Last but not least, I could not have completed this thesis without the help of all my family. To Ettan, thanks for helping me find discipline when I needed it the most. To my parents, Acha, thank you for motivating me and inspiring me

Titre : Vérification formelle des automates communicants Mots clés : systèmes distribués, vérification formelle, automates, systèmes infinis, logic Résumé :Les systèmes distribués concernent des processus qui s'exécutent indépendamment et communiquent de manière asynchrone. Bien qu'ils couvrent un large éventail de cas d'utilisation et soient donc omniprésents dans notre monde, il est particulièrement difficile de garantir leur exactitude. Dans cette thèse, nous modélisons de tels systèmes en utilisant une formulation mathématique et logique, et nousles vérifions algorithmiquement. En particulier, nous nous concentrons sur les automates FIFO (First In First Out), et plus précisément sur des systèmes à un ou plusieurs automates finis qui communiquent via des canaux FIFO fiables pouvant contenir des mots de longueur arbitrairement grande. Comme la plupart des problèmes de vérification sont connus pour être indécidables pour les automates FIFO, nous nous concentrons sur diverses sous-classes et approximations du modèle.

Le premier modèle que nous considérons est celui des systèmes de transition bien structurés sur les branches d'états accessibles (branch-WSTS), une classe qui inclut strictement la classe des WSTS. Nous étudions les problèmes de finitude des canaux et de terminaison pour de tels systèmes, et nous en montrons quelques exemples. Nous définissons également une autre classe de systèmes où la condition de monotonie est relâchée et nous montrons qu'une variante du problème de couerture est décidable sous des conditions naturelles d'effectivité.

Nous étudions ensuite la restriction de la limitation de l'entrée (input-boundedness) sur les canaux FIFO et nous montrons que l'accessibilité rationnelle et diverses autres propriétés sont décidables pour les automates FIFO. Ce faisant, nous répondons à une question ouverte concernant l'accessibilité des automates FIFO limités en entrée. Nous dérivons également certaines bornes de complexité en considérant le cas le plus simple, un automate FIFO avec un seul canal.

Une autre restriction que nous étudions est la synchronisabilité dans les systèmes communicants. En particulier, nous étudions cette notion pour les MSCs (Message Sequence Charts), qui est un modèle pour représenter les exécutions d'un système communicant. Nous montrons que si un ensemble quelconque de MSC satisfait les deux propriétés suivantes, à savoir la définissabilité MSO (Monadic Second-order Logic) et la (spécial) largeur d'arbre (tree-width) bornée, alors la synchronisabilité est décidable. De plus, l'accessibilité et le model checking sont également décidables dans ce cadre. Nous unifions alors certaines classes de la littérature à l'aide de ce cadre, et pour certaines autres classes, nous montrons leur indécidabilité.

Title : Formal Verification of Communicating Automata Keywords : distributed systems, formal verification, infinite-state systems, automata, logic Abstract : Distributed systems involve processes that run independently and communicate asynchronously. While they capture a wide range of use cases and are hence, ubiquitous in our world, it is also particularly difficult to ensure their correctness. In this thesis, we model such systems using mathematical and logical formulation, and try to verify them algorithmically. In particular, we focus on FIFO (First-In First-Out) machines, with one or more finite-state machines communicating via unbounded reliable FIFO buffers.

As most verification problems are known to be undecidable for FIFO machines, we focus on various subclasses and approximations of the model. The first model we consider is branch-wellstructured transition systems (branch-WSTS), a class which strictly includes the well-known class of WSTS. We study the problems of boundedness and termination for such systems, and demonstrate some examples of them. We also define another class of systems where the monotony condition is relaxed and show that a variant of the coverability problem is decidable under effectivity conditions.

We then study the restriction of inputboundedness on FIFO machines, and show that rational reachability and various other properties are decidable for FIFO machines under the inputbounded restriction. In doing so, we answer a longstanding open question regarding the reachability of input-bounded FIFO machines. We also derive some complexity bounds by considering the simplest case, a FIFO machine with a single channel.

Another restriction that we study is synchronizability in communicating systems. In particular, we explore this notion for MSCs (Message Sequence Charts), which is a model to represent executions of a communicating system. We show that if any set of MSCs can satisfy two properties, namely MSO (Monadic Second-order Logic) definability and bounded (special-)tree width, then synchronizability is decidable. Moreover, reachability and model checking are also decidable within this framework. We also unify some classes from the literature using this framework, and for some other classes, show their undecidability.

First and foremost, I thank my advisors, Benedikt Bollig and Alain Finkel. Benedikt, thank you for your patience, encouragement, and all the help with the various drafts along the way. I would consider it an immense blessing if I go on to become half as good a researcher as you. Alain, thank you for your honesty, support, and feedback -I have learned a lot about clarity, precision and perfection from you. This thesis could not happen without the support of both of you. I would like to thank Ahmed Bouajjani and Rupak Majumdar for taking the time to review this thesis, and for their feedback. I extend my gratitude to all the members of the jury, including Mihaela Sighireanu, Thierry Jéron, and Nobuko Yoshida. The thought-provoking questions during the defense have paved the way for the direction of my future research. I thank my co-authors, Cinzia Di Giusto, Etienne Lozes, and Laetitia Laversa, for the collaboration, and the many interesting discussions that followed it. Much gratitude is also owed to Krishna S for a very pleasant stay at IIT Bombay, and very insightful and inspiring discussions. I hope we continue to collaborate in the future.

I was fortunate to spend the duration of my thesis at LMF, a great environment with the most supportive colleagues one could ask for. I would especially like to thank my o ce-mates and colleagues Igor, Olivier, Fabricio, Anirban, and Gayathri for all the banter, and the support when I needed it. I also want to thank the regulars at the LMF café -Dietmar, Phillippe, Matthias, Stéphane, for the crosswords and chats. For all the administrative e↵orts for the various conferences and travels, thank you to Marie-France, Eugenie and Imane. Thank you, Patricia, for ensuring the spirit of the lab is always high. And I would also like to thank my teachers, Nutan Limaye, Akshay S, Paul Gastin, Philippe Schnoebelen, Stefan Schwoon, and Sylvain Schmitz, among many others, for inspiring me to pursue this thesis. I would also like to thank my friends -Moira, Sakshi, Harsha, Marie-Claude, Bernard, Ravi, Abhishek, Akshay, Tanmay, Advait, and Kriti -for all the pep talks along the way. Your presence, especially during the pandemic, helped me more than I can express.

Synthèse

Ces dernières années, en raison des progrès technologiques, les systèmes sont devenus de plus en plus complexes. Cela conduit à la question naturelle de déterminer si un système donné est correct. La vérification formelle est l'un des outils utilisés pour vérifier si un système fonctionne selon les propriétés souhaitées. Il s'agit de vérifier si un modèle d'un tel système satisfait certaines spécifications mathématiques.

Dans le cadre de cette thèse, nous modélisons les systèmes en utilisant une formulation mathématique et logique, et essayons de les vérifier algorithmiquement. En particulier, nous nous concentrons sur les automates FIFO (First-In First-Out), qui sont des machines à états finis communiquant via des canaux FIFO fiables pouvant contenir des mots de longueur arbitrairement grande. Comme la plupart des problèmes de vérification sont connus pour être indécidables pour les automates FIFO, nous nous concentrons sur diverses sous-classes et approximations de ce modèle.

Nous proposons et étudions une généralisation des systèmes de transition bien structurés (WSTS) tout en conservant la décidabilité de finitude des états accessibles et de terminaison. Dans notre classe des branch-WSTS, nous généralisons la définition de beau-quasi-ordre (wqo) pour qu'elle soit applicable seulement sur les branches d'états accessibles à partir de l'état initial. De plus, nous généralisons également la condition de monotonie de la même manière. Bien que les branch-WSTS conservent la décidabilité de la terminaison et de la finitude des états accessibles, il apparaît que le problème de couverture est indécidable. Nous définissons une nouvelle notion de monotonie, appelée cover-monotony, qui est strictement plus générale que la monotonie habituelle et permet, malgré tout, de décider une forme restreinte du problème de couverture, que nous appelons le problème de couverture initiale. Nous montrons également quelques exemples de systèmes dans la littérature qui ne sont pas des WSTS mais sont des branch-WSTS.

Ensuite, nous étudions la restriction de la limitation de l'entrée (input-boundedness) sur les canaux FIFO (c'est-à-dire que la séquence de messages envoyés via un canal particulier appartient à un langage borné donné). Nous prouvons, en réduisant ce modèle à une machine à compteurs avec des tests à zéro restreints, que le problème d'accessibilité rationnelle (et par extension, l'accessibilité de l'état de contrôle, la vii viii terminaison, les blocages, etc.) est décidable. Cette classe de machines englobe les machines où le langage entrant est borné sur des lettres (letter-bounded), les machines plates (flat FIFO), les réseaux FIFO linéaires et les machines monogènes, pour lesquelles certains de ces problèmes se sont déjà avérés décidables. Ces résultats théoriques peuvent constituer les bases pour construire un outil de vérification des machines FIFO générales basé sur l'analyse des machines à langages bornés en entrée. De plus, nous étudions également le dual naturel de la restriction de la limitation de l'entrée, en considérant des exécutions bornées en sortie. Nous montrons que de nombreuses propriétés entre ces restrictions sont inter-réductibles, tout en soulignant leurs di↵érences. Enfin, nous montrons également des bornes inférieures pour le problème d'accessibilité bornée par les entrées.

Enfin, nous étudions la classe des systèmes synchronisables, qui est une sousclasse stricte des machines à états finis communicantes générales (CFSM). Plusieurs notions de synchronisabilité d'un système distribué communicant ont été introduites dans la littérature. Essentiellement, un système est dit synchronisable si chaque exécution peut être réordonnée afin qu'elle satisfasse à certains critères, par exemple, qu'elle maintient un canal borné. Nous considérons l'ensemble des MSC (Message Sequence Charts), qui représentent graphiquement les exécutions du système. Pour cet ensemble, nous créons un cadre basé sur la logique monadique du second ordre (MSO) et la largeur des graphes, qui unifie la majorité des définitions existantes, explique leurs bonnes propriétés et permet de déduire facilement d'autres définitions plus générales et des résultats de décidabilité pour la synchronisabilité. Nous fournissons également de meilleures bornes inférieures en utilisant la logique dynamique propositionnelle (PDL) pour certains cas. Notre cadre capture également à la fois le modèle de communication peer-to-peer, ainsi que le modèle de communication de boîte aux lettres (mailbox). De plus, pour la notion de synchronisabilité en envoi, qui ne satisfait pas les propriétés de notre framework, nous prouvons également l'indécidabilité des problèmes d'accessibilité (et d'autres problème associés).

Chapter 1

Introduction

Over the years, due to the advance in technology, systems have been getting increasingly complex. From mobile telephones to automatic doors, we are surrounded by hardware, software, and their interactions. This leads to the natural question of investigating the correctness of a given system. Formal verification is one of the tools used to verify if a system works according to its properties.

Let us be more precise. What do we mean by a system? In the context of this thesis, a (distributed) system is a set of autonomous processes which communicate (asynchronously) with one another and accomplish tasks. The problem of formal verification deals with checking if a model of such a system behaves as desired, according to some mathematical specifications.

The objective of this thesis is not to prove that a system performs the function it is intended to do, but rather to verify specific properties for any systems, regardless of their function. This helps detect a large number of common design errors across various systems. For example, one of the problems we consider is the deadlock problem. This occurs when a process reaches a state but cannot progress any further, either by sending any messages to other processes, receiving any messages, or performing any local actions. Deadlocks are common design errors that can be seen in nearly every kind of distributed system.

Let us consider a basic scenario as follows: A user wishes to connect to a server. To this end, they send a request (which we refer to as REQ) to the server, and wait. The server reads the request, provides the service, and sends a message when it is done (which is denoted by DONE). The user can read this message and restart the exchange again. When the server is not processing a request, it can self-inspect and might detect a fault in itself. In this case, it sends an alarm to the user (which we denote by ALARM) and moves to a repair state. The user can read this alarm, register it, and direct the server back to the idle state by sending an acknowledgment (ACK). This protocol was introduced in [START_REF] Brand | On Communicating Finite-State Machines[END_REF].

We model this scenario using a finite-state machine each for the user and the server, and a (potentially unbounded FIFO) communication bu↵er for each direction, as shown in Figure 1.1. The notation for expressing sends and receptions is illustrated in the figure. Both the user and the server start at state 0, indicated by an incoming arrow with no source. An exclamation sign (!m) identifies the sending of a message m, and a question mark (?m) signals the reception of the message m. For example, by taking an arc marked with, say !ACK, the user changes their state, and the message ACK is sent to the channel from which the server reads. Returning to the deadlock problem, we can see that the model above can lead the processes to a deadlock. For example, if the user sends a request REQ to the client, but the client detects a fault before it receives the request and instead sends an alarm ALARM to the user. Then, at states 1 and 2, respectively, the user and the server are both in a state where they cannot send any more messages, or receive the message in their channels. Some of the central verification problems we study are the non-termination, reachability, and model checking problems. Non-termination amounts to checking whether or not every run of the system is terminating. Reachability asks if a specific state is reachable in any run of the system. And finally, the model checking problem asks for an algorithm that decides, given a property (expressed as a formula of a suitable logic), whether every behavior of the system satisfies it.

We shall now look more closely at the models we study in this thesis, and survey some of the related results from the literature.

Systems communicating via FIFO channels

The primary model studied in this thesis is one where the communication between processes is via (potentially unbounded) First-In First-Out (FIFO) channels, as seen in the example above. Furthermore, we abstract the processes as finite-state automata, which can send and receive messages from the channels, apart from performing local actions. However, since systems of processes communicating through (at least two) one-directional FIFO channels, or, equivalently, a single process with one FIFO channel, simulate Turing machines, most properties, including deadlock detection and the other problems we mentioned earlier, are undecidable for such systems [START_REF] Brand | On Communicating Finite-State Machines[END_REF].

A natural restriction to retain decidability for such systems is weakening the nature of the channels. In [START_REF] Abdulla | Verifying programs with unreliable channels[END_REF][START_REF] Finkel | Decidability of the termination problem for completely specified protocols[END_REF], the authors showed that if the underlying channels are lossy, then the state reachability problem becomes decidable (but non-elementary). For a survey of the plethora of results in the study of lossy channel systems, see [A ČJT00,[START_REF] Finkel | Well-structured transition systems everywhere![END_REF].

If one restricts to runs with B-bounded channels (the number of messages in every channel does not exceed B 2 N), then reachability becomes decidable for universally-bounded FIFO systems [START_REF] Genest | On Communicating Automata with Bounded Channels[END_REF]. In fact, the model checking problem also becomes decidable for various logics [START_REF] Peled | Specification and Verification of Message Sequence Charts[END_REF][START_REF] Madhusudan | Beyond Message Sequence Graphs[END_REF][START_REF] Genest | A Kleene Theorem for a Class of Communicating Automata with E↵ective Algorithms[END_REF]. Moreover, in [START_REF] Lohrey | Bounded MSC Communication[END_REF], the authors introduced existentially k-bounded systems (see also [START_REF] Lohrey | Bounded MSC Communication[END_REF][START_REF] Genest | A Kleene Theorem for a Class of Communicating Automata with E↵ective Algorithms[END_REF][START_REF] Genest | On Communicating Automata with Bounded Channels[END_REF]) where all accepting executions leading to a stable (with empty channels) final states can be re-ordered into a k-bounded execution. For this model as well, the reachability problem becomes decidable. However, checking if a system is existentially k-bounded is undecidable, even if k is part of the input [START_REF] Genest | On Communicating Automata with Bounded Channels[END_REF]. A more general definition, still called existentially bounded, is given in [START_REF] Kuske | Communicating automata[END_REF], where the considered executions are not supposed to be final or stable. In [HMK + 05, LM04], the notion of universally k-bounded is also discussed, and the authors show that the property is undecidable in general.

In [START_REF] La | Context-Bounded Analysis of Concurrent Queue Systems[END_REF], the authors propose a "context-bounded" analysis of systems communicating with message channels. According to this approach, one "context" involves a single process reading from its channel, and posting to the channel of other processes, and the number of contexts per execution is bounded. The context-bounded reachability problem is in 2-EXPTIME, even for recursive FIFO systems [START_REF] La | Context-Bounded Analysis of Concurrent Queue Systems[END_REF][START_REF] Heußner | Reachability Analysis of Communicating Pushdown Systems[END_REF]. For "non-confluent topology", where every channel has restrictions either at the source or destination, the reachability problem is in EXPTIME for recursive FIFO systems with 1-bounded channels [START_REF] Heußner | Reachability Analysis of Communicating Pushdown Systems[END_REF].

Reachability is in PTIME in half-duplex systems [START_REF] Cécé | Verification of programs with halfduplex communication[END_REF] with two processes. In fact, for two process, the reachability set is recognizable and e↵ectively computable. However, in the same paper, the natural extension to three processes was shown to be undecidable. More recently, in [START_REF] Di Giusto | Towards Generalised Half-Duplex Systems[END_REF], the authors introduce "greedy systems" or RSC (realizable with synchronous communications) systems, as a possible generalization of half-duplex systems for more than two processes.

In [START_REF] Madhusudan | The tree width of auxiliary storage[END_REF][START_REF] Aiswarya | Verifying Communicating Multi-pushdown Systems via Split-Width[END_REF], uniform criteria for decidability of reachability and model 1. Introduction checking questions are established for communicating recursive systems whose restricted architecture or communication mechanism gives rise to behaviors of bounded tree-width.

Input-bounded FIFO machines. Instead of fixing the size of a channel, another approach that has been investigated over the years involves restricting the input-language of a channel. Roughly, the input-language of a channel refers to the set of words that record the messages entering a channel. Notably, there have been various papers studying FIFO machines where the input-language is included in the set Pref (w ⇤ 1 w ⇤ 2 . . . w ⇤ n ) of prefixes of a bounded language w ⇤ 1 w ⇤ 2 . . . w ⇤ n . This class of FIFO machines are called input-bounded. In this thesis, if all w 1 , . . . , w n are single letters, then the language is called input-letter-bounded.

Note that if the set of letters that may enter a channel c is reduced to a unique letter a c , then the input-language of c is included in a ⇤ c , and this subclass trivially reduces to VASS and Petri nets [START_REF] Yu | Unboundedness detection for a class of communicating finite-state machines[END_REF]. Also note that, in general, the behavior of input-bounded FIFO machines does not have bounded tree-width.

Monogeneous FIFO nets [START_REF] Finkel | About monogeneous FIFO Petri Nets[END_REF][START_REF] Memmi | An introduction to FIFO nets-monogeneous nets: A subclass of FIFO nets[END_REF][START_REF] Finkel | Well-structured transition systems everywhere![END_REF] are defined as FIFO nets such that the input-languages of channels c are included in Pref (u c • v ⇤ c ), where u c , v c are two words associated with c. Furthermore, linear FIFO nets [START_REF] Choquet | Simulation of linear FIFO nets by Petri nets having a structured set of terminal markings[END_REF] refer to FIFO systems such that the input-languages are included in Pref (m ⇤ 1 m ⇤ 2 . . . m ⇤ n ) where each m i is a letter and m i 6 = m j if i 6 = j. Both monogeneous and linear FIFO nets generalize Petri nets, and still have decidable reachability. The deadlock problem, which is, in fact, a variant of the reachability problem, is shown as decidable for input-letter-bounded FIFO systems in [START_REF] Gouda | On deadlock detection in systems of communicating finite state machines[END_REF] by reducing to reachability for VASS. However, the extension to general input-bounded machines was left open.

Flat machines are another subclass of input-bounded machines in which the language of their control-graph, considered a finite automaton, is a bounded language. For flat FIFO machines, control-state reachability is NP-complete [START_REF] Esparza | A Perfect Model for Bounded Verification[END_REF]; this result has recently been extended to reachability, channel unboundedness, and other classical properties [START_REF] Finkel | Verification of Flat FIFO Systems[END_REF].

Flat, input-letter-bounded, linear (which we also refer to as distinct-letter bounded), and monogeneous FIFO machines (the last three types contain VASS, and are all incomparable) are all included in the more general input-bounded FIFO machines. The unboundedness problem of input-bounded FIFO machines was shown to be decidable in [START_REF] Jéron | Testing for unboundedness of fifo channels[END_REF] by using the well-structured concepts but with no extension to decidability of reachability.

Synchronizability. There have been various notions of synchronizability of a communicating system that have been introduced in the literature. Broadly, a system is called synchronizable if every execution can be rescheduled to meet certain criteria, for example, a channel bound.

We focus on the boundedness problem, which we know to be undecidable. We could limit our analysis to decide whether, for a given integer k 0, known in advance, the FIFO channels are k-bounded, and this property is generally decidable in PSPACE. Unfortunately, the k-boundedness property is too binding since it excludes even a basic two-process unbounded system where one process only sends messages, and the other process is always able to receive. Hence, to cope with this limitation, one can find variants of the boundedness property that essentially reduce to say that every unbounded execution of a system (i.e., where one or more channels are unbounded along the execution) is equivalent (say, causally equivalent) to another bounded execution.

In [START_REF] Basu | Choreography conformance via synchronizability[END_REF], the authors introduced synchronizable systems, for which every execution is equivalent (for the projection on sending messages) to an execution of the same system, but communicating by rendezvous. To avoid ambiguity, we call such systems send-synchronizable. However, for peer-to-peer systems, this property was shown to be undecidable in [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF]. In [START_REF] Schewe | Realisability of Choreographies[END_REF], the authors show that the class of synchronizable peer-to-peer systems is exactly the same as the ones which are "choreography realizable", a property that now precisely characterizes the class of peer-to-peer systems which are synchronizable.

In [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF], the authors called a system k-synchronizable (to avoid confusion, we call such systems weakly k-synchronizable in the remainder of this thesis) if every message sequence chart (MSC) of the system admits a linearization (which is not necessarily an execution) that can be divided into blocks of at most k messages. After each block, a message is either read, or will never be read. This constraint seems to imply that bu↵ers are bounded to k messages. However, as the linearization need not be an execution, this implies that a weakly k-synchronizable execution, even with the more e cient reschedule, can need unbounded channels to be run by the system. Reachability under this restriction and checking k-synchronizability are both PSPACE-complete [START_REF] Di Giusto | On the ksynchronizability of Systems[END_REF].

A short note on communication architectures. A key di↵erence between these works is that they consider di↵erent communication architectures. Existentially bounded systems have been studied for peer-to-peer systems (with one channel per pair of processes). On the other hand, k-synchronizability has been studied for mailbox communication, for which each process merges all its incoming messages in a unique channel. The decidability results for k-synchronizability have been extended to peer-to-peer communications [START_REF] Di Giusto | On the ksynchronizability of Systems[END_REF], but it is unknown whether the decidability results for existentially bounded systems extend to mailbox communication. Moreover, variants of those definitions can be obtained depending on if we consider messages that are sent but never read, called unmatched messages.

Introduction

Indeed the challenges that arise in [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF] are due to mailbox communication and unmatched messages blocking a channel so that all messages sent afterward will never be read.

Well-structured transition systems

Transition systems, including FIFO systems, broadly refer to any systems that take transitions to move from state to state. Well-structured transition systems (WSTS) (initially called structured transition systems in [START_REF] Finkel | Reduction and covering of infinite reachability trees[END_REF]) are a notable subclass of transition systems. They have decidable termination and boundedness problems. They capture properties common to a wide range of systems, and are used in model checking, system verification, and concurrent programming [START_REF] Finkel | Well-structured transition systems everywhere![END_REF].

A WSTS is an infinite set X (of states) with a transition relation ! ✓ X ⇥ X. The set X is quasi-ordered by , and ! fulfills one of the various possible monotonies with respect to . The quasi-ordering of X is further assumed to be well, i.e., well-founded and with no infinite antichains. These two properties form a framework that helps to algorithmically decide verification problems such as boundedness, termination, and coverability. Some important classes of infinite-state systems are straightforwardly WSTS, and some others can be analyzed using WSTS as approximations of their behavior. Petri Nets (or, equivalently, vector addition systems (with states) VASS), and many of their extensions are WSTS. Even Lossy Channel Systems, which we introduced earlier, are WSTS. More recently, the theory of WSTS has been applied to study computational models resulting from a combination of di↵erent types of systems like asynchronous systems defined by extending pushdown systems with an external memory [START_REF] Chadha | Deciding branching time properties for asynchronous programs[END_REF], cryptographic protocols [START_REF] Emanuele | Decidable Inductive Invariants for Verification of Cryptographic Protocols with Unbounded Sessions[END_REF], and others. While some systems may not have the required monotonicity, they can be overapproximated in order to be a WSTS. Hence, in the over-approximated system, any negative answer for control-state reachability (or positive answer for termination or boundedness) will still be valid for the original system. This is an approach used, for example, in [ABC + 08, ADR09, ACV11].

Many safety properties of real-world systems reduce to the coverability problem, which asks: Given a WSTS S = (X, !, ) and two states x, y 2 X, does there exist a sequence of transitions leading from x to a state y 0 y? For this verification problem, there are two main classes of algorithms on WSTS, both relying heavily on the monotony condition. Firstly, we have the backward algorithms, which start from a final state, and then progressively compute an over-approximation of the predecessor states. Such algorithms work well on WSTS as their properties result in a simple representation of the approximation of predecessor states. Such algorithms generally allow for deciding safety properties like control-state reachability. On the other hand, forward algorithms that start from an initial state, progressively compute an over-approximation of the reachable states. These algorithms generally allow for deciding liveness properties like termination or properties related to the complete set of reachable states like boundedness. Over the years, a number of strengthenings and weakenings of the notion of monotony (of ! w.r.t. ) were introduced, with the goal of allowing WSTS to capture ever more models [A ČJT00,[START_REF] Finkel | Well-structured transition systems everywhere![END_REF]. However, the representation of the approximation of reachable states is not immediate, making verifying properties that are more precise than boundedness di cult. Recently, a procedure to decide such properties has been proposed in [START_REF] Blondin | Well Behaved Transition Systems[END_REF], but its termination was not guaranteed.

Contributions of the thesis

This thesis aims to study a number of under-approximations of general transition systems. Firstly, we look at branch-well-structured transition systems, which we shall henceforth refer to as branch-WSTS. This model tries to relax the aforementioned well-quasi-order condition to elements along an execution. Moreover, we similarly try to relax the monotony condition as well. Secondly, for FIFO machines, we restrict the reachability set to runs where the language that enters a channel is bounded. Finally, we survey various notions of synchronizability from the literature, provide a framework that consolidates many of these classes, and give properties to decide inclusion into the class. We summarize here the main contributions of this thesis.

Branch-WSTS

As mentioned previously, WSTS captures various classes of transition systems, and lets one algorithmically verify properties about them. Our main contribution is to prove that the monotony and well-quasi-order (wqo) assumptions can further be weakened while some problems remain decidable. More precisely, we introduce a notion of WSTS, called branch-well-structured transition systems (branch-WSTS), where the monotony only applies to states reachable one from another. Furthermore, we also relax the wqo condition to such states. Retaining the decidability of termination and boundedness is still possible with this relaxation. Moreover, we show some classes of systems that have been studied in the literature that are branch-WSTS.

However, we show that the coverability problem is undecidable for general branch-WSTS. Hence, for the coverability problem, we introduce a notion of monotony, called cover-monotony, which still allows deciding the coverability problem, even in the absence of strong (or strict or transitive or reflexive) monotony. In-1. Introduction deed, while the usual backward algorithm for coverability relies on well-foundedness, the forward algorithm described in [START_REF] Blondin | Well Behaved Transition Systems[END_REF] does not require that property. Hence, we show that, for a given initial state, we can decide the coverability problem for such systems.

Bounded reachability

Secondly, we solve a problem that was left open in [START_REF] Gouda | On deadlock detection in systems of communicating finite state machines[END_REF], namely the decidability of the reachability problem for input-bounded FIFO machines. We present a simulation of input-bounded FIFO machines by counter machines with restricted zero tests, for which we show that reachability is decidable. The main idea is to associate a counter with each word in the bounded language, and to ensure that the counters are incremented and decremented in a way that corresponds to the FIFO order. Since we can have repeated letters, and ambiguities in the FIFO machine, we first need to construct a normal form of the FIFO machine. Furthermore, we ensure that for every run in the FIFO machine, we can construct an equivalent run in the counter machine and vice-versa.

As we actually solve the general rational-reachability problem, we can deduce the decidability of other verification properties like control-state reachability, deadlock, unboundedness, and termination.

We study the natural dual of the input-bounded reachability problem, which are systems of output-bounded languages in which the set of words received by each channel is constrained to be bounded, and can deduce the reachability, unboundedness, termination, and control-state reachability for the same.

We obtain better upper bounds for the input-bounded reachability of FIFO machines with a single channel (reachability is still undecidable for FIFO machines with a single channel). This is done by reducing it to reachability in unary ordered multi-pushdown systems (a class that was previously analyzed in [START_REF] Faouzi Atig | Emptiness of Ordered Multi-Pushdown Automata is 2ETIME-Complete[END_REF]). It is, hence, solvable in EXPTIME.

Following the bounded verification paradigm, applied to FIFO machines (for instance, in [START_REF] Esparza | A Perfect Model for Bounded Verification[END_REF][START_REF] Finkel | Verification of Flat FIFO Systems[END_REF]), we open the way to a methodology that would apply existing results on input-bounded FIFO machines to general FIFO machines.

Synchronizability

As we saw earlier, there are a number of di↵erent notions of synchronizability in the literature. In order to unify these notions, we introduce a general framework based on monadic second-order (MSO) logic and (special) tree-width that captures most existing definitions of systems that may work with bounded channels. Moreover, reachability and model checking are shown to be decidable in this framework.

We show that existentially bounded systems can be expressed in our framework and, consequently, the existentially k-bounded property is decidable by using the generic proof. We generalize the existing notion of (weak) k-synchronizability in, and we introduce three new classes of synchronizable systems: weakly synchronizable (which are more general than weakly k-synchronizable [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF]), strongly synchronizable and strongly k-synchronizable (which are particular cases of weakly synchronizable). We then prove that most of these properties fit in our framework and are all shown to be decidable using the generic proof. We also show some undecidability results for classes that do not fit in the framework.

We then deduce that reachability and model checking are decidable for these classes. Previously, only control-state reachability was shown to be decidable for weakly k-synchronizable [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF], and it is clearly also decidable for existentially/universally bounded systems, but reachability properties are generally not studied for these classes of systems.

In order to obtain better complexity results for some classes (strongly and weakly synchronizable systems), we also use the fragment of propositional dynamic logic with loop and converse (LCPDL) instead of MSO logic in our framework.

Finally, we also look closely at the notion of send-synchronizability, a notion that was shown undecidable for peer-to-peer systems in [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF]. For this model, we go on to show that reachability and control-state reachability are also not decidable, and investigate whether there is a class of properties that are decidable for send-synchronizable systems.

Organization of the thesis

Chapter 2 introduces the various types of models we study in the remainder of the thesis. It starts with the most general transition system, and goes on to define the more specific models of FIFO machines, communicating systems, and counter machines. For communicating systems, we also define the graphical representation and give some information on the communication architecture. We also define the notion of finite automata and some conditions on them.

Chapter 3 delves into the first subclass of transition systems that we study in this thesis: branch-well-structured transition systems, or branch-WSTS.

We first introduce terminology and some well-known results concerning wellquasi-orderings and well-structured transition systems. Then we introduce branch-WSTS, and show that termination and boundedness are decidable for a class of e↵ective branch-WSTS. Then, we look at some examples of classes of branch-WSTS. Finally, we investigate the coverability problem for WSTS with relaxed conditions.

Chapter 4 investigates the second restriction we study on transition systems. In this chapter, we study the bounded reachability problem for FIFO machines.

We introduce the notion of bounded reachability, and then go on to prove the main result, which is the input-bounded rational-reachability problem. Then, we extend the result to other problems, such as reachability, deadlock, and boundedness. This is followed by the study of the natural dual of input-bounded reachability, which we refer to as output-bounded reachability. We then study the single-channel case, and obtain some lower bounds and elementary upper bounds. Finally, we conclude with a theory to use these results as an under-approximation for general FIFO machines.

Chapter 5 provides a framework, based on MSO (and LCPDL) logic and special tree-width, in order to unify the various definitions of synchronizability in literature.

It starts with providing a logical background for the rest of the chapter, and some of the graphical notions related to the executions of communicating systems, such as tree-width and the conflict graph. Then, we present the unifying MSO (and LCPDL) framework and two general theorems on k-synchronizability and model checking. Finally, we apply the framework to various subclasses, including k-synchronous MSCs and existentially-bounded MSCs. We conclude with a brief account of some recent developments in the field.

Chapter 6 focuses on the send-synchronizability problem for peer-to-peer systems. We study some of the verification problems for send-synchronizable systems.

We introduce the two notions of send-synchronizable systems, and some of the problems that we investigate for these classes. Then, we show that reachability and some variants are undecidable for both these classes. Then, we study a series of problems for which we can have decidable properties, and conclude with some final remarks.

Most of the results presented in this thesis appear in [BFS20, BDGF + 21, BFS22a, BFS22b].

Chapter 2

Transition Systems

Transition systems are an abstraction used in the study of computation, to describe the potential behavior of discrete and continuous systems. A transition system consists of a set of states, and a collection of transitions between states. We study a variety of transition systems in this work, and this chapter will be their overview.

As a concrete example, consider an elevator. Here, the states are the various positions of the elevator cabin, and the transitions describe the movement of the cabin. It can be viewed as a dynamic process with the users pressing buttons, thereby changing the state of the elevator. Similarly, programs, networks, communication systems, etc., can be seen as transition systems. Moreover, the notion of transition systems not only helps in modeling such behaviors but also helps to develop tools for verifying the modeled system.

Hence, the goal is to develop general mathematical structures that could serve as su cient conditions for achieving decidability. Over the last few decades, there has been a concerted e↵ort toward defining classes of models and finding appropriate algorithms to automatically verify them. Notable examples include timed automata [ACD90, AH94], hybrid automata [START_REF] Henzinger | Hybrid automata with finite bisimulations[END_REF], Petri nets [Jan90, JM95], well-structured transition systems [A ČJT00, FS01], etc.

Preliminaries. Before we start with the formal representation of transition systems, let us recall some basic definitions of words and languages.

Let A be a finite alphabet. As usual, A ⇤ is the set of finite words over A, and A + the set of non-empty finite words. We let |w| denote the length of w 2 A ⇤ . For the empty word ", we have |"| = 0. Given a 2 A, let |w| a denote the number of occurrences of a in w. With this, we let

Alph(w) = {a 2 A | |w| a 1} . The concatenation of two words u, v 2 A ⇤ is denoted by u • v or u.v or simply uv. u 2 A ⇤ is a prefix (resp. su x) of w if w = u • v (resp. w = v • u) for v 2 A ⇤ . Similarly, u 2 A ⇤ is an infix of w if w = v 1 • u • v 2 for v 1 , v 2 2 A ⇤ .
The sets of 11 prefixes, su xes, and infixes of w 2 A ⇤ are denoted by Pref (w), Suf (w), and Inf (w), respectively. prefix, su x, infix Note that {", w} ✓ Pref (w) \ Suf (w) \ Inf (w). For a set X, any mapping f :

A ⇤ ! 2 X can be extended to f : 2 A ⇤ ! 2 X letting, for L ✓ A ⇤ , f (L) = S w2L f (w).
In particular, Alph(L), Pref (L), Suf (L), and Inf (L) are extended in that way. Now, we shall begin to define transition systems. At its core, the most general representation of a transition system is the following.

Definition 2.1. A transition system transition system is a pair S = (X, !) where X is a (potentially infinite) set of states and ! ✓ X ⇥ X is the transition relation.

We write x ! y for (x, y) 2 !. Transition systems may have additional structures like initial and final states, labels for transitions, causal independence relations, etc.

Example 1. A simplified model of a server is described as follows (see Figure 2.1):

The server has three states, a waiting state, a state upon receiving a request, and a state upon completing a request. If the server is in the idle state, it continues to wait until it receives a request. Upon receiving a request, it moves to x req . It then processes the request and goes to x done upon completing the request, and then goes back to the waiting state. Hence, X = {x wait , x req , x done } ! = {(x wait , x wait ), (x wait , x req ), (x req , x done ), (x done , x wait )} x wait

x req x done We denote by ⇤ ! the reflexive, transitive closure of !, and + ! denotes the transitive closure of !. For every x 2 X, the sets of immediate successors and immediate predecessors are defined by:

P re S (x) = {y 2 X | y ! x} P ost S (x) = {y 2 X | x ! y} For every x 2 X, P ost ⇤ S (x) = {y 2 X | x ⇤ ! y} and P re ⇤ S (x) = {y 2 X | y ⇤
! x} denote respectively the sets of successors and predecessors of x. Pre ⇤ , Post ⇤ P ost ⇤ S (x) is also referred to as the reachability set of x reachability set

. We say that a state y is reachable from a state x if y 2 P ost ⇤ S (x). We drop the subscript S when it is clear from the context. A transition system S is finitely branching if for every x 2 X, P ost(x) is finite. It is infinitely branching otherwise. We naturally extend P ost, P re, P ost ⇤ and P re ⇤ to subsets of states, e.g., for D ✓ X we have P re ⇤ (D) = S x2D P re ⇤ (x).

Often, to be more specific while describing transition systems, we label the transitions with actions, which are elements from a finite alphabet. This aids in answering questions about the occurrence of specific transitions. We formally define labeled transition systems (LTS).

Definition 2.2. A labeled transition system (with an initial state) labeled transition system is a quadruple S = (X, A, !, init) where X is the set of states, A is a finite alphabet, init 2 X is the initial state, and ! ✓ X ⇥ A ⇥ X is the transition relation.

In the case of a labeled transition system, we write

x a ! x 0 instead of (x, a, x 0 ) 2 !. For x, x 0 2 X, let x ! x 0 if x a ! x 0 for some a 2 A. For w 2 A ⇤ , we write x w ! x 0 if there is a w-labeled path from x to x 0 . Formally, x " ! x 0 , where " is the empty word, if x = x 0 . And x aw ! x 0 if there is y 2 X such that x a ! y and y w ! x 0 . We let Traces(S) = {w 2 A ⇤ | init w ! x for some x 2 X} be the set of traces. Given w 2 A ⇤ , we let Tracereach S (w) = {x 2 X | init w ! x}. Moreover, for L ✓ A ⇤ , Tracereach S (L) = S w2L
Tracereach S (w) is the set of states that are reachable via a word from L. Finally, for a labeled transition system reachability set for LTS , the reachability set of S is defined as Reachset S = P ost ⇤ S (init) = Tracereach S (A ⇤ ). We call S finite if Reachset S is finite (and this is the case if X is finite). Otherwise, S is called infinite.

When we work on purely state problems (hence, labels are meaningless), we will allow ourselves to use an infinite set of actions in order to provide the reader with information about what transitions are used. However, most of this work relies on using labels, hence, we only use a finite set of actions.

