L'auto-stabilisation est un paradigme adapté aux systèmes distribués, particulièrement susceptibles de subir des fautes transitoires. Des erreurs de corruption de mémoire, de messages, la rupture d'un lien de communication peuvent plonger le système dans un état incohérent. Un protocole est auto-stabilisant si, quel que soit l'état initial du système, il garantit un retour à un fonctionnement normal en temps fini.

Plusieurs contraintes s'appliquent aux algorithmes conçus pour les systèmes distribués. L'asynchronie en est un exemple emblématique. Avec le développement de réseaux d'objets connectés, censés être autonomes, il devient également central de concevoir des algorithmes ayant un faible coût en termes de consommation énergétique et peu exigeants en termes de ressources.

Une des manières d'appréhender ces problèmes est de chercher à réduire la taille des messages échangés entre les différents noeuds du réseau. Cette thèse se concentre sur l'optimisation de la mémoire nécessaire à la communication pour les algorithmes distribués auto-stabilisants.

Nous établissons dans cette thèse plusieurs résultats négatifs, démontrant l'impossibilité de résoudre certains problèmes sans une certaine taille minimale pour les messages échangés, en établissant une impossibilité d'utiliser jusqu'au bout l'existence d'identifiants uniques dans le réseau en dessous de cette taille minimale. Ces résultats sont génériques et peuvent s'appliquer à de nombreux problèmes distribués. Dans un second temps, nous proposons des algorithmes particulièrement efficaces en mémoire pour la résolution de deux problèmes fondamentaux des systèmes distribués: la détection de terminaison, et la circulation perpétuelle de jeton.

One way to address these problems is to aim at reducing the size of the messages exchanged between the nodes of the network. This thesis focuses on the memory optimization of the communication for self-stabilizing distributed algorithms.

We establish in this thesis several negative results, which prove the impossibility to solve some problems under a certain limit on the size of the exchanged messages, by showing an impossibility to fully use the presence of unique identifiers in the network below that minimal size. Those results are generic, and may apply to numerous distributed problems. Secondly, we propose particularly efficient algorithms in terms of memory for two fundamental problems in distributed systems: the termination detection, and the token circulation.

Introduction

The Matrix is everywhere. It is all around us. Even now, in this very room. You can see it when you look out your window or when you turn on your television. You can feel it when you go to work... when you go to church... when you pay your taxes.

Morpheus

The continuous development of communication technologies has deeply changed every aspect of our society. Most users see this evolution through the increasing role and size of Internet, social networks, instant messaging, etc. It also brought ruptures in the core of the economy. Six out of the eight biggest companies in the world, in terms of capitalization, are directly linked to computing technology, produce both devices and services, the stock market itself also relies on those technologies.

Communication technology is in constant change, and already widely diverse. Data collection from connected objects relies on the structure of the Internet of Things (IoT), GPS technology relies on a very precise synchronization in satellite networks, phone internet is based on Wi-Fi networks.

With the development of communication protocols involving small, autonomous devices which communicate via WiFi, it is crucial to design algorithms which are efficient in terms of energy, memory, CPU. . . All these communication technologies can be described as distributed systems. A distributed system, which we also call network, is a system composed of several autonomous computing units, and of communication links between those units. Each device computes autonomously, depending on the information it has, and can send and receive information to other devices through the communication links. Each unit is directly linked to a non-empty subset of the other units, its neighbors, such that there exists a communication path between any two computing units. This definition includes computer networks, sensor networks, swarm robots, parallel computers. . . . Although very diverse, distributed systems share some characteristics which differentiate them from central systems. In distributed systems, the different computing units of a distributed system do not necessarily compute at the same speed, may run different computations which do not take the same time, may run on different materials which do not have the same performances. This results in an asynchrony inherent to distributed systems. In particular, the individual clocks of each device may desynchronize, which invalidates the possibility to rely on a global notion of time.

We must also consider that the communication between devices takes place through communication links of various qualities, length, with different speeds. This makes it impossible to define a reliable order on the operations made by separate devices: an execution on one system may not be linearizable. Therefore, one cannot expect any synchronization between the different devices of a distributed system. This asynchrony has, as a direct consequence, non-determinism on the evolution of the system. Even if the algorithm con-sidered is deterministic, the order in which the nodes compute, send and receive messages may be different in two separate executions.

Distributed systems are more prone to faults than centralized systems. Such systems cover a huge quantity of diverse devices and depend on a large variety of communication technologies, which make the existence of communication or unit errors very likely within time. Therefore, algorithms for distributed systems should be fault-resilient.

In distributed systems, the computing units are autonomous, which means that they all execute their own code, and update their own variables. By definition, nodes have no global view on the state of the system. Therefore, the computations and decisions made by the individual devices in order to make the system behave correctly only depend on the local memory of the device, and on the messages it received from its direct neighbors. Due to asynchrony, this information may be outdated, and due to faults, they can even be erroneous.

Wireless networks are simpler to deploy than wired networks, and therefore are more and more spread, and larger and larger within time. The IoT, sensor networks, or swarm robots are research and technological areas in constant development. All those networks share some properties which make it a specific challenge to design algorithms for them. In wired networks, the messages are exchanged through physical, wired, communication links. Due to commutation technology, everything behaves like if any communication link was shared by exactly two devices. In such situations, identifying the communication link, the port on which it is physically connected, allows devices to know which of their neighbors sent them some message. Reciprocally, devices can without difficulty send a message to exactly one of their neighbors.

Things are very different for wireless networks. In such networks, any message sent by one device is identically received by all of its neighbors, through wireless communication (WiFi, Bluetooth, radio. . . ). Therefore, sending a message to one specific neighbor is impossible, and addressing a message to one specific neighbor is a challenge, since the same message will be received by all the other nodes in the neighborhood. Not only does this complicate the resolution of some tasks, but in addition this can lead to an increase in the number of sent messages in the network, and even to loops of propagation of information.

One way to solve this issue is to rely on unique identifiers possessed by nodes, such as MAC addresses, or IP addresses. If all nodes share their unique identifier to all of their neighbors, then it becomes possible to address a message to one specific neighbor by prefixing the message with the recipient identifier. This technique has several flaws. The first one is that it does not apply to networks in which nodes do not have a unique, permanent, identifier. Such networks are said anonymous. A lot of operations are much more complicated to achieve in anonymous networks. Even in networks in which devices have a globally unique identifier, it might be desirable to avoid such solutions. Indeed, this solution requires the transmission if identifiers, by WiFi, to the entire neighborhood, which rises privacy and/or security issues. Finally, prefixing all messages by the identifier of the recipient has a non-negligible cost in terms of size of the message communicated by the devices.

Sensor networks, robot networks, also have in common the fact that the devices involved may be distant from any source of energy for a pretty long period of time. In order to keep them able to perform their task, algorithms for such networks should be as little talkative as possible. Indeed, in distributed systems, devices constantly exchange information to check local consistency, and perform the task they are designed for. To save battery, and extend the life expectancy of the devices, it becomes crucial to make the messages as short as possible. For this reason, designing algorithms which do not require the exchange of the node identifiers is an interesting challenge. One other interest of such algorithms is that they do not require a lot of memory, since nodes do not have to store the identifiers of their neighbors, and thus are suitable for networks in which the devices have a low storage capacity.

Problems addressed in the field of distributed computing can be very diverse.

Structure construction problems designate all the problems which aim at providing the network a structure which satisfies an intended property. This structure can be spanning the whole network (maximal independent set, tree, . . . ), involving only one node (leader election). Building structures is often a first step to solve a more complicated problem.

Mutual exclusion problems designate all the problems which aim at assuring that one or several resources in the network (a printer, a computing server, a database. . . ) is not accessed by several users at the same time. This exclusion can be local: no two neighbors can access the resource at the same time, or global: no two devices of the networks can access the resource at the same time.

Global observation problems designate all the problems which aim at gathering on one or several nodes information relative to the global state of the system. The particular information can be the termination of a computation as well as detecting some property on the topology of the network, or the presence of a deadlock.

Nowadays distributed systems involve more and more components, and more and more non-reliable components (watches, fridges, printers. . . ). With this increase of the number of devices, the probability that faults occur increase as well. These faults can be caused by the environment, by attacks, or even by the device itself which may be poorly coded, or unadapted to the conditions in which it operates. Furthermore, the effects of such faults are also pretty diverse. It can lead to a temporary or permanent disappearing of one node, or of some communication links. I can also be simply the transmission of some erroneous messages. In the worst case, an attacker takes permanent control of one or several nodes, which hinder a normal behavior of the system. Two main paradigms are suitable for faulty distributed systems.

Robustness [START_REF] Gupta | On the robustness of distributed algorithms[END_REF][START_REF] Casteigts | Robustness: A new form of heredity motivated by dynamic networks[END_REF] is a paradigm which focuses on the nature of the solution. A solution is robust if, even when some node, or some communication links crash, the solution remains valid. Designing robust solutions to problems allows ignoring the future faults in the system. Such solutions are generally expensive, and hard to build when they exist, which is not always the case. They are mainly used for critical systems, such as nuclear plants, passenger transport (planes, autonomous cars), etc.

Self-stabilization, introduced by Dijkstra [START_REF] Edsger | Self-stabilizing systems in spite of distributed control[END_REF], is a more general paradigm, which focuses on the ability to autonomously recover a correct configuration after some faults occur. This paradigm is suitable for transient faults, which happen rarely enough for the system to have enough time to converge between faults. An algorithm is self-stabilizing if, whatever the initial configuration of the system, it returns to a correct behavior in finite time. Several variants of self-stabilization are presented in the literature.

In this thesis, we focus on the space complexity of some distributed problems in the framework of self-stabilization for wireless networks. Small space complexity is desirable for distributed algorithms in general, and especially for wireless distributed systems. We address the question of lower bounds for the space complexity of some problems, an underdeveloped field of research. We consider both anonymous and identified networks, and introduce memory efficient self-stabilizing algorithms in both environments.

In Chapter 2 we detail the computational model used in this thesis. We formally define distributed systems, algorithms, distributed problems, and stabilization hypotheses.

In Chapter 3, we present results from [START_REF] Blin | Optimal space lower bound for deterministic self-stabilizing leader election algorithms[END_REF]. We study the cost of using the presence identifiers in identified networks. Most algorithms requiring unique identifiers use Ω(log n) bits per node, to store and send the identifiers to their neighbors. Recently, algorithms solving problems which require unique identifiers were presented, and only use O(log log n) bits per node. We prove that this complexity is asymptotically optimal, in the sense that under O(log log n) bits per node, algorithms cannot use the presence of unique identifiers in the network, and behave as if the network was anonymous. It is a very general result: it applies to all distributed algorithms, stabilizing or not, in various specific models. We apply this result to obtain lower bounds on the space complexity of actual problems, by establishing a Ω(log log n) lower bound for the Leader Election problem, one of the most studied problems in the field of self-stabilization. Our lower bound is established on one very simple, and widely studied, class of graphs: non-prime rings.

These results have been awarded Best Student Paper at [START_REF] Blin | Optimal space lower bound for deterministic self-stabilizing leader election algorithms[END_REF], and extended abstracts were also presented in [START_REF] Blin | Brief announcement: Memory lower bounds for self-stabilization[END_REF][START_REF] Blin | Borne inférieure optimale pour la complexité spatiale des algorithmes déterministes autostabilisants d'élection[END_REF].

In Chapter 4, we present results from [START_REF] Blin | Silent anonymous snap-stabilizing termination detection[END_REF]. We address one fundamental problem of distributed systems: the Termination Detection problem. We design a snap-stabilizing solution for this problem, with very low requirements on the network. It works in anonymous settings, is adapted to wireless networks, and works on any topology. Furthermore, our solution only requires Θ(log D) bits per node, which is the lowest complexity achieved so far, and had never been achieved by any snap-stabilizing algorithm before. To design our algorithm, we rely on an unspecified unison algorithm. To be so generic, we established a theoretical analysis of properties of unison algorithms, from the specification of Unison problem itself.

A French-language version of these results was also presented in [START_REF] Blin | Détection de terminaison auto-stabilisante silencieuse, anonyme et instantanée[END_REF]. In Chapter 5, we address the problem of fair token circulation. We design a selfstabilizing algorithm which solves this problem on a generic class of graphs, Destination Oriented Acyclic Graphs, and is also adapted to wireless networks. Finally, this solution requires Θ(log log n) bits per node, which is asymptotically optimal, and works under the weaker assumption on the synchrony of the network. This result will soon be submitted to an international conference.

In the last chapter we summarize our contributions, and broaden their scope by opening directions in which our techniques and results might be extended.

In this chapter we introduce the formal framework in which this thesis lies. We introduce the computational model, the communication model, and other objects that are considered all along this thesis.

Preliminaries

In this section we define some mathematical objects and properties that will be useful later.

Relation Let V be a set. A binary relation R on V is a subset of V × V . We write uRv as an equivalent of (u, v) ∈ R. A binary relation is reflexive if ∀v ∈ V, vRv. A binary relation is transitive if ∀u, v, w ∈ V, uRv ∧ vRw ⇒ uRw. The transitive closure of a relation R, denoted R + is the smallest transitive relation which contains R. We have

uR + v ⇐⇒ ∃k > 0, ∃v 0 , . . . , v k : (u = v 0 ∧ v = v k ∧ ∀i ∈ [0, k -1], v i Rv i+1 ).
The reflexive transitive closure of a relation R, denoted R * is the smallest reflexive and transitive relation which contains R. We have

uR * v ⇐⇒ ∃k ≥ 0, ∃v 0 , . . . , v k : (u = v 0 ∧ v = v k ∧ ∀i ∈ [0, k -1], v i Rv i+1 ) ⇐⇒ (uR + v) ∨ (u = v).
A binary relation R is acyclic if ∀u ∈ V, ¬(uR + u). A binary relation R is rooted if ∃r ∈ V :

∀u ∈ V, uR * r. Remark that if a binary relation R is both rooted and acyclic, then there exists one unique r ∈ V : ∀u ∈ V, uR * r. This element r is said the root of R.

are the elements of V . The communication links of the distributed system are represented by the (non-oriented) edges of G, which are the elements of E ⊆ P 2 (V ) (pairs of elements of V ).

There exist works focusing on oriented, or directed, networks. In oriented networks, the communication links are not necessarily symmetric: it might happen that one node can send information to one of its neighbor, without reciprocity. This is modeled by oriented edges, elements of E ⊆ V × V . In this thesis we always consider bi-directional communication links, but sometimes refer to results established in oriented networks.

We call size of G and denote by n the number of nodes in the network. Two nodes u and v are neighbors in G if and only if {u, v} is an edge of G. The set of all the neighbors of v is denoted N v . We also denote by N [v] the set of extended neighbors of v, N [v] = N v ∪ {v}.

Graphs Properties

We call degree of a node v and denote ∆ v the number of neighbors of v. We call degree of G and denote ∆(G), or simply ∆ if no confusion can be made, the maximum degree of the nodes of G.

A path of G is a sequence p = (v 1 , v 2 , . . . , v k ) of nodes of G such that ∀i ∈ [1, k -1], {v i , v i+1 } ∈ E. We call source of p the node v 1 , end of p the node v k , and length of p the number of edges in p, here k -

1. A path p = (v 1 , v 2 , . . . , v k ) of G is elementary if ∀i = j ∈ [1, k], v i = v j .
If the source and the end of a path p are equal, then p is also said a cycle. A cycle c = (v 1 , v 2 , . . . , v k ) is an elementary cycle if the path p = (v 1 , v 2 , . . . , v k-1 ) is elementary.

The distance between two nodes u and v in G is the length of the shortest path of G with source u and end v. We denote by dist(u, v) the distance between u and v. We call diameter of G, and denote D(G), or simply D if no confusion can be made, the maximal distance between two nodes of G.

Local Knowledge

Port Numbering In distributed systems, nodes receive information from several neighbors, each neighbor corresponds to one specific communication link. Although one connected device does not necessarily know which entity is located at the endpoint of each communication link, it can nevertheless distinguish the different communication links from another. Practically, this distinction is made by identifying the port number associated to the communication, the frequency used by the device, etc. We do not suppose any global consistency in the attribution of the port numbers in the network.

In our model, a node v has access to locally unique port numbers associated with its adjacent edges. We denote by port v (u) the port number associated by v to the edge leading to its neighbor u. Typically, port v (u) is an integer in [1, ∆ v ].

Identifiers, Semi-Uniform

In some distributed networks, devices come with a globally unique identifier, which can be a MAC address, an IP address, etc. This unicity can be useful to solve problems that require symmetry breaking, for example. Due to NATing, or to false MAC-addresses, it might happen that some, but few, devices share the same identifier. In most cases, this homonymy does not cause any problem, but in some situations, this can lead to, sometimes unsolvable, issues.

Although most distributed systems are based on devices with unique identifiers, several reasons justify the interest to design distributed algorithms that do not require such identifiers. For privacy reasons, it might be crucial to design algorithms that are not based on sharing unique identifiers in the entire network. Furthermore, for this precise reason, there exist actual networks where identifiers do exist, but do not have any consistency through time due to the use of VPN for example.

Independently of the presence of identifiers, there sometime exists one particular device in the network that has a specific role. This specific device can be the DHCP server, for a local network, or a master DNS, in one DNS zone. Some problems are easier to address if the network has a distinguished device, that can perform tasks that the other devices cannot.

A network G is identified if ∀v ∈ V , v has a local constant, its identifier, denoted by ID v , such that ∀u = v ∈ V, ID u = ID v . For all k ∈ N * , G is k-homonymous if ∀v ∈ V , v has a local constant, its identifier, denoted by ID v , and such that at least k nodes have the same identifier. Remark that according to this definition, any k-homonymous network is also k -homonymous, for any k ≤ k. A network G is anonymous if all nodes have the same identifier or, equivalently, if there is no identifier at all. Remark that anonymous networks may be seen as n-homonymous networks.

Given a graph G, an integer k ∈ N * , and a set of identifiers S ID , we use the following notations:

• G 0 [S ID ] represents any identified network with topology G and with unique identifiers taken in S ID .

• G k [S ID ] represents any k-homonymous network with topology G and with identifiers taken in S ID

• G n [ID] represents the anonymous network with topology G in which all nodes have identifier ID.

A network is semi-uniform if ∀v ∈ V , v has a local constant distinguish v such that ∃w ∈ V : distinguish w = 1 and ∀u = w, distinguish u = 0. Otherwise, the network is uniform.

Knowledge about the Topology of the System

Depending on the distributed system, some global characteristics (and especially its size, diameter, and degree) can be persistent through time. Although this does not apply to mobile networks, for example, this can be a relevant hypothesis for sensor networks, which contain devices that are not meant to be moved. In such situations, the knowledge of the values of those parameters can be helpful to efficiently solve tasks in the system. Depending on the application, the exact value of the parameter is not always necessary: an approximation or an upper bound can be sufficient. For example, an upper bound on the diameter of the network is enough to guarantee the propagation of information through the entire network.

In some cases, the nodes of the network have a local constant that stores n, ∆, D, or a combination of those parameters. In such case, the parameter is said given. If only an upper bound or an approximation of the value is given to the nodes, then the parameter is said approximated.

Common Topologies

In the general case, distributed systems have very diverse topologies. Thus, we aim to design distributed algorithms which behave correctly on any topology. If no precision is made, saying that a distributed algorithm completes a certain task means that it completes this task on all topologies.

Yet, it might be interesting to reason on specific, simpler topologies for at least two reasons. The first one is that some distributed systems actually respect some specific topologies, and it might be possible to find more efficient algorithms by supposing some specific topology. The other reason is that some problems can be difficult to address in the first place, and working on a simpler case can be an option to find a way to a generic solution.

We call topology a class of all the networks that respect a particular property. Here we give some common topologies that will be used in our thesis. We present examples of graph for each topology in Figure 2.1.

• G is a ring if there exists an elementary cycle of length n in G. Rings are a typical example of a tool-topology. Although it is one very simple topology, numerous problems of distributed computing (the presence of cycles, symmetric configurations) can be tackled in this simple topology at first.

• G is a tree if there is no elementary cycle in G.

Trees are both a simple topology, suited to first address some problems, and a realworld topology. Indeed, minimizing the number of communication links in distributed systems is pretty useful to reduce the number of messages exchanged, to avoid conflicts. . .

• G is a star if there exists one node r such that all the other nodes have only r as a neighbor.

Stars are a particular case of trees, which corresponds to highly centralized networks.

• G is a complete graph if there exists an edge between any pair of nodes.

• We also consider Directed Acyclic Graphs (DAG) and Destination Oriented Directed Acyclic Graph (DODAG), which are both particular cases of oriented graphs. Recall that we consider non-oriented networks, in the sense that the communication is always bi-directional. The orientation we are talking about is therefore more a hierarchy relation between neighbors than an orientation of the communication links. In practice, devices have a local table that allows them to know whether one specific neighbor is a parent or a child of theirs in the network. Similarly, we rely on port numbers to grant an orientation to the network.

Suppose that the space of port numbers can be split into two disjoint sets port + and port -. Let us denote by u → v the relation port u (v) ∈ port + .

G is a Directed Acyclic Graph (DAG) if the relation → is acyclic. Note that this implies:

port u (v) ∈ port + ⇐⇒ port v (u) ∈ port -.
DAGs corresponds to hierarchical distributed systems, where devices have initiators, and followers.

G is a Destination Oriented Directed Acyclic Graph (DODAG, or D o ) if the relation → is acyclic and rooted. We call root of the D o the root of the relation →.

DODAGs are DAGs with only exactly one node that has no ancestor, which is a common ancestor of all the other nodes. It corresponds to centralized, hierarchical networks, such as DNSs networks.

Figure 2.1: Common topologies, from left to right starting from the first row: complete graph, ring, star, tree, DAG, DODAD

Communication Model, Algorithm

Memory

During the execution of a distributed algorithm, the devices of the system exchange information through the communication links. Every time one device receives some information, it can update its variables, depending on its personal information, and on the one it received.

After that, the device can send an updated information to its neighbors, that depends on its new state and on other local information. Thus, a device possesses two distinct types of information. The information that is inherent to its material, persistent, and the information it received from the other devices of the system, that is meant to be updated, and transmitted.

In our model, nodes have two types of memory: the immutable memory and the mutable memory. The immutable memory is not corruptible, and cannot be updated by the node itself. It typically contains the code of the algorithm, the identifier of the node, its port numbers, and constant distinguish. The mutable memory, also called register, is corruptible, and can be updated by the node itself. It typically contains the variables of the algorithm that is executed in the network.

The set of all variables in the registers of node v is called the state of v, and is denoted state v . We also denote by local v the set of all local constants of node v, stored in its immutable memory: its identifier, port numbers, distinguish. . . We call a configuration of G the set of all the states of the nodes of V . Configurations are denoted by the letter γ. We also denote by Γ the set of all possible configurations of G. The value of variable var on node v in configuration γ is denoted var γ v .

We call execution, and denote by the letter , any non-empty sequence of configurations: = γ 0 → γ 1 → • • • .

Communication

State Model The communication between the devices of a distributed system highly depends on the material, of the network, and can be studied at each layer of the OSI model (ADSL/Bluetooth, Wi-Fi/Ethernet, IPv4/IPv6, TCP/UDP, etc). For the sake of genericity, we model communication between nodes by abstracting the sending of messages.

We consider the state model, denoted S, introduced by Dijkstra [START_REF] Edsger | Self-stabilizing systems in spite of distributed control[END_REF]. In the state model, each node v has read/write access to its register, and has a read-only access to the registers of its neighbors. Thus, to transmit information to its neighbors, a node simply writes that information in its mutable memory.

Knowledge of the Port Numbers

In wired distributed systems, the communication between neighbors is made through physical links, each link connecting exactly two devices. In such systems, one node can naturally send different information to its neighbors. On the other hand, in wireless networks, such as sensor networks or Wi-Fi antennas, communication is multidirectional: any information emitted by one device is identically received by all of its neighbors. In such networks, it can be pretty difficult to send information to one, and only one, neighbor.

In our model, the different communication links are identified by port numbers. To embrace that diversity in the capacity to communicate, two variants of the state model are studied in the literature: the port-known state model and the port-unknown state model.

In the port-known state model, denoted S PK , nodes know the port number it is assigned by its different neighbors. Namely, v has a table that contains the value port u (v) for each of its neighbors u. Thus, if one neighbor u of v wants to send information to one of its neighbors, it can prefix this information with the port number it assigned to that neighbor. Since all of its neighbors know their assigned port number, they can decide whether the information is intended to them or not. The model S PK corresponds to wired distributed systems.

In the port-unknown state model, denoted S PU , nodes do not have any knowledge a priori on which port number they were assigned by their different neighbors. This makes it non-trivial to send information to one specific neighbor. If necessary, then this difficulty must be overcome by the algorithm. The model S PU corresponds to wireless distributed systems.

The positive results and algorithms presented in Chapters 4 and 5 are all valid in the most challenging model: the port-unknown state model S PU . The negative results (lower bound and impossibility results), presented in Chapter 3 are all valid in the least challenging model: the port-known state model S PK .

In Chapter 5, the problem we address requires that nodes communicate information to exactly one of their neighbors. Let us give an idea on how this difficulty might be overcome. If the network is identified, then sending information to one neighbor can be done by prefixing the information by the identifier of the designated neighbor. This requires that each node permanently writes its identifier in its mutable memory, so that its neighbors have access to it (recall that the local constants of v, such as ID v , are not readable by the neighbors of v). This technique has one flaw: it has a non-negligible cost in terms of memory used, since storing the identifier in the mutable memory requires at least O(log n) bits on each node. In Chapter 5 we exponentially reduce the size of the memory.

Note that in anonymous networks, sending information to one specific neighbor is generally unfeasible in S PU .

Deterministic Algorithm

Rules A distributed algorithm consists of a set of rules of the following form: < label > : < guard > → < action > where • < label > is the name of the rule,

• < guard > is a predicate that involves the variables of the node and of its neighbors, and the local constants of the node (its identifier, port numbers...),

• < action > is a set of deterministic instructions that modify the state of the node.

If at least one action involves randomization, then the algorithm is said non-deterministic, or randomized. In this work, we only consider deterministic algorithms.

We denote by R A the set of the rules of A. If the guard of a rule is evaluated to true on node v, then this rule is said enabled on v. An action can be executed by node v only if the rule in which it appears is enabled. A node is enabled if one of its rules is enabled, and is disabled otherwise. We denote by A e (γ) the set of the enabled nodes in γ.

A configuration γ is terminal if no node is enabled in γ, i.e. if A e (γ) = ∅.
Network-Specificities of Algorithms If at least one rule of an algorithm A refers to the local constant distinguish, then it is designed to be efficient on semi-uniform networks. Algorithm A is said semi-uniform. Otherwise, it is said uniform. If no rule of an algorithm A refers to the local identifier of the node, then it is designed to be efficient on anonymous networks. Algorithm A is said anonymous. Otherwise, it is said ID-based.

Computation When activated, an enabled node v atomically executes the three following actions.

• It reads the state of all of its neighbors u ∈ N v • It executes the action of one of the rules it is enabled, according to the state of its neighbors, its own state, and its local constants.

• It writes in its mutable memory its new state.

If several nodes are activated at the same moment, they all atomically execute those three actions.

Permanent Communication

As defined above, it might seem that nodes read the state of their neighbors only when activated. This is actually misleading. In a distributed system, the devices constantly exchange information, in order to detect any update, any breaking in the system. In our model, this is true as well, but hidden by the notion of enabled nodes.

A node is activated only if it enabled, which depends on the state of its neighbors. Thus, to be able to know whether it is enabled or not, a node necessarily has to constantly read the state of its neighbors, and evaluate all the guards of its rules with the updated information it read.

Scheduler

Asynchrony

Although devices constantly exchange information, there is no guarantee that all the nodes compute and communicate at the same speed. Most certainly, some devices are more reactive than others, some communication links are more congested than others, etc. Thus, it would be a huge simplification supposing that enabled nodes are immediately activated: distributed systems are inherently asynchronous. This asynchrony is modeled by the existence of an adversary, called daemon or scheduler. At each step, the scheduler selects a subset of the enabled nodes, and activates all of them. Each activated node updates its state according to the action of one of its enabled rules. If several rules are enabled on the same activated node, then it non-deterministically pick one of them.

Formally, a schedule is a map D that takes as input a non-empty sequence of configurations (γ 0 , γ 1 , . . . , γ k ) and a subset of the nodes of the graph V e ⊆ V , which represents the set of enabled nodes.

D(γ 0 , γ 1 , . . . , γ k , V e ) = ∅ if and only if V e = ∅. If V e = ∅, then D(γ 0 , γ 1 , . . . , γ k , V e ) is a non-empty subset of V e .
Let us denote by γ -→ A γ a computing step of algorithm A, where γ is obtained from γ after the activation of one or several enabled nodes and the simultaneous execution of their action.

Given a schedule D, an execution

of A under D, is a finite or infinite execution = γ 0 -→ A γ 1 -→ A • • • such that ∀i, the set of activated nodes between γ i and γ i+1 is D(γ 0 , γ 1 , . . . , γ i , A e (γ i )). An execution is maximal if it is infinite, or if it is finite and the last configuration of is terminal. If = γ 0 -→ A γ 1 -→ A • • • is an execution, then ∀i ≥ 0, = γ i -→ A γ i+1 -→ A • • • is a
sub execution of . A sub execution can be both finite or infinite. The first configuration of an execution, γ 0 , is called the initial configuration.

Schedules and Schedulers

In practice, we don't know the precise schedule that will determine the execution of our algorithm. Furthermore, it would be very restrictive to design an algorithm for one particular schedule. What we actually do is suppose that the execution respects some properties of fairness, for example. We call scheduler a class of schedules which all share common properties. Since we do not use in practice the notion of schedule, we also denote by D the schedulers. Saying that an algorithm A respects some property on a certain scheduler D means that it respects that property on every schedule of D.

Common Schedulers

Dubois and al. in [START_REF] Dubois | A taxonomy of daemons in selfstabilization[END_REF] presented a vast overview of schedulers. In this section, we only present the schedulers that are invoked in this thesis. Let us consider a schedule D and a infinite sequence of configurations γ 0 , γ 1 , . . . .

• The schedule D is strongly fair if the following is true for any sequence of configurations γ 0 , γ 1 , • • • , for any i ≥ 0 and for any node v ∈ V : if v is enabled in an infinite number of configurations γ j with j ≥ i then v is eventually activated by D. More formally, if there exists an infinite number of sets V j v with j ≥ i, then there exists

k ≥ i : v ∈ D(γ 0 , γ 1 , . . . , γ k , V k ).
• The schedule D is weakly fair if the following is true for any sequence of configurations γ 0 , γ 1 , • • • , for any i ≥ 0 and for any node v ∈ V : if v is enabled in all the configurations γ i , γ i+1 , . . . , then v is eventually activated by D. More formally, if ∀j ≥ i, v ∈ V j , then there exists

k ≥ i : v ∈ D(γ 0 , γ 1 , . . . , γ k , V k ).
• The schedule D is central if it activates only one of the enabled nodes at each computing step. In other words, if for any i ≥ 0, for any

V e ⊆ V , |D(γ 0 , γ 1 , . . . , γ i , V e )| ≤ 1.
• The schedule D is synchronous if it activates all the enabled nodes at each computing step. Remark the there exists exactly one synchronous schedule, and that it is strongly fair.

Remark that if D is strongly fair, then it is also weakly fair. By commodity, we say that all schedules are unfair. By commodity, we also say that all schedules are distributed, by opposition to central schedules.

Those properties of schedules directly transfer to schedulers. For example, we can consider the central strongly fair scheduler, which contains all the schedules that are both central and strongly fair.

Relation Between Schedulers

A scheduler D 1 is stronger (resp. weaker) than a scheduler

D 2 if D 1 can simulate D 2 (resp. if D 1 can be simulated by D 2 ). More formally, if D 1 ⊇ D 2 (resp. if D 1 ⊆ D 2 ).
Intuitively, the more possible executions there are, the stronger the adversary.

Note that not all schedulers can be compared. For example, the synchronous scheduler and the central scheduler, both weaker than the distributed scheduler, cannot be compared with each other.

Problems Specification

Specification

Let R and Q be two boolean predicates over configurations. We note γ ∈ R when R is evaluated to true in γ, and γ / ∈ R otherwise. We denote by true the predicate that always evaluates to true. Given an algorithm A, the predicate R is closed for A if for every computing step γ -→

A γ , such that γ ∈ R, then γ ∈ R. Algorithm A converges to predicate Q from predicate R under the scheduler D if Q is closed and if for any execution = (γ 0 -→ A γ 1 -→ A • • • ) under D such that γ 0 ∈ R, there exists i ≥ 0 such that γ i ∈ Q. This is noted R AD Q. If no confusion can be made, we simply write R A Q or even R Q. We say that R is an attractor if true R.
When it is clear in the context, we indifferently use a predicate and the set of configurations it describes. For example, we can write Γ instead of true.

The specification SP P of a problem P is a predicate over the executions and the network, which describes a specific behavior of the system. An algorithm A solves a problem P under a certain scheduler if every execution of A under that scheduler satisfies the specification of P .

The specification of a problem might be described through the use of local predicates. Intuitively, a local predicate is a boolean function evaluated by one node, with the same information as when the node evaluates the code of the algorithm: its own local constants, its own state, and the states of its neighbors.

Definition 2.1 (Local Predicate)

We call local predicate any boolean predicate which takes as inputs a set of local constants, and a set of one or several states of nodes.

If P is a local predicate and v ∈ V , we denote

P γ (v) = P (local v , state γ N [v] ).

Examples of Problems

We shortly present some common problems, and especially those that are studied in this thesis.

• The Leader Election problem, denoted LE, is a fundamental problem that consists in determining one single, elected, node in the network. Solving this problem is basically making semi-uniform a uniform network, and simplify dealing with the issues related to concurrency, by allowing only one node to make critical decisions. We specifically address LE in Chapter 3.

• The Spanning Tree Construction problem, denoted ST , consists in building a spanning tree structure in the network. Having a spanning tree structure in the network is particularly useful for minimizing the number of exchanged messages when propagating information in the whole network.

• The Vertex Coloring problem, or simply Coloring problem, denoted ∆ -C, consists in associating to each node a color, usually an integer between 1 and ∆, such that no two neighbors have the same color. Coloring a graph is a suitable tool to simulate S PK in S PU with an additional cost of Ω(∆) bits of memory per node. Indeed, nodes of a vertex-colored network can address information to one of their neighbors by prefixing the message by the color of the intended neighbor. Coloring a network also captures a local mutual exclusion problem, which corresponds to situations where neighbors share a resource or a service which cannot be used by several devices at a time, to the allocation of frequency bands for WiFi antennas. . .

• The Maximal Independent Set problem, denoted MIS, consists in selecting a subset of all the nodes, such that no two neighbors are selected, and such that the obtained subset is maximal: all the nodes that are not selected have at least one neighbor which is. A maximal independent set is a structure that is notably adapted to timevarying graphs, since it is relatively simple to maintain, and offers a lite but complete coverage.

• The Unison problem, denoted U, requires the presence of a variable clock on each node, and consists in increasing all of these variables infinitely often, while maintaining each pairs of neighboring clocks with a difference at most one. Unison guarantees a minimal form of synchrony in an asynchronous network. Notably, a correct unison guarantees that even under an unfair scheduler, all nodes are regularly activated. We specifically address U in Chapter 4 and especially in Section 4.3.

• The Termination Detection problem, denoted T D, consists in detecting when another algorithm executed on the same network has converged. In numerous situations, network protocols are built as a pile of interacting algorithms. If one of the layers is critical, then it might be necessary to be able to guarantee that the service it provides is actually satisfied before using it. This problem boils down to checking whether the algorithm of the critical layer has terminated. We specifically address T D in Chapter 4.

• The Token Circulation problem (or Fair Token Circulation problem), denoted T C, is a fundamental problem that consists in guaranteeing that a unique token travels the network perpetually, visiting every node repeatedly. This problem models the objective of perpetually and fairly allocating a resource or a service to the devices of a distributed system, while insuring global mutual-exclusion. We specifically address T C in Chapter 5.

Classes of Problems

Terminating and Non-Terminating Problems Some problems such as T C, or U, require a perpetual execution of the algorithm. In particular, no finite execution can satisfy the specification of such problems. Those problems are said non-terminating.

On the contrary, there are problems, such as LE, ST , or MIS which only aim to provide the network a particular configuration. For those problems, the specification is of the form SP P ( ) ≡ ∀γ ∈ , P (γ), where P is a predicate over the configurations and the network. Those problems are said terminating. Note that some algorithms may require infinite executions to solve terminating problems.

Request/Answer Problems Some problems, such as T D, depend on an external activation, a request. When the request is made, then the algorithm starts an execution, which ends when an answer is emitted, as a response to the request. Those problems generally suppose that one variable of the algorithm is shared by another application. This variable is dedicated to the communication of the request and the answer between the two algorithms. Such problems are called request/answer problems, or request-based problems.

Stabilization

Distributed systems are prone to transient faults. Most commonly, some messages can be lost, or corrupted. If such a failure occurs, the system may reach an incorrect configuration. Therefore, algorithms designed to perform in such environments must be fault-tolerant. Several paradigms were introduced in the literature to capture that notion. We only present the variants that we use in this work.

Distributed Algorithms Some distributed algorithms are not effective in faulty environments. Namely, they suppose that the initial configuration of the system is non faulty, typically that the variables of the nodes are properly initiated to a blank value. Such algorithms converge from this initial configuration, but not necessarily from a faulty, inconsistent configuration. Those algorithms, with no fault-recovering properties, are simply called distributed algorithms. In this thesis, we only consider algorithms which can handle faults, but we sometime compare ourselves to the simpler case of distributed algorithms.

Silent Self-stabilization There exist problems, such as the leader election or the spanning tree construction, for which the specification tolerates constant executions. Indeed, as soon as one single leader is elected, there is no a priori need to keep computing. An algorithm A is silent [START_REF] Dolev | Memory requirements for silent stabilization[END_REF] for problem P under scheduler D if every maximal execution of A is finite. Silent self-stabilization is a paradigm particularly adapted to terminating problems.

Definition 2.2 (Silent)

A distributed algorithm A is silent if all the maximal executions of A are finite.

Self-stabilization

For most situations, the concept of self-stabilization introduced by Dijkstra [Dij74] is a suitable paradigm. An algorithm A is self-stabilizing for one problem P under scheduler D if there exists a predicate R such that Γ AD R and such that any execution of A under D starting from a configuration γ ∈ R satisfies SP P . In other words, a self-stabilizing algorithm converges to a legitimate execution whatever the initial configuration of the system. Self-stabilization is a paradigm suited to distributed systems prone to relatively rare transient failures.

Definition 2.3 (Self-stabilization)

Algorithm A is a self-stabilizing algorithm for problem P under a certain scheduler D if there exists a predicate R such that Γ AD R and such that any execution of A starting from a configuration γ ∈ R satisfies SP P . An execution of A has stabilized once R is valid. The stabilization time of A is the maximal number of rounds in executions of A starting from any configuration, before A stabilized.

Snap-stabilization

Although self-stabilization is a suitable paradigm in most situations, there exist problems for which this condition is not sufficient. If we consider problems that depend on an output, typically observation problems, then self-stabilization is not adapted. Indeed, self-stabilization ensures that execution ultimately converges to one predicate R from which executions are correct. Yet, nothing guarantees that no incorrect output is provided before the convergence to R. Such incorrect outputs might be detrimental to the system, which makes self-stabilization non-suitable in this situation. An algorithm A is snap-stabilizing [START_REF] Bui | Snapstabilization and PIF in tree networks[END_REF] for one problem P under scheduler D if any execution of A under D satisfies SP P . In other words, if as soon as there are no more faults, then the system immediately behaves correctly. Snap-stabilization is a paradigm especially suitable for request-based problems.

Definition 2.4 (Snap-Stabilization)

A distributed algorithm A is snap-stabilizing for a specification SP if any maximal execution of A starting from any configuration satisfies SP .

Efficiency of an Algorithm

We have already seen above that numerous criteria can be studied to discuss the genericity of an algorithm. Those criteria are the presence of (unique or not) identifiers, the uniformity of the network, the (precise or bounded) knowledge of some parameters of the network (size, degree, diameter. . . ), the topologies on which the algorithm works (rings, trees, all graphs. . . ), the knowledge of nodes of the port number affected to them by their neighbors (S PU or S PK ), the determinism of the algorithm, the hypothesis made on the scheduler (fairness, centrality. . . ), and the capacity to handle transient faults.

In addition to those criteria, the complexity of the execution of an algorithm is one other crucial parameter to take into account. Algorithms executed on a central system are evaluated based on two criteria: the memory required and the convergence time. Algorithms executed on distributed systems are also evaluated on these criteria.

In most cases, the limiting parameters do not come from the computing units, but from the communication links of the network, bandwidth, latency, etc. Thus, the relevant quantities of a distributed algorithm are not the complexity of the algorithm on one node, but the global complexity of the execution of the algorithm in the network. Although this does not bring much trouble when examining the spatial complexity, it requires some nuance when we come to time complexity. Spatial and time complexities are expressed as functions, whose parameters are parameters of the network. The most common parameters of complexity functions are the size, diameter, and degree of the network (n, D, and ∆).

Comparison Functions

What is interesting when studying spatial and time complexities is their asymptotic behavior. To express this, we use the following standard notations:

f (x) ∈ o(g(x)) ⇐⇒ lim x→∞ f (x) g(x) = 0 f (x) ∈ O(g(x)) ⇐⇒ lim x→∞ f (x) g(x) = ∞ f (x) ∈ Ω(g(x)) ⇐⇒ lim x→∞ f (x) g(x) = 0 ⇐⇒ ¬ f (x) ∈ o(g(x)) f (x) ∈ ω(g(x)) ⇐⇒ lim x→∞ f (x) g(x) = ∞ ⇐⇒ ¬ f (x) ∈ O(g(x)) f (x) ∈ Θ(g(x)) ⇐⇒ 0 < lim x→∞ f (x) g(x) < ∞ ⇐⇒ f (x) ∈ O(g(x)) ∧ f (x) ∈ Ω(g(x))

Spatial Complexity

The relevant quantity for the spatial efficiency of an algorithm executed on a distributed system is the size of the messages necessary to complete the task. In the state model, the messages are abstracted by the ability for nodes to directly read the mutable memory of their neighbors. Thus, the size unit of the messages which are exchanged on the network is the size of the mutable memory the algorithm requires, on each node. Note that the identifier of the node is part of the immutable memory, and thus its size is not taken into account in spatial complexity, unless the algorithm explicitly writes it into the mutable memory to share it with the neighborhood.

We call spatial complexity of an algorithm A, and denote S A , the number of bits of mutable memory required by A on each node.

Time Complexity

To estimate the time efficiency of a distributed algorithm, focusing on the time complexity of the execution of one action on one node is not relevant for two reasons. The first one is that this time is most often negligible when compared to the communication time between the devices of the system. The second is that what takes time in the execution of a distributed algorithm is the number of communications necessary for the convergence of the system. We define the time complexity of an algorithm A, denoted T A , as the number of time units it requires before resolving the problem. Time Units Due to asynchrony, some nodes whose action is necessary for the algorithm, can be inactivated during a long time, and block the execution of the algorithm. To embrace such situations, there are two definitions of what a time unit is.

The notion of step corresponds to the number of separated activation of nodes by the scheduler: the number of computing steps.

On the other hand, the notion of round [START_REF] Bui | Snapstabilization and PIF in tree networks[END_REF] captures the execution rate of the slowest processor. Let us state this more formally. A node v is neutralized in the computing step γ -→ A γ if v is enabled in γ and not enabled in γ , but does not execute any action between these two configurations. Neutralization occurs when some neighbors of v changed their state between γ and γ , and this change makes the guards of all actions of v false. Let be an execution.

The first round of an execution , noted , is the minimal prefix of in which every node that is enabled in the initial configuration either executes an action or becomes neutralized. Let be the suffix of starting from the last configuration of . The second round of is the first round of , and so forth.

Time of Resolution

The notion of resolving a problem depends on the stabilization paradigm considered.

If we consider self-stabilization, then the resolution corresponds to the convergence of the algorithm: the moment where the specification of the problem is satisfied. We call this quantity the time of convergence.

If we consider silent self-stabilization, then the resolution corresponds to the termination of the system: when it reaches a terminal configuration. We call this quantity the time of termination.

Snap-stabilizing algorithms are, by definition, self-stabilizing algorithms whose time of convergence is 0, which makes this quantity non-relevant. In most cases, snap-stabilizing algorithms are designed to solve request/answer problems. In such situations, a suitable parameter is the time of response, which is the number of time units between the moment a request is made, and the moment the algorithm answers to this request. This notion can be refined depending on the problem considered. In this chapter, we introduce a generic O(log log n) lower bound for the space complexity of distributed, deterministic algorithms, and especially for the leader election problem.

A preliminary version of these works was presented in [START_REF] Blin | Optimal space lower bound for deterministic self-stabilizing leader election algorithms[END_REF].

Introduction

It is known that the presence of unique identifiers at the nodes of a network is very helpful, and sometimes necessary, to break symmetric configurations. Some fundamental problems, such as Leader Election or Spanning Tree Construction, are known to be unsolvable by deterministic algorithms in generic anonymous networks [START_REF] Angluin | local and global properties in networks of processors[END_REF][START_REF] Edsger | Self-Stabilization in Spite of Distributed Control[END_REF]. On the other hand, numerous distributed, deterministic, self-stabilizing algorithms exist for those problems in identified networks [BGJ99, DGS99, DLV11a, DLV11b, BT18]. Although it is known that identifiers are required to solve such problems, the question of how compact the use of those identifiers can be made remains. Most algorithms for identified networks are such that nodes directly share their identifier with their neighbors by writing it into their mutable memory, and thus have a spatial complexity in Ω(log n) bits per node. Recently, a self-stabilizing algorithm was presented to address Leader Election, which requires only O(log log n+log ∆) bits per node [START_REF] Blin | Compact self-stabilizing leader election for general networks[END_REF]. This indicates that O(log log n + log ∆) bits per node are sufficient to use the identifiers. On the other hand, it is known that Leader Election cannot be solved with constant space complexity [START_REF] Beauquier | Memory space requirements for self-stabilizing leader election protocols[END_REF]. This indicates that one cannot fully use the power proper to identified networks with O(1) bits per node. However, the question of how many memory is necessary for algorithms to use the identifiers was still open. We prove a Ω(log log n) bits per node lower bound for that problem. More precisely, on identified, bounded-degree graphs, algorithms that use o(log log n) bits of memory per nodes behave exactly the same way as if they were executed on anonymous networks. Since a large variety of problems, and especially Leader Election, are unsolvable in bounded-degree anonymous networks, we can conclude a Ω(log log n) bits per node lower bound for Leader Election.

Motivation

During the execution of a self-stabilizing algorithm, the nodes exchange information along the links of the network, and this information is stored locally at every node. Specifically, processes in a distributed system have two types of memory: the persistent memory, and the mutable memory. The persistent memory is used to store the identity of the process (e.g., its IP address), its port numbers, and the code of the algorithm executed on the process. Importantly, this section of the memory is not write enabled during the execution of the algorithm. As a consequence it is less likely to be corruptible, and most work in selfstabilization assumes that this part of the memory is not subject to failures. The mutable memory is used to store the variables used by the algorithm, and is subject to failures, that is, to the corruption of these variables. The space complexity of a self-stabilizing algorithm is the total size of all the variables used by the algorithm.

Preserving small space complexity is very much desirable, for several reasons. First, it is expected that self-stabilizing algorithms offer some form of universality, in the sense that they are executable on several types of networks. Networks of sensors as used in IoT, as well as networks of robots as used in swarm robotics, have the property to involve nodes with limited memory capacity, and distributed algorithms of large space complexity may not be executable on these types of networks. Second, a small space complexity is the guarantee to consume a small bandwidth when nodes exchange information, thus reducing the overhead due to link congestion [START_REF] Adamek | Evaluating practical tolerance properties of stabilizing programs through simulation: The case of propagation of information with feedback[END_REF]. In fact, a self-stabilizing algorithm is never terminating, in the sense that it keeps running in the background in case a failure occurs, for helping the system to return to a correct configuration. Therefore, nodes may be perpetually exchanging information, even after stabilization, and even when no faults occur. Limiting the amount exchanged information, and thus, in particular, the size of the variables, is therefore of the utmost importance for optimizing time, and even energy. Last but not least, increasing robustness against variable corruption can be achieved by data replication [START_REF] Herman | Error-detecting codes and faultcontaining self-stabilization[END_REF]. This is, however, doable only if the variables are reasonably small. Said otherwise, for a given memory capacity, the smaller the space complexity the larger the robustness thanks to data replication.

Related Work

Space complexity of self-stabilizing algorithms has been extensively studied for silent algorithms, that is, algorithms that guarantee that the content of the variables of every node does not change once the algorithm has reached a correct configuration. For silent algorithms, Dolev and al. [START_REF] Dolev | Memory requirements for silent stabilization[END_REF], proved that finding the centers of a graph, electing a leader, and constructing a spanning tree require registers of Ω(log n) bits per node. Silent algorithms have later been related to a concept known as proof-labeling scheme (PLS) [START_REF] Korman | Proof labeling schemes[END_REF]. Any lower bound on the size of the proofs in a PLS for a predicate P on graphs implies a lower bound on the size of the registers for silent self-stabilizing algorithms solving P . A typical example is the Ω(log 2 n)-bit lower bound on the size of any PLS for minimumweight spanning trees (MST) [START_REF] Korman | Distributed verification of minimum spanning trees[END_REF] , which implies the same bound for constructing an MST in a silent self-stabilizing manner [START_REF] Blin | Space-optimal time-efficient silent selfstabilizing constructions of constrained spanning trees[END_REF]. Thanks to the tight connection between silent self-stabilizing algorithms and proof-labeling schemes, the space complexity of a vast collection of problems is known, for silent algorithms. (See [START_REF] Feuilloley | Survey of distributed decision[END_REF] for more information on proof-labeling schemes.)

