exists {s}_{1}:{s}_{1}\in m{s}_{1}:({s}_{0},{s}_{1})\in {\delta}_{e})\vee ({s}_{0},{s}_{1})\in ({\delta}_{e}\cap {\delta}_{b})\right)\wedge \left(\nexists {s}_{2}::({s}_{0},{s}_{2})\in {\delta}_{p}^{\prime}\right)\}$

We add state ${s}_{0}$ to $m{s}_{1}$ in three cases in this line:

**Case 1**$\exists {s}_{1}:{s}_{1}\in m{s}_{2}:({s}_{0},{s}_{1})\in f$

In this case according to Lemma A9, a transition in ${\delta}_{b}$ may occur, or there is a suffix that never reach ${S}^{\prime}$, or a state in $m{s}_{1}$ can be reached. Thus, according to the induction hypothesis, the theorem is proved.

**Case 2**$\exists {s}_{1}::({s}_{1}\in m{s}_{1}\wedge ({s}_{0},{s}_{1})\in {\delta}_{e})\wedge (\nexists {s}_{2}::({s}_{0},{s}_{2})\in {\delta}_{p}^{\prime})$

In this case, if according to fairness, $({s}_{0},{s}_{1})$ can occur, state ${s}_{1}\in m{s}_{1}$ can be reached by $({s}_{0},{s}_{1})$ and according to the induction hypothesis, the theorem is proved. However, if $({s}_{0},{s}_{1})$ cannot occur, some other transition $t\in {\delta}_{p}^{\u2033}\cup f$ occurs. Since $\exists {s}_{1}:{s}_{1}\in m{s}_{1}:({s}_{0},{s}_{1})\in {\delta}_{e}$, we know that ${s}_{0}\notin R$. By construction, ${\delta}_{p}^{\prime}$ contains any transition from states $\neg R$ to R. Since $\nexists {s}_{2}::({s}_{0},{s}_{2})\in {\delta}_{p}^{\prime}$, we conclude t goes to a state in $\neg R$ (i.e., $m{s}_{2}$). Thus, according to Lemma A9 either a transition in ${\delta}_{b}$ can occur, or there is a suffix that never reaches ${S}^{\prime}$, or a state in $m{s}_{1}$ can be reached. Thus, according to the induction hypothesis, the theorem is proved.

**Case 3**$\exists {s}_{1}::(({s}_{0},{s}_{1})\in {\delta}_{e}\cap {\delta}_{b})\wedge (\nexists {s}_{2}::({s}_{0},{s}_{2})\in {\delta}_{p}^{\prime})$

In this case, if according to fairness, $({s}_{0},{s}_{1})$ can occur, by its occurrence a transition in ${\delta}_{b}$ has occurred. However, if $({s}_{0},{s}_{1})$ cannot occur, some other transition in ${\delta}_{p}^{\u2033}$ should occur. Since $\exists {s}_{1}::(({s}_{0},{s}_{1})\in {\delta}_{e}\cap {\delta}_{b})$, ${s}_{0}\notin R$. Our algorithm add any possible program transition that is not $mt$ and goes to a state in R to ${s}_{0}$ in Line 17. Since there is no such transition, any transition in ${\delta}_{p}^{\u2033}$ either is in $mt$ or goes to $\neg R$. In either case, we have a computation that reaches a state in $m{s}_{2}$ starting from ${s}_{0}$. Thus, according to Lemma A9, either a transition in ${\delta}_{b}$ can occur, or there is suffix that never reaches ${S}^{\prime}$, or a state in $m{s}_{1}$ can be reached. Thus, according to the induction hypothesis, the theorem is proved. □

Like Lemma A4 for Algorithm 2, we have following lemma for $m{s}_{4}$ for Algorithm 3.

**Lemma** **A11.** If ${S}^{\u2033}$ includes any state in $m{s}_{4}$ in any iteration of the loop on Lines 13–21, then there is a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}$ computation that starts from ${S}^{\u2033}$ that is not a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}$.

**Proof.** The proof of this lemma is very similar to that of Lemma A4. □

**Theorem** **A5.** Algorithm 3 is complete.

**Proof.** Suppose program ${p}^{\u2033}$ and invariant ${S}^{\u2033}$ solve transformation problem. We show that at any point of Algorithm 3, ${S}^{\u2033}$ must always be a subset of ${S}^{\prime}$. We prove this by looking at lines where we set ${S}^{\prime}$.

In the first iteration of the loop on Lines 6–43,

${S}^{\prime}=S$. According to constraint

**C1** of the problem definition in

Section 5.1,

${S}^{\u2033}\subseteq S$. Thus,

${S}^{\u2033}\subseteq {S}^{\prime}$ for the

${S}^{\prime}$ at the beginning of the first iteration of the loop on Lines 6–43. According to Lemmas A9 and A10,

${S}^{\u2033}$ cannot have any transition in

$m{s}_{2}$ in first iteration of the loop on Line 6–43, because by starting from a state in

$m{s}_{2}$, a computation may execute a bad transition, or reach a state outside

${S}^{\u2033}$ from which there is a computation that never reaches

${S}^{\prime}$ (i.e., never reaches

${S}^{\u2033}$). In addition,

${S}^{\u2033}$ must be closed in

${\delta}_{p}^{\u2033}$ and cannot have any deadlock state. Thus,

${S}^{\u2033}\subseteq {S}^{\prime}$ for

${S}^{\prime}$ at Line 33.

According to Lemma A11, ${S}^{\u2033}$ cannot include any state in $m{s}_{4}$ in the first iteration of the loop of Lines 6–43, because otherwise there is a ${p}^{\u2033}{\left[\right]}_{2}{\delta}_{e}$ computation that is not $p{\left[\right]}_{2}{\delta}_{e}$ (contradiction to **C1**). Thus, ${S}^{\u2033}\subseteq {S}^{\prime}$ for ${S}^{\prime}$ at the end of the first iteration of the loop on Lines 6–43.

With the induction, we conclude that ${S}^{\u2033}$ cannot include any states in $m{s}_{2}$ or $m{s}_{4}$ in next iterations of the loop of Lines 6–43. Thus, always we have ${S}^{\u2033}\subseteq {S}^{\prime}$. Our algorithm declares failure only when ${S}^{\prime}=\varnothing $. Thus, if our algorithm does not find any solution, from ${S}^{\u2033}\subseteq {S}^{\prime}$, we have ${S}^{\u2033}=\varnothing $ (contradiction to Definition 11). □