Verification problems for transition systems

We formally define some of the verification problems commonly studied for transition systems. It is important to note that in order to be able to decide these problems for transition systems, at the minimum, we require that the transition relations have some e↵ectiveness properties. The most basic condition is that ! is decidable. This is the classic definition of e↵ectivity for a finite-branching transition system, so if ! is decidable, we say that the finitely branching transition system S is e↵ective. However, this is only a necessary condition, not a su cient one. In this thesis, we refer to this notion as weakly e↵ective to avoid confusion, as we shall see in future chapters stronger e↵ectivity conditions for subclasses of transition systems.

The central problem for the verification of transition systems is reachability, which simply asks whether a state (say, an error state) is reachable from another state (say, an initial state).

Decision Problem: REACHABILITY

Input:

a TS S = (X, !),

x, y 2 X Question:

is

y 2 P ost ⇤ S (x)?
Reachability is a safety problem, i.e., it only looks at finite transition sequences.

We also look at liveness problems. One of these is non-termination, which looks for an infinitely long execution in the system.

Decision Problem: NON-TERMINATION

Input: a TS S = (X, !),

x 0 2 X Question:

is there x 1 , x 2 , . . . 2 X such that: for all i 0, x i ! x i+1 ?

Decision Problem: BOUNDEDNESS

Input: a TS S = (X, !), x 2 X Question: is Reach S (x) finite?
Note that a finitely branching system can be unbounded only if it does not terminate. Moreover, in many cases, termination reduces to boundedness. However, the converse is not true, as we can find transition systems where termination is decidable, but boundedness is not.

FIFO machines

We now look at some subclasses of transition systems. A FIFO machine M can be seen as a finite-state automaton equipped with a collection of FIFO (First-In First-Out) channels c 1 , c 2 , . . . In this section, we consider FIFO machines having a sequential control graph rather than systems of communicating processes that are distributed systems. We study the latter in Section 2.2.1. It is clear that, given a distributed system, one may compute the Cartesian product of all processes to obtain a FIFO machine (the converse is not always true).

Definition 2.3. A FIFO machine FIFO machine is a tuple M = (Q, Ch, ⌃, T, q 0 ) where Q is a finite set of control-states, q 0 2 Q is an initial control-state, and Ch is a finite set of channels. Moreover, ⌃ is a finite message alphabet. It is partitioned into

⌃ = U c2Ch ⌃ c
where ⌃ c contains the messages that can be sent through channel c.

Finally, T ✓ Q ⇥ Act M ⇥ Q is a
A trace trace ⌧ 2 Act ⇤
M is a finite (possibly empty) sequence of actions. We write " for the empty trace. For a channel c, we let proj c! : Act ⇤ M ! ⌃ ⇤ c be the homomorphism defined by proj c! (hc!mi) = m for all m 2 ⌃ c , and

proj c! (↵) = " if ↵ 2 Act M is not of the form hc!mi for some m 2 ⌃ c . Moreover, proj c! (⌧ 1 • ⌧ 2 ) = proj c! (⌧ 1 ) • proj c! (⌧ 2 ).
Furthermore, we let proj ! : Act ⇤ M ! ⌃ ⇤ be the homomorphism defined by proj ! (hc!mi) = m for all m 2 ⌃ and c 2 Ch, and proj ! (↵) = " if ↵ 2 Act M is not of the form hc!mi for some m 2 ⌃ and c 2 Ch. We define proj c? :

Act ⇤ M ! ⌃ ⇤ c and proj ? : Act ⇤ M ! ⌃ ⇤ similarly.
Let ⌃ !? = {#m | m 2 ⌃ and # 2 {!, ?}}. For ⌧ 2 Act ⇤ M and channels c 2 Ch, we write:

• ⌧ c 2 Act ⇤ M for the sub-trace of actions = 1 • • • k in ⌧ such that i = hc#mi for all 1  i  k and # = {!, ?} and m 2 ⌃ c . • bu↵er c (⌧ ) for the word w 2 ⌃ ⇤ , if it exists, such that proj c! (⌧ ) = proj c? (⌧ ) • w. • proj !? : Act ⇤ M ! ⌃ ⇤ !?
for the homomorphism defined by proj !? (hc!mi) = !m and proj !? (hc?mi) = ?m for all m 2 ⌃.

A FIFO machine M = (Q, Ch, ⌃, T, q 0 ) induces a (potentially infinite) labeled transition system transition system induced by FIFO machine

S M = (X M , Act M , ! M , init M ). Its set of states is X M = Q ⇥ Q c2Ch ⌃ ⇤ c .
In (q, w) 2 X M , the first component q denotes the current controlstate and w = (w c ) c2Ch determines the contents w c 2 ⌃ ⇤ c for every channel c 2 Ch. The initial state is init M = (q 0 , ") where " = (", . . . , "), i.e., every channel is empty. The transitions are given as follows:

• (q, w) hc!ai ! M (q 0
, w 0 ) if (q, hc!ai, q 0 ) 2 T , w 0 c = w c • a, and w 0 d = w d for all d 2 Ch \ {c};

• (q, w) hc?ai ! M (q 0 , w 0 ) if (q, hc?ai, q 0 ) 2 T , w c = a • w 0 c , and

w 0 d = w d for all d 2 Ch \ {c}.
We say a state is stable stable state if w c = " for all c 2 Ch. The initial state init M of S is a stable state. The reachability set of M is defined as the reachability set of S M , i.e., Reachset M = Reachset S M . As in the case of transition systems,

Traces(M) = Traces(S M ) = { 2 Act ⇤ M | init M ! x for some x 2 X M }.
A trace ⌧ is FIFO trace FIFO (resp. k-bounded FIFO, for k 1) if for all c 2 Ch, for all prefixes ⌧ 0 of ⌧ , bu↵er c (⌧ 0 ) is defined (resp. defined and of length at most k); in other words, ⌧ is FIFO if for every prefix ⌧ 0 of ⌧ , for c 2 Ch, the sequence of messages received by c in ⌧ 0 is a prefix of the sequence of messages sent to c. Intuitively, a trace is FIFO if it is an execution of a machine that manipulates FIFO channels. A trace stable trace

⌧ is stable if bu↵er c (⌧ ) = " for all c 2 Ch. A trace is synchronous trace synchronous if proj !? (⌧ ) is of the form !m 1 •?m 1 •!m 2 •?m 2 • • •!m k •?m k for some k 0 and m 1 , . . . , m k 2 ⌃.
In particular, a synchronous trace is a 1-bounded FIFO trace. The converse is not necessarily true. For example, we could have a 1-bounded FIFO trace

hc 1 !m 1 i • hc 2 !m 2 i • hc 1 ?m 1 i • hc 2 ?m 2 i for processes c 1 , c 2 2 Ch and m 1 , m 2 2 ⌃. Since proj !? (⌧ ) = !m 1 •!m 2 •?m 1 •?m 2 ,
the trace is not synchronous.

For k 1, we write Traces k (S) for the set of k-bounded traces of S. Moreover, Traces 0 (S) is the set of synchronous traces of S.

Communicating finite-state machines

This section provides preliminaries on communicating finite-state machines (CFMs). In a CFM, a fixed number of finite-state processes communicate by exchanging messages through unbounded FIFO channels. Each process is encoded by an automaton, and by abuse of notation, we say that a system is the parallel composition of such processes. In this section, we are looking at peer-to-peer (p2p) systems, where each pair of machines exchange messages via two channels, one per direction of communication. We also look at mailbox, or ⇤ 1, communication, where each process is limited to a single FIFO channel that it receives from. We will define the model precisely in Section 2.2.3. Let P set of processes P be a finite set of processes. The set of (p2p) channels is Ch = {(p, q) 2 P⇥ P | p 6 = q}. Let ⌃ = U c2Ch ⌃ c be a set of messages. For (p, q) 2 Ch, let Send(p, q) = {h(p, q)!mi | m 2 ⌃} and Rec(p, q) = {h(p, q)?mi | m 2 ⌃ (p,q) }. For p 2 P, we set Send(p, ) = {h(p, q)!mi | q 2 P \ {p} and m 2 ⌃}. Similarly, for m 2 ⌃, Send(m) = {h(p, q)!mi | (p, q) 2 Ch}. Moreover, Act p = Send(p, ) [ Rec( , p) will denote the set of all actions that are executed by p. Finally, Act = S p2P Act p is the set of all the actions. For every process p 2 P, we let ⌃ p = S q2P ⌃ (p,q) [ S q2P ⌃ (q,p) . Note that these sets are not disjoint, i.e., ⌃ p \ ⌃ q = ; for p 6 = q. Definition 2.4. A communicating system communicating finite-state machine (CFM) over P is a tuple A = ((P p ) p2P , ⌃). For each p 2 P, P p = (Q p , ⌃ p , p , `0p ) is a finite labeled transition system where Q p is a finite set of local (control) states, p ✓ Q p ⇥ Act p ⇥ Q p is the transition relation, and `0p 2 Q p is the initial state. Moreover, ⌃ = S p2P ⌃ p .

Given p 2 P and a transition t = (`, ↵, `0) 2 p , we let source(t) = `, target(t) = `0, action(t) = ↵, and

msg(t) = m if ↵ 2 Send(m) [ Rec(m).
We now define the operational semantics of a communicating system A as the transition system of the FIFO machine M A = (Q A , Ch, ⌃, T A , `0A ). We define M A as follows. The set of control-states is the Cartesian product of the sets of local states of each process,

Q A = Q p2P Q p . Moreover, `0A = (`0 p ) p2P and T A ✓ Q A ⇥ Act ⇥ Q A .
The set of transitions can be described as follows: there is a transition ((`p) p2P , ↵, (`0 p ) p2P ) 2 T A if (`p, ↵, `0 p ) 2 p for some p 2 P and for all q 6 = p, `q = `0 q .

Example 2 (Connection-Deconnection Protocol). A model for the (simplified) connection-deconnection protocol, CDP, between two processes is described as follows (see Figure 2.2): We model the protocol with two processes and two (unbounded) channels. The first process (on the left) can open a session (this is denoted by sending the message "a" through channel c 1 to the other process). Once a session is open, the first process can close it (by sending message "b" to the other process), or upon demand of the second process (if it receives the message "e"). This protocol has been studied in [START_REF] Jard | Specification of Properties is Required to Verify Distributed Algorithms[END_REF][START_REF] Thierry | Testing for unboundedness of Fifo channels[END_REF].

In the example, it is natural to consider a system of two processes p, q. However, we formalize this in terms of the associated FIFO machine. That is, the CDP is modeled as the FIFO machine M A = (Q A , Ch, ⌃, T A , `0A ) where Q A = {0, 1} ⇥ {0, 1} (the Cartesian product of the local states) with initial state `0A = (0, 0), Ch = {(p, q), (q, p)}, ⌃ = ⌃ (p,q) ] ⌃ (q,p) with ⌃ (p,q) = {a, b} and ⌃ (q,p) = {e}. Moreover, the transition relation T contains, amongst others, ((0, 0), h(p, q)!ai, (1, 0)) and ((1, 0), h(p, q)?ai, (1, 1)).

Message sequence charts

Another (equivalent) way to define the semantics of a communicating system is to consider the interactions between processes graphically. A CFM accepts/generates 0 1 (p, q) (q, p) 0 1 h(p, q)!ai h(p, q)!bi h(q, p)?ei h(p, q)?ai h(p, q)?bi h(q, p)!ei (1) FIFO condition for every pair (e, f ) 2 C, there is a send action h(p, q)!mi such that (e) = h(p, q)!mi, (f ) = h(p, q)?mi, and #Send(p, q)(! + , e) = #Rec(p, q)(! + , f),

(2) for all f 2 E such that (f ) is a receive action, there is e 2 E such that e C f .

Finally, relation  M letting  M = (! [ C) ⇤ , we require that  M is a partial order.
Condition (1) above ensures that every (p2p) channel (p, q) behaves in a FIFO manner. By Condition (2), every receive event has a matching send event. Note that, however, there may be unmatched send events in an MSC. We let

SendEv (M ) = {e 2 E | (e) is a send action}, RecEv (M ) = {e 2 E | (e) is a receive action}, Matched (M ) = {e 2 E | there is f 2 E Matched (M )
such that e C f }, and Unm(M ) Unm(M ) = {e 2 E | (e) is a send action and there is no f 2 E such that e C f }.

We do not distinguish isomorphic MSCs and let MSC be the set of all MSCs over the given sets P and ⌃.

Example 3. For a set of processes P = {p, q, r} and a set of messages

⌃ = {m 1 , m 2 , m 3 , m 4 }, M 1 = (E, !, C, )
p q r m 1 m 2 m 3 m 4 Figure 2.3: MSC M 1 Consider M = (E, !, C, ) 2 MSC. A p2p linearization (or simply lineariza- tion) linearization of M is a (reflexive) total order ✓ E ⇥ E such that  M ✓ . Let M = (E, !, C, ) 2 MSC and consider E ✓ E such that E is  M -downward- closed, i.e, for all (e, f ) 2  M such that f 2 E, we also have e 2 E. Then, the MSC (E, ! \ (E ⇥ E), C \ (E ⇥ E), 0
), where 0 is the restriction of E to E, is called a prefix of M . In particular, the empty MSC is a prefix of M . We denote the set of prefixes of M by Pref (M ). This is extended to sets L ✓ MSC as expected, letting Pref (L) = S M 2L Pref (M ).

Let M 1 = (E 1 , ! 1 , C 1 , 1 ) and M 2 = (E 2 , ! 2 , C 2 , 2 ) be two MSCs. Their concatenation M 1 • M 2 = (E, !, C, ) is defined if, for all (p, q) 2 Ch, e 1 2 Unm(M 1 ), and e 2 2 E 2 such that (e 1 ) 2 Send(p, q) and (e 2 ) 2 Send(p, q), we have e 2 2 Unm(M 2 ). As expected, E is the disjoint union of E 1 and

E 2 , C = C 1 [C 2 ,
is the "union" of 1 and 2 , and

! = ! 1 [ ! 2 [ R.
Here, R contains, for all p 2 P such that (E 1 ) p and (E 2 ) p are non-empty, the pair (e 1 , e 2 ) where e 1 is the maximal p-event in M 1 and e 2 is the minimal p-event in M 2 . Note that M 1 • M 2 is indeed an MSC and that concatenation is associative. Now, given a communicating system S, we will define the language of S directly as a set of MSCs. This semantic view is essentially equivalent to the transition system view we defined earlier, but they have di↵erent advantages depending on the context. Let M = (E, !, C, ) be an MSC. A run of S on M is a mapping run on MSC ⇢ : E ! S p2P p that assigns to every event e the transition ⇢(e) that is executed at e. Thus, we require that (i) for all e 2 E, we have action(⇢(e)) = (e), (ii) for all (e, f ) 2 !, target(⇢(e)) = source(⇢(f )), (iii) for all (e, f ) 2 C, msg(⇢(e)) = msg(⇢(f )), and (iv) for all p 2 P and e 2 E p such that there is no f 2 E with f ! e, we have source(⇢(e)) = `0p .

The L p2p (S) (p2p) language of S is L p2p (S) = {M 2 MSC | there is a run of S on M }. Note that, as in [BEJQ18, DGLL20], we do not consider final states, as our purpose is to reason about all possible traces that can be generated by S. Moreover, we see that L p2p (S) is prefix-closed, i.e., Pref (L p2p (S)) ✓ L p2p (S).

Mailbox semantics

A di↵erent model of communication is with the mailbox semantics, also known as ⇤ 1 mailbox, where every process receives from a single channel. The notions we had for the peer-to-peer case can be directly extended for the mailbox case as well. However, we need to add constraints to the MSC representation in order to accommodate for this change.

Definition 2.5. Let mailbox semantics @ M ✓ E ⇥ E be defined by: e 1 @ M e 2 if there is q 2 P such that (e 1 ) 2 Send( , q), (e 2 ) 2 Send( , q), and one of the following holds:

• e 1 2 Matched (M ) and e 2 2 Unm(M ), or

• e 1 C f 1 and e 2 C f 2 for some f 1 , f 2 2 E q such that f 1 ! + f 2 .
We let

relation M M = (! [ C [ @ M ) ⇤ . Note that  M ✓ M . We call M 2 MSC a mailbox MSC if M is
a partial order. Intuitively, this means that events can be scheduled in a way that corresponds to the mailbox semantics, i.e., with one incoming channel per process. Following the terminology in [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF], we also say that a mailbox MSC satisfies causal delivery. The set of mailbox MSCs M 2 MSC is denoted by MSC mb .

Example 4. MSC M 1 is a mailbox MSC. Indeed, even though the order defined in Example 3 does not respect all mailbox constraints, particularly the fact that e 4 @ M 1 e 1 , there is a total order ◆ M 1 such that e 2 e 3 e 0 3 e 4 e 1 e 0 2 e 0 4 . We call a mailbox linearization, which is formally defined below.

Similar to the notion of a p2p linearization, a mailbox linearization of M is a total order ✓ E ⇥ E such that M ✓ . That is, every mailbox linearization is a p2p linearization, but the converse is not necessarily true (Example 4). Note that an MSC is a mailbox MSC i↵ it has at least one mailbox linearization.

Lemma 2.6. Every prefix of a mailbox MSC is a mailbox MSC.

Proof. Let M = (E, !, C, ) 2 MSC mb and M 0 = (E 0 , ! 0 , C 0 , 0 ) be a prefix of M , i.e., E 0 ✓ E. By contradiction, suppose that M 0 is not a mailbox MSC. Then, there are distinct e, f 2 E 0 such that e M 0 f M 0 e with M 0 = (! 0 [ C 0 [ @ M 0 ) ⇤ . As E 0 ✓ E, we have that ! 0 ✓ !, C 0 ✓ C, and @ M 0 ✓ @ M . Finally, M 0 ✓ M and M is not a mailbox MSC, which is a contradiction.

We concatenate mailbox MSCs in the same way as their p2p counterparts. Moreover, concatenation is associative for mailbox MSCs as well.

Similar to the notion of the p2p language of a communicating system S, we define the mailbox language L mb (S) as follows. The mailbox language of S is L mb (S) = {M 2 MSC mb | there is a run of S on M }.

And finally, from Lemma 2.6, we obtain prefix closure for mailbox systems as well.

Lemma 2.7. For all com 2 {p2p, mb}, L com (S) is prefix-closed: Pref (L com (S)) ✓ L com (S).

Example 5. Fig. 2.4 depicts A 1 = (A p , A q , A r ) such that MSC M 1 in Fig. 2.3 belongs to L p2p (A 1 ) and to L mb (A 1 ). There is a unique run ⇢ of A 1 on M 1 . We can see that (e 0 3 , e 4 ) 2 ! and target(⇢(e 0 3 )) = source(⇢(e 4 )) = `1 r , (e 2 , e 0 2 ) 2 C M 1 , and msg(⇢(e 2 )) = msg(⇢(e 0

2 )) = m 2 .

`0 p `1 p `2 p h(p, q)!m 1 i h(q, p)?m 2 i Ap `0 q `1 q `2 q `3 q h(q, p)!m 2 i h(q, r)!m 3 i h(r, q)?m 4 i Aq `0 r `1 r `2 r h(q, r)?m 3 i h(r, q)!m 4 i Ar

Counter machines

Counter machines, also known as Minsky machines, are finite-state machines that manipulate counters, which are variables that store non-negative integers. Transitions of a counter machine, besides changing control-states, perform a specified operation on a counter: increment by one, decrement by one, along with a set of counters to be tested for zero. We formally define a counter machine below.

Definition 2.8. A counter machine (with zero tests) is a tuple counter machine C = (Q, V, T, q 0 ). Here, Q is the finite set of control-states and q 0 2 Q is the initial control-state. Moreover, V is a finite set of counters and

T ✓ Q ⇥ Act C ⇥ Q is the transition relation where Act C = {inc(v), dec(v), noop | v 2 V } ⇥ 2 V (
an element of 2 V will indicate the set of counters to be tested to 0). The counter machine C induces an LTS transition system induced by counter machine

S C = (X C , Act C , ! C , init) with set of states X C = Q ⇥ N V .
In (q, `) 2 X C , the first component q is the current control-state and `= (`v) v2V represents the counter values. The initial state is then init = (q 0 , `0) with all `0 = (0, 0, . . . , 0).For op 2 {inc, dec}, v 2 V , and Z ✓ V (the counters tested for zero), there is a transition (q, `) op(v),Z ! C (q 0 , m) if (q, (op(v), Z), q 0 ) 2 T , `v0 = 0 for all v 0 2 Z (applies the zero tests),

m v = `v + 1 if op = inc and m v = `v 1 if op = dec, and m v 0 = `v0 for all v 0 2 V \ {v}.
For op = noop, and Z ✓ V , there is a transition (q, `) op,Z ! C (q 0 , m) if (q, (op, Z), q 0 ) 2 T , `v0 = 0 for all v 0 2 Z (applies the zero tests), and m v = `v for all v 2 V . We sometimes omit writing noop and label the transition with only the set of counters to be tested to zero, or we write zero(Z). Similarly, we omit Z if

Z = ;.
The model of (deterministic) counter machines is Turing-complete, and therefore all the verification problem we looked at in Section 2.1 is undecidable (even for machines with 2 counters). Hence, in this thesis, we look at a weakening of this model, which we refer to as counter machines with restricted zero tests.

Counter machines with restricted zero tests. We define counter machines with restricted zero tests (CMRZ) counter machine with restricted zero tests (CMRZ) imposing the following requirement: Once a counter has been tested for zero, it cannot be incremented or decremented any more. Formally, we say that C is a counter machine with restricted zero tests if for all transition sequences of the form q 0 op(v 1 ),Z 1

! q 1 op(v 2 ),Z 2 ! . . . op(v n 1 ,Z n 1 ) ! q n 1 op(vn),Zn
! q n , for every two positions 1  i  j  n, we have v j 6 2 Z i .

Finite-state automata

We now formally recall the notion of a finite-state automaton (also known as finitestate machine or FSM in the literature). A finite-state automaton (deterministic) finite-state automaton (DFA) is a tuple A = (Q, ⌃, , q 0 , F), where Q is the set of control-states, ⌃ is the input alphabet, q 0 2 Q is the initial state, and F ✓ Q is the set of final (or accepting) states. We define the transition relation as :

Q ⇥ ⌃ ! Q.
A non-deterministic finite-state automaton (NFA) is the same as a DFA, except that the transition relation is : Q ⇥ ⌃ ! P(Q), where P(Q) is the power set of Q. We say that a word w is accepted by a DFA A if and only if starting from q 0 , it can read w (according to the transition function) and reach a state q 2 F. By abuse of notation, we denote this as ⇤ (q 0 , w) = q. The language of an automaton A, denoted by L(A) is the set of all accepted words. We call a DFA A complete complete DFA if for every q 2 Q and for every m 2 ⌃, (q, m) is defined. Moreover, we call a DFA trimmed trimmed DFA if for every state q 2 Q, there exists a word w 2 ⌃ ⇤ such that ⇤ (q, w) = q f where q f 2 F, i.e., from every state of the DFA, we can reach a final state. Note that given an untrimmed DFA A, we can construct a trimmed DFA A 0 such that L(A) = L(A 0 ). We do this by removing all the states (and associated transitions) that do not reach a final state, and doing this does not alter the language of the automaton.

Chapter 3

Branch-Well-Structured Transition Systems

Let us recall that a well-structured transition system (WSTS) is an ordered transition system S = (X, !, ) such that the set X is quasi-ordered by , and ! fulfills one of various possible monotonies with respect to . The quasi-ordering of X is further assumed to be well, i.e., well-founded and with no infinite antichains.

In this chapter, we introduce branch-well-structured transition systems (branch-WSTS). Branch-WSTS is a relaxation of general WSTSs. In the case of branch-WSTS, the set of states in the same branch of the reachability tree forms a well-quasi-ordered set, and monotony is enforced only between states reachable one from another.

As boundedness and termination are decidable for WSTS with some e↵ectivity conditions, it is a model that has been studied since its inception in [START_REF] Finkel | Reduction and covering of infinite reachability trees[END_REF]. We show that the branch relaxation still preserves the decidability of boundedness and termination if the underlying system is e↵ective.

We show that for branch-WSTS, the coverability problem is undecidable, which leads to another definition of monotony, the so-called cover-monotony, which is still a relaxation of the monotony condition. We call the class of ordered transition systems cover-WSTS if the ordering is a wqo and the monotony enforced is the cover-monotony. For e↵ective cover-WSTS S = (X, !, ), i.e., systems such that X is a well-quasi-ordered set over , and ! is cover-monotone with respect to , the decidability of coverability from the initial state is still decidable, using the forward algorithm from [START_REF] Blondin | Well Behaved Transition Systems[END_REF].

We also explore the systems which fall into these two WSTS classes, including (normalized) input-bounded FIFO systems and counter machines with restricted zero tests [START_REF] Bollig | Bounded Reachability Problems Are Decidable in FIFO Machines[END_REF], which are branch-WSTS, and a class of counter systems which are cover-WSTS. 25

Orderings

Let X be a set and  ✓ X ⇥ X a binary relation over X, which we also write as (X, ). We call  a quasi, partial, and total ordering quasi-ordering if it is reflexive and transitive. When a set X is equipped with a quasi-ordering , we refer to it as a qo (X, ). A partial ordering is a quasi-ordering that is also anti-symmetric (if x  y and y  x, then x = y.) Furthermore, it is a total ordering (sometimes also known as a linear ordering) if for any x, y 2 X, we either have x  y or y  x. We write x < y if x  y and y ⇥ x. If  is a partial ordering, x < y is then equivalent to x  y and x 6 = y. An antichain antichain of (X, ) is a subset Y ✓ X such that elements of Y are pairwise incomparable (i.e., for all y, y 0 2 Y, y 6 = y 0 =) y ⇥ y 0 ). Given (X, ) a (quasi-)ordered set, the upward, downward closure

upward closure (in X) of a set E ✓ X is "E = {y 2 X | 9x 2 E, x  y} and conversely, the downward closure of E is #E = {y 2 X | 9x 2 E, y  x}. E is upward-closed (resp. downward-closed ) if E = "E (resp. E = #E). A downward-closed (resp. upward-closed) set E has a basis basis B if E = #B (resp. E = "B
). E has a finite basis if B can be chosen finite.

For example, let X ✓ N 2 such that X = {(x, y) | x + y 1}. X can be expressed as the upward closure of the finite basis B = {(0, 1), (1, 0)}, and

X = "{(0, 1), (1, 0)}.
An upper bound of E ✓ X, if it exists, is an element x 2 X such that y  x for every y 2 E. The least upper bound of a set E, if it exists, is written lub(E).

Well-orderings

A quasi-ordered set (X, ) is well founded if there is no infinite strictly decreasing sequence

x 1 > x 2 > . . . of elements of X. It is well-quasi- ordered set (wqo)
well if there is also no infinite antichain. There are equivalent formulations for the definition of well-quasi-ordered set (wqo for short), as given by the following proposition: Proposition 3.1. [START_REF] Joseph | The theory of well-quasi-ordering: A frequently discovered concept[END_REF] Given a quasi-ordered set (X, ), the following properties are equivalent:

• (X, ) is well-quasi-ordered.
• (X, ) is well founded, and there is no infinite antichain in (X, ).

• From any infinite sequence x 0 , x 1 , x 2 . . . one can find i < j such that x i  x j .

• From any infinite sequence x 0 , x 1 , x 2 . . . one can extract an infinite increasing subsequence.

• Any non-empty upward closed subset of X admits a finite basis.

Default orderings

Some common sets and the associated orderings that we study are listed below.

• The set of natural numbers N and integers Z are ordered by their canonical ordering . Moreover, (N, ) is a wqo. On the other hand, (Z, ) is not a wqo as we can have an infinite decreasing sequence, e.g., 0 > 1 > 2 > . . .

• (N k , ), i.e.
, the set of vectors of k 1 natural numbers with component-wise ordering, is a wqo [START_REF] Leonard | Finiteness of the Odd Perfect and Primitive Abundant Numbers with n Distinct Prime Factors[END_REF]. More generally, if (X, ) is wqo, then the set of vectors of k elements of X with the component-wise ordering, (X k , ), is also a wqo.

• The set of finite words over a finite alphabet ⌃, i.e., ⌃ ⇤ , along with the prefix ordering prefix ordering , which we denote by , where

u w i↵ w = u • v for u, v, w 2 ⌃ ⇤ . (⌃ ⇤
, ) is not a wqo if |⌃| 2 as we can find an infinite antichain. For example, let ⌃ = {a, b}. Then, a ba bba . . . is an infinite sequence of incomparable elements.

• We can also define the subword ordering subword ordering  sw on the set of finite words over a finite alphabet ⌃, which we will denote by  sw . (⌃ ⇤ ,  sw ) is a wqo, as in [START_REF] Higman | Ordering by Divisibility in Abstract Algebras[END_REF].

• We sometimes use the extended ordering, when talking about states which are, in fact, tuples, with the first component being the control-state and the other component(s) being integers, words, etc. In this case, the ordering is equality on the control-states, and the (component-wise) canonical ordering on the other components. For example, the extended prefix ordering extended prefix ordering  p  p is defined on Q ⇥ (⌃ ⇤ ) k by (q, w)  p (q 0 , w 0 ) if q = q 0 and for all 1  i  k, one have w i w 0 i , where w = (w i ) 1ik , w 0 = (w 0 i ) 1ik .

Well-structured transition systems

An important class of transition systems that we will consider are well-structured transition systems, or WSTS for short, for which many properties are known to be decidable.

A (well-)ordered transition system is a tuple S = (X, !, ) consisting of a transition system S = (X, !), equipped with a (well) qo (X, ). ordered labeled transition system (OLTS)

We extend these definitions for labeled transition systems: An ordered labeled transition system (OLTS) is a tuple S = (X, A, !, init, ) consisting of a labeled transition system S = (X, A, !, init), equipped with a qo (X, ).

Branch-Well-Structured Transition Systems

There are di↵erent monotony properties that the transition relation can fulfill. We define here the most important ones. Definition 3.2. [START_REF] Finkel | Well-structured transition systems everywhere![END_REF] wellstructured transition system (WSTS)

A well-structured transition system (WSTS) is a wellordered transition system S = (X, !, ) that satisfies monotony: for all x, x 0 , y 2 X, we have: x  y ^x ! x 0 =) 9y 0 2 X: x 0  y 0 ^y ⇤ ! y 0 .

We define a labeled WSTS as an OLTS such that the ordering is well and it satisfies the monotony condition: for all x, x 0 , y 2 X and a 2 A, we have:

x  y ^x a ! x 0 =) 9y 0 2 X and w 2 A ⇤ : x 0  y 0 ^y w ! y 0 .
Let us define the other types of monotony. We say that a well-ordered transition system S = (X, !, ) satisfies other monotonies strong monotony (resp., transitive monotony ) if, for all x, y, x 0 2 X such that x  y and x ! x 0 , there is y 0 2 X such that x 0  y 0 and y ! y 0 (resp., y + ! y 0 ). The transition system S satisfies strict monotony if, for all x, y, x 0 2 X such that x < y and x ! x 0 , there is y 0 2 X such that x 0 < y 0 and y ⇤ ! y 0 . We can similarly define these monotonies for ordered labeled transition systems.

Decidability of verification problems for WSTS. In order to be able to decide the problems defined in Section 2.1 for WSTS, we need to require that the transition systems have some e↵ectiveness properties. Throughout this work, WSTS will be assumed e↵ective in the following sense:

1. the set of states X is recursively enumerable (which su ces to compute P ost S (x) when |P ost S (x)| is known and finite) e↵ectivity conditions for WSTS , 2. the transition relation is decidable, i.e., the WSTS comes equipped with an algorithm that can decide, given x, y 2 X, whether x ! y or, equivalently, whether y 2 P ost S (x), 3. the quasi-ordering  is decidable, i.e., the WSTS also comes equipped with an algorithm that can decide, given x, y 2 X, whether x  y.

Branch-WSTS

As we saw in Section 2.1, boundedness and termination are important problems in the study of transition systems, and they are decidable for a large class of systems. In this section, we propose a relaxation to the definition of well-structured transition systems (WSTS), and still retain the decidability of boundedness and termination. Let us define the model formally. Let S = (X, A, !, init, ) be an ordered labeled transition system. A run, or a branch branch , of S is a finite or infinite sequence ⇢ = (x 0 ! x 1 )(x 1 ! x 2 ) . . ., simply written x 0 ! x 1 ! x 2 . . ..

Branch-wqo

Consider an ordered labeled transition system, S = (X, A, !, init, ). We say that ⇢ is branch-wqo if the set of states {x 0 , x 1 , x 2 , . . .} visited along ⇢ is wqo with respect to . Definition 3.3. An ordered labeled transition system S = (X, A, !, init, ) is branch-wqo branch-wqo if every run of S starting from init is branch-wqo.

Example 6. Consider the FIFO machine M 1 in Figure 3.1 with one FIFO channel c. In control-state 0, it makes a loop by sending the letter a to the channel. Then, we may go, non-deterministically, to control-state 1 by sending the letter b once, and then we either stop or consume a b and go to 2 if possible. Let us consider the set of states X 1 = {0, 1} ⇥ {a, b} ⇤ together with the extended prefix ordering  p . The reachability set of

M 1 from (0, ") is equal to {(0, w), (1, w 0 ) | w 2 a ⇤ , w 0 2 a ⇤ b}. Note that  p is not a wqo since elements of the set {(1, w) | w 2 a ⇤
b} form an infinite antichain for  p . However, every branch in the reachability tree of M 1 is branch-wqo for the initial state (0, "). Hence, there exist branch-wqo ordered labeled transition systems S = (X, A, !, init, ) such that (X, ) is not a wqo.

Note that the property of branch-wqo for a given system depends on the initial state. There could be a system S = (X, A, !, init, ) and init 0 2 X such that S is branch-wqo but S = (X, A, !, init 0 , ) is not branch-wqo (cf. Figure 3.2).

Branch-monotony

We now define a generalization of strong monotony, which we refer to as branchmonotony.

Definition 3.4. An ordered labeled transition system S = (X, A, !, init, ) is branch- monotony branch-monotone if, for all x, x 0 2 X, 2 A ⇤ such that init ⇤ !
x ! x 0 and x  x 0 , there exists a state y such that x 0 ! y and x 0  y.

Let us remark that branch-monotone systems have strong (hence, transitive) monotony. As in the case of general monotony, strict branch-monotony is defined using strict inequalities in both cases: An OLTS S = (X, A, !, init, ) is strictly branch-monotone if, for all x, x 0 2 X, 2 A ⇤ such that init ⇤ ! x ! x 0 and x < x 0 , there exists a state y such that x 0 ! y and x 0 < y.

Example 7. Consider M 1 from Figure 3.1 once again. M 1 along with the extended prefix ordering  p induces an ordered labeled transition system by considering the actions on the edges to be the labels. Let us show that it is branch-monotone. Let us consider two states x, x 0 2 X such that init ⇤ ! x ! x 0 and x  x 0 . By the definition of the extended prefix ordering, we know that the control-state of x and x 0 need to be the same. Moreover, when we look at the FIFO machine, we see that the only possibility for x 0 to be reachable from x and x  x 0 is if the control-state for both x and x 0 is 0. Furthermore, the only option is x = (0, a n ) and x 0 = (0, a n+k ) for n, k 2 N. Once again, from the figure, we see that there exists a transition sequence such that (0, a n ) ! (0, a n+k ), where = (hc!ai) k . Finally, we can see that x 0 ! y such that y = (0, a n+k+k ) and hence, x 0  y. We deduce that M 1 is branch-monotone.

Note that if we consider the extended subword ordering for the FIFO system in

!

(2, "). However, this transition is not possible from (1, ab). Nevertheless, by the same argument as above, M 1 is branch-monotone for the extended subword ordering.

Branch-WSTS

We are now ready to extend the definition of WSTS.

Definition 3.5. A branch-WSTS is an OLTS S = (X, A, !, , init)
branch-WSTS that is finitely branching, branch-monotone, and branch-wqo.

When we say, without ambiguity, that a machine M is branch-wqo, WSTS, or branch-WSTS, we mean that the ordered transition system S M , associated with machine M, is branch-wqo, WSTS, or branch-WSTS, respectively. Branch-WSTS is a strict superclass of labeled WSTS. For example, machine M 1 in Figure 3.1 is branch-WSTS for the ordering but it is not WSTS for since is not a wqo on {q 0 , q 1 } ⇥ {a, b} ⇤ or on the subset {(q 1 , w) | w 2 a ⇤ b}.

Termination and Boundedness for Branch-WSTS

In this section, we will examine the two verification problems of termination and boundedness for branch-WSTS.

Let us recall the Reduced Reachability Tree (RRT ) Reduced Reachability Tree (RRT)

, which was defined as Finite Reachability Tree in [START_REF] Finkel | Well-structured transition systems everywhere![END_REF]. Suppose that S = (X, A, !, , init) is an OLTS. Then, the Reduced Reachability Tree from init, denoted by RRT (S, init), is a tree where nodes are labeled by states of X, and n(x) denotes that node n is labeled by state x. Nodes are either dead or live. The root node n 0 (init) is live. A dead node has no child node. A live node n(y) has one child n 0 (y 0 ) for each successor y 0 2 P ost S (y). If there is a path in the tree n 0 (init) ⇤ ! n 0 (y 0 ) + ! n(y) such that n 0 6 = n and y 0  y, we say that n 0 subsumes n, and then n is dead. Otherwise, n is live.

(q 0 , ")

(q 1 , b) (q 0 , a) dead Figure 3.3:
The Reduced Reachability Tree of M 1 (from Figure 3.1) starting from (q 0 , "). Note that (q 0 , a) is dead because it is subsumed by state (q 0 , "). As a matter of fact, we have (q 0 , ") ⇤ ! (q 0 , a) and (q 0 , ")  p (q 0 , a). State (q 1 , b) is also dead but it is not subsumed. Proposition 3.6. Let S = (X, A, !, , init) be an OLTS that is finitely branching and branch-wqo. Then, RRT (S, init) is finite.

Proof. Let us assume that the RRT (S, init) is infinite. Since (S, init) is finitely branching and branch-wqo, there is an infinite branch, in the reachability tree, beginning with the finite prefix n 0 (init)

⇤ ! n 1 (x 1 ) + ! n 2 (x 2 ) + ! n 3 (x 3 ), in RRT (S, init),
such that nodes n 0 , n 1 , n 2 , n 3 are all di↵erent and x 1  x 2  x 3 . Hence, the node n 2 (x 2 ) has been marked as dead, and the tree has not been explored any further. Thus, there is a contradiction. Hence, RRT (S, init) is finite.

Proposition 3.7. Let S = (X, A, !, , init) be a branch-WSTS, equipped with strict branch-monotony and such that  is a partial ordering. The reachability set P ost ⇤ S (init) is infinite i↵ there exists a branch n 0 (init)

⇤ ! n 1 (x 1 ) + ! n 2 (x 2 ) in RRT (S, init) such that x 1 < x 2 .
Proof. The following proof is an adaptation of the proof of boundedness for WSTS in [START_REF] Finkel | Well-structured transition systems everywhere![END_REF] to branch-WSTS. Let us assume (S, init) is unbounded, i.e.,

P ost ⇤

S (init) is infinite. Then, there are an infinite number of distinct states which are reachable from init. We first show that there exists a computation starting from init without any loop, where all states are distinct. We consider the finitely branching tree of all prefixes of computations, and prune this tree by removing prefixes that contain a loop. Because any reachable state can be reached without a loop, the pruned tree still contains an infinite number of prefixes. By König's lemma, there exists an infinite computation with no loop. Any computation starting from init has a finite prefix labeling a maximal path in RRT (S, init). To simplify the notations, we use nodes and states synonymously without ambiguity. Hence, there must be a node x 2 which is subsumed by a node x 1 such that x 1 6 = x 2 . Since we assumed  to be a partial ordering, we deduce from x 1 6 = x 2 , and

x 1  x 2 that x 1 < x 2 .
Conversely, let us assume that there exist two states x 1 , x 2 in RRT (S, init) such that x 1 ! x 2 and x 1 < x 2 .