On the other hand, to our knowledge, the only lower bound on the space complexity for general self-stabilizing algorithms (without the requirement of being silent) that corresponds to our setting has been established by Beauquier, Gradinariu and Johnen [START_REF] Beauquier | Memory space requirements for self-stabilizing leader election protocols[END_REF] who proved that registers of constant size are not sufficient for leader election algorithms. Interestingly, the same paper also contains several other space complexity lower bounds for models different from ours -e.g., anonymous networks, or harsher forms of asynchrony. Although there are very few lower bounds for the model we consider, there exist several impossibility results for specific topologies. In the case of anonymous networks, where nodes do not have a unique identifier, Angluin [START_REF] Angluin | local and global properties in networks of processors[END_REF] proved that there does not exist any self-stabilizing algorithm for strict leader election (i.e. such that there is never more than one leader), even under a central scheduler and even allowing randomization, due to the general impossibility to break symmetry in such networks. Later, Dijkstra [START_REF] Edsger | Self-Stabilization in Spite of Distributed Control[END_REF] proved that there does not exist any self-stabilizing algorithm for leader election on the anonymous ring, unless the size of the ring is a prime number. A slightly more powerful model than anonymous networks is homonymous networks, where identifiers may be shared by several nodes. In [FKK + 04], the authors investigate the problem on solving leader election on homonymous rings. They prove that leader election is feasible if and only if there is no non-trivial symmetry in the distribution of the identifiers around the ring. In [START_REF] Delporte-Gallet | Leader election in rings with homonyms[END_REF] the authors propose a necessary and sufficient condition on the number of distinct labels in bidirectional homonymous rings to solve terminating leader election. They show that there is a solution if and only if the number of distinct identifiers is greater than the highest divisor of n. Later, [ADD + 20] generalizes the previous by establishing impossibility results for leader election in some unidirectional homonymous rings. Note that the impossibility results of [START_REF] Delporte-Gallet | Leader election in rings with homonyms[END_REF] and [ADD + 20] are established for general distributed algorithms, without any self-stabilization requirements.

The literature dealing with upper bounds is far richer. In particular, [START_REF] Blin | Compact deterministic self-stabilizing leader election on a ring: the exponential advantage of being talkative[END_REF] recently presented a self-stabilizing leader election algorithm using registers of O(log log n) bits per node in n-node rings. This algorithm was later generalized to networks with maximum degree ∆, using registers of O(log log n + log ∆) bits per node [START_REF] Blin | Compact self-stabilizing leader election for general networks[END_REF]. It is worth noticing that spanning tree construction and (∆ + 1)-coloring have the same space complexity O(log log n + log ∆) bits per node [START_REF] Blin | Compact self-stabilizing leader election for general networks[END_REF]. Prior to these works, the best upper bound was a space complexity O(log n) bits per node [START_REF] Blin | Compact deterministic self-stabilizing leader election on a ring: the exponential advantage of being talkative[END_REF], and it has then been conjectured that, by some iteration of the technique enabling to reduce the space complexity from O(log n) bits per node to O(log log n) bits per node, one could go all the way down to a space complexity of O(log * n) bits per node. Arguments in favor of this conjecture were that such successive exponential improvements have been observed several times in distributed computing. A prominent example is the time complexity of minimum spanning tree construction in the congested clique model [LPPP05, HPP + 15, GP16, JN18]. Complexities O(log * n) are not unknown in the self-stabilizing framework [START_REF] Awerbuch | Memory-efficient and self-stabilizing network RESET[END_REF], and it seemed at first that the technique in [START_REF] Dolev | Memory requirements for silent stabilization[END_REF] could indeed be iterated (in a similar fashion as in [START_REF] Boczkowski | Minimizing message size in stochastic communication patterns: Fast self-stabilizing protocols with 3 bits[END_REF]). Our result shows that this is not the case, and somewhat closes the question of the space complexity of leader election.

Contributions

In this chapter, we establish several lower bounds of Ω(log log n) bits per node for the space complexity of deterministic distributed algorithms that require unique identifiers. Namely, we establish a link between executions of algorithms in identified networks, and executions of algorithms in weaker types of networks.

We first show that, as soon as identifiers are taken in a polynomial range [1, n c ], with c ∈ R, c > 1, then algorithms that use o(log log n) bits per node are not more powerful than anonymous algorithms. More precisely, let A be an algorithm in a network with unique node identifiers, and let us assume that A has space complexity o(log log n) bits per node. We show that there exist graphs and assignments of identifiers to the nodes of these graphs such that, in these graphs and for these identifier-assignments, A has the same behavior as an algorithm executed in these graphs but where all nodes share the same identifier (i.e. in the anonymous version of these graphs).

Be aware that a space complexity in o(log n) does not prevent A from exchanging identifiers between nodes, but they must be transferred as a series of smaller pieces of information that are pipelined along a link, each of size o(log n) bits. Yet, a node cannot store the identifier of even just one of its neighbors.

We then slightly modify our proof to obtain a second, similar, theorem. We show that, for any k ∈ N, k ≥ 2, as soon as identifiers are taken in a linear range [1, n × c], with c ∈ R, c > 1, then algorithms that use o(log log n) bits per node are not more powerful than k-homonymous algorithms. More precisely, let A be an algorithm in a network with unique node identifiers, and let us assume that A has space complexity o(log log n) bits per node. We show that, with spacial complexity o(log log n) bits per node, there exist graphs and assignments of identifiers to the nodes of these graphs such that, in these graphs and for these identifier-assignments, A has the same behavior as an algorithm executed in these graphs but where identifiers can be shared by several nodes (i.e. in the k-homonymous version of these graphs).

Both results have a very broad scope of application. Indeed, we make almost no hypothesis on the model in which A is executed. We do not make any assumption on the communication model (S PU or S PK ), neither on the knowledge of the topology (precise or bounded knowledge of n, ∆, D), neither on uniformity of the network, neither on the scheduler under which it is executed, and a weak assumption is made on the topology on which the algorithm is executed. Practically, one can fix any parametrization for the model, our theorem guarantees an equivalence between executions of A in identified and anonymous or homonymous networks, under the same chosen model. What our result is really about is the power of identifiers in a scenario where very little space/communication is used. Remember that the Naor-Stockmeyer order-invariance theorem [START_REF] Naor | What can be computed locally?[END_REF] states that in the LOCAL model, for local problems, constant-time algorithms that use the exact values of the identifiers are not more powerful than the order-invariant algorithm that only uses the relative ordering of the identifiers. In some sense our paper and [START_REF] Naor | What can be computed locally?[END_REF] have the same take-home message, in two different contexts: if you do not have enough resources, you cannot use the (full) power of the identifiers.

Note that both previous results establish an equivalence between executions on identified networks, and executions on weaker networks. Yet it is unclear whether this extends to the resolution of some problems. Indeed, although we prove that the behavior of the algorithm cannot fully use the power of identifiers, it may be that the specification predicates uses the identifiers. In such a case, it could be that in an identified network, the specification is valid thanks to the identifier, while in the exact same configuration of an anonymous, or k-homonymous, network, it is not. Fortunately, in most cases, the specification of the problem is simple enough for this issue to be easily overcome.

As a third result, we show how the previous can be adapted to prove lower bound of Ω(log log n) bits per node for a problem, by addressing the Leader Election problem. This improves the only lower bound known so far (see [START_REF] Beauquier | Memory space requirements for self-stabilizing leader election protocols[END_REF]), which states that leader election has non-constant space complexity, i.e., complexity ω(1). More importantly, our bound matches the best known upper bound on the space complexity of leader election, which is O(log log n) bits per node in bounded degree networks [START_REF] Blin | Compact self-stabilizing leader election for general networks[END_REF], and in particular invalidates the folklore conjecture stating that leader election is solvable using only O(log * n) bits of mutable memory per node.

The technique used to adapt the previous results to prove a lower bound for LE is very generic, and works for basically any problem that requires minimal symmetry breaking. In Chapter 5 we reuse the previous to prove the space-optimality of our token-circulation algorithm.

Chapter Outline

The remainder of this chapter is organized as follows. We first formally describe the particular models in which we work, provide some definition, and the specification of the leader election problem in Section 3.2. Then, in Section 3.3 we show on a simple example the reasoning used in our proofs. Finally, in Sections 3.4, 3.5, and 3.6 we formally prove our three theorems.

Model

Indistinguishability

The proofs of Sections 3.4, 3.5 and 3.6 are based on the notion of indistinguishability. In this work, we only consider indistinguishability for networks that have the same underlying graph. Two networks that have the same underlying graph are indistinguishable for an algorithm A if the computing steps of A are exactly the same on both networks.

Definition 3.1 (Indistinguishability)

Let G 1 and G 2 be two networks with identical topology, i.e. whose underlying graph is the same, and let A be a distributed algorithm. G 1 and G 2 are indistinguishable for A if for any two configurations γ and γ , γ → γ is a valid computing step of A on G 1 if and only if it is a valid computing step of A on G 2 .

Remark that, by transitivity, if G 1 and G 2 are indistinguishable for A then, for any scheduler D, the executions of A on G 1 under D are the same than the executions of A on G 2 under D.

Degree-limited

The proofs of Sections 3.4 and 3.5 are only effective on graphs with relatively small degree. Let us give a proper definition of how to asymptotically define this notion of small degree:

Definition 3.2 (∆-limited) Let G = (G i ) i∈N be
(n) = ∞. We say that G is ∆-limited by function f if ∆ G (n) ∈ o(f (n)).

Model for Sections 3.4 and 3.5

Our two first results are highly generic, in the sense that they can be adapted to a large variety of situations. We prove that whatever are the precise state model S PU or S PK , the scheduler, the knowledge of the parameters of the network, the uniformity of the network, or the presence of faults, executions of some deterministic algorithm with small memory on large, identified networks are also executions of the same algorithm on an anonymous or homonymous network. We only make 2 hypothesis, on the range in which are taken the identifiers, and on the degree of the networks that are involved.

Range for identifiers

We need to consider identifiers between 1 and n × c, for c > 1, at least. This is not an artifact of our proofs: it is actually necessary for the results to hold. Indeed, if the identifier range is [1, n], then an algorithm can attribute specific rules to each node of the network, and being certain that no set of rules will be missing. For example, even in a uniform network, an algorithm may use the node with identifier 1 as a designated node, and thus making the network semi-uniform-like. This operation could not be done in the anonymous version of the network. Since semi-uniform algorithms can achieve space complexity below our lower bound [START_REF] Kumar Datta | Selfstabilizing depth-first token circulation in arbitrary rooted networks[END_REF][START_REF] Johnen | Memory efficient, self-stabilizing algorithm to construct BFS spanning trees[END_REF], this excludes the possibility to extend our results to identifier range [1, n]. Even without the possibility of having a trivially designated node, one can take advantage of small identifier range: there actually exists a leader election algorithm for the ring which requires constant memory if the identifiers are taken in [1, n + c] for a constant c [START_REF] Beauquier | Memory space requirements for self-stabilizing leader election protocols[END_REF]. As soon as the identifiers are taken in a linear range [1, n × c], no such trick can be made to attribute a specific role to one node.

Limited-degree graphs Our proofs only apply on networks with relatively small degree. Namely, it works with graphs with degree o(log n). This may seem very restrictive, but practically it is not. Indeed, most problems that cannot be solved on general anonymous networks can neither be solved on anonymous networks with small degree. Therefore, proving an equivalence between the executions of algorithms on identified and anonymous, small-degree, networks, is generally sufficient to prove that some problem cannot be solved with o(log log n) bits per node.

Model for Section 3.6

In Section 3.6 we prove the following theorem: Our lower bound is actually optimal not only in terms of size, but also in terms of the assumptions we make on the setting. More precisely, our theorem has four restrictions: it works for deterministic algorithms only, on rings with a non prime number of nodes, rings that are uniform, and with identifiers in a large enough range. In particular, we do not make any real assumption on the scheduler, since the central strongly fair scheduler and the synchronous scheduler are the weakest schedulers in the literature, nor on the knowledge on the topology, nor on the variant of the state model.

Theorem 3.1 Let c ∈ R,
We will now discuss why those four limitations are actually necessary. Determinism Randomization is a common tool for symmetry breaking, and our problem is one example. Namely, [START_REF] Itkis | Fast and lean self-stabilizing asynchronous protocols[END_REF] proved that using randomization, one can solve leader election using constant memory, which implies that our result cannot be generalized in that direction.

Topology Our proof is established on composite rings, i.e. rings whose size n is not a prime number. Therefore, it applies to any algorithm that solves Leader Election on, at least, composite rings. Note that our result does not invalidate the possibility to design constant-size algorithms for Leader Election in some particular topologies. In stars, exactly one node has more than one neighbor. Therefore, stars can be seen as particular semiuniform networks: the center of the star is a trivial designated leader. More interestingly, our result does not apply to algorithms that solve leader election on prime rings, i.e. rings whose size n is a prime number. There is no hope to extend our result in that direction, since [START_REF] Itkis | Deterministic, constant space, self-stabilizing leader election on uniform rings[END_REF] builds a constant memory algorithm for leader election on anonymous prime rings, under a central scheduler.

Remark that proving an impossibility result for the sub-class of composite rings is particularly interesting since a large number of works have focused on solving the problem of the leader election in rings [ILS95, BGJ99, DGFTT14, BT18, ADD + 20]. We prove that even under that pretty simple topology, one cannot design an algorithm that uses o(log log n) bits per node.

Identifier Range Since Leader Election is impossible in general homonymous networks, the equivalence result of Section 3.5 is sufficient to establish our lower bound. Thus, we only need to suppose that identifiers are taken in a linear range, [1, n × c], for c ∈ R, c > 1 to obtain our impossibility result. Due to [START_REF] Beauquier | Memory space requirements for self-stabilizing leader election protocols[END_REF] constant-memory algorithm for Leader Election when identifiers are taken in [1, n + c], for c ∈ N, there is no hope to extend our theorem to asymptotically smaller range of identifiers.

Uniformity Our proof is only valid in uniform networks. There is no hope to extend our results to semi-uniform networks since LE is trivial in anonymous, semi-uniform networks. Indeed, the distinguished node of the network is a trivial designated leader.

Leader Election Problem

In Section 3.6, we focus on one of the arguably most important problems in the context of distributed computing, namely leader election. The objective is to maintain a unique leader in the network, and to enable the network to return to a configuration with a unique leader in case there are either zero or more than one leader.

One first step to define the specification of LE is to express what being a leader means. Some papers suppose a variable leader v on each node v, that can only take two values, 1 and 0, 1 being the value for the leader and 0 for the others. In this case, solving LE boils down to reaching a configuration where exactly one node v has its variable leader v set to 1.

Although pretty intuitive, this definition is a bit restrictive. Indeed, it could be that nodes do not store in a variable the information whether they are the leader or not. A more general possibility is that each time it is necessary, nodes compute a value which indicates whether they are the leader or not. This computation may depend on their local variables, their state, and the state of their neighbors, according to the state model. To be as generic as possible, we consider the second option, which implies the use of a local predicate.

We can now define the specification of LE by referring to the unicity of the leader. A configuration γ ∈ Γ is a correct configuration for the leader election problem if one single node is elected, and an execution satisfies the specification of LE if any configuration it contains is a correct configuration for the leader election problem. More formally:

Specification 3.1 (Leader Election) LE (Leader Election) in G = (V, E) is specified by the existence of a local predicate E LE . A configuration γ is correct if P LE (γ) ≡ ∃!v ∈ V : E γ LE (v) = true. An execution = γ 0 → • • • is correct if all the configurations γ i are correct: SP LE ( ) ≡ ∀i ≥ 0, P LE (γ i ) ≡ ∀i ≥ 0, ∃!v ∈ V : E γi LE (v) = true.
Remark that, once again, our definition is extremely general. Notably, we do not suppose that the leader remains leader during the entire execution, the leadership can switch from one node to another.

Since we prove a lower bound for LE, being as permissive as possible only strengthens our result.

Intuition of the proofs

Challenge of lower bounds for non-silent algorithms

Almost all lower bounds for self-stabilization are for silent algorithms, which are required to stay in the same configuration once they have stabilized. These lower bounds are then about a static data structure, the stabilized solution. The question boils down to establishing how much memory is needed to locally certify the global correctness of the solution, and this is well-studied [START_REF] Feuilloley | Introduction to local certification[END_REF].

When we do not require that the algorithm should converge to one correct configuration, and stay there, there is no static structure on which we can reason. It is then unclear how we can establish lower bounds. One way is to think about invariants. Consider a property that we can assume to hold in the initial configuration, and that is preserved by the computation (if it follows some memory requirement hypothesis). If no correct output configuration has this property, then we can never reach a correct output configuration.

In our proof, the property that will be preserved is that every configuration is symmetric. This can clearly be assumed for the original configuration, and we show that basically if the memory is limited then this is preserved at each step. As the specification we use for leader election is that the leader should output 1, and the other nodes should output 0, then it is not possible that a proper output configuration is symmetric.

Intuition on a minimal example

Equivalence with anonymous and homonymous networks Let us now give some intuition about why algorithms for identified networks with small memory are effective in k-homonymous or anonymous networks as well. The code of an algorithm A for identified networks may refer to the identifier of the node that is running it. For example, a rule of the algorithm could be:

• if the states of the current node and of its left and right neighbors are respectively x, y, and z, then: if the identifier is odd the new state is a, otherwise it is b. Now suppose you have fixed an identifier, and you look at the rules for this fixed identifier. In our example, if the identifier is 7, the rule becomes:

• if the states of the current node and of its left and right neighbors are respectively x, y, and z, then: the new state is a. This transformation can be done for any rule, thus, for an identifier i, we can get an algorithm A i specific to this identifier. When we run A on every node, we can consider that every node, with some identifier i is running A i . Note that A i does not refer to the identifier in its code.

The key observation is the following. If the amount of memory an algorithm can use is very limited, then there is very limited number of different behaviors a node can have, especially if the code does not refer to the identifier. Let us illustrate this point by studying an extreme example: a ring on which states have only one bit. In this case the number of input configurations for a node is the set of views (x, y, z) as above, with x, y, z ∈ {0, 1}. That is there are 2 3 = 8 different inputs, thus the algorithm can be described with 8 different rules. Since the output of the function is the new state, the output is also a single bit. Therefore, there are at most 2 8 = 256 different sets of rules, that is 256 different possible behaviors for a node. In other words, in this extreme case, each specific algorithm A i is equal to one of the behaviors of this list of 256 elements. This implies that, if we take a ring with 257 nodes, there exist two nodes with two distinct identifiers i and j, such that the specific algorithms A i and A j are equal. But the idea above can be strengthened to get our theorem. The key is to use the hypothesis that the identifiers are taken from a large enough range. As we have a pretty large palette of identifiers, we can always find, not only 2, but n distinct identifiers in [1, n × c] that can be grouped such that the specific algorithm of all the nodes of the same group correspond to the exact same behavior. In this case, it is as if the network was k-homonymous, where k is the size of each group. If the identifiers are taken in [1, n c ], we can even find n distinct identifiers, such that all the specific algorithms A i correspond to the exact same behavior. In this case it is as if the network was anonymous.

Application: Lower Bound for LE As soon as the network is homonymous-like, we can start an execution from a symmetric configuration. If the scheduler always activates all homonymous nodes consecutively, then the execution contains an infinity of symmetric configurations, and thus never stabilizes to a proper leader election execution. This is presented in Figure 3.1.

u 1 u 2 u 3 u 4 u 5 u 6 Symmetric u 1 u 2 u 3 u 4 u 5 u 6 u 1 activated u 1 u 2 u 3 u 4 u 5 u 6 Symmetric u 4 activated
A ID(u1) = A ID(u4) , A ID(u2) = A ID(u5) , A ID(u3) = A ID(u6)
. Identical states are represented by identical shades of gray. If the states of the nodes are symmetric in the initial configuration, and if the behavior functions are symmetrically placed around the ring, then an execution can contain an infinity of symmetric configurations.

Note that the larger the memory is, the more different behaviors there are, and the smaller the set of identical specific algorithms we can find. This trade-off implies that the construction works as long as the memory is in o(log log n).

Equivalence with Anonymous Networks

Statement of the Theorem

In this section, we prove the following theorem:

Theorem 3.2 Let c ∈ R, c > 1. Let us consider G = (G i ) i∈N a
G i ∈ G, there exist n identifiers ID 1 , ID 2 , . . . , ID n in [1, n c ] such that G 0 i [ID 1 , ID 2 , . . . , ID n ] and G n i [ID 1 ] are indistinguishable for A.
In other words, there exist n identifiers in [1, n c ] such that in G i , A cannot distinguish those identifiers: it runs exactly as if the network was anonymous.

Proof in S PU on uniform networks

In this section we prove a weaker version of Theorem 3.2: we only consider the portunknown state model and uniform networks. We show in Section 3.4.3 how this proof can be generalized to S PK and to semi-uniform networks.

Consider a graph G i with maximal degree ∆, and an algorithm for identified networks using f (n) bits of memory per node on graphs of G. An algorithm can be seen as the function that describes the behavior of the algorithm. In the state model, the predicates of the different rules may consider the identifier of the node itself, its state, the degree of the node, and the states of the neighbors of the node. The degree can actually be a parameter on which the algorithm relies. Algorithms, especially in anonymous networks, may have different behavior depending on the degree of the node. Depending on the value of the different parameters, an action will be executed, which produces an update of the state of the node.

Consequently, we model an algorithm by a function, which takes as an input, an identifier, a state for the node, the degree of the node, and a state for all of the neighbors of the node. This function produces as an output a new state for the node. Formally:

A : [n c ] × {0, 1} f (n) × [∆] × {0, 1} f (n) ∆ → {0, 1} f (n) (ID , state , degree , ∆ states) → new-state
The idea is that, to get its output, node v will first feed its identifier ID v , its own state S(v), then its own degree ∆ v and finally the states of its ∆ v first neighbors as the ∆ v next fields. The other fields are left blank. The output of the function is the output of the algorithm: the new state of the node.

Note that this corresponds to the port-unknown state model: the function does not have any information that allows distinguishing the actions taken by one node that is pointed by its port-number, and one node that is not pointed by its port number, both having the same neighboring. Now we can consider that for every identifier i, we have an algorithm of the form:

A i : {0, 1} f (n) × [∆] × {0, 1} f (n) ∆ → {0, 1} f (n) (state , degree , ∆ states) → new-state
Thus a specific algorithm A i boils down to a function of the form:

A i : {0, 1} f (n) ∆+1 × [∆] → {0, 1} f (n) .
Let us call such a function a behavior, and let B n be the set of all behaviors.

Lemma 3.1 counts the maximum number of distinct behaviors that can exist.

Lemma 3.1

|B n | ≤ 2 f (n) 2 (∆+1)f (n) ∆
Proof : The inputs are basically an integer between 1 and ∆, and binary strings of length f (n), and there are up to ∆ + 1 such strings. There are at most 2 (∆+1)f (n) possibilities for the strings, and ∆ possibilities for the degree. Similarly the number of possible outputs is

2 f (n) . Thus the number of functions in Bn is at most 2 f (n) 2 (∆+1)f (n) ∆ .
Lemma 3.1 implies that the smaller f , the fewer different behaviors. Let us make this more concrete with Lemma 3.2.

Lemma 3.2 If f (n) ∈ o( log log n ∆
), then for every large enough n, n c-1 > |B n |.

Proof : Consider the expressions of n c-1 and |Bn| after applying the logarithm twice:

log log n c-1 = log((c -1) log n) = log(c -1) + log log n ∼ log log n log log |Bn| ≤ log log 2 f (n) 2 (∆+1)f (n) ∆ ≤ log f (n)2 (∆+1)f (n) ∆ ≤ (∆ + 1)f (n) + log f (n) + log ∆ ∈ o(log log n)
As the dominating term in the second expression is of order f (n) ∈ o(log log n), asymptotically the first expression is larger. As log log(•) is an increasing positive function for large values, this implies that asymptotically n c-1 > |Bn|.

Recall that our goal is to find n different identifiers that all correspond to the same behavior function. The next lemma shows that this is feasible as soon as

n c-1 = o(|B n |). Lemma 3.3 If n c-1 > |B n | then there exist n distinct identifiers ID 1 , ID 2 , . . . , ID n in [1, n c ]
that all have the same behavior, i.e. such that

A ID1 = A ID2 = • • • = A IDn Proof : Let ϕ : [n c ]
→ Bn be the function that associates to each identifier its corresponding behavior function: ϕ(ID) = AID. The number of pre-images a behavior function Ai has is

|ϕ -1 (Ai)|.
Remark that since ϕ is a function defined on a set of n c elements, we have:

A i ∈Bn |ϕ -1 (Ai)| = n c .
Let us count the average number of pre-image a behavior function has by ϕ, which is the total number of pre-images divided by the total number of behavior functions. Therefore, this number is: 1

|Bn| A i ∈Bn |ϕ -1 (Ai)| = 1 |Bn| • n c
By hypothesis, this average number is greater than n, and thus by pigeonhole principle there must exist at least one behavior function Ai that has at least n pre-image by ϕ.

In other words, there exist n distinct identifiers ID1, ID2, . . . , IDn such that

AID 1 = AID 2 = • • • = AID n .
Let us now consider a large enough graph G i ∈ G. By Lemmas 3.2 and 3.3, there are n identifiers ID 1 , ID 2 , . . . , ID n such that

A ID1 = A ID2 = • • • = A IDn . Consequently G 0 i [ID 1 , ID 2 , . . . , ID n and G n i [ID 1 ] are indistinguishable by A.
This completes the proof of Theorem 3.2.

Generalization to S PK and to semi-uniform networks

Generalization to S PK In the previous section, we supposed the model S PU . If we now consider the model S PK , then nodes know which port was assigned to them by each of their neighbors. Namely, each node v has, as a local variable, a table that associates to each of its ∆ v neighbors which port it was assigned. This table, with length ∆ v and entries between 1 and ∆ should be part of the inputs of the function that models A.

There are two options to deal with this situation. The first one is to slightly modify the hypothesis that G is ∆-limited by log n. If we suppose that G is ∆-limited by (log n) • (log log n) then adding a field ∆ log∆ in the parameters of A does not invalidate all the math we made, especially the proof of Lemma 3.2.

The other option is to remark that the port number assignment can be chosen symmetrically. In such circumstances, all nodes have the same table as an input, and it then becomes irrelevant as a parameter of the function that models A.

Generalization to semi-uniform networks

In the previous section, we supposed uniform networks. If we suppose now that the network is semi-uniform, then variable distinguish may be used by the algorithm, and thus should be a parameter of the function that models A.

But actually, to prove indistinguishability with anonymous, semi-uniform, networks, it is sufficient to find n-1 distinct identifiers that all correspond to the same behavior function and to map them to the n -1 undistinguished nodes. Indeed, an anonymous, semi-uniform, network permits that the distinguished node has a behavior different from the other nodes. Thus, we can simply reason on the n -1 nodes with variable distinguish set to 0, and exactly as before, variable distinguish becomes irrelevant as a parameter of the function that models A.

Equivalence with Homonymous Networks

Statement of the Theorem

In this section, we prove the following theorem: In other words, there exist n identifiers in [1, n×c] such that in G i , A cannot distinguish those identifiers: it runs exactly as if the network was homonymous.

Theorem 3.3 Let c ∈ R, c > 1 and let k ∈ N, k ≥ 2. Let us consider G = (G i ) i∈N a

Proof when k divides n

Similarly to how we proceeded in Section 3.4, we suppose in this section the S PU model and uniform graphs. The remarks made in Section 3.4.3 apply without any difficulty to the following proof to establish the general version of Theorem 3.3.

In this section we prove a weaker version of Theorem 3.3: we suppose that the size of the networks we consider are divisible by the integer k. We show in Section 3.5.3 how this proof can be generalized to all networks.

The proof of Theorem 3.3 is basically the same as the proof of Theorem 3.2, and follows the same scheme. The major difference is that since the range in which the identifiers are taken is smaller, it is harder to find distinct identifiers that cannot be distinguished by A. Actually, we cannot guarantee to find n such identifiers anymore. Fortunately, we can find n distinct identifiers that can be grouped k by k so that in each group all the identifiers have the same corresponding behavior function, and thus we obtain the equivalence with homonymous networks.

Consider a graph G i with maximal degree ∆, and an algorithm for identified networks using f (n) bits of memory per node on graphs of G. Once again, the algorithm can be seen as the function which takes as an input, an identifier, a state for the node, the degree of the node, and a state for all of the neighbors of the node:

A : [n × c] × {0, 1} f (n) × [∆] × {0, 1} f (n) ∆ → {0, 1} f (n) (ID , state , degree , ∆ states) → new-state
We can still consider that for every identifier i, we have an algorithm of the form:

A i : {0, 1} f (n) × [∆] × {0, 1} f (n) ∆ → {0, 1} f (n) (state , degree , ∆ states) → new-state
Lemma 3.1 remains valid:

|B n | ≤ 2 f (n) 2 (∆+1)f (n) ∆
Since there are fewer identifiers than there were in the previous, we must be tighter when dominating |B n | by a function of n than we were in Lemma 3.2.

Lemma 3.4 If f (n) ∈ o( log log n ∆ ), then for every n large enough, we have n(c-1) k-1 > |B n |. Proof : Consider the expressions of n(c-1) k-1
and |Bn| after applying the logarithm twice:

log log n(c-1) k-1 = log(log n + log(c -1) -log(k -1))
∼ log log n And similarly to what was established for Lemma 3.2:

log log |Bn| ∈ o(log log n)
As log log(•) is an increasing positive function for large values, this completes the proof of the lemma.

Recall that our goal is to find n different identifiers that can be grouped by sets of size k such that, in every group, all the identifiers have the same corresponding behavior. If we consider ϕ the function that associates each identifier to the corresponding behavior, then it boils down to finding n distinct identifiers that can be grouped by k, such that in each group, all the identifiers have the same image by ϕ. For example, if k = 2, if the identifiers are taken in {1, 2, 3, 4, 5, 6, 7}, and if there are three behaviors

B = {b 1 , b 2 , b 3 }, we can have ϕ(1) = ϕ(2) = ϕ(3) = b 1 , ϕ(4) = b 2 , and ϕ(5) = ϕ(6) = ϕ(7) = b 3 .
In that case, we can form two sets of size k = 2 such that all the elements of one set have the same image by ϕ. We can for example consider {1, 3} and {6, 7}.

Let us give a definition that formalizes that.

Definition 3.3 (k-group number of a function)

Let ϕ : A → B be a function, and let k ∈ N. We define the k-group number of ϕ, and denote t k (ϕ) the maximum number of disjoint sets of size k of elements of A, S 1 , S 2 , . . . , S t k (ϕ) such that all the elements of the same set S i have the same image by ϕ.

The precise value of t k (ϕ) depends on the specificities of ϕ. Nevertheless, we can have a pretty good estimation of t k (ϕ) by comparing the respective sizes of A and B. Indeed, the larger A is, the more chances we have to find sets of elements of A that satisfy some property. On the contrary, the larger B is, the more possible images there are, and the harder it is to find elements of A that are mapped to the same element of B. Lemma 3.5 establishes a generic lower bound on t k (ϕ). . By definition, we also have

t k (ϕ) = b∈B t b k (ϕ) = b∈B |ϕ -1 (b)| k .
Recall the inequality, true for any integer m:

m k ≥ m-(k-1) k
. Thus, we deduce:

t k (ϕ) ≥ b∈B 1 k (|ϕ -1 (b)|-(k-1)) ≥ 1 k b∈B (|ϕ -1 (b)|-(k-1)) ≥ 1 k b∈B (|ϕ -1 (b)|)-(k-1)|B| Since ϕ is a function from A to B we have b∈B (|ϕ -1 (b)|) = |A| and thus we conclude t k (ϕ) ≥ |A|-(k-1)|B| k . The next lemma shows that, if n(c-1) k-1 > |B n |, we can find n/k disjoint sets of k identifiers taken in [1, n × c]
such that all the identifiers of each set have the same corresponding behavior.

Lemma 3.6

Let

ϕ n : [1, n × c] → B n be the function that associates each identifier ID to its corresponding behavior A ID . If n(c-1) k-1 > |B n |, then t k (ϕ n ) ≥ n/k.
Proof : According to Lemma 3.5 we have t k (ϕn) ≥ 1 k (nc -(k -1)|Bn|), and by hypothesis this means that t k (ϕn) ≥ 1 k (ncn(c -1)), and thus t k (ϕn) ≥ n/k.

Let us now consider a large enough graph G i ∈ G. By Lemmas 3.4 and 3.6 we can consider S 1 , S 2 , . . . , S n/k , disjoint sets of k identifiers, such that all the identifiers of the same set have the same image by ϕ n . For each set S i , let us pick one specific identifier, ID i .

Consider now G

k i [ID 1 , . . . , ID n/k
] a k-homonymous network with topology G and k occurrences of each ID i , on the first hand, and

G 0 i [S 1 ∪ S 2 ∪ • • • ∪ S k ]
an identified network similar to G h , where for each i, occurrences of identifier ID i are substituted by one of each value of S i . By construction, algorithm A cannot distinguish identifiers from the same set S i , and thus

G k i [ID 1 , . . . , ID n/k ] and G 0 i [S 1 ∪ S 2 ∪ • • • ∪ S k ] are indistinguishable for A.
This completes the proof of Theorem 3.3.

Proof for any n

In the previous section, we supposed that n was a multiple of k, which simplifies the distribution of groups of k identifiers to the n nodes of the network.

If this hypothesis falls, then for a fixed value k we can still find n/k disjoint sets of k identifiers such that in each set, all the identifiers have the same corresponding behavior. Yet this does not cover all the nodes anymore, there are still n mod k nodes that do not have an identifier this way.

Finding one new set of k identifiers that all correspond to the same behavior, and associating some of them to the nodes that do not have an identifier will not work, since a k-homonymous network must have at least k nodes with the same identifier, and n mod k is less than k.

To solve that issue, let us rather prove that there are at least n mod k (in practice, at least k -1) disjoint sets of k + 1 identifiers such that in each set, all the identifiers have the same corresponding function. This way, we can construct a k-homonymous network, in which all identifiers are shared by at least k, sometimes k + 1, nodes.

One problem may arise: it might be that some of those sets of k + 1 identifiers intersects 2 of the sets of size k that we have. Indeed, suppose that 2k identifiers correspond to the same behavior. This allows us to define 2 sets of size k, but if k + 1 such identifiers are taken by one of the new sets, then we cannot finish the identifier assignments. Hopefully, we cannot lose more that 2 sets of size k due to a set of size k + 1. If this happens, we can reorganize the different incomplete sets to form new ones.

To avoid such situation, it is sufficient to find not n/k, but n/k + k sets of size k. Thus, even if we lose 2 sets of size k for every set of size k + 1, we end with k sets of size k + 1, and (n/kk) sets of size k, which is sufficient to assign a unique identifier to each node of the graph. Since n is supposed large enough, this additional k will be negligible.

Similarly to Lemma 3.4, we can prove that for any large enough n, we have

|B n | ≤ nc-k 2 +1 k
, on the first hand, and

|B n | ≤ n(c-1)-k 2 k-1
on the other hand.

Now, similarly to Lemma 3.6, we use these inequalities to prove that for any large enough n, t k+1 (ϕ n ) ≥ k -1, on the first hand, and t k (ϕ n ) ≥ n k + k, on the other hand. Finally, we can consider S 1 , S 2 , . . . , S n mod k disjoint sets of k +1 identifiers such that all the identifiers of the same set have the same image by ϕ n , and S1 , S2 , . . . , S n/k -(n mod k) disjoint sets, disjoint from the S i , such that all the identifiers of the same set have the same image by ϕ n .

The elements of these n/k jointly contain (n mod k)(k+1)+k( n/k -(n mod k)) = n mod k + k n/k = n elements. Thus, similarly to how we concluded the proof of Theorem 3.3, we can consider a large enough graph G ∈ G on the one hand, and one specific identifier ID i for each set on the other hand. By construction,

G k [ID 1 , . . . , ID n/k ] is k- homonymous, and is indistinguishable from the identified network G 0 [S 1 ∪ • • • ∪ S n mod k ∪ S1 ∪ • • • ∪ S n/k -(n mod k) ],
which completes the proof.

Lower Bound for LE

Statement of the Theorem

In this section we establish a lower bound of Ω(log log n) bits per node for the space complexity of distributed algorithms that solve leader election in composite, uniform, rings. This bound improves the only lower bound known so far [START_REF] Beauquier | Memory space requirements for self-stabilizing leader election protocols[END_REF], from ω(1) to Ω(log log n), and it is tight, as it matches the upper bound of [START_REF] Blin | Compact deterministic self-stabilizing leader election on a ring: the exponential advantage of being talkative[END_REF], obtained in the same model and under a more challenging scheduler, the weakly fair distributed scheduler. In particular, it invalidates the folklore conjecture stating that the aforementioned problems are solvable using only O(log * n) memory.

Link with Dijkstra's impossibility result

In a celebrated paper [START_REF] Edsger | Self-Stabilization in Spite of Distributed Control[END_REF], Dijkstra established, among other things, that one cannot break symmetry within anonymous composite rings. This result holds under a central strongly fair scheduler. Theorem 3.1 follows the same idea as Dijkstra's. The core of the proof, and the statement of Theorem 3.2 is about proving that an algorithm with too little memory cannot fully use the power of identifiers. The second part of the proof of Theorem 3.1 is basically a generalization of [START_REF] Edsger | Self-Stabilization in Spite of Distributed Control[END_REF]: we prove that one cannot break symmetry in homonymous composite rings.

Recall that assuming that the ring is composite is essential, due to the constant memory algorithm on anonymous prime rings of [START_REF] Itkis | Deterministic, constant space, self-stabilizing leader election on uniform rings[END_REF].

Limits of Theorems 3.2 and 3.3

It is known that LE cannot be solved in general, homonymous rings [DGFTT14, ADD + 20]. Therefore, the proof of Theorem 3.1 will rely on Theorem 3.3 and on its proof. Yet, there are two issues that must be overcome to adapt Theorem 3.3 to the impossibility to solve LE on composite rings.

k-Homonymy

In the previous section, we supposed that k was a fixed integer, independent of n. In this section, in order to prove the impossibility of solving LE, we must make sure to have a symmetric network. This is feasible only if k is a divisor of n. In the worst case, we have k =

√ n. We will have to adapt some of our proofs so that everything remain valid.

Indistinguishability

We proved in Section 3.5 that for any algorithm A which uses few memory, there exist identified and homonymous networks that are indistinguishable for A. It is very tempting to conclude that any problem that cannot be solved in homonymous networks, can neither be solved with few memory. Since it is known that LE cannot be solved in homonymous networks, we would conclude immediately. Unfortunately, things are not that straightforward.

Indeed, we only proved that networks were indistinguishable for A. We did not prove that they were indistinguishable for SP LE . It could be that two identical executions, one in an identical network, and one in a homonymous network, do not have the same status from the specification point of view, and that the execution in the identified network solves LE, while it does not in the homonym network. Let us give one example. Suppose that each node has in its memory a string of bits, and that this string of bits corresponds to the identifier of one of the node. In a homonymous network, this does not help to solve LE. However, in the identified network, LE is now trivially solved, although all nodes are in the exact same state. This is because the specification of the LE, and especially E LE , can rely on the identifiers.

The example above requires that each node stores an identifier, which requires at least log n bits, and thus, it is contradictory with the hypothesis on the memory. This is actually not a coincidence: with few memory, one predicate, not more than one algorithm, can fully use the uniqueness of the identifiers.

We will follow that idea to prove that the reasoning we made on A in Sections 3.4 and 3.5 can be extended to the predicate that determines LE.

Proof

In this section we prove Theorem 3.1 by focusing on the case were the scheduler is a central strongly fair scheduler. Although the synchronous scheduler cannot be said stronger than the central strongly fair scheduler, the construction we propose fits for the synchronous scheduler too.

Consider a ring of size n, and an algorithm for identified networks A using f (n) bits of memory per node to solve leader election in composite rings.

Similarly to what we did in the previous sections, we can consider the function that describes the behavior of the algorithm. Since all nodes have exactly two neighbors, the expression of A as a function is much simpler than in the previous section:

A : [n × c] × {0, 1} f (n) × {0, 1} f (n) × {0, 1} f (n) → {0, 1} f (n) (ID , state
, left-state , right-state) → new-state Note that in general, we consider non-directed rings thus the nodes do not have a consistent global definition for right and left. As we are dealing with a lower bound with a worstcase on the port numbering, assuming such a consistent orientation only makes the result stronger.

Unfortunately, as explained above, this will not be sufficient to establish Theorem 3.1.

Let us suppose that A solves LE. By definition there exists a boolean predicate E LE associated to A, that characterizes how A solves the specification of LE. By definition, this predicate takes the same input as A: the local variables of the node on which it is evaluated, and the state of the node itself and of its neighbors. Therefore, we can consider the function (A, E LE ), which takes the same inputs as A, or E LE , and returns a tuple, the result computed by A, which is a new state for the node, and the result computed by E LE , which is a boolean value that indicates whether the node is elected or not. Formally:

(A, E LE ) : [n × c] × {0, 1} f (n) × {0, 1} f (n) × {0, 1} f (n) → {0, 1} f (n) × {0, 1} (ID , state , left-state , right-state) → (new-state, elected)
Now, we can consider that for every identifier i, we have a tuple of the form:

(A, E LE ) i : {0, 1} f (n) × {0, 1} f (n) × {0, 1} f (n) → {0, 1} f (n) × {0, 1} (state , left-state , right-state) → (new-state, elected)
Thus a specific tuple (A, E LE ) i boils down to a function of the form:

{0, 1} 3f (n) → {0, 1} f (n)+1 .
Let us call such a function a behavior, and let B n be the set of all behaviors.

Similarly to what was done in Lemma 3.1 we can count how many distinct behaviors can exist:

|B n | = 2 (f (n)+1)×2 3f (n)
Remark that from now on, the issue coming from the non-indistinguishability for the predicate is basically solved: behaviors now include the predicate, and the increase in number is negligible in front of what we tolerate for the algorithm.

However, the issue coming from which the possibility for k to grow with n has not been addressed yet. Recall that our goal is to find n different identifiers which can be grouped by sets of size k (k being a divisor of n), such that in every group, all the identifiers have the same corresponding behavior. In the worst case, all rings have size p 2 where p is prime. To build a symmetric configuration in this case, and formally establish impossibility, we need to find p disjoint sets of p identifiers that all have the same corresponding behavior, where p is the square root of the size of the network. Therefore, k cannot be supposed a constant anymore.

Let us establish a variant of Lemma 3.4:

Lemma 3.7 If f (n) ∈ o(log log n), then for every n large enough, for every k ≤ √ n, we have n(c-1) k-1 > |B n |. Proof : Remark first that n(c-1) k-1 ≥ √ n(c -1)
. Now consider the expressions of √ n(c -1) and |Bn| after applying the logarithm twice:

log log( √ n(c -1)) = log( 1 2 log n + log(c -1)) ∼ log log n log log(|Bn|) = log (f (n) + 1) × 2 3f (n) = log(f (n) + 1) + 3f (n) ∈ o(log log n)
As log log(•) is an increasing positive function for large values, this completes the proof of the lemma.

The next lemma shows that if

n(c-1) k-1 > |B n |, then for every k ≤ √ n we can find n/k disjoint sets of k identifiers taken in [1, n × c]
such that all the identifiers of each set have the same corresponding behavior.

Lemma 3.8

Let ϕ n : [1, n × c] → B n be the function that associates each identifier i to its corresponding behavior A i , and

let k ≤ √ n. If n(c-1) k-1 > |B n |, then t k (ϕ n ) ≥ n/k. Proof : According to Lemma 3.5 we have t k (ϕn) ≥ 1 k (nc -(k -1)|Bn|),

and by hypothesis this means that t

k (ϕn) ≥ 1 k (nc -n(c -1)), and thus t k (ϕn) ≥ n/k.
Combining the three lemmas we get that, if f (n) ∈ o(log log n), then for any large enough n, for any k ≤ √ n, we can find n different identifiers in [1, n × c], which can be grouped in sets of size k such that all identifiers of the same set have the exact same behavior.

Now, consider a large enough composite ring of size n, and let k be a divisor of n such that 1 < k ≤ √ n. Let us consider n identifiers which can be grouped as explained above, and let us place those identifiers on the ring such that the identifiers of the same set are placed each n/k node, similarly to what is presented on Figure 3.1.

For our proof, we need to start in a symmetric configuration, where all nodes with their identifier taken in the same set have the same state. Since our theorem does not suppose a faulty environment, we must consider as an initial configuration, a correctly initialized configuration, where all nodes have the same, clean, state. This perfectly fits what is required for the proof.

Let γ 0 be the initial, correctly initialized, configuration of the system. We cannot have P LE (γ 0 ). Indeed, the predicate E LE has the same behavior on all the nodes with identifiers taken in the same set. Therefore, the number of nodes v such that

E γ0 LE (v) = 1 is a multiple of k.
Since γ 0 does not satisfy P LE , at least one node is enabled. Note that all nodes with identifiers from the same set see the same states for themselves, and for both their neighbors. Thus, since all of them have the same behavior, if one is enabled, then the others are too, and if activated they will execute the same rule. Now, the central scheduler activates one of them, and for the k-1 next steps, it activates each of the others. Since those nodes are placed at a distance at least 2 from each other, the action executed by one node has no incidence on the state of the other nodes, nor on the states of their neighbors, and thus the other nodes take the exact same step as the first one. Thus, after those k computing steps, the ring is once again in a symmetric configuration γ k . One again, we have ¬P LE (γ k ).

We can iterate this argument forever, as long as the scheduler consecutively activates nodes from the same set, which a central strongly fair scheduler can do. In other words, there exists an execution of A such that the system is infinitely often in symmetric configurations, which do not satisfy P LE . Therefore, the network never stabilizes in an execution that satisfies leader election. This proves Theorem 3.1.

If we now consider an execution under the synchronous scheduler, where all the enabled nodes are atomically activated at each computing step, then all the k computing steps happen at once, and therefore all the configurations are symmetric, which also invalidates the specification of LE.

Generalization of Theorem 3.3 Theorem 3.3 establishes an equivalence between algorithms with small memory, and algorithms for k-homonymous networks, for any fixed value of k ∈ N. On the other hand, the technique used in the proof of Theorem 3.1 guarantees that for any k ≤ √ n, we can build a k-homonymous network on which the algorithm behaves exactly the same way as in an identified network.

The second is more general, since k can depend on n. Since the proofs of Theorem 3.1 and 3.3 are basically the same, we can adapt the given proof of Theorem 3.3 to make the result a bit more general.

We state the new theorem as a corollary of Theorem 3.3 and of the proof of Theorem 3.1.

Corollary 3.1 Let c ∈ R, c > 1. Let us consider G = (G i ) i∈N a
there exist n identifiers ID 1 , ID 2 , . . . , ID n in [1, n × c] such that G 0 i [ID 1 , ID 2 , . . . , ID n ] and G k i [ID 1 , ID 2 , . . . , ID n/k ] are indistinguishable for A.

Conclusion

In this chapter, we establish two generic results that establish a strong link between algorithms that use o(log log n) bits per node, and algorithms executed in anonymous or homonymous networks. Since various problems are unsolvable in anonymous, or homonymous networks, these theorems are a powerful tool to establish sub-logarithmic lower bounds.

However, the specification of the problem must be taken into account too, to conclude an impossibility result from an indistinguishability result. We showed in Section 3.6 how this logical link can be done, by addressing the leader election problem. Specifically, we prove a Ω(log log n) bits per node lower bound for the leader election problem on the ring. This bound matches the upper-bound O(log log n) bits per node on rings [START_REF] Blin | Compact deterministic self-stabilizing leader election on a ring: the exponential advantage of being talkative[END_REF]. Yet, for arbitrary graphs, [START_REF] Blin | Compact self-stabilizing leader election for general networks[END_REF] requires an additional space in O(log ∆) bits per node. An interesting problem would be to find whether this additional term in O(log ∆) is necessary for graphs where the degree is not bounded.

Introduction

Termination Detection [START_REF] Francez | Distributed termination[END_REF] is a fundamental and widely studied problem of distributed systems. It belongs to the category of global system observation mechanisms that processes of the distributed system may need in the accomplishment of a global computation, for example, detecting the presence of a deadlock, taking a snapshot of the global system state, or maintaining a logical distributed clock. The distributed nature of systems makes these problems difficult to solve. They are subject to specific distributed algorithms dedicated to control the global state of other distributed algorithms. Regarding the termination detection (TD, for short) problem, any node of the distributed system may need to detect whether a computation has globally terminated. More precisely, upon a (local) request (for instance, from an application) a node initiates an instance of TD over the whole system to find out whether another distributed algorithm is terminated.

Motivation

It is known that TD cannot be achieved in the context of self-stabilization, except in the specific case where the TD algorithm is snap-stabilizing. Indeed, with the self-but not snap-stabilizing approach, assume an application where nodes decide to use local variables (supposed to be updated by a global detection mechanism) whether the stabilization phase is over or not. Then it is always possible to build an arbitrary configuration in which the same nodes have access to exactly the same local information. As a consequence, the two situations are indistinguishable, leading to a wrong decision in the second one.

Nevertheless, a self-stabilizing algorithm (at least) guarantees that by repeating global detection instances, the variables provide the correct answer at some, but in an unpredictable time. Indeed, let ssTD be a self-stabilizing TD algorithm. By initiating ssTD, it is possible that ssTD returns a wrong answer during the stabilization phase, e.g., ssTD returns "yes" (meaning that an observed algorithm A terminated), while A actually did not terminate. In other words, ssTD can compute incorrect (or unsafe) answers several (but a finite number of) times before at the end computing true/correct answers. Self-stabilization ensures that by repeating instances of ssTD, the answer is eventually correct forever.

In [CDD + 16], it is shown that the termination detection can be achieved using only one detection instance i.e., at the very first request to know whether an observed algorithm is terminated or not, the returned answer is correct, even if the request was initiated during the stabilization phase. This corresponds to the paradigm of snap-stabilization.

It is important to notice that snap-stabilizing algorithms do not hide better the effects of transient faults than the self-stabilizing algorithms that do not respect this property. However, while a self-stabilizing algorithm guarantees only a finite, yet generally unbounded, number of incorrect answers after the faults cease, a snap-stabilizing algorithm offers correct answers from the first request (after the faults cease).

Note that the snap-stabilizing solutions in [CDD + 16] assume an identified network, where each node has a unique identifier. Even if most of existing distributed systems are identified, developing algorithms that do not use process identifiers definitely makes sense in several aspects. Such algorithms are said to be anonymous algorithms-or, algorithms for anonymous systems.

Anonymity often makes the resolution of some problems harder by far. That makes anonymous approaches interesting from a computational point of view. As presented in the previous chapter, Leader Election is an iconic example of that difficulty. Although the problem is quite trivial to solve deterministically by using the total order provided by process identifiers-just choose the maximum or minimum identifier as the leader, it cannot be solved at all in systems lacking properties (as process identifiers) that break possible symmetries [START_REF] Angluin | local and global properties in networks of processors[END_REF][START_REF] Edsger | Self-Stabilization in Spite of Distributed Control[END_REF]. Also, anonymous solutions a priori require less memory. Notably, they do not need process identifiers, and thus do not require any register to store the information related to the identifiers. Anonymous approaches are also very attractive from a practical point of view. Indeed, they provide solutions that preserve user privacy, they work for systems with homonyms, where nodes can change their names or be replaced during the algorithm lifetime. They are also very suitable for networks made of units with weak capabilities such as wireless sensor networks, body-area networks, etc.

Related Work

The question of detecting the stability of a self-stabilizing algorithm in an anonymous system was first addressed in [START_REF] Lin | Observing self-stabilization[END_REF]. In this paper, the authors introduce the notion of observer: a local node that can detect correctness of a given algorithm, but cannot influence it.

Assuming the central scheduler, where only one node takes a step at each time and a prime-size uniform ring, the authors propose a deterministic distributed algorithm for the observer that detects stability in Θ(n 2 ) steps from the time the ring is stabilized. Located at each node, the proposed observer is not subject to any type of corruption i.e., it is not self-stabilizing. In [START_REF] Beauquier | Observing locally self-stabilization[END_REF], the authors also propose a non-self-stabilizing observer. They propose an observer for synchronous rooted systems, where all enabled nodes take steps simultaneously and a unique node is distinguished from the others. In a synchronous and non-self-stabilizing system, the same authors remove the constraint of having a distinguished node by introducing randomization [START_REF] Beauquier | Observing locally self-stabilization in a probabilistic way[END_REF].

The first deterministic algorithm that solves the problem addressed in [START_REF] Lin | Observing self-stabilization[END_REF] that is also self-stabilizing is proposed in [CDD + 16]. By contrast with the above results [LS92, [START_REF] Beauquier | Observing locally self-stabilization[END_REF][START_REF] Beauquier | Observing locally self-stabilization in a probabilistic way[END_REF] that are not self-stabilizing, the results in [CDD + 16] show the necessity to achieve snap-stabilization and not only self-stabilization. Indeed, only snap-stabilization offers the desirable property of returning the right answer to the request of knowing whether a selfstabilizing algorithm achieved stability, even during the stabilization phase of the observed algorithm. As mentioned earlier, the solution in [CDD + 16] requires a named network.

In anonymous networks of arbitrary size, unison [CFG92, BPV04, DJ19, EK21] offers a nice support to implement deterministic solutions [START_REF] Boulinier | Snap-stabilizing waves in anonymous networks[END_REF]. The asynchronous unison consists in maintaining a local logical clock (sometimes referred to as counter), one for each node, such that: (i) the clock value of each node does not differ by more than 1 with any of its neighbors, and (ii) the clock value of each node is increased by 1 infinitely often. The unison principle is a strong tool to synchronize the whole system by implementing a synchronization barrier. To the best of our knowledge, this principle forms the basis of all known deterministic solutions for anonymous networks, even non-self-stabilizing, which solve global (a.k.a., total [START_REF] Tel | Total algorithms[END_REF]) problems, i.e. problems involving all nodes of the network before a decision can be taken. TD obviously belongs to this class of algorithms. The phase algorithm in [START_REF] Tel | Total algorithms[END_REF] and the TD algorithm in [START_REF] Boleslaw | Terminating iterative solution of simultaneous equations in distributed message passing systems[END_REF] are typical examples of algorithms that use an underlying unison mechanism. Both algorithms require that nodes know (an upper bound on) the network diameter D, i.e. the maximum distance between two nodes of the network. As far as we know, the question of the necessity of this knowledge to be able to deterministically solve total problems remains open.

In [START_REF] Godard | Snap-stabilizing tasks in anonymous networks[END_REF], the author proposes a snap-stabilizing TD algorithm to characterize tasks that are solvable with snap-stabilizing algorithms in anonymous networks. This algorithm combines the synchronization technique in [START_REF] Boleslaw | Terminating iterative solution of simultaneous equations in distributed message passing systems[END_REF] and the self-stabilizing enumeration algorithm in [START_REF] Godard | A self-stabilizing enumeration algorithm[END_REF]. The former actually uses a unison mechanism and requires that nodes know (an upper bound of) D. The latter works on a particular class of graphs (so called, non-ambiguous graphs [START_REF] Mazurkiewicz | Distributed enumeration[END_REF]) and implements a renaming mechanism that uses an a priori exponential memory size.

Many self-stabilizing algorithms aim at being silent, i.e., after some calculations, the communication registers used by the algorithm remain fixed as long as no request is made [START_REF] Dolev | Memory requirements for silent stabilization[END_REF][START_REF] Gouda | The alternator[END_REF]. By communication variable, we mean variables shared between neighboring nodes. Silence is trivially a desired property with algorithms that terminate by building distributed fixed structures-e.g., spanning trees, coloring, Maximal Independent Set, etc. It is also very desirable for so-called "long-lived" algorithms-e.g., mutual exclusion, unison, routing, etc.-to reduce communication operations and bandwidth. For instance, it is quite easy to design a self-stabilizing silent unison [GH99, BPV04] by modifying the above Condition (ii) as follows: (ii ) the clock value of each node is increased by 1, provided that at least one node decides to do it.

Contribution

In this chapter, we address asynchronous anonymous networks. We focus on terminating and silent self-stabilizing algorithms i.e., self-stabilizing algorithms that converge in finite time to a desired global configuration from which no values of the communication variables are changed thereafter. We present a generic, deterministic, silent algorithm that detects whether an observed terminating silent self-stabilizing algorithm has converged to a configuration that satisfies an intended predicate. Our solution uses similar techniques as in [START_REF] Boulinier | Snap-stabilizing waves in anonymous networks[END_REF] to achieve snap-stabilization, namely it is based on an underlying unison algorithm. However, in this chapter, the latter can be any (asynchronous) unison in the literature, e.g., [CFG92, BPV04, DJ19, EK21].

As all existing deterministic anonymous total algorithms in the literature (e.g., [SSP85, Tel88, BLP08, God19]), our algorithm requires that nodes know (an upper bound on) the diameter D of the network. It works under the weakest scheduling assumptions a.k.a, the unfair scheduler. Built over any asynchronous self-stabilizing underlying unison U, our solution adds only O(log D) bits per node, where D is the diameter of the network. Since there exists no unison algorithm with better space complexity -the best space complexity for the asynchronous unison is obtained in [START_REF] Emek | A thin self-stabilizing asynchronous unison algorithm with applications to fault tolerant biological networks[END_REF] with O(log D) bits -, the extra space of our solution is negligible w.r.t. the space complexity of the underlying unison algorithm. Time complexities are given in terms of rounds that captures the execution rate of the slowest node in any computation [CDD + 16, Dol00]. The response time computes the number of rounds between the time when a request is triggered and the time when the answer to that request is returned. The response time of our solution is in O(max(k, k , D)) rounds, where k and k are the stabilization time complexities of A and U, respectively. In other words, once both A and U are stabilized, our solution provides an answer in optimal time, i.e., O(D) rounds.

Chapter Outline

The remainder of the chapter is organized as follows. We first formally describe specific notations and definitions. Then, in Section 4.3, we formally define the unison problem, and establish some properties of self-stabilizing unison algorithms. In Section 4.4, we present and formally describe our snap-stabilizing algorithm for termination detection. Section 4.5 contains the proofs of our claims and theorems, and in particular we establish that our algorithm is snap-stabilizing for the termination detection problem. We make some concluding remarks in Section 4.6.

Model

Computational Hypothesis

In this chapter, we consider the port-unknown state model S PU , where nodes do not know the port number they were assigned by their neighbors. We also consider anonymous, uniform networks. The conjugation of these three parameters is the weakest assumption one can make on the network.

Nevertheless, we suppose that nodes all know an upper bound on the diameter of the network D. We do not suppose that all nodes have the exact same lower-bound. However, the time and space complexity of our algorithm depend on the highest value of that lowerbound in the network. To avoid unnecessary complications, we suppose in the following that all nodes have the same value D as an upper bound on the diameter of the network.

Our algorithm for termination detection relies on a self-stabilizing unison algorithm U. This algorithm is used as a black box, we only require that it eventually stabilizes in an execution satisfying the Unison requirements. On the other hand, the termination detection itself must be snap-stabilizing: it must not provide any incorrect output if no fault occurs during its execution. Classically, our algorithm can only detect the termination of a terminating, and thus silent, algorithm. The termination detection algorithm is itself silent too.

Finally, our termination detection algorithm works under any scheduler. Hence, it nevertheless requires that the observed algorithm terminates, which may be possible only under some specific scheduling assumptions.

Unison Algorithms

Algorithms solving Unison guarantee that all the nodes in the system have a variable clock that increases infinitely often, and such that any pair of neighboring nodes have a difference of at most one between their clocks. Let us denote by C the set of values that clock can take.

Since we consider nodes with finite memory, C must be finite. Therefore, to be infinitely increased, it is necessary that after some increase, the clock of some node reaches some value it has already taken. Therefore, in a valid execution, the values taken by clock must cycle.

Without loss of generality, we suppose that the values taken by clock contain some set Z/mZ, the modulo-m integer, for some value of m (which may depend on some parameters of the network).

To achieve maximal genericity, we consider that C can contain other values than the classical values in Z/mZ. Typically, C can contain control values such as ⊥, nil, etc. Notice that if the value of clock ∈ Z/mZ, then the usual arithmetic operations on clock are modulo-m operations. In the following, we consider the operations made on clock, specific to each algorithm, only when clock ∈ Z/mZ.

Let us formalize this in the following specification: E) is specified by the existence of a variable clock v on each node v ∈ V which takes values in C ⊇ Z/mZ, for some integer m.

Specification 4.1 (Unison) U (Unison) in G = (V,
A node v is non-faulty in γ if

P γ (v) ≡    ∀u ∈ N [v], clock γ u ∈ Z/mZ ∧ clock γ u ∈ {clock γ v -1, clock γ v , clock γ v + 1}
A configuration γ is correct if all nodes are non-faulty:

P γ U ≡ ∀v ∈ V, P γ (v)
An execution = γ 0 → • • • is correct if all the configurations γ i are correct (safety property) and if all the nodes have their variable clock increased infinitely many times (liveness property):

SP U ( ) ≡    ∀i ≥ 0, P γi U ∧ ∀v ∈ V, ∀i ≥ 0, ∃j > i : clock γj v = clock γi v + 1
An algorithm U is a self-stabilizing algorithm for Unison if Γ U P U and if any execution that starts in P U satisfies SP U .

Termination Detection Algorithms

Request-Based Algorithm A request-based algorithm RB is an algorithm that interacts with an external application App, typically an external user or another algorithm. This interaction takes place through one shared variable, req, that can be updated by the application. The variable req has four values: idl, on, wk, off. The value idl means that no request is in progress on node v for the application. Node v is then said idle. Value on means that a request is initiated, but the computation is not launched. Once the requested computation is running, req is set to wk. The fourth value, off indicates that the requested computation is done, but the result has not been communicated to the application yet. Variable req is updated through four methods. Two of them, ask and get, are part of App. The two others, R start and R stop , are part of RB-see Snap-stabilization is a suitable paradigm for request-based algorithms. Indeed, a snapstabilizing request-based algorithm ensures that if the application executes ask on one node v, then the following execution of get on the same node v will mark the end of a correct computation. We define the response time of a request-based algorithm as the maximal number of rounds between any computing step in which the application executes ask on any node v, and the following computing step in which the same node v updates req v to off.

Simulation Strictly speaking, a termination detection algorithm T runs on the same network as A the algorithm it observes. T has a read-only access to the variables of A, and A is executed exactly the same way as if it was not observed. To model this behavior in a didactic way, we reverse this paradigm. Rather than having T observe an independent execution, and to define triggers for each action taken by A, We consider that T is in charge of the execution of A. Both points of view are equivalent, and only differ in the writing conventions.

Yet, since T executes the code of A, we must assure that the behavior of A executed by T actually corresponds to real executions of A. We introduce the notion of simulation to formalize that constraint:

Definition 4.1 (Simulation)
An algorithm T is said to simulate an algorithm A if the variables of A are a subset of the variable of T , and if any (possibly infinite) execution of T , = (γ 0 -→

T γ 1 -→ T • • • ) corresponds to a legitimate execution of A, A = (γ 0|A -→ T γ 1|A -→ T • • • ) on the subset of the variables of A, with possibly empty computing steps γ i|A = γ i+1|A . is called a simulation of A.
The possible empty computing steps correspond to the fact that T might execute actions without any activation of rules of A.

Remark that our algorithm T will not only simulate A, but the unison algorithm U as well.

Termination Detection In this chapter, we consider the Snap-Stabilizing Termination Detection problem. An algorithm solves the termination detection problem on A if it simulates A, and if when a request is emitted on some node u, (req is set from idl to on), then u ultimately answers (i.e., req is set to off), and when it answers, algorithm A has terminated.

Let us state that more formally:

Specification 4.2 (Termination Detection) T D (Termination Detection) of a silent distributed algorithm A in G = (V, E) is specified by the presence of a variable req v ∈ {on, wk, off, idl} on each node v ∈ V . An execution = γ 0 → • • • is correct if: 1. is a simulation of A, 2. A terminates in 3. ∀t ≥ 0, ∀v ∈ V , if req γt v = on then 3-i ∃t > t : req v = off, and
3-ii ∀t > t : req v = off, A has terminated in γ t .
Remark that according to Definition 4.1, an execution that does not take any computing step of A is considered as a simulation of A. This does not fit our requirements, since we need that A terminates in any execution of T . For that reason, we add another requirement which forces A to terminate in executions of T .

Algorithm-Specific Notations

In the following, we will simultaneously consider three algorithms: the observed algorithm A, a unison algorithm U, and a termination detection algorithm T . To avoid confusions, we specify the algorithm to which our notations correspond by the following: The set of rules of algorithm X is denoted by R X . The subset of the variables of one node v specific to one algorithm X is denoted by state v|X .

Properties of Unison Algorithms

Preliminaries: Silent Unison Algorithms

The termination algorithm that we propose is silent. Yet, it simulates a unison algorithm, whose liveness property is the opposite of silence. Let us explain how to combine those two properties.

Any self-stabilizing unison algorithm can be made silent, with as consequence the loss of the liveness property. To do so, we can prevent the clock to increase if there is no request for it and the safety property is achieved. Essentially, if

P (v) and ∀u ∈ N v , clock u ∈ {clock v -1, clock v }, then v is not enabled. If the initial configuration of the system is correct (i.e. if P γ0
U ), then the system reaches a terminal configuration as soon as all the clock reach the highest initial value.

Yet, one may want to keep a silent self-stabilizing unison algorithm running as long as some external condition is not satisfied. This request notion may be extended with the concept of local request [START_REF] Boulinier | When graph theory helps self-stabilization[END_REF]. Silent self-stabilizing unison algorithms are equipped with one additional predicate LocReq(v) that depends on external parameters. When this predicate is evaluated to true on one node, then it takes precedence over the termination condition, and forces the system to keep running with respect to P U . In the following, we consider a silent self-stabilizing unison algorithm.

Rules of Unison Algorithms

In this section, we aim at proving global properties of unison algorithms. Since those properties must be true for any unison algorithm, the only tool on which we can reason is the specification of U, SP U . The main tool on which we reason is the fact that the predicate P U is closed. This means that once a correct configuration is reached, the system never becomes incorrect. But individual nodes do not have any information on the global correctness of the system. Before taking an action or not, the only information on which one node can rely is its local correctness. In other words, the specification of unison guarantees that a node v such that P (v) never executes an action that, isolated, could invalidate the correctness of the whole system. Let us first recall the definition of P (v):

P (v) ≡    ∀u ∈ N [v], clock u ∈ Z/mZ ∧ clock u ∈ {clock v -1, clock v , clock v + 1}
Let us consider a unison algorithm U. It will be useful for us to separate the rules of U into three distinct sets, depending on their guards. Let R U be the set of the rules of U.

Let us define the following predicates:

P + (v) ≡ P (v) ∧ ∀u ∈ N v , clock u = clock v -1 P -(v) ≡ P (v) ∧ ∃u ∈ N v : clock u = clock v -1.
Note that P + (v) and P -(v) are mutually exclusive, and, joined, equate P (v). We suppose without loss of generality that the guard of all the rules in R U contains ¬P (v), P + (v), or P -(v). If not, we make three copies of each rule, and add ¬P (v) to the guard of the first copy, P + (v) to the guard of the second copy, and P -(v) to the guard of the third copy.

Since U is a self-stabilizing algorithm, any rule that includes P (v) in its guard guarantees that its action will not invalidate P (v). Thus, actions that include P + (v) either increment clock v by one or do not update it. In the same way, actions that include P -(v) cannot update clock v , for it could lead to a difference of 2 between v and its neighbor u such that

clock u = clock v -1.
Among all the rules that include P + (v), we denote by R U N , and call the normal rules the rules whose action increases by 1 the variable clock v . These are the rules by which U makes progress. We denote by R U T and call the transparent rules all the other rules that include P (v) (either P -(v) or P + (v)), which do not update clock v by definition. Transparent rules do not necessarily exist in all unison algorithms, but cannot be avoided a priori. Finally, we denote by R U C and call the convergence rules all the other rules of R U , rules that include ¬P (v), and that enable convergence. By definition, U has stabilized if and only if no rule of R U C is enabled.

We define the sluggishness of U, and denote S(U) as the maximal number of consecutive transparent rules a node can execute between two executions of normal rules, after stabilization. Sluggishness depicts how much the transparent rules might slow down clock increment. Sluggishness of unison algorithms presented in [CFG92, BPV04, BPV08, DJ19, EK21] is 0.

Tools on Executions of Unison Algorithms

In this subsection we introduce logical tools that will be useful to reason on generic unison algorithms. Definitions 4.2 to 4.5 were introduced in [START_REF] Boulinier | Snap-stabilizing waves in anonymous networks[END_REF]. Definition 4.6 is original work and was designed specifically for our proof.

Our goal, in this section, is to prove that following the combination of the safety property and of the liveness property of the unison specification. Our goal, in this section, is to prove that, due to the combination of the safety property and of the liveness property of the unison specification, the activations of nodes during the execution of a unison algorithm reflect, somehow, long-distance interactions between nodes.

To illustrate this idea, assume that one node v, anywhere in the network, is blocked, i.e. never increases its clock. Therefore, its neighbors will eventually be blocked at 1 over the value of clock v . But then, the neighbors of v's neighbors will eventually be blocked at 2 over the value of clock v .

Step by step, we can see that the entire network will eventually be blocked, which means that one node may have an influence in the entire network. If at some point, v restarts increasing its clock, then its neighbors will be able to increase their own variable too. And after that, the neighbors of v's neighbors, and so on.

In order to formalize this notion of interactions, we must provide some definitions.

An event corresponds to a computing step in which one node executed a particular rule.

Definition 4.2 (Event)

Let = (γ 0 -→

U γ 1 • • • ) be a finite or infinite execution.
An event is a pair (v, t + 1) such that v is activated in γ t -→ U γ t+1 . We say that v executes a rule at time t + 1. By convention, (v, 0) is an event for all v ∈ V . An event (v, t) is said to be external if the guard of the executed rule by v depends on at least one shared register of a neighbor of v.

An event (v, t) is a normal (resp. transparent, resp. convergence) event if v executes a normal (resp. transparent, resp. convergence) rule at time t.

The causal relation

allows us to causally link two events that are not necessarily globally consecutive in an execution, due to activation of distant nodes, buy that are locally consecutive.

Definition 4.3 (Causal relation )

The causal relation is the smallest relation on the set of events such that the following two conditions hold:

1. Let (v, t) and (v, t ) be two events such that t is the greatest integer such that t < t. Then (v, t ) (v, t);

2. Let (v, t) and (w, t ) be two events such that (v, t) is an external event, w ∈ N v , t is the greatest integer such that t < t. Then (w, t ) (v, t).

The dependence relation N allows us to formalize the notion that a node increases its clock immediately after one other node increased its variable clock. Note that any activation of a convergence rule on the node that increased its clock first beaks the dependence relation.

We also denote by N the transitive closure of N .

Definition 4.4 (Dependence Relation N )

Let (v, t 0 ) and (w, t ) be two events. We say that (w, t ) normally depends on (v, t 0 ), and denote (v, t 0 ) N (w, t ) if there exists k ≥ 0 and t 1 , . . .

t k such that (v, t 0 ) (v, t 1 ) • • • (v, t k ) (w, t ) and
∀i > 0, (v, t i ) is a transparent event, and (w, t ) is a normal event.

We denote (v, t) N (w, t ) if there is a path w.r.t to N from (v, t) to (w, t ).

An N -sequence corresponds to consecutive clock increase on one node, without any execution of a convergence rule.

Definition 4.5 (N -sequence)

When a node v consecutively executes k normal rules, possibly intercut with transparent rules,

N (v, t 0 ) N (v, t 1 ) N • • • N (v, t k-1 )
it executes an N -sequence of length k.

A causal pyramid is the extension of the notion of dependence relation to interconnected interactions of neighbors to neighbors. Intuitively, if one node v executes numerous, say N , normal actions, then its neighbors will necessarily execute at least N -2 normal actions between the first and last action of v, and the neighbors of v's neighbors at least N -4 during the first and last action of their common neighbor with v, and so on. Once again, we consider that any execution of a convergence rule breaks the pyramid. A causal pyramid scheme is presented on Figure 4.2 We denote (i, j) the set of all integers k such that i < k < j.

Definition 4.6 (Causal pyramid)

Let p = v 0 v 1 . . . v k be a path of length k in G, and let us consider d ≥ 2k + 1. We say that p is a causal pyramid of length d and of origin

t 0 0 if ∀i ∈ [0, k], ∀j ∈ [i, (d -1) -i], ∃t i j such that • ∀i, we have t i i < t i+1 i+1 and t i+1 (d-1)-(i+1) < t i (d-1)-i • ∀i, v i does not execute rules of R U C in (t i-1 i-1 , t i-1 (d-1)-(i-1) ) • ∀i, v i executes an N -sequence N (v i , t i i ) N (v i , t i i+1 ) N • • • N (v i , t i (d-1)-i ) v 0 t 0 0 v 0 t 0 1 v 0 t 0 2 v 0 t 0 2k-2 v 0 t 0 2k-1 v 0 t 0 2k • • • N N N N N N N v 1 t 1 1 v 1 t 1 2 v 1 t 1 2k-2 v 1 t 1 2k-1 • • • N N N N N v1 : no RUC v1 : no RUC v 2 t 2 2 v 2 t 2 2k-2 • • • N N N v2 : no RUC v2 : no RUC Figure 4.2: Causal Pyramid Scheme: v 0 v 1 v 2 is a causal pyramid of length 2k + 1 and of origin t 0 0 Notice that if p is a causal pyramid, then (v 0 , t 0 0 ) N (v 1 , t 1 1 ) N • • • N (v k , t k k ) N (v k , t k (d-1)-k ) N • • • N (v 0 , t 0 d-1 ).

Properties of Unison Algorithms

In this section, we extend and adapt some of the results of [START_REF] Boulinier | Snap-stabilizing waves in anonymous networks[END_REF] to any unison algorithm, and establish Theorem 4.1 that will allow us to establish synchronization properties of our termination detection algorithm T .

Lemma 4.1

Let v and w be two neighbors. Suppose that v is a causal pyramid of length 3 and of origin t 0 , and that in (t 0 , t 2 ), w does not execute rules of R U C . Then vw is a causal pyramid of length 3 and of origin t 0 .

Proof : Let us denote by p the value of clockv at time t0 -1. Since v executes three consecutive normal actions, at time t0, t1, and t2, it increases its clock by three. Furthermore, since v executes a normal action at t0, we have P + (v) at t0 -1 and thus clockw is equal to p or p + 1. If w does not execute any normal action between t0 and t2, then when v executes its third normal action, at t2 -1, we have clockw ∈ {p, p + 1} and clockv = p + 2, so ¬P + (v), which is contradictory.

The following lemma directly follows by induction of Lemma 4.1 on the length of an N -sequence.

Lemma 4.2

Let v and w be two neighbors. Suppose that v is a causal pyramid of length This corresponds to the definition of vw being a causal pyramid of length d + 1.

Lemma 4.2 establishes a link between the behavior of two neighbors. By induction on the distance between v and any other process, Theorem 4.1 follows.

Theorem 4.1

Let v 0 and v k be two nodes, and let

p = v 0 v 1 • • • v k be a path. Suppose that v 0 . . . v k-1 is a causal pyramid of length d ≥ 2k + 1, and that in (t k-1 k-1 , t k-1 (d-1)-(k-1) ), v k does not execute rules of R U C . Then v 0 • • • v k is a causal pyramid of length 2k + 1.
Proof : We simply apply Lemma 4.2 to v k-1 , which is a causal pyramid of length d-2(k-1) ≥ 3 and of origin t k-1 k-1 . This implies that v k executes a N -sequence of length at least d -2k during (t k-1 k-1 , t k-1 (d-1)-(k-1) ), and thus v0 • • • v k is a causal pyramid of length 2k + 1.

Corollary 4.1

Let v 0 and v k be two nodes, and let p = v 0 v 1 • • • v k be a path. Suppose that v 0 is a causal pyramid of length 2k +1, and that ∀i,

v i does not execute rules of R U C in (t 0 , t 2k ). Then v 0 • • • v k is a causal pyramid of length 2k + 1.
Proof : We iterate Theorem 4.1 on v0, then on v0v1, and so on.

Algorithm

Let us consider a silent self-stabilizing algorithm A that solves a problem P under the unfair distributed scheduler. We introduce a generic mechanism that builds an anonymous silent snap-stabilizing request-based algorithm T that solves the Termination Detection of A.

Based on an anonymous self-stabilizing unison algorithm U, it follows the request-based mechanism described in Section 4.2.3. More specifically, for each node v, the algorithm communicates with the application App by means of req v -refer to Figure 4.1. To know whether A has terminated or not, App triggers a request to T by executing App : ask on some idle nodes v 1 , v 2 , . . . , v k of the system, setting the value of req vi , for i ∈ [1, k], from idl to on. Next, T answers to the request only after algorithm A has terminated, by setting req v to off. Then, App may execute App : get that sets req v to idl.

Scheme of Algorithm T

The main idea of our algorithm is that each node has a variable dedicated to detect the activity of algorithm A. When one node sees an activation of a rule of A (in our model, when one node simulates a rule of A), it sets its variable to its maximal value, and then decrease it by one at each activation. This variable is also used to propagate the information that A has been activated to the neighbors of the nodes. Namely, nodes increase their own variable if one of their neighbors has a non-zero value.

When a request is emitted on one node, this node sets another countdown to its maximal value, and decrease it at each computing step. If when this countdown reaches 0, it has not detected any activation of A from its neighbors, then it can answer that A has terminated. This works only if the decrease of both variables is relatively synchronized on the nodes of the system. This is why we need a unison algorithm. Both variables are synchronized with the clock of the unison algorithm. Therefore, thanks the properties established in Section 4.3, we can transfer properties of unison algorithms to our termination detection algorithm.

Variables

The variables of node v in algorithm T are:

• state v|A the set of all variables of node v in algorithm A.

• state v|U the set of all variables of node v in algorithm U, including clock v .

• da v ∈ [0, 2D + 2], for detection of activity. This variable is used to store the number of steps since the last time a convergence rule (for A or U) was executed by node v.

Variable da propagates through the whole system with the following rule: if the maximum value of da among the neighbors of v is p, then v cannot set da v under p -1.

• dt v ∈ [0, 2D + 1], for detection of termination, is a countdown to 0, initiated at 2D + 1 when the application asks for the termination.

• req v ∈ {on, wk, off, idl}, for request, is the interface between App and T . req v may be updated according to Figure 4.1.

The space complexity of the variables of T is O(log D) bits per node, where D is an upper bound of the diameter of the graph. Consequently, the space complexity of the whole system is O(S(A) + S(U ) + log D) bits per node, where S(A) (resp. S(U)) is the space complexity of algorithm A (resp. of algorithm U) in bits per node.

Overview of the algorithm

The detail of the rules of algorithm T is presented in Algorithm 1. Algorithm T simulates both algorithms A and U, independently. When an enabled node v is activated, v atomically executes the rule of A for which it is enabled, if such rule exists, the rule of U for which it is enabled, if such rule exists, and updates the proper variables of algorithm T .

Since algorithm T performs two distinct and independent tasks: the simulation of A and U, on the one hand, the detection of termination, on the other hand, it is natural to divide the set of the rules of T , R T , in two disjoint sets: R S simul and R S proper . A node is enabled for T if it enabled for at least one rule of R S simul or R S proper . If an enabled node is activated, then it atomically executes the rule of R S simul for which it is enabled, if such a rule exists, and the rule of R S proper for which it is enabled, if such a rule exists. R S simul contains the rules which simulate algorithms A and U, and also updates the variable da. To facilitate reasoning, we distinguish several cases depending on which rules are enabled for A and U. simul . If the activated node v has not yet converged for both A and U, then it executes a convergence rule for at least one of those algorithms and sets its variable da v to 2D + 2. The set of all convergence rules is denoted R cvg , and it contains the following rules:

R U C cvg , R N cvg , R A cvg .
Those rules differ by the precise rules of A and U they simulate. Be aware that the rules of R cvg are not necessarily convergence rules in the sense of unison algorithms. More precisely, R cvg contains the convergence rules relative to U, but also the convergence rules relative to A.

Otherwise, if w is only enabled for a transparent rule of U, then it executes R trans ∈ R S simul and nothing else. Finally, if v is only enabled for a normal rule of U then v executes the rule R wait ∈ R S simul , which sets da v to one less than the maximum value of da of the closed neighbors of v. As a consequence, as long as one node v has not converged for A, variable da is maintained at 2D + 2 on v. When activated, the neighbors of v set their variable da to 2D + 1 (or 2D + 2 if one rule of R cvg is activated). After that, if one neighbor of a neighbor of v is activated, then it sets its variable da to at least 2D, and so on. Thus, if one node is enabled for a convergence rule, then the variable da will propagate at high value along the graph. Yet, this property requires that all the nodes are activated, in a specific order. For T , convergence (resp. transparent, resp. normal) rules are rules simulating a convergence (resp. transparent, resp. normal) rule of U. We extend that definition to R A cvg , which is a transparent rule.

R U C R U T R U N ¬R U R A R U C cvg R A cvg R N cvg R A cvg ¬R A R U C cvg R trans R wait
Fortunately, since U is a unison algorithm, no node, and no subset of nodes, may compute independently of the rest of the system, and decrease its variable da down to 0 regardless of what happens in the whole system. This guarantees that, starting from any configuration, after a node v executes 2D + 1 computing steps, the variable da v is under the influence of all the other nodes of the system. Consequently, after 2D + 1 computing steps of node v, the variable da v cannot be 0 unless all the nodes in the graph have converged for both A and U. This property allows us to design our procedure thanks to the variable dt.

Whenever App asks one node v for the termination of the algorithm, v executes rule R start , it sets its variable dt v to 2D +1 and updates its variable req v from on to wk. Variable dt v is decreased by one each time a normal rule of U is executed, by rule R cpt , and is updated to 2D + 1 as soon as da v = 0 by rule R end . Since U is a unison algorithm, in a legitimate execution dt v reaches 0 (and therefore an answer is produces through rule R stop ) only after all nodes have converged for A. As a desired consequence, algorithm T is snap-stabilizing for the detection of termination for algorithm A.

Predicates

Let RS ∈ R A , R U , R U C , R U T , R U N be
the set of the rules of one algorithm, and let v be a node. Act(RS, v) returns true if and only if node u is enabled by a rule of RS.

Act(RS, v) ≡ v is enabled by one rule of RS (4.1)
As described in Section 4.3.1, we consider a silent self-stabilizing unison algorithm U. In T , the normal rules of U, denoted R U N , are not enabled on node v unless the following predicate LocReq(v) is evaluated to true.

LocReq(v) ≡ (∃u ∈ N v : clock u = clock v + 1) Act(R A , v) (da v = 0) (req v ∈ {on, wk}) (4.2)
When both algorithm A and U have converged on node v, the only simulation rules that v may execute are the normal rules of algorithm U, which permit the liveness of U. This situation is described by the predicate UnisonOnly.

UnisonOnly(v) ≡ ¬Act(R A , v) ∧ Act(R U N , v) (4.3)

Actions

Let RS ∈ R A , R U , R U C , R U T , R U N be
Simul(v) ≡ SimulR(R A , v); SimulR(R U , v) (4.5)
Procedure Propagate_da(v) updates the variable da v to one less than the maximal value of da of the closed neighbors of v:

Propagate_da(v) ≡ da v := max(0, max u∈N [v] (da u -1)) (4.6)

Correctness of Algorithm T

In this section, we establish that T is a snap-stabilizing procedure for the detection of the termination of Algorithm A. This proof is divided in four subsections.

Algorithm 1: Algorithm T During a step, if a rule of set R S simul and a rule of set R S proper are enabled then v executes these 2 rules.

R S

simul :: rules to update da

R U C cvg : Act(R U C , v) -→ Simul(v); dav := 2D + 2 ∈ R T C R A cvg : Act(R A , v) ∧ ¬ Act(R U C , v) ∨ Act(R U N , v) -→ Simul(v); dav := 2D + 2 ∈ R T T Rtrans : ¬Act(R A , v) ∧ Act(R U T , v) -→ Simul(v) ∈ R T T R N cvg : Act(R A , v) ∧ Act(R U N , v) -→ Simul(v); dav := 2D + 2 ∈ R T N R wait : UnisonOnly(v) -→ Simul(v); Propagate_da(v) ∈ R T N R S
proper :: rules to update dt and req

Rstart :

req v = on -→ req v := wk; dtv := 2D + 1 Rstop : req v = wk ∧ UnisonOnly(v) ∧ dtv = 0 ∧ dav = 0 -→ req v = off Rcpt : req v = wk ∧ UnisonOnly(v) ∧ dtv = 0 ∧ dav = 0 -→ dtv := dtv -1 R end : req v = wk ∧ UnisonOnly(v) ∧ dav = 0 -→ dtv := 2D + 1
In Subsection 4.5.1, we prove that T satisfies both Conditions 1 and 2 of Specification 4.2.

In Subsection 4.5.2, we prove that T satisfies Condition 3i of Specification 4.2.

Finally, in Subsection 4.5.3, we prove that T satisfies Condition 3ii of Specification 4.2.

We also prove in Subsection 4.5.4 the time complexity of our algorithm.

Simulation properties of T

In this section, we establish Theorem 4.2, which ensures that T satisfies Condition 1 and Condition 2 of Specification 4.2.

Theorem 4.2

T is a simulation of both A and U, and in any execution of T , both A and U ultimately converge.

Theorem 4.2 is a consequence of Lemmas 4.4, 4.6, and 4.7.

Before anything else, let us establish Lemma 4.3, that characterizes the terminal configurations of T . These configurations are the one in which U converged, and in which on all the nodes v of the system, LocReq(v) is not verified (this includes the termination of A).

Lemma 4.3

The terminal configurations of T are the configurations such that ∀v ∈ V :

¬Act(R U , v) ∧ ¬LocReq(v) Proof : Let γ be a terminal configuration of T . If ∃u ∈ V : Act(RA, v) ∨ Act(RU , v), then one rule of R S simul is enabled on node v, so ∀v ∈ V, ¬Act(RA, v) ∧ ¬Act(RU , v).
Furthermore, since U is a self-stabilizing algorithm, it satisfies the liveness property. Thus, unless all the nodes v ∈ V satisfy ¬LocReq(v), there exist enabled nodes in the system. Consequently,

∀v ∈ V, (∀u ∈ Nv, clocku ∈ {clockv -1, clockv}) ∧ ¬Act(RA, v) ∧ dav = 0 ∧ (req v ∈ {off, idl}).
Conversely, such configurations are terminal configurations. The rules of R S simul are not enabled because ∀v ∈ V, ¬Act(RA, v) ∧ ¬Act(RU , v), and the rules of R S proper are not enabled because ∀v ∈ V, req v ∈ {off, idl}.

By the definition of the actions of T , any execution of T simulates both Algorithm A and Algorithm U. This is stated in Lemma 4.4.

Lemma 4.4

Any execution of T is a simulation of both A and U.

Proof : The only action that updates the variables of state v|A (resp. of state v|U ) is SimulR(RA, v) (resp. SimulR(RU , v)). It is applied only if the activated nodes are enabled for A (resp. for U). Thus, the execution of T is a simulation of A (resp. of U).

Since A is a silent self-stabilizing algorithm, there do not exist infinite executions of A. Since executions of T are simulations of executions of A, then the number of computing steps of an execution of T that execute a rule of A is finite. This is stated in Lemma 4.5, and will be useful to prove the convergence of U.

Lemma 4.5

In any execution of T , a finite number of computing steps execute rules of A.

Proof : Let = (γ0 -→ T γ1 -→ T • • •
) be an execution of T . Suppose there exists an infinite number of computing steps of that execute rules of A.

Then, A = (γ 0|A -→ T γ 1|A -→ T • • • ) is an infinite execution of A.
Since A is a silent self-stabilizing algorithm under the unfair scheduler, it converges in finite time in any execution of A. Thus, such infinite execution does not exist.

Since A is activated only a finite number of times, and since U is a self-stabilizing algorithm, it indeed ultimately converges in any execution of T . This is stated in Lemma 4.6.

Lemma 4.6

U converges in any maximal execution of T .

Proof : Let = (γ0 -→ T γ1 -→ T • • •
) be a maximal execution of T . According to Lemma 4.5, we can assume without loss of generality that in , no rule of Algorithm A is executed. Let us reason by contradiction and suppose U does not converge in . According to Lemma 4.3, cannot contain any terminal configuration, so is an infinite execution. Since U is a selfstabilizing algorithm under the unfair scheduler, it converges in finite time in any execution of U. If contains an infinite number of computing steps that execute rules of U, then U converges. Consequently, there only exists a finite number of such computing steps. We now consider an infinite suffix of that does not contain any rule of U nor of A. All the rules of R S simul induce a rule of U or A. Furthermore, the predicates of Rstop, Rcpt, and R end all include UnisonOnly which is the guard of Rwait. The only rule executed in is Rstart, but it cannot be executed twice on a node v without v executes the rule Rstop (and several times Rcpt) in the meantime. This is contradictory. Consequently, U converges in .

Finally, since U is a unison algorithm, all the nodes are regularly activated in any execution, and since A is a self-stabilizing algorithm, this implies that the convergence of A ultimately occurs in any maximal execution of T . This is stated in Lemma 4.7.

Lemma 4.7

A converges in any maximal execution of T .

Proof : Let us consider = (γ0 -→ T γ1 -→ T • • • ) a maximal execution of T .
According to Lemma 4.6, we can assume without loss of generality that in γ0, U has already converged. Since U is a unison algorithm and since Act(RA, v) is included in LocReq(v), the correctness of U ensures that as long as A has not converged, all the nodes are regularly activated. Since A is a self-stabilizing algorithm for the unfair scheduler, this guarantees that A converges.

This completes the proof of Theorem 4.2.

Remark 4.1

Since T is a simulation of U, we can extend the results of Section 4.3.4 to the executions of T . To do this, we extend to T the concepts of normal, transparent, and convergence rule, normal dependence relation, and N -sequence. T has one convergence rule R U C cvg , two transparent rules R A cvg and R trans , and two normal rules R N cvg and R wait . Specifically, Theorem 4.1 and Corollary 4.1 remain valid on T .

Termination of T

In this section, we establish that maximal executions of T satisfy Condition 3i of Specification 4.2 (Theorem 4.4).

We define Γ cvg ⊂ Γ the set of configurations in which A has stabilized and U has converged, and Γ da the set of configurations in which, in addition, ∀v, da v = 0. Lemma 4.8 states that Γ da is an attractor.

Definition 4.7

Let

Γ da ⊂ Γ cvg ⊂ Γ be Γ cvg : ∀v ∈ V, (¬Act(R A , v) ∧ ¬Act(R U C , v)) Γ da : ∀v ∈ V, (¬Act(R A , v) ∧ ¬Act(R U C , v) ∧ da v = 0) Lemma 4.8 Γ T Γ cvg T Γ da
Proof : Γcvg is closed since A and U are self-stabilizing algorithms. Theorem 4.2 ensures Γ T Γcvg. Let us prove that Γ da is closed. Let γ -→ T γ be a computing step such that γ ∈ Γ da . Since γ ∈ Γcvg which is closed, γ ∈ Γcvg. In γ, no rule of Rcvg is enabled, so only Rwait may update da. But since ∀v ∈ V, da γ v = 0, then Propagate_da(v) has no effect. Thus, γ ∈ Γcvg. Let us now prove that T converges to Γ da from Γcvg. Let γ0 ∈ Γcvg be a configuration, and let us consider a maximal execution = (γ0 -→

T γ1 -→ T • • • ).
According to Lemma 4.3, if is finite, then the terminal configuration belongs to Γ da . We suppose now that this execution is infinite. Since Γcvg is closed, we are only interested in the value of da.

Let us consider Ci = maxv∈V da γ i v . If C0 = 0, then γ0 ∈ Γ da . Otherwise, since is infinite, and U is a unison algorithm, and R A cvg is not enabled in Γcvg, all the nodes execute Rwait infinitely many times. Let i1 such that before reaching γi 1 , all the nodes have executed Rwait. We have Ci 1 < C0. By induction, there exists a time t such that Ct = 0, so we obtain γt ∈ Γ da .

Finally, we define Γ v

dt where v ∈ V , as the set of the configurations of Γ da such that req v ∈ {off, idl}. Theorem 4.3 states that any execution that starts in Γ da eventually reaches a configuration of Γ v dt .

Definition 4.8

Let v ∈ V . Let Γ v dt ⊂ Γ da be the set of configurations such that, ∀u ∈ V :

(¬Act(R A , u) ∧ ¬Act(R U C , u) ∧ da u = 0) ∧ req v ∈ {off, idl} Theorem 4.3
Let v ∈ V be a node and = (γ 0 -→

T γ 1 -→ T • • • ) be a maximal execution such that γ 0 ∈ Γ da . There exists i ≥ 0 : γ i ∈ Γ v dt . Proof : Suppose γ0 / ∈ Γ v dt , i.e. req γ 0 v ∈ {on, wk}. Case 1: req γ 0 v = wk. Since Γ da is closed, the only rules of R S
proper enableds on v are Rstop and Rcpt. As long as req v ∈ {on, wk}, LocReq(v) is satisfied, and since U is a unison algorithm, it makes progress, which means that Rwait is regularly activated on all nodes. Thus, as long as dtv = 0, Rcpt is regularly activated by v. Since each activation of Rcpt by v decreases dtv by 1, it ultimately reaches 0, after what Rstop is activated by v, and then, the system has reached Γ v dt . Case 2: req γ 0 w = on. Then the previous guarantees as well that node w will eventually be activated, through rule Rstart, after which req w = wk, which is the case above.

Lemma 4.8 and Theorem 4.3 basically prove that, whatever the initial configuration, the system globally converges to Γ da , and each node is infinitely often in an availability state for the app. This proves that T satisfies Condition 3-i of Specification

Snap-stabilization

In this section, we establish that maximal executions of T satisfy Condition 3ii of Specification 4.2 (Theorem 4.7).

The activation of R start by v corresponds to the request by v to detect the termination of Algorithm A. The activation of R stop by v corresponds to the detection of the termination of Algorithm A by v. Lemma 4.9 states that v will eventually execute the rule R stop along any execution starting by a termination detection request by v (i.e. the activation of R start by v). This lemma allows us to define, for a maximal execution starting by a termination detection request by v, the response time to v's request: f , the time of the first computing step in which v executes the rule R stop . This is stated in Definition 4.9.

Lemma 4.9

Let v ∈ V and let = (γ -→

T γ 0 -→ T γ 1 -→ T • • • ) be a maximal execution such that v executes R start in γ -→ T γ 0 . ∃i > 0 such that in γ i-1 -→ T γ i , v executes R stop .
Proof : This is a direct corollary of Theorem 4.4

Definition 4.9 (Time of Response)

Let v ∈ V and let = (γ -→ T γ 0 -→ T γ 1 -→ T • • • ) be a maximal execution such that v executes R start in γ -→ T γ 0 .
We denote by f(v, ), or simply f the time of response of v in , which is the smallest i > 0 such that during

γ i-1 -→ T γ i , v executes R stop .
To prove that T satisfies Condition 3-ii of Specification 4.2, we only have to prove that A has terminated in γ f .

Before an answer is provided by T , a lot of computations can be required. Notably, v can execute R end numerous times, which resets dt v up to its maximal value. In our reasoning, we will focus on the subexecution that follows the last time v resets dt v , which is the part where v does not see any activity from A during a sufficiently long period of time for it to answer. This is presented in

f = (γ -→ T γ 0 -→ T • • • -→ T γ f -1 ). If v executes R end along f then let us define cs s = γ s-1 -→ T γ s , the latest computing step of f in which v executes R end .
Otherwise we set s = 0 and cs s = γ -→ T γ 0 . Remark that cs s is the latest computing step of f in which v executes a rule that sets dt v at 2D + 1.

We denote by s the final descent of v in , s = γ s -→

T γ s+1 -→ T • • • -→ T γ f -1 .
In the sequel of this section, we study the properties of s . We establish in Theorem 4.6 that γ s ∈ Γ cvg . As Γ cvg is closed, we also have γ f ∈ Γ cvg : a terminal configuration of A is reached when the answer is provided. Basically, the scheme of the following is:

Proposition 4.1
To prove that in γ s , A has terminated, we must prove that if A had not, then:

1. a rule of A would be executed on one node u, and 2. this action would have been transmitted to node v before f , postponing γ s .

For the sake of the proof, we aim at finding one early such activation of a rule of A.

We prove the first part of Proposition 4.1 in Theorem 4.5, and the second part in the proof of Theorem 4.6 (which is a proof by contradiction, so the statement of Theorem 4.6 concludes that A has terminated in γ s ). Then,

2D + 1

dt v time γ γ 0 R start γ 1 R end γ s R end γ f R stop final descent s
da γ i v = 2D + 2. By construction, v executes Rstop in γ f -1 -→ T γ f .
According to the algorithm and guard definitions, v also executes Rwait in

γ f -1 -→ T γ f . Let us consider csj = γj-1 -→ T γj the first computing step of γi -→ T • • • -→ T γ f -1 -→ T γ f in which v executes Rwait.
We have da γ i v = 2D + 2, and only Rwait can decrease dav, so da

γ j-1 v = 2D + 2. Since
v executes Rwait in csj, we also have UnisonOnly γ j-1 (v). By construction of Algorithm 1, v executes R end in csj, which is contradictory with the definition of γs. Thus, v does not execute any rule of Rcvg in s.

Let us now prove that v executes an N -sequence of length at least 2D + 1 in s. The only rule of R S proper executed by v along s is Rcpt, because req v = wk and because, by definition, Rstop and R end are not executed.

During the -subexecution s, v executes Rcpt exactly 2D + 1 times, since dt γs v = 2D + 1 and dt Let us introduce anchors, that are nodes which execute a convergence action (and thus reset da at its maximal value) at their first activation during some execution. Anchors are natural candidates to prove point 1 of Proposition 4.1.

γ f -1 v = 0.

Definition 4.11 (Anchor of an execution)

Let u ∈ V and let = (γ -→

T γ 0 -→ T • • •
) be an execution. We say that u is an anchor of if during , u executes a rule that is not R start , and if the first rule different from R start executed by u is a rule of R cvg .

We now introduce Theorem 4.5 that establishes that if an execution does not respect Condition 3-ii of Specification 4.2 then there exists an anchor of that execution. Theorem 4.5 is a direct consequence of Lemmas 4.12 and 4.13.

Theorem 4.5

Let v be a node and let = (γ -→

T γ 0 -→ T γ 1 -→ T • • • ) be a maximal execution such that v executes R start in γ -→ T γ 0 . If γ s / ∈ Γ cvg ,
then there exists a node u that is an anchor of s .

We first establish by contradiction that, if is an execution that starts in a configuration where A or U has not stabilized, and such that all nodes are activated, then at least one node executes a convergence rule for A of U during . This is formally stated in Lemma 4.11.

Lemma 4.11

Let = γ 0 -→

T γ 1 -→ T • •
• be a finite or infinite execution such that all the nodes of V execute at least once a rule that is not R start in . If γ 0 / ∈ Γ cvg , then there exists u ∈ V that executes a rule of R cvg in .

Proof : Since γ0 / ∈ Γcvg, then ∃u ∈ V : Act γ 0 (RA, u) ∨ Act γ 0 (RU C , u). Case 1: Act γ 0 (RA, u). Let csu = γu -→ T γ u be the first computing step of in which u is activated. If in csu, u executes a rule of Rcvg then our proof is complete. Otherwise, it means that in γu, ¬Act(RA, u). This is possible only if one neighbor u of u updates state u |A before γu, and thus u executes a rule of Rcvg in .