Since the system is strictly branch-monotone, there exists a state x 3 such that x 2 ! x 3 and x 2 < x 3 . By iterating this process, we construct an infinite sequence of states (x k ) k 0 such that for all k 1, one has x k ! x k+1 and x k < x k+1 . Since  is a partial ordering, we deduce that all x k are di↵erent. Hence, P ost ⇤ S (init) is infinite, and S is unbounded.

We now need a notion of e↵ectivity adapted to branch-WSTS.

Definition 3.8. branch-e↵ective

A branch-WSTS S = (X, A, !, , init) is branch-e↵ective if S is e↵ective, and P ost S (x) is a (finite) computable set, for all x 2 X. Theorem 3.9. Boundedness is decidable for branch-e↵ective branch-WSTS S = (X, A, !, , init) with strict branch-monotony such that  is a partial ordering.

Proof. Suppose S = (X, A, !, , init) satisfies the above conditions. From Proposition 3.6, we obtain that RRT (S, init) is finite. By hypothesis, S is finitely branching and branch-e↵ective. In particular, for all x, P ost S (x) is a finite computable set. As  is decidable, we deduce that RRT (S, init) is e↵ectively computable. From Proposition 3.7, we know that P ost ⇤ S (init) is infinite i↵ there exists a finite branch n 0 (init)

⇤ ! n 1 (x 1 ) + ! n 2 (x 2 ) such that x 1 < x 2 .
This last property can be decided on RRT (S, init), and so the boundedness property can be decided, too.

We also generalize the decidability of termination for WSTS [START_REF] Finkel | Well-structured transition systems everywhere![END_REF] to branch-WSTS.

Proposition 3.10. A branch-WSTS S = (X, A, !, , init) does not terminate from state init i↵ there exists a subsumed node in RRT (S, init).

Proof. Let us assume that S is non-terminating. Then there exists an infinite branch b : n 0 (init) ! n 1 (x 1 ) ! n 2 (x 2 ) ! n 3 (x 3 ) ! ... in the reachability tree of (S, init). Since S is branch-wqo, consider the first index i such that there is an j > i such that x i  x j . Now, we say that the prefix of the branch b containing the first j + 1 nodes, n 0 (init)

⇤ ! n i (x i ) ⇤ ! n j (x j
), necessarily appears in RRT (S, init). Node n i subsumes node n j .

Conversely, let us assume that there is a subsumed node in RRT (S, init). Then there exists a branch in RRT (S, init) of the form

n 0 (init) ⇤ ! n 1 (x 1 ) a 1 ! n 2 (x 2 ) . . . a k ! n k+1 (x k+1 ) such that x 1  x k+1 .
From the remark following the definition of branch-monotony, we deduce that one may repeat the sequence = a 1 a 2 . . . a k with 6 = ", and then there exists an infinite branch in the reachability tree. Hence, the system does not terminate.

Theorem 3.11. Termination is decidable for branch-e↵ective branch-WSTS.

Proof. Given a branch-WSTS S = (X, A, !, , init), we apply Proposition 3.10 so that it is su cient to build RRT (S, init) and check if there exists a subsumed node. Since S is branch-e↵ective, we can e↵ectively construct RRT (S, init) and verify the existence of a subsumed node.

Note that we can thus solve the termination and boundedness problems for the example machine M 1 , and since there exist nodes n 0 (init) and n 1 (x 1 ) in the RRT such that init = (q 0 , ") and x 1 = (q 0 , a) such that init < x 1 and init + ! x 1 , the machine M 1 is unbounded. Moreover, since n 1 (x 1 ) is also a subsumed node, it is non-terminating. An even simpler argument is that any unbounded system is non-terminating.

On the other hand, boundedness becomes undecidable if we relax the strict monotony condition to general monotony (even when we strengthen the order to be wqo). This is because boundedness is undecidable for Reset Petri nets [START_REF] Dufourd | Reset nets between decidability and undecidability[END_REF]. Reset Petri nets are e↵ective WSTS S = (X, A, !, , init), hence branch-e↵ective WSTS, where  is the wqo on vectors of integers. Hence, we deduce: Proposition 3.12. Boundedness is undecidable for branch-e↵ective branch-WSTS.

Classes of branch-WSTS

We now look at some examples of systems which are branch-WSTS (but not WSTS).

Counter machine with restricted zero tests

In [START_REF] Bollig | Bounded Reachability Problems Are Decidable in FIFO Machines[END_REF], it was shown that termination and boundedness (and moreover, reachability) are decidable for this class of systems. However, using the alternative approach of branch-WSTS, we can verify that termination and boundedness are decidable for this class without reducing these problems to reachability.

Given a CMRZ C = (Q, V, T, q 0 ), we consider the associated transition system S C = (X C , Act C , ! C , init). From this system, we construct an OLTS over the extended ordering  such that (q, v)  (q 0 , v 0 ) i↵ q = q 0 and v  v 0 (componentwise). Note that (X C , ) is a wqo. Moreover, this ordering is a partial ordering.

We now show that CMRZ are branch-monotone for . We drop the subscript while denoting X C for the remainder of this section, as it is clear from the context. Proposition 3.13. CMRZ are branch-monotone and strictly branch-monotone for the wqo .

Proof. Consider the OLTS S = (X, A, !, , init) associated to a CMRZ with states x, x 0 2 X such that x  x 0 (resp. x < x 0 ) and init ⇤ ! x ! x 0 . We need to show that there exists a state y such that x 0 ! y and x 0  y (resp. x 0 < y).

We first prove the following claim:

Claim: For states x, x 0 2 X such that init ⇤ ! x ! x 0 where x  x 0 (resp.

x < x 0 ) and | | = n, the following property holds: For all ⌫ , we have z, z 0 2 X such that x ⌫ ! z and x 0 ⌫ ! z 0 and z  z 0 (resp. z < z 0 ). We prove this claim by induction on the length of ⌫.

For the base case, |⌫| = 0. We have from the hypothesis, x  x 0 , hence the claim is trivially true.

Let us assume that the claim holds for |⌫| = k. We show that it holds for |⌫| = k + 1. From the induction hypothesis, we know that for ⌫ = ⌫ 0 • a where a 2 A, there exists z 1 , z 0 1 such that x

⌫ 0 ! z 1 and x 0 ⌫ 0 ! z 0 1 and z 1  z 0 1 . Since x ! x 0 , we know that there exists z 2 X such that x ⌫ 0 ! z 1 a ! z.
We can now be in one of the following cases:

Case i: If a is of the form noop and Z = ;, then we can trivially execute a from z 0 1 and reach z 0 such that z  z 0 (resp. z < z 0 ).

Case ii:

The action a is of the form inc(v) or dec(v), and the set of counters to be tested for zero Z = ;, i.e., z 1 a ! z only increments one counter and leaves the others unchanged (and no counters are tested to zero). Since z 1  z 0 1 (resp. z 1 < z 0 1 ), we know that z 1 , z 0 1 have the same control-state. Hence, this action is enabled in z 0 1 . Moreover, because of the CMRZ property, we know that v is not tested to zero even once until the state z 0 1 is reached in this run. Therefore, we can execute the increment/decrement operation on v. Furthermore, since z 1  z 0 1 (resp. z 1 < z 0 1 ), the value of v in z 0 1 is greater than or equal to (resp. strictly greater than) the value of v in z 1 . Hence, we can execute a from z 0 1 and reach a state z 0 such that z  z 0 (resp. z < z 0 ).

Case iii: Z 6 = ; in the transition z 1 a ! z. Hence, there are a set of counters Z which are tested to zero. By the CMRZ property, we know that all counters v 2 Z, are never incremented or decremented further. Hence, during the execution

z 1 a ! z w ! z 0
1 where w 2 A ⇤ , we know that none of these counters are incremented or decremented. Hence, the value of the counters in z 0 1 is also equal to zero. Therefore, we can execute a from z 0 1 to reach z 0 . Moreover, since z 1  z 0 1 (resp. z 1 < z 0 1 ), and none of these counters change their value, we can conclude that z  z 0 (resp. z < z 0 ). Hence, as a special case of the claim where ⌫ = , we prove that CMRZ are branch-monotone (resp. strictly branch-monotone).

Proposition 3.14. CMRZs are branch-e↵ective branch-WSTS.

Proof. Given an OLTS S = (X, A, !, , init) associated to a CMRZ, for any two states x, x 0 2 X, we can decide if x  x 0 . Furthermore, since we have a finite automaton, ! is decidable, and P ost S (x) is computable for all x 2 X. Hence, it is branch-e↵ective.

Hence, we deduce: Theorem 3.15. Termination and boundedness are decidable for counter machines with restricted zero tests.

Input-bounded FIFO machines

We now study a subclass of FIFO machines, and investigate if they are branch-WSTS.

Consider a FIFO machine M = (Q, Ch, ⌃, T, q 0 ). We define the input-language of a FIFO channel c as the set of all words that are sent into the channel, i.e., proj c! (Traces(M)). We say that the machine is input-bounded if there is a tuple (L c ) c2Ch of regular bounded languages L c (i.e., languages of the form w ⇤ 1 . . . w ⇤ n ) such that, for all c 2 Ch, proj c! (Traces(M)) ✓ L c , i.e., every run of the FIFO machine is input-bounded language. We say that L is distinct-letter if |w 1 . . . w n | a = 1 for all a 2 ⌃. This class is studied in more depth in Chapter 4. For more precise definitions of these notions, we refer the reader to Section 4.1.

Proposition 3.16. Input-bounded FIFO machines are branch-wqo for the prefixordering  p .

Proof. Let us consider the transition system S M = (X M , Act M , ! M , init M ) associated an input-bounded FIFO machine M with a single channel, and an infinite run

x 0 ! x 1 ! x 2 ! ...x i ... with x i = (q i , w i ) 2 X M and x 0 = init M .
The infinite run is of the form x 0

1 ! x 1 2 ! x 2 ...x i 1 i ! x i i+1 ! . . . and we denote [i] = proj ! ( 1 2 . . . i ). It can be observed that [i] is a prefix of [i +1] for all i 2 N. Since [i] is of the form v n 1,i 1 ...v n m,i m u m for u m v m and n 1,i ..., n m,i 0 and 1  m  k, the infinite sequence ( [i]) i2N satisfies

two possible exclusive cases:

Case i: There exists an i 0 such that 8i i 0 , proj ! ( i ) = ✏ so there exists i 1 i 0 such that for all i i 1 , w i = w i+1 . Hence, because there are finitely many control-states, we deduce that there exist i 2 , i 3 i 1 such that x i 2 + ! x i 3 and

x i 2 = x i 3 , hence, also in particular x i 2  p x i 3 .
Case ii: There are infinitely many indices i such that proj ! ( i ) 6 = ✏, which means that the infinite sequence ( [i]) i2N is not stationary. This implies that the set S = {(n 1,i , ..., n k,i ) | i 2 N}, associated with , is infinite. Hence, there exists a least index p such that the set {n p,i } i2N is infinite. Then the set

F = {(n 1,i , ..., n p 1,i ) | i 2 N} is finite.
We claim that for all indices ` p + 1, n `,i = 0 for all i. Let us assume to the contrary that there is some index ` p + 1 and i 0 such that n `,i 0 6 = 0. This means that the word v `is in the channel in state x i 0 , which means that the word v `was sent to the channel before (or at) the step i 0 , i.e,

[i 0 ] = v n 1,i 0 1 ...v n p,i 0 p ...v n m,i 0 m
u m for some u m v m and n l,i 0 > 0 and 1  m  k. So, in particular, word v p cannot be sent after i 0 , hence, n p,i = n p,i 0 8i > i 0 . Hence, {n p,i } i2N is finite which is a contradiction to our assumption that {n p,i } i2N is infinite. This means that after some state x t , we only write word v p to the channel. Since, the set F = {(n 1,j , ..., n p 1,j ) | j 2 N} is finite, we can extract an infinite subsequence (q, w i ) i2K✓N where w i = uv n p,i p with u 2 F and (n p,i ) i2K is non-decreasing. Hence, there exist two indices a, b > 0 such that w a = u.v np,a p and w a+b = u.v n p,a+b p and n p,a  n p,a+b , hence, w a+b = w a .v n p,a+b np,a p , hence, w a w a+b . So we have found two states x a , x a+b such that x a  p x a+b . Hence, the machine is branch-wqo for the prefix ordering.

We show that it is branch-wqo for a single channel, but using the same argument for each channel, we can conclude that input-bounded FIFO machines with multiple channels are branch-wqo for the prefix-ordering  p .

It is clear that M 1 belongs to this class of FIFO systems. But, we see below that the class of input-bounded FIFO machines is not branch-WSTS.

Example 8. Consider the FIFO machine M 2 in Figure 3.4 that is input-bounded for L = (ab) ⇤ . We have (q 0 , ✏) ! (q 0 , b), where =!a?a!b. Moreover, (q 0 , ✏)  p (q 0 , b). However, we cannot repeat from (q 0 , b), as it is not possible to execute (q 1 , ba) ?a !. Hence, the machine is not branch-monotone for the prefix-ordering.

q 0 q 1 q 2 !a !b ?a Figure 3.4: The FIFO machine M 2
From the above counter-example, we see that the class of distinct-letter inputbounded FIFO machines are not branch-WSTS. Hence, we impose another restriction on such systems.

Consider an input-bounded FIFO machine M = ( Q, Ch, ⌃, T , q0 ) (with a single channel) with a distinct-letter bounded input-language L. We first consider a deterministic, trimmed, (not necessarily complete) finite automaton

A = (Q A , Act M , T A , q 0 A , F A ), with a set of final states F A ✓ Q A , whose language is L(A) = L ! \ Pref (L ? ), where L ! = { | proj ! ( ) 2 L} and L ? = { | proj ? ( ) 2 L}.
With this, we define M = (Q, Ch, ⌃, T, q 0 ) as the product of the FIFO machine M and A in the expected manner. In particular, the set of control-states of M is

Q = Q ⇥ Q A ,
and its initial state is the pair q 0 = ( q0 , q 0 A ).

Note that since M is input-bounded, every run in M belongs to L ! \ Pref (L ? ). Therefore, the language of the new FIFO machine M is the same as the language of the old FIFO machine M, and a subset of the trimmed automata.

Proposition 3.17. The machine M, constructed as a product of a distinct-letter input-bounded FIFO machine M and the deterministic finite automaton of its input language, is branch-compatible.

Proof. Let L = w ⇤ 1 . . . w ⇤ n . Let (q 0 , ") ⌧ ! (q, w) ! (q, w 0
) such that w w 0 . To prove branch-compatibility, we need to show that there exists w 00 such that (q, w 0 ) ! (q, w 00 ) and w 0 w 00 .

Firstly, we know that proj ! (⌧ ) = w n 1 1 . . . w n i i .u i where u i w i and 1

 i  n and n p 2 N for all 1  p  i. Moreover, proj ! ( ) 2 Pref (u 0 i • w n 0 i i . . . w n j j ) where u i .u 0 i = w i and 1  i  j  n.
Let us consider the channel content w now. From the characterization of ⌧ above, we can express w = v `• w n `. . . w n i i .u i , where 1  ` i and v `2 Suf (w `). Now, let us analyze the cases based on the value of proj ? ( ):

• proj ? ( ) = ". In other words, this means that there are only send actions in . Hence, it is possible to take the same sequence of moves once again as we are in the same control-state q. Therefore, (q, w 0 ) ! (q, w 00 ) for some value of w 00 . Furthermore, since has only send actions, w 0 = w.v for some v 2 ⌃ ⇤ . Therefore, after we repeat once again from (q, w 0 ), we reach (q, w 00 ) such that w 00 = w 0 .v = w.v.v. Therefore, (q, w 0 )  p (q, w 00 ) and we are done with this case.

• For proj ? ( ) 6 = ", we can be in one of three cases:

-w 6 = " and 9p 1 , p 2 such that 1  p 1 < p 2  i such that w = v p 1 .v.u p 2
where v p 1 2 Suf (w p 1 ), u p 2 2 Pref (w p 2 ), and v p 1 , v p 2 6 = " and v 2 ⌃ ⇤ . In other words, in this case, there is a non-empty part of at least two distinct words in the channel contents w. Since the FIFO machine is input-bounded, we can conclude that proj ! ( ) does not contain any occurrences of alphabets from the word w p 1 . Therefore, in order for the condition w w 0 to be satisfied, it is necessary that proj ? ( ) = ", which is a contradiction to our assumption. Hence, this case is not valid. -Therefore, if w 6 = " and proj ? ( ) 6 = ", then the only possibility is that

w = v i .w n i i .u i such that v i 2 Suf (w i ).
Therefore, proj ? ( ) only consists of letters from words w j such that j i. However, since w w 0 , we can be certain that it only consists of letters from the word w i (if we start receiving a word w j where j > i then there can be no occurrence of the word w i in the channel). Therefore, proj ? ( ) consists of only letters belonging to w i . Moreover, since proj ! ( ) is non-empty, there is at least one letter that is read from w. Therefore, the first letter that is sent in the sequence most certainly belongs to the word w i (to ensure w w 0 ). Let us consider this subsequence 0 from (q, w) to the first send action.

Let us say we have (q, w) 0 ! (q 0 , v 0 ). Now, since the subsequence 0 only consists of receptions from (q, w), along with the first send action, this subsequence is also possible from (q, w.v) for all v 2 ⌃ ⇤ . Therefore, we can execute the same sequence from (q, w 0 ). Hence, proj ! (⌧. . 0 ) 2 L. Therefore, since Alph(proj ! ( 0 )) 2 Alph(w i ), we can be sure that Alph(proj ! ( )) 2 Alph(w i ). Therefore, only sends and receives letters from a single word w i . Moreover, since the system is input-bounded, and the first send action in 0 matches the first send action in , we see that

w 0 = v i .w n i i .u i .(v 0 i .w n 0 i i .u i ) = w.(v 0 i .w n 0 i i .u i ) such that u i .v 0 i = w i .
Therefore, we can repeat this sequence from (q, w 0 ) and reach a state (q, w 00 ) such that w 0 w 00 , and hence, it is branch-compatible for this case.

-The final case we need to consider is w = ". In this case, it is clear that consists of at least one send action before the first reception. Therefore, because of the input-bounded property and the fact that this action can be executed at (q, w 0 ), we can once again see that proj ! ( ) consists only sending only letters from a single word. Moreover, since the same action can be executed, once again we see that proj ! ( ) = v j .w n j j .u j such that u j .v j = w j . Therefore, proj ? ( ) 2 Pref (v j .w n j j .u j ). Now let us consider the run ⌧. in the automaton A that we constructed. Since ⌧. is a run in M, there is also a run in A such that q 0 A ⌧ ! q s ! q s . Moreover, we can also repeat to obtain q 0 A ⌧ ! q s ! q s ! q s . Therefore, ⌧. . 2 Pref (L ? ). Moreover, since proj ? ( ) 6 = ", proj ? ( ) = u 0 j .w n 0 j j .v 0 j such that v 0 j .u 0 j = w j . Therefore, we can repeat from (q, w 0 ) in M, and we reach a state (q, w 00 ) such that w 0 w 00 .

Hence, we see that for all cases, if (q 0 , ") ⌧ ! (q, w) ! (q, w 0 ) such that w w 0 . then there exists w 00 such that (q, w 0 ) ! (q, w 00 ) and w 0 w 00 . Hence, M is branch-compatible.

We can extend the same argument for each channel in case of multiple channels, and we obtain branch-compatibility for the case of distinct-letter FIFO machines with multiple channels (intersected with the corresponding finite automata).

Example 9. Consider the FIFO machine M 2 as in Figure 3.5 that is inputbounded for L = (ab) ⇤ . As we saw in Example 8, it is not branch-monotone. However, let us consider the product M 0 2 of M 2 along with the finite automaton A that recognizes L ! \ Pref (L ? ). Here, we see that the counter-example we had previously is no longer there. In fact, the loop that could not be realized has now been opened up and we can see that the FIFO machine M 0 2 has only a finite run. Moreover, we see that it is branch-monotone for the prefix-ordering.

LL LR RL RR !a !b !a !b ?a ?b ?a ?b A q 0 q 1 q 2 !a !b ?a M 2 q 0 , LL q 1 , LR q 2 , RR q 0 , RL q 1 , RR !a ?a !b !a M 0 2 Figure 3.5:
The FIFO machine M 2 (right) and the automaton A that recognizes

L ! \ Pref (L ? ) (left) intersect to give M 0 2 (below) which is branch-monotone.
We remark here that in Chapter 4, when we show that input-bounded rationalreachability is decidable, we construct a "normalized" FIFO machine, from the given FIFO machine and bounded language. Using the same principles, we can modify every input-bounded FIFO machine into one that is distinct-letter, and using the product construction from above, we have the following proposition: Proposition 3.18. Normalized input-bounded FIFO machines are branch-e↵ective branch-WSTS (for the prefix ordering).

Proof. Given an input-bounded FIFO machine S M , for any two states x, x 0 2 X, we can decide if x  p x 0 . Furthermore, since we have a finite automaton, ! is decidable, and P ost S (x) is computable for all x 2 X. Hence, it is branch-e↵ective.

Moreover, the extended prefix ordering is a partial ordering. Hence, we deduce: Theorem 3.19. Termination and boundedness are decidable for input-bounded FIFO machines.

Coverability

We look at the notion of coverability now. Let us formally define the problem we are trying to solve.

Decision Problem: COVERABILITY Input: a TS S = (X, !),
x, y 2 X Question: does there exist a y 0 2 P ost ⇤ S (x) such that y  y 0 ?

Coverability is decidable for a large class of WSTS:

Theorem 3.20 ([FS01, A ČJT00]). The coverability problem is decidable for effective WSTS S = (X, !, ) equipped with an algorithm that, for all finite sets I ✓ X, computes a finite basis pb(I) of "P re("I).

Assume S = (X, !, ) is a WSTS and x 2 X is a state. The backward coverability algorithm involves computing (a finite basis of) P re ⇤ ("x) as the limit of the infinite increasing sequence "I 0 ✓ "I 1 ✓ . . . where I 0 = {x} and I n+1 def = I n [ pb(I n ). Since there exists an integer k such that "I k+1 = "I k , the finite set I k is computable (one may test, for all n, whether "I n+1 = "I n ) and I k is then a finite basis of P re ⇤ ("x) so one deduces that coverability is decidable.

Coverability can be also decided by using the forward coverability algorithm that relies on two semi-decision procedures (as described below). It applies to the class of well-behaved transition systems, which are more general than WSTS. A wellbehaved transition system (WBTS) is an ordered transition system S = (X, !, ) with monotony such that (X, ) contains no infinite antichain. We describe e↵ectiveness hypotheses that allow manipulating downward-closed sets in WBTS. But first, we introduce some notions. Ideals. An ideal is a downward-closed set I ✓ X that is also directed, i.e., it is non-empty and, for every x, y 2 I, there exists z 2 I such that x  z and y  z. The set of ideals is denoted by Ideals(X) = {; ⇢ I ✓ X | I = #I and I is directed}. A directed complete partial ordering (dcpo) is an ordered set (X, ) such that every directed set D ✓ X has a least upper bound (lub) in X: for instance, (N, ), with the usual notations, is not a dcpo since the directed set N has no lub in N; if we add the lub ! to N, then (N ! , ) is a dcpo. There is a way to add all lubs to any ordered set (X, ), that is called the ideal completion. The elements of the ideal completion of X are its ideals, i.e., its downward-closed directed families, ordered by inclusion.

Definition 3.21 ([BFM17, Definition 3.4]). A class C of WBTS is ideally e↵ective ideally e↵ective if, given S = (X, ! , ) 2 C,
• the set of encodings of Ideals(X) is recursive,

• the function mapping the encoding of a state x 2 X to the encoding of the ideal #x 2 Ideals(X) is computable;

• inclusion of ideals of X is decidable;

• the downward closure #P ost(I) expressed as a finite union of ideals is computable from the ideal I 2 Ideals(X).

Theorem 3.22 ([BFM17]

). The coverability problem is decidable for ideally e↵ective WBTS.

The proof is done by two semi-decision procedures where downward-closed sets are represented by their finite decomposition in ideals and this is e↵ective. Procedure 1 checks for coverability of y from x, by recursively computing #x, #(#x [ P ost(#x)) and so on. This procedure terminates only if y belongs to one of these sets, hence it terminates if y is coverable. Hence, we deduce: Proposition 3.23 ([BFM17]). For an ideally e↵ective WBTS S = (X, !, ), an initial state x, and a state y, Procedure 1 terminates i↵ y is coverable from x. Procedure 2 enumerates all downward-closed subsets (by means of their finite decomposition in ideals) in some fixed order D 1 , D 2 , . . . such that for all i, D i ✓ X and #P ost(D i ) ✓ D i . We note that this enumeration is e↵ective since S is ideally e↵ective. If such a set D i contains x, it is an over-approximation of P ost ⇤ (x). Hence, if there is such a set D i such that x 2 D i but y / 2 D i , it is a certificate of non-coverability. Moreover, this procedure terminates if y is non-coverable because #P ost ⇤ (x) is such a set, and hence, will eventually be found.

Proposition 3.24 ([BFM17]

). For a WBTS S = (X, !, ), states x and y, Procedure 2 terminates i↵ y is not coverable from x.

Coverability for branch-WSTS

We show that the two existing coverability algorithms for WSTS do not allow one to decide coverability for branch-WSTS. We note that, contrary to WSTS, P re ⇤ ("x) is not necessarily upward-closed. In fact, even for a CMRZ with a single zero-test, this property is not satisfied.

q 0 q 1 zero(v) Figure 3.6: System M 4 is branch-WSTS.
Example 10. In Figure 3.6, let us consider the counter machine M 4 with a single counter v. Let x = (q 1 , 0). We see that

P re ⇤ ("x) = {(q 1 , n) | n 0} [ {(q 0 , 0)}. However, "P re ⇤ ("x) = P re ⇤ ("x) [ {(q 0 , n) | n 1}.
Thus, we get:

Proposition 3.25. Given a branch-e↵ective branch-WSTS S = (X, A, !, , init) and a state x 2 X, the set P re ⇤ ("x) is not necessarily upward-closed.

So we deduce that we cannot use the backward algorithm.

Let us consider using the forward algorithm instead. The second procedure computes all sets X which satisfy the property #P ost ⇤ (X) ✓ X. This is because for WSTS, the set #P ost ⇤ (x) satisfies this property. However, we now show a counter-example of a branch-WSTS which does not satisfy this property.

q 0 q 1 q 2 inc(v) zero(v) Figure 3.7: System M 5 is branch-WSTS.
Example 11. Consider the counter machine M 5 from Figure 3.7, with init = (q 0 , 0). We compute #P ost ⇤ (init). We see that P ost ⇤ (init) = {(q 0 , 0), (q 1 , 1)}, hence, Y = #P ost ⇤ (init) = {(q 0 , 0), (q 1 , 1), (q 1 , 0)}. However, #P ost ⇤ (Y ) 6 ✓ Y , as #P ost ⇤ (Y ) = {(q 0 , 0), (q 1 , 1), (q 1 , 0), (q 2 , 0)}, which is strictly larger than Y .

This gives us:

Proposition 3.26. For branch-e↵ective, branch-WSTS S = (X, A, !, , init) such that #P ost(#x) is computable for all x 2 X, the set Y = #P ost ⇤ (init) does not necessarily satisfy the property

#P ost ⇤ (Y ) ✓ Y .
Not only do the two coverability algorithms not terminate but we also show that coverability is undecidable. To this end, let us define well-structured nets, which was introduced in [START_REF] Finkel | A wellstructured framework for analysing petri net extensions[END_REF].

Definition 3.27. A well-structured net wellstructured net is a triple N = (N p , F, ) for some dimension p where F is a finite set of non-decreasing functions defined on upward-closed subsets of N p .

Let us denote by TM j the j th Turing Machine in some enumeration. Consider the family of functions f j : N 2 ! N 2 defined by f j (n, k) = (n, 0) if k = 0 and T M j runs for more than n steps, else f j (n, k) = (n, n + k). Let g : N 2 ! N 2 be the function defined by g(n, k) = (n +1, k). Now, consider the strongly monotone WSN N j = (N 2 , {f j , g}, ). Since N j is strongly monotone, it is also branch-monotone. Moreover, system N j is branch-e↵ective and we observe that P ost is computable and  is wqo. Hence, N j belongs to a class of branch-e↵ective branch-WSTS.

From [FMP04, Theorem 4.3], we deduce that the state (1, 1) is coverable from (0, 0) in N j i↵ TM j halts.

Hence, we obtain the following corollary:

Corollary 3.28. The coverability problem is undecidable for branch-e↵ective branch-WSTS S = (X, A, !, , init) (even if S is strongly monotone and  is wqo).

Cover-WSTS

We show that coverability is decidable for a class of WSTS-like systems with a wqo but with a new notion of monotony, which we refer to as cover-monotony.

We recall the classical definition of the coverability set coverability set of x 2 X as Cover S (x) = #P ost ⇤ S (x). Let us consider the following monotony condition. Definition 3.29. Let S = (X, A, !, , init) be an ordered labeled transition system. We say that S is cover-monotone covermonotone (resp. strongly cover-monotone) if, for all y 1 2 Cover S (init) and for all x 1 , x 2 2 X such that x 1  y 1 and x 1 ! x 2 , there exists a state y 2 2 X such that y 1 ⇤ ! y 2 (resp. y 1 ! y 2 ) and x 2  y 2 .

q 0 q 1 q 2 q 3 zero(v) inc(v) dec(v) inc(v) inc(v)
Figure 3.8: Machine M 6 is cover-monotone if we consider the associated transition system to have initial state (q 0 , 0). However, if we consider the initial state as (q 0 , 1), then it is not cover-monotone.

Cover-monotony is more general than the usual monotony, i.e., a system can be cover-monotone but not monotone (as we shall see in this section). However, let us emphasize that cover-monotony of a system S = (X, A, !, , init) is a property that depends on the initial state init while the usual monotony does not depend on any initial state (see Figure 3.8). Hence, the two notions are incomparable.

The strong cover-monotony property is not trivially decidable for general models while (usual) strong-monotony is decidable for many powerful models like FIFO machines and counter machines. However, this notion is still of theoretical interest, as it shows that we can relax the general monotony condition.

However, there is a link between general monotony and cover-monotony.

Proposition 3.30. A system S = (X, A, !, , init) is monotone i↵ for all x 2 X, (X, A, !, , x) is cover-monotone.

Proof. Every monotone system is trivially cover-monotone for all x 2 X. Conversely, consider a system S = (X, A, !, , init) such that (X, A, !, , x) is cover-monotone for all x 2 X. Let us consider x 1 , y 1 , x 2 2 X such that x 1  y 1 and x 1 ! x 2 . In order to show that S is monotone, we need to prove that there exists y 2 such that y 1 ⇤ ! y 2 and x 2  y 2 . Since x 1  y 1 (by hypothesis), x 1 2 Cover S (y 1 ). By the hypothesis, (X, A, !, , y 1 ) is cover-monotone, hence there exists y 2 such that y 1 ⇤ ! y 2 with x 2  y 2 . Hence, S is monotone.

We may now define cover-WSTS as follows.

Definition 3.31. A cover-WSTS cover-WSTS is a finitely branching cover-monotone system S = (X, A, !, , init) such that (X, ) is wqo.

For cover-WSTS, the backward algorithm fails. This is once again because the presence of a single zero test removes the property of the set P re ⇤ ("y) being upward-closed. But we will now show that the forward coverability approach is possible.

Proposition 3.32. Given a system S = (X, A, !, , init) and a downward-closed set D ✓ X such that #P ost(D) ✓ D, then we have the inclusion #P ost ⇤ (D) ✓ D.

Proof. We first prove the following claim by induction.

Claim: Given a system S = (X, A, !, , init), for every downward-closed set D ✓ X such that #P ost(D) ✓ D, the following inclusion holds:

#P ost k (D) ✓ D, for all k 1.
Base case: For k = 1, this is the hypothesis.

The inductive hypothesis asserts that: Given a system S = (X, A, !, , init), for every downward-closed set D ✓ X such that #P ost(D) ✓ D, the following inclusion holds: #P ost k (D) ✓ D. We now prove that it is also true for k + 1. Let us define a particular instance of the coverability problem in which we verify if a state is coverable from the initial state.

Decision Problem: init-COVERABILITY

Input: an ordered transition system S = (X, A, !, , init), a state y 2 X Question: is y 2 #P ost ⇤ S (init)?

We show that init-coverability is decidable for cover-WSTS:

Theorem 3.33. Let S = (X, A, !, , init) be an ideally e↵ective cover-WSTS such that P ost is computable. Then, the init-coverability problem is decidable.

Proof. Consider a system S = (X, A, !, , init) that is cover-WSTS, and let us consider a state y 2 X. To find a certificate of coverability (if it exists), we cannot use Procedure 1 since general monotony is not satisfied and then, in general, #P ost ⇤ (init) 6 = #P ost ⇤ (#init) but we can use a variation of Procedure 1, where we iteratively compute init, P ost(init), P ost(P ost(init)), and so on, and at each step check if y  x for some x in the computed set. This can be done because S is finitely branching and the sets P ost k (init) are computable for all k 0. Hence, if there exists a state that can cover y reachable from init, it will eventually be found.

Now, let us prove that Procedure 2 terminates for input y i↵ y is not coverable from init.

If Procedure 2 terminates, then at some point, the while condition is not satisfied and there exists a set D such that y / 2 D and init 2 D and #P ost(D) ✓ D. Moreover, #P ost ⇤ (I) ✓ I for every inductive invariant I (see Proposition 3.32). Hence, Cover S (init) ✓ D, therefore, since y / 2 D, we deduce that y 6 2 Cover S (init) and then y is not coverable from init.

Note that every downward-closed subset of X decomposes into finitely many ideals since (X, ) is wqo [START_REF] Finkel | Forward Analysis for WSTS, Part I: Completions[END_REF]. Moreover, since init is ideally e↵ective, ideals of X may be e↵ectively enumerated. By [START_REF] Blondin | Handling infinitely branching well-structured transition systems[END_REF] and [START_REF] Blondin | Well Behaved Transition Systems[END_REF], for ideally e↵ective systems, testing of inclusion of downward-closed sets, and checking the membership of a state in a downward-closed set, are both decidable.

To show the opposite direction, let us prove that if y is not coverable from init, the procedure terminates. It su ces to prove that Cover S (init) is an inductive invariant. Indeed, this implies that Cover S (init) is eventually found by Procedure 2 when y is not coverable from init.

Let us show #P ost(Cover S (init)) ✓ Cover S (init). Let y 2 #P ost(Cover S (init)). Then, there exists x, x 0 , y 0 such that init ⇤ ! x 0 , x  x 0 , x ! y 0 and y  y 0 . Hence,

x, x 0 2 Cover(init). And by cover-monotony, there exists y 00 y 0 such that x 0 ⇤ ! y 00 . Therefore, init ⇤ ! y 00 and y  y 0  y 00 , hence, y 2 Cover S (init). Hence, the init-coverability problem is decidable. However, we see that the general coverability problem is undecidable for cover-WSTS. We see that as for branch-WSTS, for the class of cover-WSTS the property of #P ost ⇤ (Y ) ✓ Y does not hold for sets excluding the coverability set from the initial state.

Theorem 3.34. The coverability problem is undecidable for cover-WSTS.

Proof. Given any counter machine

C = (Q, V, T, q 0 ), let S C = (X C , Act C , ! C , 
, init) be its transition system equipped with the natural order on counters. We can construct a system S 0

C = (X 0 C , Act C , ! 0 C , , init 0 ) such that S 0 C is cover-monotone, and any state x 2 X C is coverable i↵ it is also coverable in X 0
C . The construction is as follows. We add a new control-state q from the initial state in the counter machine (q 0 ) reachable via a noop transition, therefore, X 0 C = X C [ {(q, 0) | n 2 N}. This new control-state is a sink state, i.e., there are no transitions from q to any other control-state (except itself). Moreover, we let init 0 = (q, 0). Note that S 0

C is cover-monotone, because there is no state reachable from init 0 , hence, the property is vacuously satisfied. However, for all other states, as we leave the system unchanged, we see that a state x is coverable in S C by a state y i↵ it is coverable in S 0 C . Hence, coverability for counter machines reduces to the coverability problem for cover-WSTS, and coverability is therefore, undecidable for cover-WSTS.

Chapter 4

Input-Boundedness

As we saw in the previous chapters, for general FIFO machines, boundedness, termination and reachability are all undecidable. Moreover, as FIFO systems are neither WSTS, nor branch-WSTS, the problem of analyzing an interesting subclass with decidable properties is still left open.

There have been many works since the 1980s which have studied FIFO machines in which the input-language of a channel (i.e., the set of words that record the messages entering a channel) is included in the set Pref (w ⇤ 1 w ⇤ 2 . . . w ⇤ n ) for words w 1 , w 2 , . . . , w n . We call this class of FIFO machines input-bounded.

In this chapter, we solve a problem that was left open in [START_REF] Gouda | On deadlock detection in systems of communicating finite state machines[END_REF], the decidability of the reachability problem for input-bounded FIFO machines. We present a simulation of input-bounded FIFO machines by counter machines with restricted zero tests.

In fact, we actually solve the more general problem of rational-reachability, hence, we can deduce the decidability of other verification properties like controlstate reachability, deadlock, unboundedness, and termination. We also study the natural dual of the input-bounded reachability problem, which are machines in which the output-language, or set of words received by each channel, is bounded. For this class, we are able to deduce the decidability of reachability, unboundedness, termination and control-state reachability.

We obtain EXPTIME upper bounds and NP lower bounds for the input-bounded reachability of FIFO machines with a single channel. And finally, following the bounded verification paradigm like in [EGM12, FP20], we suggest a methodology that would apply existing results on input-bounded FIFO machines to general FIFO machines.

Bounded reachability

We formally define a bounded language first. Let A be an alphabet.

Definition 4.1 ([GS64]). bounded language
Let w 1 , . . . , w n 2 A + be non-empty words where n 1. A bounded language over (w 1 , . . . , w n ) is a language L ✓ w ⇤ 1 . . . w ⇤ n .