Case 2: Act γ 0 (RU C , u). This means that ¬P γ 0 (u). Thus there exists u ∈ Nu such that

clock γ 0 u / ∈ {clock γ 0 u - 1, clock γ 0 u , clock γ 0 u + 1}. Let csu = γu -→ T
γ u be the first computing step of in which u executes a rule that is not Rstart.

If in csu, u executes a rule of Rcvg then our proof is complete. Otherwise, it means that in P γu (u). This is possible only if before γu, u executes a rule that updates state u |U . Let cs u = γ u -→ T γ u be the first activation of u that updates state u |U . By construction, ¬P γ u (u ) since the clocks of u and u are unsynchronized. Consequently, in cs u , u executes a rule of Rcvg.

We now establish that if an execution does not respect Condition 3-ii of Specification 4.2 then there exists a node that executes a convergence rule for A of U during a final descent s . Once again, we reason by contradiction, and observe that we can use Lemma 4.10 and Corollary 4.1. This is stated in Lemma 4.12.

Lemma 4.12

Let v be a node and let = (γ -→

T γ 0 -→ T γ 1 -→ T • • • ) be a maximal execution such that v executes R start in γ -→ T γ 0 . If γ s / ∈ Γ cvg ,
(v = v0)v1 • • • v k-1 (v k = w) a path of length k ≤ D.
According to Lemma 4.10, v executes an N-sequence of length at least 2D + 1 in s, which means that v is a causal pyramid of length 2D + 1. Since we supposed that no node executed rules of Rcvg in s, we can apply Corollary 4.1:

v0v1 • • • v k-1 v k is a causal pyramid of length 2D + 1. In particular, v k executes Rwait in s.
We can therefore apply Lemma 4.11, which ensures that there exists a node u that executes a rule of Rcvg in s.

Finally, we prove that if there exists a node that executes a convergence rule for A of U during a final descent s , there exists an anchor of that execution. Indeed, consider cs a the first computing step of s where a node executes a convergence rule, and consider u a node that executes a convergence rule during cs a . Then, necessarily, the first activation of u during s happens at cs a . This is formally stated in Lemma 4.13.

Lemma 4.13

Let = γ 0 -→

T γ 1 -→ T • •
• be a finite or infinite execution such that there exists one node w that executes a rule of R cvg in . Then there exists u ∈ V that is an anchor of . Act(RA, u) remains constant during a too, and thus is evaluated to true all along a since in csa, u updates state u|A . Thus, any activation of u during a implies that u updates state u|A . This means that csa is the first activation of u in .

Case 2: in , w executes a rule of Rcvg that simulates a rule of RU C .

Let cs = γa -→ T γ a be the first computing step of in which one node u executes a rule of Rcvg that simulates a rule of RU C , and let us consider one such u. In γa, ¬P (u). Recall that normal and transparent rules cannot invalidate P (v), on any node v ∈ V . Thus, since before γa, no node executes rules of RU C , and in γa, ¬P (u), we have ¬P (u) all along

a = γ0 -→ T γ1 -→ T • • • -→ T γa. Therefore, the first activation of u different from Rstart during a is a rule of Rcvg.
The combination of that last result and of the previous one terminates the proof of Theorem 4.5. Theorem 4.6 is a consequence of Theorem 4.5. We show that if there exists an anchor of , then a contradiction is raised, thus the premisses of Theorem 4.5 do not hold. In the proof, we consider a causal pyramid of maximal length with origin v that ends near a node u, such that u executes a convergence rule before the action of the last node of the pyramid. We then prove that variable da spreads down the pyramid from u to v, which leads to the conclusion that v executes R end during s , raising a contradiction.

Theorem 4.6

Let v be a node, and let = (γ -→

T γ 0 -→ T γ 1 -→ T • • • ) be a maximal execution such that v executes R start in γ -→ T γ 0 .
We have: γ s ∈ Γ cvg .

Proof : Let us reason by contradiction and suppose that γs / ∈ Γcvg. According to Theorem 4.5, there exists a node u such that in s, u executes a rule of Rcvg before any execution of Rwait. Let us consider a path p of length k ≤ D between v and u: p

= (v = v0v1 • • • v k = u).
According to Lemma 4.10, v0 is a causal pyramid of length 2D + 1.

Case 1:

v0v1 • • • v k is not a causal pyramid of length 2D+1. Let q be such that v0v1 • • • vq is a causal pyramid of length 2D + 1 and v0v1 • • • vqvq+1 is not a causal pyramid of length 2D + 1. According to Theorem 4.1, vq+1 executes R U C
cvg during (t q q , t q 2D-(q-1) ). Furthermore, by definition there exists (vq,

t q 2D-q ) N • • • N (v0, t 0 2D ). Case 2: v0v1 • • • v k is a causal pyramid of length 2D + 1. Let q = k -1. By definition there exists (v k , t k (2D)-k ) N • • • N (v0, t 0 2D
). In both cases, we have (vq,

t q 2D-q ) N • • • N (v0, t 0 2D
) and vq+1 executes a rule of Rcvg before (vq, t q 2D-q ). We will now prove that there is a contradiction. The fact that one node near the pyramid executes a convergence rule before a dependance relation path N necessarily implies that v will receive a non-zero value for da before the end of its N -sequence, which will force it to execute R end . This is contradictory with the definition of final descent.

Let us consider γ t q+1 -→ T γ t q+1 the first computing step in which vq+1 execute a rule of

Rcvg in s. Remark that in γ t q+1 , dav q+1 = 2D + 2. Let us now define, t i , ∀i ≤ q, such that γ t i -→ T γ t i is the first computing step of γ t i+1 -→ T • • • in which vi executes Rwait. Such integers exist since (v k , t k (2D)-k ) N • • • N (v0, t 0 2D
) exists, and we have ∀i, t i ≤ t i 2D-i . Let us remark that dav i can decrease only when vi executes Rwait, and that according to Lemma 4.1, a node cannot execute more than twice Rwait or R N cvg before its neighbors execute Rwait or R N cvg . Thus, in γ t q , dav q+1 ≥ 2D, so in γ t q , dav q ≥ 2D -1. By induction, we obtain that ∀i, in γ t i

,

dav i ≥ 2D -1 -2(q -i). Since q ≤ k -1 ≤ D -1, in γ t 0 , dav ≥ 2D -1 -2q ≥ 1.
Let us now consider the first rule executed by v at time t > t 0 . As da

γ f -1 v = 0, t < f .
This rule does not belong to Rcvg according to Lemma 4.10. As req

γ t k v
= wk, this rule cannot be Rstart. Therefore, v executes Rwait at time t, and since da γ t v = 0 and req γ t v = wk, v also executes R end at time t. There is a contradiction with the definition of γs.

We can now use Theorem 4.6 to prove that maximal executions of T satisfy the last condition of Specification 4.2: Condition 3-ii By definition, t occurs after γact in , since req v = on as long as v does not execute Rstart. More precisely, the first t such that req

γ t v = off is γ f .
The execution satisfies the premises of Theorem 4.6 and thus we have γs ∈ Γcvg. In particular, A has terminated in γs. Since γ t occurs after γs, and since termination of A is a closed property, this guarantees that A has terminated in γ t .

Time complexity

Definition 4.12 (Full Round)

Recall that the sluggishness of U is the maximal number of transparent rules a node can execute between two normal rules, in a stabilized execution. A full round of an execution is defined as 1 + S(U) rounds.

The notion of full round is the suitable notion to evaluate the time of response of our snap-stabilizing algorithm, since Algorithm U is for us a black box. Recall that, for unison algorithms presented in [CFG92, BPV04, DJ19, EK21], the notion of full round is identical to the more classical notion of round. Proof : Theorem 4.2 guarantees that all the rounds are finite.

During one full round, all nodes u such that ∀w ∈ Nu, clockw ∈ {clocku, clocku + 1} are activated and execute rule Rwait. These activations imply that minw∈V clockw increases by at least one each full round. Since, at any moment, the maximal difference between the clocks of two nodes is D, we obtain that ∀k ∈ N, during D + k full rounds all the nodes are activated at least k times. After D + 1 full rounds, all the nodes are activated, and the following property holds for any node u in any configuration: dau = maxw∈V daw ∧ dau > 0 ⇒ UnisonOnly(w). In other words, the nodes with maximal value of da are enabled for the rule Rwait. This implies that the maximal value of da decreases by at least one in each full round. This ensures that after at most 3D + 3 full rounds, the system is in Γ da . Moreover after D + 2D + 2 more full rounds, all the nodes are activated at least 2D + 2 times, so v executes Rcpt 2D + 1 times, after which it executes rule Rstop.

We established that f occurs in at most 6D + 5 = O(D) full rounds after the execution of Rstart by v.

Conclusion

In this chapter, we introduced a generic, deterministic, snap-stabilizing, silent algorithm that solves Termination Detection in asynchronous networks. Our solution works assuming an unfair scheduler. It has the nice feature of working in anonymous networks, but requires that each node knows (an upper bound on) the network diameter D. The space complexity of our solution is O(log D) bits per node, and provides an answer in O(max(k, k , D)) rounds, where k and k are the stabilization time complexities of the observed and the unison algorithms, respectively. We have endeavored to provide a generic algorithm that works with any self-stabilizing unison algorithm in the literature, e.g., [CFG92, BPV04, DJ19, EK21].

Introduction

In this chapter, we are interested in the problem of Token Circulation in a distributed system. The objective is to maintain one single token circulating in the network, from one node to another, the token fairly visiting every node infinitely often. It is one very common way to achieve global mutual exclusion, a fundamental problem in distributed systems. This problem inherently requires that the token holder can designate a unique neighboring node to pass the token to. This single task is actually, challenging as soon as we consider wireless networks, in which each transmitted message is identically received by all of the transmitter's neighbors.

The contribution of this chapter is fourfold. First, we present the first token circulation algorithm for rooted wireless networks that uses only O(log log n) bits per node for communications. This is an exponential improvement compared to the classical addressing. Second, our algorithm assumes a Destination-Oriented Directed Acyclic Graph (DODAG) spanning the network. DODAGs are very desirable in wireless networks because, conversely to rooted spanning trees, they allow multiple communication paths and do not require that nodes distinguish one unique parent. Third, our algorithm has the very desirable property of being self-stabilizing, i.e., starting from a configuration where zero or more than one token circulate in the network, the system is guaranteed to eventually behave correctly, i.e. a unique token eventually fairly visits every node infinitely often. Finally, we show that our algorithm is optimal in terms of space complexity. Meaning that, for every n-node wireless network, no token circulation algorithm can use less than Ω(log log n) bits of memory per node, even given a rooted spanning tree and even without considering self-stabilization.

Motivation

Token Circulation, also referred to as token passing is a fundamental problem that consists in guaranteeing that a single token circulates from one node to another, the token fairly visiting every node infinitely often. It captures the objective of perpetually and fairly allocating a resource to the nodes of a distributed system, while insuring mutual exclusion. We are interested in self-stabilizing [START_REF] Edsger | Self-stabilizing systems in spite of distributed control[END_REF] token circulation in distributed systems. A typical example of such systems is the celebrated Dijkstra's stabilizing token ring algorithm, which guarantees that a unique token is circulating among the n nodes of a ring-shaped network.

A self-stabilizing algorithm must return the system to a correct behavior whatever its initial configuration. In the context of token circulation, examples of initial arbitrary system configurations are scenarios in which no token exists in the network, or several tokens exist in the network. To satisfy the requirement of self-stabilization, a distributed token circulation algorithm must return in finite time the system in a configuration that contains exactly one token. It must actually do more than that, as the presence of a unique token is not sufficient. Indeed, the algorithm must also guarantee that, eventually, this unique token is circulating fairly among the nodes. Following the seminal work of Dijkstra [START_REF] Edsger | Self-stabilizing systems in spite of distributed control[END_REF], token circulation has been widely investigated deterministically in the context of self-stabilization, on rings [BP89, GH96], on acyclic networks [BGW89, Gho93, PV07], and on arbitrary shaped networks [HC93, DIM93, JB95, DJPV00, CDPV06, PV07, CDV09], to quote only a few.

All the above algorithms were written in the state model [START_REF] Edsger | Self-stabilizing systems in spite of distributed control[END_REF], where the communications between the nodes are modeled by the ability for a node to atomically read the content of its neighbors registers, and update its own registers. Hence, they all assume wired distributed systems, i.e. the port-known state model S PK in which nodes can address a message to exactly one of their neighbors. This hypothesis is particularly helpful for the problem of Token Circulation, where sending the token to exactly one neighbor is crucial to maintain the unicity of the token.

In recent years wireless network technology has gained tremendous importance. It not only more and more replaces so far 'wired' network installations, but also gives rise to new applications and with them, new tech and soft stacks enabling specific communications. Wireless networks often involve devices with small memory and/or battery. Therefore, designing memory efficient algorithms for token circulation in wireless networks is essential.

Related Work

The port-known state model S PK has the desirable advantage to achieve algorithm design that does not necessarily need global information and to facilitate maintaining a global covering structure, as tree networks (by maintaining a pointer parent and, if necessary, some pointers descendants). Since Dijkstra's seminal work on ring-shape networks, this model has been widely used for various problems. Refer to [Dol00, ADDP19] for more algorithms.

Note that some of the token circulation algorithms written in S PK are interested in optimizing the space complexity. They achieve O(log δ u ) bits per node (recall that δ u is the degree of u) [Dij74, BP89, GH96, BGW89, Gho93] on rings or chains, [PV07] on trees, and [DJPV00] on arbitrary networks. Except [START_REF] Burns | Uniform self-stabilizing rings[END_REF] that assumes a uniform prime size ring, all the above algorithms require a root node, i.e., a node with a particular local algorithm with respect to the other nodes.

Unlike S PK , the port-unknown state model S PU introduces no local assumption for a node to select one of its neighbors, except its identifier. This means that given a pair of neighbors u and v, v has no way to know the port number of u that links u to v. This model fits more to wireless networks than the first variant. By contrast with the first variant where a node has the possibility to select a specific neighbor with the use of a pointer, in this model, with local information only, a node has a priori no way to know whether it is the specific recipient of a message sent by one of its neighbors. The lack of discernment between neighbors makes the design of algorithms much more difficult, which often require the knowledge of extra information used by each local algorithm, as the use of node's identifiers or the construction of an underlying vertex coloring. Token circulation algorithms for S PU are proposed in [BDF20, [START_REF] Blin | A self-stabilizing memory efficient algorithm for the minimum diameter spanning tree under an omnipotent daemon[END_REF][START_REF] Blin | A new self-stabilizing minimum spanning tree construction with loop-free property[END_REF]. All these articles work on tree topologies and require O(log n) bits.

Still in S PU , it has been shown that many standard "one-shot" tasks like leader election and spanning tree construction can be constructed in a self-stabilizing manner with memory O(log log n + log ∆) bits in any n-node network with maximum degree ∆ [START_REF] Blin | Compact deterministic self-stabilizing leader election on a ring: the exponential advantage of being talkative[END_REF][START_REF] Blin | Compact self-stabilizing leader election for general networks[END_REF]. This indicates that some tasks can be achieved in S PU with only sublogarithmic memory. As the results established in Chapter 3 suggest, it is much harder to reach o(log log n) memory.

Contributions

In this chapter, we address the problem of token circulation in S PU on a particular class of graphs, Destination-Oriented Directed Acyclic Graphs, DODAG for short [START_REF] Martin | Distribution of the time through a directed, acyclic network[END_REF]. Recall that DODAGs are bi-directional graphs in which each edge is given an orientation, so that the resulting graph contains no loop, and has exactly one root: a node with only incoming edges from its neighbors. Our interest for DODAGs is multifold. First, it provides the nodes with a weak notion of sense-of-direction [START_REF] Flocchini | Sense of direction in distributed computing[END_REF]. Second, it relaxes the notion of rooted spanning tree by allowing the nodes to have more than a single parent, which increases the difficulty of token circulation. Third, DODAGs avoid loops, and provide the network with a single sink, which fit with the standard semi-uniform model [START_REF] Dolev | Self-Stabilization[END_REF] for self-stabilization -every node with the same degree executes the same program, except one. Last but not least, DODAGs are the basic structures used in practice by RPL (Routing Protocol for Low power and lossy networks [WTB + 12]), which is the standard routing protocol for IPv6-based multi-hop wireless sensor networks [START_REF] Thubert | Routing for rpl (routing protocol for low-power and lossy networks) leaves[END_REF].

We propose a self-stabilizing algorithm for the token circulation problem on DODAGs. Our algorithm works under the strongest adversary, the unfair scheduler, which can activate any subset of the enabled nodes at each step, without any fairness requirements. Our algorithm requires only Θ(log log n) bits per node, which is similar to the complexity of [START_REF] Blin | Compact deterministic self-stabilizing leader election on a ring: the exponential advantage of being talkative[END_REF][START_REF] Blin | Compact self-stabilizing leader election for general networks[END_REF], without the dependence on the degree of the graph ∆. We prove that this space complexity is optimal for the token circulation in S PU , even under a least challenging scheduler, and even on simpler classes of graphs, such as trees.

To obtain such complexity, we use a similar technique than [BT18, BT20] for the communication of identifiers, which is basically bit-by-bit communication. Although it is possible to communicate an identifier by small pieces, it remains impossible for nodes to store the different identifiers of their neighbors, and to directly address one of them. Therefore, we designed an additive mechanism that relies on that bit-by-bit communication to allow the token holder to give the token to one of its children, and to somehow remember it did once, so that when its child sends it back, it can give the token to one other child, and therefore achieve the fairness property.

Chapter Outline

The rest of the chapter is organized as follows. We first introduce specific notations, definitions, and formal structures on which our work relies. Then in Section 5.3 we present our token circulation algorithm. Section 5.4 contains the proofs of the validity and optimality of our algorithm. We prove in particular that our algorithm is a self-stabilizing algorithm for the fair token circulation problem. We make some concluding remarks in Section 5.5.

Model and Definitions

General Model

Our token circulation algorithm is designed for DODAGs (see Section 5.2.2), which are graphs that are inherently semi-uniform. We consider the port-unknown state model S PU , and suppose that nodes are given unique identifiers taken in [1, n c ]. Our algorithm does not require that all identifiers have the same length, but we make the reasonable hypothesis that all identifiers have at least one bit, even a 0 bit. Finally, our algorithm works under the most challenging adversary, the unfair distributed scheduler, which activates any subset of the enabled nodes at each step, without any fairness requirement.

DODAGs

In this thesis, we only consider graphs in which the communication links are not oriented, in the sense that the communication is bi-directional. Some networks are nevertheless structured, sometimes hierarchically, DNS servers, routers to quote a few. This hierarchy is materialized by the fact that nodes can distinguish messages sent by neighbors that dominate them, from messages sent by neighbors that they dominate.

In tree networks, nodes different from the root have exactly one node which dominate them. This hypothesis is very strong, and in particular it does not allow any redundancy, which could be useful if faults occur. We consider structures that do not require the unicity of the parent. Two characteristics are desirable for such organized network, being loop-free, and being rooted. An oriented graph is loop-free if there does not exist any path along the directed edges from one node to itself, and it is rooted if there exists one node (necessarily unique by loop-free property) that can reach any other node by a path along the directed edges.

Similarly as Dijkstra's stabilizing token ring algorithm [START_REF] Edsger | Self-stabilizing systems in spite of distributed control[END_REF] assumes a consistent notion of left and right in the ring network, we assume that each edge {u, v} ∈ E is provided with a direction, from u to v, or from v to u, so that the resulting directed graph form a Destination-Oriented Directed Acyclic Graph [START_REF] Martin | Distribution of the time through a directed, acyclic network[END_REF] (DODAG), i.e., a Directed Acyclic Graph (DAG) with a unique root (see Fig. Let us be more formal:

Definition 5.1 (Destination-Oriented Directed Acyclic Graph, DODAG)

A DODAG is a tuple D = (G, →) where G = (V, E) is a graph and → is a relation between the nodes of G which:

• covers the edges of G:

(u → v ∨ v → u) ⇐⇒ {u, v} ∈ E,
• is acyclic: there does not exist any path from one node v to itself w.r.t. →, and

• is rooted: there exists one node r ∈ V such that ∀v ∈ V, v → * r.

The nodes of D are V , and the edges of D are →.

By the acyclic property, such a node r is unique, and is called the root of D. Also by the acyclic property, for any edge {u, v} ∈ E, we have either u → v or v → u but not both.

In practice, the relation → is implemented at the layer of the local port numbers of the nodes. A DODAG is a graph in which the port numbers can be split into two disjoint sets port + and port -, and the relation → is defined by u → v ⇐⇒ port u (v) ∈ port + .

In the latter, we often need to consider, on one node v, the set of its neighbors that precede it, and the set of neighbors that it precedes. We call those sets the parents and the children of the node, by analogy with the lexical field relative to trees.

Note that contrary to what is possible in trees, nodes may have several parents in DODAGs.

Definition 5.2 (Parental Relationships in a DODAG)

Let D = (G, →) be a DODAG. We call parents of v in D the set

P(v) = {u ∈ N v : v → u}. We call children of v in D the set C(v) = {u ∈ N v : u → v}.

Remark 5.1

The information of the set of the parents of each node is equivalent to the information of the relation →. In practice, we define a DODAG by the parental relationship it induces more than by expliciting the relation →.

It will be useful in the latter to reason on sub-structures of the DODAG in which our algorithm is executed. In most cases, the sub-structures considered also have the desirable property of being DODAGs. A sub-DODAG of D is any DODAG whose nodes and edges are a subset of those of D.

Definition 5.3 (Sub-DODAG of G, Anchor)

A tuple

D = (G , → ) is a sub-DODAG of D = (G, →) if • D is a substructure of D: (V ⊆ V ) ∧ (→ ⊆→) ∧ (→⊆ V × V ).
• D is a DODAG Remark that the root of D may not be the same than the root of D. To avoid being misleading, we call the root of a sub-DODAG an anchor.

Remark 5.2

Following what was stated in Remark 5.1, we will not use relation → to define sub-DODAGs in practice, and rather use the underlying set of parents and children, P D and C D .

One typical example of sub-DODAG is the restriction of the DODAG to the nodes which can reach one particular node (other than the root) in (G, →).

Definition 5.4 (G a DODAG under a)

Let (G, →) be a DODAG, and let a ∈ V . We denote by V a the nodes that can reach a by →: V a = {v ∈ V : v → * a}. We denote by E a and → a the restrictions of E and → to nodes of V a :

E a = E ∩ P 2 (V a ) and → a =→ ∩(V a × V a ).
We denote by (G a , → a ), or simply G a , and call the DODAG under a, the sub-DODAG ((V a , E a ), → a ). Although DODAGs are the structure in which our algorithm and our proofs are established, it is often simpler to reason on linear structures than on DODAGs. In the latter, we will consider branches of DODAGs, which are descending paths from one node to one of its descendants.

Definition 5.5 (Branch of a DODAG)

We call branch of a DODAG D = (G, →) a path of nodes in D (which is a path of nodes in G w.r.t. →). For the sake of readability, we denote branches by starting at the highest node. For example, if w → v → u is a path in D, then we say that uvw is a branch of D.

We denote branches by the letter B.

A branch B = v 0 v 1 . . . v k of a DODAG D is maximal if v 0 is

the root (or the anchor) of D, and if v k does not have any children in D.

Given a sub-DODAG of D, it will be interesting to consider the longest branches it shares with D. These longest branches are called projections of the sub-DODAG on branches.

Definition 5.6 (Projection of a sub-DODAG on a Branch)

Let us consider a DODAG D, and a sub-DODAG of D with anchor a, D a . Let B = v 1 v 2 . . . v k be a maximal branch of G a , the DODAG under a. In particular, v 1 = a. We denote D a (B), and call the projection of D a on B the longest branch of D a that coincides with B:

D a (B) = v 1 v 2 • • • v j where ∀i < j, v i+1 ∈ C Da (v i ) and v j+1 / ∈ C Da (v j ) (recall that v ∈ C Da (u) ⇐⇒ v → Da u).

Remark 5.3 (DODAG ≡ D o )

In the latter, we consider different types of DODAGs, depending on their purpose. For the sake of readability, we will use D o as an alias for the classical notion of DODAG, and CD o , WD o , FD o as aliases for particular types of DODAG.

Bit-by-Bit Communication of Identifier

In S PU , nodes cannot communicate a message to one single neighbor without using the fact that identifiers are, at least locally, unique (this is formally proven in Section 5.4.4).

In other words, nodes must communicate their identifier to their neighbors to achieve the circulation of one single token. Hence, the size of an identifier is Θ(log n) bits, while we aim at designing a sub-logarithmic algorithm.

To reach a Θ(log log n) memory, [START_REF] Blin | Compact deterministic self-stabilizing leader election on a ring: the exponential advantage of being talkative[END_REF] make the nodes communicate their identifier by smaller pieces. In this seminal paper, the authors used a function called Bit v (i), which returns the position of the i th most significant bit equal to 1 in id v .

We use a similar technique, but for the sake of simplicity, we slightly modified this function for this work, and send the identifier bit-by-bit, which does not change the asymptotic complexity. Essentially, nodes do not communicate their entire identifier at once, but when asked for, they send to their neighbors the value of their i-th bit (which is 0 or 1). Although the value of the bit is 1-bit long, we must take into account the fact that the position of the bit which is asked, i, is now part of the message. This position variable i takes value between 1 and the maximal length of an identifier, which is in Θ(log n). Therefore, it is encoded on Θ(log log n) bits. To simplify, we suppose that all nodes are given a local function Bit that associates to each position, the value of the bit at this position in their identifier. If the position asked is bigger than the length of their identifier, then the function simply returns ⊥. Suppose for example that node v has identifier id v = 1011. Then we define the function Bit v by:

Bit v (i) :=            1 if i=1 0 if i=2 1 if i=3 1 if i=4 ⊥ if i > 4
Nodes keep storing their own identifier in their immutable memory, but what is communicated to the neighbors through the immutable memory is the tuple (i, bit), which requires Θ(log log n) bits. Remark that since the identifiers are globally unique, the different functions Bit are also globally unique, although they can coincide for some values of i.

Well-Founded Sets

Recall that an ordered set (M, ) is well-founded if there does not exist an infinite sequence of elements of M , v 0 v 1 . . . such that ∀i ∈ N, v i+1 ≺ v i . Such relations are very desirable to prove termination of algorithms, or their convergence. In the latter, we consider an arbitrary well-founded set (M, ).

Given (M, ), we can define an order on tuples of elements of M , which is itself wellfounded when restricted to sequences of length at most k, for any k.

Definition 5.7 (Lexicographic Order)

For any k ≥ 1 we define the lexicographic order on M k induced by , and denote k lex , by:

(u 1 , . . . , u k ) ≺ k lex (v 1 , . . . , v k ) ⇐⇒ ∃i ∈ [1, k] : (u 1 , . . . , u i-1 ) = (v 1 , . . . , v i-1 ) u i ≺ v i
In our proof, we are sometimes led to compare sequences of elements of M which have variable length. We extend the definition of lexicographic order to sequences of arbitrary length, which corresponds to the alphabetical order. The resulting order is itself wellfounded.

Definition 5.8 (Alphabetical Order)

The lexicographic order on (possibly empty) sequences of elements of M induced by , is denoted α and defined by:

(u 1 , . . . , u k ) ≺ α (v 1 , . . . , v l ) ⇐⇒    ∃i ≤ min k, l : (u 1 , . . . u i ) ≺ i lex (v 1 , . . . v i ) ∨ k < l ∧ (u 1 , . . . , u k ) = (v 1 , . . . , v k )

Token Circulation

In this chapter, we consider the problem of fair token circulation, which requires that one unique token perpetually circulates through the network.

The part of the specification of the token circulation problem which corresponds to the existence and unicity of the token is not complicated to state, and is basically what we made in Chapter 3 when we gave a specification for the leader election problem. It boils down to defining a local predicate on nodes, which represents the fact that the token is held by that node, and guaranteeing that the predicate is evaluated to true on exactly one node in each configuration. This first predicate will be denoted by T , for token.

It is a bit harder to formally specify the fairness circulation property. For a token circulation to be fair, one could expect that all nodes have the token at the same rate. But the more a node has children, the more it will receive it back from its children before sending it to its other children. We must be more specific on what fairness is. We define a more restrictive local predicate, which represents the fact that the node has the token and is allowed to use it to access the resource, the service,. . . This second predicate will be denoted by R, for resource access. Now that we have this second predicate, we only have to guarantee that, between two configurations in which one particular node has access to the resource, then all the other nodes also have it, and exactly once. In practice, the node that we consider to delimit fairness is the root. A sub-execution in which the root receives the token for access, then drops it, and then receives it back for access, is called a round, or a circulation round.

Definition 5.9 (Round according to R)

Let R be a local predicate, and let

= γ 0 → γ 1 → • • • be an execution. A sub-execution = γ i → • • • → γ j of is a round according to R if: • ¬R γi-1 (r) • R γj+1 (r) • ∃i ≤ k < j such that -∀t ∈ [i, k], R γt (r) -∀t ∈ [k + 1, j], ¬R γt (r)
Note that by construction, circulation rounds perfectly follow each other in any execution.

We say that a circulation round is fair if for any node v, there exists exactly one continuous sequence of configurations in which v has access to the resource.

Definition 5.10 (Fair Round according to R)

Let = γ 0 → γ 1 → • • • be an execution, and let

= γ i → • • • → γ j be a round according to R. is fair if for any v ∈ V , there exist i ≤ t 1 < t 2 ≤ j such that • ∀t ∈ [t 1 , t 2 ], R γt (v) • ∀t ∈ [i, j] \ [t 1 , t 2 ], ¬R γt (v)
We can now formally define the specification of Fair Token Circulation:

Specification 5.1 (Token Circulation)

T C (Token Circulation) is defined by the existence of two local predicates T and R such that ¬T ⇒ ¬R.

A configuration γ is correct if it contains one unique token

U T C (γ) ≡ ∃!v ∈ V : T γ (v) An execution = γ 0 → • • • is correct if 1. All its configurations are correct: ∀i ≥ 0, U T C (γ i ).
2. is infinite and can be divided into an infinite number of rounds according to R.

All of these rounds are fair

Definition 5.11 (Circulation Rounds)

In the context of Token Circulation, we call Circulation Round a round according to the predicate R.

Algorithm

The general idea of our token circulation algorithm is to implement a perpetual Depth-First traversal from the root. The root sends the token to its child with maximum identifier, which does the same, until a leaf is reached. Then, the leaf sends the token back to its parent, which visits its other children, until all of them are visited, then it sends it back to its own parent, and so on.

Nodes have to remember which of their children were already visited, in order to send the token to unvisited children, or to send it back to a parent. Classically, we implement that with a variable color which can take two values. Nodes only send the token to the nodes that do not have the same color as themselves, and as soon as one node receives the token from a parent, it changes its color, and therefore becomes visited.

Issues Relative to the Communication Model and Partial Solutions

The main difficulty to design a token circulation algorithm in S PU with Θ(log log n) bits per node is that nodes cannot store any pointer to one neighbor.

This is yet crucial to avoid duplicating the token when sending it to one child. As explained above, the presence of unique identifiers, and the bit-by-bit communication scheme will allow us to implement such a behavior. But a second issue comes with the return of the token. Indeed, nodes cannot store a pointer to the parent from which they received the token. For fairness concerns, it is necessary that the parent that receives the token back from one node is the one that sent it to that node. Indeed, in the scheme presented in Figure 5.3, it might be that node b has other unvisited children after c, let us say d. If a receives the token directly from c, then it won't send it to b before the next circulation round, which is likely to be a simple repetition of what we just described. Therefore, d would never receive the token. We show on Figure 5.4 how this returning should be.

As we said previously, a node cannot remember from which of its parents it received the token. Therefore, from c's point of view, a and b are indistinguishable. This implies that the responsibility to not duplicate the token belongs to a and b. The idea is that each node that has sent the token to its children, and which has not received it back yet, keeps that information in its variables, meaning that it is involved in a non-terminated circulation. Considering this new information, a and b now differ in the sense that, from b's perspective, when c offers the token up, it does not have any other children involved in a token circulation, while from a's perspective, it also has b as a child which waits for the token. Therefore, only b will take the token when c offers it.

General Ideas of our Algorithm

Implicit Repair as much as possible One very fundamental idea of the design of our algorithm is to repair the nodes as rarely as possible. One first reason is that the algorithm is already highly complex, due to the numerous tasks that nodes must fulfil to achieve fair token circulation. Any additional rule designed to repair an inconsistent situation would complicate the understanding of both the algorithm and its proof. One second reason is that for most cases, it in unnecessary to repair nodes, since if the algorithm is resilient enough, then the token will circulate in the network. For most cases, the simple presence of the token and the rules that allow fair executions will allow the network to eventually stabilize. There are few exceptions i.e. repairing rules that are necessary for convergence.

Fairness Property: Coloring the Nodes As we said above, we use a one-bit variable, referred to as color, to achieve the fairness requirement. The idea is that one node that has the token considers that its children with the same color already received it. Conversely, a node that has the same color as a parent offering the token will ignore it. Each time a node receives the token, it switches its color and becomes visited. Once the root receives the token from one child, and notices that all its children have its color, then it simply switches it color, and a new circulation round starts. This guarantees that one node can only receive the token once at each round.

In consistency with the previous paragraph, the color of the node is only checked from the child to the parent, and not the opposite. This means that if a parent v has a child u from the opposite color which offers the token to its ancestry, then v will accept the token, although it does not match a regular execution.

Even if we start in a configuration where the color of the nodes is inconsistent, after some circulation rounds, all the graph will eventually be reached by the token. Indeed, at each round, the color of the token switches and thus nodes that were ignored for being supposedly visited are now seen as unvisited, and therefore receive the token at once. This is depicted in Figure 5.5.

Choice of the Child: Identifier-Based Local Election

To determine which of its children will receive the token, the parent progressively eliminates them, until only one remains. When it has exactly one child running for the token, it can finally declare that it gives the token. All the children that were eliminated ignore that message, and the one winner can take the token from its parent, and therefore no duplication of the token can occur.

The elimination process relies on the identifiers of the children, and on one additional variable which allows unvisited nodes to declare themselves as negotiating, or as losers of the negotiation. Step by step, the parent asks for the value of the i-th bit of the identifier of its children, and when all have answered, it reveals the biggest value it sees. All the nodes Figure 5.5: Increase of the area in which the token circulates starting from an arbitrary configuration. Shots are taken just before the root switches its color.

that have not announced this value consider themselves as eliminated until their parent allows them to negotiate again. This moment, when the parent allows its children who lost the election to negotiate again happens immediately after the winner of the election takes the token. Figure 5.6: Process of the designation of one child to give the token to. The parent reveals the biggest bit announced, then the children with small identifiers quit the negotiation, and in the end the winner takes the token and the losers are ready to negotiate again.

Preventing Livelocks and Deadlocks due to Several Circulating Token: Coloring is not Enough If we consider executions in which one single token is circulating in the network, then the previous is basically enough to ensure fairness and unicity of the token. One variable is used to remember whether the node is still negotiating for the token, and the color of the node states whether the node has already been visited. Hence, we must design an algorithm which achieves fair token circulation from an arbitrary initial configuration.

Things become more complicated when several tokens are circulating. Even with only two tokens, we can design pathological configurations, and especially if the two tokens are of different colors. What we must absolutely prevent is situations in which one node alternatively takes a red token from one parent, sends it back later, then switches color and takes the green token from its other parent, sends it back, and then takes the red one again, and so on. With two such children, we can design scenarios where the tokens are in a livelock, and the circulation is blocked.

Note that nodes can neither simply ignore the token, for it would create a deadlock: both tokens would be blocked.

To avoid such situations, we force a node that has received the token from one of its parents to not being available for a new token until this parent has sent the token back to its own parent. This requires being more subtle in how we define the election-related variables on the children.

Non-Atomicity of Token Passing Figure 5.6 presents a simplified version of what is actually made. Indeed, at each step of the token passing, from one node to the other, numerous tasks must be fulfilled in order to guarantee the consistency of the network, such as acknowledging the receipt of a token, or resetting the variables of other children, for example. This non-atomicity reflects on the variable used to encode the token.

In a model where nodes can implement pointers to their neighbors, the token can be implemented with only two values (present or absent). In our model, two states is not enough, we give more details on our variable token in Section 5.3.3.1.

First Tools for the Algorithm

Variables

Color of the Token To achieve fair perpetual circulation, and in particular to avoid nodes to take the token twice from two different parents, we use a variable color which takes two values.

c v ∈ {red, green}
Only one operation is used in this variable, which is switching its value from red to green, or from green to red. This operation is denoted by c v := ¬c v .

State of the Token

To achieve atomicity of the operations required to maintain the network in a consistent state, we need to define a variable which takes eight different values.

tok v ∈ {⊥, , •, , , ↓, •, ↑}
Let us give some explanations on those different values.

The state tok v = ⊥ corresponds to nodes that are away from the current token circulation. For example, when the root has the token, all the other nodes are such that tok v = ⊥. Reciprocally ⊥ is a value that cannot be taken by the root, which would mean that no token is circulating in the network.

When a node that is not involved in the current token circulation receives the token from its parent, it simultaneously switches it color, and switches its token value to tok v = . This value corresponds to the moment where one node receives the token from its parent, which is supposed to happen exactly once in each circulation round. Therefore, this value will be particularly interesting for the design of the predicate R which will correspond to the implementation of Specification 5.1.

When the parent of v has finally left the token (recall that such operations are not atomic), v can start negotiating with its children to decide to which one it will send the token. To do that, it sets tok v = •, and keep that state until one winner is elected.

Once a winner u is elected i.e. when all nodes of a different color than v have declared themselves losers, u excepted, v updates tok v = to offer the token to one of its children. After that, the child u that won the negotiation can update its own variable tok u to .

After its child u took the token, v updates its variable to tok v = , to let its children which lost the negotiation reset their variable in order to be ready for the next negotiation, when v will receive back the token from u.

When all the children of v have finished resetting their variable, v sets tok v =↓, which indicates that it is a node involved in a token circulation, but that the token it had is below it, to one of its descendants.

After u has finished the token circulation below it, it sets tok u =↑, to send the token back to v. If nothing wrong happened, v has only one child with a value tok = ⊥ at that moment, and therefore can take the token. To do so, it updates tok v = •, and then waits for u to effectively drop the token, by setting tok u = ⊥.

After that, v restarts a negotiation, setting tok v = •. After some time, v has no more children of a different color. When this happens, v offers the token to its parent w by setting tok v =↑. Before effectively dropping the token, v waits that w acknowledges the token by updating its variable to tok w = •, but it also waits for all of its children to update their variable linked to the negotiation. Indeed, in the current situation, all the children of v have successively won the token. As explained above, those nodes are prevented from taking one token of another color, to avoid livelocks. But now, the circulation of the token of v is terminated, so this becomes irrelevant. Worse, if nodes do not reset their variable to a value that allows them to negotiate, then they will all be ignored when a token from another color will come the next round. When all the children of v have reset their variable, v finally drops the token, and sets tok v = ⊥.

Remark that for a node v with tok v / ∈ {⊥, ↓}, there is a strong pressure on the possible values of tok u , where u is a child of v, and most combinations are actually not supposed to occur in an execution.

Negotiation Variables: Bit-by-Bit Communication

To negotiate for the token, nodes send bit-by-bit the value of their identifier to their parent. Two variables are required for that. The first one, ph, is used to communicate the position of the bit that is currently asked. It takes values between 1 and N , where N is the largest length of an identifier in the network, and thus N ∈ O(log n). The second variable is b, and is used to communicate the value of the bit that each child has, and for the parent to communicate the highest value it has seen. The variable b v is used to communicate the values given by function Bit v . It takes values in {0, 1, ⊥}, where ⊥ is the value that corresponds, for children, to the absence of a bit at that position (the identifier is too short), and, for the parent, to the request of the value of the bit. For simplicity, we denote the tuple (ph v , b v ) by the notation id v .

The general scheme is the following: first the parent sets id v = (1, ⊥). Then all the children answer with the value of their first bit, by setting id u = (1, Bit u (1)). After all the children have answered, v sets id v = (1, b) where b is 1 if v saw a 1 in its children, and 0 otherwise. Then, all the children that do not have answered (1, b) lose the negotiation. After all losers have left the negotiation, v sets id v = (2, ⊥), and so on until only one node remains.

Negotiation Variables: State in the Negotiation Process In addition to the identifier variables ph and b, we need a variable to remember where each node is in the negotiation process. This variable is denoted by play and takes four values:

play v ∈ {P, L, W, F}
Nodes v such that play v = P are the nodes that are available for a negotiation process with any of their parent that has a different color. They are the only nodes which can participate in a negotiation, the others have either already won, or lost. Note that P also stands for players.

When a node v loses the negotiation, it sets play v = L, and thus becomes a loser, and is not involved in the current negotiation process anymore.

When a node v wins the negotiation and receives the token, it updates its color, its variable tok v , and it also updates play v to W, to signify that it won a negotiation. After that, and until its parent sends the token back to its own parent, v won't negotiate with any of its parents. This guarantees that whatever the initial configuration of the system, v will not create oscillations between two tokens, and therefore no livelock.

We need the fourth value F to overcome a tricky situation. Recall that when a node u sends back the token to its parent w, it first waits for its children who won the negotiation (i.e. such that play v = W) to reset their variable play v to P, so that they will be able to negotiate during the next circulation round. But in triangle configurations, it might be that one such node v with play v = W has a common ancestor, with its parent u, as depicted in Figure 5.8.

In such a situation, v should not update play v = P. Indeed if it does, then from w's perspective, it is exactly as if we never introduced the value W: it has one child who won the token and is at P. In particular, we can now create a livelock at the level of w.

But v can neither keep its value at W, for it creates a deadlock with its parent u. Therefore, v fakes resetting its variable play v , by setting it to F, which is understood by its parent with tok u =↑ as a P value, but both v and its grandparent w do recall that v has already had the token. This requires that as soon as possible, node v update its variable play v = W, otherwise it could miss the opportunity to eventually reset its variable at P, notably if w sets tok w =↑.

Non-Redundancy of c v and play v = W Although the alternating between two colors and the state play v = W share the common goal, which is to prevent a node to have several times the token, they are relevant in totally different situations.

The alternation between two colors is built to prevent a node from receiving twice the same token, from parents that might be totally unrelated in the On the other hand, the value W prevents a node to oscillate between two colors, from two different parents, which would block the circulation of the token.

D o . ↓, W ↑, W ⊥, W ⊥, W w u v •, W ↑, W ⊥, F ⊥, P w u v •, W ⊥, W ⊥, F ⊥, P w u v •, W ⊥, W ⊥, F ⊥, P w u v

Common Sets

To define the rules of our algorithm, some sets are especially useful. An important distinction that nodes almost systematically do is the difference between their parents with the same color, and their parents with the other color.

P eq (v) = {u ∈ P(v) | c u = c v }
(5.1)

P neq (v) = {u ∈ P(v) | c u = c v } (5.2)
Similarly, nodes distinguish their children with the same color from their children with the other color.

C eq (v) = {u ∈ C(v) | c u = c v } (5.3) C neq (v) = {u ∈ C(v) | c u = c v } (5.4)
One other central set for the negotiation is the set of the nodes with whom the parent negotiates. The parent negotiates with its children that do not have the same color, and such that play u = P. A node that negotiates is not supposed to have any children u such that tok u = ⊥, and a specific rule is designed for such erroneous situations. Yet, to simplify some reasoning, we also add as a constraint the fact that v only negotiates with its children such that tok u = ⊥. In the latter, we call these nodes the players of v.

Players(v) = {u ∈ C neq (v) |tok v = ⊥ ∧ play u = P} (5.5)

Rules of the Algorithm

In this section, we present the predicates, actions, and rules of our algorithm. For the sake of readability, we have grouped the rules according to the task they relate to. In Section 5.3.4.1, we present the rule dedicated to deal with inconsistencies of the variable tok. In Section 5.3.4.3, we present the negotiation process, based on the identifiers of the children of the node holding the token. In Section 5.3.4.2 we present the rules that make nodes quit that negotiation process. In Section 5.3.4.4 we present the rules which reset variables of nodes to a proper value after the end of the negotiation process. In Section 5.3.4.5 we present the rules that allow one node to receive the token back from one of its children. In Section 5.3.4.6 we present the rules that are executed when one circulation below a node is terminated, whether the node is the root or another node. Finally, in Section 5.3.4.7, all the rules are gathered to allow an easy access during the reading of the proofs.

Error

As hinted above, some combinations of the variable tok should not occur on a node and its children. In general, a node v that has the token, or which is very near a token, i.e. with tok v ∈ { , •, , , •, ↑}, should only have children u with tok u = ⊥, with a few exceptions.

Indeed, if tok v ∈ { , }, then v is allowed to have a child such that tok u = , the child to which it just gave the token.

If tok v = •, then v is allowed to have a child such that tok u =↑, the child from which it is receiving the token.

One other exception is when tok v =↑. In this case, v is sending the token back to its parent, which means that it is on its way to set tok v = ⊥. We do not consider any error for such nodes, since it would not be very effective, and could create an error at the level of its own parent.

To repair such errors, the principle is that the parent trusts its child, in the sense that if both v and u believe they have a token, then v forgets its token, and repairs itself by setting tok v =↓, acknowledging the fact that there is a token below it.

The illegal pairs are detected by the predicate Er(v) and the correctness of the state of the token of node v is handled by the rule E TrustChild .

Er(v) ≡ tok v ∈ {•, } ∧ ∃u ∈ C(v) : tok u = ⊥ ∨ tok v ∈ { , } ∧ ∃u ∈ C(v) : tok u / ∈ {⊥, } ∨ tok v = • ∧ ∃u ∈ C(v) : tok u / ∈ {⊥, ↑} (5.6)
E TrustChild : for all v ∈ V Er(v) -→ tok v :=↓
All the other rules of the algorithm suppose that node v is not in such an error. For homogeneity and readability, we constrained all rules with ¬Er(v), even rules which suppose that tok v ∈ {⊥, ↓, ↑}.

End of the Negotiation Phase

Before showing how the negotiation phase is implemented, let us first explain how nodes may quit this phase. In a negotiation, two types of nodes are involved, the parent v which has the token, such that tok v = •, and the children u that are elements of Players(v).

The parent can quit the negotiation phase by two means.

Rule R OfferUp The first one is when the parent observes that all of its children in Players(v) have been visited, which means that it ended the circulation below itself. When this happens the parent sends the token back to its own parent.

Before doing so, the parent must first be assured that it is not in a situation as depicted in the last configuration of Figure 5.8. If v has a child u such that play u = F, then it is a node which actually won the token, but faked being reset to P to another parent p such that tok p =↑. If v is the last parent of u, and switches tok v =↑, then u will never be reset to P, which breaks the fairness of the token circulation. Therefore, before executing this action, v waits that all of its children have quit the value F.

The predicate WaitSib corresponds to this requirement.

WaitSib(v) ≡ ∃c ∈ C eq (v) : play c = F (5.7) R OfferUp : for all v ∈ V ¬Er(v) ∧ tok v = • ∧ ¬WaitSib(v) ∧ (∀u ∈ C neq (v) : play u ∈ {W, F}) -→ tok v :=↑
Note that even if the root has no parent, it may execute rule R OfferUp when it does not have any more children to visit. Since some operations subsequent to having finished circulation below oneself are identical for the root and the other nodes, we factorize the rules as far as possible.

Rule R Give The second possibility for a parent to quit the negotiation is to decide to offer the token to one of its children. This happens when node v has exactly one child in Players(v).

But there is one other situation to which we must give attention. Suppose that due to a wrong initialization of the network, no node belongs to Players(v), but the circulation is not over yet, for one or several children of v are losers, i.e. play u = L. In this situation, node v needs to reset the variable play of these children to P, and then will perform a negotiation between them. One simple way to do that is to follow the transition diagram of tok depicted in Figure 5.7. No child of v will take the token offered by tok v = , but immediately after, when tok v is set to , the losers will update play u = P, which will allow a further negotiation process.

Actually, v basically executes a full round of its variable tok just to refresh its wrongly initialized children. Note that this may only be caused by a corrupted initial configuration, and that after convergence, this part of the rule becomes useless.

The predicate Give describes the situations in which node v ends the negotiation by sending the token to one of its children.

Give(v) ≡ |Players(v)| = 1 ∨ (|Players(v)| = 0 ∧ ∃u ∈ C neq (v) : play u = L) (5.8) R Give : for all v ∈ V ¬Er(v) ∧ tok v = • ∧ Give(v) -→ tok v :=
Let us now consider the children u ∈ Players(v). A child quits the negotiation if it quits Players(v). It may do that by three means.

Rule R FakeWin The first situation in which a child quits the negotiation is when it has an inconsistent parenthood. More precisely, if v has several parents that are dealing with a token. Such parents are those whose value tok p / ∈ {⊥, ↓, ↑}. We do not consider the nodes who are not involved in a token circulation (tok p = ⊥) neither do we consider the nodes who announce a token in their descendants (tok p =↓). We also do not consider ↑ for the same reason that it was ignored in predicate Er: such parent is about to drop the token to its own parent, it is therefore unnecessary to consider it.

The parents which may force v to quit the negotiation are ParNeg:

ParNeg(v) = {p ∈ P(v) | tok p ∈ {⊥, ↑, ↓}}
(5.9)

Let us describe the situations where v does not have to quit the negotiation due to an inconsistent parenthood. First, if v has exactly one parent in ParNeg(v), then there is no inconsistency. If v has no parent in ParNeg(v), there is no inconsistency either.

There is one other situation that may occur in legal execution. In a triangle configuration, v has two parents and one of them is the children of the other. Then the middle one receives the token and sets its variable tok to , there is a moment where v has its variable play v = P and also has two parents in ParNeg(v), since the other parent is at . This is described in Figure 5.9

⊥, P ⊥, L ⊥, L ⊥, L ⊥, P Figure 5
.9: Node with several parents indicating a token Formally, the situations that do not force v to interrupt the negotiation are:

OkNeg(v) ≡    |ParNeg(v)| ≤ 1 ∨ (|ParNeg(v)| = 2 ∧ {tok p | p ∈ ParNeg(v)} = { , }) (5.10)
When a node decides to stop negotiating with its parent for inconsistency reasons, it fakes winning the token, in the sense that it becomes visited by switching its color, and updates its variable play, but does not actually take the token. In most cases, switching to W is sufficient. Hence, if before switching its color, v has a parent of the other color, such that tok p =↑, then at the next computing step, v will update play v to F, as shown in Figure 5.8. In order to spare one computing step, and to simplify some proofs, we set play v at the right value at once.

The action corresponding to the rule R FakeWin is given by FakeWin:

FakeWin(v) ≡    c v := ¬c v ; play v := W if ∀p ∈ P neq (v), tok p =↑; F if ∃p ∈ P neq (v), tok p =↑; (5.11) R FakeWin : for all v ∈ V \ {r} ¬Er(v) ∧ tok v = ⊥ ∧ play v = P ∧ ¬OkNeg(v) :-→ FakeWin(v)
Rule R Win The second situation in which a child quits the negotiation is when it wins the negotiation. A node v wins the negotiation if its parents are not in an inconsistent configuration (which is OkNeg(v)), and if it is still at play v = P when its parent offers it the token (i.e. when tok p = ).

The predicate WinNeg is dedicated to detect such situations.

WinNeg(v) ≡ OkNeg(v) ∧ ∃p ∈ P neq (v) : tok p = (5.12)

When a node v wins the negotiation, it takes the token, and switches its color. Furthermore, it updates its variable play v to W. Contrary to how we did for FakeWin, we do not have to worry about the precise value of play v right now. Indeed, since v has a value different than ⊥ for tok v , v does not have to worry about the moment where it will be reactivated by its parent, which happens at the end of the circulation of its parent.

Win(v) ≡    tok v := ; c v := ¬c v ; play v := W;
(5.13)

R Win : for all v ∈ V \ {r} ¬Er(v) ∧ tok v = ⊥ ∧ play v = P ∧ WinNeg(v) -→ Win(v)
Rule R Lose The third and last situation in which a child quits the negotiation is when it loses it. The exact condition of how a child loses the negotiation will be properly defined in the following section. For now, let us just consider that there exists a predicate LosePar(v, p), which depends on the values of id v and id p , where p ∈ P neq (v), which describes that v should lose the negotiation according to p.

A node loses the negotiation if its parents are not in an inconsistent configuration (which is OkNeg(v), and if it does not win the negotiation (which is ¬WinNeg(v)).

All these conditions are grouped in the predicate LoseNeg(v):

LoseNeg(v) ≡ OkNeg(v) ∧ ¬WinNeg(v) ∧ ∃p ∈ P neq (v) : (tok p = • ∧ LosePar(v, p)) (5.14)
When v loses the negotiation, it simply sets play v = L.

R Lose : for all v ∈ V \ {r} ¬Er(v) ∧ tok v = ⊥ ∧ play v = P ∧ LoseNeg(v) -→ play v := L

Negotiation Identifier-Based

In the negotiation phase, the only children which are relevant to consider, from the parent's perspective, are the children in Players(v). In the description of the rules, we write players instead of children in Players(v), to facilitate the reading.

Let us first describe the general mechanism of the election, then explain some subtleties, before presenting the rules of the bit-by-bit negotiation.

One first important idea is that the parent does not execute any action unless all of its players have executed their rule. In particular, the parent waits for all of its players to be at the same value of ph as it is.

Synch(v) ≡ ∀u ∈ Players(v), ph u = ph v (5.15)
One other general principle, which is crucial due to the asynchrony of the system, and due to the self-stabilizing requirement, is that nodes do not correct their answer. More precisely, if one node v (parent or child in the negotiation) is in a state that may have an influence on the execution of a rule by one other node u, then v does not update its state. Even if this state is inconsistent with its identifier, for a child, or with the values of id u on its players, for a parent, v waits that its neighbors have finished interpreting this state, and accept the consequences of this error. Such inconsistencies are typically due to an incorrect initialization of the system. This general principle only applies to the negotiation rules, and does not prevent nodes to execute rules such as E TrustChild , R FakeWin , or R Give for example.

Let us recall the general scheme of how the negotiation process happens 0. Parent v asks for the value of the first bit of its players u ∈ Players(v), by setting

id v = (1, ⊥).
1. Players u of v answers with their own value (1, Bit u (1)) (rule R NewBit ).

2. When all its players have answered, i.e. when all have the right value ph u = 1, v announces the biggest value it sees, by setting

id v = (1, b) (rule R maxPos ).
3. Players u of v which have a lower value than b v lose the negotiation (rule R Lose ).

4. When all of its players have ph u = 1 and b u = b v , v asks for the value of the second bit of its remaining players, by setting id v = (2, ⊥) (rule R NewPh ), and so on.

A particular situation is when all the players u of v answer (ph, ⊥), i.e. when all the players declare that they do not have a long-enough identifier to provide a ph-th bit. This situation is not possible in correct executions, since all identifiers are distinct, we cannot reach a point where several identifiers are similar and terminated. Hence, this may happen in the early steps of an execution which starts in an inconsistent configuration. Either at least one child has an identifier actually greater than ph, and could go further, but due to an incorrect initialization, it has a wrong value for b, either due to an incorrect initialization of the parent, the negotiation process did not start at ph = 1 but further, and we could have missed the opportunity to distinct the identifiers of the nodes in Players(v).

When this happens, the parent cannot simply increase ph, since its players formulate that they can't even reach the current value of ph. Therefore, if all of its players answer (ph, ⊥), then the correct move for the parent is to restart at ph v = 1. Only one exception to that rule, is when it happens when ph v = 1 already. In this situation, v would not change a single bit of information by setting id v = (1, ⊥). We suppose that all identifiers have at least one bit, even if it is a single bit 0. Therefore, (1, ⊥) can never be a valid answer for a child. In consequences, without any contradiction with the previous principle stating that no possibly valid answer can be revised, players such that id v = (1, ⊥) can actually update their state to send their actual value for Bit u (1). This is not true for other values of ph: if id v = (ph, ⊥) with ph > 1 and Bit v (ph) = ⊥, then to avoid confusing its parent, it does not update its state.

Let us now treat the different rules corresponding to the scheme presented above.

Rule R NewBit Some first conditions for a node v to answer the negotiation is that its parenthood is not inconsistent, and it is not winning the negotiation, nor losing it. This corresponds to the partial predicate OkNeg(v) ∧ ¬WinNeg(v) ∧ ¬LoseNeg(v).

The other condition is that v is in a situation where it is its turn to answer. One first situation in which it should answer is when it does not have the same value of ph as its negotiating parent p. The second situation is the particular case where ph v = ph p = 1, and v has answered ⊥, which is never a valid answer, and the parent p is still waiting for its players to answer. Indeed, in an poorly initialized configuration, the parent p could have already decided which value was the highest, and thus v must not answer. This is synthesized in predicate AnswerPar:

AnswerPar(v, p) ≡ ph v = ph p ∨    ph p = 1 b p = ⊥ b v = ⊥ (5.16)
We also define the predicate which excludes concurrency with R FakeWin , R Win , and R Lose :

AnswerNeg(v) ≡ OkNeg(v) ∧ ¬WinNeg(v) ∧ ¬LoseNeg(v)∧ ∃p ∈ P neq (v) : (tok p = • ∧ AnswerPar(v, p)) (5.17)
The action which corresponds to answering the negotiation is updating variable ph v to the value of our parent, and b v according to function Bit v .

Remark that such a parent p is necessarily unique, due to OkNeg(v). To simplify the notations, we consider that such parent p is given as an external information to the action which corresponds to AnswerNeg, Announce:

Announce(v) ≡ id v := (ph p , Bit v (ph p )) (5.18) R NewBit : for all v ∈ V \ {r} ¬Er(v) ∧ tok v = ⊥ ∧ play v = P ∧ AnswerNeg(v) -→ Announce(v)
Rule R maxPos One first condition for the parent to announce the maximal value it sees on its players is that the negotiation is not over yet, i.e. there are at least two players.

One second condition is that all of those players have answered, i.e. that they have the same value as itself for ph, which is captured by Synch(v).

One third condition is that it does not have already announced a value, i.e. b v = ⊥.

There are two more subtleties. The first one is that if we have ph v = 1 then v actually waits for all of its players to produce a non-empty answer, a value for b u which is not ⊥, an invalid answer for ph = 1.

The second subtlety is that if, for a value of ph greater than 1, all the players of v announce ⊥, then it is irrelevant to keep increasing phases, and actually irrelevant to answer ⊥ as well. In this situation, the correct move is to restart the negotiation from ph v = 1, which will be dealt with by rule R NewPh .

The last condition and the subtleties are described by predicate NextPlay.

NextPlay(v) ≡ b v = ⊥ ∧    ph v = 1 ∧ ∀u ∈ Players(v), b u = ⊥ ∨ ph v = 1 ∧ ∃u ∈ Players(v) : b u = ⊥ (5.19)
Once all these conditions are fulfilled, v can announce the biggest value of b it sees in its playing childhood (classically we have ⊥ < 0 < 1). This action is denoted MaxPos.

MaxPos(v) ≡ b v := max u∈Players(v) b u (5.20) R maxPos : for all v ∈ V ¬Er(v) ∧ tok v = • ∧ |Players(v)| ≥ 2 ∧ Synch(v) ∧ NextPlay(v) -→ MaxPos(v)
Predicate for Rule R Lose In the previous section we did not explicitly give the predicate LosePar. One node v loses the negotiation when they have the same value of ph as their parent, and that the answer provided by their parent is different from the one they have.

LosePar(v, p) ≡ ph p = ph v ∧ b p = ⊥ ∧ b p = b v (5.21)
Rule R NewPh The parent increases its phase only when the negotiation round is terminated, which means that nonetheless all its players have the same value as it has, for ph, but also that they all have the same value as is has for b.

Either this value is ⊥, and therefore all players are out of bits, and the new phase should be 1, either it is not ⊥, and therefore all the nodes asked to lose have actually lost and are now out of Players(v), and the new phase should be one more than the current one.

There is one particular case where this increase should not happen: when we have ph = 1 and b = ⊥ (on both the parent and its players), since it does not correspond to a valid answer. Predicate PhComplete summarizes that.

PhComplete(v) ≡ (ph v = 1 ∨ b v = ⊥) ∧ ∀u ∈ Players(v), b u = b v (5.22) PhasePlus(v) ≡    b v := ⊥ ph v := 1 if ∀u ∈ Players(v), b u = ⊥ ph v + 1 if ∃u ∈ Players(v), b u = ⊥ (5.23) R NewPh : for all v ∈ V ¬Er(v) ∧ tok v = • ∧ |Players(v)| ≥ 2 ∧ Synch(v) ∧ PhComplete(v) -→ PhasePlus(v)

Operations Post-Negotiation

In this section we consider actions subsequent to the executions of R Give by the parent, and R Win by one child, which were presented in Section 5.3.4.2. The parent has its variable tok = , the winning player has its variable tok = , and the other children that have not received the token yet have their variable play = L.

Rule R NewPlay The first action that the parent takes, after its child has actually received the token, is switching its variable tok to to inform its other children that the negotiation phase is terminated, and that they are free to negotiate again. This is necessary to ensure a proper depth-first traversal, since some of them may also be children of the winning player.

This can be done as soon as v does not have any players. Since we classically suppose that v is not in error, it means that its children u of the opposite color are either at tok u = , or at play u = P.

R NewPlay : for all v ∈ V ¬Er(v) ∧ tok u = ∧(∀u ∈ C neq (v) : play u = P ∨ tok u = ) -→ tok v :=
Rule R ReplayD When v has one parent which notifies that it can reset its value of play v to P, v first gets sure that it is not near one other negotiation phase. Indeed, v should not join a running negotiation phase by updating play v from L to P. In correct executions, v cannot be close to several negotiation phases, by unicity of the token. Yet, due to an inconsistent initialization of the network, this must be considered.

Parents that correspond to ongoing negotiation phases are those with tok p = • and tok p = .

ReplayL(v) ≡ ∀u ∈ P neq (v), tok u / ∈ {•, } ∧ ∃u ∈ P neq (v), tok u ∈ { , •} (5.24)
Note that we also consider situations where v has a parent p with tok p = •. This corresponds to a similar situation, which we will develop in Section 5.3.4.5

When this predicate is satisfied, v updates play v to P, and simultaneously resets its variable id v to a neutral value.

Replay(v) ≡

play v := P; id v := (1, ⊥) (5.25)

R ReplayD : for all v ∈ V \ {r} ¬Er(v) ∧ tok v = ⊥ ∧ play v = L ∧ ReplayL(v) -→ Replay(v)
Rule R Drop When all of its children have reset their variable play from L to P, node v can finally update its variable tok to ↓, which terminates the passing of the token to the child who won the negotiation.

To avoid deadlocks due to an inconsistent initial configuration, we must consider situations in which some child of v has the token (tok u = ) but also has its variable play u at L. Rather than creating a new rule to make u update its variable play, we chose to let v drop the token in such situations.

R Drop : for all v ∈ V ¬Er(v) ∧ tok v = ∧(∀u ∈ C neq (v) : play u = L ∨ tok u = ) -→ tok v :=↓ Rule R Nego
Once the parent of the node v who won the negotiation has terminated the previous actions, and has set its variable tok to ↓, v can finally start negotiating with its own children, by setting tok v = • and its variables ph and b to the initial value of the negotiating process.

StartNego(v) ≡ tok v := •; id v := (1, ⊥); (5.26) R Nego : for all v ∈ V ¬Er(v) ∧ tok v = ∧ (∀p ∈ P(v) : tok u ∈ { , }) -→ StartNego(v)
Figure 5.11 presents the process of how a token is given to a child.

•, W ⊥, P ⊥, P •, W ⊥, P ⊥, L RLose , W ⊥, P ⊥, L RGive , W , W ⊥, L RWin , W , W ⊥, L RNewPlay , W , W ⊥, P RReplayD ↓, W , W ⊥, P RDrop ↓, W •, W ⊥, P RNego Figure 5
.10: Execution of rules for returning the token back to one child. The activated node is the one with its line doubled

Reception of the Token from a Child

In this section we consider actions subsequent to the execution of R OfferUp (presented in Section 5.3.4.2). We consider one node v such that tok v =↓, which has one child u that offered the token to its parent by setting tok u =↑.

Rule R Receive When node v has its child u announcing that it returns the token back, v needs to be sure that it does not have any other children which is involved in a token circulation, in which case it cannot take the token before its other children have terminated their circulation. Recall that in Figure 5.4, the top node did not take the token.

If v takes the token while having another child involved in a token circulation, it becomes in error, and thus executes E TrustChild , and sets tok v =↓, which may create a livelock.

R Receive : for all v ∈ V ¬Er(v) ∧ tok v =↓ ∧(∀u ∈ C(v), tok u ∈ {⊥, ↑}) -→ tok v := • Rule R ReNego If node v did not
have any children and took the token by setting tok v = • with rule R Receive , then before starting negotiating, it waits that its child, from which it received the token, actually drops it.

More precisely, v start negotiating only if it all of its children are such that tok u = ⊥, otherwise it would create an error by setting tok v = •. The following predicate guarantees that one node has no children involved in a token circulation:

Leaf(v) ≡ ∀u ∈ C(v), tok u = ⊥ (5.27)
Furthermore, before starting a negotiation round, v also waits that all its children which have not won the token yet have properly reset their variable play to L. This is guaranteed since Rule 5.3.4.4 applies to situations where the parent has its variable tok = •.

R ReNego : for all v ∈ V ¬Er(v) ∧ tok v = • ∧ Leaf(v) ∧ ∀u ∈ C neq (v) : play u = L -→ StartNego(v)

End of the Circulation

In this section we also present actions subsequent to the execution of R OfferUp (presented in Section 5.3.4.2), but from the child perspective. We consider the node which executed R OfferUp , and its potential children.

Rule R Return After it has offered the token to its parent, a node v which is not the root should eventually drop the token, and set tok v = ⊥. Before that, it must check that all its children have correctly updated their variable W to P to assure that when a token of the other color will come, all those nodes will be available for a negotiation phase. This only applies to children of v which have the same color as v, since other children may be involved in a concurrent token circulation, and we do not want to create any livelock. Also, it only applies to nodes which are not involved in any circulation of the token, i.e. such that tok u = ⊥ (recall that since tok v =↑, v cannot be in error).

If such children u of v, with play u = W still have parents involved in a negotiation, they will shift that value to F, faking a reset to v. Thus, v should tolerate children u with play u = F.

On the other hand, if v has children u which have their variable play u = L, those children might be involved in another negotiation phase, which they have lost. Those children should not reset their variable play to P, for it would harm the negotiation process.

Thus, v checks that all of its children with the same color have a value of play different from W before it sends the token back.

We add one more consistency check, which is that v does not have any parent in error, i.e. parents p such that tok p ∈ { , •, , }. If it has, it waits for those parents to execute E TrustChild before returning the token to its parents. This predicate is not necessary for our algorithm to work, but it may make convergence faster.

These predicates are combined in predicate MayDropUp.

MayDropUp(v) ≡ ∀p ∈ P(v), tok p ∈ {⊥, ↓, ↑, •} ∧ ∀u ∈ C eq (v), (tok u = ⊥ ⇒ play u ∈ {P, L, F}) (5.28)
When this condition is fulfilled, v can drop the token. This includes setting tok v = ⊥ and updating play v to a correct value depending on the parents of v. As depicted in Figure 5.8, there are situations where nodes without a token must set their variable at F instead of W, to avoid blocking one parent which is close to execute R Return itself.

Drop(v) ≡    tok v := ⊥; play v := W if ∀p ∈ P eq (v), tok p =↑ F if ∃p ∈ P eq (v), tok p =↑ (5.29) R Return : for all v ∈ V \ {r} ¬Er(v) ∧ tok v =↑ ∧MayDropUp(v) -→ Drop(v)
Rule R r NewDFS In a similar situation, where all of its children have repaired themselves, the root does not drop the token, for it would simply destroy it. When the root is in such a situation, it means that the current circulation round is terminated, and one other can start.

To do that, the root resets its token value to , which corresponds to the first time the token is held by any node in the new circulation round, and switches its color. After that, the root will be able to execute rule R Nego and to start a negotiation process with its children.

NewToken(r) ≡

c r := ¬c r tok r := (5.30)

This action can be seen as one atomic execution of the two actions Drop and Win, which corresponds to what r would have done, non-atomically, if it were not the root.

R r

NewDFS :

for v = r ¬Er(v) ∧ tok v =↑ ∧MayDropUp(v) -→ NewToken(v)
Let us now consider the actions taken by children of such a node, i.e. a node v which has one parent of the same color and its variable tok =↑.

Rule R ReplayUp If node v only has parents that are sending the token higher, i.e. no other parent which is still involved in a token circulation, then v can reset its variable play v = P to be ready for the next circulation round.

ReplayW(v) ≡ ∃p ∈ P eq (v) : tok p =↑ ∧∀p ∈ P eq (v), tok p ∈ {⊥, ↑} (5.31)
Note that v only considers its parent with the same color, since the situation which we want to prevent is livelock caused by the oscillation between two tokens. Therefore, v can join a negotiation of the other color by this action.

R ReplayUp : for all v ∈ V \ {r} ¬Er(v) ∧ tok v = ⊥ ∧ play v = W ∧ ReplayW(v) -→ Replay(v)
Rule R Fake If v has, in addition to some parents that are sending the token higher, other parents which have not terminated their token circulation, it must update its variable play v = F. FakeReplay(v) ≡ ∃p ∈ P eq (v), tok p =↑ ∧¬ReplayW(v) (5.32)

R Fake : for all v ∈ V \ {r} ¬Er(v) ∧ tok v = ⊥ ∧ play v = W ∧ FakeReplay(v) -→ play v := F
Rule R ReWin Finally, we must design a rule to cancel the effect of updating one's variable at F, to reset it at W. Without this rule, the predicate WaitSib could be infinitely false on one parent of v, and thus the token could not be sent higher. This rule can be activated only when the node does not have any parent with the same color such that tok =↑.

Up to this rule, all the guards of the rules require that the node is near a token. For consistency, we also require proximity of a token for this rule, but it is not actually necessary.

StopFaking(v) ≡ ∃p ∈ P eq (v) : tok v = ⊥ ∧ ∀p ∈ P eq (v), tok p =↑ (5.33) R ReWin : for all v ∈ V \ {r} ¬Er(v) ∧ tok v = ⊥ ∧ play v = F ∧ StopFaking(v) -→ play v := W Figure 5
.10 present the process of how a token is returned to a parent.

↓, W •, W ⊥, W ⊥, W ↓, W ↑, W ⊥, W ⊥, W ROfferUp ↓, W ↑, W ⊥, P ⊥, P RReplayUp •, W ↑, W ⊥, P ⊥, P RReceive •, W ⊥, W ⊥, P ⊥, P RReturn •, W ⊥, W ⊥, P ⊥, P RReNego Figure 5
.11: Execution of rules for returning the token back to one parent. The activated node is the one with its line doubled

Complete Algorithm

Algorithm 2 presents all the rules of our algorithm.

Algorithm 2: Token Circulation algorithm

∀v ETrustChild : Er(v) -→ tokv :=↓ ∀v ROfferUp : ¬Er(v) ∧ tokv = • ∧ ¬WaitSib(v) ∧ (∀u ∈ Cneq(v) : play u ∈ {W, F}) -→ tokv :=↑ ∀v RGive : ¬Er(v) ∧ tokv = • ∧ Give(v) -→ tokv := v = r RFakeWin : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ ¬OkNeg(v) -→ FakeWin(v) v = r RWin : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ WinNeg(v) -→ Win(v) v = r RLose : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ LoseNeg(v) -→ play v := L v = r RNewBit : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ AnswerNeg(v) -→ Announce(v) ∀v RmaxPos : ¬Er(v) ∧ tokv = • ∧ |Players(v)| ≥ 2 ∧ Synch(v) ∧ NextPlay(v) -→ MaxPos(v) ∀v RNewPh : ¬Er(v) ∧ tokv = • ∧ |Players(v)| ≥ 2 ∧ Synch(v) ∧ PhComplete(v) -→ PhasePlus(v) ∀v RNewPlay : ¬Er(v) ∧ toku = ∧(∀u ∈ Cneq(v) : play u = P ∨ toku = ) -→ tokv := v = r RReplayD : ¬Er(v) ∧ tokv = ⊥ ∧ play v = L ∧ ReplayL(v) -→ Replay(v) ∀v RDrop : ¬Er(v) ∧ tokv = ∧(∀u ∈ Cneq(v) : play u = L ∨ toku = ) -→ tokv :=↓ ∀v RNego : ¬Er(v) ∧ tokv = ∧ (∀p ∈ P(v) : toku ∈ { , }) -→ StartNego(v) ∀v RReceive : ¬Er(v) ∧ tokv =↓ ∧(∀u ∈ C(v), toku ∈ {⊥, ↑}) -→ tokv := • ∀v RReNego : ¬Er(v) ∧ tokv = • ∧ Leaf(v) ∧ ∀u ∈ Cneq(v) : play u = L -→ StartNego(v) v = r RReturn : ¬Er(v) ∧ tokv =↑ ∧MayDropUp(v) -→ Drop(v) r R r NewDFS : ¬Er(v) ∧ tokv =↑ ∧MayDropUp(v) -→ NewToken(v) v = r RReplayUp : ¬Er(v) ∧ tokv = ⊥ ∧ play v = W ∧ ReplayW(v) -→ Replay(v) v = r RFake : ¬Er(v) ∧ tokv = ⊥ ∧ play v = W ∧ FakeReplay(v) -→ play v := F v = r RReWin : ¬Er(v) ∧ tokv = ⊥ ∧ play v = F ∧ StopFaking(v) -→ play v := W
Figures 5.12 and 5.13 present the scheme of an execution of our algorihtm. These are two dual visions of the same phenomenon. The first one focuses on the values of the different variables of one node v, and the second on the executions of the rules on one node v.

Proof of the Correctness of our Algorithm

In this section, we prove that Algorithm 2 is a self-stabilizing algorithm for the token circulation problem, as it is defined in Specification 5.1. We also prove that this algorithm is optimal in terms of memory, i.e. that any algorithm which solves T C in S PU requires Ω(log log n) bits per nodes, even under less general hypothesis than ours. This section is subdivided in four subsections. In Section 5.4.1 we establish that maximal

⊥, W ⊥, F ⊥, P ⊥, L ph, b , W •, W , W , W ↓, W •, W ↑, W RNewBit RWin RLose RReplayD RFake RReWin RNego RGive RmaxPos -RNewPh RFakeWin RReplayUp R F a k e W i n

RNewPlay

RDrop RReceive RReNego ROfferUp RReturn Figure 5.12: Chain of the states taken by a node during the execution of the agorithm. The update of c v is represented by color gray. Rules in blue corresponds to the negotiation. Rules in red correspond to the sending of a token from a child to a parent. Rules in black correspond to the sending of a token from a parent to a child. executions of our algorithm are infinite. Formally, we prove that in any configuration, there is at least one enabled node. This work is static in the sense that we do not need to consider an execution of the algorithm. It boils down to a syntactical analysis of the guards of the rules of our algorithm (Algorithm 2).

R NewBit idv R ReplayD play v := P R Lose play v := L R Win tokv := ; play v := W idv := (1, ⊥) R Nego tokv := •; R maxPos idv R NewPh idv R Give tokv := ; R NewPlay tokv := R Drop tokv :=↓ R Receive tokv := • R ReNego tokv := • idv := (1, ⊥) R OfferUp tokv :=↑ R Return tokv := ⊥ R Fake play v := F R ReWin play v := W R ReplayUp play v := P
In Section 5.4.2 we establish that no token can circulate indefinitely in the D o , unless it regularly reaches the root and is reset by the execution of R r NewDFS . This guarantees that a token which is not anchored at the root of the D o either vanishes, or is eventually not activated. Using the previous, we also establish that there are an infinite number of circulation rounds in maximal executions of our algorithm. This guarantees that our algorithm satisfies Condition 2 of Specification 5.1.

In Section 5.4.3 we use the previous results to establish that the token anchored at the root circulates fairly in deeper and deeper parts of the D o . Thus, even if there are other tokens in the network, they will eventually be reached and destroyed by the legitimate token anchored at the root. Therefore we prove in this section that, at some point, the execution of our algorithm satisfies Conditions 1 and 3 of Specification 5.1, which means that it is a self-stabilizing algorithm for T D.

Finally, in Section 5.4.4 we use the results of Chapter 3 to prove that the space complexity of our algorithm is optimal.

In order to prove that our algorithm satisfies conditions of Specification 5.1, we must first define the predicates T and R involved in this specification. One node v is considered to hold the token if it has a non-empty value for its variable tok v , and if none of its children holds the token. One node v is considered to have access to the resource if it is in the state where it just received the token from its parent, which corresponds to tok v = .

Definition 5.12 (Predicates for our Token Circulation Algorithm)

The resolution of T D by our algorithm will be proven under the following specification predicates:

T (v, γ) ≡ tok γ v = ⊥ ∧ ∀u ∈ C(v), tok γ u = ⊥ R(v, γ) ≡ T (v, γ) ∧ tok γ v = Definition 5.13 (Reset Points) Let = γ 0 → • • • be an execution. We say that γ i is a reset point of if r executes R r NewDFS during γ i-1 → γ i+1 .
We say that two reset points γ i and γ j are consecutive if i < j and ∀k ∈ [i + 1, j + 1], γ k is not a reset point.

Theorem 5.1 (Circulation Rounds)

Let = γ 0 → • • • be an execution. Let us denote by t 0 ≤ t 1 ≤ • • • all the reset points of , such that ∀i ≥ 0, γ ti and γ ti+1 are consecutive. ∀i ≥ 0, γ t1 → • • • → γ ti+1-1 is a circulation round.
Proof : For any computing step cs = γ → γ , we have ¬R γ (r) ∧ R γ (r) if and only if r executes R r NewDFS , which is equivalent to γ being a reset point.

Liveness

Recall that we denote by A e (γ) the set of the enabled nodes for A in configuration γ. In this section, we prove that ∀γ ∈ Γ, A e (γ) = ∅.

The proof is subdivided in several lemmas. In each lemma we work under the hypothesis that some value for tok v , on one node v, is present in γ, and in each case we prove that there exists at least one enabled node, in γ. Not all the lemmas are independent: it happens that to prove a lemma, we simply prove that there exists one node u with another value of tok u , value which has already been dealt with in a previous lemma.

One lemma is even proven by induction, the lemma which considers as a hypothesis the presence of a node v such that tok v =↓. Such nodes can actually pretty far from the actual token, and thus to find an enabled node, we may have to descend a branch of the D o , until we fall on a leaf, or on a node with a different value for tok v .

More precisely, we prove that either we can find an enabled node, or there exists one other node u such that tok u =↓, but u is deeper than v in the DODAG. Since DODAGs are finite, and acyclic, there can only be a finite number of times where the second hypothesis is the right one, and therefore this proves that there exists at least one enabled node.

The proofs are basically reasoning by case disjunction, which forms decision trees of variable depth. We must guarantee that at the end of each branch i.e. at each leaf, we find one enabled node.

Since it is basically syntactical analysis, we only present the different decision trees, which contain all the elements of the proofs, and are easier to parse than the written version of the proofs.

In each proof, we also provide a reasoning toolbox, to remind the reader of the detail of the predicates considered in the reasoning.

Lemma 5.1

Let γ ∈ Γ. If there exists v ∈ V such that tok v =↑ in γ then A e (γ) = ∅.

Proof : The proof is given in Figure 5.14

tok v =↑ MayDropUp(v) v : R Return /R r NewDFS ∃p ∈ P(v) : tok p ∈ { , •, , } p : E TrustChild
∀v ETrustChild : Er(v) -→ tokv :=↓ v = r RReturn : ¬Er(v) ∧ tokv =↑ ∧MayDropUp(v) -→ Drop(v) r R r NewDFS : ¬Er(v) ∧ tokv =↑ ∧MayDropUp(v) -→ NewToken(v) v = r RReplayUp : ¬Er(v) ∧ tokv = ⊥ ∧ play v = W ∧ ReplayW(v) -→ Replay(v) v = r RFake : ¬Er(v) ∧ tokv = ⊥ ∧ play v = W ∧ FakeReplay(v) -→ play v := F Er(v) ≡ tokv ∈ {•, } ∧ ∃u ∈ C(v) : toku = ⊥ ∨ tokv ∈ { , } ∧ ∃u ∈ C(v) : toku / ∈ {⊥, } ∨ tokv = • ∧ ∃u ∈ C(v) : toku / ∈ {⊥, ↑} -→ tokv :=↓ MayDropUp(v) ≡ ∀p ∈ P(v), tokp ∈ {⊥, ↓, ↑, •} ∧ ∀u ∈ Ceq(v), (toku = ⊥ ⇒ play u ∈ {P, L, F}) ReplayW(v) ≡ ∃p ∈ Peq(v) : tokp =↑ ∧∀p ∈ Peq(v), tokp ∈ {⊥, ↑} FakeReplay(v) ≡ ∃p ∈ Peq(v), tokp =↑ ∧¬ReplayW(v) Lemma 5.2 Let γ ∈ Γ. If there exists v ∈ V such that tok v = in γ then A e (γ) = ∅.
Proof : The proof is given in Figure 5.15

tok v = ∀c ∈ C(v) : tok c ∈ {⊥, } ∀c ∈ C neq (v) : play c = P ∨ tok c = v : R NewPlay ∃c ∈ C neq (v) : play c = P ∧ tok c = ⊥ OkNeg(c) c : R Win , c = r ¬OkNeg(c) c : R FakeWin , c = r ∃c ∈ C(v) : tok c / ∈ {⊥, } v : E TrustChild
Er(v) -→ tokv :=↓ ∀v RNewPlay : ¬Er(v) ∧ toku = ∧(∀u ∈ Cneq(v) : play u = P ∨ toku = ) -→ tokv := ∀v = r RWin : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ WinNeg(v) -→ Win(v) ∀v = r RFakeWin : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ ¬OkNeg(v) -→ FakeWin(v) Er(v) ≡ tokv ∈ {•, } ∧ ∃u ∈ C(v) : toku = ⊥ ∨ tokv ∈ { , } ∧ ∃u ∈ C(v) : toku / ∈ {⊥, } ∨ tokv = • ∧ ∃u ∈ C(v) : toku / ∈ {⊥, ↑} -→ tokv :=↓ WinNeg(v) ≡ OkNeg(v) ∧ ∃p ∈ Pneq(v) : tokp = OkNeg(v) ≡ |ParNeg(v)| ≤ 1 ∨ (|ParNeg(v)| = 2 ∧ {tokp | p ∈ ParNeg(v)} ∈ {{ , }, { , }}) ParNeg(v) = {p ∈ P(v) | tokp ∈ {⊥, ↑, ↓}} Lemma 5.3 Let γ ∈ Γ. If there exists v ∈ V such that tok v = • in γ then A e (γ) = ∅.
Proof : The proof is given in Figures 5.16 and 5.17 Proof : The proof is given in Figure 5.18

Tools Lemma 5.3 ∀v ETrustChild : Er(v) -→ tokv :=↓ ∀v RmaxPos : ¬Er(v) ∧ tokv = • ∧ |Players(v)| ≥ 2 ∧ Synch(v) ∧ NextPlay(v) -→ MaxPos(v) ∀v RNewPh : ¬Er(v) ∧ tokv = • ∧ |Players(v)| ≥ 2 ∧ Synch(v) ∧ PhComplete(v) -→ PhasePlus(v) ∀v RGive : ¬Er(v) ∧ tokv = • ∧ Give(v) -→ tokv := ∀v ROfferUp : ¬Er(v) ∧ tokv = • ∧ ¬WaitSib(v) ∧ (∀u ∈ Cneq(v) : play u ∈ {W, F}) -→ tokv :=↑ v = r RNewBit : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ AnswerNeg(v) -→ Announce(v) v = r RLose : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ LoseNeg(v) -→ play v := L v = r RWin : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ WinNeg(v) -→ Win(v) v = r RFakeWin : ¬Er(v) ∧ tokv = ⊥ ∧ play v = P ∧ ¬OkNeg(v) -→ FakeWin(v) v = r RReWin : ¬Er(v) ∧ tokv = ⊥ ∧ play v = F ∧ StopFaking(v) -→ play v := W Er(v) ≡ tokv ∈ {•, } ∧ ∃u ∈ C(v) : toku = ⊥ ∨ tokv ∈ { , } ∧ ∃u ∈ C(v) : toku / ∈ {⊥, } ∨ tokv = • ∧ ∃u ∈ C(v) : toku / ∈ {⊥, ↑} -→ tokv :=↓ AnswerPar(v, p) ≡ (ph v = ph p ) ∨ (ph p = 1 ∧ bp = ⊥ ∧ bv = ⊥) LosePar(v, p) ≡ ph p = ph v ∧ bp = ⊥ ∧ bp = bv ParNeg(v) = {p ∈ P(v) | tokp ∈ {⊥, ↑, ↓}} OkNeg(v) ≡ |ParNeg(v)| ≤ 1 ∨ (|ParNeg(v)| = 2 ∧ {tokp | p ∈ ParNeg(v)} ∈ {{ , }, { , }}) WinNeg(v) ≡ OkNeg(v) ∧ ∃p ∈ Pneq(v) : tokp = LoseNeg(v) ≡ OkNeg(v) ∧ ¬WinNeg(v) ∧ ∃p ∈ Pneq(v) : tokp = • ∧ LosePar(v, p) AnswerNeg(v) ≡ OkNeg(v) ∧ ¬WinNeg(v) ∧ ¬LoseNeg(v) ∧ ∃p ∈ Pneq(v) : tokp = • ∧ AnswerPar(v, p) Players(v) = {u ∈ Cneq(v) |tokv = ⊥ ∧ play u = P} Synch(v) ≡ ∀u ∈ Players(v), ph u = ph v NextPlay(v) ≡ bv = ⊥ ∧ ph v = 1 ∧ ∀u ∈ Players(v), bu = ⊥ ∨ ph v = 1 ∧ ∃u ∈ Players(v) : bu = ⊥ PhComplete(v) ≡ (ph v = 1 ∨ bv = ⊥) ∧ ∀u ∈ Players(v), bu = bv Give(v) ≡ |Players(v)| = 1 ∨ (|Players(v)| = 0 ∧ ∃u ∈ Cneq(v) : play u = L) WaitSib(v) ≡ ∃c ∈ Ceq(v) : play c = F StopFaking(v) ≡ ∃p ∈ Peq(v) : tokv = ⊥ ∧ ∀p ∈ Peq(v), tokp =↑ tokv = • ∀u ∈ C(v) : toku = ⊥ |Players(v)| = 0 ∃c ∈ Cneq(v) : play c = L v : RGive ∀c ∈ Cneq(v), play c ∈ {W, F} ∀c ∈ Ceq(v), play c = F v : ROfferUp ∃c ∈ Ceq(v) : play c = F ∀p ∈ Peq(c), tokp =↑ c : RReWin ∃p ∈ Peq(c) : tokp =↑ p : Lemma 5.1 |Players(v)| = 1 v : RGive |Players(v)| ≥ 2 ∃c ∈ Players(v) : ¬OkNeg(c) c : RFakeWin ∀u ∈ Players(v), OkNeg(u) ∧ ∃c ∈ Players(v) : WinNeg(c) c : RWin ∀u ∈ Players(v), (OkNeg(u) ∧ ¬WinNeg(u)) ∧ ∃c ∈ Players(v) : LoseNeg(c) c : RLose ∀u ∈ Players(v), (OkNeg(u) ∧ ¬WinNeg(u) ∧ ¬LoseNeg(u)) ∧ ∃c ∈ Players(v) : ph c = ph v c : RNewBit ∀u ∈ Players(v), (OkNeg(u) ∧ ¬WinNeg(u) ∧ ¬LoseNeg(u)) ∧ Synch(v) ∃u ∈ C(v) : toku = ⊥ v : ETrustChild
Synch(v) ph v = 1 b v = ⊥ ∃c ∈ Players(v) : b c = ⊥ c : R NewBit ∀c ∈ Players(v), b c = ⊥ v : R maxPos b v = ⊥ ∃c ∈ Players(v) : b c = b v c : R Lose ∀c ∈ Players(v), b c = b v v : R NewPh ph v = 1 b v = ⊥ ∃c ∈ Players(v), b c = ⊥ v : R maxPos ∀c ∈ Players(v), b c = ⊥ v : R NewPh b v = ⊥ ∃c ∈ Players(v) : b c = b v c : R Lose ∀c ∈ Players(v), b c = b v v : R NewPh
tokv = ∀c ∈ C(v) : tokc ∈ {⊥, } ∀c ∈ Cneq(v) : play c = L ∨ tokc = v : RDrop ∃c ∈ C(v) : play c = L ∧ tokc = ⊥ ∃p ∈ Pneq(c) : tokp ∈ {•, } p : Lemma 5.3 or Lemma 5.2 ∀p ∈ Pneq(c) : tokp / ∈ {•, } c : RReplayD ∃c ∈ C(v) : tokc ∈ {⊥, } v : ETrustChild
Er(v) -→ tokv :=↓ ∀v RDrop : ¬Er(v) ∧ tokv = ∧(∀u ∈ Cneq(v) : play u = L ∨ toku = ) -→ tokv :=↓ ∀v = r RReplayD : ¬Er(v) ∧ tokv = ⊥ ∧ play v = L ∧ ReplayL(v) -→ Replay(v) Er(v) ≡ tokv ∈ {•, } ∧ ∃u ∈ C(v) : toku = ⊥ ∨ tokv ∈ { , } ∧ ∃u ∈ C(v) : toku / ∈ {⊥, } ∨ tokv = • ∧ ∃u ∈ C(v) : toku / ∈ {⊥, ↑} -→ tokv :=↓ ReplayL(v) ≡ ∀u ∈ Pneq(v), toku / ∈ {•, } ∧ ∃u ∈ Pneq(v), toku ∈ { , •} Lemma 5.5 Let γ ∈ Γ. If there exists v ∈ V such that tok v = • in γ then A e (γ) = ∅.
Proof : The proof is given in Figure 5.19

tokv = • ∀c ∈ C(v) : tokc = ⊥ ∃c ∈ Cneq(v) : play c = L ∃p ∈ Pneq(c) : tokp ∈ {•, } p : Lemma 5.3 or Lemma 5.2 ∀p ∈ Pneq(c) : tokp / ∈ {•, } c : RReplayD ∀c ∈ Cneq(v) : play c = L v : RReNego ∃c ∈ C(v) : tokc = ⊥ ∃c ∈ C(v) : tokc =↑ c : Lemma 5.1 ∃c ∈ C(v) : tokc / ∈ {⊥, ↑} v : ETrustChild
Er(v) -→ tokv :=↓ ∀v RReNego : ¬Er(v) ∧ tokv = • ∧ Leaf(v) ∧ ∀u ∈ Cneq(v) : play u = L -→ StartNego(v) v = r RReplayD : ¬Er(v) ∧ tokv = ⊥ ∧ play v = L ∧ ReplayL(v) -→ play v := P Er(v) ≡ tokv ∈ {•, } ∧ ∃u ∈ C(v) : toku = ⊥ ∨ tokv ∈ { , } ∧ ∃u ∈ C(v) : toku / ∈ {⊥, } ∨ tokv = • ∧ ∃u ∈ C(v) : toku / ∈ {⊥, ↑} -→ tokv :=↓ ReplayL(v) ≡ ∀u ∈ Pneq(v), toku / ∈ {•, } ∧ ∃u ∈ Pneq(v), toku ∈ { , •} Lemma 5.6 Let γ ∈ Γ. If there exists v ∈ V such that tok v = in γ then A e (γ) = ∅.
Proof : The proof is given in Figure 5.20

tok v = ∀c ∈ C(v) : tok c = ⊥ ∃p ∈ P(v) : tok p ∈ { , } p : Lemmas 5.2 or Lemma 5.4 ∀p ∈ P(v), tok p / ∈ { , } v : R Nego ∃c ∈ C(v) : tok c = ⊥ v : E TrustChild
Er(v) -→ tokv :=↓ v = r RNego : ¬Er(v) ∧ tokv = ∧ (∀p ∈ P(v) : toku ∈ { , }) -→ StartNego(v) Er(v) ≡ tokv ∈ {•, } ∧ ∃u ∈ C(v) : toku = ⊥ ∨ tokv ∈ { , } ∧ ∃u ∈ C(v) : toku / ∈ {⊥, } ∨ tokv = • ∧ ∃u ∈ C(v) : toku / ∈ {⊥, ↑} -→ tokv :=↓ Lemma 5.7 Let γ ∈ Γ. If there exists v ∈ V such that tok v =↓ in γ then A e (γ) = ∅.
Proof : The proof is given in Figure 5.21 ∀v ETrustChild :

tok v =↓ ∃u ∈ C(v) : tok u =↓ u : Lemma:5.7, prof u < prof v ∃u ∈ C(v) : tok u ∈ { , •, , •, } u : Lemma 5.
Er(v) -→ tokv :=↓ ∀v RReceive : ¬Er(v) ∧ tokv =↓ ∧(∀u ∈ C(v), toku ∈ {⊥, ↑}) -→ tokv := • Er(v) ≡ tokv ∈ {•, } ∧ ∃u ∈ C(v) : toku = ⊥ ∨ tokv ∈ { , } ∧ ∃u ∈ C(v) : toku / ∈ {⊥, } ∨ tokv = • ∧ ∃u ∈ C(v) : toku / ∈ {⊥, ↑} -→ tokv :=↓ Theorem 5.2 ∀γ ∈ Γ, A e (γ) = ∅
Proof : Let γ ∈ Γ be a configuration. Since tokr ∈ {↑, , •, , •, , ↓}, one of the following lemmas applies: 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 5.7.

Progress

In this section we formally establish, at once, two crucial properties for the validity of our algorithm. The first property is that if a token is not anchored at the root of the D o (we will give later a proper definition of the anchor of a token), then it can only circulate a finite number of times before being blocked, or deleted. This means that no scheduler, even unfair, can create an execution in which the token held by the root is never activated.

The second property is that circulation rounds (see Section 5.2.5) are always finite. We actually prove that the token held by the root can only circulate a finite number of times before it reaches the root, and the root executes R r NewDFS . The combination of these two properties, and of the liveness established in Theorem 5.2 leads to the guarantee that there is an infinity of finite circulation rounds in any maximal execution of our algorithm. We will prove in the next section that, eventually, the circulation of the token is fair.

To prove both properties, we define a potential function, which associates a positive value (a weight) to each token in any configuration. Then, we establish that any computing step decreases the weight of the token, unless the token is reset by an execution of R r NewDFS . This establishes that a token cannot circulate indefinitely, since any step it takes makes a positive quantity decrease, unless this token is anchored at the root and there are an infinity of new circulation rounds.

In this section we provide a formal proof of these properties. Let us first have an overview of this proof. In a corrupted initial configuration, the network may contain several tokens, which may have common ancestors, and also have several ancestors. To deal with the diversity of possible configurations, we define a new object to reason on, circulation DODAGs, denoted by CD o , for each token. Then, we define a weight function, which associates a weighted DODAG, denoted by WD o , to each CD o . We finally prove that each time a node of a CD o is activated, the corresponding WD o decreases. According to Theorem 5.2, there is at least one enabled node in each configuration, which guarantees that WD o 's actually decrease in maximal executions.

In Section 5.4.2.1 we present the inherent difficulties to overcome for proving our results, and show how CD o 's and WD o 's are suitable solutions. In Section 5.4.2.2 we formally define CD o 's and establish basic properties on them. In Section 5.4.2.3 we show how to define the weight function we use, and introduce the concept of WD o 's. Then, in Sections 5.4.2.4, 5.4.2.5, 5.4.2.6, 5.4.2.7, and 5.4.2.8 we define the actual weight function, step by step, and prove properties on it at each step. Finally, we establish our main theorems in Section 5.4.2.9.

Difficulties to Overcome, Circulation DODAG

To associate a decreasing weight to a token, the main difficulty to overcome is that during one circulation, the token shifts a lot, upward and downward alternately. Thus, the information of whether the token is very close to the end of the circulation round, or still far, is not local. This information strongly depends, for example, on which branches have already been visited by the token, on the number of unvisited children the different nodes have, on whether one error will be raised, etc. As a result, we cannot focus only on the token if we want to succeed in estimating how many steps it still has to execute before it ends its circulation.

One first condition for our potential function to be consistent is that it takes into account the variables of the node holding the token, but also information relative to some ancestors of that node. In practice, only the ancestors which are somehow pointing to this token will be considered.

Yet, it might happen that one node in the ancestry of the token holder has several children involved in a token circulation. If this is due to a triangle topology, i.e. if one node has two parents, one being the parent of the other one, then considering the ascendants of the token is sufficient. But this could also be a situation in which one node has two independent token circulations below it. Our algorithm does not create such situations, but they might exist due to an incorrect initial configuration. In such a situation, our previous definition is not fully satisfactory since it does not highlight the fact that those two token circulations are, though independent, intertwined.

To embrace that complexity, we define an ad hoc object, called a Circulation DODAG, denoted CD o , which has a D o structure. That new object follows the same idea as the upwards branch starting at the token, but we reverse that idea. We first look for nodes with no ancestry (called anchor), that is to say nodes v such that tok v = ⊥ ∧ ∀p ∈ P(v), tok p ∈ {⊥, ↑}. Then, we go down from each anchor to all its descendants, following nodes u such that tok u = ⊥. Since nodes with tok u =↑ can only be updated by R Return , with effect tok u := ⊥, we include them in our structures, but not their potential descendants: such nodes are necessarily leaves of the CD o . Note that if the initial configuration is inconsistent, it may contain several CD o 's. In Section 5.4.2.2 we formally define CD o 's and we establish some basic properties on CD o 's.

Our goal is now to associate a finite positive quantity, a weight, to any CD o in any configuration. Such an association will be called a weight function. A weight function is said admissible if any activation of the CD o results in a decrease of the weight of the CD o . Since there does not exist an infinite decreasing sequence of positive integers, it comes that any CD o has a finite lifetime. Actually, since our algorithm of token circulation does not terminate, there necessarily exists one rule that does not respect that specification. The rule R r NewDFS is the only rule that increases the weight of a CD o , as it refreshes the token by switching its color. Since only the root of the D o can execute R r NewDFS , we guarantee that any other CD o , anchored at another node than the root, has a finite lifetime.

Unfortunately, associating a simple integer to a CD o does not allow to take into account the diversity of situations that we must consider. The appropriate quantity to reason on has itself a D o structure, which has the same topology as the CD o to which it is associate by the weight function. Such D o 's are called weighted DODAGs and are denoted WD o . More precisely, a WD o is a 5-tuple of D o 's. Each component of the tuple deals with one aspect of the algorithm. The order in which the different components are set is crucial. Indeed, it happens that some computing step makes one of the components increase. We prove that this can be only if one component with higher priority decreases at the same time.

• The first component of the 5-tuple evaluates the number of unvisited children of each node of the CD o .

• The second component is dedicated to the numbers of errors in the network.

• The third component is dedicated to the updates of variable tok on each node, as depicted in Figure 5.7.

• The fourth component is dedicated to the variable play on the children of each node of the CD o .

• And the last component is dedicated to the negotiation process near nodes with tok = •.

Circulation DODAGs

In this subsection, we define tools to capture the behavior of the token circulation, and especially Circulation DODAGs, CD o 's. We prove in particular that the number of CD o 's can never increase, which is a very desirable property to have to establish that the token is eventually unique.

Remember that we denote by var γ v the state of variable var for the node v in configuration γ, and by P γ (v) the values of predicate P on node v in configuration γ.

We first define the anchors of our CD o 's. The anchors are nodes v that are involved in a token circulation, i.e. tok v = ⊥, and which do not have any parent in this token circulation. Recall that nodes u such that tok u =↑ cannot be considered as parents, since they can only execute rule R Return , which makes them quit the circulation.