We always assume that a bounded language L is given together with its tuple (w 1 , . . . , w n ) and that

Alph(L) = Alph(w 1 . . . w n ). We say L is distinct-letter if |w 1 . . . w n | a  1 for all a 2 A. If |w 1 | = . . . = |w n | = 1, i.e., w 1 , . . . , w n 2 A, then
L is a letter-bounded language. Note that the set of bounded languages is closed under Pref and Suf . We bounded reachability set say that a FIFO machine M = (Q, Ch, ⌃, T, q 0 ) has a bounded reachability set if there is a tuple (L c ) c2Ch of regular bounded languages L c ✓ ⌃ ⇤ c such that, for all (q, w) 2 Reachset M , we have w 2 Q c2Ch L c . We define the input-language of a FIFO channel c as the set of all words that are sent into the channel, i.e., proj c! (Traces(M)).

input-bounded FIFO machine

Moreover, we say that the machine is input-bounded if there is a tuple (L c ) c2Ch of regular bounded languages

L c ✓ ⌃ ⇤ c such that, for all c 2 Ch, proj c! (Traces(M)) ✓ L c .
Let us also briefly recall a few notions that have been studied in the literature. Monogeneous FIFO nets [Fin82, [START_REF] Memmi | An introduction to FIFO nets-monogeneous nets: A subclass of FIFO nets[END_REF][START_REF] Finkel | Well-structured transition systems everywhere![END_REF] are machines where input-languages of channels c are included in Pref (u c • v ⇤ c ) where u c , v c are two words associated with c. Linear FIFO nets (or as we will refer to them, distinct-letter-bounded FIFO machines) [START_REF] Choquet | Simulation of linear FIFO nets by Petri nets having a structured set of terminal markings[END_REF] are machines where the input-language is distinct-letter. Finally, flat machines are a class of FIFO machines such that every control-state is part of at most one non-elementary loop [START_REF] Finkel | Verification of Flat FIFO Systems[END_REF]. All these classes are subclasses of input-bounded FIFO machines.

We show that restricting the reachability set to be bounded is not su cient to obtain a decidable reachability problem, by simulating any two counter (Minsky) machine by a FIFO machine with fixed languages L c .

Theorem 4.2. The reachability problem is undecidable for FIFO machines (with a single channel) with a (given) bounded reachability set.

Proof. We prove this by reducing reachability in a two counter machine to reachability in a FIFO machine that has a single channel and a bounded reachability set. Intuitively, for every state (q, v 1 , v 2 ) reachable in the counter machine, where q is the control-state and v 1 , v 2 are the counter contents, we are able to reach a state (q, w) in the FIFO machine, where

w = #a v 1 #b v 2 #.
Consider a counter machine C = (Q C , V, T C , q init ), where Q C is the set of controlstates, V = {x 1 , x 2 } is the set of counters, q init the initial control-state, and

T = Q ⇥ Act ⇥ Q such that Act = {inc(x), dec(x), zero(x) | x 2 V }
to denote the increment, decrement and testing for zero of the counters.

We construct a FIFO machine

M = (Q M , Ch, ⌃, T M , q 0 ) such that Q M = Q C [ Q mid , where Q mid is a set of intermediate control-states, Ch = {c}, ⌃ = {a, b, #}, and q 0 = q init .
For every transition C 2 T C :

• If C = (q, inc(x 1 ), q 0 ): We add the sequence of transitions as shown in Figure 4.1 to T M . Put simply, if counter x 1 is incremented, we increment the number of a's in the channel by 1. By rotating the tape contents, we ensure that the channel contents at q 0 are of the form #a v 1 #b v 2 #. • If C = (q, dec(x 1 ), q 0 ): We add the sequence of transitions as shown in Figure 4.2 to T M . As before, if counter x 1 is decremented, we decrement the number of a's in the channel by 1. By rotating the tape contents, we ensure that the channel contents at q 0 are of the form #a v 1 #b v 2 #. Note that, for the FIFO machine, if there is no a in the channel, then the sequence will not be completed and q 0 cannot be reached. • If C = (q, zero(x 1 ), q 0 ): In this case, we have the sequence as shown in Figure 4.3 added to T M . This transition sequence can only be executed if there is no occurrence of a in the channel.

q q 0 ?#!# ?a !a ?# !a !# ?b !b ?#!#
q q 0 ?#!# ?a ?a !a ?# !# ?b !b ?#!#
Similar constructions are made for the transitions involving counter x 2 . Consider the transition system associated to M, i.e., S M . Observe that the channel contents always belong to the bounded language

q q 0 ?#!# ?#!# ?b !b ?#!#
# ⇤ a ⇤ # ⇤ b ⇤ # ⇤ a ⇤ # ⇤ b ⇤ # ⇤ .
Hence, S M has a bounded reachability set.

Consider the associated transition systems, i.e., S C and S M , we prove the following claim: There is a transition t of the form (q, v 1 , v 2 )

t ! (q 0 , v 0 1 , v 0
2 ) in S C i↵ there is a transition sequence of the form (q, w)

↵ 1 ! (q 1 , w 1 ) ↵ 2 ! . . . ↵n ! (q 0 , w 0 ) in S M such that w = #a v 1 #b v 2 #, states q 1 , . . . , q n 1 2 Q mid and w 1 , . . . , w n 1 2 ⌃ ⇤ and w 0 = #a v 0 1 #b v 0 2 #.
Let us first show that for every transition t of the form (q, v 1 , v 2 )

t ! (q 0 , v 0 1 , v 0
2 ) in S C there is a corresponding sequence in S M as defined above. Without loss of generality, let us assume that the transition t modifies counter x 2 . (The same arguments can be extended in the case of counter x 1 ). By construction, for an increment, we know that there is a transition sequence that can be executed from state (q, w) in S M , which leads to (q 0 , w 0 ). Similarly, if t involves decrement of the counter x 2 , then we know that v 2 1. Hence, there is at least one occurrence of the letter b in w. Hence, we can successfully execute the transition sequence from (q, w) to (q 0 , w 0 ) as per the construction. If t tests x 2 to zero, then we know that there is no occurrence of b in w. Hence, in S M , the transition sequence corresponding to the zero test can be executed to reach from (q, w) to (q 0 , w 0 ).

To show the opposite direction, we assume there is a transition sequence of the form (q, w)

↵ 1 ! (q 1 , w 1 ) ↵ 2 ! . . . ↵n ! (q 0 , w 0 ) in S M such that w = #a v 1 #b v 2 #, control-states q 1 , . . . , q n 1 2 Q mid and w 1 , . . . , w n 1 2 ⌃ ⇤ and w 0 = #a v 0 1 #b v 0 2 #.
Hence, there is a corresponding transition in S C as all the transition sequences between states in Q C are constructed based on transitions in the counter machine. Moreover, if the transition system corresponding to a zero test of say, counter x 2 , is executed, we can be sure that there is no b in w. Hence, v 2 = 0. Hence, from the state (q, v 1 , v 2 ) the zero test of x 2 can be executed and (q 0 , v 0 1 , v 0 2 ) can be reached. The same arguments can be extended for all transition sequences, and we prove our claim.

We can extend this claim by induction to consider any transition sequences in S C . Hence, we can derive the following claim: (q, v 1 , v 2 ) is reachable from (q init , 0, 0) i↵ (q, w) is reachable from (q, ###), where w = #a v 1 #b v 2 #. And since reachability is undecidable for 2-counter machines, we can say it is also undecidable for FIFO machines with a bounded reachability set. Note that the above result only uses a single channel, and still the reachability problem is undecidable. Moreover, in the proof above, |⌃| = 3, but we can modify the construction to use only 2 letters (we represent both counters by the same letter a). Hence, for a single channel and |⌃| = 2, the reachability problem is still undecidable for FIFO machines with a bounded reachability set. Furthermore, if we modify the restriction to consider non-repeating letters (i.e., distinct-letter bounded), we still obtain undecidability of the reachability problem. We know that if |⌃| = 1, we can represent the channel by a single counter, for which reachability is known to be decidable.

We see in the previous proof that if there is a loop in the counter machine, the input-language of the channel is not bounded: If we have a transition from q in the original machine of the kind (q, inc(x i ), q), there exists a corresponding 2 Act ⇤ M in the FIFO machine such that proj c! ( ) = (#a ⇤ #a ⇤ #) ⇤ , which is not bounded. Hence, the input-language need not be a bounded language even if the reachability set is. Furthermore, if the original counter machine is not flat, the FIFO machine would not be flat either, since there can be control-states that are in more than one elementary loop.

We therefore consider a di↵erent restriction to obtain decidability of reachability for FIFO systems. The reachability problem for FIFO systems can be seen as follows:

Given a FIFO machine M = (Q, Ch, ⌃, T, q 0 ), and a state (q, w) in the set of states X M of the associated transition system, do we have (q, w) 2 Tracereach M (L) where L = Act ⇤ M , i.e., is there any path from the initial state to (q, w)? Since this problem is undecidable, we are looking for language classes C that render the problem decidable under the restriction that L 2 C.

For a given FIFO machine M = (Q, Ch, ⌃, T, q 0 ), we are interested in computing Tracereach M (L) where L ✓ Act ⇤ M is input-bounded i.e., for every channel c, the sequence of messages that are sent through channel c is from a given regular bounded language L c ✓ ⌃ ⇤ c .

With this, given a tuple

L = (L c ) c2Ch of bounded languages L c ✓ ⌃ ⇤ c , we set L ! = { 2 Act ⇤ M | proj c! ( ) 2 L c for all c 2 Ch} and L ? = { 2 Act ⇤ M | proj c? ( ) 2 L c
for all c 2 Ch}. We observe that, if all L c are regular, then so are L ! and L ? .

We now define the input-bounded (IB) reachability problem as follows:

Decision Problem: INPUT-BOUNDED (IB) REACHABILITY Input:
a FIFO machine M = (Q, Ch, ⌃, T, q 0 ) a tuple of non-empty regular bounded languages L = (L c ) c2Ch a state (q, w) 2 X M Question:

is (q, w) 2 Tracereach M (L ! )?

Note that, if (q 0 , ") ! M (q, w) and 2 L ! , then because we are considering FIFO channel, we also have 2 Pref (L ? ). Thus,

Tracereach M (L ! ) = Tracereach M (L ! \ Pref (L ?
)) so that we can restrict to action sequences from L ! \ Pref (L ? ). We will call L ! \ Pref (L ? ) the set of valid words. Example 12. Let us consider a simple model of a Client-Server-Logger system from [START_REF] Lange | Verifying Asynchronous Interactions via Communicating Session Automata[END_REF], which consists of three processes, a client (denoted by c), server (s) and logger (l), and channels between them. The client sends to the server a request, followed by some data in a fire-and-forget fashion, i.e., before receiving any response from the server. The server either grants the requests and sends a log message to the logger, or sends a message ko to the client, after which the client tries again. This system is neither flat nor monogeneous nor linear. However, the input-languages of the channels are L cs = (req • data) ⇤ , L sc = (ko) ⇤ • (ok) ⇤ and L sl = (log) ⇤ . Hence, they are all bounded languages. Therefore, computing the reachability set for the entire system is equivalent to computing reachability over a set of bounded languages.

4.2

The IB rational-reachability problem.

Actually, instead of reachability of a single state as stated above, we study a more general problem, called the input-bounded rational-reachability problem. It asks whether a state (q, w) is reachable for some channel contents w from a given rational relation. Let us formally define this notion.

Semi-Linear Sets.

Y = {b + i 1 p 1 + . . . + i m p m | i 1 , . . . , i m 2 N}.
The basis along with the periods are referred to as the generators of the linear set Y . A finite union of linear sets is called a semi-linear set semi-linear set. Every finite subset of N d is semi-linear (including the empty set ;) -it can be seen as a finite union of linear sets with no period.

Example 13. The set Y 1 = {(x, y) | x
1} ✓ N 2 is a linear (hence, semilinear) set, with b = (1, 0), p 1 = (0, 1) and p 2 = (1, 0). On the other hand,

Y 2 = {(x, y) | y  x 2 } is not a semi-linear set.
It is well known that the language of a non-deterministic finite-state automaton (NFA) over a d-letter alphabet ⌃ = {a 1 , . . . , a d } can be seen as a semi-linear set [START_REF] Rohit | On Context-Free Languages[END_REF]. Given a word w 2 ⌃ ⇤ , we define the Parikh map Parikh map of w by (w) = (|w| a 1 , . . . , |w| a d ). By extension, the Parikh map of a language L, is denoted by (L) = { (w) | w 2 L}. Hence, if we are given a semilinear set Y , we can construct an NFA which accepts a language L such that (L) = Y .

Rational and Recognizable Relations. We say that a subset Rel ✓

Q c2Ch ⌃ ⇤ c is rational rational set if there is a regular word language R ✓ ⇥ ⇤ over the alphabet ⇥ = Q c2Ch (⌃ c [ {"}) such that Rel = {(a 1 c • . . . • a n c ) c2Ch | a 1 . . . a n 2 R with n 2 N and a i = (a i c ) c2Ch 2 ⇥ for i 2 {1, . . . , n}}. Here, a 1 c • . . . • a n c 2 ⌃ ⇤ c is the concatenation of all a i c 2 ⌃ c [ {"
} while ignoring the neutral element ". For example, in the presence of two channels, Rel = {(a m , b n ) | m n} is a rational relation, witnessed by R = ((a, b) + (a, ")) ⇤ . In the following, we will always assume that a rational relation is given in terms of a finite automaton for the underlying regular language R.

A relation Rel ✓ Q c2Ch ⌃ ⇤ c is called recognizable recognizable relation
if it is the finite union of relations of the form Q c2Ch R c where all R c ✓ ⌃ ⇤ c are regular languages. Note that every recognizable relation is rational while the converse is, in general, false. We are now prepared to define the input-bounded (IB) rational-reachability problem.

Decision Problem: INPUT-BOUNDED (IB) RATIONAL-REACHABILITY

Input:

a FIFO machine M = (Q, Ch, ⌃, T, q 0 ) a tuple L = (L c ) c2Ch of non-empty regular bounded languages a control-state q 2 Q, and

a rational relation Rel ✓ Y c2Ch ⌃ ⇤ c Question: is (q, w) 2 Tracereach M (L ! ) for some w 2 Rel ?
We shall now try to prove that the above problem is decidable for FIFO machines.

Let M = (Q, Ch, ⌃, T, q 0 ), and let L = (L c ) c2Ch be a tuple of non-empty regular bounded languages L c ✓ ⌃ ⇤ c over (w c,1 , . . . , w c,nc ). We proceed by reduction to counter machines. Intuitively, we represent the contents of channel c in terms of a set of counters, one for every component w c,i .

However, in order to simulate FIFO machines by counter machines, we require that the FIFO machine (along with the bounded languages associated to it) be in a normal form. This can be achieved at the expense of an exponential blow-up of the FIFO machine.

Definition 4.3. We say that M and L are in normal form if the following hold: normal form 1. For all c 2 Ch, ⌃ c ✓ Alph(L c ) and L c is distinct-letter.

We have Traces

((Q, Act M , T, q 0 )) ✓ Pref (V) where set of valid words V V = L ! \ Pref (L ?
). Note that (Q, Act M , T, q 0 ) is the finite transition system induced by the control graph of M.

Distinct-Letter Property. Let ⌃ be an alphabet. Consider the bounded language L ✓ ⌃⇤ over ( ŵ1 , . . . , ŵn ). For i 2 {1, . . . , n}, let m i = | ŵi | be the length of the i-th word. Furthermore, let m = m 1 + . . . + m n . Let ⌃ denote the alphabet {`1, . . . , `m}. We construct a distinct-letter bounded language L ✓ ⌃ ⇤ over (w 1 , . . . , w n ) such that w i = `j+1 . . . `j+m i , where j = P p<i m p , for all 1  i  n. In order to obtain the distinct-letter language L, we first construct the homomorphism h : ⌃ ⇤ ! ⌃⇤ where h(`i) is the i-th letter of the word ŵ1 . . . ŵn . We obtain L as h 1 ( L) \ w ⇤ 1 . . . w ⇤ n , hence, preserving regularity and boundedness. We then remove all the words from the bounded language (w 1 , . . . , w n ) (and their letters from ⌃) whose letters do not occur in L. Example 14. For example, suppose we have L = (ab) ⇤ bb ⇤ over (ab, b). We determine the language L over (a 1 a 2 , a 3 ). The homomorphism h : {a 1 , a 2 , a 3 } ⇤ ! {a, b} ⇤ is given by h(a 1 ) = a and h(a 2 ) = h(a 3 ) = b. We have h 1 ( L) = (a 1 (a 2 + a 3 )) ⇤ (a 2 + a 3 )(a 2 + a 3 ) ⇤ , which we intersect with (a 1 a 2 ) ⇤ a ⇤ 3 . We thus get the regular bounded language L = (a 1 a 2 ) ⇤ a 3 a ⇤ 3 over (a 1 a 2 , a 3 ). All letters from {a 1 , a 2 , a 3 } occur in L so we are done.

Trace Property. Given a FIFO machine M = ( Q, Ch, ⌃, T , q0 ) and the tuple L = ( Lc ) c2Ch of non-empty regular bounded languages Lc ✓ ⌃⇤ c , we now construct the FIFO machine

M = (Q, Ch, ⌃, T, q 0 ) such that Traces((Q, Act M , T, q 0 )) ✓ Pref (V) with V = L ! \ Pref (L ? ). Let h c : ⌃ ⇤
c ! ⌃⇤ c be the homomorphism defined earlier for channel c 2 Ch. First, to take care of the homomorphism h c , we define the transition relation h 1 ( T ) = {(q, hc!ei, q 0 ) | (q, hc!ai, q 0 ) 2 T and e 2 h 1 c (a)} [ {(q, hc?ei, q 0 ) | (q, hc?ai, q 0 ) 2 T and e 2 h 1 c (a)}. Thus, the set of actions of M will be Act M = {hc!ei | c 2 Ch and e 2 ⌃ c } [ {hc?ei | c 2 Ch and e 2 ⌃ c }. Recall from Example 14 that the corresponding homomorphism h c maps a 1 to a and both a 2 and a 3 to b, and that we obtain

q 0 q 1 M Lc = (ab) ⇤ bb ⇤ L c = (a 1 a 2 ) ⇤ a 3 a ⇤ 3 !a | !b | ?a ?b ?b q 0 q 1 h 1 ( M) !a 1 | !a 2 | !a 3 | ?a 1 ?a 2 | ?a 3 ?a 2 | ?a 3
L c = (a 1 a 2 ) ⇤
a 3 a ⇤ 3 . To continue the example, a transition t = (q, hc!bi, q 0 ) would be replaced by h 1 (t) with the two transitions (q, hc!a 2 i, q 0 ) and (q, hc!a 3 i, q 0 ). We construct h 1 ( M) = ( Q, Ch, ⌃, h 1 ( T ), q0 ) as shown in the Figure 4.5 (right).

To guarantee trace inclusion in Pref (V), we follow the same idea as in Section 3.5.2. To recall, we will consider a deterministic (not necessarily complete) finite automaton A = (Q A , Act M , T A , q 0 A , F A ), with set of final states F A ✓ Q A , whose language is L(A) = V and where, from every state, a final state is reachable in the finite graph (Q A , T A ). With this, we define M as the product of the FIFO machine h 1 ( M) = ( Q, Ch, ⌃, h 1 ( T ), q0 ) and A in the expected manner. In particular, the set of control-states of M is Q ⇥ Q A , and its initial state is the pair (q 0 , q 0 A ).

q 0 q 1 h 1 ( M) M L R A for V = L ! \ Pref (L ? ) M L R !a 1 | !a 2 | !a 3 | ?a 1 ?a 2 | ?a 3 ?a 2 | ?a 3 !a 1 !a 2 !a 3 !a 3 ?a 1 ?a 2 ?a 3 ?a 3 q 0 L,M M q 0 M,M q 0 R,M q 1 R,R q 0 L,L q 0 M,L q 0 R,L q 1 R,M !a 1 !a 2 !a 1 !a 2 ?a 1 !a 3 !a 3 ?a 1 ?a 1 !a 3 !a 3 ?a 3 ?a 2
?a 3 ?a 3 Example 16. Figure 4.6 illustrates the completion of the normalization procedure for the FIFO machine M. We see that M (see Figure 4.6 bottom) is the product of h 1 ( M) (top left) and a finite automaton A for V = L ! \ Pref (L ? ) (obtained as the shu✏e of the two finite automata on the top right). The state names in M reflect the states of M and A they originate from. We depict only accessible states of M from which we can still complete the word read so far to a word in V. For example, (q 1 , M, L) and (q 1 , L, R) would no longer allow us to reach the final state R of the L ! -component, and hence, are not visible in the figure. Now suppose we are given a reachability query for M in terms of q 2 Q and a rational relation Rel ✓ Q c2Ch ⌃⇤ c . The lemma below shows how to reduce it to a reachability query in M. Here, for w

= (w c ) c2Ch 2 Q c2Ch ⌃ ⇤ c , we define h(w) = (h c (w c )) c2Ch 2 Q c2Ch ⌃⇤
c . Note that h 1 ( Rel ) is rational. Furthermore, h : ⌃ ⇤ ! ⌃⇤ is defined by h(a) = h c (a) for all c 2 Ch and a 2 ⌃ c , and we extend this to h : Act ⇤ M ! Act ⇤ M in the expected manner.

Lemma 4.4. We have (q, ŵ) 2 Tracereach M( L! ) for some ŵ 2 Rel i↵ ((q, q A ), w) 2 Tracereach M (L ! ) for some q A 2 Q A and w 2 h 1 ( Rel ).

Proof. Let us assume we have (q, ŵ) 2 Tracereach M( L! ) for some ŵ 2 Rel . Hence, there exists ˆ 2 L! such that (q 0 , ")

ˆ ! (q, ŵ). For channel c, let ŵc = proj c! (ˆ ). Since ˆ 2 L! , we have ŵc 2 Lc for all c 2 Ch. Let w c 2 L c = h 1 c ( Lc ) \ (w c,1 ) ⇤ . . . (w c,nc ) ⇤ such that h c (w c ) = ŵc .
There is a unique 2 Act ⇤ M such that h( ) = ˆ and proj c! ( ) = w c and proj c? ( ) 2 Pref (w c ) for all c 2 Ch. Here, h : ⌃ ⇤ ! ⌃⇤ is defined by h(a) = h c (a) for all c 2 Ch and a 2 ⌃ c , and we extend this to h : Act ⇤ M ! Act ⇤ M in the expected manner. Note that 2 L ! \ Pref (L ? ). Hence, we know that in the FIFO machine h 1 ( M), one has (q 0 , ") ! (q, w) for some w (by construction of h 1 ( T )), and that 2 L(A). Therefore, since M is a product of the two machines, we can deduce that there is a run in M of the kind ((q 0 , q 0 A ), ") ! (q, q A ), w), for some value of q A . Furthermore, by h( ) = ˆ , we have h(w) = ŵ. Hence, w 2 h 1 ( Rel ).

Conversely, let us assume that ((q, q A ), w) 2 Tracereach M (L ! ) for some q A 2 Q A and channel contents w 2 h 1 ( Rel ). Then, we know that there exists 2 L ! such that ((q 0 , q 0 A ), ") ! (q, q A ), w). Let ˆ = h( ). Since 2 L ! , we have proj c! ( ) 2 L c for all c 2 Ch. In particular, proj c! ( ) 2 h 1 c ( Lc ) and, therefore, h c (proj c! ( )) = proj c! (h( )) 2 Lc . We deduce ˆ 2 L! . Furthermore, we can execute ˆ in M (by construction) to reach states (q, ŵ) for some ŵ. By ˆ = h( ), we have ŵ = h(w). Therefore, ŵ 2 Rel .

Reduction of Normal Form to Counter Machine

The next step in our proof is to construct a counter machine C such that the IB rational-reachability problem for M can be solved by answering a reachability query in C, However, as we already know, for general counter machines, reachability is undecidable. Hence, in order to obtain decidability, we impose a restriction on counter machines.

We modify the syntactic restriction in Section 2.3, where we imposed that once a counter has been tested for zero, it cannot be incremented any further. We now impose this notion not syntactically but on the semantics of the counter machine. To define this, let

L zero C L zero C be the set of words (op 1 (v 1 ), Z 1 ) . . . (op n (v n ), Z n ) 2 A ⇤ C
such that, for every two positions 1  i  j  n, we have v j 6 2 Z i . As discussed before, this restriction leads us to an extension of VASS. Hence, the reachability problem is decidable, which we demonstrate below.

Theorem 4.5. The following problem is decidable (though inherently non-elementary): Given a counter machine C = (Q, V, T, q 0 ), a regular language L ✓ A ⇤ C , a controlstate q 2 Q, and a semi-linear set V ✓ N V , do we have (q, v) 2 Tracereach C (L zero C \ L) for some v 2 V? Proof sketch. We reduce reachability in counter systems with restricted zero tests in the presence of a semi-linear target set to state reachability in VASS. The idea is to have 2 |V | many copies of the counter machine, such that instead of testing for zero, we branch into a copy corresponding to storing the information of the counter to be tested to zero (and we do not modify the counter further in this copy). Finally, to check whether a counter valuation belongs to V, we branch when we are in a control-state q into a component that decrements counters accordingly and eventually checks whether they are all zero.

Hence, reachability for counter machines with restricted zero tests straightforwardly reduces to state-reachability in VASS, which is decidable [START_REF] Mayr | An Algorithm for the General Petri Net Reachability Problem[END_REF], though inherently non-elementary [CLL + 19].

Henceforth, we suppose that M = (Q, Ch, ⌃, T, q 0 ) and L = (L c ) c2Ch are in normal form, where L c is a bounded language over (w c,1 , . . . , w c,nc ). In particular, for every letter a 2 ⌃ c , there is a unique index i 2 {1, . . . , n c } such that a 2 Alph(w c,i ). We denote this index i by i a .

We build a counter machine C such that the IB rational-reachability problem for M can be solved by answering a reachability query in C, using Theorem 4.5. Each run in C will simulate a run in M. However, counter values are just natural numbers and hence, store less information than channel contents, which could have a non-unary alphabet. To tackle this, the idea is to represent each word w c,i of a tuple (w c,1 , . . . , w c,nc ) as a counter x (c,i) . Then, we can replace the send actions by increments of the corresponding counter, and similarly receive actions can be replaced by decrements. More precisely, hc!ai becomes (inc(x (c,ia) ), ;), thus incrementing the counter associated with the unique word w c,i in which a occurs. Similarly, hc?ai translates to (dec(x (c,ia) ), Z) (for suitable Z). This alone does not put us in a position yet where, from a counter valuation, we can infer unique channel contents, as we only currently have information about the number of letters of the word in the channel. To overcome this, we additionally store the last messages that are sent in each channel. Note that since the language is bounded, if we have the additional information of one terminal letter, we can reconstruct unique channel contents.

The last detail to note is that in general, a set of counters do not immediately behave like a channel. More specifically, in case of a channel, the decrements happen in FIFO order, and hence, there should be an order in decrementing the sets of counters. There is one more thing to consider here. Translated to the counter setting, this means that performing dec(x (c,j) ) should require all counters x (c,i) with i < j to be 0, so this is where the zero tests come into play. As the L c are bounded languages and thanks to the normal form, however, a counter that has been tested for zero does not need to be modified any more.

We can directly implement these ideas formally and define C = (Q, V, T 0 , q 0 ) as follows (note that Q and q 0 remain unchanged):

• The set of counters is V = {x (c,i) | c 2 Ch and i 2 {1, . . . , n c }}.

• For every (q, hc!ai, q 0 ) 2 T , we have (q, (inc(x (c,ia) ), ;), q 0 ) 2 T 0 .

• For every (q, hc?ai, q 0 ) 2 T , we have (q, (dec(x (c,ia) ), Z), q 0 ) 2 T 0 where the set of counters to be tested for zero is

Z = {x (c,j) | j < i a }.
Let us first observe that it is important for the FIFO machine to satisfy the trace property. We suppose in the following example that we construct the counter machine directly from h 1 ( M) (instead of M in Example 16).

q 0 q 1 h 1 ( M) !a 1 | !a 2 | !a 3 | ?a 1 ?a 2 | ?a 3 ?a 2 | ?a 3 q 0 q 1 inc(x) | inc(y) | dec(x) dec(x) | dec(y) dec(x) | dec(y)
C 0 without trace property Figure 4.7: We see that the counter machine C 0 constructed directly from h 1 ( M) does not have a tight correspondence with the FIFO machine.

Example 17. Let us look at the counter machine C 0 constructed from h 1 ( M) (cf. Figure 4.7) according to the above construction. Then, state (q 1 , (1, 0)) would be reachable in the counter machine via ⌧ = inc(x)inc(x)dec(x). If we look at the only possible transition sequence corresponding to ⌧ in h 1 ( M), we obtain hc!a 2 ihc!a 2 ihc?a 2 i. However the only trace corresponding to ⌧ from Pref (V) is hc!a 1 ihc!a 2 ihc?a 1 i, which in fact, leads to (q 0 , a 2 ) in h 1 ( M). Hence, we do not have a tight enough correspondence between the transitions in h 1 ( M) and C 0 .

Due to the non-determinism still present in h 1 ( M), we modify it so as to obey the trace property and obtain the following construction.

Example 18. Figure 4.8 illustrates the construction of C from a FIFO machine M in normal form (cf. Example 16). Recall that we have one channel c and the bounded language L c = (a 1 a 2 ) ⇤ a 3 a ⇤ 3 over (a 1 a 2 , a 3 ). Thus, C will have two counters, say x for a 1 a 2 and y for a 3 . Note that performing dec(y) indeed comes with a test of x for zero.

q 0 L,M M q 0 M,M q 0 R,M q 1 R,R q 0 L,L q 0 M,L q 0 R,L q 1 R,M !a 1 !a 2 !a 1 !a 2 ?a 1 !a 3 !a 3 ?a 1 ?a 1 !a 3 !a 3 ?a 3 ?a 2 ?a 3 ?a 3 q 0 L,M C q 0 M,M q 0 R,M q 1 R,R q 0 L,L q 0 M,L q 0 R,L q 1 R,M inc(x) inc(x) inc(x) inc (
So consider M and its counter machine C. A channel contents w 2 ⌃ ⇤ c (here, we have one channel) has a natural counter analogue w = (|w| a 1 + |w| a 2 , |w| a 3 ). In fact, if (q, w) is reachable in M, then following the corresponding transitions in C will lead us to (q, w). For example, ((q 0 , R, L), a 2 a 3 a 3 ) is reachable in M along the trace hc!a 1 ihc!a 2 ihc?a 1 ihc!a 3 ihc!a 3 i, and so is ((q 0 , R, L), (1, 2)) in C along the trace inc(x)inc(x)dec(x)inc(y)inc(y) (all zero tests are empty).

But how about the converse? In general, one may associate with a counter valuation such as (4, 0) several channel contents. Actually, both a 1 a 2 a 1 a 2 and a 2 a 1 a 2 a 1 seem suitable. However, if we know the most recent message that has been sent, say a 1 , then this leaves only one option, namely a 2 a 1 a 2 a 1 . In this way, we can associate with each counter valuation v and message a i 2 ⌃ c a unique (if it exists at all) possible channel contents JvK a i . Suppose that ⌧ is a trace in C arising from a trace in M whose last sent message is a i . If (q, v) is reachable in C via ⌧ , then (q, JvK a i ) is reachable in M via . For example, ⌧ = inc(x)inc(x)dec(x) allows us to go to state ((q 0 , M, L), (1, 0)). It arises from = hc!a 1 ihc!a 2 ihc?a 1 i 2 Pref (V), whose last sent message is a 2 . We have J(1, 0)K a 2 = a 2 . Indeed, leads to ((q 0 , M, L), a 2 ).

Relation between FIFO Machine and Counter Machine

Recall that the FIFO machine M = (Q, Ch, ⌃, T, q 0 ) and L = (L c ) c2Ch are in normal form, where L c is a bounded language over (w c,1 , . . . , w c,nc ). Let C = (Q, V, T 0 , q 0 ) be the associated counter machine. We will now formalize the tight back-and-forth correspondence that allows us to solve reachability queries in M in terms of reachability queries in C.

We start with a simple observation concerning the traces of M and C. Proof. Observe that Traces(M) ✓ Traces((Q, Act M , T, q 0 )) ✓ Pref (V). Thus, the first property holds.

For the second statement, consider (q 0 , 0) = (q 0 , v 0 )

↵ 1 ! C (q 1 , v 1 ) ↵ 2 ! C . . . ↵n ! C (q n , v n )
and let ⌧ = ↵ 1 . . . ↵ n . Thus, ⌧ 2 Traces(C). Suppose that we apply a zero test at position `2 {1, . . . , n}, i.e., ↵ `= (dec(x (c,j) ), Z) for some (c, j), where Z contains the counters x (c,i) with i < j. Then, there is k < `such that ↵ k = (inc(x (c,j) ), ;). By the construction of C, we have transitions (q k 1 , hc!ai, q k ) and (q ` 1 , hc?bi, q `) in M for some a, b 2 ⌃ c,j . By the trace property of M, none of the actions "reachable" from q `in M employs a message from ⌃ c,i , for all i < j. Thus, none of the actions ↵ m with ` m modifies a counter from Z. We deduce that ⌧ 2 L zero C .

With every channel contents w 2 Q c2Ch ⌃ ⇤ c of the FIFO machine M, we associate a counter valuation w w = v 2 N V where, for each counter x (c,i) , we let

v x (c,i) = P a2⌃ c,i |w 0 c | a .
Furthermore, abusing notation, we define a homomorphism . : Act ⇤ M ! A ⇤ C which maps a sequence of actions of M to a sequence of actions of C. It is defined by hc!ai = (inc(x (c,ia) ), ;) and hc?ai = (dec(x (c,ia) ), Z) where

Z = {x (c,j) | j < i a }.
Conversely, we will associate, with counter values and traces of C the corresponding objects in the FIFO machine. Because of the inherent ambiguity, this is, however, less straightforward. First, we define a partial mapping JvK J . K :

A ⇤ C ! Act ⇤ M
(that is not a homomorphism). For ⌧ 2 A ⇤ C , we let J⌧ K be the unique (if it exists) word 2 Pref (V) such that = ⌧ . Next, we associate with a counter valuation a corresponding channel contents. As explained above, there is no unique choice unless we make an assumption on the last messages that have been sent. For c 2 Ch, we set

⌃ ? c = ⌃ c ] {?}. Let a 2 ⌃ ?
c and w 2 ⌃ ⇤ c . We say that a is good good for w if w 2 Inf (L c ) and either w = " or w = u.a for some u 2 ⌃ ⇤ c . Intuitively, it may be possible to obtain contents w in channel c when a is the last message sent (no message was sent yet through c if a = ?). Note that the set of words w 2 ⌃ ⇤ c such that a is good for w is a regular language. Moreover, with w 2

Q c2Ch ⌃ ⇤ c , we associate the finite set G(w) G(w) ✓ Q c2Ch ⌃ ? c of tuples a = (a c ) c2Ch such that, for all c 2 Ch, a c is good for w c . Let v 2 N V and a 2 Q c2Ch ⌃ ? c .
Abusing notation, we will associate with v and a the channel contents JvK a 2 Q c2Ch ⌃ ⇤ c (if it exists). We let JvK a JvK a = w if w = v and a 2 G(w). There is at most one such w so that this is well-defined. Note that JvK a = v.

Input-Boundedness

Example 19. If we have one channel c and our bounded language is L c = (a 1 a 2 a 3 ) ⇤ (a 4 ) ⇤ , then J(4, 0)K a 2 = a 2 a 3 a 1 a 2 and J(2, 1)K a 4 = a 2 a 3 a 4 , whereas J(3, 1)K a 3 is undefined. Moreover, G(a 2 a 3 ) = {a 3 } and G(") = {a 1 , a 2 , a 3 , a 4 , ?}.

Given v and a, we can easily compute JvK a since there are only finitely many words w for a given v such that w = v. Furthermore, we can also compute G(w) for a given w as we have finitely many possibilities of a.

Finally, for a 2

Q c2Ch ⌃ ? c , we let L last a L last a ✓ Act ⇤
M be the set of words such that, for all c 2 Ch, a c is the last message sent to c in (no message was sent if a c = ?). We are now ready to state that runs in the FIFO machine are faithfully simulated by runs in the counter machine (the proof is by induction on the length of the trace): Proposition 4.7. Let 2 Act ⇤ M . For all (q, w) 2 X M and a 2

Q c2Ch ⌃ ? c such that 2 L last
a , we have: (q 0 , ") ! M (q, w) =) (q 0 , 0) ! C (q, w) and a 2 G(w) .

Proof. We will prove the statement by induction on the length of . In the base case, | | = 0. The only value of such that | | = 0 is = ". Furthermore,

" 2 Pref (V) \ L last a
where a = (?) Ch . The initial state (q 0 , ") 2 X M is the only state reachable by ". In S C , the only state reachable via " = " is (q 0 , 0) = (q, "), and " 2 L zero C . Finally, we also see that a 2 G("). Therefore, the base case is valid.

We suppose that the statement is true for all 2 Act ⇤ M such that | | = n. We will now show that it is true for 0 2 Act ⇤ M where

| 0 | = n + 1. Let a 0 2 Q c2Ch ⌃ ? c and suppose 0 2 Pref (V) \ L last a 0 .
We write 0 = . such that 2 Pref (V)\L last a for some a 2

Q c2Ch ⌃ ? c , | | = n,
and 2 Act M . There exists such a since the set Pref (V) is prefix-closed.

Let (q 0 , w 0 ) 2 X M such that (q 0 , ") 0 ! M (q 0 , w 0 ). Then, there is (q, w) 2 X M such that (q 0 , ") ! M (q, w) ! M (q 0 , w 0 ). Hence, there exists t = (q, , q 0 ) 2 T in the FIFO machine.

Case (1):

Suppose = hc!ai, for some c 2 Ch and a 2 ⌃ c . Hence, we have w 00 c = w 0 c .a, and w 00 d = w 0 d for all d 2 Ch \ {c}. Moreover, since 0 = . and = hc!ai, we can deduce that a 0 c = a and a 0 d = a d for all d 6 = c. This is because the only change in the last sent letters between and 0 is in the channel c.

By construction of C, we know that there is a transition t 0 = (q, inc(x (c,ia) ), ;, q 0 ) 2 T 0 in C, and by the definition of . , we also have = (inc(x (c,ia) ), ;). By induction hypothesis, we have (q 0 , 0) ! (q, v) where v = w. Since increases a counter, we have (q, v) ! (q 0 , v 0 ) for the counter valuation v 0 such that v 0 p = v p +1 for p = x (c,ia) and v 0 p 0 = v p 0 for all p 0 2 V \ {p}. Hence, w 0 = v 0 and we have (q 0 , 0) . ! (q 0 , w 0 ). Note that, by Lemma 4.6, we have . 2 L zero C .

From the induction hypothesis, we know that a 2 G(w). In order to show that a 0 2 G(w 0 ), we only need to address the case of the channel c, since the values of a d , w d remain unchanged for all d 6 = c. We know that w 0 c = w c .a 0 c . By induction hypothesis, w c 2 Inf (L c ). Since 0 2 Pref (L ! ), we also have w c .a 0 c 2 Inf (L c ). Hence, a 0 2 G(w 0 ).

Case (2):

Suppose = hc?ai, for some c 2 Ch and a 2 ⌃ c . We have w 0 c = a.w 00 c , and w 00 d = w 0 d for all d 2 Ch \ {c}. Since 0 = . and = hc?ai, we can deduce that a 0 = a. This is because there is no change in the last letter sent between and 0 . By construction of C, we know that there is a transition t 0 = (q, dec(x (c,ia) ), Z, q 0 ) 2 T 0 in C where Z = {(x (c,j) ) | j < i a }. By the definition of . , we also have = (dec(x (c,ia) ), Z). By the induction hypothesis, we have (q 0 , 0) ! (q, w). Furthermore, recall that w 0 c = a.w 00 c . This implies that a is at the head of the channel c in the state (q, w). Hence, all the letters b such that i b < i a are not present in the channel. Therefore, in the state (q, w), all the counters x (c,i b ) are equal to zero for i b < i a . Hence, we can execute the transition t 0 from (q, w), and we have (q 0 , 0) ! (q, w) ! (q 0 , v 0 ) for some counter valuation v 0 . By Lemma 4.6, we have . 2 L zero C . We write v = w, and from the counter machine transition relation, we know that v 0 p = v p 1 for p = x (c,ia) and v 0 p 0 = v p 0 for all p 0 2 V \ {p}. Hence, w 0 = v 0 .

From the induction hypothesis, we know that a 2 G(w). In order to show that a 0 2 G(w 0 ), we only need to address the case of the channel c, since the values of a d , w d remain unchanged for all d 6 = c. We know from the induction hypothesis that w c 2 Inf (L c ). Hence, we can immediately deduce that w 0 c 2 Suf (w c ) ✓ Inf (L c ).

Furthermore, we know that w c = u.a 0 c for some u 2 ⌃ ⇤ c . If u = ", then we can deduce that w 0 c = ". If u 6 = ", then we have w 0 c = u 0 .a 0 c such that a.u 0 = u. Hence, a 0 2 G(w 0 ). Conversely, we can show that runs of the counter machine can be retrieved in the FIFO machine (again, the proof proceeds by induction on the length of the trace):

Proposition 4.8. Let ⌧ 2 A ⇤ C . For all (q, v) 2 X C and a 2 Q c2Ch ⌃ ? c such that ⌧ 2 Pref (V) \ L last a , we have: (q 0 , 0) ⌧ ! C (q, v) =) (q 0 , ") J⌧ K ! M (q, JvK a ) .
Proof. We proceed by induction on the length of ⌧ . In the base case, |⌧ | = 0. The only value of ⌧ such that |⌧ | = 0 is ⌧ = ". Furthermore, " 2 Pref (V) \ L last a where a c = ? for all c 2 Ch. The only state reachable via " is (q 0 , 0). In the FIFO machine, the state (q 0 , ") is the only state reachable via J"K = ". We know that the initial contents is " = J0K a . Hence, the base case is valid.

Let us suppose that the statement holds for ⌧ 2 A ⇤ C where |⌧ | = n. We show that it is true for ⌧ 0 with |⌧ 0 | = n+1. Let a 0 such that ⌧ 0 2 Pref (V)\L last a 0 . Then we can write ⌧ 0 = ⌧.↵ for some ⌧ 2 Act ⇤ C and ↵ 2 Act C . There exists 0 2 Pref (V) \ L last a 0 such that 0 = ⌧ 0 . Furthermore, since . is a homomorphism, we can express 0 = . for some 2 Act ⇤ M and 2 Act M where = ↵ and = ⌧ . Since

Pref (V) is prefix-closed, we have 2 Pref (V) \ L last a for some a 2 Q c2Ch ⌃ ? c . Therefore, ⌧ 2 Pref (V) \ L last a .
Let (q 0 , 0)

⌧ 0
! C (q 0 , v 0 ). Note that, by Lemma 4.6, we have ⌧ 0 2 L zero C . We will prove that (q 0 , ") J⌧ 0 K ! M (q, w 0 ) where w 0 = Jv 0 K a 0 . Since ⌧ 0 = ⌧.↵, there is (q, v) 2 X C such that (q 0 , 0)

⌧ ! (q, v) ↵ ! (q 0
, v 0 ). Hence, there exists a transition t = (q, ↵, q 0 ) 2 T 0 . By the induction hypothesis, we know that (q 0 , ") J⌧ K ! M (q, w) where w = JvK a .

Case (1):

Suppose ↵ = (inc(x (c,i) ), ;) for c 2 Ch and i 2 {1, . . . , n c }. We have v 0 p = v p + 1 for p = x (c,i) and v 0 p 0 = v p 0 and for all p 0 2 V \ {p}.

By construction of C, we know that there is a transition t 0 = (q, , q 0 ) 2 T in M with = hc!ai for some a 2 ⌃ c such that i a = i. Thanks to the trace property (Definition 4.3 (2.)), we have = . Let w 0 be given by w 00 c = w 0 c .a and w 00 d = w 0 d for all d 2 Ch \ {c}. Then, (q, w) ! M (q 0 , w 0 ). Furthermore, since i a = i and w = v, we can deduce that w 0 = v 0 . Moreover, recall that . = ⌧.↵, hence, 0 = . = J⌧ 0 K.

Since 0 = . and = hc!ai, we can deduce that a 0 c = a and a 0 d = a d for all d 6 = c. This is because the only change in the last sent letters between and 0 is in the channel c.

We recall that w 0 = v 0 . From the induction hypothesis, we know that JvK a = w. Hence, in order to show that Jv 0 K a 0 = w 0 , we only need to address the case of the channel c, since the values of a d , w d remain unchanged for all d 6 = c. We know that w 0 c = w c .a 0 c . Since 0 2 Pref (L ! ), we have w c .a 0 c 2 Inf (L c ). Therefore, w 0 = Jv 0 K a 0 .

Case (2):

Suppose ↵ = (dec(x (c,i) ), Z), for c 2 Ch, i 2 {1, . . . , n c } and Z = {x (c,j) | j < i}. We have v 0 p = v p 1 for p = x (c,i) and v 0 p 0 = v p 0 for all p 0 2 V \ {p}.

By construction of C, we know that there is a transition t 0 = (q, , q 0 ) 2 T in M with = hc?ai for some a 2 ⌃ c such that i a = i. Again, by the trace property (Definition 4.3 (2.)), we get = . In order to execute t 0 from (q, w), it is necessary that we have w c = a.u for some word u.

Since . 2 Pref (L ? ) and proj c? ( ).w 0 c = proj c! ( ), we can deduce that w 0 c = a.u for some word u. Hence, the transition t 0 can be executed to reach a state (q 0 , w 0 ) such that w 0 c = a • w 00 c , and w 00 d = w 0 d for all d 2 Ch \ {c}. Furthermore, since i a = i and w = v, we can deduce that w 0 = v 0 . Moreover, recall that . = ⌧.↵, hence, 0 = . = J⌧ 0 K. Since 0 = . and = hc?ai, we can deduce that a 0 = a. This is because no letters are sent between and 0 . We also know from the induction hypothesis that w = JvK a . Also recall that w 0 = v 0 . In order to show that w 0 = Jv 0 K a 0 , we only need to address the case of the channel c, since the values of a d , w d remain unchanged for all d 6 = c.

We know from the induction hypothesis that w c is contained in Inf (()L c ) and, thus, so is w 0 c . Furthermore, we know that w c = u.a 0 c for some u 2 ⌃ ⇤ c . If u = ", then we can deduce that w 0 c = ". On the other hand, if u 6 = ", then we know that w 0 c = u 0 .a 0 c such that a.u 0 = u. We also recall that w 0 = v 0 . Hence,

w 0 = Jv 0 K a 0 .
From Propositions 4.7 and 4.8 and Lemma 4.6, we obtain the following corollary.

Corollary 4.9. For all (q, w) 2 X M , we have:

(q, w) 2 Tracereach M (L ! ) () (q, w) 2 Tracereach C (L zero C \ V \ S a2G(w) L last a ) .
From Theorem 4.5, we know that verifying whether (q, w) 2 Tracereach C (L zero C \ L) where L = V \ S a2G(w) L last a is decidable. Hence, we can already deduce decidability of the (state-)reachability problem. In fact, using Propositions 4.7 and 4.8, we can solve the more general IB rational-reachability problem. For this, it is actually enough to check, in the counter machine, the reachability of a counter value that belongs to a semi-linear set. For a 2 Q c2Ch ⌃ ? c and a rational relation

Rel ✓ Q c2Ch ⌃ ⇤ c , let V a (R) = {v 2 N V | JvK a 2 Rel }.
Lemma 4.10. The set V a (R) is e↵ectively semi-linear.

Proof. For c 2 Ch, let G c be the set of words w 2 ⌃ ⇤ c such that a c is good for w.

Moreover, let G = Q c2Ch G c .
As G c is regular for every c 2 Ch, the relation G is recognizable. As the intersection of a rational and a recognizable relation is rational, we have that Rel \ G is rational. It follows that Parikh(Rel \ G) is semi-linear. From the definitions, we obtain

JvK a 2 Rel () 9w 2 Rel \ G : 8x (c,i) 2 V : v x (c,i) = P a2⌃ c,i |w c | a () 9⇡ 2 Parikh(Rel \ G) : 8x (c,i) 2 V : v x (c,i) = P a2⌃ c,i ⇡ a Thus, V a (R) = {v 2 N V | JvK a 2 Rel } = P a2⌃ c,i ⇡ a x (c,i) 2V | ⇡ 2 Parikh(Rel \ G) .
Let '((X a ) a2⌃ ) be a Presburger formula defining Parikh(Rel \ G). Then, by the above equivalence, the following Presburger formula defines V a (R):

c ((Z y ) y2V ) = 9(X a ) a2⌃ : ⇣ '((X a ) a2⌃ ) ^ŷ2V Z y = X a2⌃y X a ⌘
where, for y = x (c,i) 2 V , we let ⌃ y = ⌃ c,i . It follows that V a (R) is e↵ectively semi-linear.

Using this property, we finally reduce the IB rational-reachability problem to a reachability problem in counter machines: Corollary 4.11. For every q 2 Q, we have:

(q, w) 2 Tracereach M (L ! ) for some w 2 Rel () (q, v) 2 Tracereach C (L zero C \ V \ L last a ) for some a 2 Q c2Ch ⌃ ? c and v 2 V a (R) .
Proof. Suppose (q, w) 2 Tracereach M (L ! ) with w 2 Rel . There are a 2 Q c2Ch ⌃ ? c and 2 V \ L last a such that (q 0 , ") ! M (q, w). By Proposition 4.7 and Lemma 4.6, we have (q 0 , 0) ! C (q, w) and 2 L zero C and a 2 G(w). By definition, the latter implies w = JwK a and hence w 2 V a (R).

Conversely, suppose we have (q 0 , 0) ! C (q, v) where 2 V \L last a , 2 L zero C , and v 2 V a (R). By Proposition 4.8, we get (q 0 , ") J K ! M (q, JvK a ). Note that J K = 2 L ! . Moreover, v 2 V a (R) implies JvK a 2 Rel , which concludes the proof.

By Theorem 4.5, we can now deduce the following theorem: Theorem 4.12. IB rational-reachability is decidable for FIFO machines.

Reachability and deadlock

We now address some other commonly studied reachability problems, which, as it turns out, can be reduced to the IB rational-reachability problem studied in the previous section. We first look at the control-state reachability problem.

Decision Problem: IB CONTROL-STATE REACHABILITY

Input:

a FIFO machine M = (Q, Ch, ⌃, T, q 0 ) a tuple L = (L c ) c2Ch of non-empty regular bounded languages a control-state q 2 Q Question: is (q, w) 2 Tracereach M (L ! ) for some w?

In [START_REF] Finkel | Verification of Flat FIFO Systems[END_REF], it was shown that reachability reduces to control-state reachability for flat FIFO machines but the converse is not true. However, using the same reductions as in [START_REF] Finkel | Verification of Flat FIFO Systems[END_REF], we obtain the following result: Proposition 4.13. IB reachability is recursively equivalent to IB control-state reachability for FIFO machines.

Proof. Let us consider a FIFO machine M = (Q, Ch, ⌃, T, q 0 ) with Ch = {1, . . . , m}, a control-state q, a state (q, w), and a tuple L = (L c ) c2Ch of non-empty regular bounded languages L c ✓ ⌃ ⇤ c . Suppose w = (w c ) c2Ch with w c = w 1 c . . . w nc c .

We first reduce IB reachability to IB control-state reachability. We construct another machine M (q,w) = (Q 0 , Ch, ⌃ 0 , T 0 , q 0 ) as follows. We set Q 0 = Q [ {q end } such that q end / 2 Q, and ⌃ 0 = ⌃[{$} such that $ 6 2 ⌃. Moreover, a "path" q ! q end with = 1 . . . m is added from the control-state q as follows. For c 2 Ch, we have

c = ( hc!$ihc?w 1 c i . . . hc?w nc c ihc?$i if |w c | > 0, hc!$ihc?$i otherwise.
Then, (q, w) 2 Tracereach M (L ! ) i↵ q end is reachable, i.e., (q end , w 0 ) 2 Tracereach M (q,w) (L 0 ! ) for some w 0 , where L 0 = (L c .w c .$) c2Ch . Furthermore, L 0 is bounded if L is bounded, since concatenation of a finite word with a bounded language results in a bounded language. Therefore, IB reachability in M reduces to IB control-state reachability in M (q,w) .

Conversely, in order to show that IB control-state reachability is reducible to IB reachability, we construct M q as follows. To M, we add |⌃| ⇥ m self-loops around the control-state q as follows: q c?a ! q for all c 2 Ch and a 2 ⌃ c .

The control-state q is reachable in M i↵ there exists w such that (q, w) is reachable in M i↵ (q, ") is reachable in M q (as we can read all the channel contents in q due to the self-loops). Moreover, consider 2 Pref (L ! ) such that (q 0 , ") ! M (q, w) for some channel contents w. Let us append to a sequence of actions 0 = 1 . . . m such that c = hc?w c i for all c 2 Ch, where hc?w c i is to be understood as a sequence of transitions whose e↵ect is to consume the string w c from the channel c. By construction, we have, (q 0 , ")

• 0 ! Mq (q, "). Furthermore, proj c! ( ) = proj c! ( • 0 ) for all c 2 Ch. Hence, • 0 2 Pref (L ! ) and we can conclude that the control-state q is reachable in M i↵ (q, ") 2 Tracereach Mq (L ! ).

Therefore, IB control-state reachability reduces to IB reachability for FIFO machines.

Definition 4.14. We say that a state (q, w) of a FIFO machine M is a deadlock state deadlock if there is no state reachable from it, i.e., there exists no (q 0 , w 0 ) such that (q, w) ! M (q 0 , w 0 ).

Decision Problem: IB DEADLOCK Input: a FIFO machine M = (Q, Ch, ⌃, T, q 0 ) a tuple L = (L c ) c2Ch of non-empty regular bounded languages a control-state q 2 Q Question:

does Tracereach M (L ! ) contain a deadlock?

Proposition 4.15. IB reachability is recursively reducible to IB deadlock for FIFO machines.

Proof. Given a FIFO machine M = (Q, Ch, ⌃, T, q 0 ), a state (q, w), and a tuple L = (L c ) c2Ch of non-empty regular bounded languages L c ✓ ⌃ ⇤ c , we construct M (q,w) as in the case of reducing reachability to control-state reachability (see proof of Proposition 4.13). We then modify M (q,w) to M 0 (q,w) as follows. We add a new channel d to the existing set of channels Ch (the set of channels is now Ch 0 ). For all q 6 = q end , we add the following transition: (q, hd!$i, q). Hence, except for q end , every control-state has at least one send action. Finally, we also construct a new tuple

L 0 = (L 0 c ) c2Ch 0 such that L 0 c = L c .$ for all c 2 Ch and L 0 d = $ ⇤ .
We claim that (q, w) 2 Tracereach M (L ! ) i↵ Tracereach M 0 (q,w) (L 0 ! ) contains a deadlock. To see this, first, we observe that, if there is a deadlock in Tracereach M 0 (q,w) (L 0 ! ), then the associated control-state would be q end since from every other state s 0 such that the associated control-state q 0 is not q end , the transition (q 0 , hd!$i, q 0 ) can always be taken, and hence, there will never be a deadlock. Moreover, as in the construction in Proposition 4.13, the control-state q end is reachable i↵ the state (q, w) is in Tracereach M (L ! ).

Let us now suppose that the state (q, w) is in Tracereach M (L ! ). We can execute the same set of transitions as in M and reach the control-state q with the channel contents w via an execution 0 in M 0 (q,w) . Having done that, we can then execute the path q ! q end as described in T 0 in order to reach q end . Also observe that 0 • 2 L 0 ! . Since there are no transitions from this control-state, we reach a deadlock.

Suppose now that (q, w) is not in Tracereach M (L ! ). Hence, we can never reach (q, w) in M 0 and thus, can never execute q ! q end and reach q end . Furthermore, as we saw previously, we can never be in a deadlock as we can always send $ to the channel d.

Corollary 4.16. The problems IB reachability, IB control-state reachability, and IB deadlock are decidable for FIFO machines.

Since input-bounded FIFO machines subsume VASS (a VASS can be seen as an input-bounded FIFO machine with an alphabet reduced to a unique letter), the complexity of IB reachability is not elementary, which is inherited from the lower bound for VASS [CLL + 19].

Unboundedness and termination

We now introduce two new decision problems, firstly unboundedness, defined as follows:

Decision Problem: IB UNBOUNDEDNESS Input: a FIFO machine M = (Q, Ch, ⌃, T, q 0 ) a tuple L = (L c ) c2Ch of non-empty regular bounded languages Question:

is Tracereach M (Pref (L ! )) infinite?

IB unboundedness in FIFO machines reduces to an equivalent problem in counter machines. Given a FIFO machine M and L, the associated FIFO machine M in normal form (with the corresponding tuple L of distinct-letter languages), as well as the associated counter machine C, the following result can be derived.

Proposition 4.17.

Tracereach M( L! ) is infinite i↵ Tracereach M (L ! ) is infinite i↵ Tracereach C (L zero C \ V) is infinite.
Proof. We first show that unboundedness is preserved by the normal-form construction. This essentially follows from Lemma 4.4 and the fact that h is lengthpreserving.

If (q, ŵ) 2 Tracereach M( L! ), then ((q, q A ), w) 2 Tracereach M (L ! ) for some q A and w such that h(w) = ŵ. Thus, if Tracereach M( L! ) is infinite, then so is

Tracereach M (L ! ).
Conversely, if ((q, q A ), w) 2 Tracereach M (L ! ), then (q, h(w)) 2 Tracereach M( L! ). Thus, if Tracereach M (L ! ) is infinite, then so is Tracereach M( L! ). Now, let us assume that Tracereach M (L ! ) is infinite. Hence, there are infinitely many states (q, w) 2 X M which are reachable from (q 0 , "). From Corollary 4.9, for each of these states, (q, w) 2 Tracereach C (L), where

L = L zero C \ L ! \ Pref (L ? ) \ S a2G(w) L last a . Since L ✓ L zero C \ L ! \ Pref (L ? ), we have (q, w) 2 Tracereach C (L zero C \ L ! \ Pref (L ? ))
. Furthermore, there are only finitely many states (q, w) 2 X M that correspond to a state (q, w)

2 X C . Hence, if Tracereach M (L ! ) is infinite, Tracereach C (L zero C \ L ! \ Pref (L ? )) is infinite.
For the converse direction, let us assume that Tracereach C (L zero C \L ! \Pref (L ? )) is infinite. Hence, there are infinitely many states (q, v) reachable from (q 0 , 0) via some ⌧ such that ⌧ 2 L zero C \ L ! \ Pref (L ? ). Let us choose one such (q, v) and ⌧ . There exists a unique such that = ⌧ . Consider the vector a such that 2 L last a and let w = JvK a . Thus, w = v. Hence, (q, w) 2

Tracereach C (L zero C \ L ! \ Pref (L ? ) \ S a2G(w) L last a )
. From Corollary 4.9, we can deduce that (q, w) 2 Tracereach M (L ! ). Therefore, for every v such that (q, v) is reachable, there is a corresponding state (q, w) reachable in Tracereach M (L ! ).

In particular, this statement applies to prefix-closed languages, i.e., we can reduce checking whether Tracereach M(Pref ( L! )) is infinite to checking whether Tracereach C (L zero C \ V) is infinite for some C and prefix-closed language V. The latter is decidable as we establish in the following. Recall that, by the construction of C, we then have

Reachset C = Tracereach C (L zero C \Pref (V)) = Tracereach C (L zero C \ V).
The main idea that follows is the reduction of unboundedness of the counter machine to reachability in a modified counter machine. It is not immediate that we can use the results in the literature (for example [START_REF] Dufourd | Polynomial-Time Many-One reductions for Petri nets[END_REF]) which reduce boundedness to reachability in Petri nets/VASS. This is because the property of monotonicity does not extend to zero tests; if one can execute a zero test at (q, v), it is not necessarily the case that it can be executed at (q, v 0 ) with v  v 0 , where we let

v  v 0 if v x  v 0
x for all x 2 V . However, we show that, for the counter machine that we construct from the FIFO machine, this property does hold. If we are able to show this, the constructions used in the case of VASS can be adapted.

Lemma 4.18. For every execution in C of the form (q 0 , 0) ! (q, v) 0 ! (q, v 0 ) such that v  v 0 , the following holds: The counters that are tested to zero during 0 already evaluate to zero at (q, v), and do not change their value throughout the execution of 0 .

Proof. Let us assume to the contrary that there is at least one counter which is incremented or decremented during 0 and also tested to zero during the execution. Without loss of generality, let us consider x (c,i) to be the first counter along the execution 0 that is tested to zero during 0 and also incremented/decremented before it was tested to zero.

• Case (1): It has a non-zero value at (q, v), and is then either decremented, or first incremented and then decremented, and finally tested to zero. Since we know that . 0 2 L zero C , no counter tested to zero can then be incremented. Hence, its value will remain zero. But this is a contradiction to our assumption that v  v 0 . Hence, all the counters with non-zero values at (q, v) cannot be tested to zero during 0 .

• Case (2): It has value zero in (q, v), and is incremented, then decremented, then tested to zero during 0 . This implies that it first has to be incremented. Consider now some sub-execution 00 2 Pref ( 0 ) where (q, v) 00 ! (q 1 , v 1 ) such that the value of x (c,i) in the state (q 1 , v 1 ) is non-zero. Since there are no "new" zero-tests along the execution 00 (by our assumption), we can execute 00 from (q, v 0 ) (by the monotonicity and trace property). However, we cannot increment the counter x (c,i) along 00 , because it was tested to zero during the run (q 0 , 0)

. 0 ! (q, v 0 ). Hence, we once again have a contradiction. Now, we can use results from [START_REF] Finkel | Well-structured transition systems everywhere![END_REF] to show the following: Proposition 4.19. The set Reachset C is infinite i↵ there exist , 0 2 Act ⇤ C , q 2 Q, and v, v 0 2 N V such that (q 0 , 0) ! (q, v) 0 ! (q, v 0 ) and v < v 0 (i.e., v  v 0 and v 6 = v 0 ).

Proof. Let us assume that Reachset C is infinite. As in [START_REF] Finkel | Well-structured transition systems everywhere![END_REF], we consider the tree of all prefixes of computations. We prune this tree by removing all prefixes where there is at least a loop, i.e., containing two nodes that are labeled by the same state. Since every reachable state can be reached without a loop, we still have an infinite number of prefixes in the pruned tree. For every state (q, v) in the tree, there are finitely many successors (as the transition system is finitely branching). Hence, in order for the tree to be infinite, there is at least one infinitely long execution (by König's lemma). This execution has no loop. Therefore, by Dickson's lemma, there is an infinite subsequence of states (q 1 , v 1 ), (q 2 , v 2 ), . . . such that v 1 < v 2 < . . .. Once we extract this sequence, since there are only finitely many control-states in Q, we know that there is at least one pair (q, v), (q, v 0 ) such that (q 0 , 0) ! (q, v)

0 ! (q, v 0 ) and v < v 0 .
Conversely, let us assume that there is an execution (q 0 , 0) ! (q, v) 0 ! (q, v 0 ) such that v < v 0 . We know from Lemma 4.18 that the only counters which may be tested for zero during 0 already evaluate to zero at (q, v), and do not change their value throughout the execution of 0 . Therefore, all the transitions of the counter system in 0 can be considered as VASS operations. Hence, the property of monotonicity holds, i.e., if (q, v) 0 ! (q, v 0 ) and (q, v) < (q, v 0 ), then we know there exists an infinite sequence v 1 < v 2 < . . . reachable from state (q, v 0 ).

Construction of modified counter system. We modify the counter system C and construct a new counter system C 0 such that Reachset C is infinite i↵ a specific state is reachable in C 0 . The construction is loosely based on the reduction of boundedness to reachability for Petri Nets in [START_REF] Dufourd | Polynomial-Time Many-One reductions for Petri nets[END_REF].

Proposition 4.20. We can e↵ectively construct a counter machine C 0 (with bounded zero tests) and a finite set of states R ✓ S C 0 such that Reachset C is infinite i↵ some state from R is reachable in C 0 .

Proof. We modify the counter machine C and construct a new counter machine C 0 such that Reachset C is infinite i↵ a state belonging to a finite set is reachable in C 0 . The construction is loosely based on the reduction of boundedness to reachability for Petri Nets in [START_REF] Dufourd | Polynomial-Time Many-One reductions for Petri nets[END_REF]. Since we do not know the values of v and v 0 a priori, we will try to characterize the general condition. The di↵erence v 0 v is a non negative vector, with at least one strictly positive component. We add a duplicate set of counters for every counter in the system. The intuition is that the counter machine non-deterministically moves from operating on both sets to a state from where it only operates on this second set. The first set will remain unchanged (with the value v), and the second set will keep track of the values (until it reaches v 0 ). From this state (which represents (q, v 0 )), we move to a new control-state, q reach . Here, we check for the condition v 0 v > 0 by first decrementing each counter in the first set which has a non-zero value in tandem with the corresponding counter in the second set. We do this until all the counters in the first set are equal to zero. If v 0 v > 0, then there is at least one counter in the second set with a non-zero counter value. We non-deterministically decrement all the counters in the second set until we reach a state that has some counter c in the second set with a value of 1, and all other counters evaluate to zero. Since there are finitely many such states, we can just check every case.

From the above results, we have the following theorem.

Theorem 4.21. The IB unboundedness problem is decidable for FIFO machines.

In [START_REF] Gouda | On deadlock detection in systems of communicating finite state machines[END_REF], the authors stated that unboundedness is in EXPSPACE for letter-bounded systems. However, they only give an idea of the proof, stating that it can be done in a similar fashion as for the deadlock problem. In the construction for solving the deadlock problem, they reduce the input language to tally letter-bounded languages (tally means that the input-language is included in a ⇤ where a is a letter). They add as many channels as letters in the original letter-bounded-language. Furthermore, in order to ensure that no channel is nonempty before the next channel is read, they ensure that in all control-states where a later channel is being read, there are reception transitions of previous channel contents which lead to a sink state (where there is never a deadlock). Notice that it is still possible to leave a channel non-empty before the next channel is read. But one never reaches a deadlock in such an "incorrect" run, since there is always the option of reading the unread channel contents of the previous channels and reach the sink state.

However, when we consider this model for unboundedness, there may exist unbounded "incorrect" runs since we can leave a channel non-empty and proceed to the next and may have an unbounded run there. Hence, it seems that one still needs some reachability test to check if the runs are correct because we cannot ensure that some channels are zero in an unbounded run.

We now look at the IB termination problem, which we will define below:

Decision Problem: IB TERMINATION Input: a FIFO machine M = (Q, Ch, ⌃, T, q 0 ) a tuple L = (L c ) c2Ch of non-empty regular bounded languages a state s 2 X M Question: is there no infinite execution init M 1 ! M s 1 2 ! M s 2 3 ! M . . . such that, for all i 2 N, we have s i 2 X M , i 2 Act M , and 1 . . . i 2 Pref (L ! )?
For termination, we take a similar approach as for unboundedness. Suppose again that we are given M and L, the associated FIFO machine M in normal form (with the corresponding tuple L of distinct-letter languages), and the associated counter machine C. We first show that the normal form preserves the (non-)termination property. In the following, i will denote a send or receive action and ↵ i will denote an increment or decrement action.

We obtain the following equivalence.

Proposition 4.22. The following statements are equivalent:

• There is an infinite execution of the form init

M 1 ! M s 1 2 ! M s 2 3 ! M . . . such that, for all i 2 N, we have 1 . . . i 2 Pref ( L! ).
• There is an infinite execution of the form init

M 1 ! M s 1 2 ! M s 2 3 ! M . . . such that, for all i 2 N, we have 1 . . . i 2 Pref (L ! ).

Proof. Assume that there is an infinite execution of the form init

M ˆ 1 ! M ŝ1 ˆ 2 ! M ŝ2 ˆ 3 ! M .
. . in M such that, for all i 2 N, we have ˆ 1 . . . ˆ i 2 Pref ( L! ). Hence, there are 1 , 2 , 3 , . . . 2 Act M such that, for all i 2 N, letting i = 1 . . . i , we have h( i ) = ˆ 1 . . . ˆ i and i 2 Pref (V). Hence, we know that, in the FIFO machine h 1 ( M), one has (q 0 , ") 1 ! (q 1 , w 1 ) 2 ! (q 2 , w 2 ) 3 ! . . . for suitable (q i , w i ) (by construction of h 1 ( T )), and that i 2 Pref (L(A)). Therefore, since M is a product of the two machines, we can deduce that there is an infinite execution init

M 1 ! M s 1 2 ! M s 2 3 ! M . . . as required.
Conversely, assume that there is an infinite execution of the form init

M 1 ! M s 1 2 ! M s 2 3 ! M . . . such that, for all i 2 N, we have 1 . . . i 2 Pref (L ! ). Let ˆ i = h( 1 . . . i ) for all i 2 N. Since 1 . . . i 2 Pref (L ! ), we have proj c! ( 1 . . . i ) 2 Pref (L c ) for all c 2 Ch. In particular, proj c! ( 1 . . . i ) 2 h 1 c (Pref ( Lc )) and, therefore, h c (proj c! ( 1 . . . i )) = proj c! (h( 1 . . . i ))
2 Pref ( Lc ). We deduce ˆ i 2 Pref ( L! ). Furthermore, we can execute ˆ in M (by construction) for all i 2 N. Hence, we can build an infinite execution in M , such that ˆ i 2 Pref ( L! ) for all i 2 N.

The latter property can be reduced to checking a decidable property in the counter machine as follows:

Proposition 4.23. The following statements are equivalent:

• There is an infinite execution of the form init

M 1 ! M s 1 2 ! M s 2 3 ! M . . . such that, for all i 2 N, we have 1 . . . i 2 Pref (L ! ).
• There is an infinite execution of the form init

C ↵ 1 ! C s 1 ↵ 2 ! C s 2 ↵ 3 ! C . . . such that, for all i 2 N, we have ↵ 1 . . . ↵ i 2 L zero C \ Pref (V). • There exist 2 Act ⇤ C , 0 2 Act + C , (q, v) 2 X C , and v 0 such that (q 0 , 0) ! C (q, v) 0 ! C (q, v 0 ) and v  v 0 .
Proof. The equivalence of the first two items is obtained as a corollary of Propositions 4.7 and 4.8. So let us show that the latter two are equivalent.

Consider a non-terminating execution as described above. By Dickson's lemma, there is an infinite subsequence of states (q 1 , v 1 ), (q 2 , v 2 ), . . . such that v 1  v 2  . . .. Once we extract this sequence, since there are only finitely many control-states in Q, we know that there is at least one pair (q, v), (q, v 0 ) such that (q 0 , 0) ! (q, v) 0 ! (q, v 0 ) and v  v 0 . Conversely, assume (q 0 , 0) ! (q, v) 0 ! (q, v 0 ) and v  v 0 . From the same argument as for boundedness, we can deduce that no counter is being tested to zero for the first time in 0 and all the counters previously tested stay unchanged. Hence, all the transitions of the counter system in 0 can be considered as VASS operations. Therefore, we know there exists v 00 such that (q, v 0 ) 0 ! (q, v 00 ) and v 0  v 00 . Repeating this reasoning, we can build an infinite sequence starting from (q, v 0 ). Finally, we construct a modified counter machine as in the case for boundedness (Proposition 4.20) and get the following: Proposition 4.24. We can e↵ectively construct a counter machine C 00 (with bounded zero tests) and a state s 2 S C 00 such that the following statements are equivalent:

• There exist 2 Act ⇤ C , 0 2 Act + C , (q, v) 2 X C , and v 0 such that (q 0 , 0) ! C (q, v)

0 ! C (q, v 0 ) and v  v 0 . • State s is reachable in C 00 .
Proof. We can adapt the construction of C 0 for unboundedness. The di↵erence is that we now allow for v = v 0 . Hence, there is no need any more to check that, after decrementing both sets of counters in tandem, there is still a positive counter left in the second set. We can therefore also empty the second set of counters in a new control-state q and check whether (q, 0) is reachable. Thus, we have the following theorem.

Theorem 4.25. The IB termination problem is decidable for FIFO machines.

Output-bounded problems

We consider the dual case of input-bounded languages in which the set of words that may be received by each channel (the output-language) is constrained to be bounded. The OB problems are defined as follows:

Definition 4.26. OB decision problems Given a FIFO machine M = (Q, Ch, ⌃, T, q 0 ), a tuple L = (L c ) c2Ch of non-empty regular bounded languages L c ✓ ⌃ ⇤ c (each given in terms of a finite automaton), a control-state q 2 Q, a state s 2 X M , and a rational relation

Rel ✓ Q c2Ch ⌃ ⇤ c .
• OB rational reachability: Do we have (q, w) 2 Tracereach M (L ? ) for some w 2 Rel ?

• OB reachability: Do we have s 2 Tracereach M (L ? ) ?

• OB control-state reachability: Do we have (q, w) 2 Tracereach M (L ? ) for some w ?

• OB deadlock: Does Tracereach M (L ? ) contain a deadlock ?

• OB unboundedness: Is Tracereach M (Pref (L ? )) infinite?

• OB termination: Is there no infinite execution of the form init

M 1 ! M s 1 2 ! M s 2 3 ! M .
. . such that, for all i 2 N, we have s i 2 X M , i 2 Act M , and 1 . . . i 2 Pref (L ? )? Theorem 4.27. OB reachability is decidable for FIFO machines.

Proof. Given a state (q, w) in M, and a tuple of bounded languages L, the output-bounded reachability problem asks if (q, w) 2 Tracereach M (L ? ). Since the output language is in L ? , we know that the contents of the channels which have already been read is in the corresponding input-language, i.e., L ! . Therefore, (q, w) 2 Tracereach M (L ? ) i↵ (q, w) 2 Tracereach M (L ! 0 ) where L 0 = (L 0 c ) c2Ch and L 0 c = L c .w c . Hence, the OB reachability problem is decidable for FIFO machines.

Theorem 4.28. OB control-state reachability is decidable for FIFO machines.

Proof. In order to show that OB control-state reachability is decidable for FIFO machines, we first convert it to the normal form. This construction is similar to that as specified in Section 4.1, however we make a few changes. Firstly, when we change the alphabet to distinct letter, we add an additional letter, say $, to represent all the letters which are not present in the bounded language, but are present in the transitions of the FIFO system. Then, in addition to the transitions we already add to the new FIFO system as in Section 4.1, for every send action in the original FIFO system, we add a send action with this new letter $. However, for the reception, we leave it as before. This new FIFO system can now only read letters in the output language, however, it can potentially send any letter. Hence, we have only restricted the output language.

Next, to the automata that is constructed to accept the bounded language for send actions, we add to all the states a transition that enables the automata to send $ and go to a sink state which loops with send actions sending $. Hence, once again, we have ensured that the input language is not restricted. To the reception automata, we make no such changes. Hence, the reception automata only accept the bounded language.

In this new machine, we can solve for control-state reachability, over the inputlanguage L 0 = (L 0 c ) c2Ch such that L 0 c = L c .$ ⇤ (but we let the output-language remain L when we construct the trimmed automata). If a state (q, w) is reachable in this new machine, then there exists a path which can be taken in the original machine to reach control-state q via 2 L ? . Furthermore, if there is a path which can be taken in the original machine, it can also be taken in the new machine. Hence, we can decide if there exists a w such that (q, w) is reachable.

Theorem 4.29. OB unboundedness and OB termination problems are decidable for FIFO machines.

Proof. We can decide the OB unboundedness and termination problems as well. We can construct a counter system for the normal form described in the proof of Theorem 4.28. Note that the counter corresponding to $ will only have increments and no decrements, which is in line with the fact that the contents corresponding to this counter do not belong to the output-language. The FIFO machine has an infinite run i↵ this newly constructed counter machine has also an infinite run. We then construct the modified counter machine, as is the case for boundedness (see Section 4.4), and test if there is a run (q 0 , 0) ! (q, v) 0 ! (q, v 0 ) such that v < v 0 . Since this modified counter system has bounded zero tests (the added counter has no decrements or zero tests associated to it), we can decide the reachability of the state, and hence, decide if the FIFO machine is unbounded. A similar explanation can be made for termination.

The rational reachability problem cannot be directly reduced to the inputbounded case. For the output bounded case, we do not know precisely the reachability set, since we only restrict the output-language. Hence, in order to check if some w 2 Rel is reachable, we need to be able to compute the reachability set. Similarly, unlike the input-bounded case, we cannot determine the deadlock problem a priori, since the deadlock problem is reduced to rational reachability for the input-bounded case. Hence, these two problems have been left open.

FIFO machines with a single channel

When we restrict the communication to a single channel, we obtain better upper bound for reachability.

Upper bound for reachability: EXPTIME We consider the model of ordered multi-pushdown systems, studied in [START_REF] Faouzi Atig | Emptiness of Ordered Multi-Pushdown Automata is 2ETIME-Complete[END_REF]. We define it using our counter systems. A counter system can be seen as a multi-pushdown system with a unary alphabet. Unary ordered multi-pushdown systems (UOMPDSs) UOMPDS are multi-pushdown systems which impose a total order on the counters and limit decrements to the lowest non-empty counter. We use the following result of reachability of UOMPDS.

Theorem 4.30 ([ANKS13], Theorem 13). The reachability problem in UOMPDS is solvable in EXPTIME.

Consider the counter machine C with the semantic restriction L zero C which can be built from a single channel FIFO machine M. We see that a counter x i can only be decremented if the previous counters x j such that j < i are equal to zero. Therefore, the counter system C is a UOMPDS, where the order of the counters is defined as x i < x j i↵ i < j. Hence, we have the following proposition.

Proposition 4.31. IB reachability in single channel FIFO machines is polynomially reducible to reachability in UOMPDS.

In [START_REF] Faouzi Atig | Adjacent Ordered Multi-Pushdown Systems[END_REF], it was also shown that repeated reachability for UOMPDS is solvable in EXPTIME. We know that a system is non-terminating if and only if we can reach any control-state infinitely often. Therefore, we can guess a controlstate and verify if it is reachable repeatedly in order to verify if the system is non-terminating. Furthermore, we see that even for FIFO machines with a single channel, using the same construction as in Proposition 4.13, reachability and control-state reachability are recursively equivalent.

We then have the following corollary.

Corollary 4.32. The IB reachability, termination and control-state reachability problems are in EXPTIME for FIFO machines with a single channel.

However, for the unboundedness result in Section 4.4, we use the reachability for counter systems with bounded zero tests. Furthermore, the set of all counters in the modified counter system do not have a total order any more. Hence, following our constructions, we may only say that the unboundedness problem in FIFO machines with a single channel (over a bounded language) is solvable by using the Petri net reachability (which is tower-hard).