Definition 5.14 (Anchor)

Let γ ∈ Γ be a configuration. Node a ∈ V is an anchor in γ if

• tok γ a = ⊥, and

• ∀u ∈ P(a), tok γ u ∈ {⊥, ↑}.

We denote by A(γ) the set of all anchors at γ, and by A * (γ) the set of all anchors except the root.

Remark 5.4

The root of G is an anchor in any configuration γ.

Now that we have defined anchors, we can define the nodes of the CD o anchored at one particular anchor. The nodes of the CD o anchored at a are all the nodes which can reach a by paths corresponding to a actual token circulation. In other words, we only consider paths in which all nodes have a value tok = ⊥, and such that all the nodes apart from the source have a value tok =↑. Indeed, nodes u such that tok u =↑ are necessarily leaves of CD o 's.

Definition 5.15 (Nodes of a Circulation DODAG)

Let us consider a configuration γ ∈ Γ and an anchor a ∈ A(γ). We define by induction the nodes of the Circulation DODAG (CD o ) anchored at a in γ, and denote by V γ a as the smallest set which contains the node a and such that:

v ∈ V γ a ⇐⇒ tok γ v = ⊥ ∃u ∈ P(v) : u ∈ V γ a ∧ tok γ u =↑ .
We now give a definition of CD o and we present an example with several CD o 's in one D o in Figure 5.22.

Definition 5.16 (Circulation DODAG)

Let us consider a configuration γ ∈ Γ and an anchor a ∈ A(γ). We define the Circulation DODAG (CD o ) anchored at a in γ, and denote D γ a , as the D o with nodes V γ a , and whose parental relationship is defined by:

∀u, v ∈ V γ a , (u ∈ C D γ a (v) ⇐⇒ u ∈ C G (v) ∧ tok γ v =↑) Remark 5.5
We use the notation v ∈ D γ a as an alias for v ∈ V γ a .

Remark 5.6

A CD o with anchor a is a sub-D o of G a , the D o under a (see Definition 5.4).

Lemma 5.8 establishes that any node v such that tok v = ⊥ belongs to at least one CD o . It will be useful in the latter to prove that any action taken by some node has an effect on at least one CD o , and therefore decreases the weight of at least one CD o . .9 states that the set of anchors A of G is non-increasing: if one node v is not an anchor in a configuration γ, then it will never be an anchor in a further configuration. This lemma justifies that focusing on the decrease of the weight of CD o is sufficient, since no CD o appears.

Lemma 5.9

Let cs = γ → γ be a computing step. We have A(γ ) ⊆ A(γ)

Proof : Let us prove the equivalent statement: V \ A(γ) ⊆ V \ A(γ ). Let the node v be v / ∈ A(γ), and prove that v / ∈ A(γ ).

• Suppose first that

tok γ v = ⊥. If tok γ v = ⊥, then v / ∈ A(γ ). Otherwise, we have tok γ v = ⊥ and tok γ v = ⊥,

Remark 5.7

In the latter, when considering the effect of a computing step γ → γ on a CD o , we always work under the hypothesis that a ∈ A(γ ), which also implies that a ∈ A(γ) according to Lemma 5.9.

Corollary 5.1

The number of CD o does not increase.

A CD o evolves through an execution of the algorithm, and in particular it can federate new nodes during some computing steps, if some node close to the CD o executes R Win . To be able to consider such situations, we introduce the notion of border of a CD o , which are close nodes that might join the CD o .

Definition 5.17 (Border of a CD o )

Let D γ a be a CD o . We define the border of D γ a and denote B(D γ a ) the set of nodes v ∈ V such that tok γ v = ⊥, and ∃p ∈ P(v)

: p ∈ D γ a ∧ tok γ p =↑.
The border of a CD o describes the nodes that can join a CD o . On the other hand, some nodes can leave a CD o . Lemma 5.10 establishes that the only nodes susceptible to leave a CD o during one computing step are the leaves of the CD o : the nodes v such that tok v =↑.

Lemma 5.10

Let cs = γ → γ be a computing step, and let a ∈ A(γ

). Let v 1 v 2 • • • v k be a branch of D γ a such that v 1 = a. Then v 1 v 2 • • • v k-1 is a branch of D γ a , and if v k does not execute R Return during cs, then v 1 v 2 • • • v k is a branch of D γ a .
Proof : (vi), we deduce that tok γ v i+1 = ⊥, and thus vi+1 executes RReturn during cs. But then, tok γ v i+1 =↑ and thus vi+1 has no children in D γ a . We deduce that vi+1 = v k , which means that vi = v k-1 and thus v1v2

If B = v1v2 • • • v k is a branch of D γ a the
• • • v k-1 is a branch of D γ a , and if v k does not execute RReturn then v1v2 • • • v k is a branch of D γ a .
Lemma 5.11 establishes constraints on which actions might be taken by a node.

Lemma 5.11

Let cs = γ → γ be a computing step, and let v be a node.

If v = r then v can update c v only if tok γ v =↑, and if v = r then v can update c v only if tok γ v = ⊥. Proof : If v =

Introduction to the potential function W

To prove that one CD o can only be activated a finite number of times, we associate a weight to each CD o in each configuration γ. We design this weight function (or potential function) such that if one node is activated in the CD o or near it during the computing step γ → γ , then the weight of the CD o is less in γ than in γ. The goal is to provide the domain of weights with a well-founded order, so that such decreasing sequences are necessarily finite.

Recall that decreasing occurs only during periods during which no execution of R r NewDFS resets the weight of a CD o to a high value.

Unfortunately, the structure of CD o is too complex for it can be valuated by an object as simple as an integer. The most natural way to associate a weight to a CD o is to build a D o , similar to the CD o considered, but whose nodes are labeled with weights. We call such structures Weighted DODAGs, denoted WD o 's for short.

In this section, we consider (M, ≤) an arbitrary well-founded set. Although our weight function is defined on CD o 's, it is simpler to work through this section by considering arbitrary D o 's. Since CD o 's have a D o structure, all this work naturally applies to CD o 's. Definition 5.18 formally introduces WD o 's: the object on which we will define a wellfounded order and that will later be considered as the weight of D o 's. The next step is to define an order of WD o 's. This is feasible only if the two WD o 's we compare are based on D o 's having the same anchor a. This won't be restrictive since in practice, we compare the weights of the same CD o at different, consecutive, configurations of an execution.

To compare WD o 's, the first step is to compare branches of WD o 's. Since two WD o 's that share the same anchor do not necessarily share the same branches in their topology, the appropriate notion to this comparison is the projection of WD o 's on the branches of the D o under their common anchor. This is similar to what we introduced in Definition 5.6.

(v 1 )W(v 2 ) • • • W(v j ), where D a (B) = v 1 v 2 • • • v j is the projection of D a on B.
Since the branches of two WD o 's may have variable length, we compare them using the alphabetical order (see Definition 5.8). This order is well-founded since the branches of the WD o 's are all bounded by n, the number of nodes in the graph.

To compare WD o 's, we compare the weights of all the branches which start at a. One WD o D 1 a is less than or equal to one other WD o D 2 a if, for any branch B of G a the D o under a, the projection of D 1 a on B is less than or equal to the projection of D 2 a on B. Definition 5.20 presents a well-founded order on WD o 's.

Definition 5.20 (Order on WD o 's)

We define a partial order on WD o 's which share the same anchor by:

(D a , W ) (D a , W) ⇐⇒ for all maximal branch B of G a , (D a , W )(B) α (D a , W)(B)
By construction, the resulting order is not a total order. Indeed, there exist D o 's and branches such that (D a , W )(B 1 ) ≺ α (D a , W)(B 1 ), on the one hand, and (D a , W)(B 2 ) ≺ α (D a , W )(B 2 ) on the other hand. Yet, we guarantee in the following sections that any computing step makes the weight of the D o decrease (which implies that the corresponding WD o 's are comparable).

, W N ) (D n a , W n ).
Since is an order, we have

∀n ≥ N, (D n a , W n ) = (D N a , W N ).
We now show how to associate a WD o to any CD o as soon as we are given a weight function W on nodes of G. This association is itself a weight function on CD o , induced by the weight function on nodes. For simplicity, we also call W the induced weight function.

Contrary to what was presented in Definition 5.18, the weight function on nodes may depend on the global configuration γ of the system, and not only on the state of nodes v. More formally, we now consider a weight function W(v, γ) which associates an element of M to each node in a given configuration. This does not pose any fundamental problem since, given γ, we can still associate a WD o to any CD o D γ a . We can as well associate, given γ, a weight to any projection of D γ a on any branch of G a . This is formally stated in Definition 5.21.

Definition 5.21 (Weight of a circulation DAG)

Let W : V ×Γ → M be a function that associates a weight to any node of a configuration. For any fixed configuration γ ∈ Γ, we define W( • , γ) ∈ M V Da the function that associates to any node v ∈ V Da the weight of v in γ:

W( • , γ)(v) = W(v, γ).
Then, for all γ ∈ Γ, for all CD o D γ a at γ, we can consider W(D γ a , γ) the weight of D γ a in γ, which is the WD o (D γ a , W( • , γ)). We also define the weight of a branch

B = v 1 v 2 • • • v k of D γ a in γ, and denote W(D γ a (B), γ) = W(D γ a , γ)(B) = (D γ a , W( • , γ))(B) = W(v 1 , γ)W(v 2 , γ) • • • W(v k , γ).
To deal with all the different aspects of the algorithm, we actually define several weight functions in Sections 5.4.2.4 to 5.4.2.8, dealing with the different aspects of our algorithm. Each of these functions defines one different WD o to the same CD o . In order to deduce global properties on the evolution of the entire algorithm, we must combine all those functions and to compare the different induces WD o 's all at once. To do so, we simply use the lexicographic order on WD o 's that is induced by the order introduced in Definition 5.20.

Definition 5.22 (Lexicographic order on WD o 's)

We denote by k the lexicographic order on k-tuples of WD o 's which share the same anchor, induced by the order . ∀k ∈ N, k is a well-founded order, as a lexicographic order induced by a well-founded order.

Our goal is now to prove two properties. The first one is that the WD o 's associated to one CD o never increase unless the anchor of the CD o is the root, and the root executes R r NewDFS . The second property is that each time one node of the CD o , or near it, is activated (by a rule which is not R r NewDFS ), the weight of the CD o decreases. A weight function which respects the first property is said pre-admissible, and it is said admissible if it respects both.

Since the weight of a CD o is expressed as a tuple of WD o 's, the formal definitions of admissibility and pre-admissibility lie on the lexicographic order introduced in Definition 5.22. Each potential function has an even stronger weight as it appears on the first component of the tuple.

The exact definition of admissibility actually depends on how we define what a node near a CD o is. This definition depends on constraints which will emerge from the definitions of the weight functions, and therefore will be provided later, in Definition 5.25 of Section 5.4.2.9.

We give here the definition of pre-admissibility.

Definition 5.23 (Pre-admissible weight-functions)

Let W 1 , . . . , W k : V × Γ → M be k weight functions on nodes. We say that (W 1 , . . . , W k ) is pre-admissible if for any computing step cs = γ → γ such that r does not execute R r NewDFS during cs, for all CD o D γ a , we have

W 1 (D γ a , γ ), • • • , W k (D γ a , γ ) k W 1 (D γ a , γ), • • • , W k (D γ a , γ) .

Remark 5.8

In order to have relatively short and readable equations in the following, the previous inequality will often be written:

W 1 , . . . , W k (D γ a , γ ) k W 1 , . . . , W k (D γ a , γ)
In Sections 5.4.2.4 to 5.4.2.8 we define five weight functions on nodes, that belong to V × Γ → N: which are W Ch , W Er , W Circ , W Play and W Nego . Each one of those 5 functions deals with one specific part of the algorithm, by decreasing order of importance, and is treated separately in one of the next five sections. Thus, we define, for each configuration, 5 WD o 's that, associated with the lexicographic order 5 , will allow us to formally prove that the token circulation terminates. Figure 5.23 summarizes the effects of the rules, and for each of them indicates which component of W it decreases.

We prove that W = (W Ch , W Er , W Circ , W Play , W Nego ) is pre-admissible, by proving step by step that all the prefixes of that 5-tuple are pre-admissible. We also establish some properties that will allow us to prove, in Section 5.4.2.9, that (W Ch , W Er , W Circ , W Play , W Nego ) is admissible.

First component of W: W Ch future children of v

Explanations One property which guarantees that circulation rounds are finite is that one node can receive the token from its parent only once, as long as the parent does not return the token to its own parent. Indeed, once a node u receives the token from one of its parents p, it takes the same color as that parent, and its variable play becomes W. Variable play u then cannot be set to P before tok p is set to ↑, which implies that u cannot take the token once again from p before p itself returns the token to its own parent.

For that reason, the first component of the weight function W should, at least, count on each node u ∈ V the number of children of u that are susceptible to execute R Win before u executes R OfferUp . The variables that we must consider to establish if one node is susceptible to execute R Win are play and c. In the following we detail how we formally define this count. Let us consider one node v and one of its children u. Remark first that if tok v ∈ {⊥, ↑}, then the weight of v can be defined as 0. Indeed, such a node cannot be involved in a pass of the token to its children before it itself receives the token from one of its parents. Thus, when v receives the token from its parent, its own weight increases from 0 to the actual count of how many children susceptible to execute R Win it has. But at the same moment, the weight of v's parent decreases by one due to v cannot execute R Win anymore. Consequently, due to how we defined α on weighted chains, the weight of each branch of a CD o that contains v and its parent decrease when v executes R Win .

node Rule id tok c play W v = r R Win ⊥ → switch P → W W Ch v = r R FakeWin switch P → {W, F} W Ch ∀v ∈ V E TrustChild {•, , , •, } →↓ W Er ∀v ∈ V R Give • → W Circ ∀v ∈ V R NewPlay → W Circ ∀v ∈ V R Drop →↓ W Circ ∀v ∈ V R Nego (1, ⊥) → • W Circ v = r R OfferUp • →↑ W Circ ∀v ∈ V R Receive ↓→ • W Circ ∀v ∈ V R ReNego (1, ⊥) • → • W Circ v = r R Return ↑→ ⊥ → {W, F} W Circ v = r R Lose P → L W Play v = r R ReplayD L → P W Play v = r R ReplayUp W → P W Play v = r R Fake W → F W Play ∀v ∈ V R maxPos max u∈C(v) id u W Nego ∀v ∈ V R NewPh (ph + 1, ⊥) W Nego v = r R NewBit (ph, Bit(ph)) W Nego v = r R ReWin F → W r R r NewDFS ↑→ switch
We now consider one node v such that tok v / ∈ {⊥, ↑} and one child u of v. In this section, we only focus on the transmission of the token between nodes, and not on the transitions of the variable tok on one node. Thus, we treat indifferently the different cases when tok v ∈ {•, , , , •, ↓}. Let us establish under which circumstances u might receive the token from v.

• Node u can receive the token, at first, if c u = c v and play u ∈ {P, L}, by simply executing R Win (or after one execution of R ReplayD ).

• Secondly, if c u = c v and play u ∈ {W, F}, then u can execute R ReplayUp , and R ReWin if necessary, and then arrives in the previous situation. Therefore, we must count u as a node that might receive the token.

• Finally, if c u = c v and play u ∈ {P, L}, then u can execute R Win or R FakeWin , and then arrives in the previous situation.

Note that if c u = c v and play u ∈ {W, F} then u cannot execute R Win nor R FakeWin due to play u , and cannot execute R ReplayUp since tok v ∈ {⊥, ↑}. This is described in Figure 5.24. All the transitions presented in the diagram of Figure 5.24 bring the node that executes the corresponding rule closer to the stable state where c u = c v ∧ play u ∈ {W, F}. We need to fully describe the process that leads to the passing of the token to one child. Therefore, we define W Ch such that any execution of a rule that corresponds to a transition presented in Figure 5.24 makes W Ch decrease on the parent of the node that executes it.

c u = c v play u ∈ {P, L} c u = c v play u ∈ {W, F} c u = c v play u ∈ {P, L} c u = c v play u ∈ {W, F} R Win (only if tok v =↓ ) R FakeWin R ReplayUp R Win R FakeWin
Yet, remark that we cannot treat R ReplayUp the same way as we treat R Win and R FakeWin . Indeed, any execution of R Win or R FakeWin by one node u requires that at least one parent v of u has its variable tok v different from {⊥, ↑}, which means that any such execution corresponds to a transition on that diagram for that node v. On the contrary, one node u might execute R ReplayUp without any parent v such that tok v / ∈ {⊥, ↑}. Thus, although we treat some, we do not treat all possible executions of R ReplayUp with W Ch . This means that, by the end of this section, we prove that any activation of R Win or R FakeWin makes W decrease, and that some specific activation of R ReplayUp makes W decrease. This piece of knowledge will nevertheless be useful in the following sections until we prove that any activation of R ReplayUp makes W decrease. This is formally stated in Theorems 5.3 and 5.4.

Definitions Since children u of v move along the different boxes of Figure 5.24, we must design W Ch such that any transition taken by u makes W Ch (v, γ ) < W Ch (v, γ). Our solution is to attribute different coefficients to the different boxes: the further node u is from the stable configuration c u = c v ∧ play u ∈ {P, L}, the higher the coefficient. Somehow, the coefficient represents the number of transitions needed by one node to reach the stable configuration. The coefficients are the integers above and below the boxes in Figure 5.25.

In practice, to make the proof easier to approach, we define 3 sets on each node v, such that any transition taken by one child u of v brings u out of one of the sets. Those sets have a non-empty intersection, and are such that the coefficient attributed to one node is the number of sets it belongs to.

• One set includes all the nodes that are potential candidates to receiving the token from v, that is to say all the children u of v that are not in a stable state.

• One other set, included in the first one, includes all of those candidates that must execute R ReplayUp before they might receive the token from v.

• Finally, the last set, included in the second one, includes all of those candidates that must execute R Win or R FakeWin before they can execute R ReplayUp and receive the token from v, that are also the candidates that are the same color as v. Let us define those three sets, starting from the last, and smallest, one.

AllCand(v) ReplayCand(v) EqColCand(v) c u = c v play u ∈ {P, L} c u = c v play u ∈ {W, F} c u = c v play u ∈ {P, L} c u = c v play u ∈ {W, F} R Win R FakeWin R ReplayUp R Win R FakeWin ×1 ×2 ×0 ×3
EqColCand γ (v) = {u ∈ C(v) | c γ u = c γ v ∧ play γ u ∈ {P, L}} (5.34)
ReplayCand γ (v) = EqColCand γ (v) ∪ {u ∈ C(v) | c γ u = c γ v ∧ play γ u ∈ {W, F}} (5.35) AllCand γ (v) = ReplayCand γ (v) ∪ {u ∈ C(v) | c γ u = c γ v ∧ play γ u ∈ {P, L}} (5.36)
Finally, we can define W Ch (v, γ) such that the coefficients on Figure 5.25 are respected:

W Ch (v, γ) = 0 if tok γ v ∈ {⊥, ↑} AllCand γ (v) + ReplayCand γ (v) + EqColCand γ (v) otherwise
(5.37) Proofs Lemmas 5.13, 5.14, and 5.15 state that ∀v ∈ V , the three sets defined previously can only decrease during an execution, as long as tok v / ∈ {⊥, ↑}. Basically, we prove that there is no other transition than the ones we represented in Figure 5.25. These three lemmas are one of the main arguments to establish that W Ch is a pre-admissible weight function.

Lemma 5.13

Let cs = γ → γ be a computing step and let v ∈ V be a node. If tok γ v / ∈ {⊥, ↑} then AllCand γ (v) ⊆ AllCand γ (v).

Proof : We prove the equivalent statement: Lemma 5.17 establishes that the function W Ch is adapted to Definitions 5.8 and 5.20. Indeed, it might happen that one node sees its weight increase, but only if all of its parents see their weight decrease.

C(v) \ AllCand γ (v) ⊆ C(v) \ AllCand γ (v). Since tok γ v / ∈ {⊥

Lemma 5.17

Let cs = γ → γ be a computing step and let v ∈ V such that v does not execute R r NewDFS during cs. If W Ch (v, γ ) > W Ch (v, γ) then ∀p ∈ P(v) such that tok γ p / ∈ {⊥, ↑}, we have W Ch (p, γ ) < W Ch (p, γ), and there exists at least one such p.

Proof : According to Lemmas 5.13, 5.14, and 5.15, if Theorem 5.3 establishes that W Ch is pre-admissible.

tok γ v ∈ {•, , , , ↓, •}, then WCh(v, γ ) ≤ WCh(v, γ). Furthermore, if tok γ v =↑, then tok γ v ∈ {↑, ⊥} and thus WCh(v, γ ) = WCh(v, γ). Finally, if tok γ v = ⊥, then WCh(v, γ ) > WCh(v,

Theorem 5.3

Let cs = γ → γ be a computing step, and let a be an anchor at γ , and suppose that a does not execute R r NewDFS during cs. We have W Ch (D γ a , γ ) W Ch (D γ a , γ). ,γ). Let us consider the smallest i such that WCh(vi, γ ) = WCh(vi, γ). According to Lemma 5.17, WCh(vi, γ ) < WCh(vi, γ), and as a consequence, WCh(v1, γ )WCh(v2, γ )

Proof : Let B = v1v2 • • • v k be a
• If v1v2 • • • vj is a branch of D γ a (B) and ∀i ∈ [1, j], WCh(vi, γ ) = WCh(vi, γ). Then we have WCh(v1, γ )WCh(v2, γ ) • • • WCh(vj, γ ) = WCh(v1, γ)WCh(v2, γ) • • • WCh(vj, γ) and thus WCh(D γ a (B), γ ) α WCh(D γ a (B), γ). • If v1v2 • • • vj is a branch of D γ a (B) and ∃i ∈ [1, j] : WCh(vi, γ ) = WCh(vi
• • • WCh(vj, γ ) ≺ WCh(v1, γ)WCh(v2, γ) • • • WCh(vj, γ). Thus, we have WCh(D γ a (B), γ ) ≺α WCh(D γ a (B), γ). • If v1v2 • • • vj is not a branch of D γ a . Let us consider v1v2 • • • v l = D γ a (B) the projection of D γ a on B. Since v1v2 • • • vj is not a branch of D γ
a we have 1 ≤ l < j, and thus l +1 ≤ j. Remark first that since (v l , v l+1 ) is an edge in D γ a , we have tok γ v l / ∈ {↑, ⊥}, and thus tok γ v l =↑. But v l+1 / ∈ D γ a , so tok γ v l+1 = ⊥, and since v l+1 ∈ D γ a , tok γ v l+1 = ⊥ so v l+1 executes RWin during cs. Thus, Lemma 5.16 applies, and as a consequence WCh(v l , γ ) < WCh(v l , γ).

Let us consider the smallest i ≤ l such that WCh(vi, γ ) = WCh(vi, γ). According to Lemma 5.17, WCh(vi, γ ) < WCh(vi, γ), and as a consequence,

WCh(v1, γ )WCh(v2, γ ) • • • WCh(vj, γ ) ≺ WCh(v1, γ)WCh(v2, γ) • • • WCh(v l , γ).
Thus, we have WCh(D γ a (B), γ ) ≺α WCh(D γ a (B), γ). We prove that for any maximal branch v1v2 • • • v k of Gt, WCh(D γ a (B), γ ) α WCh(D γ a (B), γ). By definition, we have WCh(D γ a , γ ) WCh(D γ a , γ).

Theorem 5.4 and Lemma 5.18 prove that under certain circumstances, we are certain that the weight of one CD o decreases. The first theorem focuses on the application of rules R Win and R FakeWin , and will be useful to prove that W is an admissible weight function, but also to prove that the other, longer, prefixes of W are pre-admissible. Indeed, if in any computing step, one node executes R Win or R FakeWin , we do not need to look beyond the first component to be assured that the weight does not increase, since k is a lexicographic order. The second lemma focuses on the length of the branches of a CD o , and is useful for us to write proofs in the following. Just as we explained before, we can now suppose in the following proofs of pre-admissibility that branches of CD o 's never increase, since it would make the first component of W decrease.

Theorem 5.4

Let cs = γ → γ be a computing step, and let a be an anchor at γ , and suppose that a does not execute R r NewDFS during cs.

If ∃v ∈ B(D γ a ) such that v executes R Win , R FakeWin , or R ReplayUp during cs, we have W Ch (D γ a , γ ) ≺ W Ch (D γ a , γ).

Lemma 5.18

Let cs = γ → γ be a computing step, and let a be an anchor at γ , and suppose that a does not execute R r NewDFS during cs. If there exists

B = v 1 v 2 • • • v k a branch of G a such that D γ a (B) is longer than D γ a (B), then W Ch (D γ a , γ ) ≺ W Ch (D γ a , γ). Proof : Let us consider v1v2 • • • vj = D γ a (B). Let us prove that v = vj+1 satisfies the conditions of Theorem 5.4. Remark first that tok γ v i =↑. Indeed, if tok γ v i =↑ then tok γ v i ∈ {↑, ⊥}, which is contra- dictory since v ∈ C D γ a (vi). Then, we have tok γ v = ⊥ which implies v ∈ B(D γ a ), otherwise we would have v ∈ C D γ a (vi). But since v ∈ D γ a , we have tok γ v = ⊥, which is possible only if v executes RWin during cs.
We can apply Theorem 5.4 to our situation, and consequently WCh(D γ a , γ ) ≺ WCh(D γ a , γ).

Second component of W: W Er errors descending from v

Explanations One major quantity in our algorithm that should decrease during an execution is the number of nodes v such that Er(v). Indeed, we expect that after some convergence time, no node will execute E TrustChild , and that our CD o will have the expected shape. Although that last sentence will be proven true in the following, the number of nodes v such that Er(v) might occasionally increases. Indeed when a node executes E TrustChild , it might happen that it creates an error in some of its parents. For example, if node v has p as a parent, and tok γ v = , tok γ p = . We have ¬Er γ (p), but if in γ → γ , v executes E TrustChild , then tok γ v =↓ and thus Er γ (p). In the described case, the number of nodes in error does not increase, but if node v has several parents p with tok γ p ∈ { , } then that number will actually increase.

One first idea to prevent this from happening is that each node counts the number of descendants it has that are in error. This almost works, but not totally. Indeed, suppose v has two parents p, that both have the same parent a, and we have tok γ v = , tok γ p = , tok γ a =↓. In γ, a only has one descendant in error, but has two once v executes E TrustChild . The fact that errors can split through several branches forces us to design W Er such that it counts a descendant in error as many times as there exist paths to that node.

Fortunately, we can stop the count in our descendants as soon as we reach a node v such that tok v ∈ {⊥, ↑, ↓}. Indeed, such nodes cannot execute E TrustChild , which implies that errors cannot ride up through such nodes.

There exists another situation that increases the number of nodes in error. Suppose one node v executes R Win during γ → γ . We have W Er (v, γ) = 0 by definition. Yet, it might happen that one child u of v is such that tok γ u = ⊥. It might even happen that W Er (u, γ ) > 0, with an arbitrary value. In such a situation, the weight of v, and thus W Er (D γ a ) can increase arbitrarily. Hopefully, we proved in the previous section that at the same moment, W Ch (D γ a ) decreases, and thus no problem is raised.

Definition

According to what precedes, we define W Er the second component of our weight function by 0 on nodes v such that tok v ∈ {↓, ↑, ⊥}, and by the number of nodes in error they can see within range, themselves included, otherwise. Theorem 5.5 establishes that (W Ch , W Er ) is pre-admissible.

W Er (v, γ) =    0 if tok γ v ∈ {↓, ↑, ⊥} u∈C(v) W Er (u, γ) + 1 if Er γ (v) u∈C(v) W Er (u, γ) otherwise ( 5

Theorem 5.5

Let cs = γ → γ be a computing step, and let a be an anchor at γ , and suppose that a does not execute R r NewDFS during cs. We have

(W Ch , W Er )(D γ a , γ ) 2 (W Ch , W Er )(D γ a , γ
γ v = ⊥, or if WCh(v, γ ) < WCh(v, γ) which implies that WCh(D γ a , γ ) ≺ WCh(D γ a , γ), or if ∃u ∈ C(v)
such that u executes ETrustChild during cs. In that last case, we have Er γ (u) so WEr(u, γ) ≥ 1, and tok γ u =↓ and so WEr(u, γ ) = 0. Since we took v one deepest node such that WEr(v, γ ) > WEr(v, γ), we have ∀u ∈ C(v), WEr(u, γ ) ≤ WEr(u, γ), so, by considering the child that executes ETrustChild, we have u∈C(v) WEr(u, γ ) < u∈C(v) WEr(u, γ), and thus WEr(v, γ ) ≤ WEr(v, γ). Theorem 5.6 proves that under certain circumstances, we are certain that the weight of one CD o decreases. It will be useful to prove that W is an admissible function, but also to prove that the other, longer, prefixes of W are pre-admissible. Indeed, if in any computing step one node executes E TrustChild then we do not need to look beyond the second component to be assured that the weight does not increase, since k is a lexicographic order.

Theorem 5.6

Let cs = γ → γ be a computing step, and let a be an anchor at γ , and suppose that a does not execute R Since W Ch has higher priority in the lexicographic order than W Circ , we are going to design W Circ so that it increases exactly when W Ch decreases. Therefore, we can cycle as many times as necessary through the transition diagram of Figure 5.7 and having the 3-tuple (W Ch , W Er , W Circ ) decrease at each step.

To do this, we must associate a different weight to a node v with tok v = depending on whether it still has one child that is going to execute R Win (or R FakeWin ) in the next computing steps. More precisely, if there still exists one child u of v that belongs to Players(v), we associate a lower weight to v that if such child u does not exist. When v executes R Win or R FakeWin , W Circ increases on v, but W Ch decreases at the same time.

But since we work in the framework of self-stabilization, it might happen that registers are incorrectly initialized, and that when node v executes R Give , and updates tok v from • to , v immediately has no children susceptible to execute R Win . Indeed, if in the initial configuration, id v is inconsistent with the id of its children, it might happen that after some computations, all the children u of v such that play u = P eventually lose the negotiation. In such a situation, after v executes R Give , we arrive in a configuration in which W Circ (v, γ ) is already at its high value. But this high value is precisely designed to be the highest assigned value of the diagram. To overcome that issue, we add one possible value for W Circ (v, γ) when tok γ v = •, higher than the high value for nodes with tok γ v = . This value is taken by W Circ (v, γ) only if we detect that after few computations, we fall into a situation where no children of v can execute R Win . It is crucial that this situation cannot happen consecutively to an execution of R ReNego , otherwise we should also design two possible outcomes for the weight of some node v with tok v = •. The predicate FullRound achieves that detection for node v such that tok v = •.

For the other values that tok v might take, we only associate integers that decrease along the classical scheme depicted in Figure 5.7. The definition of W Circ is summarized in Figure 5.27 Definitions The weight of one node v such that tok v = depends on if it has children susceptible to take the token. If it has, then we set its weight to one low value, so that when the child takes the token, W Ch decreases on v at the same time that we make W Circ increases on v. If it has not, then it must be a high value so that the weight of v can decrease through Theorem 5.8 proves that under certain circumstances, we are certain that the weight of one CD o decreases. It will be useful to prove that W is an admissible function, but also to prove that the other, longer, prefixes of W are pre-admissible. Indeed, if in any computing step one node updates its variable tok then we do not need to look beyond the third component to be assured that the weight does not increase, since k is a lexicographic order.

Theorem 5.8

Let cs = γ → γ be a computing step, and let a be an anchor at γ , and suppose that a does not execute R r NewDFS during cs.

If ∃v ∈ D γ a such that v executes one rule among R Give , R NewPlay , R Drop , R Nego , R OfferUp , R Receive , R Return , R ReNego during cs, then (W Ch , W Er , W Circ )(D γ a , γ ) ≺ 3 (W Ch , W Er , W Circ )(D γ a , γ

Fourth component of W: W Play , circulation of variable play on children

Explanations The three weight functions that we previously defined, W Ch , W Er , and W Circ totally embrace the rules that affect tok v and c v . Thus, we can now consider that both these variable are constant on nodes, and focus on the two other variables that are play and id. In this section, we only treat variable play. Remark that the rules R Win , R FakeWin , and R Return have an impact on variable play, but were already treated in Sections 5.4.2.4 and 5.4.2.6. Thus, although we discussed rule R ReplayUp in Section 5.4.2.4, we did not treat all the cases where this rule might be executed, and thus we must consider it in this section.

Consequently, the rules that interest us in this section are R Lose , R ReplayD , R ReplayUp , R Fake , and R ReWin .

Depending on its variable tok v , it happens that one node v is waiting for some of its children to update their variable play, before it executes a rule that updates tok v to the next state. For example, if tok v = , then v does not execute R NewPlay until all of its children u such that tok u = P updates play u to L, W, or F. In order to prove that our algorithm progresses, and that circulation might terminate, we need to prove that the number of children u of v such that play u = P never increases, at least as long as tok v = . Indeed, as soon as tok v is updated, then we already know that (W Ch , W Er , W Circ ) decreases. Actually, when tok v = , children u of v such that play u = P will update play u with rule R Win or R FakeWin , both cases have already been treated in Section 5.4.2.4, so we do not need to elaborate any further on this case.

There exists other situations where one node v waits until its children u have some specific values for their variable play u before v itself updates tok v . For each of those situations, we want to define W Play such that any time one child u of v updates its variable play u in a sense that allows v to update tok v , W Play decreases on v. Thus, we define W Play such that each node v counts the number of children it has that prevent it from updating its variable tok v . In order to have a function that is pre-admissible, we also require that W Play never increases, and thus that no action taken by one node u might add u to the set of children that prevent one of its parents v to update tok v .

The situations where one node v waits for its children u to update play u occurs when tok v ∈ {•, , •, ↑}. Let us give some details:

• If tok v = • and b v = ⊥,
then v waits for some of its children u to execute R Lose and update play u from P to L.

Although rule R Lose could be treated in the following section that focuses on negotiation, we treat it here for two reasons. First, it concerns variable play as well, and thus it remains consistent here. Second, having already treated executions of rule R Lose will help us greatly in the section on negotiation.

• If tok v = • or tok v = , then v does not execute R Drop until all of its children u such that tok u = L execute R ReplayD and update play u to P.

• If tok v =↑, then before executing R Return , v waits for all of its children u such that play u = W execute R ReplayUp or R Fake , and update play u from W to P or F, depending on whether u still has parents in any CD o .

From what precedes, if one node u executes R Lose , R ReplayD , R ReplayUp , or R Fake , it will make decrease the weight of the CD o 's that contain the parents v of u that have the corresponding value of tok v . Indeed, all of these four rules are conditioned by the existence of at least one parent v with the adapted value of tok v .

Remark that we did not mentioned rule R ReWin . It is not difficult to define a weight function that decreases on v each time one child u of v execute R ReWin . The difficulty comes from proving that the weight function we defined that way is pre-admissible. Indeed, R ReWin might be executed in very various situations: as soon as u has one no parent v such that tok v =↑. Unfortunately, there exists situations in which we can give no guarantee that there won't be executions of R Fake that cancels executions of R ReWin , and thus we cannot treat both R Fake and R ReWin at the same layer of W.

However, the design of the algorithm allows us design W Play that is pre-admissible and such that it decreases any time one node u executes R Lose , R ReplayD , R ReplayUp , or R Fake . This is stated in Theorems 5.9 and 5.10. Figure 5.28 summarizes the different transitions that might be taken by variable play u on one node u. We represented in blue the rules that have already been treated in the previous sections, and in red the rule R ReWin that is not treated in that section.

L

P W F {P, L, W, F} R Lose R ReplayD R Win , R FakeWin R F a k e W i n R ReplayUp R ReWin R Fake R R e t u r n R R e t u r n

Theorem 5.10

Let cs = γ → γ be a computing step, let a be an anchor at γ that does not execute R r NewDFS during cs.

If ∃v ∈ D γ a and u ∈ C Ga (v) such that:

• tok γ v = • and c γ u = c γ v and

Fifth component of W: W Nego negotiation between one parent and its children

Explanations Only one aspect of the algorithm has not been treated yet: the negotiation between one node v that has the token tok v = • and its children u ∈ Players(v). This negotiation occurs only if there are several nodes in Players(v), otherwise v decides that the negotiation is terminated, and executes R Give or R OfferUp depending on whether there exist some candidates for the token or not. Furthermore, let us remark that if Players(v) evolves during an execution, whether by an addition (with R ReplayUp ) or a deletion (with R Lose for example), then according to Theorems 5.4 and 5.10 the weight of the CD o which contains v decreases. Thus, we can suppose in the following that we work under the following hypothesis: Players(v) is constant, and there are at least two nodes in it.

Due to the impact of PhasePlus(v) on variable ph v , we cannot guarantee at first sight that the negotiation does not cycle. Indeed, if all the children u of v declare that they cannot give an answer for ph v , then v decides to restart from ph v = 1 so it does not eliminate all of its children. But as soon as v can restart, we must prove that it does not restart indefinitely, what would create a livelock in the negotiation phase.

To overcome this problem, we statically determine the first value ph v which, when taken by v, will push one child u ∈ Players(v) to execute R Lose . Such values exist since we supposed that there are at least two nodes in Players(v) and that the identifiers are globally unique. If we prove that ultimately, some node u can only execute R Lose and thus makes W Play decrease, we prove that the negotiation is livelock-free. Unfortunately, it is not trivial to determine the value of the first incoming value of ph v which will induce an execution of R Lose . Basically, we are looking for the lowest value greater or equal to ph v which induces different answers on two children u ∈ Players(v).

One first subtlety comes with the fact that, since we work in the framework of selfstabilization, there might not be such greater value. Indeed, if the initial value of ph v is different from 1, and if all the values of ph v which might differentiate two children u ∈ Players(v) are less than this initial value, then the differentiation will not happen before a reset of ph v . Under such circumstances, v executes a full round of all the possible value for ph, increasing as long as its children u produce answers different from b u = ⊥, and when they all, at the same moment by hypothesis, cannot, v restart from ph v = 1. Then, v will increase ph v until it reaches one value which differentiates two of its children u ∈ Players(v).

One other, trickier, subtlety coming from the self-stabilizing framework, is that the registers of the children might be incorrectly initialized. If, due to an incorrect initialization, we miss an occasion to differentiate two children in Players(v), a similar scheme will happen. In such situation, v increases ph v until it reaches the next value which differentiates two of its children of Players(v). It might even happen that the initial value of ph v is the only value which can differentiate any two children of Players(v). In this situation, node v will execute a full round of all the possible value for ph v , increasing as long as all of its children produce answers different from b u = ⊥, then restarting from ph v = 1 until it reaches again the initial value which differentiates its children. On the contrary, an incorrect initialization of the values of b u on some node u ∈ Players(v) might implies that u executes R Lose while it is not supposed to, according to its actual id. That last case will be said to be a false positive.

Incorrect initializations of variable b u might only happen at the very beginning of the execution, and might be taken into account only if u does not update it before any action if its parent, i.e. if ¬AnswerPar(u, v). Then, as soon as u takes a step, either it executes R Lose , either it updates b u according to its identifier, and then we will not face any incorrect initialization anymore. Thus, we have to consider the possibilities of wrong initializations only in few cases, basically only for the current value of ph v and only if ¬AnswerPar(u, v). For any other situation, Bit u (ph) is the adapted value, which describes the value of b u taken into account during the negotiation.

To summarize, we can distinguish three situations.

• The first, simplest, situation, is when the current value of ph v actually differentiates at least two children of Players(v). This situation includes false positive, when ph v is not meant to play this role regarding to identifiers, and excludes situations where an incorrect initialization of the b u prevents the expected differentiation to actually happen.

• The second situation is when the current value of ph v does not differentiate two children of Players(v), but there exists a value greater than ph v which does. In such a situation, we only have to wait for ph v to increase until it reaches the first such value, and we fall in the previous situation.

• The third and last situation is when neither the current value of ph v , neither any value greater than it, can differentiate two children of Players(v). This situation includes, as an extreme case, the situation where the current value of ph v is the only one which might differentiate two children of Players(v), but an incorrect initialization of some b u prevents the differentiation from being effective. In this third situation, we wait for ph v to increase until the value for which all children of Players(v), at the same moment, answer ⊥. At this moment, ph v is set to 1 and then we fall in one of the previous situations.

We want to design a function dealing with as many aspects, or as many rules, of the algorithm as possible. Thus, we intend to define W Nego such that any action involving R maxPos , R NewPh , or R NewBit , makes W Nego decrease. It is pretty natural to treat R NewPh since it increases (or reduces down to 1) the value of ph v , and thus bring closer to the expected value. Since any two execution of R NewPh are separated by an execution of R maxPos , which updates b v from ⊥ to a value different from ⊥, we will not have much trouble to use those properties in the design of W Nego . Finally, we want W Nego to decrease any time one child u ∈ Players(v) executes R NewBit . In other words, we must, in a certain way, count the number of children of v which can execute R NewBit . But any execution of R NewPh recreates the conditions under which all the nodes u ∈ Players(v) can execute R NewBit , and thus if we simply decrease W Nego by one for the execution of R NewPh , but it increases by |Players(v)| at the same time, we fail. Two options are left to us. First, we can define W Nego as a 2-tuple, the first component focuses on the progress of ph v , and the second one focuses on the decreasing of the number of nodes which can execute R NewBit . The other option is to deal this in one single function, and to give some coefficients to the different components involved. In a certain sense, it boils down to the same as the previous option, but instead of using the lexicographic order, we define manually high coefficients on the first component so that it all works the same with one integer value. To avoid making this proof even more tedious, we chose the second option.

Definitions Before properly defining W Nego , let us first formally determine the three different situations which were described above, whether we reached the expected value for ph v , or whether not but there we will reach this value with only increasing ph v , or whether we will have to reset ph v to 1 before we reach it.

Recall that to decide if the current value of ph v will differentiate two children u ∈ Players(v), we cannot simply rely on the values of Bit u (ph v ). Indeed, we must take into account that the register of b v and/or b u might be incorrectly initialized. If this happens, and if the current state of one node u can be interpreted as an answer by its parent, then it does not update it, and thus b u is the value used to decide what the future of the negotiation is. Otherwise, u has to first execute R NewBit before anything else, and then erase its previous state and only Bit u (ph v ) is relevant. Thus, we first formally define what actual value will be taken as the answer by the parent v of u for the current step of the negotiation, which depends for each node u on whether it will produce a new answer to its parent, or not.

Answer γ (u, v) = Bit u (ph γ v ) if AnswerPar γ (u, v) b γ u otherwise (5.50)
Let us now detail the situations in which the current value of ph v differentiates two children u ∈ Players γ (v). The first, most natural, situation is when two different nodes will produce different values for b in response to ph γ v . If this happens, then after v executes R maxPos (or before, if we already have b γ v = ⊥, at least one of them will be in a situation where it must execute R Lose .

TwoDiffer γ (v) ≡ ∃u 1 , u 2 ∈ Players γ (v) : Answer γ (u 1 , v) = Answer γ (u 2 , v) (5.51)
The previous captures almost all the situations where one node is close to execute R Lose . There exists one other, unusual, situation, which is not described here, which is when all the nodes u ∈ Players γ (v) will produce the same value for ph v , but due to an incorrect initialization of variables, v has already picked a value, which is different from the common value proposed by its children. In this situation, all the children will actually execute R Lose at very short term.

OneDiffers γ (v) ≡ b γ v = ⊥ ∧ ∃u ∈ Players γ (v) : Answer γ (u, v) = b γ v (5.52)
We can now define the first of our three cases, which corresponds to the situation where one node u ∈ Players γ will execute R Lose before any update of ph v .

Finished γ (v) ≡ TwoDiffer γ (v) ∨ OneDiffers γ (v) (5.53)
Let us now discuss the two other situations, in which the current value ph γ v does not differentiate any two children of Players γ (v). We need to determine whether v will reset ph v to 1 before we reach a value which differentiates two of its children of Players γ (v), or whether not. We could think, at first, that it is sufficient to determine whether there exists one value greater than ph γ v which differentiates two nodes of Players γ (v) or not. If there is not such greater value, ph v will indeed be reset to 1 before we terminate the negotiation phase. Yet, it might happen that, although there exists such a greater value, we are nevertheless forced to reset ph v to 1 before we reach this greater value. Indeed, it could happen that, due to an incorrect initialization of variables b u , all the children u ∈ Players γ (v) produce ⊥ as an answer for ph γ v while there exists a greater value which would differentiate two of them. If this happens, then the execution of PhasePlus(v) will reset ph v = 1. Hopefully, this is can happen only due to incorrect initialization of variables, and thus can only happen for the initial value of ph v . Remark that if only few of the nodes produce ⊥ as an answer for ph γ v then we have Finished γ (v). Let us define the predicate ForcedReset(v) which corresponds to configurations where an execution of R NewPh by v will set ph v to 1.

ForcedReset γ (v) ≡ ∀u ∈ Players γ (v), Answer γ (u, v) = ⊥ (5.54)
If ForcedReset γ (v), then we are sure that v will first reset ph v = 1. But if not, we must determine whether there exists one value greater than ph γ v which differentiates two nodes of Players γ (v) or not. Let us first define Separators γ (v) the set of all the values for ph v which can differentiate two children u ∈ Players γ (v). Remark that this set is defined statically: it does not depend at all on the values of ph v , b v , ph u , b u , and only relies on the values of the different identifiers of children of v in Players γ (v). Yet, we consider this set only if ¬Finished γ (v), that is to say if we must execute R NewPh at least once before reaching the value that differentiates children of v. By definition, after v executes R NewPh , we necessarily have AnswerPar(u, v) for all children u ∈ Players γ (v). Thus, in such situations, Bit u is the relevant tool to decide whether some value for ph v will differentiate children of v. Remark also that Separators γ (v) only depends on Players γ (v), which will be supposed constant in the following. Consequently, we will suppose Separators γ (v) constant too. Finally, since we are interested in considering the negotiation phase, v has at least two children, and then Separators γ (v) contains at least one value.

Separators γ (v) = {ph ∈ [0, log n ] | ∃u 1 , u 2 ∈ Players γ (v) : Bit u1 (ph) = Bit u2 (ph)} (5.55)
Let us now define the two other predicates, which correspond to situations where node v will not reset ph v to 1 before it reaches a value which differentiates two of its children, and to the situation where it will.

WontReset γ (v) ≡ ¬Finished γ (v) ∧    ∃i > ph γ v : i ∈ Separators γ (v) ∧ ¬ForcedReset γ (v) (5.56) WillReset γ (v) ≡ ¬Finished γ (v) ∧    ∀i > ph γ v , i / ∈ Separators γ (v) ∨ ForcedReset γ (v) (5.57) (W Ch , W Er , W Circ , W Play , W Nego )(D γ a , γ ) 5 (W Ch , W Er , W Circ , W Play , W Nego )(D γ a ,

γ).

Proof : According to Theorem 5.9, (WCh, WEr, WCirc, WPlay)(D γ a , γ ) 4 (WCh, WEr, WCirc, WPlay)(D γ a , γ).

If (WCh, WEr, WCirc, WPlay)(D γ a , γ ) ≺ 4 (WCh, WEr, WCirc, WPlay)(D γ a , γ), then the result is trivial. Let us now suppose that (WCh, WEr, WCirc, WPlay)(D γ a , γ ) = (WCh, WEr, WCirc, WPlay)(D γ a , γ), and prove that WNego(D γ a , γ ) WNego(D γ a , γ). In the same way we did in the proof of Theorem 5.5, we can suppose that for any branch B of Ga, D γ a (B) is not longer than D γ a (B). In such circumstances, we have WNego(D γ a , γ ) WNego(D γ a , γ) only if there exists a branch B of Ga such that ∃v ∈ D γ a (B) such that WNego(v, γ ) > WNego(v, γ). Theorem 5.12 establishes that under certain circumstances, we are certain that the weight of one CD o decreases. It will we useful to prove the admissibility of W.

Theorem 5.12

Let cs = γ → γ be a computing step and let a be an anchor at γ such that a does not execute R r NewDFS during cs.

Conclusions

In this section we combine the results of Sections 5.4.2.4 to 5.4.2.8 to provide a suitable definition of admissible potential function. More precisely, we provide a definition of admissibility which is wide enough to include our weight function W, and tight enough to be convenient in the following proofs.

The final theorem of this section states that our algorithm satisfies Condition 2 of Specification 5.1, but other intermediate theorems will be used in the following section.

From now on, to ease the reading, when we use comparison operations on 5-tuple induced by W, we simply use the symbol ≺ rather than ≺ 5 to denote the lexicographic order on 5tuples of WD o 's. Theorem 5.13 states that W is pre-admissible. As hinted above, to define admissibility we must first interest to what an activation of a CD o is.

Definition 5.24 (Activation of a CD o )

Let cs = γ → γ be a computing step, let a be an anchor at γ , and let u ∈ V be a node. We say that u activates D γ a during cs if:

• u = a and u executes R r NewDFS during cs, or We say that D γ a is activated during cs if there exists one node u ∈ V which activates D γ a during cs.

We now prove that the definition of activation matches the evolution of CD o 's. Namely, if one CD o is not activated during one computing step, either it is unchanged, either it disappears, its anchor becoming an intern node of one other CD o .

Lemma 5.48

Let cs = γ → γ be a computing step, and let a ∈ A(γ) be an anchor at γ. If D γ a is not activated during cs then either D γ a = D γ a , either a / ∈ A(γ ). We now prove that the definition of activation captures almost all computing steps of our algorithm. The only situation in which no CD o is activated is when all activated nodes execute R ReWin , rule which is not considered by W, but which cannot be responsible of livelock only by itself.

Lemma 5.49

Let cs = γ → γ be a computing step. There exists an anchor a ∈ A(γ) such that D γ a is activated during cs, or all nodes activated during cs execute R ReWin .

Proof : Let us suppose that there exists at least one node u ∈ V such that u executes one rule different from RReWin during cs.

• We can finally provide a definition of admissibility, which corresponds to our weight function W according to Theorem 5.14.