In the case of a single channel, we have a total order on the counters, and therefore we are able to use results from Ordered Multipushdown Systems. However, even when we consider two channels, we cannot immediately extend these results since there is no longer a total order in the decrement of counters.

Lower bound for reachability: NP-hard We consider a sub-problem of the IB reachability, unboundedness, and termination problems as follows. Recall that, given a bounded language L = w ⇤ 1 . . . w ⇤ n , if |w 1 | = . . . = |w n | = 1, i.e., w 1 , . . . , w n 2 A, then L is called a letter-bounded language. Definition 4.33. Given a FIFO machine ILB decision problems M = (Q, Ch, ⌃, T, q 0 ), a control-state q 2 Q, a state s 2 X M , and a tuple L = (L c ) c2Ch of non-empty regular letterbounded languages L c ✓ ⌃ ⇤ c .

• ILB-reachability: Do we have s 2 Tracereach M (L ! ) ?

• ILB-unboundedness: Is Tracereach M (Pref (L ! )) infinite?

• ILB-termination: Is there no infinite execution of the form init

M 1 ! M s 1 2 ! M s 2 3 ! M .
. . such that, for all i 2 N, we have s i 2 X M , i 2 Act M , and 1 . . . i 2 Pref (L ! )?

We see that most of the properties are NP-hard for FIFO machines with a single channel over a letter-bounded language. This is proved by simulating 3-CNF formula with such machines. Our simulation follows the same ideas as the proof of NP-hardness for flat FIFO machines with multiple channels [START_REF] Esparza | A Perfect Model for Bounded Verification[END_REF][START_REF] Finkel | Verification of Flat FIFO Systems[END_REF], except that we use a unique channel.

Theorem 4.34. ILB-reachability, ILB-unboundedness, and ILB-non-termination are NP-hard for machines with a single channel, even when the input language is letter bounded.

Proof. We reduce from 3SAT. Given a 3-CNF formula C 1 ^. . . ^Cm over variables x 1 , . . . , x n , we construct a FIFO machine with one channel. The message alphabet has 2n+1 letters and is as follows

⌃ # = ⌃]{#}, where ⌃ = {1, . . . , n}]{ 1, . . . , n}.
The FIFO machine consists of the gadgets shown below. The gadget for variable x k adds either k (in the top transition) or k (in the bottom edge) to the channel. At the end of this gadget, the channel will have either k or k. We will sequentially compose the gadgets for all variables. Starting from the initial control-state of the gadget for variable x 1 , we reach the final control-state of the gadget for variable

x n , such that for every variable x k we either have k or k in the channel -and this determines the truth valuation.

We then add the gadget that adds the stop symbol to the channel, as shown in Figure 4.9.

C 1 = x 1 _ ¬x 2 _ ¬x 3 (
gadgets for other clauses follow similar pattern) is shown in Figure 4.10. The gadget checks that the channel has either 1 (in the top path) or has 2 (in the middle path) or has 3 (in the bottom path). We append the clause gadgets to the end of the variable gadgets one after the other. All clauses are satisfied by the truth valuation determined by the contents of channels x 1 , . . . , x n i↵ we can reach the last control-state of the last clause.

The gadget for cleaning up all the variables is shown below (it receives all the letters from the channel). We append the clean-up gadget to the end of the clause gadget for C m .

Note that in the FIFO machine given above, every gadget can only be visited once, and the input language of each gadget for a variable x k is equal to {k, k} which is included in the letter-bounded language k ⇤ k⇤ . Hence, for every execution " " " ?a!a ?1!1 ?a!a ?#!# ?a!a ? 2! 2 ?a!a ?#!# ?a!a ? 3! 3 ?a!a ?#!# ?⌃ # (a) Gadget for clause along the sequence of variable gadgets, we have 2 L ! where L = 1 ⇤ 1⇤ . . . n ⇤ n⇤ # ⇤ . For every clause gadget, we have, once again, an execution 0 2 L ! . Hence, we see that the input-language of every run can be restricted to the bounded language (1 ⇤ 1⇤ . . . n ⇤ n⇤ # ⇤ ) m+1 . Furthermore, while there are loops in the FIFO machine, it can be seen that no loop can be executed infinitely often. We can also see that along every run, the channel is bounded and the size of the channel does not exceed n + 1.

C 1 = x 1 _ ¬x 2 _ ¬x 3 (b) Gadget for clean-up
The given 3-CNF formula is satisfiable i↵ the control-state of the clean-up gadget can be reached with the channel being empty. Hence, this constitutes a reduction to the reachability problem. Furthermore, if we add a self loop to the state of the clean-up gadget, such that it sends the letter # to the channel, then this loop can be iterated infinitely often to add unboundedly many occurrences of the letter # to the channel. Now, the given 3-CNF formula is satisfiable i↵ the constructed FIFO machine is unbounded i↵ channel is unbounded i↵ there is a non-terminating run. Hence reachability, unboundedness and non-termination are all NP-hard.

We can remove the "-transitions in the above construction by instead nondeterministically choosing one of the three variables per clause. This would eliminate all "-transitions, and corresponds to the model we define, which does not have them.

We can adapt the proof above to the more restrictive case of FIFO machines whose input language is restricted to a distinct-letter-bounded language, by modifying the transitions in the gadget for clause C i as follows: For every transition sequence of the form ?a!a, we replace it by ?a i 1 !a i , thereby ensuring that we write di↵erent letters to the channel in every gadget. The transitions for the gadgets for each variable x k (when it is set initially) would be modified by !k 0 and ? k0 . Furthermore, we can modify gadgets for the clauses (see Figure 4.11) in order to have the following corollary, which improves a similar result for flat FIFO machines with multiple channels in [START_REF] Finkel | Verification of Flat FIFO Systems[END_REF].

" " " ?1!1 ?2!2 ? 2! 2 . . . ?n!n ?n!n ?#!# ?1!1 ? 1! 1 ? 2! 2 . . . ?n!n ?n!n ?#!# ?1!1 ? 1! 1 ?2!2 ? 2! 2 ? 3! 3 . . . ?n!n ?n!n ?#!# ?1 " ? 1 " . . . ?# (a) Gadget for clause C 1 = x 1 _ ¬x 2 _ ¬x 3 (b) Gadget for clean-up
Corollary 4.35. For flat FIFO machines with a single channel, reachability, unboundedness, and non-termination are NP-hard, hence, they are also NP-complete.

Towards a theory of boundable FIFO machines.

We conclude by briefly summarizing the results in this chapter in Table 4.1. As shown, we were able to extend a lot of the decidability results from flat and letter-bounded systems to the bounded case.

Table 4.1: Summary of key results in this chapter; results for all other extensions are subsumed by these results (D stands for decidable).

Flat Letter-bounded Bounded UNBOUND NP-C ([FP20]) D ([GGLR87]) D ([JJ93]) TERM NP-C ([FP20]) D D REACH NP-C ([FP20]) D D, not ELEM CS-REACH NP-C ([EGM12, FP20]) D D DEADLOCK D D ([GGLR87]) D
Let us now look at the implications of bounded verification problems in the general case. 0 1 (p, q) (q, p) Example 20. Coming back to the protocol CDP M from Example 2 and Figure 2.2, we see that it is neither monogeneous nor linear nor flat. Since the input-languages of the two channels contain {a, ab} ⇤ and e ⇤ resp., and since {a, ab} ⇤ is not a bounded language, we have proj c! (Traces(M)) 6 ✓ L c! for every pair of bounded languages (L c ) c2Ch . In other words, M is not input-bounded. However, when we look at the reachability set obtained by considering the tuple of bounded languages L = (L (p,q) , L (q,p) ) where L (p,q) = (ab) ⇤ (a + ")(ab) ⇤ is a bounded language over (ab, a, ab), and L (q,p) = e ⇤ is a bounded language over (e), we still obtain the entire reachability set. That is, we have Reachset M = Tracereach M (L ! ). Hence, even though the input-languages of the system are not all bounded, we can still compute the reachability set by restricting our exploration to a tuple of (regular) bounded languages L.

0 1 h(p, q)!ai h(p, q)!bi h(q, p)?ei h(p, q)?ai h(p, q)?bi h(q, p)!ei
From the above example, we have seen that all states that are reachable in the CDP protocol are already reachable in presence of a suitable collection L of bounded input-languages. Analogous to the well-established theory of flattable machines [BFLP08, DFGD10, CFS11], we propose the following definition. Definition 4.36. Let M be a FIFO machine and let L be a tuple of regular bounded languages. We say that M is boundable language L-boundable if Reachset M = Tracereach M (L ! ). We say that M is boundable if there exists a tuple L of regular bounded languages such that M is L-boundable.

Hence, we deduce that reachability is decidable for L-boundable FIFO machines, which is a strictly larger class than input-bounded machines. CDP is not inputbounded but it is L CDP -boundable with L CDP = ((ab) ⇤ (a + ")(ab) ⇤ , e ⇤ ). Let us also remark that CDP is flattable by using the bounded set of runs (!a!b) ⇤ !a!e?e(!a!b) ⇤ + (!a!b) ⇤ (where we omit channel information for readability), because it covers the reachability set which is equal to (ab) ⇤ (a + ")(ab) ⇤ on control-state (0, 0). It is not clear whether reachability is decidable for boundable machines. A strategy that would fairly enumerate all regular bounded families L 1 , L 2 , . . . , L n , . . . will necessarily find a good one, if M is boundable, but this is not su cient because we must be able to recognize Reachset M . Observe that boundable machines are more robust than flat machines. Consider a system S = (A 1 , A 2 , . . . , A n ) of n flat finite automata A i communicating peer to peer (P2P) through one-directional FIFO channels. Let M S denote FIFO the machine obtained as the Cartesian product of all automata A i of S; there is no reason to assume that M S is flattable but it is input-bounded and thus M S is L-boundable where L is easily computable from S.

Chapter 5

Framework for Synchronizability

In this chapter, we are interested in the notion of bounded FIFO machines. If we limit our analysis to decide whether for a given integer k 0, the FIFO channels are k-bounded, we could verify this property in PSPACE. However, such a boundedness property is too restricting as we would not be able to design any possibility of unbounded runs. Hence, in order to overcome this limitation, we try to relax the boundedness property to instead only require that every unbounded execution of a system (i.e., channels are unbounded along the execution) is equivalent (for instance, causally equivalent) to another bounded execution. This leads us study the notion of synchronizability, which roughly translates to verifying if every run can be rescheduled to such a "bounded" run. The definition of such a bounded run varies in the literature -it could mean a channel bound of size k, a rendezvous run, etc. Moreover, the criteria for rescheduling the run also varies in the literature.

We study a framework based on monadic second-order (MSO) logic and (special) tree-width that aims to unify these di↵erent notions of synchronizability. Moreover, reachability and model checking are shown as decidable in this framework. We also study the various classes of systems which belong to this class, and briefly compare them to each other. For a detailed comparison, one can refer to [START_REF] Laversa | La synchronisabilité pour les systèmes distribués[END_REF]. It should be noted that we study not only the peer-to-peer model, but also the mailbox model, described in Section 2.2.1.

Logical background

We first introduce the notions of MSO Logic and PDL. Hence, the definition of a mailbox MSC can be readily translated into the formula MSO mailbox formula ' mb = ¬9x.9y.(¬(x = y) ^x y ^y x) so that we have L(' mb ) = MSC mb . Here, x y is obtained as the MSO-definable reflexive transitive closure of the union of the MSO-definable relations !, C, and @. In particular, we may define x @ y by :

x @ y = _ q2P a,b2Send( ,q) (x) = a ^ (y) = b^ matched (x) ^¬matched (y) _ 9x 0 .9y 0 .(x C x 0 ^y C y 0 ^x0 ! + y 0 ) ! Propositional Dynamic Logic
While MSO is a very natural and expressive logic, we also study Propositional Dynamic Logic (PDL), which is another classical logic (albeit less expressive than MSO) which has better algorithmic properties. It was introduced to reason about programs originally in [START_REF] Michael | Propositional dynamic logic of regular programs[END_REF]. However, since then, PDL and its extensions have found applications in verification of transition systems, artificial intelligence, etc.

We study an extension of PDL with Loop and Converse, which we call LCPDL (cf.

[BG21, BFG21, Str82] for more details).

PDL consists of two types of formulas: event (or state) formulas which are evaluated at events in a structure, and path formulas or programs which are evaluated at pairs of events and allow us to traverse inside the structure. In addition, we also define sentences to reason about global properties of the model. propositional dynamic logic (PDL)

Its syntax is:

::= E | _ | ¬ ( s e n t e n c e ) ::= a | _ | ¬ | h⇡i | Looph⇡i (event formula) ⇡ ::= ! | C | test( ) | jump | ⇡ + ⇡ | ⇡ • ⇡ | ⇡ ⇤ | ⇡ 1 (path formula)
The first part of the formula checks for the condition that there exists receive messages in the same order as the sends, and the second part checks the condition for the unmatched send.

Tree-width and conflict graph

We now introduce two notions associated to MSCs.

Special Tree-Width

Special tree-width [START_REF] Courcelle | Special tree-width and the verification of monadic second-order graph properties[END_REF], is a graph measure that indicates how close a graph is to a tree (we may also use classical tree-width instead). This or similar measures are commonly employed in verification. For instance, tree-width and split-width have been used in [START_REF] Madhusudan | The tree width of auxiliary storage[END_REF] and, respectively, [CGK12, AGK14] to reason about graph behavior generated by pushdown and channel systems. There are several ways to define the special tree-width of an MSC. We adopt the following game-based definition from [START_REF] Bollig | Non-Sequential Theory of Distributed Systems[END_REF]. We refer the reader to [START_REF] Courcelle | Special tree-width and the verification of monadic second-order graph properties[END_REF] for more details on special tree-width and tree-width. Definition 5.1. Given an MSC M = (E, !, C, ), we define an MSC fragment MSC fragment M 0 = (E 0 , ! 0 , C 0 , ) such that E 0 ✓ E, ! 0 ✓! and C 0 ✓ C. Moreover, we define a marked MSC fragment as a pair (M, U) such that M = (E, !, C, ) is an MSC fragment, and U ✓ E is the subset of "marked" events.

Adam and Eve play a two-player turn based "decomposition game" decomposition game on an arena Arena(P, ⌃) = (Pos 9 ] Pos 8 , Moves), whose positions are MSCs with some pebbles placed on some events. More precisely, Eve's positions Pos 9 are marked MSC fragments (M, U) and Adam's set of positions Pos 8 consists of pairs of marked MSC fragments. A move by Eve consists in the following steps:

1. marking some events of the MSC resulting in (M, U 0 ) with U ✓ U 0 ✓ E, 2. removing (process and/or message) edges whose endpoints are marked, resulting in (M 0 , U) with M 0 being a fragment of M 3. dividing (M, U) in (M 1 , U 1 ) and (M 2 , U 2 ) such that M is the disjoint (unconnected) union of M 1 and M 2 and marked nodes are inherited.

When it is Adam's turn, he simply chooses one of the two marked MSC fragments. The initial position is (M, ;) where M is the (complete) MSC at hand. A terminal position is any position belonging to Eve such that all events are marked. Neither player can move from terminal positions which are winning for Eve. For k 2 N, we say that the game is k-winning for Eve if she has a (positional) strategy that allows her, starting in the initial position and independently of Adam's moves, to reach a terminal position such that, in every single position visited along the play, there are at most k + 1 marked events.

Theorem 5.2 ([BG21]

). The special tree-width of an MSC is the least k such that special tree-width the associated game is k-winning for Eve.

The set of MSCs whose special tree-width is at most k is denoted by MSC k-stw .

Conflict Graph

Before we delve into verification problems that we are interested in, we first recall the notion of a conflict graph associated to an MSC, as defined in [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF], which is also referred to as a dependency graph in the literature. This graph is used to depict the causal dependencies between message exchanges. Each vertex of the graph represents a message and each edge between two vertices represents a temporal dependence between two actions of the two messages concerned. A dependency exists if both messages have a process in common. A dependency linked to a sending will be represented by an S while a dependency linked to a reception will be represented by an R.

For instance, an

SS

! dependency between message exchanges v and v 0 expresses the fact that v 0 has been sent after v, by the same process. This model is of interest because it was seen in [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF] that the notion of synchronizability in MSCs (which is studied in this paper) can be graphically characterized by the nature of the associated conflict graph. It is defined in terms of linearization in [START_REF] Di Giusto | On the ksynchronizability of Systems[END_REF], but we equivalently express it directly in terms of MSCs. Example 22. We see in Figure 5.2 the MSC M 1 and its associated conflict graph. Note that since m 1 is not received by process q, we do not have any dependencies between e 1 and nodes associated to events in q.

Extended Conflict Graph

As was shown in [START_REF] Di Giusto | On the ksynchronizability of Systems[END_REF], in order to capture the mailbox semantics, we need extended edges. We recall from [START_REF] Di Giusto | On the ksynchronizability of Systems[END_REF] the extended edge relation

XY 999K with X, Y 2 {S, R} in Figure 5.3. extended conflict graph
We call the conflict graph along with the new extended edges the extended conflict graph (ECG).

v 1 XY ! v 2 v 1 XY 999K v 2 (Rule 1) v 2 C v SR 999K v (Rule 2) v 1 RR ! v 2 v 1 SS 999K v 2 (Rule 3) v 1 XY 999K Y Z 999K v 2 v 1 XZ 999K v 2 (Rule 4)
e 1 2 Matched (M ) e 2 2 Unm(M ) e 1 2 Send ( , q), e 2 2 Send ( , q), q 2 P µ(e 1 ) SS 999K e 2 (Rule 5)

Figure 5.3: Additional rules for extended conflict graph;

XY ! refers to an edge in the conflict graph Example 23. We see in Figure 5.2 the MSC M 1 and its associated extended conflict graph. Note that there is now a dependence between e 1 and (e 4 , e 0 4 ) by Rule 5, since the message m 1 is not received by q, it should causally be after m 4 which is received by q.

Model checking and synchronizability

In this section, we introduce two decision problems for communicating systems, which we have not encountered in the previous chapters.

The first problem is the model checking problem, in which one checks whether a given system satisfies a given specification. A canonical specification language for MSCs is monadic second-order (MSO) logic. However, model checking in full generality is undecidable. A common approach is, therefore, to restrict the behavior of the given system to MSCs of bounded (special) tree-width.

Model Checking

We have already seen that in the general case, verification problems such as control-state reachability, are undecidable for communicating systems. However, they are decidable when we restrict to behavior of bounded special tree-width, which motivates the following definition of a generic bounded model checking problem for com 2 {p2p, mb}:

Decision Problem:

BOUNDED MODEL CHECKING Input: Two finite sets P and ⌃, a communicating system S, an MSO sentence , and k 2 N

Question: do we have L com (S) \ MSC k-stw ✓ L( )? Theorem 5.4 ([BG21]
). The bounded model checking problem for com = p2p is decidable. When the formulas are from LCPDL, then the problem is solvable in exponential time.

Note that [START_REF] Bollig | Non-Sequential Theory of Distributed Systems[END_REF] does not employ the LCPDL modality jump, but it can be integrated easily. Using ' mb or mb , we obtain the corresponding result for mailbox systems as a corollary: Theorem 5.5. The bounded model checking problem for com = mb is decidable. When the formulas are from LCPDL, then the problem is solvable in exponential time.

Proof. Using the mailbox semantics and the MSO formula ' mb , we get

L mb (S) \ MSC k-stw ✓ L( ) () L p2p (S) \ MSC k-stw \ L(' mb ) ✓ L( ) () L p2p (S) \ MSC k-stw ✓ L( _ ¬' mb ) .
The latter is decidable due to Theorem 5.4. Similarly, we can use the LCPDL formula mb , whose size is polynomial in the number of processes and messages.

Synchronizability

The above model checking approach is incomplete in the sense that a positive answer does not imply correctness of the whole system. The system may still produce behavior of special tree-width greater than k that violate the given property. However, if we know that a system only generates behavior from a class whose special tree-width is bounded by k, we can still conclude that the system is correct. This motivates the synchronizability problem. Several notions of synchronizability have been introduced in the literature. However, they all amount to asking whether all behaviors generated by a given communicating system have a particular shape, i.e., whether they are all included in a fixed (or given) set of MSCs C.

Hence, we study the synchronizability problem as an inclusion problem, i.e., we check if L p2p (S) ✓ C or L mb (S) ✓ C. We show that if C is MSO-definable and special-tree-width-bounded (STW-bounded), then this inclusion is decidable.

We call C ✓ MSC (i) MSO-definable if there is an MSO-formula such that L( ) = C, (ii) LCPDL-definable if there is an an LCPDL-formula such that L( ) = C, and

(iii) STW-bounded if there is k 2 N such that C ✓ MSC k-stw .
In order to prove decidability of inclusion, we first define and prove the following lemma, which essentially claims that every MSC which does not belong to C ✓ MSC k-stw has a minimal violation, i.e., a prefix of special tree-width k + 2 which also does not belong to C. Note that a similar property was shown in [GKM07, Proposition 5.4] for the specific class of existentially k-bounded MSCs. Lemma 5.6. Let k 2 N and C ✓ MSC k-stw . For all M 2 MSC \ C, we have (Pref (M ) \ MSC (k+2)-stw ) \ C 6 = ;.

Proof. Let k and C be fixed, and let M 2 MSC \ C be an MSC that does not belong to C. Let M 0 2 Pref (M ) \ C be a prefix of M such that, for all  M 0 -maximal events e (all events e such that there exists no event f such that e  M 0 f ) of M 0 , removing e (and its adjacent edge(s)) creates an MSC in C.

We can obtain such an MSC by successively removing maximal events. If M 0 is the empty MSC, we are done, since then

M 0 2 (Pref (M ) \ MSC k+2-stw ) \ C.
Otherwise, let e be  M 0 -maximal and let M 00 = M 0 \ {e}.

From our construction, we now know that M 00 2 C. So Eve has a winning strategy with k + 1 pebbles for M 00 . Let us design a winning strategy with k + 3 pebbles for Eve for M 0 , which will show the claim.

Observe that the event e occurs at the end of the timeline of a process (say p) since it is  M 0 -maximal, and it is part of at most two edges:

• one with the previous p-event (if any)

• one with the corresponding send event (if e is a receive event)

Note that e cannot be a send event with a matching receive in M 0 because then it would not be  M 0 -maximal.

Let e 1 , e 2 be the two Neighbors of e (if they exist). The strategy of Eve is the following: in the first round, mark e, e 1 , e 2 , then erase the edges (e 1 , e) and (e 2 , e), then split the remaining graph in two parts: M 00 on the one side, and the single node graph {e} on the other side. Then Eve applies its winning strategy for M 00 , except that initially the two events e 1 , e 2 are marked (so she may need up to k + 3 pebbles).

Therefore, the MSC M 0 has special tree-width k + 2.

An important component of the decidability of inclusion is the following lemma, which shows that we can reduce synchronizability to bounded model checking for an STW-bounded class, which uses the above lemma. Lemma 5.7. Let S be a communicating system, com 2 {p2p, mb}, k 2 N, and

C ✓ MSC k-stw . Then, L com (S) ✓ C i↵ L com (S) \ MSC (k+2)-stw ✓ C.
Proof. It is obvious that if L com (S) ✓ C, then every MSC M 2 L com (S) has special tree-width k, and therefore L com (S) \ MSC (k+2)-stw = L com (S) ✓ C.

For the case when L com (S) * C, let us assume there exists an MSC M 2 L com (S) \ C. Then, by Lemma 5.6, we know that (Pref (M ) \ MSC (k+2)-stw ) \ C 6 = ;, and since, L com (S) is prefix-closed, L com (S) \ MSC (k+2)-stw * C.

We now have all ingredients to state a generic decidability result for the synchronizability problem for com 2 {p2p, mb}:

Decision Problem: SYNCHRONIZABILITY Input:
Two finite sets P and ⌃, an MSO-definable and STW-bounded class C ✓ MSC a communicating system S, Question:

do we have L com (S) ✓ C?

Theorem 5.8. The synchronizability problem is decidable.

Proof. Consider the MSO-formula such that L( ) = C, and let k 2 N such that C ✓ MSC k-stw . We have L com (S) ✓ C Lemma 5.7

() L com (S) \ MSC (k+2)-stw ✓ C ()
L com (S) \ MSC (k+2)-stw ✓ L( ). The latter can be solved thanks to Theorem 5.4 and Theorem 5.5.

Note that, in some cases (cf. Section 5.4), P and ⌃ are part of the input and the concrete class C may be parameterized by a natural number so that it is part of the input, too. Then, we need to be able to compute the MSO formula characterizing the class as well as the bound on the special tree-width.

Application to concrete classes of synchronizability

In this section, we instantiate our general framework by specific classes.

A new general class: Weakly synchronous MSCs

We first introduce the class of weakly synchronous MSCs. This is a generalization of synchronous MSCs studied earlier, in [BEJQ18, DGLL20], which we shall discuss in Section 5.4.2. We say an MSC is weakly synchronous if it is breakable into exchanges where an exchange is an MSC that allows one to schedule all sends before all receives. Let us define this formally: Definition 5.9. Let M = (E, !, C, ) be an MSC. exchange

We say that M is an exchange if SendEv (M ) is a  M -downward-closed set. Definition 5.10. We say that M 2 MSC is weakly synchronous

weakly synchronous if it is of the form M = M 1 • . . . • M n such that every M i is an exchange.
We use the term weakly to distinguish from variants introduced later.

Example 24. Consider the MSC M 2 in Fig. 5.4. It is is weakly synchronous. Indeed, m 1 , m 2 , and m 5 are independent and can be put alone in an exchange. Repetitions of m 3 and m 4 are interlaced, but they constitute an exchange, as we can do all sends and then all receptions. An easy adaptation of a characterization from [DGLL20] yields the following result for weakly synchronous MSCs: Proposition 5.11. Let M be an MSC. Then, M is weakly synchronous i↵ no RS edge occurs on any cyclic path in the conflict graph CG(M ).

Proof. Let us first show that the conflict graph of every weakly synchronous MSC has no RS edge on any cyclic path. Let M be an MSC. If M is weakly synchronous, then M = M 1 • . . . • M n such that every M i is an exchange. Hence, for every vertex v 2 Nodes of the conflict graph CG(M ), the associated send action belongs to exactly one k-exchange, which we denote byM ◆(v) . In other words, if v 2 C (resp. v 2 Unm(M )), then v can be represented by (e `, e 0 `) (resp. (e `)), and 1 (e `) 2 M ◆(v) . Note that if there is an edge from v to v 0 in the conflict graph, some action of v must happen before some action of v 0 , and hence,

◆(v)  ◆(v 0 ). Furthermore, note that if v RS ! v 0 , then ◆(v) < ◆(v 0 ), since SendEv (M ◆(v 0 )
) is downward-closed, i.e., all the send events in an exchange precede all the receive events. Hence, there can be no edge v 0 ! v in the conflict graph, so there is no cycle in the conflict graph with an RS edge.

Let M be an MSC. Conversely, we assume now that the conflict graph of M does not contain a cyclic path with an RS edge. Let V 1 , . . . , V n be the set of maximal SCCs (strongly connected components) of the conflict graph, listed in some topological order. For a fixed i, let M i = s 1 . . . s m r 1 . . . r m 0 be the enumeration of the actions of the message exchanges of V i defined by first taking all send actions of V i obeying the relation  M , and then all the receive actions of V i in the same order as in  M . Let M 0 = M 1 . . . M n . Then the conflict graph of M 0 is the same as that of M , as the permutation of actions we defined could only postpone a receive after a send of a same SCC, therefore it could only replace some v RS ! v 0 edge with an v SR ! v 0 edge between two vertices v, v 0 of a same SCC. However, since we assumed that the cycles (hence by extensions SCCs) do not contain RS edges, this cannot happen. Therefore M and M 0 have the same conflict graph, and correspond to the same MSC. Furthermore, since the sends precede the receives in each M i , SendEv (M i ) is a downward-closed set, hence, M 0 is weakly synchronous, and so is M .

We now show that the characterization from Proposition 5.11 is LCPDLdefinable:

Corollary 5.12. The sets of weakly synchronous MSCs and weakly synchronous mailbox MSCs are LCPDL-definable. Both formulas have polynomial size.

Proof. LCPDL can be used to express the graphical characterization of weakly synchronous MSCs. This follows from the formulas below. Here, we let S = W a2Send( , , ) a and R = W a2Rec( , , ) a.

SS ! = test(¬R)• ! + •test(¬R) RR ! = test(¬R) • C• ! + • C 1 •test(¬R) RS ! = test(¬R) • C• ! + •test(¬R) SR ! = test(¬R)• ! + • C 1 •test(¬R) CG ! = ( SS ! + RR ! + RS ! + SR !)
The absence of RS edges in any cycle in the conflict graph can be expressed by the following formula:

wsync = ¬Looph( CG !) ⇤ • RS ! •( CG !) ⇤ i
Moreover, under the mailbox semantics, we can show: Proposition 5.13. The set of weakly synchronous mailbox MSCs is STW-bounded (in fact, it is included in MSC 4|P|-stw ).

Proof. Let M be fixed, and let us sketch Eve's winning strategy. Let n = |P|.

The first step for Eve is to split M in exchanges. She first disconnects the first exchange from the rest of the graph (2n pebbles are needed as she can mark the maximal event of each process of the first exchange and the minimal event of each process of the following exchange), then she disconnects the second exchange from the rest of the graph (2n pebbles are needed again, plus the n pebbles we used from the first round), and so on for each exchange. Now, given an exchange M i , we design a winning strategy for Eve with 4n + 1 pebbles, where initially there are (at most) n pebbles placed on the first event of each process and also (at most) n pebbles placed on the last event of each process. Eve also places (at most) n pebbles on the last send event of each process and also (at most) n pebbles on the first receive event of each process. Eve erases the (at most) n !-edges between the last send event and the first receive event (as sends precede the receives in an exchange).

We are now in a configuration that will be our invariant.

Let us fix a mailbox linearization of M 0 and let e be the first send event in this linearization.

• if e is an unmatched send of process p, Eve places her last pebble on the next send event of p (if it exists), let us call it e 0 . Then Eve erases the !-edge (e, e 0 ), and now e is completely disconnected, so it can be removed and the pebble can be taken back.

• if eCe 0 , with e 0 a receive event of process q, then due to the mailbox semantics e 0 is the first receive event of q, so it has a pebble placed on it. Eve removes the C-edge between e and e 0 , then using the extra pebble she disconnects e and places a pebble on the !-successor of e, then she also disconnects e 0 and places a pebble on the !-successor of e 0 .

After that, we are back to our invariant, so we can repeat the same strategy with the second send event of the linearization, and so on until all edges have been erased.

Example 25. Consider the MSC M 2 given in Figure 5.5(a). We shall play the decomposition game on it. First Eve splits M into exchanges. As explained in Example 24, m 1 , m 2 and m 5 can be put alone into an exchange. First, Eve separates m 1 from the rest. To this end, she puts the pebbles at the maximal event of the first exchange. In this case, that is just the send event of m 1 , and the minimal events on all processes after this event. She also removes the associate edges (see Now m 1 is separated from the rest. For Adam, the best option is to choose the rest of the MSC. Let us assume he does that. Eve then proceeds to remove the second exchange. In this case, that is the sole message m 2 . Eve repeats the process of separating it from the rest (see Fig 5.5 (c)).

Once again Adam best choice is the larger graph. Eve proceeds to separate the exchange with m 3 and m 4 messages from the rest. (see Fig 5.5 (d)). Now Adam can only choose the exchange with m 3 and m 4 messages. Eve places pebbles on the last send and first receive of each process (see Fig 5 .5 (e)). We now see that the sends are separated from the receives along a process. Moreover, since the MSC is weakly synchronous, we have (at least) one event which we can separate from the rest. We show the graph after removing the edges in In the next step, all events will marked when Eve chooses the next node to separate from the rest. Hence, Eve wins with less that 13 pebbles. In fact, since there are no longer any p-events from step (b), we even see that Eve does it with less than 9 pebbles.

We obtain the following result as a corollary. Note that it assumes the mailbox a partitioned alphabet to model the definition by adding an indicator of the source of each message, but for simplicity we omit it and assume a shared alphabet. Informally, the system works as follows:

• Prover 1 guesses a solution i 1 . . . i K of the PCP instance, and Prover 2 also guesses a solution i 1 . . . i K .

• Prover 1 sends ↵ i 1 . . . ↵ i K to Verifier 1 and sends simultaneously i 1 . . . i K to Verifier 2

• Prover 2 sends i 1 . . . i K to Verifier 1 and sends simultaneously i 1 . . . i K to Verifier 2

• Verifier 1 checks that the two words are equal and Verifier 2 checks that the sequences of indices are equal.

Let us now formally define these machines. We will describe them with regular expressions (that lead them to a specific control-state). For w = a 1 • • • a n , we write h(p, q)!wi (respectively h(p, q)?wi) for h(p, q)!a 1 i . . . h(p, q)!a n i (respectively h(p, q)?a 1 i . . . h(p, q)?a n i). Furthermore, we denote Prover i as P i and Verifier i as V i . The channels between, say, Prover 1 and Verifier 1 will be denoted by (P 1 , V 1 ) (and similarly for the other channels).

The language of

• Prover 1 is ⇣ K X i=1 h(P 1 , V 1 )!↵ i i • h(P 1 , V 2 )!ii ⌘ + • h(P 1 , V 1 )!#i • h(P 1 , V 2 )!#i • Prover 2 is ⇣ K X i=1 h(P 2 , V 1 )! i i • h(P 2 , V 2 )!ii ⌘ + • h(P 2 , V 1 )!#i • h(P 2 , V 2 )!#i • Verifier 1 is ⇣ X a2⌃ h(P 1 , V 1 )?ai • h(P 2 , V 1 )?ai ⌘ ⇤ • h(P 1 , V 1 )?#i • h(P 2 , V 1 )?#i • Verifier 2 is ⇣ K X i=1 h(P 1 , V 2 )?ii • h(P 2 , V 2 )?ii ⌘ ⇤ • h(P 1 , V 2 )?#i • h(P 2 , V 2 )?#i
As the channels are unidirectional, the system is weakly synchronous by default. Moreover, it can be seen that all machines reach the specified control-state if and only if the PCP instance has a solution.

Weakly k-synchronous MSCs

The negative result for the p2p semantics of weakly synchronous MSCs motivates the study of other classes. We now look at a class from the literature. Let us now recall the definition from [BEJQ18, DGLL20], but (equivalently) expressed directly in terms of MSCs rather than via executions. It di↵ers from the weakly synchronous MSCs in that here, we insist on constraining the number of messages sent per exchange to be at most k. Definition 5.17. Let k 2 N. We say that M 2 MSC is weakly ksynchronous

weakly k-synchronous if it is of the form M = M 1 • . . . • M n such that every M i is a k-exchange.
Example 26. MSC M 3 in Fig. 5.6 is weakly 1-synchronous, as it can be decomposed into three 1-exchanges (the decomposition is depicted by the horizontal dashed lines). We remark that M 3 2 MSC mb . Note that there is a p2p linearization that respects the decomposition. On the other hand, a mailbox linearization needs to reorganize actions from di↵erent MSCs: the sending of m 3 needs to be done before the sending of m 1 . Note that M 1 in Fig. 2.3 is also weakly 1-synchronous. Proof. We first denote some relations between events. rec(x) = 9y.(y C x) SS(e 1 , e 2 ) = e 1 6 = e 2 ^¬rec(e 1 ) ^¬rec(e 2 ) ^e1 ! ⇤ e 2 RR(e 1 , e 2 ) = e 1 6 = e 2 ^¬rec(e 1 ) ^¬rec(e

p q r m 1 m 2 m 3 M 3 p q r m 1 m 2 m 3 m 4 M 1
2 ) ^9f 1 , f 2 .[e 1 C f 1 ^e2 C f 2 ^f1 ! ⇤ f 2 ] RS(e 1 , e 2 ) = e 1 6 = e 2 ^¬rec(e 1 ) ^¬rec(e 2 ) ^9f 1 .[e 1 C f 1 ^f1 ! ⇤ e 2 ] SR(e 1 , e 2 ) = e 1 6 = e 2 ^¬rec(e 1 ) ^¬rec(e 2 ) ^9f 2 .[e 2 C f 2 ^e1 ! ⇤ f 2 ] CG(e 1 , e 2 ) = _ X,Y 2{R,S} XY (e 1 , e 2 )
The formula for the property that there is no strongly connected component of size greater than k in the conflict graph can be expressed as follows: @e 1 , . . . , e k+1 . [

î6 =j CG ⇤ (e i , e j )]
And finally, we express the property that there is no RS edge in any cycle of the conflict graph @e 1 , e 2 .[CG ⇤ (e 1 , e 2 ) ^RS(e 2 , e 1 )] This property is similar to the graphical characterization of weakly synchronous MSCs, except for the condition that every SCC in the conflict graph is of size at most k. However, note that the set of weakly k-synchronous MSCs is not directly expressible in LCPDL (the reason is that LCPDL does not have a built-in counting mechanism). However, its complement is expressible in the extension of LCPDL with existentially quantified propositions (we need k + 1 of them). The model checking problem for this kind of property is still in EXPTIME and, therefore, so is the problem from Theorem 5.21 when k is given in unary. It is very likely that our approach can also be used to infer the PSPACE upper bound from [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF] by showing bounded path width and using finite word automata instead of tree automata. Finally, note that the problem to decide whether there exists an integer k 2 N such that all MSCs in L com (S) are weakly k-synchronous has recently been studied in [START_REF] Di Giusto | Guessing the bu↵er bound for k-synchronizability[END_REF] and requires di↵erent techniques.

Next, we establish a bound on the special tree-width: Proposition 5.20. Let k 2 N. The set of MSCs that are weakly k-synchronous have special tree-width bounded by 2k + |P|.

Proof. Let M be a k-synchronous MSC. By definition, we know that

M = M 1 • . . . • M n such that every M i is a k-exchange.
Eve's strategy is to mark the vertices belonging to the set M 1 . Hence, she marks at most 2k vertices. We can remove the edges between these vertices. Let the new marked MSC fragment be (G, U ), where G is the new MSC fragment (with the edges between marked vertices removed), and U the set of marked vertices.

Notice that |U |  2k. Furthermore, since every vertex corresponding to a send message in U is either unmatched or matched with a reception in U (by definition), we can be sure that there are no message edges between vertices of U and any other vertex. Moreover, we can also be sure that there are at most |P| process edges between vertices in U and vertices outside this set. Let us mark these |P| vertices. We call these vertices U 0 . Let the new marked MSC fragment be (G 0

, U [ U 0 ), where G 0 is the new MSC fragment (with the edges between all vertices in U [ U 0 removed). Now, we see that there are no edges between any of the vertices in U and any other vertex, i.e., all the vertices in U are isolated. We can divide the MSC fragment to consist of the vertices U and V \ U and the corresponding edges.

Let the MSC fragment with vertices in U be (G 1 , U 1 ). It consists of at most 2k isolated colored vertices. Let the MSC fragment with vertices in V \ U be (G 2 , U 2 ). We observe that |U 2 | = n. Adam trivially loses if he chooses (G 1 , U 1 ), hence, he has to choose (G 2 , U 2 ). Now, we mark the vertices corresponding to M 2 , which are again, at most 2k. We have two possibilities for each vertex in U 2 , either they belong to the set M 2 or belong to another set M p where p > 2. However, if they belong to M p , we can be sure that there is no other event on the same process that belongs to M 2 -this is because it was the successor of some event in M 1 . Hence, we see once again, that marking all the vertices in M 2 and the immediate successors along each process will result in marked vertices of size at most 2k + |P|. And once again, we see that we can separate into MSC fragments (G 0 1 , U 0 1 ) and (G 0 2 , U 0 2 ) such that every vertex in U 0 1 is isolated, and |U 0 1 |  2k. We do this for all i 2 [n], and hence, we can e↵ectively use 2k + |P| colors. Therefore, set of MSCs over |P| processes which are k-synchronous have bounded special tree-width. Hence, we can conclude that the class of weakly k-synchronous MSCs is MSOdefinable and STW-bounded. As a corollary, we get the following (known) decidability result, but via an alternative proof: Theorem 5.21 ( [BEJQ18, DGLL20]). For com 2 {p2p, mb}, the following problem is decidable: Given finite sets P and M, a communicating system S, and k 2 N, is every MSC in L com (S) weakly k-synchronous?

Proof. We proceed similarly to the proof of Theorem 5.14. For the given P, M, and k, we first determine the MSO formula k such that L( k ) is the set of weakly ksynchronous p2p/mailbox MSCs, from Proposition 5.19. From Proposition 5.20, we know that the special tree-width of all weakly k-synchronous MSCs is bounded by 2k + |P|. By Lemma 5.7, we have L com (S) ✓ L( k ) i↵ L com (S) \ MSC (2k+|P|+2)-stw ✓ L( k ). The latter is an instance of the bounded model checking problem. By Theorem 5.4 and Theorem 5.5, we obtain decidability.

Observe also that we can remove the constraint of all the sends preceding all the receives in a k-exchange, and still have decidability. We then have the following definition. We extend this notion to consider modified weakly k-synchronous executions as before, and the graphical characterization of this property is that there are at most k nodes in every SCC of the conflict graph. Hence, this class is also MSO-definable, and since each modified k-exchange has at most 2k events, it also has bounded special tree-width.

Strongly k-synchronous MSCs and other classes

Our framework can be applied to a variety of other classes. Here we show how the decidability results can be shown for a variant of the class of weakly k-synchronous MSCs.

Definition 5.23. Let M = (E, !, C, ) 2 MSC mb . We call M strongly ksynchronous strongly ksynchronous if it can be written as

M = M 1 • . . . • M n such that every MSC M i = (E i , ! i , C i , i
) is a k-exchange and, for all (e, f ) 2 @ M , there are 1  i  j  n such that e 2 E i and f 2 E j .

Example 27. MSC M 4 2 MSC mb in Fig. 5.7 is strongly 1-synchronous. Indeed, we can decompose it into 1-exchanges and this decomposition allows for a total order compatible with @ M 4 . Moreover, MSC M 3 in Fig. 5.6, which is weakly 1synchronous, is strongly 3-synchronous. Indeed, we need to put the three messages in the same k-exchange to regain our total order. Finally, for all k, MSC M 1 in Fig. 2.3 is not strongly k-synchronous, as we cannot put all messages in the same k-exchange, where all sends are followed by all receptions. Here, this is not possible as the reception of m 3 has to take place before the sending of m 4 .

p q r m 1 m 2 m 3 M 4 p q r m 1 m 2 m 3 M 3 p q r m 1 m 2 m 3 m 4 M 1 Figure 5
.7: MSC M 4 is strongly 1-synchronizable, M 3 is strongly 3-synchronizable and M 1 is not strongly k-synchronizable for any k.

Similar to Theorem 5.18, we now show the graphical characterization of strong synchronizability.

Theorem 5.24. Let M 2 MSC mb be an MSC. M is strongly k-synchronous i↵ every SCC in the extended conflict graph ECG(M ) is of size at most k and no RS edge occurs on any cycle in ECG(M ).

Proof. Let us assume that we have an MSC M which is strongly k-synchronous. Hence, M = M 1 . . . M n , where each M i is a k-exchange. We denote the edges of the ECG by the dashed arrow (99K).

We prove, by contradiction, that the size of the largest SCC in ECG(M ) is at most k. Let us assume, to the contrary, that there exists an SCC which is of size k 0 > k. As there at most k messages in each k-exchange, there exists vertices v, v 0 which belong to the SCC such that v 2 M i and v 0 2 M j , where 1  i < j  n. Since v, v 0 belong to the same SCC, we have v 99K ⇤ v 0 99K ⇤ v. We prove by induction on the length of the path between v 0 and v that v 0 99K v implies that j  i.

For the base case, we have v 0 XY 999K v.

• If XY 6 = SS, then there is a path from v 0 to v in the conflict graph (because all the rules in Figure 5.3 except Rule 5 add edges between vertices which are already connected in the conflict graph). Therefore, some action of v 0 precedes an action of v, and hence, j  i.

• On the other hand, if XY = SS and it is built by Rule 5 (all the other SS dependencies fall into the above case) then v 0 is matched whereas v is unmatched, and both v, v 0 involve sending messages to the same process. Hence, to obey mailbox semantics, the send of v 0 has to precede the send of v therefore j  i.

By induction hypothesis, we assume that if there is a path of length h from v 0 to v in the SCC, then j  i. Let us now show that it holds true if the length is h + 1. Assume that we have v 0 99K ⇤ v 00 99K v, where there is a path of length h between v 0 and v 00 . Moreover, by the induction hypothesis, v 00 2 M `where j  ` n. Once again, we can be in one of two cases.

• v 00 XY 999K v, XY 6 = SS. By the same argument as for the base case, ` i and therefore, j  i.

• v 00 SS 999K v. Then, v 00 has to be sent before v and once again j  ` i.

Therefore, if the size of the SCC is larger than k, then all the vertices need to belong to the same k-exchange, which is a contradiction.

Next, we show that there is no RS edge in any SCC. If we assume to the contrary that there is an RS edge, i.e., v RS 999K v 0 99K ⇤ v in ECG(M ), then using the same argument as above, v and v 0 have to belong to the same k-exchange. Moreover, v RS 999K v 0 implies that the reception associated to v, say f 2 E has to happen before the send action associated to v 0 , say e 0 2 E. However, in a strongly synchronous k-exchange, all the sends precede the receives and hence, we have a contradiction.

Conversely, assume that every SCC in ECG(M ) is of size at most k and no RS edge occurs on any cyclic path. Then, we first show that every SCC in the extended conflict graph is k-synchronous. Let C be an SCC formed from a set of nodes v 1 , . . . , v m , for some 1  m  k. Let us denote by e i the send actions associated to vertex v i for all 1  i  m. Because the MSC is mailbox, it satisfies causal delivery, which means that there is no SS cycle in ECG(M ) [START_REF] Di Giusto | On the ksynchronizability of Systems[END_REF]. Hence, let us assume an indexing of the vertices consistent with the edges labeled by SS, i.e., for every 1  i 1  i 2  m, C does not contain an edge v i 2 SS 999K v i 1 . We further index the nodes in such a way that the sends associated to each process are all consecutive, i.e., for every 1  i < j < l  m, if e i , e l 2 Send (p, ), then e j 2 Send (p, ).

Let i 1 , . . . , i r be the maximal subsequence of 1, . . . , m such that f `is the receive action associated to the send e `for all `2 {i 1 , . . . , i r }. C is therefore the graph of the execution E = e 1 . . . e m f i 1 . . . f ir . The fact that all sends can be executed before the receives is a consequence of the fact that C does not contain edges labeled by RS. Then, the order between receives is consistent with the one between sends because C satisfies causal delivery. Therefore, C is strongly k-synchronous. Now, let C 1 , . . . , C n be the set of maximal SCCs in ECG(M ), listed in topological order. For each i, let E i refer to the send and receive actions ordered as above. Let us consider M 0 = E 1 . . . E n to be the MSC associated with this ordering. We can see that ECG(M ) = ECG(M 0 ). Now, let us show that M 0 satisfies the mailbox property. Let us assume to the contrary that M 0 does not satisfy the mailbox property. Then, there exists indices i < j such that there is an unmatched send e i in E i and a matched send e j in E j such that e i , e j 2 Send (p, ) for some p 2 P.

Then, there is an edge v j SS 999K v i , where v i , v j are the vertices associated to e i , e j respectively. But since i < j, there is already a path v 99K ⇤ v 0 for some vertices v 2 C i and v 0 2 C j . Hence, C i and C j are the same SCC, which is a contradiction. Therefore, M 0 satisfies the mailbox property. The formula for the property that there is no strongly connected component of size greater than k in the extended conflict graph can be expressed as follows: @e 1 , . . . , e k+1 . [ î6 =j ECG ⇤ (e i , e j )]

And finally, we express the property that there is no RS edge in any cycle of the extended conflict graph: @e 1 , e 2 .[ECG ⇤ (e 1 , e 2 ) ^ERS closed (e 2 , e 1 )] STW-bound. For the condition of bounded STW, it is su cient to see that the set of strongly k-synchronizable MSCs is included in the set of weakly k-synchronizable MSCs. Hence, Eve can use the same decomposition strategy as in Proposition 5.13 to obtain a bound on the special tree-width.

As a corollary, we thus obtain: Theorem 5.26. The following problem is decidable: Given finite sets P and M, a communicating system S, and k 2 N, is every MSC in L mb (S) strongly k-synchronous?

Only mailbox MSCs are considered for the definition of strongly k-synchronous MSCs for the following reason: A natural p2p analogue of Definition 5.23 would require from the decomposition that, for all (e, f ) 2  M , there are indices 1  i  j  n such that e 2 E i and f 2 E j . But this is always satisfied. So the natural definition of "strongly k-synchronous MSCs" would coincide with weakly k-synchronous MSCs. Proposition 5.27. Consider a p2p MSC M = M 1 . . . M n such that every MSC

M i = (E i , ! i , C i , i ) is a k-exchange.
Then, for all (e, f ) 2  M , there are 1  i  j  n such that e 2 E i and f 2 E j .

Proof. If e  M f , then there is a sequence of events e 0 ./ 1 e 1 ./ 2 . . . ./ m e m where e 0 = e and e m = f and ./ i 2 {!, C} for all 1  i  m. For every 0  `< m, there are indices 1  i  j  n such that e `2 E i and e `+1 2 E j . Hence, by transitivity, the proposition is proved.

Like the variant for the case of weakly synchronous MSCs, we can also generalize strongly k-synchronous MSCs by removing the restriction on the number of messages per exchange: Definition 5.28. Let M = (E, !, C, ) 2 MSC mb . We call M strongly synchronous strongly synchronous if it can be written as M = M 1 • . . . • M n such that every MSC

M i = (E i , ! i , C i , i
) is an exchange and, for all (e, f ) 2 @ M , there are indices 1  i  j  n such that e 2 E i and f 2 E j .

Similarly to the constructions for strongly k-synchronous MSCs, we can obtain a graphical characterization where we only look for the absence of RS-edges in a cycle. Hence, this class is also MSO-definable (in fact, even LCPDL-definable) and STW-bounded. M is called k-p2p-bounded if, for all e 2 Matched (M ), with (e) = h(p, q)!mi, # Send(p,q) ( , e) # Rec(p,q) ( , e)  k ,

We call M existentially k-p2p-bounded existentially k-p2pbounded if it has some p2p linearization that is k-p2p-bounded.

Proposition 5.30. For all k 2 N, the set of existentially k-p2p-bounded MSCs is MSO-definable and STW-bounded.

Proof. The set of existentially k-p2p-bounded MSCs was shown to be MSOdefinable (in fact, even FO-definable) in [START_REF] Lohrey | Bounded MSC Communication[END_REF]. Note that there are minor di↵erences in the definitions (in particular, the fact that we deal with unmatched messages), which, however, do not a↵ect FO-definability. In [START_REF] Bollig | Non-Sequential Theory of Distributed Systems[END_REF], it was shown that their special tree-width is bounded.

Theorem 5.31. For com 2 {p2p, mb}, the following problem is decidable: Given finite sets P and M, a communicating system S, and k 2 N, is every MSC in L com (S) existentially k-p2p-bounded?

Proof. Again, the proof follows exactly the same lines as that or Theorem 5.21, now using Proposition 5.30.

Note that this is similar to the problem considered in [GKM07, KM21], though there is a subtle di↵erence: in [GKM07, KM21], there are a notion of deadlock and distinguished final states.

Existentially k-bounded MSCs

= (E, !, C, ) 2 MSC is called k-mailbox-bounded if,
for all e 2 Matched (M ), say with (e) = h(p, q)!mi, we have # Send( ,q) ( , e) # Rec( ,q) ( , e)  k . Definition 5.32. Let M = (E, !, C, ) 2 MSC and k 2 N. We call M existentially k-mailboxbounded existentially k-mailbox-bounded if it has some mailbox linearization that is k-mailboxbounded.

Note that every existentially k-mailbox-bounded MSC is a mailbox MSC.

Example 28. MSC M 5 in Fig. 5.8 is existentially 1-mailbox-bounded, as witnessed by the (informally given) linearization h(q, p)!m 2 i h(p, q)!m 1 i h(q, r)!m 3 i h(q, r)?m 3 i h(p, q)?m 1 i h(p, q)!m 1 i h(q, p)?m 2 i h(q, r)!m 3 i . . . Note that M 5 is neither weakly nor strongly synchronous as we cannot divide it into exchanges. Proof. Assume that M is existentially k-mailbox-bounded. Let be a mailbox linearization of M such that for all e 2 Matched (M ), with (e) = h(p, q)!mi, # Send( ,q) ( , e) # Rec( ,q) ( , e)  k .

Then

is also a linearization of ( M [ rev ! k ) ⇤ . Indeed, if it was not the case, there would be a pair of events e 0 , f 0 such that f 0 rev ! k e 0 and e 0 f 0 . But then we would have # Send( ,q) ( , e 0 ) # Rec( ,q) ( , e 0 ) > k ,

which is a contradiction. So is a linearization of ( M [ rev ! k ) ⇤ and M [ rev ! k is acyclic. Conversely, assume that M [ rev ! k is acyclic. Let be a linearization of ( M [ rev ! k ) ⇤ . In particular,
is a mailbox linearization of M . Let us show that for all e 2 Matched (M ), with (e) = h(p, q)!mi, # Send( ,q) ( , e) # Rec( ,q) ( , e)  k .

Let e 2 Matched (M ) be fixed, and let f 0 be such that e C f 0 . There are two cases:

• # Rec( ,q) (!, f 0 )  k. Then # Send( ,q) ( , e)  k ,
because all sends to the channel of process q before e are matched. So # Send( ,q) ( , e) # Rec( ,q) ( , e)  k ,

• # Rec( ,q) (!, f 0 ) > k. Then there is f on process q such that f rev ! k e. Since M [ rev ! k is acyclic, we have f e,
and there are at most k messages in the channel of q at the time of event e, or in other words, # Send( ,q) ( , e) # Rec( ,q) ( , e)  k .

So

is a mailbox linearization with k bounded bu↵ers, and M is existential k-mailbox-bounded.

Proposition 5.34. For all k 2 N, the set of existentially k-mailbox-bounded MSCs is MSO-definable and STW-bounded.

Proof. Let k 1 be fixed. Since every existentially k-mailbox-bounded MSCs is also existentially k-p2p-bounded, and since the class of existentially k-p2pbounded MSCs is STW bounded (see Proposition 5.30), the class of existentially k-mailbox-bounded MSCs is also STW bounded.

Let us show that it is moreover MSO definable. By Lemma 5.33, it is enough to show that the acyclicity of M [ rev ! k is MSO definable, and since M was already shown MSO definable and acyclicity is easily MSO definable, it is enough to show that rev ! k is MSO definable. It is indeed the case, as demonstrated by this formula (r, s) = 9r 1 , r 2 , . . . , r n .r ! r 1 ! r 2 ! . . . ! r n ^s C r n .

Finally, let us show that existentially k-mailbox-bounded is also LCPDL definable. This follows from the following formulas:

M = (C+ !) + R = hC 1 i> next R != (! ^test(¬R)) ⇤ • (! ^test(R)) rev ! k = ( next R !) k .(C) 1 . 9k mb-bounded = ¬ELooph( M + rev ! k ) + i

Discussion

This chapter presents a unifying framework in order to decide synchronizability among other interesting properties. It is based on MSO (and LCPDL) logic, and the notion of bounded (special) tree-width. Let us look at some of the other related problems in this field. This extension is also valid for the p2p definition of existentially k-bounded MSCs, which were addressed in [START_REF] Genest | On Communicating Automata with Bounded Channels[END_REF]. Moreover, our framework can also be adapted to treat universally bounded systems [HMK + 05, LM02]. However, the send-synchronizability problem from [START_REF] Basu | Choreography conformance via synchronizability[END_REF] does not fit in our framework. This is clear, because the inclusion question L p2p (S) ✓ C 0 would be decidable, where C 0 is the set of sendsynchronizable (p2p) MSCs, but this property is undecidable (as checking whether a given system S is send-synchronizable is undecidable, from [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF]).

Note that there is a subtle di↵erence between the notion of existential boundedness as studied in this work, compared to some other works that have been studied, for example in [GKM07] as we do not take into account the unmatched messages. Some directions we could explore further would be regarding the decidability of the question whether there exists a k 0 such that L p2p (S) ✓ C k allows us to build a bounded model checking strategy by first deciding whether there exists such a k 0 and then by testing if L p2p (S) ✓ C k for k = 0, 1, 2, . . .. One may use this strategy for weakly/strongly synchronizable systems, but not for existentially bounded systems (except for deadlock-free systems) or for deterministic deadlock-free universally bounded systems. In [START_REF] Lange | Verifying Asynchronous Interactions via Communicating Session Automata[END_REF], the authors introduced an asynchronous compatibility property and it would also be interesting to verify whether this property could be expressed into our framework. Finally, we could also explore the notion of Let S = (X, Act , !, init) be the transition system associated with a CFM. Then, for any k 0, we define:

J k (S) = {proj ! (⌧ ) | ⌧ 2 Traces k (S)} I k (S) = J k (S) [ {(proj ! (⌧ ), ) | init ⌧ ! , 2 X and is stable, ⌧ 2 Traces k (S)} Furthermore, J (S), I(S) J (S) = [ k 0 J k (S) I(S) = [ k 0 I k (S)
We remark that J k ✓ I k , I k ✓ I k+1 , and J k ✓ J k+1 .

Following [START_REF] Basu | Synchronizability for Verification of Asynchronously Communicating Systems[END_REF], we define the observable behavior of a system as its set of send traces enriched with their final states when they are stable. In [START_REF] Basu | Synchronizability for Verification of Asynchronously Communicating Systems[END_REF], the authors consider the slack elasticity of a system: the property that the asynchronous distributed behavior behaves "equivalently" regardless of the slack of the channels. Hence, synchronizability is defined as the slack elasticity of these observable behaviors. Definition 6.1 (Synchronizability [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF][START_REF] Basu | Synchronizability for Verification of Asynchronously Communicating Systems[END_REF]). We say that a system S is sendsynchronizability (I and Jsynchronizability)

• J -synchronizable if J (S) = J 0 (S),

• I-synchronizable if I(S) = I 0 (S).

Let us remark that S is I-synchronizable (resp. J -synchronizable) if and only if I k = I 0 (resp. J k = J 0 ) for all k 0. Moreover, for all k, ` 0, we have that I k = I `implies J k = J `. Let us prove this: Proposition 6.2. If a system is I-synchronizable, then it is J -synchronizable.

Proof. If S is I-synchronizable, then I(S) = I 0 (S), i.e., I(S) \ I 0 (S) = ;. Since J (S) ✓ I(S), we have J (S)\I 0 (S) = ;. Moreover, I 0 (S) = J 0 (S)[{(proj ! (⌧ ), ) | init ⌧ ! , ⌧ 2 Traces 0 (S)}. Hence, J (S) \ I 0 (S) = J (S) \ J 0 (S) = ;. Therefore, J (S) = J 0 (S), and S is J -synchronizable.

The converse, however, is false in general and there exist J -synchronizable systems that are not I-synchronizable (see Example 29).

Example 29. Consider the CFM A with two processes as shown in Figure 6.1. We see that S A is J -synchronizable, because for every trace, there is the equivalent synchronous trace where both processes loop in the initial control-state. However, q 0,2 q 2 q f,2 !b (q,r) ?a (p,q) !b (q,r) ?a (p,q) P q q 0,1 q 1 q f,1 !a (p,q) ?b (q,r)

?b (q,r) !a (p,q) P p Figure 6.1: CFM A = (P p , P q , ⌃) which is J -synchronizable but not Isynchronizable.

the state (q f,1 , q f,2 , ", "), which is reachable via (q 0,1 , q 0,2 , ", ") ! (q f,1 , q f,2 , ", "), where =!a (p,q) .!b (q,r) .?a (p,q) .?b (q,r) . However, as we can see, (q f,1 , q f,2 , ", ") is not reachable via any synchronous trace. Hence, the system S A is J -synchronizable but not I-synchronizable. Also note that for k 2 N, I k (S) = I k+1 (S) does not imply I(S) = I k (S) (respectively for J (S)).

Theorem 6.3 ([FL17]

). We have the following decidability results:

• I-synchronizability and J -synchronizability are undecidable for systems of three p2p.

• I-synchronizability and J -synchronizability are decidable for systems of two p2p.

However, for such systems, there has been no study on the decidability of reachability, boundedness, or the other verification problems that we study in this thesis. This leads us to first study the problem of reachability.

Reachability for send-synchronizable systems

We first analyze the reachability problem for J -synchronizable systems.

Theorem 6.4. The reachability problem is undecidable for J -synchronizable systems of (two) CFMs.

Proof. We reduce reachability in systems of two CFMs (that is well-known to be undecidable [START_REF] Brand | On Communicating Finite-State Machines[END_REF]) to reachability in J -synchronizable systems of two CFMs.

Let us consider any CFM A = (P p , P q , ⌃) with two peers, where P i = (Q i , ⌃ i , i , `0i ) for i 2 {p, q}. We add a new control-state `i to each P i with self loops to send and receive every letter of the message alphabet, such that `i is only reachable from the initial control-state `0i via every possible transition. Let us call this modified system A 0 = (P 0 p , P 0 q , ⌃), and we can see it in Figure 6.2.

The transition system S 0 associated to A 0 is J -synchronizable. This is because, for any trace ⌧ 2 Traces(S 0 ), there exists ⌫ 2 Traces(S 0 ) such that (`0 p , `0q , ✏, ✏) ✏ ! (`p, `q, ✏, ✏) ⌫ ! (`p, `q, ✏, ✏) where proj ! (⌧ ) = proj ! (⌫) and ⌫ is of the form !?a 1 !?a 2 . . . for messages m 1 , m 2 , . . . 2 ⌃. Therefore, we can deduce ⌫ 2 J 0 (S 0 ) and hence, ⌧ 2 J 0 (S 0 ). Note that J (S 0 ) = Act ⇤ , hence J (S) ✓ J (S 0 ) but it is not necessary that J (S) = J (S 0 ). Furthermore, we see that if a state is reachable in S, then is reachable in S 0 . And conversely, any state involving a control-state of S (in Q p ⇥ Q q ), that is reachable in S 0 , is also reachable in S (note that if we reach, in S 0 , the control-state `p or `q, we cannot return to the original state space of S any more). Thus, if reachability would be decidable for S 0 , we could decide reachability for S, i.e., for any system of communicating machines, and this is not the case. Hence the reachability problem is undecidable for J -synchronizable systems of (at least two) CFMs.

Using a similar idea, we can also prove that the control-state reachability problem is undecidable for J -synchronizable systems. Moreover, reachability is also undecidable for J -synchronizable counter systems by a similar construction. However, for boundedness and termination we cannot use the same argument, as addition of the extra control-state in each peer results in a potentially unbounded (resp. non-terminating) system.

Reachability for I-synchronizable systems

In order to show that reachability is also undecidable for I-synchronizable systems, we use the construction from [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF]. However, since the underlying problem Original automaton P p Original automaton P q `0p `p !⌃ (p,q) ?⌃ (q,p) !⌃ (p,q)

?⌃ (q,p) `0,q `q !⌃ (q,p) ?⌃ (p,q)

!⌃ (q,p) ?⌃ (p,q) Figure 6.2: Construction of the modified system A 0 , where the send/reception of every message is abbreviated by the symbol !⌃ and ?⌃ we study is di↵erent, we make modifications on the original construction. The di↵erences between the two will be discussed below.

The general idea of the construction is to reduce the reachability problem for I-synchronizable systems to another (well-known) undecidable problem. In [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF], the authors reduced the reachability problem to the message reception problem for a FIFO machine (with a single channel). Since we are studying the reachability problem for send-synchronizable systems, we instead consider the well-known undecidable reachability problem for FIFO machines.

First, we recall the notion of "good-for-reduction" FIFO machines from [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF]. Definition 6.5. A good-forreduction FIFO machine M is good-for-reduction if the only stable trace of S M is the empty trace. Now, we adapt the well-known result from [START_REF] Brand | On Communicating Finite-State Machines[END_REF] to good-for-reduction FIFO machines.

Theorem 6.6. Reachability is undecidable for good-for-reduction FIFO machines.

Proof sketch. We show that good-for-reduction FIFO machines may simulate the run of a Turing machine. This simulation is now sketched. Given a Turing machine T M, there exists a good-for-reduction FIFO machine M (with a single channel) such that any run of T M of length n can be simulated by a run of M of length O(n 2 ). Intuitively, this simulation consists simply in having the entire tape of the simulated Turing machine in the channel with added end markers. To simulate a run of T M, the contents of the channel can be rotated, i.e., entirely read and immediately rewritten in the channel, with one exception, the part of the content representing the head of the Turing machine. This is modified to simulate a step of the Turing machine computation. The resulting FIFO automaton is indeed good-for-reduction since at all points of the execution, at the very minimum, at least one of the end markers will be left in the channel.

To now prove the undecidability of reachability of I-synchronizable systems, we use the construction from [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF]. Let us recall this construction. Given a (good-for-reduction) FIFO machine M, the authors first construct a CFM A M that simulates M. Then, they complete the system in order to make it I-synchronizable.

The system A M consists of three processes p, q and r.

Intuitively, process p imitates the actions of M, and the channel (p, q) represents the channel of M. When M enqueues a letter m, process p sends a letter m to process q. When M dequeues a letter m, process p sends an order to dequeue to process r, which process r then forwards to process q. Then, process q executes the dequeueing, and then sends an acknowledgment back to process r, which process r then forwards to process p. In other words, process r acts as an intermediary for the dequeueing process.

Formally, let M = (Q, Ch, ⌃, T, `0) be a good-for-reduction FIFO machine. As |Ch| = 1, we will omit specifying the channel henceforth.

For the CFM A M , for each channel (p, q), we define ⌃ (p,q) = {m (p,q) | m 2 ⌃}. Moreover, since the alphabet set is disjoint for each channel, we omit specifying the channel henceforth. In other words, h(p, q)!mi will now be written as !m (p,q) . The transition system associated to process p which we call P p is obtained by replacing every !m-transition of M with !m (p,r) , and every ?m-transition with the sequence of two transitions !m (p,r) ?m (r,p) . Formally, P p = (Q p , ⌃ p , p , `0p ), where

Q p = Q ] {` | 2 T } and p = {(`, !m (p,q) , `0) | (`, !m, `0 2 T )} [ {(`, !m (p,r)
, ` ), (` , ?m (r,p) , `0) | = (`, ?m, `0) 2 T }.

Process q receives messages from process r when it is time to dequeue, executes it and then sends a confirmation back to r. Formally, P q = (Q q , ⌃ q , q , `0q ) where q) , `m,1 ), (`1 q , ?m (r,q) , `m,1 ), (`m ,1 , ?m (p,q) , `m,2 ), (`m ,2 , !m (q,r) , `1q ) | m 2 ⌃} Note that the loop of P q is unrolled once. This is because we need to ensure that it never comes back to the initial state (as our final system is the union of two such processes).

Q q = {`0 q , `1q } [ {`m ,1 , `m,2 | m 2 ⌃} q = {(`0 q , ?m (r,
Process r receives a message to dequeue from process p and forwards it to process q. Once it receives an acknowledgment from process q, it forwards it to process p. The associated transition system is defined as P r = (Q r , ⌃ r , r , `0r ) where r) , `m,1 ), (`m ,1 , !m (r,q) , `m,2 ), (`m ,2 , ?m (q,r)

Q r = {`0 r } [ {`m ,1 , `m,2 , `m,3 | m 2 ⌃} r = {(`0 r , ?m (p,
, `m,3 ), (`m ,3 , !m (r,p) , `0r ) | m 2 ⌃} Example 30. Consider the following example from [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF]. We have ⌃ = {a, m} and the FIFO machine M 1 = ({`0, `1}, Ch, ⌃, T, `0), with transition relation T = {(`0, !a, `0), (`0, !m, `1), (`1, ?m, `0), (`1, ?a, `0)}. The CFM associated to processes p, q and r are shown in Figure 6.3.

Let P = {p, q, r}, and Ch A = {(p, q) | p, q 2 P}, and ⌃ A = S c2Ch A ⌃ c . Then, A M = (P p , P q , P r , ⌃ A ). It was shown in [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF] that there is a tight correspondence between the k-bounded traces of S M for k 1, and the k-bounded traces of S A M : every trace ⌧ 2 Traces k (S M ) induces the trace h(⌧ ) 2 Traces k (S A M ) where

h : Act M ! Act ⇤
A M is the homomorphism from the traces of S M to the traces of S A M , defined by h(!m) =!m (p,q) and h(?m) =!?m (p,r) •!?m (r,q) •?m (p,q) •!?m (q,r) •!?m (r,p) . Now, we extend this idea to the sets of reachable states of S M and S A M . Let us denote a particular state of S A M as (`, w), where w (p,q) denotes the channel content of (p, q). Proposition 6.7. For any execution (`0, ✏) ⌧ ! (`, w) in S M , there exists an execution (`0 p , `0q , `0r , ") h(⌧ ) ! (`, `q, `0r , w) in S A M , where `q 2 {`0 q , `1q } and w (p,q) = w (resp. " (p,q) = ") and w c = " (resp. " c = ") for all c 6 = (p, q). Proof. We prove this by induction on the length of ⌧ . For the base case, |⌧ | = 0, i.e., ⌧ = ", for which the proposition is trivially true. Now, by the induction hypothesis, we assume that the proposition holds for any ⌧ such that |⌧ | = n. We will show that it is also true for n + 1. Let us assume that we have an execution of length n + 1, say ⌫. Let ⌫ = ⌧ • , where ⌧ is an execution of length n, and is a single action. Say (`0, ✏) ⌧ ! (`, w) ! (`0, w 0 ). Firstly, by [FL17, Lemma 6], ⌫ induces a trace h(⌫) = h(⌧ ) • h( ) from 0 = (`0 p , `0q , `0r , ") in S A M . Moreover, by the induction hypothesis, there is a state

6. Send-Synchronizability !a (p,q) !m (p,q) !a (p,r) !m (p,r)
?a (r,p) ?m (r,p)

P p !a !m ?a, ?m FIFO automaton M 1 ?m (r,q)
?a (r,q) ?m (r,q)

?a (r,q) ?m (p,q)

!m (q,r) ?a (p,q)

!a (q,r) P q ?m (p,r) !m (r,q) ?m (q,r) !m (r,p) ?a (p,r) !a (r,q)

?a (q,r) !a (r,p) P r Figure 6.3: The FIFO machine M and CFM A M with P p , P q and P r from Example 30 (`, `q, `0r , w) reachable from 0 via h(⌧ ), where `q 2 {`0 q , `1q }, w (p,q) = w and w c = " for all c 6 = (p, q). Hence, we only now need to show that (`, `q, `0r , w) h( ) ! (`0, `0 q , `0r , w 0 ), for some values of `0 q and w 0 .

• Let us assume is a write operation, say !m. Then, there exists a transition from the control-state `in M to the control-state `0 which sends a letter m. Therefore, by construction, there exists such a control-state in P p as well. Hence, we can execute the same transition in P p , which sends a letter m to the channel (p, q), i.e., a transition h( ), and moves to state `0. The other processes do not make any transitions. Hence, we reach a state (`0, `0 q , `0r , w 0 ) such that w 0 (p,q) = w • m and w 0 c = ✏ for all c 6 = (p, q). Moreover, `0 q = `q. Hence, the proposition holds.

• Now, let us assume is a read operation, say ?m. This implies w = m • w 0 .

Moreover, there exists a transition from control-state `in M to the controlstate `0 which reads a letter m. Therefore, by construction, there exists a control-state `0 in P p as well, which is reached from `via an intermediate control-state ` . Let us assume P p executes the transition `!a (p,r) ! ` . Then, P p cannot proceed any further since it needs to receive a response from P r , which it does not have yet as the channel (r, p) is empty (by the induction hypothesis). Hence, while P p is blocked, P r now has a message in the channel (p, r), which it can read (as it is in the initial state, such a transition is possible). It moves to an interim control-state `m,1 and then sends to P q an order m (r,q) to dequeue m from channel (p, q), and reaches `m,2 where it is blocked. Now, P q receives a new message in the channel (r, q), which was empty so far (by the induction hypothesis). It then consumes this message (again, this is possible as it is in one of the "initial states" `0q or `1q ). It then moves to `m,1 from where can read the letter m from the channel (p, q). Note that by the induction hypothesis, the channel contents in (p, q) is w = m • w 0 , hence, it can read m, leaving behind w 0 . Then, it moves to `m,2 , and then sends to P r an acknowledgment, and moves to `1q . Now, P r can consume the message from (q, r) and send an acknowledgment back to P p and reach back to its initial control-state. And finally, P p is no more blocked an can reach `0. Hence, we reach a state (`0, `1q , `0r , w 0 ) where w 0 (p,q) = w 0 and w 0 c = ✏ for all c 6 = (p, q). Hence, the proposition holds.

The proposition holds for n + 1, and we are done with the proof.

Let us prove the converse direction now.

6. Send-Synchronizability Proposition 6.8. For any execution (`0 p , `0q , `0r , ") ⌫ ! (`, `q, `0r , w) in S A M such that `q 2 {`0 q , `1q } and w (p,q) = w 2 ⌃ ⇤ and w c = " for all c 6 = (p, q), there exists an execution (`0, ✏)

h 1 (⌫) ! (`, w) in S M . Proof. From [FL17, Lemma 6], we know that for all k 0, Traces k (S A M ) = #{h(⌧ ) | ⌧ 2 Traces k (S M )} [ #{h(⌧ ) • !?m (p,q) • !?m (r,q) | ⌧ 2 Traces k (S M )}.
Hence, for all traces ⌫ 2 #{h(⌧ ) | ⌧ 2 Traces k (S M )}, from Proposition 6.2, we can construct an execution in S M that satisfies the requisite properties.

That leaves us with the set of traces {h(⌧ ) • !?m (p,r) | ⌧ 2 Traces k (S M )} and the set {h(⌧ ) • !?m (p,r) • !?m (r,q) | ⌧ 2 Traces k (S M )}. However, for any trace belonging to either of these sets, it can be seen that the control-state reached in P q is not `0q and hence, the traces in these sets do not belong to the set of traces we consider in the proposition. Hence, the proposition holds true.

While S A M simulates S M , it is not I-synchronizable. Hence, we try to modify A M so as to make the associated transition system I-synchronizable. We define a system A 0 M = (P p , P 0 q , P r , ⌃ A ) where P p and P r are the same as in A M but P 0 q is modified. This system will later be combined with A M and the whole system will be used in the reduction of the reachability problem in the FIFO automaton to the reachability in I-synchronizable systems. The main purpose of A 0 M is to make the traces of S A M synchronizable.

A crucial di↵erence between our construction in P 0 q and the construction in [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF] is that we do not fix a special message m and exclude the traces containing m (q,r) from the synchronous traces. In fact, we want to make the entire system I-synchronizable, so we do not isolate any letter from the rest. Therefore, this construction can be seen as a special case of the construction in [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF] where the underlying FIFO machine M does not contain the letter m at all in its alphabet.

Intuitively, P 0 q will always be able to receive any message from P p , in particular, at the time the message is sent. Furthermore, it is also able to receive orders from P r to dequeue; however, instead of actually dequeueing, it ignores the order but sends an acknowledgment back to P r . Formally, P 0 q = (Q 0 q , ⌃ q , 0 q , `0q ) is defined as follows:

Q q = {`0 q , `0 1q } [ {`0 m,1 | m 2 ⌃} q = {(`0 q , ?m (p,q)
, `0 1q ), (`, ?m (p,q) , `) | m 2 ⌃, `2 Q 0 q \ {`0 q }} [ {(`0 q , ?m (r,q) , `0 m,1 ), (`1 q , ?m (r,q) , `0 m,1 ), (`0 m,1 , !m (q,r) , `0 1q ) | m 2 ⌃} Example 31. For ⌃ = {a, m}, and P 1 from Figure 6.3, P 0 q is depicted in Figure 6.4. from Proposition 6.10. Hence, J (S A 00 M ) ✓ J 0 (S A 0 M ) [ J 0 (S A M ). So we only need to prove that for all stable traces ⌧ of S A M , there is a stable synchronous trace ⌧ 0 of S A 00 M leading to the same state such that proj ! (⌧ ) = proj ! (⌧ 0 ). Let ⌧ 2 Traces(S A M ) be a stable trace. By [FL17, Lemma 8], there is a trace ⌧ 0 such that either ⌧ = h(⌧ 0 ), or ⌧ = h(⌧ 0 ).!?m (p,r) , or ⌧ = h(⌧ 0 )•!?m (p,r) •!?m (r,q) . By the definition of h, if ⌧ is stable, ⌧ 0 is also stable. Since M is good-for-reduction, ⌧ 0 must be the empty trace. Hence, in all the above cases, ⌧ is synchronous, and therefore, all stable traces of S A M are synchronous, which means S A 00

M is I-synchronous.

Finally, we recall one important aspect of the construction. When defining P q and P 0 q , it was enforced that the union of the two automata cannot come back to the initial state `0q . In doing so, we make sure that any trace of A 00

M is either a trace of A M or A 0 M . Moreover, once a control-state in Q 0 q \ {`0 q } has been reached, it is no longer possible to reach a control-state in Q q .

Using the results so far, we can now prove that reachability is undecidable for I-synchronizable systems. Theorem 6.12. Reachability is undecidable for I-synchronizable peer-to-peer systems with at least 3 processes.