Definition 5.25 (Admissible weight function)

Let W 1 , . . . , W k : V ×Γ → M be k weight functions on nodes such that (W 1 , . . . , W k ) is preadmissible. We say that (W 1 , . • ∃v ∈ D γ a , v ∈ P(u), tok γ v = • and u executes RLose or RNewBit during cs, then since OkNeg γ (u), we deduce v ∈ Pneq γ (v), and thus according to Theorems 5.10 and 5.12 W(D γ a , γ ) ≺ W(D γ a , γ). • ∃v ∈ D γ a , v ∈ Pneq(u), tok γ v ∈ { , •} and u executes RReplayD during cs, then according to Theorem 5.12 W(D γ a , γ ) ≺ W(D γ a , γ). • ∃v ∈ D γ a , v ∈ Peq(u), tok γ v =↑ and u executes RFake or RReplayUp during cs, then according to Theorem 5.12 W(D γ a , γ ) ≺ W(D γ a , γ).

We now prove that if the anchor of a CD o does not execute R r NewDFS , then the CD o can only be activated a finite number of time.

Theorem 5.15

Let = γ 0 → γ 1 → • • • be an infinite execution, and let a ∈ V such that ∀t ≥ 0, a ∈ A(γ t ), and such that a does not execute R r NewDFS during . There only exists a finite number of computing steps cs t = γ t → γ t+1 such that D γt a is activated during cs t .

Proof : According to Theorem 5.14, W is admissible, so if D γ t a is activated during cst, we have W(D γ t+1 a , γt+1) ≺ W(D γ t a , γt). Let us now reason by contradiction and suppose that there exists an infinity of such computing steps, cst 0 , cst 1 , . . . . We have ∀i ≥ 0, W(D

γ t i +1 a , γt i +1) ≺ W(D γ t i
a , γt i ). Furthermore, according to Theorem 5.13, we also have ∀i ≥ 0, W(D

γ t i+1 a , γt i+1 ) W(D γ t i +1 a
, γt i +1). Thus, we deduce ∀i ≥ 0, W(D

γ t i+1 a , γt i+1 ) ≺ W(D γ t i a , γt i ).
Since ≺ is a well-founded order on WD o 's, such infinite decreasing sequence does not exist, and thus we raised a contradiction. Consequently, there only exists a finite number of computing steps cst = γt → γt+1 such that D γ t a is activated during cst.

The following theorem is crucial, since it states that at some point, the CD o which are not anchored at the root cease being activated, and cease disappearing too. It is a key theorem to prove the last result of this section, but will also be determining in the following section to prove the fairness of our algorithm.

Theorem 5.16

Let = γ 0 → γ 1 → • • • be an infinite execution. There exists t 0 ≥ 0 such that for all t ≥ t 0 , A * (γ t ) = A * (γ t0 ) and ∀a ∈ A * (γ t ), D γt a is not activated during γ t → γ t+1 .

Proof : Let us first define t0, and let us consider a ∈ A * (γ0).

If ∃t ≥ 0 : a / ∈ A * (γt) then let us set ta = t. According to Lemma 5.9, ∀t ≥ ta, a / ∈ A(γt). Otherwise, we have ∀t ≥ 0, a ∈ A * (γt). According to Theorem 5.15, there exists only a finite number of computing steps cst = γt → γt+1 such that D γ t a is activated during cst (since a = r, it cannot execute R r NewDFS ). Let us consider t the highest value of t such that D γ t a is activated during cst, and let us set ta = t + 1.

Let us now set t0 = max a∈A * (γ 0 ) ta. Let us consider one anchor a ∈ A * (γt 0 ). We have ∀t ≥ t0, a ∈ A * (γt), since if not, we would have ta > t0 which is contradictory with the definition of t0. Therefore we have ∀t ≥ t0, A * (γt 0 ) ⊆ A * (γt), and according to Lemma 5.9 we conclude ∀t ≥ t0, A * (γt 0 ) = A * (γt). Furthermore, since ∀t ≥ t0, a ∈ A * (γt), ta has been defined as one more than the highest value such that D γ t a is activated during cst. Therefore, ∀t ≥ t0, D γ t a is not activated during cst.

We now formally prove that our algorithm satisfies Condition 2 of Specification 5.1.

Theorem 5.17

Let = γ 0 → γ 1 → • • • be a maximal execution, and let r be the root of G. is infinite, and can be divided into an infinite number of circulation rounds.

Proof : According to Theorem 5.1, we only have to prove that there exists an infinite number of computing steps csi = γi → γi+1 such that r executes R r NewDFS during csi. According to Theorem 5.16, there exists t0 ≥ 0 such that ∀a ∈ A(γt) \ {r}, ∀t ≥ t0, a ∈ A(γ t ) and D γ t a is not activated during γ t → γ t +1 . Let us reason by contradiction and suppose that there only exists a finite number of computing steps csi = γi → γi+1 such that r executes R r NewDFS during csi. Then, there exists t1 ≥ 0 such that ∀t ≥ t1, r does not execute R r NewDFS during cst. Thus, according to Theorem 5.15, there exists t2 ≥ t1 such that ∀t ≥ t2, D γ t r is not activated during cst. Let us consider t3 = max(t0, t2), and the infinite execution 3 = γt 3 → γt 3 +1 → • • • . By definition, no CD o is activated during 3. Thus, during 3, nodes only execute RReWin. But once a node v executes RReWin, it cannot execute it again before the execution of one other rule sets play v = F. Thus, there does not exist such execution, so we reached a contradiction.

Consequently, there exists an infinite number of computing steps csi = γi → γi+1 such that r executes R r NewDFS during csi.

Convergence

In this section, we establish that our algorithm behaves correctly, by largely using results established in Section 5.4.2, and especially in Section 5.4.2.9. We use in particular Theorems 5.16 and 5.17, that allow us to start the reasoning at a moment where the algorithm has already partly converged. Namely, we consider executions in which the set of all the anchors remain constant, and such that all the CD o 's which are not anchored at the root of the D o are not activated.

Once this is considered, the proof is organized according to the following scheme. We first establish some additional stability properties on the CD o anchored at the root of the D o . Then, we give a formal definition of the notion of having the token, for one node. The formal notion we use to describe the part of an execution where one node is involved in the token circulation is circulation round, introduced in Theorem 5.1 and Definition 5.27. After that, we prove that if one node executes a circulation round, then all of its children which might take the token (depending on their variables play and c) actually do it too, and execute a circulation round as well. We can thus reason by induction an prove that, starting at the root, the token browses a part of the D o . Finally we prove that the alternation of the color of the root, which occurs each time it executes R r NewDFS , associated to properties of the algorithm, especially its effect on the variables play of the children of a node, guarantee that the part of the D o which is being browsed by the token grows each time the root executes R r NewDFS , and eventually become the entire D o . As we said before, we consider executions which start after the value of t 0 guaranteed by Theorem 5.16. In particular, the set of anchors does not evolve during the executions we consider, and according to Lemma 5.48, no CD o other than the one anchored at r will be updated. Consequently, to enhance readability, we allow ourselves to simply write A (resp. A * ) without referring to the configuration in which this set is evaluated, and to simply write D a when a ∈ A * without referring to the configuration in which we consider the CD o anchored at a.

Lemma 5.50

Let be a maximal execution. We have ∀t ≥ 0, ∀a ∈ A * , D γt r ∩ D a = ∅.

we proved the lower bound for leader election (Theorem 3.1), we can consider the function (A, T, R) which has asymptotically the same space complexity as A.

Let us first define the topology used to prove our lower bound. A bi-branch D o is a D o in which the root has two children, and all the other nodes have one child, and one parent. Although we call it D o , it is actually a tree, with bounded degree. For simplicity, we provide the set of edges of the bi-branch as a set of oriented edges, which matches the relation →. The class G = (Bi) i≥1 contains graphs of arbitrary large size, and is ∆-limited by log n since all the graphs it contains have degree 2. Therefore, we can apply Theorem 3.2. Rather than simply applying it to A, we consider the tuple (A, T, R). Theorem 3.2 guarantees that, for any n large-enough, there exist n distinct identifiers ID1, . . . , IDn in [1, n c ] which the tuple (A, T, R) does not distinguish.

• V k = {r, u 1 , u 2 , • • • , u k , v 1 , v 2 , • • • , v k }, • E k = {(u 1 , r), (u 2 , u 1 ), • • • , (u k , u k-1 ), (v 1 , r), (v 2 , v 1 ), • • • , (v k , v k-1 )}. r u 1 u 2 u k v 1 v 2 v k
Let us now consider one such large-enough network Bn, such that the identifiers of the nodes are ID1, . . . , IDn. We consider the framework of distributed algorithms, where the initial configuration is not corrupted. Therefore, we suppose a configuration γ0 such that the root holds the token (i.e. T γ 0 (r) = true), and that all the other nodes are in one unique state. By definition, γ0 is symmetric. Let us build step by step an infinite execution such that ∀i ∈ N, T γ i (r). This is clearly contradictory with the fairness of the token circulation.

We reason by induction, building step by step an execution in such that each one or two configuration is symmetric, and such that the root permanently holds the token. The base case is immediate: γ0 respects both properties.

Let us suppose that γ k is symmetric, and T γ k (r) = true. By symmetry, we have ∀i ∈ [1, k], for all rules R of RA, R is enabled on ui if and only if it is enabled on vi. In particular, ui is enabled if and only if vi is enabled. Since by hypothesis A solves T C, there is at least one enabled node.

If the central strongly fair scheduler activates r in γ k , then the resulting configuration γ k+1 is symmetric. Predicate T only relies on the states of the nodes, since it cannot distinguish the identifiers by construction, and therefore T γ k+1 (ui) ⇐⇒ T γ k+1 (vi) by symmetry. By unicity of the token, we have T γ k+1 (r), and the induction step is established.

Suppose now that the central strongly fair scheduler activates ui in γ k . In this case, the scheduler can activate vi in γ k+1 . Since there is no edge between ui and vi, the action of ui does not have any incidence on vi, which means that vi takes the exact same step as ui. As a result, γ k+2 is symmetric, and consequently r holds the token in γ k+2 . Finally, we prove that r also holds the token in γ k+1 . Since predicate T is local, and since only ui is activated in γ k , only neighbors of ui or ui itself may have their value on T updated between γ k and γ k+1 . Let w be the node such that T γ k+1 (w) = true, and suppose that w = r, i.e. w = uj with j ∈ {i -1, i, i + 1}. Therefore, by symmetry and since vi takes the exact same step as ui, and is the only activated node in γ k+1 , T γ k+2 (vj) = T γ k+2 (uj) = true, which breaks the unicity of the token. As a consequence, r holds the token in γ k+1 , and the induction step is established.

Let us now consider the synchronous scheduler. All the enabled nodes are activated at each step, which preserves symmetry at each step, and thus the root permanently holds the token too.

Conclusion

In this chapter, we introduce a memory-optimal self-stabilizing algorithm for the fair token circulation in arbitrary DODAGs. Our algorithm works under the port-unknown state model S PU , and requires only Θ(log log n) bits per node. To our knowledge, this is the first self-stabilizing algorithm which breaks symmetry in this model, in graphs of arbitrary degree with this complexity.

One consequence of the combination of the communication model S PU and of this low space complexity is that nodes cannot store a permanent pointer to any of their neighbors. This induces many complications compared to other circulation algorithms in the literature. We overcome these complications by the use of many precautions in the design of the rules of the algorithm, and notably for the passing of the token from one node to another. The resulting algorithm is relatively complex, and so is the proof of its validity.

Due to the complexity if the algorithm, we had to make a rather formal demonstration of its validity. We use the well-known concept of potential functions to prove the finiteness of circulation rounds, but ours is particularly elaborated, which make the proof especially trustful.

Chapter 6

Conclusion

So long Farewell Aufwiedersehn Goodbye Von Trapp Family

This thesis focuses on low-memory self-stabilizing algorithms for networks in which point-to-point communication is not built-in. With the recent development of networks composed of small autonomous devices, such algorithms are more and more desirable. We are interested in both lower and upper bounds. By lower bounds, we mean impossibility theorems, which prove some minimal requirement in terms of memory to solve a problem. By upper bound, we mean efficient algorithms, with better complexity than was previously achieved.

We obtained both types of results, and in various, and general settings.

Our first contribution is an impossibility result. We prove that, whatever the actual settings of the networks, one cannot use the algorithmic power procured by unique identifiers with less memory than O(log log n) bits per node. We proved that under that, execution of algorithms was the same on identified networks, and on homonymous or anonymous networks. We obtain this result by a counting argument. We prove that, although the behavior of an algorithm can depend on the value of the identifier, if the memory is too small, then there are much less way to behave differently than there are identifiers. In other words, there always exists a collection of several identifiers that the algorithm cannot distinguish through the choices it makes.

We extend this lower bound from executions to problems, by proving as an example a Ω(log log n) lower bound for the leader election problem. The main idea is to consider jointly the behavior of the algorithm, and the predicate that decides whether the node is leader or not. The boolean predicate does not significantly increase the size of the output, and therefore the reasoning made previously remains valid. This technique can be applied to any problem whose specification boils down to a constant number of local boolean predicates. This lower bound of Ω(log log n) for the leader election problem is tight on graphs with degree less than log n, since an algorithm was presented in [START_REF] Blin | Compact self-stabilizing leader election for general networks[END_REF] for the leader election problem, with only Θ(log log n + log ∆) bits per node required.

Our second contribution is twofold. The main part is a silent snap-stabilizing, for the detection of termination in anonymous networks, which requires Θ(log D) bits per node.

The problem of termination detection was widely studied in the past years, but there are very few snap-stabilizing algorithms in the literature, and this is the first such algorithm designed for anonymous networks, and has, furthermore, a low memory requirement.

To design this algorithm, we basically use two counters, that are both synchronized with a self-stabilizing unison algorithm. One counter is local to each node, and the other one is synchronized between neighbors.

Any self-stabilizing unison algorithm can be chosen for the synchronization of the two counters of our algorithm. This genericity was achieved after a theoretical analysis of unison algorithms, derived only from the specification of the Unison. We established strong synchronization properties that are necessarily satisfied by any algorithm solving unison.

Our third contribution is a token circulation algorithm. It is the first sublogarithmic token circulation algorithm for this problem in the port-unknown state-model, and we also prove that it is optimal in memory. The combination of the communication model and the memory requirements makes it impossible to statically designate one unique neighbors, which highly complicates the passing of the token. Our algorithm works under the weakest scheduling assumptions, on any Destination-Oriented Directed Acyclic Graphs, a class which notably contains trees.

General Perspectives

In this section, we propose general perspective as potential extensions of the presented results.

Our termination detection algorithm only returns positive answers: no answer is given while the observed algorithm does not effectively terminate according to its specification. Adapting our solution to provide snap-stabilizing negative answers, without any false negative is not so easy to achieve. It seems to be dependent on stabilizing time of the unison algorithm. Therefore, we should be able to achieve this goal by developing an ad-hoc solution, but likely at the expense of genericity. Also, two other issues remain open in anonymous settings, namely (i) the question of necessity for nodes to know (an upper bound on) the diameter of the network (no matter the solution being self-or non-self-stabilizing), and (ii) the optimality in both spaces and time to solve snap-stabilizing TD in anonymous networks. More generally, is O(log D) bits per node necessary to solve global observation problems in anonymous networks ?

Our lower Ω(log log n) bits per node lower bound applies to various problems. One remaining question is the tightness of this bound. Indeed, the best complexity achieved so far for the leader election problem, and the spanning tree construction is O(log log n+log ∆) bits per node. The question whether it is possible to solve leader election or other spanning structure construction with exactly Θ(log log n) bits per node, or whether an additional cost is necessary, remains open.

Our self-stabilizing token circulation algorithm is providing hope that it might be possible to design self-stabilizing token circulation algorithms for arbitrary networks G, beyond the case of D o , with space-complexity O(log log n) bits. The design of such algorithms requires to overcome at least two problems: the presence of more than one root, and the symmetry caused by the presence of cycles. The presence of multiple roots is an issue which may not be too dramatic, as it may be possible to let several tokens circulate, one per root, and to remove the tokens one by one until a single token remains. The symmetries caused by the presence of cycles appear to cause severe difficulties, and our current knowledge is insufficient to guarantee that a space-complexity O(log log n) bits can be achieved under such symmetries. Such an algorithm with complexity Θ(log log n) bits per node, solving token circulation on arbitrary graphs would be a valuable toolbox which could be used to solve other problems, such as the leader election, the spanning tree construction, etc. Combined with our lower bound, this would be a significant advance in the knowledge of the complexity of a large variety of problems.

Optimisation de la Mémoire pour les Algorithmes Distribués Auto-Stabilisants

Résumé : L'auto-stabilisation est un paradigme adapté aux systèmes distribués, particulièrement susceptibles de subir des fautes transitoires. Des erreurs de corruption de mémoire, de messages, la rupture d'un lien de communication peuvent plonger le système dans un état incohérent. Un protocole est autostabilisant si, quel que soit l'état initial du système, il garantit un retour à un fonctionnement normal en temps fini. Plusieurs contraintes s'appliquent aux algorithmes conçus pour les systèmes distribués. L'asynchronie en est un exemple emblématique. Avec le développement de réseaux d'objets connectés, censés être autonomes, il devient également central de concevoir des algorithmes ayant un faible coût en termes de consommation énergétique et peu exigeants en termes de ressources.

Une des manières d'appréhender ces problèmes est de chercher à réduire la taille des messages échangés entre les différents noeuds du réseau. Cette thèse se concentre sur l'optimisation de la mémoire nécessaire à la communication pour les algorithmes distribués auto-stabilisants.

Nous établissons dans cette thèse plusieurs résultats négatifs, démontrant l'impossibilité de résoudre certains problèmes sans une certaine taille minimale pour les messages échangés, en établissant une impossibilité d'utiliser jusqu'au bout l'existence d'identifiants uniques dans le réseau en dessous de cette taille minimale. Ces résultats sont génériques et peuvent s'appliquer à de nombreux problèmes distribués. Dans un second temps, nous proposons des algorithmes particulièrement efficaces en mémoire pour la résolution de deux problèmes fondamentaux des systèmes distribués: la détection de terminaison, et la circulation perpétuelle de jeton.

Mots clés :

Algorithmes distribues, tolerance aux pannes, auto-stabilisation, anonymat, optimisation mémoire

Memory-Optimization for Self-Stabilizing Distributed Algorithms

Abstract: Self-stabilization is a suitable paradigm for distributed systems, particularly prone to transient faults. Errors such as memory or messages corruption, break of a communication link, can put the system in an inconsistent state. A protocol is self-stabilizing if, whatever the initial state of the system, it guarantees that it will return a normal behavior in finite time.

Several constraints concern algorithms designed for distributed systems. Asynchrony is one emblematic example. With the development of networks of connected, autonomous devices, it also becomes crucial to design algorithms with a low energy consumption, and not requiring much in terms of resources.

One way to address these problems is to aim at reducing the size of the messages exchanged between the nodes of the network. This thesis focuses on the memory optimization of the communication for self-stabilizing distributed algorithms.

We establish in this thesis several negative results, which prove the impossibility to solve some problems under a certain limit on the size of the exchanged messages, by showing an impossibility to fully use the presence of unique identifiers in the network below that minimal size. Those results are generic, and may apply to numerous distributed problems. Secondly, we propose particularly efficient algorithms in terms of memory for two fundamental problems in distributed systems: the termination detection, and the token circulation.

Keywords: Distributed algorithms, fault-tolerance, self-stabilization, anonymity, memory optimization

Figure 3 . 1 :

 31 Figure 3.1: Example of two computing steps, with n = 6, k = 2, and A ID(u1) = A ID(u4) ,

Lemma 3. 5 .Proof:

 5 Let ϕ : A → B be a function, and let k ∈ N * . We have t k (ϕ) ≥ |A|-(k-1)|B| k Let us first consider b ∈ B, and denote t b k (ϕ) the number of disjoint sets of size k of elements of A with image b that can be formed. Intuitively, we have t b k (ϕ) = |ϕ -1 (b)| k

Theorem 3. 1

 1 Let c ∈ R, c > 1. Every deterministic distributed algorithm solving leader election in the state model under a central strongly fair scheduler or under the synchronous scheduler requires registers of size at least Ω(log log n) bits per node in n-node composite uniform rings with unique identifiers in [1, n × c].

  class of graphs which contains graphs of arbitrary large size, such that G is ∆-limited by log n.Let A be a distributed algorithm that uses registers of size o( log log n ∆ ) on all identified networks G 0 i [1, n × c], i.e. on all graphs G i with unique identifiers in [1, n × c]. For any large-enough graph G i ∈ G, for any divisor k of n such that k ≤ √ n,

  Figure 4.1. on wk off idl RB : R start RB : R stop App : get App : ask

Figure 4 .

 4 Figure 4.1: Diagram for req v

Figure 4 .

 4 3 recaps the different possible situations, and the name of the corresponding rule of R S

Figure 4 .

 4 Figure 4.3: Rules of R S simul depending on the enabled rules for A and U. Rules of R cvg are convergence rules for U or A.For T , convergence (resp. transparent, resp. normal) rules are rules simulating a convergence (resp. transparent, resp. normal) rule of U. We extend that definition to R A cvg , which is a transparent rule.

Figure 4 . 4 .

 44 Let us define that subexecution: Definition 4.10 (Final Descent) Let v ∈ V and let = (γ -→ ) be a maximal execution such that v executes R start in γ -→ T γ 0 , and let f be the time of response of v in . Let us consider

Figure 4 . 4 :

 44 Figure 4.4: Example of Final Descent on node v, progression indicated by the decrease of dt v

  By definition of the algorithm and guards, in a step where v executes Rcpt, v also executes Rwait. Hence v also executes Rwait at least 2D + 1 times during s. Since v does not execute any rule of Rcvg in s, those 2D + 1 executions of Rwait constitute an N -sequence of length at least 2D + 1.

Proof:

  Case 1: in , w executes a rule of Rcvg that updates state w|A . Let us consider csa = γa -→ T γ a the first computing step of in which one node u executes a rule that updates state u|A , and let us consider one such u. By definition, ∀v ∈ V, state v|A remains constant during a = γ0 -→ T γ1 -→ T • • • -→ T γa. As a consequence,

Theorem 4. 7

 7 Let = γ 0 -→ T • • • be a maximal execution such that ∃v ∈ V, t ≥ 0 : req γt v = on,and let t > t such that req γ t v = off. Then A has terminated in γ t . Proof : Let us first make the same reasoning as in the proof of Theorem 4.4: according to Lemma 4.6, and since U is a unison algorithm, v is activated at least once after γt, and when first activated it executes Rstart. Let us call γact -→ T γact+1 that computing step. Let us now consider the subexecution = γact -→ T γact+1 -→ T • • • .

Theorem 4. 8

 8 Let v be a node, and let = (γ -→ T γ 0 -→ T • • • ) be a maximal execution such that γ ∈ Γ cvg and in γ -→ T γ 0 , v executes R start . Then f occurs in O(D) full rounds after γ.

Figure 5 . 1 :

 51 Figure 5.1: A destination-oriented directed acyclic graph (D o ).

aFigure 5 . 2 :

 52 Figure 5.2: Example of a DODAG under the anchor a in blue, and of a sub-DODAG of G in red

Figure 5 .Figure 5 . 3 :

 553 Figure 5.3: Scheme of the circulation of a token from top to bottom in a triangle, with id b > id c . The node holding the token is colored in blue.

Figure 5 . 4 :

 54 Figure 5.4: Scheme of the return of a token to the right parent in a triangle for fairness concerns.

Figure 5 .Figure 5 . 7 :

 557 Figure 5.7 represents the order between the different states taken by the variable tok.

Figure 5 . 8 :

 58 Figure 5.8: Cleaning children before sending up the token in a triangle: play v = F.

Figure 5 .

 5 Figure 5.13: Chain of execution of the different rules on one node, and effects of these rules. The update of c v is represented by color gray.

  Figure 5.14: Proof of Lemma 5.1

Figure 5 .

 5 Figure 5.15: Proof of Lemma 5.2

Figure 5 .

 5 Figure 5.16: Proof of Lemma 5.3, part. 1

Figure 5 .Lemma 5 . 4

 554 Figure 5.17: Proof of Lemma 5.3, part. 2

Figure 5 . 4 Tools Lemma 5. 4 ∀v

 544 Figure 5.18: Proof of Lemma 5.4

Figure 5 . 5 Tools Lemma 5. 5 ∀v

 555 Figure 5.19: Proof of Lemma 5.5

Figure 5 .

 5 Figure 5.20: Proof of Lemma 5.6

  Figure 5.21: Proof of Lemma 5.7

Lemma 5. 8 Figure 5 .

 85 Figure 5.22: Example of three CD o 's in the same graph G

Definition 5 .

 5 18 (Weighted DODAG)A weighted D o (WD o ) is a D o with labels in M : (D a , W), where D a is a D o and W ∈ M Va is a map that associates an element of M to each node of D a .

Definition 5 .

 5 19 (Projection of a WD o on a Branch) Let (D a , W) be a WD o , and let B = v 1 v 2 • • • v k be a maximal branch of G a . We call projection of (D a , W) on B, and denote (D a , W)(B) the sequence W

Lemma 5. 12

 12 Definition 5.20 defines a well-founded order.Proof : By construction, is reflexive, anti-symmetric, and transitive. Let us prove that it is also well-founded. Consider an infinite sequence ofWD o 's (D n a , W n ) n∈N such that ∀n, (D n+1 a , W n+1 ) (D n a , W n ),and let us prove that there exists N ∈ N such that ∀n ≥ N, (D n a , W n ) = (D N a , W N ). Let B be a maximal branch of Ga, and let k be the length of B. By definition, ∀n, (D n+1 a , W n+1 )(B) α (D n a , W n )(B). But α is a well-founded order on sequences of length at most k, and ∀n, (D n a , W n )(B) is a sequence of length at most k. Consequently, there exists NB ∈ N such that ∀n ≥ NB, (D n+1 a , W n+1 )(B) = (D n a , W n )(B). Since there exists a finite number of maximal branches B of Ga, let us consider N = maxB(NB). By definition, ∀n ≥ N , for all maximal branch B of Ga, (D n a , W n )(B) = (D N a , W N )(B), and thus, ∀n ≥ N, (D N a

Figure 5 .

 5 Figure 5.23: Dedicated weight function for each rule. For readability, one color is associated to each weight function.

Figure 5 .

 5 Figure 5.24: Evolution of the state of a child of node v with tok v / ∈ {⊥, ↑}.

Figure 5 .

 5 Figure 5.25: Weight associated to a child of node v with tok v / ∈ {⊥, ↑}.

  maximal branch of Ga, and let v1v2 • • • vj = D γ a (B) be the projection of D γ a on B. Let us consider the following cases:

Proof:

  Let us consider one node v ∈ B(D γ a ) that executes RWin, RFakeWin, or RReplayUp during cs. By definition, ∃p ∈ P(v) : p ∈ D γ a ∧ tok γ v =↑. Let us consider B = v1v2 • • • v k a branch of D γ a such that v k = p. According to Lemma 5.10, B is a branch of D γ a . According to Lemma 5.16, WCh(p, γ ) < WCh(p, γ), and according to Theorem 5.3, WCh(D γ a (B), γ ) α WCh(D γ a (B), γ). Consequently, WCh(D γ a (B), γ ) ≺α WCh(D γ a (B), γ), and thus according to Theorem 5.3, WCh(D γ a , γ ) ≺ WCh(D γ a , γ).

Figure 5 .

 5 Figure 5.28: Diagram of variable play u .

  Let us consider one such node v ∈ D γ a (B). According to Theorems 5.6 and 5.8, we havetok γ v = tok γ v . If tok γ v = •, then WNego(v, γ ) = 0 = WNego(v, γ). If tok γ v = • and tok γ v =•, then we fall under the hypothesis of Lemma 5.47 and thus WNego(v, γ ) ≤ WNego(v, γ).Thus, for any branch B of Ga, for any node v ∈ D γ a (B), WNego(v, γ ) ≤ WNego(v, γ), and thus WNego(D γ a , γ ) WNego(D γ a , γ).

  If ∃v ∈ D γ a such that tok γ v = • and either v executes R NewPh or R maxPos during cs, either ∃u ∈ Players γ (v) such that u executes R NewBit during cs, then (W Ch , W Er , W Circ , W Play , W Nego )(D γ a , γ ) ≺ 5 (W Ch , W Er , W Circ , W Play , W Nego )(D γ a , γ) Proof : According to Theorem 5.11, (WCh, WEr, WCirc, WPlay, WNego)(D γ a , γ ) 5 (WCh, WEr, WCirc, WPlay, WNego)(D γ a , γ). If (WCh, WEr, WCirc, WPlay)(D γ a , γ ) ≺ 4 (WCh, WEr, WCirc, WPlay)(D γ a , γ), then the result is trivial. Let us now suppose that (WCh, WEr, WCirc, WPlay)(D γ a , γ ) = (WCh, WEr, WCirc, WPlay)(D γ a , γ), and prove that WNego(D γ a , γ ) ≺ WNego(D γ a , γ). Let us consider v ∈ D γ a such that tok γ v = • and either v executes RNewPh or RmaxPos during cs, either ∃u ∈ Players γ (v) such that u executes RNewBit during cs. According to Theorems 5.6 and 5.8, we have tok γ v = •. Thus, we fall under the hypothesis of Lemma 5.47 and we have WNego(v, γ ) ≺ WNego(v, γ). Thus, WNego(D γ a , γ ) = WNego(D γ a , γ) so according to Theorem 5.11, we conclude that (WCh, WEr, WCirc, WPlay, WNego)(D γ a , γ ) ≺ 5 (WCh, WEr, WCirc, WPlay, WNego)(D γ a , γ).

Theorem 5 .

 5 13 Let = γ 0 → γ 1 → • • • → γ m be an execution. If a is an anchor at γ m , and if a does not execute R r NewDFS during , then W(D γm a ) W(D γ0 a ). Proof : By definition, ∀t ∈ [0, m-1], a does not execute R r NewDFS during γt → γt+1, so according to Theorem 5.11, ∀t ∈ [0, m-1], W(D γ t+1 a ) W(D γ t a ). By transitivity, we conclude W(D γm a ) W(D γ 0 a ).

•

  u ∈ B(D γ a ) and u executes R Win or R FakeWin during cs, or • u ∈ D γ a and u executes E TrustChild or R Give or R NewPlay or R Drop or R Nego or R OfferUp or R Receive or R Return or R ReNego or R NewPh or R maxPos during cs, or • ∃v ∈ D γ a , v ∈ P(u), tok γ v = • and u executes R Lose or R NewBit during cs, or • ∃v ∈ D γ a , v ∈ P neq (u), tok γ v ∈ { , •} and u executes R ReplayD during cs, or • ∃v ∈ D γ a , v ∈ P eq (u), tok γ v =↑ and u executes R Fake or R ReplayUp during cs.

Proof:

  Let us suppose that D γ a is not activated during cs and that a ∈ A(γ ), and let us prove D γ a = D γ a . To achieve this, let us prove that for all branchB = v1 • • • v k of Ga, D γ a (B) = D γ a (B). Remark first that ∀i ∈ [1, k], tok γ v i = tok γ v i , which implies D γ a (B) ⊂ D γ a (B).We have already seen in the proof of Lemma 5.18 that if D γ a (B) is longer than D γ a (B) then there exists v ∈ B(D γ a ) which executes RWin during cs, which would activate D γ a . Consequently, D γ a (B) = D γ a (B). This, being true for all branch B of Ga, proves D γ a = D γ a .

  If u executes R r NewDFS during cs then u is the root, and u activates D γ r . • If u executes RWin or RFakeWin during cs then ∃u ∈ P(v) : tok γ p / ∈ {⊥, ↑, ↓}, so according to Lemma 5.8, ∃a ∈ A(γ) such that v ∈ D γ a and thus u ∈ B(D γ a ), and u activates D γ a . • If u executes ETrustChild or RGive or RNewPlay or RDrop or RNego or ROfferUp or RReceive or RReturn or RReNego or RNewPh or RmaxPos during cs then tok γ u = ⊥ so according to Lemma 5.8, there exists a ∈ A(γ) such that u ∈ D γ a and thus u activates D γ a . • If u executes RLose or RNewBit during cs then LoseNeg γ (u) ∨ AnswerNeg γ (u). In both cases, ∃p ∈ P(u) : tok γ p = •, so according to Lemma 5.8, there exists a ∈ A(γ) such that v ∈ D γ a and thus u activates D γ a . • If u executes RReplayD during cs then ReplayL γ (u) and thus ∃p ∈ Pneq(u) : tok γ p ∈ { , •}. According to Lemma 5.8, there exists a ∈ A(γ) such that v ∈ D γ a and thus u activates D γ a . • If u executes RFake or RReplayUp during cs then ∃v ∈ Pneq γ (u) : tok γ v =↑. According to Lemma 5.8, there exists a ∈ A(γ) such that v ∈ D γ a and thus u activates D γ a .

Proof:

  We established in Theorem 5.13 that W is pre-admissible. Let us now consider one computing step γ → γ , one CD o D γ a which is activated during cs, and suppose that a does not execute R r NewDFS during cs. Let us consider one node u which activates D γ a during cs. • If u ∈ B(D γ a ) and u executes RWin or RFakeWin during cs, then according to Theorem 5.4, W(D γ a , γ ) ≺ W(D γ a , γ). • If u ∈ D γ a and u executes ETrustChild or RGive or RNewPlay or RDrop or RNego or ROfferUp or RReceive or RReturn or RReNego or RNewPh or RmaxPos during cs, then according to Theorems 5.6, 5.8, and 5.12, W(D γ a , γ ) ≺ W(D γ a , γ).

Definition 5 .

 5 31 (bi-branchD o B k ) For any k ≥ 1, we define B k the k-th bi-branch D o by B k = (V k , E k ) where:

Figure 5 .

 5 Figure 5.29: Bi-branch D o B k

  Contents 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Lower Bound for LE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

		37
	3.6.2.1	k-Homonymy . . . . . . . . . . . . . . . . . . . . . . . . . 37
	3.6.2.2	Indistinguishability . . . . . . . . . . . . . . . . . . . . . 37
	3.6.3

3.1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 3.1.2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 3.1.3 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 3.2 Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 3.2.1 Indistinguishability . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 3.2.2 Degree-limited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3.2.3 Model for Sections 3.4 and 3.5 . . . . . . . . . . . . . . . . . . . . . 26 3.2.4 Model for Section 3.6 . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3.2.5 Leader Election Problem . . . . . . . . . . . . . . . . . . . . . . . . 27 3.3 Intuition of the proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 3.3.1 Challenge of lower bounds for non-silent algorithms . . . . . . . . . 28 3.3.2 Intuition on a minimal example . . . . . . . . . . . . . . . . . . . . 29 3.4 Equivalence with Anonymous Networks . . . . . . . . . . . . . . . . . . . . 30 3.4.1 Statement of the Theorem . . . . . . . . . . . . . . . . . . . . . . . 30 3.4.2 Proof in S PU on uniform networks . . . . . . . . . . . . . . . . . . . 30 3.4.3 Generalization to S PK and to semi-uniform networks . . . . . . . . 32 3.5 Equivalence with Homonymous Networks . . . . . . . . . . . . . . . . . . . 33 3.5.1 Statement of the Theorem . . . . . . . . . . . . . . . . . . . . . . . 33 3.5.2 Proof when k divides n . . . . . . . . . . . . . . . . . . . . . . . . . 33 3.5.3 Proof for any n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 3.6 3.6.1 Statement of the Theorem . . . . . . . . . . . . . . . . . . . . . . . 36 3.6.2 Limits of Theorems 3.2 and 3.3 . . . . . . . . . . . . . . . . . . . .

  a class of graphs which contains graphs of arbitrary large size. Let us call ∆ G (n) the function that associates to each integer n, the maximal degree of graphs of size n in G. If no graph of size n exists in G we define ∆ G (n) = 0. If there is no bound on the degree of graphs of size n in G we define ∆ G

  c > 1. Every deterministic distributed algorithm solving leader election in the state model under a central strongly fair scheduler or under the synchronous scheduler requires registers of size at least Ω(log log n) bits per node in n-node composite uniform rings with unique identifiers in [1, n × c].

  class of graphs which contains graphs of arbitrary large size, such that G is ∆-limited by log n.Let A be a distributed algorithm that uses registers of size o( log log n For any large-enough graphG i ∈ G, there exist n identifiers ID 1 , ID 2 , . . . , ID n in [1, n×c] such that G 0 i [ID 1 ,ID 2 , . . . , ID n ] and G k i [ID 1 , ID 2 , . . . , ID n/k ] are indistinguishable for A.

	networks G 0	∆	) on all identified

i [1, n × c], i.e. on all graphs G i with unique identifiers in [1, n × c].

  d + 1, d ≥ 2 and of origin t 0 , and that in (t 0 , t d ), w does not execute rules of R U C . Then vw is a causal pyramid of length d + 1 and of origin t 0 . Let us denote by p the value of clockv at time t0 -1. Since v executes d + 1 consecutive normal actions, at time t0, t1, . . . , t d , its clock in incremented d + 1 times. Furthermore, since for any i ∈ [0, d], v executes a normal action at time ti, then we haveP + (v) at ti -1, for any i ∈ [0, d].Therefore, for any i, we have at ti -1, clockw ∈ {clockv, clockv + 1}. In other words, for any i ∈ [0, d], we have at ti -1, clockw ∈ {p + i, p + i + 1}. Since w does not execute any convergence action during (t0, t d ), this is possible only if w increases d -1 times its clock during (t0, t d ). This means that w executes an N -sequence of length d -1 during the N -sequence of v.

Proof :

  4.2. Let us now formally prove Theorem 4.4: According to Lemma 4.8, there exists ta ≥ t such that γt a ∈ Γ da . Let us consider a = γt a -→ According to Theorem 4.3, there exists t d ≥ ta such that req

	Theorem 4.4
	Let = γ 0 -→
	Since req γ t	γ t d v	∈ {off, idl}.

T

• • • be a maximal execution such that ∃v ∈ V, t ≥ 0 : req γt v = on. There exists t > t such that req

γ t v = off Proof : Let us consider the subexecution t = γt -→ T • • • . T • • • . v = on and req γ t d v

∈ {off, idl}, there exists t > t such that req

γ t v = off.

  then there exists a node u that executes a rule of R cvg in s . Let us reason by contradiction and suppose that no node execute any rule of Rcvg in s. Let us prove that under such circumstances, all nodes execute a rule that is not Rstart in s. Let us consider any w ∈ V , and let us consider

Proof :

  which is possible only if v executes RWin during cs. But this is possible only if v has one parent Rule ROfferUp is the only rule whose effect might update tok from a state that is neither ⊥ nor ↑, to a state that is ⊥ or ↑. But p can execute ROfferUp during

	p such that tok γ p = . But in such a case, we necessarily have tok γ p ∈ { , , ↓}, and thus v / ∈ A(γ ). • Suppose now that tok γ v = ⊥. Since v / ∈ A(γ), v has one parent p such that tok γ p / ∈ {⊥, ↑}. Let us prove that tok γ p / ∈ {⊥, ↑}. cs only if tok γ p = •. Under such circumstances, since tok γ v = ⊥, Er γ (p) = true, so p cannot execute ROfferUp during cs. Thus, tok γ p / ∈ {⊥, ↑} and by definition, v / ∈ A(γ ).

  result is immediate. Let us rather suppose that B is not a branch of D γ a , and let us consider the highest valuei such that Bi = v1v2 • • • vi is a branch of D γ a . Remark that v1 = a is necessarily a branch of D γ a , so i ∈ [1, k -1].The only possibility for the opposite would be that vi executes ROfferUp during cs. But this implies that tok γ v i = • and thus Er γ (vi) due to vi+1. Thus, if activated, vi does not execute ROfferUp during cs but ETrustChild.

	By definition, vi+1 ∈ C D γ a (vi), so tok γ v i / ∈ {⊥, ↑} and tok γ v i+1 = ⊥. Let us first prove that tok γ v i / ∈ {⊥, ↑}. Consequently, since we have vi+1 / ∈ C D γ a

  r then only R r NewDFS can update cv, and it is enabled only if tok γ v =↑. If v = r then only RWin and RFakeWin can update cv, and both are enabled only if tok γ v = ⊥.

  , ↑}, then according toLemma 5.11, v does not update cv during cs. Let us consider one child u of v such that u / ∈ AllCand γ (v). By definition, c γ u = c γ v ∧play γ u ∈ {W, F}. EqColCand γ (p). But since play γ v ∈ {W, F}, v / ∈ EqColCand γ (p), which according to Lemma 5.15 means that EqColCand γ (p) EqColCand γ (p). According to Lemmas 5.13 and 5.14, we obtain WCh(p, γ ) < WCh(p, γ). F} and v switches its color during cs, we also have v / ∈ AllCand γ (p). According to Lemma 5.13, AllCand γ (p) AllCand γ (p), and according to Lemmas 5.14 and 5.15, we obtain WCh(p, γ ) < WCh(p, γ). Let us now suppose that v executes RReplayUp during cs. Since tok γ p / ∈ {⊥, ↑}, predicate ReplayW γ (v) implies that c γ p = c γ v . Since v execute RReplayUp during cs, we have play γ v = W, and thus v ∈ ReplayCand γ (p), and we also know that v updates play v to P and that it does not update its variable cv which implies that c γ v = c γ p ∧ play γ v = P. Thus, v / ∈ ReplayCand γ (p) so according to Lemma 5.14 means that ReplayCand γ (p) ReplayCand γ (p). According to Lemmas 5.13 and 5.15, we obtain WCh(p, γ ) < WCh(p, γ).

	{W,	If c γ v = c γ p then v ∈ Otherwise, c γ v = c γ p . Since play γ v = P, we have v ∈ AllCand γ (p), and since play γ v ∈

  γ) is possible only if v executes RWin during cs, and thus Lemma 5.16 states that ∀p ∈ P(v) such that tok γ

	WCh(p, γ ) < WCh(p, γ).	p / ∈ {⊥, ↑}, we have

  .38) Proofs Lemma 5.19 describes under which conditions one node that is not in error before a computing step can become in error after that computing step. It states that either it makes W Ch decrease, either it comes from the fact that one child of that node executed E TrustChild , which does not lead to any increase of W Er . This lemma is the main argument to establish that (W Ch , W Er ) is a pre-admissible weight function.Let v ∈ V be a node and let cs = γ → γ be a computing step. If ¬Er γ (v) and Er γ (v), then W Ch (v, γ ) < W Ch (v, γ) or v executes R Win during cs or ∃u ∈ C(v) such that u executes E TrustChild during cs. We prove the equivalent statement: if ¬Er γ (v) then ¬Er γ (v) or WCh(v, γ ) < WCh(v, γ) or, during cs, v executes RWin or ∃u ∈ C(v) such that u executes ETrustChild. cs, then ∀u ∈ C(v), tok γ u ∈ {⊥, }. Furthermore, tok γ v ∈ { , ↓}. Thus, if no children u of v executes ETrustChild during cs, ¬Er γ (v).8. If tokγ v = • ∧ ∀u ∈ C(v), tok γ u ∈ {⊥, ↑} then children u of v cannot execute RWin during cs: either u has one other parent p such that tok γ p = , and then ¬OkNeg γ (u), either it has not, and thus it cannot execute RWin either. This implies that ∀u ∈ C(v), tok γ u ∈ {⊥, ↑} and thus ¬Er γ (v).

	Lemma 5.19
	Since ¬Er γ (v), only few cases must be considered. 1. If tok γ

Proof : v = ⊥ then either v executes RWin during cs, either it does not, but then tok γ v = ⊥ and thus ¬Er γ (v). 2. If tok γ v =↑ then tok γ v ∈ {↑, ⊥} and thus ¬Er γ (v).

during

  ). We suppose now that for any branch B of Ga, D γ and let us consider one such v with highest depth. Let us first prove that tok γ RReceive during cs, which implies that ∀u ∈ C(v), tok γ u ∈ {⊥, ↑}. None of these children executes RWin during cs, because if one u does then the edge (v, u)

	Proof : According to Theorem 5.3, we already have WCh(D γ a , γ ) WCh(D γ a , γ). Consequently, by definition of the lexicographic order, we only have to establish that if WEr(D γ a , γ) ≺ WEr(D γ a , γ ) then WCh(D γ a , γ). a , γ ) ≺ WCh(D γ Let us first remark that if there exists B a branch of Ga such that D γ a (B) is longer than D γ a (B) then according to Lemma 5.18, WCh(D γ a , γ ) ≺ WCh(D γ a , γ).
	v / ∈ {⊥, ↑, ↓}. v ∈ {↑, ⊥}, and thus WEr(v, γ ) = 0 which is v =↑ then tok γ v = ⊥. If tok γ a , tok γ Since v ∈ D γ contradictory with our hypothesis, so tok γ v =↑. Finally, if tok γ v =↓ then WEr(v, γ ) > 0 is possible only if v executes belongs to D γ a (because tok γ v = •) while it does not belong to D γ a , which is contradictory with our hypothesis on branches. Consequently, ∀u ∈ C(v), tok γ u ∈ {⊥, ↑}, and thus ¬Er γ (v), and WEr(v, γ ) = 0. Thus, we can indeed assume that tok γ v / ∈ {⊥, ↑, ↓}. Since all branches of D γ a are also branches of D γ

a (B) is not longer than D γ a (B). Let us establish that ∀v ∈ D γ a , WEr(v, γ ) ≤ WEr(v, γ), or WCh(D γ a , γ ) ≺ WCh(D γ a , γ). Since the branches of D γ a are included in the branches of D γ a , this becomes WEr(D γ a , γ ) WEr(D γ a , γ) or WCh(D γ a , γ ) ≺ WCh(D γ a , γ), and thus this actually proves the theorem. Let us prove that if ∃v ∈ D γ a : WEr(v, γ ) > WEr(v, γ) then WCh(D γ a , γ ) ≺ WCh(D γ a , γ), a , and since v is one deepest node of D γ a such that WEr(v, γ ) > WEr(v, γ), we have ∀u ∈ C(v), WEr(u, γ ) ≤ WEr(u, γ). As a consequence, WEr(v, γ ) > WEr(v, γ) becomes possible only if ¬Er γ (v) and Er γ (v). According to Lemma 5.19, this is possible only if during cs, v executes RWin, which cannot happen since tok

r

  NewDFS during cs. If ∃v ∈ D γ a such that v executes E TrustChild during cs, then (W Ch , W Er )(D γ a , γ ) ≺ 2 (W Ch , W Er )(D γ a , γ).Explanations Now that we have considered the cases where nodes execute E TrustChild , we can consider that variable tok is updated in accordance with Figure5.7. The third component of the weight function should treat all the transitions of variable tok depicted in this diagram. We could think at first sight that since the diagram is circular, we will have difficulty defining a weight function that decreases along the diagram. Yet, if the algorithm behaves correctly, when a node v is updated from • to , one child of v is supposed to execute R Win in the next computing steps, and then W Ch will decrease on the observed CD o .

	Proof : Let us consider one such node v ∈ D γ a , and one branch B of Ga such that v ∈ D γ a (B). If v / ∈ D γ a (B), then according to Lemma 5.18, we have (WCh, WEr)(D γ a , γ). a , γ ) ≺ 2 (WCh, WEr)(D γ Else, remark that WEr(v, γ) > 1 since Er γ (v), and WEr(v, γ ) = 0 since tok γ v =↓. Thus, WEr(v, γ ) < WEr(v, γ), and so WEr(D γ a (B), γ ) ≺α WEr(D γ a (B), γ) since v ∈ D γ a (B). Since (WCh, WEr)(D γ a , γ ) 2 (WCh, WEr)(D γ a , γ), we conclude (WCh, WEr)(D γ a , γ ) ≺ 2 (WCh, WEr)(D γ a , γ).
	5.4.2.6 Third component of W: W Circ , circulation of variable tok

  u executes R Lose during cs, or Fake or R ReplayUp during cs,we have (W Ch , W Er , W Circ , W Play )(D γ a , γ ) ≺ 4 (W Ch , W Er , W Circ , W Play )(D γ a , γ).Let us consider such nodes v and u, and one branch B of Ga such that v ∈ D γ , •} and one child u of v executes RWin or RFakeWin, then we according to Lemma 5.18, or Theorems 5.6 and 5.8, or Theorem 5.4, we have (WCh, WEr, WCirc, WPlay)(D γ a , γ ) ≺ 4 (WCh, WEr, WCirc, WPlay)(D γ a , γ) We can now suppose that v ∈ D γ a (B) and tok γ v = tok γ v and if tok γ v ∈ {•, , •} then no child of v executes RWin or RFakeWin. Depending on which of the three situations has to be considered, Lemma 5.25, Lemma 5.26, or Lemma 5.27 applies and guarantees that WPlay(v, γ ) < WPlay(v, γ). From Theorem 5.9 we conclude (WCh, WEr, WCirc, WPlay)(D γ

	• tok γ v ∈ { , •} and c γ u = c γ v and u executes R ReplayD during cs, or • tok γ v =↑ and c γ u = c γ v and u executes R a (B). If v / ∈ D γ a (B), or if tok γ v = tok γ v , or if tok γ v ∈ {•,

Proof : a , γ ) ≺ 4 (WCh, WEr, WCirc, WPlay)(D γ a , γ).

  . . , W k ) is admissible if for all computing step cs = γ → γ , for all CD o D γ a , if D γ a is activated during cs and if a does not execute R r NewDFS during cs, then (W 1 , . . . , W k )(D γ a , γ ) ≺ k (W 1 , . . . , W k )(D γ a , γ)

	Theorem 5.14
	W is admissible.

Acknowledgments

Bien que signée de ma main seule, cette thèse n'a été menée à son terme que grâce à l'implication de bien des personnes autour de moi.

During cs, u does not execute RWin nor RFakeWin since play γ u = P, and does not execute R r

NewDFS

since it has at least one parent. Furthermore, u does not execute RReplayUp during cs since v ∈ Peq γ (u) ∧ tok γ v =↑. Thus, c γ u = c γ v ∧ play γ u ∈ {W, F}, in other words, u / ∈ AllCand γ (v). As a result, C(v) \ AllCand γ (v) ⊆ C(v) \ AllCand γ (v).

Lemma 5.14

Let cs = γ → γ be a computing step and let v ∈ V be a node. If tok γ v / ∈ {⊥, ↑} then ReplayCand γ (v) ⊆ ReplayCand γ (v).

Proof : We prove the equivalent statement:

Since tok γ v / ∈ {⊥, ↑}, then according to Lemma 5.11, v does not update cv during cs. Let us consider one child u of v such that u / ∈ ReplayCand γ (v). If u / ∈ AllCand γ (v) then according to Lemma 5.13, u / ∈ AllCand γ (v) and thus u / ∈ ReplayCand γ (v). Let us suppose now that u ∈ AllCand γ (v) \ ReplayCand γ (v), i.e. c γ u = c γ v ∧ play γ u ∈ {P, L}. If u executes RWin or RFakeWin during cs, then c γ u = c γ v ∧ play γ u = W and thus u / ∈ ReplayCand γ (v). Otherwise, since u has at least one parent it does not execute R r NewDFS and thus does not update cv, and it can neither update cu to W or L, and thus u / ∈ ReplayCand γ (v). As a result, C(v) \ ReplayCand γ (v) ⊆ C(v) \ ReplayCand γ (v).

Lemma 5.15

Let cs = γ → γ be a computing step and let v ∈ V be a node. If tok γ v / ∈ {⊥, ↑} then EqColCand γ (v) ⊆ EqColCand γ (v).

Proof : We prove the equivalent statement:

Since tok γ v / ∈ {⊥, ↑}, then according to Lemma 5.11, v does not update cv during cs. Let us consider one child u of v such that u / ∈ EqColCand γ (v). If u / ∈ ReplayCand γ (v) then according to Lemma 5.14, u / ∈ ReplayCand γ (v) and thus u / ∈ EqColCand γ (v). Let us suppose now that u ∈ ReplayCand γ (v) \ EqColCand γ (v), i.e. c γ u = c γ v ∧ play γ u ∈ {W, F}. Since u has at least one parent, it does not execute R r NewDFS during cs, and since play γ u = P, u does not execute RWin nor RFakeWin during cs. Thus, we have c γ u = c γ v and thus u / ∈ EqColCand(v, γ ). As a result, C(v) \ EqColCand γ (v) ⊆ C(v) \ EqColCand γ (v).

Lemma 5.16 establishes that if one node executes R Win , R FakeWin , or R ReplayUp , then the weight of all its parents in any CD o decrease. Basically, we formally prove that any such activation corresponds to one of the transitions represented in Figure 5.25, and thus that it makes one of the three sets decrease.

Lemma 5.16

Let cs = γ → γ be a computing step, and let v ∈ V be a node. If v executes R Win , R FakeWin , or R ReplayUp during cs, then ∀p ∈ P(v) such that tok γ p / ∈ {⊥, ↑}, we have W Ch (p, γ ) < W Ch (p, γ). 3. If tok γ v =↓ then if v does not execute RReceive during cs, tok γ v =↓ and thus ¬Er γ (v). Otherwise, v executes RReceive during cs and then ∀u ∈ C(v), tok γ u ∈ {⊥, ↑}. Either one child u of v executes RWin, and then WCh(v, γ ) < WCh(v, γ) according to Lemma 5.16, either no one does, but then ∀u ∈ C(v), tok γ u ∈ {⊥, ↑}, and since tok γ v = •, we have ¬Er γ (v). 4. If tok γ v = ∧ ∀u ∈ C(v), tok γ u = ⊥ then either one child u of v executes RWin, and then WCh(v, γ ) < WCh(v, γ) according to Lemma 5.16, either no one does, but then ∀u ∈ C(v), tok γ u = ⊥ which means that ¬Er γ (v). 5. If tok γ v = • ∧ ∀u ∈ C(v), tok γ u = ⊥ then children u of v cannot execute RWin during cs: either u has one other parent p such that tok γ p = , and then ¬OkNeg γ (u), either it has not, and thus it cannot execute RWin either. Thus, ∀u ∈ C(v), tok γ u = ⊥, so ¬Er γ (v). 6. If tok γ v = ∧∀u ∈ C(v), tok γ u ∈ {⊥, } then children u of v cannot execute RNego since they have one parent v with tok γ v = . If no children u of v executes ETrustChild during cs, then ∀u ∈ C(v), tok γ u ∈ {⊥, }. Furthermore, tok γ v ∈ { , } since ¬Er γ (v). Thus, if no children u of v executes ETrustChild during cs, ¬Er γ (v).

Let us now define the weight of one node v such that tok v = •. The weight of such a node can also be taken between two values that are 2 and 7, so that it can easily be bigger than W Circ . We must design W • Circ such that, if after v executes R Give we have W Circ (v, γ ) = 6 then we have W • Circ (v, γ) = 7 just before, otherwise the weight would increase. But we also require that we never have

In other words, if W Circ is set to 6 immediately after the execution of R Give , it must be detected at the very beginning of the execution (or as soon as tok v is set to •).

The situation described just above happens if before v executes R Give , all the nodes u ∈ Players γ (v) execute R Lose . In such a situation, no children u of v wins the negotiation, and v executes a full cycle of the cycle of Figure 5.27, which indeed forces us to attribute 7 to the weight of v. Hopefully, the design of our algorithm guarantees that this can only happen if the values of id v and/or id u are inconsistent. In other words, as soon as v executes one action, we guarantee that this situation cannot occur anymore, this will be proven in Lemma 5.23. Thus, we only have to deduce if u ∈ Players(v) will execute R Lose before any action of v, from the values of id v and id u . This strongly depends on the value of b γ v . If b γ v = ⊥ then v announces one value that defines the partial winners of that turn of the negotiation. It the configuration is inconsistent, it is very possible that no children u ∈ Players γ (v) has produced, neither will produce that answer. All of the nodes that have announced a different value than b γ v , or that will announce a different value than b γ v will execute R Lose , immediately for the first ones, and after one execution of R NewBit for the second ones

waiting for all of its children u ∈ Players γ (v) to announce Bit u (ph γ v ). Therefore, no children u ∈ Players γ (v) can execute R Lose before an action of v. We define the set Losers(v) that depends on the value of b v .

(5.41)

We are now tempted to say that W γ Circ (v) = 7 if and only if Losers γ (v) = Players γ (v). Yet, one subtlety must be treated before. Indeed, when all the children u of v have received the token, then u will not execute R Give but R OfferUp , and thus we do not have to reason based on the constraint of W Circ . Moreover, in that situation, we must not attribute a weight of 7 to v since it would be an increase when v executes R ReNego , and updates tok v from • to •. This situation cannot happen as long as there remains players, because after the execution of StartNego(v), we have Losers(v) = ∅. The only case to consider is therefore when no node children of v is susceptible to receive the token, and in that situation we force W • Circ (v, γ) to be 2. In order to make the proof easier to approach, we first define the set Candidates(v) that contains all the nodes that still have to negotiate and win the token before the circulation from v is over. This set reminds one of the different cases depicted in Figure 5.24.

We can now define the main predicate if that section, FullRound, which decides whether v has to execute one full cycle before any of its children receives the token.

We deduce function W • Circ that allows us to define W Circ .

(5.45) Proofs Lemma 5.20 establishes that actions that make the negotiation progress are non simultaneous on the parent and on its children.

Lemma 5.20

Let γ be a configuration and let v ∈ V be a node such that Synch

Proof : Since we are only interested in properties at γ, no confusion can be made, and thus we do not precise the configuration in which the predicates and sets are evaluated in that proof. By definition of Synch(v), we have ph u = ph v . Consequently, we have:

Let us first suppose that PhComplete(v). Then by definition, bu = bv, and thus ¬LosePar(u, v). Furthermore, we also have

Let us now suppose that NextPlay(v). We deduce that bv = ⊥, and thus ¬LosePar(u, v). Furthermore, we have AnswerPar(u, v)

Lemmas 5.21 and 5.22 prove that the definition of predicate Losers is adapted to the algorithm. We prove that all the nodes that execute R Lose were actually counted in the set Losers, and that execution of R NewBit does not bring any new node in the set Losers.

Lemma 5.21

Let cs = γ → γ be a computing step, and let v ∈ V be a node such that

Proof : Let u be one such node. Since u executes RLose during cs, OkNeg γ (u) = true which means that v is the only parent of u such that tokv = •. Thus, we have

Lemma 5.22

Let cs = γ → γ be a computing step, and let v ∈ V be a node such that tok γ v = • and such that v is not activated during cs.

Let u ∈ Players γ (v) be a node that executes R NewBit during cs.

, and then we conclude that Bitu(

Lemma 5.23 proves that the definition of FullRound is adapted to our algorithm. Indeed, we establish that one node v such that tok v = • both before and after a computing step does not see its weight by W Circ increase, unless it makes decrease one higher component of W at the same time.

Lemma 5.23

Let cs = γ → γ be a computing step, and let v ∈ V be a node such that Let us now suppose that Losers γ (v) = Players γ (v), which implies Candidates γ (v) = ∅. Since Players γ (v) ⊆ Candidates γ (v), we have Players γ (v) = ∅, so v cannot execute RmaxPos or RNewPh. Thus, v is not activated during cs (recall that by hypothesis,

, then either u executes RWin or RFakeWin, and then the theorem is established, either not, and then Lemma 5.24 establishes under which conditions we can have an increase of W Circ on one node v. It proves that if this happens, then we fall into the conditions of Theorem 5.4 or of Theorem 5.6. This lemma, which largely uses Lemma 5.23, is the main argument to establish that (W Ch , W Er , W Circ ) is pre-admissible.

Lemma 5.24

Let cs = γ → γ be a computing step, let a be an anchor at γ , and let v ∈ D γ a be a node.

If

• then according to Lemma 5.23 either ¬FullRound γ (v) and thus WCirc(v, γ ) = WCirc(v, γ), either there exists one child u of v that executes RWin, RFakeWin, RReplayUp, or ETrustChild during cs.

• then either v executes ETrustChild, either v executes ROfferUp and then WCirc(v, γ ) = 1 < WCirc(v, γ), either v executes RGive. Let us consider that last case. Remark first that if Candidates γ (v) = ∅ then ¬Give γ (v), and thus v cannot execute RGive during cs. As a consequence, we have Candidates γ (v) = ∅. Then, since

Thus, we necessarily have Players γ (v) = ∅, and actually since v executes RGive during cs, there Players γ (v) = 1. Let u be that node in Players γ (v). If u executes RWin or RFakeWin, we have our result, let us now consider that it does not. Since Losers γ (v) = Players γ (v), u / ∈ Losers γ (v) and thus, according to Lemma 5.21, u does not execute RLose during cs. As a consequence, u either executes RNewBit, either is not activated during cs. In both cases, variables tok, c, and play are not updated on u during cs, and thus u ∈ Players γ (v), so WCirc(v, γ ) = 1 < WCirc(v, γ).

As a consequence, v does not execute RNewPlay during cs. If v executes ETrustChild during cs, then the desired property holds. Let us now suppose that v does not execute any rule during cs. Since tok γ v = , u cannot execute RLose or RNewBit during cs, since it requires that one other parent p of u is such that tok γ p = •, and then ¬OkNeg γ (u). Thus, either u executes RWin or RFakeWin during cs and then our property holds, either it does not, but then it is not activated and thus u ∈ Players γ (v) which means that Theorem 5.7 establishes that (W Ch , W Er , W Circ ) is pre-admissible.

Theorem 5.7

Let cs = γ → γ be a computing step, and let a be an anchor at γ , and suppose that a does not execute R r NewDFS during cs. We have

γ).

Proof : According to Theorem 5. Definitions Let us first define the different sets that contain the children u of v that we are going to count in the different cases described above.

If tok γ v = •, then we want to count children u ∈ C neq γ (v) that might execute R Lose . One node u can execute R Lose only if play γ u = P, so nodes u ∈ C neq γ (v) : play γ u = P must obviously be counted. Yet, we cannot count only those children of v. Indeed, it might happen that one node u ∈ C neq γ (v) : play γ u = W execute R ReplayUp , which produces play γ u = P, and would make W Play increase on v. Although it would at the same time make W Play decrease on one other node w such that play w =↑, since we require that W decrease on each branch of each CD o , we must prevent this from happening. Thus, we must include nodes u ∈ C neq γ (v) :

For the same reason, due to rule R ReWin , we must also include nodes u ∈ C neq γ (v) : play γ u = F in that set. This leads to the following predicate:

This leads to the following predicate:

One node u might updates its variable play u from P to W only if it executes R Win or R FakeWin , cases that have been treated previously. Furthermore, due to predicate StopFaking, no node u that has a parent v ∈ P eq (u) such that tok v =↑ can execute R ReWin , and thus update its variable play u from F to W. This leads to the following predicate:

We can now define W Play (v, γ) depending on the value of tok γ v .

Proofs Lemmas 5.25, 5.26 and 5.27 prove that the definitions of ChLose, ChReplay, and ChEnd are consistent with our algorithm. For ChLose(v) and ChReplay(v) we prove in Lemmas 5.25 and 5.26 that both these sets do not increase unless it is by one node u ∈ C(v) that executes R Win or R FakeWin , which makes decrease one more important quantity. We cannot use the same reasoning for ChEnd(v). Indeed, since we consider one node v such that tok v =↑, W Ch (v) is not affected by any action taken by one child u ∈ C(v). Thus, we prove in Lemmas 5.27 that ChEnd(v) never increases, as long as tok v =↑.

We also establish in these lemmas some particular cases which necessarily decrease W Play .

Lemma 5.25

Let cs = γ → γ be a computing step and let v be a node such that

Proof : For the first part, we prove the equivalent statement, under the same conditions:

Lemma 5.26

Let cs = γ → γ be a computing step and let v be a node such that

Proof : For the first part, we prove the equivalent statement, under the same conditions:

Lemma 5.27

Let cs = γ → γ be a computing step and let v be a node such that tok γ v =↑ and

Proof : For the first part, we prove the equivalent statement:

Suppose now tok γ u = ⊥. Then we have play γ u = W. Remark first that u cannot execute RReturn during cs since tok γ u = ⊥. If play γ u = L then we cannot have play γ u = W, necessary condition to have u ∈ ChEnd γ (v). If play γ u = P, then we have play γ u = W only if u executes RWin or RFakeWin during cs, but if it does, then it switches its colorcu, so Lemma 5.28 combines the results of Lemmas 5.25, 5.26 and 5.27 and proves that W Play can decrease on one node only if the previous components of W decrease on the CD o 's that include that node.

Lemma 5.28

Let cs = γ → γ be a computing step, let a be an anchor at γ that does not execute R r NewDFS during cs, and let v ∈ D γ a be a node.

γ).

Proof : Let us first eliminate the cases in which the decrease of (WCh, WEr, WCirc) is immediate. According to Theorem 5.4 we can assume that, if tok γ v =↑, then ∀u ∈ C(v), u does not execute RWin or RFakeWin. Furthermore, according to Theorems 5.6 and 5.8, we can assume that v does not execute any rule among ETrustChild, RGive, RNewPlay, RDrop, RNego, ROfferUp, RReceive, RReturn, and RReNego during cs.

Furthermore since v ∈ D γ a , it is obvious that tok γ v = ⊥ and thus that v cannot execute RWin or RFakeWin.

As a direct consequence, we have Theorem 5.9 establishes that (W Ch , W Er , W Circ , W Play ) is pre-admissible.

Theorem 5.9

Let cs = γ → γ be a computing step, and let a be an anchor at γ , and suppose that a does not execute R r NewDFS during cs. We have

γ).

Proof : Theorem 5.7 establishes (WCh, WEr, WCirc)(D γ a , γ ) 3 (WCh, WEr, WCirc)(D γ a , γ). Suppose now WPlay(D γ a , γ ) > WPlay(D γ a , γ), and prove (WCh, WEr, WCirc)(D γ a , γ ) ≺ 3 (WCh, WEr, WCirc)(D γ a , γ). In the same way as we did in the proof of Theorem 5.5, we can suppose that for any branch B of Ga, D γ a (B) is not longer than D γ a (B). In such circumstances, we have WPlay(D γ a , γ ) > WPlay(D γ a , γ) only if there exists a branch B of Ga such that ∃v ∈ D γ a (B) : WPlay(v, γ ) > WPlay(v, γ). But then, according to Lemma 5.28, we have (WCh, WEr, WCirc)(D γ a , γ ) ≺ 3 (WCh, WEr, WCirc)(D γ a , γ).

Theorem 5.10 proves that under certain circumstances, we are certain that the weight of one CD o decreases. It will be useful to prove that W is admissible, but also to prove that it is pre-admissible.

Remark that the three predicates Finished, WontReset, and WillReset are mutually exclusive, and that ∀γ ∈ Γ, ∀v ∈ V, Finished γ (v) ∨ WontReset γ (v) ∨ WillReset γ (v). This justifies the use of these three predicates to distinguish cases in any situation.

Let us now define, for each of these three cases, the value of ph which, when reach by ph v , will provoke one execution of R Lose on one child u ∈ Players γ (v).

Finally, we are able to define one first aspect of W Nego , which is the distance between ph γ v and SepVal γ (v), which corresponds to the number of executions of R NewPh required for v. This definition is very simple in both situations Finished γ (v) and WontReset γ (v). It is slightly more difficult when WillReset γ (v) since we must determine how high ph v will reach before it is reset to 1. Two situations might occur.

If, due to an incorrect initialization of variables, all the children u of Players γ (v) produce ⊥ as an answer for ph γ v , then the next execution of R NewPh by v will set ph v to 1 and then ph γ v is the maximal value which will be reached before ph v is reset to 1. Otherwise, there will be at least one execution of R NewPh by v before we reach the maximal value, and thus only the functions Bit u are relevant. In this last case, the maximal value reached before ph v is reset to 1 is the lowest value such that, when reached, all the children u of Players γ (v) produce ⊥ as an answer.

Finally, the definition of SepDist(v) which is the number of executions of R NewPh v has to make before we have

(5.60)

We now formally define the weight of one node v. The goal is to count the number of actions each node, among v and its children in Players γ (v), can take before the execution of R Lose is necessary. Node v will execute two actions for each increase of ph v , since it must execute both R NewPh , and R maxPos for each step. A node u ∈ Players γ (v) executes R Lose when b v = ⊥, which means immediately after one execution of R maxPos , and not of R NewPh . Thus, v executes a sequence of R NewPh ; R maxPos in this order, which might be preceded by one execution of R maxPos if necessary.

One children u ∈ Players γ (v) only executes R NewBit , by hypothesis. Every time it executes R NewBit , u sets ph u at the current value of ph v , which will be updated exactly SepDist γ (v) times. Thus, u executes R NewBit once for each updated value of ph v , and execute one more action if, in the initial configuration, u has to produce an answer for ph v .

We finally define W Nego .

Preliminaries Our overall goal is to prove that W Nego behaves as expected, which is proving that associated with the four previous components, it is pre-admissible, and that in some specific cases, it is a decreasing function. Before we formally establish this, we need to establish some basic, yet numerous, properties which describe how the different predicates and sets we defined above behave during an execution. Indeed, since the definition of W Nego strongly depends on Finished, WontReset, and WillReset, among other things. In this preliminary, we focus on establishing properties of stability for those three predicates, depending on the activation of node v. To achieve this, we first prove some stability properties on other, more basic, predicates, namely AnswerPar, Answer, ForcedReset. Some of those preliminary lemmas will be reused as well in the demonstrations of the next section.

Our goal is to prove that (W Ch , W Er , W Circ , W Play , W Nego ) is pre-admissible. Thus, according to Theorem 5.9, most of the proof will be done under the hypothesis that (W Ch , W Er , W Circ , W Play ) is constant. Actually, this is hypothesis is explicitly used only in the proof of Lemma 5.29, which states that Players(v) and Separators(v) are constant. In all the other lemmas, this hypothesis on (W Ch , W Er , W Circ , W Play ) is actually used through Lemma 5.29: we suppose Players(v) and Separators(v) are constant.

Lemma 5.29

Let cs = γ → γ be a computing step and let v be a node such that Let us now consider one node u / ∈ Players γ (v). If c γ u = c γ v then we can have u ∈ Players γ (v) only if c γ u = c γ v which is possible only if u executes RWin or RFakeWin but then according to Lemma 5.16, we have WCh(v, γ ) < WCh(v, γ) which cannot happen by hypothesis. Otherwise, if tok γ u = ⊥ then we can have u ∈ Players γ (v) only if tok γ u = ⊥, which is possible only if u executes RReturn, but then the execution of Drop(u) implies that play γ u = F and thus u / ∈ Players γ (v). Finally, if c γ u = c γ v and tok γ u = ⊥, then play γ u = P. We can have u ∈ Players γ (v) only if play γ u = P, which is possible only if u executes RReplayD or RReplayUp. Due to its parent v, u cannot execute RReplayD, and if it executes RReplayD, then according to Lemma 5.16, we have WCh(v, γ ) < WCh(v, γ) which cannot happen by hypothesis. As a consequence, in any case, u / ∈ Players γ (v). We just established that u ∈ Players γ (v) ⇐⇒ u ∈ Players γ (v), which means that Players γ (v) = Players γ (v). Since Separators γ (v) only depends on Players γ (v), we can conclude that Separators γ (v) = Separators γ (v) as well.

From now on, since all the following lemmas of this section are under, at least, the hypothesis of Lemma 5.29, we allow ourselves to simply write Players(v) and Separators(v) without referring to the configuration in which the set is evaluated. Lemma 5.30 proves that, unless node v asks for one new information, which concerns one new value for ph, then the value which will be taken as an answer for the negotiation does not evolve. It partly justifies the definition of Answer.

Lemma 5.30

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

Proof : Let us consider u ∈ Players(v). If u is activated, then according to Theorems 5. 4 and 5.10, u executes RNewBit. Therefore, OkNeg γ (u) so v is the only parent of u with tokv / ∈ {⊥, ↑, ↓}, and, on the other hand, AnswerPar γ (u, v). Therefore, by definition of the action

Suppose now that u is not activated during cs. If v is not activated either, then we obviously have Answer γ (u, v) = Answer γ (u, v). Let us rather suppose that v executes RmaxPos during cs.

According to Lemma 5.20, we have ¬AnswerPar γ (u, v), so Answer γ (u, v) = b γ u , and since u is not activated during cs we even have b γ u = b γ u . By definition, we have Synch γ (v) so

Lemma 5.32 proves that once the predicate Finished evaluates to true, then it does in all the following configurations too. In order to prove it, we first establish Lemma 5.31 which proves that when we have Finished γ (v), node v cannot execute R NewPh , which justifies the name of this predicate. Lemma 5.32 is the first fundamental lemma which will be helpful in the next section.

Lemma 5.31

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

.

Proof : Suppose that Finished γ (v) ∧ Synch γ (v) and prove that ¬PhComplete γ (v). Whether we have TwoDiffer γ (v) or OneDiffers γ (v), there exists u ∈ Players(v) :

If AnswerPar γ (u, v) then according to Lemma 5.20, ¬PhComplete γ (v). Otherwise, ¬AnswerPar γ (u, v) and then b γ u = b γ v and once again, ¬PhComplete γ (v).

Lemma 5.32

Let cs = γ → γ be a computing step and let v be a node such that Since Finished = TwoDiffer ∨ OneDiffers, we deduce Finished γ (v) ⇒ Finished γ (v).

The two following lemmas prove that, when v does not execute R NewPh , then the predicates ForcedReset and Finished remain constant. Lemma 5.33 proves that, as long as v does not update ph v , then whether the next execution of R NewPh will reset ph v = 1 or not, ForcedReset(v) keeps the same boolean value. It, partly, justifies the definition of ForcedReset.

Lemma 5.33

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

Proof : Since ForcedReset only depends on Answer, this is a direct consequence of Lemma 5.30

Lemma 5.34 establishes that, as long as v does not update ph v , then whether we have reached the final value for ph v or not, Finished(v) keeps the same boolean value. In a certain sense, it specifies Lemma 5.32.

Lemma 5.34

Let cs = γ → γ be a computing step and let v be a node such that

The four following lemmas give information on how an execution of R NewPh might alter some of the predicates we consider here, or establish relations between them. Lemma 5.35 proves that one node v which executes R NewPh resets ph v = 1 if and only if it was actually detected by ForcedReset before its action.

Lemma 5.35

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and

Proof : According to Lemma 5.20, ∀u ∈ Players(v), ¬AnswerPar γ (u, v). Consequently, ∀u ∈ Players(v), Answer γ (u, v) = b γ u . Thus, ForcedReset γ (v) ≡ ∀u ∈ Players(v), b γ u = ⊥, which is exactly the condition which decides whether ph v is set to 1 by PhasePlus(v).

Lemma 5.36 states that if node v verifies WontReset, then it will not reset ph v = 1, as we expect.

Lemma 5.36

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that Lemma 5.37 states that if v executes R NewPh , i.e. if it asks for one new information to its children, then all of them will have to produce a new answer, so after this we can trust the values of Bit u in the negotiation process. Associated to Lemma 5.30 it fully justifies the definition of Answer.

Lemma 5.37

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

If v executes R NewPh during cs then ∀u ∈ Players(v), AnswerPar γ (u, v).

Proof : Let us consider one node u ∈ Players(v). According to Lemma 5.20, u is not activated during cs. Furthermore, since v executes RNewPh, we deduce

Since we also have b γ u = ⊥, we conclude AnswerPar γ (u, v). Lemma 5.38 states that if one node v executes R NewPh , then we have reached the value on which the negotiation is finished if and only if this value belongs to the set Separators(v). Associated with Lemmas 5.31 and 5.34 it fully specifies the situations where a computing step leads to a configuration which satisfies Finished.

Lemma 5.38

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

Furthermore, according to Lemma 5.37, ∀u ∈ Players(v), AnswerPar γ (v). Consequently, ∀u ∈ Players(v), Answer γ (u, v) = Bitu(ph γ v ). Since ¬OneDiffers γ (v), we obtain:

The two following lemmas, the last of this section, and establish how situations where ¬Finished(v) can evolve. Lemma 5.39 states that if we are in a configuration such that we will reach the terminal value for ph v without resetting ph v = 1, then it remains true. Associated with Lemmas 5.34 and 5.38, it fully describes what configuration is reached after a computing step which starts with WontReset(v).

Lemma 5.39

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

Proof : Recall that WontReset γ (v) implies ∃i > ph γ v : i ∈ Separators(v) and ¬ForcedReset γ (v). Suppose first that v does not execute RNewPh during cs. According to Lemma 5.33, we have ¬ForcedReset γ (v). Since Let us now suppose that ph γ v / ∈ Separators(v). By definition of WontReset γ (v), we have ∃i > ph γ v : i ∈ Separators(v). Since ph γ v = ph γ v + 1 / ∈ Separators(v), we deduce ∃i > ph γ v : i ∈ Separators(v). We now finish the proof by establishing ¬ForcedReset γ (v). Since ∃i > ph γ v : i ∈ Separators(v), we deduce ∃u1, u2 ∈ Players(v) : Bitu 1 (i) = Bitu 2 (i). At least one of them, let us say u, is such that Bitu(i) = ⊥. By definition of Bitu, since ph γ v < i, Bitu(ph γ v ) = ⊥, and by Lemma 5.37, we deduce Answer γ (u, v) = ⊥. Thus, ¬ForcedReset γ (v), and finally WontReset γ (v) ∨ Finished γ (v).

Lemma 5.40 states that if we are in a configuration such that we need to reset ph v = 1 before reaching the terminal value for ph v , then this remains true after a computing step, unless we do reset ph v = 1 during this computing step. Associated with Lemmas 5.35 and 5.38, it fully describes what configuration is reached after a computing step which starts with WillReset(v).

Lemma 5.40

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

If v does not execute RNewPh during cs then according to Lemma 5.34, ¬Finished γ (v), and according to Lemma 5.33, ForcedReset γ (v) ⇐⇒ ForcedReset γ (v). Finally, since

Suppose now that v executes RNewPh during cs. According to Lemma 5.37 ∀u ∈ Players(v), AnswerPar γ (u, v) which implies ∀u ∈ Players(u, v), Answer γ (u, v) = Bitu(ph γ v ). Let us first prove that if ph γ v = 1 then WillReset γ (v). Remark that ¬ForcedReset γ (v). Indeed, according to Lemma 5.20 we have ∀u ∈ Players(v), ¬AnswerPar γ (u, v), and thus if ForcedReset γ (v) then ∀u ∈ Players(v), b γ u = ⊥ and thus the execution of PhasePlus(v)

Let us now prove that ¬ForcedReset γ (v) to finish the proof. Since v executes RNewPh during cs, ForcedReset γ (v) ⇐⇒ ∀u ∈ Players(v), Bitu(1) = ⊥, which cannot be by hypothesis on the identifiers. Thus, ∃i

Proofs In this section, we finally address the function W Nego , the lemmas established in the previous section are going to be extremely useful.

One first step is to establish that what we defined as the last value for ph v during the negotiation phase, SepVal(v), is consistent through an execution. We prove in Lemma 5.42 that this value remains constant. Let us first prove Lemma 5.41 which states that unless we reset ph v = 1, then the maximum value for ph v which we will reach before the reset remains constant as well.

Lemma 5.41

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

Proof : If v does not execute RNewPh during cs then ph γ v = ph γ v , and according to Lemma 5.33 ForcedReset γ (v) ⇐⇒ ForcedReset γ (v), and thus MaxPh γ (v) = MaxPh γ (v).

Suppose now that v executes RNewPh during cs. By hypothesis, ph v is not reset to 1 during cs, so ph γ v = ph γ v + 1, and according to Lemma 5.35 we also have ¬ForcedReset γ (v). Thus, we deduce

On the other hand, since v executes RNewPh during cs, we know by Lemma 5.37 that ∀u ∈

Lemma 5.42

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and

Proof : Let us distinguish three cases:

• If Finished γ (v), then according to Lemma 5.31, v does not execute RNewPh during cs, and thus ph γ v = ph γ v . Furthermore, according to Corollary 5.32, Finished γ (v). Thus, we have SepVal

-If ph γ v / ∈ Separators(v) then according to Lemmas 5.39 and 5.38 ∈ Separators(v), then ¬Finished γ (v), so WontReset γ (v). We have

and thus SepVal γ (v) = SepVal γ (v) Let us now suppose that v does not execute RNewPh, or that, if it does, then it does not set ph v = 1. According to Lemma 5.40, WillReset γ (v), and we deduce SepVal

From now on, for all the lemmas of this section which are stated under, at least, the hypotheses of Lemma 5.42, which by the way are the same as the hypothesis of Lemma 5.29, we allow ourselves to simply write SepVal(v) without referring to the configuration in which this function is evaluated. This being established, we are going to follow the different components of W Nego introduced for its definition: SepDist, ParSteps, ChSteps, and finished W Nego itself. For each of those four functions, we prove that it corresponds to a non-increasing function, and for each of them we present the cases where we can guarantee its decrease.

Lemma 5.43

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and

Proof : Let us consider three cases.

• If Finished γ (v) then according to Corollary 5.32, Finished γ (v) and thus

Otherwise, according to Lemma 5.39 WontReset γ (v). Furthermore, according to Lemma 5.36,

during cs, then according to Lemma 5.40 WillReset γ (v), and according to Lemma 5.41 MaxPh γ (v) = MaxPh γ (v). Furthermore, by hypothesis

Otherwise, if v executes RNewPh during cs, and sets ph γ v = ph γ v + 1, then according to Lemma 5.40 ¬WillReset γ (v), and thus we deduce

Lemma 5.44

Let cs = γ → γ be a computing step and let v be a node such that

Proof : Let us consider three cases.

• If Finished γ (v) then according to Lemma 5.31, v does not execute RNewPh during cs.

Indeed, since WontReset γ (v), we have SepVal(v) > ph γ v , and so SepDist γ (v) > 0. Let us now suppose that ¬Finished γ (v). According to Lemma 5.39 WontReset γ (v). Furthermore, according to Lemma 5.36, ph γ v > ph γ v , and thus

On the other hand, whether

Lemma 5.45

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

Then ParSteps γ (v) ≤ ParSteps γ (v), and if v executes R maxPos or R NewPh during cs, then ParSteps γ (v) < ParSteps γ (v).

Proof : Remark first that if v is not activated during cs, then according to Lemma 5.43

SepDist γ (v) ≤ SepDist γ (v). On the other hand, b γ v = b γ v , so ParSteps γ (v) ≤ ParSteps γ (v). If v executes RNewPh during cs then according to Lemma 5.44,

By transitivity, we deduce ParSteps γ (v) < ParSteps γ (v).

Finally, if v executes RmaxPos during cs, then according to Lemma 5.43

Lemma 5.46

Let cs = γ → γ be a computing step and let v be a node such that tok γ v = • and tok γ v = •, and suppose that

If v executes RNewPh during cs then according to Lemma 5.44, SepDist γ (v) < SepDist γ (v), and thus ChSteps γ (u, v) ≤ ChSteps γ (u, v).

If v executes RmaxPos during cs then no children of v is activated during cs according to Lemma 5.20, and thus, Synch γ (v). Consequently,

Now suppose that u executes RNewBit during cs. According to Lemma 5.20, v is not activated during cs. Furthermore, we have, by definition, AnswerPar γ (u, v). The execution of Announce(u)

Lemma 5.47

Let cs = γ → γ be a computing step and let v be a node such that

Proof : This is a direct consequence of Lemmas 5.45 and 5.46.

Theorem 5.11 establishes that (W Ch , W Er , W Circ , W Play , W Nego ) is pre-admissible.

Theorem 5.11

Let cs = γ → γ be a computing step and let a be an anchor at γ such that a does not execute R r NewDFS during cs.

Proof : Let us reason by contradiction and suppose that ∃v ∈ D γ t r ∩ Da. Remark first that since v ∈ Da and a = r, we have v = r.

Since v ∈ D γ t r , there exists

According to Theorem 5.17, there exists t ≥ t such that r executes R r NewDFS during γ t → γ t +1 . By definition, at γ t , only r is a branch of D γ t r , and in particular, B is not. Let us consider t0 the smallest value greater than t such that B is a branch of D γ t 0 r and B is not a branch of D γ t 0 +1 r . According to Lemma 5.10, we deduce that v executes RReturn during γt 0 → γt 0 +1.

By definition, we deduce that v activates Da during γt 0 → γt 0 +1, which is contradictory.

Definition 5.26 (branch-CD

Lemma 5.51

Let D γ a be a clean branch-CD o , and let us label its vertices

Proof : This is a direct consequence of the definition of predicate Er, since nodes are not in error and form a branch in G.

Lemma 5.52

Let = γ 0 → γ 1 → • • • be an execution such that r execute R r NewDFS during γ 0 → γ 1 . Then ∀t, D γt r is a clean branch-CD o .

Proof : We reason by induction. The base case is true since r executes R r NewDFS in γ0 → γ1, thus tok γ 0 r =↑ and thus D γ 0 r = {r}, which is a clean branch-CD o . Let us also prove that D γ 1 r is a clean branch-CD o . We have tok γ 1 r = . Let us prove by contradiction that D γ 1 r = {r}, and suppose r has one child u with tok γ 1 u = ⊥. Since u / ∈ D γ 0 r , u is not activated during γ0 → γ1, and thus tok γ 0 u = ⊥. According to Lemma 5.8, ∃a ∈ A * : u ∈ Da. As a consequence, u ∈ Da ∩ D γ 1 r which cannot be according to Lemma 5.50, and therefore D γ 1 r is a clean branch-CD o .

Let us now suppose that the property holds at γt, and prove it at γt+1. Remark first that if no node u joins Dr by executing RWin, then the guards of the rules that update tok guarantee that no error can be generated. is a branch-CD o . Furthermore, no node reaches Players γ (v k ) since RReplayUp implies an activation of another CD o , and RReplayD is not enabled due to ¬ReplayL. Therefore,

, tokv i =↓, and are not enabled, neither is v k . Furthermore, Players γ (v k-1 ) = ∅ and no node reaches Players γ (v k-1 ) for the same reason as previously. Therefore, D

Corollary 5.2

Let = γ 0 → γ 1 → • • • be an execution such that r execute R r NewDFS during γ 0 → γ 1 . Then no node executes R FakeWin during .

Proof : Let us consider cs = γ → γ one computing step of , and let us consider one node v such that tok γ v = ⊥ and play γ v = P. Suppose first that ∀p ∈ P(v) such that tok γ p / ∈ {⊥, ↑} we have p ∈ D γ r . According to Lemmas 5.52 and 5.51, there exists at most 2 parents of v such that tok γ p =↓, and if there are 2 then we have tokp 1 = and tokp 2 = . In any case, we have OkNeg γ (v) and thus v does not execute RFakeWin during cs.

Let us now suppose that ∃p ∈ P(v) such that tok γ p / ∈ {⊥, ↑} and p / ∈ D γ r . Since tokp = ⊥, according to Lemma 5.8 there exists a ∈ A * such that p ∈ Da. But then, since v ∈ B(Da), v does not execute RFakeWin since it would activate Da.

From now on, we suppose that the executions start after at least one R r NewDFS and thus we suppose that no node executes R FakeWin during the executions. We presented in Definition 5.13 and in Theorem 5.1 the notion of circulation rounds for the root. Hence, for the sake of the proof, we also introduce the notion of circulation round on nodes that are not the root. This will allow us to consider circulation round on any node v ∈ V , root or not. Namely, this corresponds to the part of a circulation round in which one particular node holds the token, or in which the token is in one of its descendants.

Definition 5.27 (Circulation Round for

We say that v = r executes a circulation round during if v executes R Win and R Return , exactly once during , in that order.

We call circulation round of v during , and denote rt (v, ) the subexecution of : γ i+1 → • • • → γ j where γ i → γ i+1 (resp. γ j → γ j+1 ) is the computing step of where r executes R Win (resp. R Return ).

Lemma 5.53

Proof : Let us prove the three items separately. 1. If v = r then v updates cv only with the action of R r NewDFS , and it does not execute R r NewDFS during by definition.

If v = r then v updates cv only with the action of RFakeWin, which is not executed according to Corollary 5.2, or with the action of RWin, which is not executed by v during by definition.

2. Since v executes a circulation round, it is activated and thus belongs to Dr. According to Lemma 5.52, ¬Er γ 0 (v). Furthermore, by definition of circulation round, we have tok γ 0 v ∈ {•, }. Thus, ∀u ∈ C(v), tok γ 0 u = ⊥. 3. By definition of a circulation round, v executes R r NewDFS or RReturn during γ k → γ k+1 and thus tok

In the following lemma, we establish that if one node v executes a circulation round, then its playing children also execute a circulation round. This will allow us in the latter to reason by induction.

Lemma 5.54

Let us consider one node v ∈ V , and let = γ 0 → γ 1 → • • • → γ k be a circulation round of v. Then ∀u ∈ Candidates γ0 (v), u executes a circulation round during .

Proof : Let us consider u ∈ Candidates γ 0 (v). According to Lemma 5.53, ∀i ∈ [0, k],

53 also assures that tok γ 0 u = ⊥ which implies that, during , u cannot execute RReturn before it executes RWin. Let us first prove that u executes RWin during .

Whether v = r or v = r has no incidence on the fact that, necessarily, v executes ROfferUp during . Otherwise, we would have tok Consequently, u executes one circulation round during .

We now introduce the notion of Free DODAG. This notion is defined only on reset points, i.e. configuration immediately subsequent to an execution of R r NewDFS (see Definition 5.13). A Free DODAG corresponds to all the nodes which can reach the root by a path in G, such that no node of this path has any parent in one other CD o . It corresponds to nodes which have the possibility to receive the token sent from the root by executing R Win (we do not take into account the color of the nodes on this path in this definition).

Definition 5.28 (Free DODAG)

Let γ be a reset point of an execution . We call free DODAG in γ, and denote FD o (γ), the smallest set that contains r and such that ∀w = r:

Let γ 1 and γ 2 be two reset points of an execution. We have FD o (γ 1 ) = FD o (γ 2 ).

Proof : The set of nodes v such that tok γ 1 v = ⊥ is the union of D γ 1 r = {r} and of all CD o 's D γ 1 a , a ∈ A(γ 1 ). By hypothesis, the CD o 's anchored to a node of A are not activated during the execution, and thus the set of nodes v such that tokv = ⊥ is the same in γ 1 as in γ 2 . As a consequence, FD o (γ 1 ) = FD o (γ 2 ).

FD o corresponds to all the nodes that may receive the token from the root, without considering variables c and play. In order to gain in precision, we define the set of all nodes which will actually receive the token during the starting circulation round.

Definition 5.29 (Reachable area from r)

Let γ be a reset point. We define the reachable area from r at γ, and denote Reach r (γ):

We prove in the following Lemma that nodes in the Reachable area actually receive the token, and execute exactly one circulation round during the circulation round of the root.

This is possible only if, before γi v executes RWin. According to Lemma 5.53, tok γ i v = ⊥. Thus v executes at least one circulation round during .

Furthermore, v cannot execute several circulation round during , since v cannot activate any other CD o than D γ r , and after its first circulation round it has the same color as the root, and thus the same color as any node of the branch-CD o .

The token does not only circulate through the reachable area of r indefinitely, it also makes its reachable area increase at each circulation round. Indeed, suppose one node v has the token, and has one child u with the same color as v. Then u is already seen as visited, which means that it won't receive the token, as being out of the reachable area. Yet, when sending the token upwards to its parent, v forces u to reset play u to P, which means that in the next circulation round, when the color of the token has switched, u will be able to receive the token. Note that this only works if u ∈ FD o (γ), otherwise u has other parents, and therefore updates play u to F. Also note that if one child u does not receive the token for its variable play is already set to W or F, but had the appropriate color to receive it, then u will have to wait two circulation rounds before it actually receives the token. To embrace this behavior, we define the expansion areas of r, which constitutes all nodes in FD o (γ) which have a parent in Reach r (γ) without being in Reach r (γ) themselves.

Definition 5.30 (Expansion areas of r)

Let γ be a reset point. We define the expansion area of order 1 and of order 2 of r at γ, and denote Exp 1 r (γ) and Exp 2 r (γ):

The following Lemma proves that the three sets defined above are jointly increasing, as intended. This will allow us to prove that at some point, the reachable area contains the entire FD o .

Lemma 5.57

Let γ 1 and γ 2 be two consecutive reset points of an execution, and let = γ 0 → • • • → γ k be the circulation round of r between γ 1 and γ 2 .

Proof :

1. Remark that r ∈ Reachr(γ 2 ) by definition. Let us consider one node u ∈ Reachr(γ 1 ), u = r, and prove that play γ 2 u ∈ {P, L} ∧ c γ 2 u = c γ 2 r . According to Lemma 5.56, u executes one circulation round during . After , u cannot execute RWin after, at least, tokr = which occurs after γ 2 . Thus, in γ 2 , u still has the color it took when reaching Dr during Thus,

By definition of Reachr, ∃v ∈ P(u) such that v ∈ Reachr(γ 1 ). According to Lemma 5.56, v executes a circulation round during , and thus v executes ROfferUp during . Let us consider csi = γi → γi+1 the last computing step of such that one parent v of u executes ROfferUp. At γi, u terminated its circulation round. Indeed, if at γi, u has not begun its circulation round, then c γ i u = c γ i v and play γ i u ∈ {P, L} which would prevent v to execute ROfferUp. Furthermore, since ¬Er γ (v), we have tok γ i u = ⊥ so u terminated its circulation round at γi. Consequently, we have c γ i u = c γ i r and since ¬WaitSib γ i (v), we also have play γ i u = F. Furthermore, according to Lemma 5.50, we know that u has no parent such that tok γ i p / ∈ {⊥, ↑} apart from D γ i r , which implies that u has only one parent such that tok γ i p / ∈ {⊥, ↑}, which is v. Consequently, since v is the last parent of u that executes a circulation round, then from γi+1 to the end of , all the parents of u are such that tok γ p ∈ {⊥, ↑}. Thus, during that part of the execution, we have constantly ¬FakeReplay(u), and thus for that entire part of the execution, play u = F. Let us now consider γj the last configuration that is part of the circulation round of v. According to Lemma 5.53 we have MayDropUp γ j (v), so play γ j u = W and thus play γ j u ∈ {P, L}. Since v does not execute RWin nor RFakeWin after its first circulation round of , we deduce play γ 2 u ∈ {P, L} Since this is true for all the nodes of Reachr(γ 1 ), we can conclude Reachr(γ 1 ) ⊆ Reachr(γ 2 ) 2. Let us consider one node u ∈ Exp 1 r (γ 1 ). By definition of Exp 1 r , there exists p ∈ P(v) : p ∈ Reachr(γ 1 ). According to what we established above, p ∈ Reachr(γ 2 ), so we only have to prove that c γ 2 u = c γ 2 r ∧ play γ 2 u ∈ {P, L} to establish that u ∈ Reachr(γ 2 ). By definition, we have c γ 0 u = c γ 0 r . Since r does not update cr during , and since Dr is a branch-CD o along , then until u executes RWin, it has the same color as all the nodes of D γ r during . Since, on the other hand, u cannot activate any other CD o , we deduce that u actually does not execute RWin during , neither during γ k → γ 2 for the same reason. Consequently, we have c γ 2 u = c γ 2 r . Now, the proof we made for the previous case totally applies: we can select the last computing step such that one parent p of u executes ROfferUp, at that moment we have cu = cp, thus we can infer from WaitSib(v) that play u = F and from the nonactivation of other CD o 's that this remains true until at least γ 2 . FInally, we can reason about MayDropUp as well to establish that play γ 2 u ∈ {P, L} which terminates the proof.

3. Let us consider one node u ∈ Exp 2 r (γ 1 ). By definition of Exp 2 r , there exists p ∈ P(v) : p ∈ Reachr(γ 1 ). According to what we established above, p ∈ Reachr(γ 2 ), so we only have to prove that c γ 2 u = c γ 2 r to establish that u ∈ Reachr(γ 2 ). By definition, we have c γ 0 u = c γ 0 r ∧ play γ 0 u ∈ {W, F}. Thus, u cannot execute RWin before it executes RReplayUp. Since u does not activate any other CD o than Dr, u executes RReplayUp only if it has one parent p ∈ Dr such that tokp =↑ and cp = cv. But this cannot happen in before u executes RWin, since according to Lemma 5.52, all the nodes of Dr have the same color c γ 0 r , which is the opposite that cu until it executes RWin. We just found a loop of dependencies. We prove that u cannot update cu before at least γ 2 , and thus u ∈ Exp 1 (γ 2 ).

The two following lemmas prove that the sets of reachable and expansion areas of r allow a permanent growth of Reach, which stops only when Reach includes all the nodes of FD o .

Lemma 5.58

Let γ be a reset point of an execution. This node has a parent in FD o (γ) ∩ Reachr(γ) (otherwise it would not be minimal in depth). Thus, u belongs to Exp 1 r (γ) ∪ Exp 2 r (γ).

Lemma 5.59

There exists a reset point γ f such that Reach r (γ f ) = FD o (γ f ).

Proof : Let us consider γ1, γ2, • • • an infinite sequence of reset points. According to Lemma 5.58, we know that if Reachr(γi) = FD o (γi) then Exp 1 r (γi) ∪ Exp 2 r (γi) = ∅. But then, according to Lemma 5.57, we deduce that Reachr(γi) Reachr(γi+1) or Exp 1 r (γi) Exp 1 r (γi+1). If we now suppose that ∀i, Reachr(γi) = FD o (γi), then we build an infinite sequence of growing sets of nodes, which cannot happen. By contradiction, we conclude.

Since we can now apply the properties of Reach, and especially Lemma 5.56 to FD o , we can conclude that at some point, FD o = G. Let us now consider one parent p of v. According to Lemma 5.59, we have p ∈ Reach γ f r , and according to Lemma 5.56, p executes a circulation round after γ f . But thus, according to Lemma 5.53 when p starts its circulation round we have tokv = ⊥ which is contradictory.

Corollary 5.3

Reach r (γ f ) = G.

Theorem 5.19

Our algorithm is a fair self-stabilizing token circulation algorithm.

Proof : We already proved in Theorem 5.17 that our algorithm satisfies Condition 2 of Specification 5.1. Let us consider one execution = γ0 → • • • , and more precisely the subexecution

Remark that having FD o (γ f ) = G implies that all nodes v but the root are such that tok γ f v = ⊥. Therefore, A * (γ f ) = ∅, and by Lemma 5.9, this is true in all configurations of f . In particular, in any configuration of f , the set of nodes with tokv = ⊥ corresponds to the clean branch-CD o D γ r , and by construction, we have UT C (γ). This proves that our algorithm satisfies Condition 1 of Specification 5.1.

Furthermore, let us consider one circulation round of f which starts at γ 1 , and let us denote γ 2 the reset point consecutive to γ 1 . According to Lemma 5.56, all nodes of Reachr(γ 1 ) = G execute exactly one circulation round during that circulation round. Since ∀v ∈ G \ {r}, tok γ 1 v = tok γ 2 v = ⊥, this means that there is exactly one computing step in which v executes RWin, and thus there exists a finite, continuous, subexecution of this round in which R(v). Therefore, this circulation round is fair.

Space Optimality of our Algorithm

In this section, we prove that our algorithm is asymptotically optimal in terms of memory for the token circulation problem. Our algorithm has a space complexity S(A) ∼ log log n bits per node. Thus, we are going to prove that there does not exist any deterministic algorithm solving T C in S PU using o(log log n) bits per node. We prove this lower bound under less challenging hypotheses than those under which our algorithm works. Namely, our algorithm is self-stabilizing, it works under the unfair distributed scheduler and in any DODAG. Our lower bound is established for general distributed algorithms (without any stabilization requirements), under simpler schedulers (the synchronous scheduler and the central strongly fair scheduler), and in a very simple class of D o : the bi-branch D o . We basically use Theorem 3.2 established in Chapter 3 which introduces the equivalence between executions of small-memory algorithms in identified networks, and in anonymous networks. Specification 5.1 of T C relies on two local predicates, T and R. Similarly to how