Proof. We reduce the reachability of good-for-reduction FIFO machines to reachability in I-synchronizable peer-to-peer systems. Let M be a good-for-reduction FIFO machine. We construct a CFM A 00 M with three processes as shown in the above construction. From Proposition 6.11, we know that S A 00 M is I-synchronizable. From Proposition 6.2, we know that if a state (`, w) is reachable in S M , then (`, `q, `0r , w) is reachable in S A M . Hence, it is also reachable in S A 00 M . Conversely, consider a state (`, `q, `0r , w) that is reachable via ⌧ in S A 00 M such that `q 2 {`0 q , `1q }, and w (p,q) = w 2 ⌃ ⇤ and w c = " for all c 6 = (p, q). Since `q 2 Q q , we know that there cannot be a trace in S A 0 M that satisfies this property. Hence, ⌧ 2 Traces(S A M ). Moreover, by Proposition 6.2, (`, w) is reachable in S M . Hence, (`, w) is reachable in S M i↵ (`, `q, `0r , w) is reachable in S A 00 M where `q 2 {`0 q , `1q }, and w (p,q) = w 2 ⌃ ⇤ and w c = " for all c 6 = (p, q). And since reachability is undecidable for general good-for-reduction FIFO machines by Theorem 6.6, we deduce that reachability is undecidable for Isynchronizable peer-to-peer systems with at least 3 processes. Note that the above construction gives us, as a corollary, a result we proved earlier: reachability is undecidable for J -synchronizable systems. Also note that the decidability question of reachability for I-synchronizable peer-to-peer systems with 2 processes is open.

Stable reachability

As the notion of I-synchronizability and J -synchronizability di↵er only in the notion of stable states, we look at a modification of the reachability problem.

Decision Problem: STABLE REACHABILITY Input: a CFM A = ((P p ) p2P , ⌃), a state = ((`p) p2P , (") (p,q) ) for p, q 2 P and p 6 = q Question: is 2 P ost ⇤ S A (init)?

Stable state reachability is trivially decidable for I-synchronizable systems since by definition, every stable state is reachable via a synchronous run. Hence, given a stable state, we only need to verify if there exists a path to it via a run where each channel has capacity at most 1. However, we show that this is not decidable for J -synchronizable systems, which confirms that the restriction in I-synchronizable systems is indeed non-trivial. Theorem 6.13. The stable reachability problem is undecidable for J -synchronizable peer-to-peer systems with 2 processes.

Proof. We reduce reachability in communicating systems with 2 processes (that is undecidable [START_REF] Brand | On Communicating Finite-State Machines[END_REF]) to stable reachability in J -synchronizable systems of two processes.

Let us consider a CFM A = (P p , P q , ⌃) of two processes p, q such that P i = (Q i , ⌃ i , i , `0i ) for i 2 {p, q}. Our objective is to verify if = (`f ,p , `f,q , w p , w q ) is reachable.

We construct a new CFM A = (P 0 p , P 0 q , ⌃), with all the states and transitions as in A. Let P 0 i = (Q 0 i , ⌃ i , 0 i , `0i ). We add new states to Q 0 i as follows: a state `i, reachable from the initial state, and which has self loops to send and receive every letter of the message alphabet, and `wi , which is reachable from `f,i by receiving the word w i (this can be achieved by adding intermediate states, but we ignore this detail for brevity). Formally, for i 2 {p, q}, we define P 0 i = (Q 0 i , ⌃ i , 0 i , `0i ) where

• Q 0 i = Q i [ {`i, `wi } • 0 i = i [ {`0 #m ! `i | m 2 ⌃, # 2 {!, ?}, `0 2 {`i, `0i }} [ {`f ,i ?w i ! `wi }
A is shown in Figure 6.5.

The new system S A is J -synchronizable, since for any non-empty trace ⌧ = !m (p,q) • where m 2 ⌃, 2 ⌃ ⇤ , there is an execution (`0 p , `0q , ✏, ✏)

!?m (p,q) ! (`p, `q, ✏, ✏) ⌫ ! (`p, `q, ✏, ✏) such that proj ! (⌧ ) = m • proj ! (⌫) and ⌫ is of the form !?m 1 !?m 2 . . . for messages m 1 , m 2 , . . . 2 ⌃.

Furthermore, we see that if (`f ,p , `f,q , w p , w q ) is reachable in S A , then it is reachable in S A (by the same trace). Then, we can reach (`w p , `wq , ✏, ✏) in S A (by construction). Conversely, if we can reach (`w p , `wq , ✏, ✏) in S A , then it could only have been reached from (`f ,p , `f,q , w p , w q ) (as it is not reachable from any other state by construction). Hence, the state (`f ,p , `f,q , w p , w q ) is also reachable in S A by the same trace. Thus, if stable reachability would be decidable for S A , we could decide the reachability of a (`f ,p , `f,q , w p , w q ) for S A . Hence, if stable reachability would be decidable for J -synchronizable systems, then we could decide the reachability of a state in any system of communicating machines.

Original automaton P p

Original automaton P q `0p `p `f,p `wp !⌃ (p,q) ?⌃ (q,p) ?w (q,p) p !⌃ (p,q)

?⌃ (q,p) `0,q `q `f,q `wq !⌃ (q,p) ?w (p,q) q ?⌃ (p,q) !⌃ (q,p) ?⌃ (p,q) Figure 6.5: Construction of the modified system A , where the send/reception of every message is abbreviated by the symbol !⌃ and ?⌃

Some decidable notions

Since most verification problems are undecidable for (general) synchronizable peerto-peer systems, we study subclasses of CFMs for which some verification problems may be decidable. Let us look at some of these subclasses.

Input-bounded systems

Let us suppose that a P2P system S over ⌃ is J -synchronizable (I-synchronizable systems are a subclass of J -synchronizable systems). We have: J (S) = J 0 (S) where J 0 (S) = {send(⌧ ) | ⌧ 2 Traces 0 (S)} and Traces 0 (S) is the set of synchronous traces of S. Since Traces 0 (S) is computable (in polynomial time), we may also compute the language J 0 (S) ✓ ⌃ ⇤ .

Let us recall that a language L ✓ ⌃ ⇤ is bounded if there exist an integer k 1 and k words w 1 , w 2 , ..., w k 2 ⌃ ⇤ such that L ✓ w ⇤ 1 w ⇤ 2 ...w ⇤ k . The property for a rational language to be bounded is decidable, see for example [START_REF] Cho↵rut | On Bounded Rational Trace Languages[END_REF].

bounded synchronizable systems

Let us say that a synchronizable system S is bounded if J 0 (S) is a bounded language. Then given a synchronizable system, we may decide whether it is bounded.

Let us recall that a system S is input-bounded [BFS20] if J (S) def = S k 0 J k (S) is a bounded language. This class of systems subsumes input-letter-bounded machines, flat machines, linear FIFO nets, and monogeneous machine. We now observe, just by definition, that any bounded synchronizable system S is input-bounded (since J (S) = J 0 (S)) and from [START_REF] Bollig | Bounded Reachability Problems Are Decidable in FIFO Machines[END_REF], we deduce that many problems like reachability, control-state reachability, unboundedness, deadlock, etc. are decidable. With this result, we are able to find a subclass of synchronizable systems for which reachability is decidable.

Theorem 6.14. Reachability is decidable for bounded J -synchronizable peer-topeer systems.

Regular systems

Let us say that a CFM A is e↵ectively J -regular (resp. e↵ectively I-regular ) if J (S A ) (resp. I(S A )) is regular and computable.

Let us remark that J (S A ) can be regular when Traces(S A ) is not regular: suppose that A is a CFM with two processes, and a single unidirectional channel such that the alphabet contains an unique letter a and Traces(S A ) = S n p 0 (!a) n (?a) p is not regular but J (S A ) = a ⇤ .

Systems with k-bounded FIFO channels (i.e., words in channels are in ⌃ k ) and half-duplex systems [START_REF] Cécé | Verification of programs with halfduplex communication[END_REF] are two examples of e↵ective J -regular and I-regular systems. Then J -synchronizability (resp. I-synchronizability) reduces to decide whether J (S A ) = J 0 (S A ) (resp. I(S A ) = I 0 (S A )) which is decidable since the equality of two regular languages is decidable (finite automata that recognize J 0 (S A ) and I 0 (S A ) are computable from S A ). We could extend this decidability result to classes of systems S A such that J (S A ) and I(S A ) belong to classes of languages for which testing equality with a regular language is decidable like deterministic context-free languages, visibly pushdown systems. But, regularity is an undecidable property for general FIFO systems.

Discussion

The main open question in the field remains the question of whether the notions of send-synchronizability are decidable under the mailbox semantics. As we have seen in the case of weakly synchronous MSCs (cf. Section 5.4.1), there are notions which are undecidable for the peer-to-peer semantics but become decidable for the mailbox case. It would be interesting to see if send-synchronizability could be one such example.

However, for the undecidability of reachability for J -synchronizable systems, we have seen that it holds even for 2 processes, and hence, holds trivially for the mailbox case. This is not the case for I-synchronizable systems. Moreover, the question of reachability for I-synchronizable systems of 2 processes is also open as of yet.

As for the interest of the notion of send-synchronizability, the results in this chapter show that it is not a useful measure to analyze safety questions such as reachability and variations. However, the question of boundedness remains open. Moreover, it is likely that a notion based on observable behavior could be a good choice for model checking, as one could ask the question of whether a certain message is observed along the trace, and similar questions.

Another interest point of investigate is the relationship between the notions of send-synchronizability and choreography realizability. In a recent work [START_REF] Schewe | Realisability of Choreographies[END_REF], the authors have analyzed the notion of choreography realizability, where a system is called realizable, if the traces of the prescribed communication coincide with those of the asynchronous system of peers. The notion of synchronizability changes slightly in the presence of choreographies, i.e., FSMs that prescribe the rendezvous synchronization. In this case the peers are projections of a choreography, and synchronizability becomes realizability of the given choreography. The rendez-vous composition of the projected peers coincides with the choreography, whereas in general projections of a rendez-vous composition of arbitrary peers may not coincide with the given peers. It would be interesting to see if there is a similar characterization of synchronizability for the mailbox case.

Chapter 7

Conclusion

In this thesis, we studied various under-approximations of transition systems, with a particular focus on subclasses of communicating finite-state systems. For these subclasses, we tried to prove the decidability (or decidability) of various verification problems, such as reachability and boundedness. Let us recall some of the significant contributions of the thesis:

E↵ective branch-well-structured transition systems have decidable boundedness and termination. In Chapter 3, we introduced branch-WSTS, a class of systems that strictly includes well-structured transition systems where we relax both the wqo and the monotony conditions. For this class, we show that boundedness and termination are decidable under e↵ectivity conditions. However, we show that coverability is undecidable for branch-WSTS. Therefore, we introduce a class of (well-quasi-ordered) transition systems where the monotony condition is relaxed, and show that a variation of the coverability problem is decidable for them.

Input-bounded rational reachability is decidable for FIFO machines. In Chapter 4, given a rational set, a set of bounded languages, and a FIFO machine, the problem of checking whether a control-state is reachable along an input-bounded run, such that the channel contents belong to the rational set, is decidable. This result leads the way in deriving many other results, such as the decidability of boundedness, deadlock, reachability and so on, under the input-bounded restriction.

We also study the special case of a FIFO machine with a single channel to obtain some lower and upper bounds. Moreover, we also looked at the dual of such systems (where the reception is bounded), and observed some similarities, while also looking at the di↵erence between the two notions. Finally, we open the way to introducing a kind of under-approximation for the general reachability (and other verification problems) of FIFO machines, where we can take larger and larger 135 bounded languages and verify the reachability of potentially bad states.

The synchronizability problem is decidable for any class of MSCs which are MSO-definable and have bounded-special tree width. This result we show in Chapter 5 provides a framework for deciding synchronizability and reachability for a number of classes studied in the literature. Moreover, this also paves the way to unify notions of synchronizability.

We also briefly investigate the notion of send-synchronizability for peer-to-peer systems and show that a number of verification problems remain undecidable for this notion. These questions have tried to answer some of the open questions in the literature, but there are still several unanswered questions and directions for future research.

Relaxations of well-structured transition systems

Branch-WSTS and cover-WSTS have given us insight into the fact that the conditions for WSTS can be relaxed while still keeping some of the interesting problems decidable. However, there are some open problems that this study has led to:

• The biggest gap in this study is the question of coverability, and whether we can find a class of systems for which general coverability is decidable (without necessarily having to compute the coverability set).

• Another open question is the characterization of FIFO and counter machines which are branch-WSTS (and cover-WSTS). We were able to find some subclasses of these systems, but the larger question of whether one could precisely capture the set of all FIFO (or counter) machines, which are branch-WSTS for a given ordering, is open. Moreover, for FIFO machines, the prefix relation introduced in [START_REF] Jéron | Testing for unboundedness of fifo channels[END_REF] showed boundedness to be decidable for input-bounded FIFO machines. However, as it is not an ordering, we cannot use it for branch-WSTS. Strengthening this notion to an ordering would introduce a new class of FIFO machines with decidable properties.

• More generally, it would be interesting to study other models which are not WSTS and automatically verify whether boundedness and termination are decidable for such systems. We can also study other branch-WSTS (resp. cover-WSTS) and other orderings for which they hold.

Perspectives. From a theoretical perspective, a significant problem of interest is to study how much further one can relax the conditions on WSTS in order to still obtain decidable verification problems. It would also be interesting to see if this relaxation translates to better hope for the usability of WSTS and relaxations as a verification technique.

For FIFO machines, an interesting open problem is characterizing the class for which the prefix ordering behaves like a well-ordering. We saw that for branchmonotony, input-bounded systems were still too general. Another related problem would be to modify the prefix-compatible relation to make it an ordering. Since the overarching objective of the thesis was FIFO machines, a pertinent question is to see how they can be characterized as well (resp. branch-well, cover-well) under the various orderings.

Input-bounded FIFO machines

For the bounded-reachability in FIFO machines, we have a number of immediate open problems:

• It would be interesting to obtain the precise complexity of input-bounded reachability (and other verification problems) for FIFO machines with a fixed number of channels. Moreover, we could also ask what the complexity of these problems is for general FIFO machines.

• For output-bounded verification, it is interesting to see that most problems reduce from the input-bounded case. However, in order to complete the picture, it would be worthwhile to investigate whether rational reachability (and deadlock detection) are decidable for the output-bounded case. Moreover, the question of whether restricting the input-bounded language is equivalent to restricting the output-language is an interesting open question.

• We see that counter machines with restricted zero tests prove to be an interesting extension of VASS. Since each channel is modeled by more than one counter, they are not immediately comparable to VAS with hierarchical zero tests studied in [START_REF] Reinhardt | Reachability in Petri Nets with Inhibitor Arcs[END_REF][START_REF] Bonnet | Theory of Well-Structured Transition Systems and Extended Vector-Addition Systems[END_REF] (as there is a total order on the counters).

It would be interesting to compare these models and see whether we can derive some interesting results on CMRZs.

Perspectives. Over the long term, input-bounded reachability could provide a novel approach to verifying FIFO machines. Much like the notion of flattable systems, the notion of boundable FIFO machines could prove to be an interesting technique to verify FIFO machines. However, it is not yet known whether reachability is decidable for boundable FIFO machines, as we still would need to find the right set of bounded languages, and verify if the reachability set of the FIFO machine is equal to the input-bounded reachability set, which would a priori imply computing the reachability set.

However, it could also be used in practice as a semi-decidable under-approximate verification tool. Moreover, the size of the counter machine associated with a FIFO machine and a tuple of bounded languages is exponential, but it is only polynomial if the underlying FIFO is in normal form. Hence, it would be interesting to see if we can use existing tools for counter machines, and whether the construction of flat machines can be used to aid the verification of boundable FIFO machines.

Finally, we also observe that increments happen in an orderly fashion in the CMRZs we use for bounded verification. Hence, working backwards from counter machines to FIFO machines, it would be an interesting question to investigate whether we can extend the notions of bounded reachability to other FIFO machines such that verifying the underlying counter machine still remains decidable. This could, in turn, also be beneficial to the automated verification problems we discussed earlier.

Unifying notions of synchronizability

Many questions related to the notion of synchronizability can be studied in the future:

• We could think about the hypotheses to add to the framework to decidably answer the problem "does there exist k 0 such that L p2p (S) ✓ C k ?". This problem is already decidable for weakly and strongly systems [START_REF] Di Giusto | Guessing the bu↵er bound for k-synchronizability[END_REF], but it remains to be seen if we can obtain these results as an extension of our framework.

• In [START_REF] Lange | Verifying Asynchronous Interactions via Communicating Session Automata[END_REF], the authors introduced an asynchronous compatibility property. It would also be interesting to verify whether this property can be expressed in the framework.

• Finally, in recent works [Lav21, SZ22], more comparisons have been made between the classes studied in this thesis and in [BDGF + 21]. It would be interesting to complete this picture for all communication architectures (bags, mailboxes, peer-to-peer), and verify if we can include subclasses of half-duplex and reversal-boundedness to our framework.

Perspectives. For the longer term, it appears as if this definition is not wellsuited for the verification problems we are interested in. However, the notion of synchronizing observable behavior is still an interesting notion in practice. Hence, it would be worthwhile to redefine this notion such that we keep the spirit of the existing definition, but modify it to include some information about the path taken by the system as well. This would also give us some more information on the reachability of control-states and might lead to decidable results. Moreover, as the current version of send-synchronizability is undecidable, this notion could be altered to a decidable one.

Another path of investigation in future could be the notion of choreography realizability. This involves verifying if a set of traces can be realized in a communicating system. For the peer-to-peer case, as we saw earlier, this problem reduces to synchronizability of the underlying system. However, this notion is not as explicit for the mailbox case. Moreover, the intertwined relationship between these notions could lead us to better understand how to study the notion of "slack elastic observable behavior".

Other subclasses

We conclude this thesis with some interesting classes of systems that we believe will aid in the verification quest, but we did not have the bandwidth to cover them in this thesis.

Reversal-bounded FIFO machines. Reversal boundedness was introduced for counter machines in [START_REF] Ibarra | Reversal-Bounded Multicounter Machines and Their Decision Problems[END_REF] and proved to be an interesting subclass, as various properties were shown to be decidable for them. Roughly speaking, a system is k-reversal bounded if, for each run, there are at most k switches between increasing and decreasing each counter. This notion was extended to k-reversal b-bounded systems in [START_REF] Finkel | Reversal-Bounded Counter Machines Revisited[END_REF], where the authors showed that reversal-boundedness can be restricted to counters with a value above a certain bound b, and decidability can still be retained.

For FIFO machines, however, it can be seen that reversal-boundedness is undecidable. However, for various topologies, this problem can be decidable. An interesting direction for future work can be investigating the notion of reversal bounded for FIFO machines.

Half-duplex systems. Half-duplex systems have been introduced and studied in [START_REF] Cécé | Verification of programs with halfduplex communication[END_REF]. Such systems add the restriction that at any given instant, only one of the unidirectional channels between a pair of processes is not empty. However, for more than two processes, more verification problems are undecidable.

However, this notion is still interesting as it can e ciently characterize reliable channel contracts [START_REF] Lozes | Reliable Contracts for Unreliable Half-Duplex Communications[END_REF]. However, since the notion is undecidable for more than two processes, it would be interesting to extend a similar notion for multiparty CFMs, like for example, in the recent work [START_REF] Di Giusto | Towards Generalised Half-Duplex Systems[END_REF].

Beyond perfect channels. A significant assumption that we made in this thesis was that the channels of communication were perfect. However, this leads to ignoring many of the real-world problems in communication, such as lossiness, duplication, stuttering of messages, etc. A complete conclusion to this work would be to analyze these problems through the lens of these potential faults.

Index

Figure 1 . 1 :

 11 Figure1.1: The model of the protocol from[START_REF] Brand | On Communicating Finite-State Machines[END_REF]

Figure 2 . 1 :

 21 Figure 2.1: Transition system as described in Example 1

  transition relation where actions hc!mi, hc?mi Act M = {hc!mi | c 2 Ch and m 2 ⌃ c } [ {hc?mi | c 2 Ch and m 2 ⌃ c } is the set of send and receive actions.

Figure

  Figure 2.2: The model of the connection-deconnection protocol

Figure 2

 2 Figure 2.4: System A 1

Figure 3

 3 Figure 3.1: The FIFO machine M 1 (left), and its corresponding (incomplete) infinite reachability tree (right).

Figure 3 . 2 :

 32 Figure3.2: The transition system associated to the FIFO machine M 2 (with a single channel) is branch-wqo if the initial control-state is 0. If the initial controlstate is 2, then it is not branch-wqo as the states in the set {(1, w) | w 2 e + b}, which form an infinite antichain, are reachable from (2, ").

Figure 3

 3 Figure 3.1, the resulting OLTS is not monotone as (1, b)  sw (1, ab) but (1, b) hc?bi

Procedure 1 :

 1 Checks for a coverability certificate of y from x input: S = (X, !, ) and x, y D := #x while y / 2 D do D := #(D [ P ost S (D)) end while return "y is coverable from x"

Procedure 2 :

 2 Checks for non-coverability input: S = (X, !, ) and x, y enumerate D 1 , D 2 , . . . i := 1 while ¬(#P ost(D i ) ✓ D i and x 2 D i and y / 2 D i ) do i := i + 1 end while return false

  Let Z = P ost k (D). Since Z ✓ #P ost k (D), we know that Z ✓ D (by hypothesis). Furthermore, for any subset Y ✓ D, #P ost(Y ) ✓ Y , hence, #P ost(Y ) is also a subset of D. Therefore, #P ost(Z) ✓ D. Hence, we deduce #P ost(P ost k (D)) ✓ D, i.e., #P ost k+1 (D) ✓ D. Hence, we have proved the claim by induction. From the above claim, we know that #P ost k (D) ✓ D for all D ✓ X. Note also that P ost ⇤ (D) = D [ S k 1 P ost k (D). Therefore, P ost ⇤ (D) ✓ D, and finally since D is downward-closed, #P ost ⇤ (D) ✓ D.

Figure 4 . 1 :

 41 Figure 4.1: Incrementing x 1 , corresponding to rotating the channel contents and the addition of the letter a as shown in the red transition.

Figure 4 . 2 :

 42 Figure 4.2: Decrementing x 1 , corresponding to rotating the channel contents and the removal of the letter a as shown in the red transition.

Figure 4 . 3 :

 43 Figure 4.3: Testing if x 1 = 0?, which corresponds to ensuring there are no occurrences of a.

  Figure 4.4: The Client-Server-Logger example from [LY19]

  We define the Parikh image Parikh image of a relationof a relation Rel ✓ Q c2Ch ⌃ ⇤ c as Parikh(Rel ) = {(⇡ a ) a2⌃ 2 N ⌃ |9w = (w c ) c2Ch 2 Rel such that ⇡ a = |w c | a for all c 2 Ch and a 2 ⌃ c }It is well known that, if Rel is rational, then Parikh(Rel ) is semi-linear.

Figure 4 . 5 :

 45 Figure 4.5: The FIFO machine M (left) and the modified FIFO machine h 1 ( M) with distinct letters

Figure 4 . 6 :

 46 Figure 4.6: We construct a FIFO machine M (bottom), together with L c = (a 1 a 2 ) ⇤a 3 a ⇤ 3 , in normal form as the product of h 1 ( M) (top left) and an automaton for V (top right).

Figure 4

 4 Figure 4.8: Following Example 16, from the normalized FIFO machine M (left), we obtain the counter machine C (right) which has a tight correspondence with M.

Lemma 4. 6 .

 6 We have Traces(M) ✓ Pref (V) and Traces(C) ✓ L zero C .

  Figure 4.9: Gadget for variables

Figure 4 .

 4 Figure 4.10: Gadget for clauses (the loop labeled ?a!a represents loops for all a 2 ⌃)

Figure 4 .

 4 Figure 4.11: Showing NP-hardness for flat systems with a single channel

Figure 2 . 2 :

 22 Figure 2.2: The model of the connection-deconnection protocol from Example 2

Figure 5

 5 Figure 5.1: MSC M 1 (left) does not satisfy the MSO formula in Example 21 while MSC M 2 does.

For

  an MSC M = (E, !, C, ) and e 2 E, we define the type ⌧ (e) 2 {S, R} of e by ⌧ (e) = S if e 2 SendEv (M ) and ⌧ (e) = R if e 2 RecEv (M ). Moreover, for e 2 Unm(M ), we let µ(e) = e, and for (e, e 0 ) 2 C, we let µ(e) = µ(e 0 ) = (e, e 0 ). Definition 5.3. The conflict graph conflict graph CG(M ) of an MSC M = (E, !, C, ) is the labeled graph (Nodes, Edges), with Edges ✓ Nodes ⇥ {S, R} 2 ⇥ Nodes, defined by Nodes = C [ Unm(M ) and Edges = {(µ(e), ⌧(e)⌧ (f ), µ(f )) | (e, f ) 2 ! + }. In particular, a node of CG(M ) is either a single unmatched send event or a message pair (e, e 0 ) 2 C.

Figure 5

 5 Figure 5.2: MSC M 1 (top left) and its associated conflict graph (top right) and the extended conflict graph (below)

5 Figure 5 .

 55 Figure 5.4: MSC M 2

  Fig 5.5 (b)).

Figure 5 . 5 :

 55 Figure 5.5: Playing the decomposition game on M 2 .

  Fig 5.5 (f). Now, Eve separates the first process from the rest, as shown in Fig 5.5 (g).

Definition 5 .

 5 16. Let M = (E, !, C, ) be an MSC k-exchange and k 2 N. We call M a k-exchange if M is an exchange and |SendEv (M )|  k.

Figure 5 .

 5 Figure 5.6: MSC M 3 and MSC M 1 (right) are weakly 1-synchronous.

Definition 5 .

 5 22. Let M = (E, !, C, ) be an MSC modified k-exchange and k 2 N. We call M a modified k-exchange if |SendEv (M )|  k.

Proposition 5 . 5 for

 55 25. For all k 2 N, the set of strongly k-synchronous mailbox MSCs is MSO-definable and STW-bounded.Proof. MSO definability. We first express the extended relations between events in MSO: ERR(e 1 , e 2 ) = RR(e 1 , e 2 ) ERS(e 1 , e 2 ) = RS(e 1 , e 2 ) ESR(e 1 , e 2 ) = SR(e 1 , e 2 ) _ [matched (e 1 ) ^(e 1 = e 2 )] ESS(e 1 , e 2 ) = SS(e 1 , e 2 ) _ RR(e 1 , e 2 ) _ 2 6 6 4 matched (e 1 ) ^¬matched (e 2 ) ^_ q2P a,b2Send( ,q) (e 1 ) = a ^ (e 2 ) = b And we define Rule 4 in Figure 5.3 as follows: EXZ closed (e 1 , e 2 ) = EXZ(e 1 , e 2 ) _ 2 4 9e 3 . _ Y 2{R,S} (EXY closed (e 1 , e 3 ) ^EY Z closed (e 3 , e 2 )) 3 all X, Z 2 {R, S}. The MSO formula proceeds similarly to what has been shown in the previous case, but now relies on the extended conflict graph. ECG(e 1 , e 2 ) = _ X,Y 2{R,S} EXY closed (e 1 , e 2 )

5. 4 . 4

 44 Existentially k-p2p-bounded MSCs Definition 5.29. Let M = (E, !, C, ) 2 MSC and k 2 N. A linearization of

  Now, we turn to existentially k-bounded MSCs [LM02, GMK04, GKM07]. A linearization of an MSC M

Figure 5

 5 Figure 5.8: MSC M 5

  Act is a labeling function. For p 2 P, let E p = {e 2 E | (e) 2 Act p } be the set of events that are executed by p. We require that ! (the process relation) is the disjoint union relation ! p S p2P ! p of relations ! p ✓ E p ⇥ E p such that ! p is the direct successor relation of a total order on E p . For an event e 2 E, a set of actions A 2 Act, and a relation R ✓ E ⇥ E, let #A(R, e) = |{f 2 E | (f, e) 2 R and (f ) 2 A}|.

		2.2: The model of the connection-deconnection protocol
		message-sequence charts (MSCs), which are similar to UML's sequence diagrams
		[LR11]. MSCs are equipped with Lamport's happened-before relation: we say that
		an event e happens before an event f if there is a "path" from e to f [Lam78].
		Additional binary predicates connect the emission of a message with its reception,
		and successive events executed by the same process. We shall first define the notion
		of MSCs more formally.
	message sequence chart (MSC) relation C	A p2p MSC (or simply MSC) a tuple M = (E, !, C, ) where E is a finite (possibly empty) set of events and over a set of processes P and message set ⌃ is : E ! We require that C ⇢ E ⇥ E (the message relation) satisfies the following:

  is an MSC where, for example, e 2 C e 0 2 and e 03 ! e 4 (See Figure2.3). The dashed arrow means that the send event e 1 does not have a matching receive, so e 1 2 Unm(M 1 ). Moreover, e 2  M 1 e 4 , but e 1 6  M 1 e 4 .

	We can find a total order We call a linearization, which is formally defined below. e 2 e 0 2 ◆  M 1 such that e 1	e 3	e 0 3	e 4	e 0 4 .
	e 1
	e 0 2	e 2
	e 3	e 0 3
	e 0 4	e 4

  Let d 1 be a positive integer. A subset Y of N d is a linear set of dimension d if there linear set exists a basis b 2 N d and a finite set of periods {p 1 , . . . , p m } ✓ N d such that

Table 5 .

 5 1 gives a summary of the results. For a detailed comparison between these classes, refer to [BDGF + 21, Lav21].

Table 5 .

 5 1: Summary of the decidability of the synchronizability problem in various classes

			Peer-to-Peer	Mailbox
	Weakly synchronous		Undecidable	EXPTIME
			[Thm. 5.15]	[Thm. 5.14]
	Weakly k-synchronous	Decidable [BEJQ18, DGLL20] and [Thm. 5.21]
	Strongly k-synchronous	-	Decidable
				[Thm. 5.26]
	Existentially	k-p2p-	Decidable [GKM07, BG21]
	bounded
	Existentially k-mailbox-	-	Decidable
	bounded			[Prop. 5.34]

Branch-Well-Structured Transition Systems

Acknowledgements

Anyone who knows me well would know that I had started my acknowledgements long before I started the first draft of my thesis. I have been extremely fortunate to have come across many people who have made the journey so much more wonderful.

Monadic Second-Order Logic

We first recall the syntax and semantics of Monadic Second-Order Logic (MSO). Let x, y, . . . be an infinite set of first-order variables ranging over events in an MSC, and X, Y, . . . second-order variables ranging over sets of events. Then, the set of MSO formulas monadic second-order logic (MSO) over MSCs (over P and ⌃) is given by the grammar:

where a 2 Act, x and y are first-order variables, and X is a second-order variable. We assume that we have an infinite supply of variables, and we use common abbreviations such as ^, 8, etc.

Let M = (E, !, C, ) be an MSC. Let Var be a set of variables. An Minterpretation is a function I that maps every first-order variable x 2 Var to some element of E and every second-order variable X 2 Var to some subset of E. The satisfaction relation is defined inductively as follows:

Here, I[x 7 ! e] maps x to e and coincides with I on Var \ {x}. When is a sentence (i.e., a formula without free variables), we omit the (redundant) subscript I, and write M |= instead.

Example 21. We use the abbreviation matched (x) = 9y.xCy to say that the event associated to x is a matched send event (i.e., there exists a matching reception). Then, the formula ¬9x.( W a2Send( , ) (x) = a ^¬matched (x)) says that there are no unmatched send events. It is not satisfied by MSC M 1 of Fig. 5.1, as message m 1 is not received, but by M 4 from Fig. 5.7.

Given a sentence , we let L( ) denote the set of p2p MSCs that satisfy . Note that the (reflexive) transitive closure of a binary relation defined by an MSO formula with free variables x and y, such as x ! y, is MSO-definable. The logic can, therefore, freely use formulas of the form x ! + y or x  y (where  is interpreted as  M for the given MSC M ).

where a 2 Act. We use the symbol > to denote a tautology event formula (such as a _ ¬a). We describe the semantics for the logic below:

The semantics of an event formula with respect to M is a set J K M ✓ E, inductively defined below:

Intuitively, Jh⇡i K M holds at e if there exists a path ⇡ which starts at e and ends in some f such that holds at f . The semantics of a path formula ⇡ with respect to M is a set J⇡K M ✓ E ⇥ E, inductively defined below:

A sentence is evaluated wrt. an MSC M = (E, !, C, ). For sentences, we write

Note that every LCPDLdefinable property is MSO-definable. However, the converse is not true. For example, expressing that a graph is connected is possible in MSO, but not possible in LCPDL.

It can be seen below that the mailbox semantics can be readily translated into the LCPDL formula:

Hereby, we let

Theorem 5.14. The following problem is decidable in exponential time: Given P, ⌃, and a communicating system S (over P and ⌃), is every MSC in L mb (S) weakly synchronous?

Proof. According to Corollary 5.12, we determine the LCPDL formula wsmb such that L( wsmb ) is the set of weakly synchronous mailbox MSCs. Moreover, recall from Proposition 5.13 that the special tree-width of all weakly synchronous mailbox MSCs is bounded by 4|P|. By Lemma 5.7, L mb (S) ✓ L( wsmb ) i↵ L mb (S)\ MSC (4|P|+2)-stw ✓ L( wsmb ). The latter is an instance of the bounded model checking problem. As the length of wsmb is polynomial in |P|, we obtain that the original problem is decidable in exponential time by Theorem 5.5.

For the same reasons, the model checking problem for "weakly synchronous" systems is decidable. However, a reduction from the Post correspondence problem (PCP) [START_REF] Post | A variant of a recursively unsolvable problem[END_REF] shows that decidability fails when adopting the p2p semantics:

Theorem 5.15. The following problem is undecidable: Given finite sets P and M as well as a communicating system S, is every MSC in L p2p (S) weakly synchronous?

Proof. We show that the control-state reachability problem for p2p weakly synchronizable systems is not decidable. This immediately shows that the model checking problem for p2p weak synchronizable systems is not decidable. We can also argue that the membership problem (decide whether a given system is p2p weakly synchronizable) is undecidable: indeed, it is enough to add behavior that is not weakly-synchronizable after the control-states for which reachability is undecidable: the system will be not weakly synchronizable i↵ the control states are reached.

We reduce from Post correspondence problem (PCP). Let us recall the Post correspondence problem.

Decision Problem: POST CORRESPONDENCE PROBLEM [Pos46]

Input:

An alphabet A and, two finite lists ↵ 1 , . . . , ↵ N and 1 , . . . , N of words over A Question:

do we have a sequence (i k ) 1kK with K 1 and 1

It is well known that this problem is already undecidable for N = 7 and |A| = 2.

We let the set of messages be ⌃ = {1, . . . , N} ] A ] {]}, and we consider a system with four machines: Prover 1 , Prover 2 , Verifier 1 , and Verifier 2 . We can have Chapter 6

Send-Synchronizability

The results in this chapter are joint work with Benedikt Bollig, Alain Finkel and S. Krishna, unpublished.

This chapter further investigates the notion of send-synchronizability for peerto-peer systems. As we saw earlier, the decidability of send-synchronizability was shown to be undecidable for peer-to-peer systems in [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF]. However, apart from the trivial properties obtained from the definition, the decidability of global properties such as reachability, boundedness, etc. are not known. With regards to choreography realizability, it has been shown in [START_REF] Schewe | Realisability of Choreographies[END_REF] that synchronizability is decidable for choreography-defined peer-to-peer systems.

We recall the two notions of send-synchronizability defined in the literature, which we shall refer to as I-synchronizability and J -synchronizability (which has also been referred to as language-synchronizability in the literature). We go on to investigate the reachability problem, which we show is undecidable for both classes.

Finally, we propose some variants of problems which are decidable for sendsynchronizable systems, and investigate some subclasses of these systems. We conclude with some directions of future work.

Note that as we only consider peer-to-peer systems in this chapter, we will assume that the mode of communication is p2p unless otherwise specified.

I and J -synchronizability

Let us recall from Section 2.2 that for a communicating system, a trace ⌧ 2 Act ⇤ is a finite sequence of actions. Furthermore, we let proj ! : Act ⇤ ! ⌃ ⇤ be the homomorphism defined by proj ! (hc!mi) = m for all m 2 ⌃ and c 2 Ch, and proj ! (↵) = " if ↵ 6 = hc!mi for some m 2 ⌃ and c 2 Ch. ?m (r,q) ?a (r,q) ?a 1!2 , ?m (p,q)

?m (r,q) !m (q,r)

?a (r,q) !a (q,r)

?m 1!2 , ?a (p,q)

?m 1!2 , ?a (p,q)

?m 1!2 , ?a (p,q) Figure 6.4: P 0 q for the FIFO automata M 1

As a direct consequence of [FL17, Lemma 8 and 9], we have the following proposition: Proposition 6.9. For all traces ⌧ 2 Traces(S A M ), there is a synchronous trace

Now, let us consider the system A 00 M = (P p , P q [ P 0 q , P r ), where P q [ P 0 q = (Q q [ Q 0 q , q [ 0 q , ⌃ q , `0q ) is obtained by merging the initial state of P q and P 0 q .

As a consequence of [FL17, Lemma 10], we have: Proposition 6.10. The system S A 00 M is J -synchronizable, i.e., J (S A 00 M ) = J 0 (S A 00 M ).

From the above results, we deduce: Proposition 6.11. Assume that M is good-for-reduction. Then, the system S A 00

Proof. Since I 0 (S A 00 M ) ✓ I k (S A 00 M ) is true for any system, in order to show that S A 00 M is I-synchronizable, we only need to prove that

) for all k 2 N, we have to prove that

). From Proposition 6.9, we know that I(S A 0 M ) ✓ I 0 (S A 0 M ). Hence, we only need to show I(S A M ) ✓ I 0 ((S A 0 M ) [ I 0 S (A M ). We know that S A 00 M is J -synchronizable Perspectives. To recap, the decidability of the question whether there exists a k 0 such that L p2p (S) ✓ C k allows us to build a model checking strategy by first deciding whether there exists such a k 0 and testing if L p2p (S) ✓ C k for k = 1, 2, . . . One may use this strategy for weakly/strongly synchronizable systems but not for general existentially bounded systems or deadlock-free universally bounded systems [HMK + 05, LM04].

We believe that our approach can also be used to infer the PSPACE upper bound of weakly k-synchronous MSCs from [START_REF] Bouajjani | On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony[END_REF] by showing bounded pathwidth and using finite word automata instead of tree automata. It would be interesting to also verify this approach for obtaining other upper bounds. More generally, the question of specific complexity bounds for many of these systems is also open.

A final long-term perspective would be the study of high-level MSCs within the framework. From a CFM, one can try to extract an equivalent high-level MSC. As the language of a k-synchronous CFM is finitely-generated, it may indeed be possible to extract such a high-level MSC. This would imply summarizing several asynchronous steps in a CFM into a macro step of a high-level MSC. Therefore, the question of whether one can compute a high-level MSC from a k-synchronous systems is a potential future direction to study.

Verifying send-synchronizable systems

Some immediate open questions in the study of send-synchronizable systems are as follows:

• The largest missing piece of the puzzle is the question of whether sendsynchronizability is decidable under the mailbox semantics. In [START_REF] Finkel | Synchronizability of Communicating Finite State Machines is not Decidable[END_REF], the authors have shown that the earlier proof in [START_REF] Basu | Deciding choreography realizability[END_REF] for mailbox systems fails for a counter-example. However, the decidability of this notion is still open.

• Following the earlier vein, the question of deciding other verification problems for mailbox systems is open. We know that reachability is undecidable from the proof of undecidability for the peer-to-peer case, but this does not extend to the other notions. Moreover, the question of boundedness and termination is open for both mailbox and peer-to-peer semantics.

• Finally, the question of model checking may prove to be decidable for sendsynchronizable systems, as we find the definition to be conducive to verify actions along a path of execution. Decidability of model checking could add interest in this class of systems.