Jules Arnaud

Diego Antoine Amélie

Pierre B Sylvain

part, je Jean-Loup D'autre

Geneviève

Catherine Ahmad

Audrey

Frédérique

Gilles

Marthe Barbara

Je tiens tout d'abord à remercier Igor Walukiewicz et Jean-Marc Talbot pour m'avoir fait l'honneur d'accepter d'être rapporteurs de cette thèse. Leur lecture attentive de mon manuscrit et leurs commentaires m'ont été d'une aide précieuse. Je remercie également Sophie Tison et Christof Loeding d'avoir accepté de participer au jury.

Merci également à mon directeur de thèse officiel, Jean Goubault-Larrecq, d'avoir accepter cette responsabilité.

Je remercie Florent Jacquemard, mon co-directeur de thèse, avec qui j'ai travaillé avec plaisir pendant plus de trois ans. La plupart des résultats présentés ici doivent leur origine à de longs après-midi passés ensemble devant un tableau. Qu'il ait su gérer mes excès d'enthousiasme ou de scepticisme n'est pas le moindre de ses mérites.

Merci à Francis Klay, de France Télécom, pour son accueil, pour les échanges scientifiques, malheureusement trop peu nombreux, et pour s'être assuré que tout se déroulait au mieux pour moi tout au long de ma thèse. Merci également à Yves Quemener, pour avoir fait un suivi bien apprécié de ma situation administrative durant ces trois années.

Je remercie Guillem Godoy, pour son accueil, sa bonne humeur et ses idées éclairantes. Ces trois jours de travail en commun à Barcelone ont constitué une étape cruciale dans le déroulement de ma thèse. Je lui en suis redevable.

Si cette thèse a pu voir le jour, c'est grâce à la bonne ambiance qui règne dans les bâtiments du LSV et aux personnes qui s'y trouvent, contribuant à en faire un peu plus qu'un simple lieu de recherche. Merci notamment à ceux et celles avec qui j'ai partagé un bureau, des soirées, des repas, ou plus que cela. Une pensée donc pour Thomas,

Introduction

In system and software verification, one classical problem is to modelize infinite structures with only finitely many informations. Automata on words have been used with this approach since decades. They are basically finite state machines that allow to represent potentially infinite languages of words. An intuitive way to describe automata is to say that they have a finite number of states, and each of these states will correspond to a (potentially infinite) class of words that have the same behavior when viewed as prefixes of other words. Then, the automaton will have several transition rules that define the relations between all these states. The languages recognized by automata are called regular. The use of automata spread quickly and they are still widely used in many fields of computer science. Among the most evident reasons of their success, one can cite their expressiveness, the decidability of many important problems, and the closure properties of regular languages.

Automata are as expressive as rational expressions: any language that can be described as a rational expression can be described as an automaton language. The problem to know whether a word can be recognized by a given automaton, or whether there even exists such a word, are decidable, in a reasonable complexity. Moreover, regular languages can be combined, and automata can recognize the union or intersection of two regular languages, and also the complement of a regular language.

Automata have been quickly generalized from words to terms in order to finitely represent infinite languages of structures shaped like trees. Most of the properties of automata on words are still true on trees. In particular, the problems and properties mentioned above are still valid for Tree Automata. They can be used to represent infinite sets of states of a system or a program (in the latter case, a term can represent the program itself), messages exchanged in a communication protocol, XML documents... In these settings, the closure properties of TA languages permit incremental constructions and verification problems can be reduced to TA problems decidable in polynomial time like emptiness (is the language recognized by a given TA empty) and membership (is a given term t recognized by a given TA).

Tree automata techniques are widely used in several domains like automated deduction (see e.g. [CLDG + 07]), static analysis of programs [START_REF] Bouajjani | On computing reachability sets of process rewrite systems[END_REF] or protocols [START_REF] Kumar | Alternating two-way ac-tree automata[END_REF][START_REF] Feuillade | Reachability Analysis over Term Rewriting Systems[END_REF], and XML process-ing [START_REF] Schwentick | Automata for xml -a survey[END_REF]. Hence they are an important tool in security issues such as communications protocol verification, or XML updates analysis. A severe limitation of standard tree automata (TA) is however that they are not able to test for equality (isomorphism) or disequality between subterms in an input term. For instance, the language of terms described by a non-linear pattern of the form f (x, x) is not regular (i.e. there exists no TA recognizing this language). Such tests would also be useful for expressing integrity constraints . Similar problems are also frequent in the context of XML documents processing. Intuitively, an XML document is a textual representation of the storage of data in a tree structure; in other words, it is a finite labeled unranked tree. XML documents are commonly represented as labeled trees, and they can be constrained by XML schemas, which define both typing restrictions and integrity constraints. All the typing formalisms currently used for XML are based on finite tree automata. The key constraints for databases are common integrity constraints expressing that every two distinct positions of a given type have different values (see e.g. [START_REF] Fan | On XML integrity constraints in the presence of DTDs[END_REF]). This is typically the kind of constraints that can not be characterized by TA.

One first approach to overcome this limitation of TA consists in adding the possibility to make equality or disequality tests at each step of the computation of the automaton. The tests are performed locally, between subtrees at a bounded distance from the current computation position in the input tree. The emptiness problem, whether the language recognized by a given automaton is empty, is undecidable with such tests [START_REF] Mongy | Transformation de noyaux reconnaissables d'arbres[END_REF]. A decidable subclass is obtained by restricting the tests to sibling subtrees [START_REF] Bogaert | Equality and disequality constraints on direct subterms in tree automata[END_REF] (see [CLDG + 07] for a survey).

Another approach to allow such tests is to add an auxiliary memory containing a tree and permit memory comparison [START_REF] Comon | Tree automata with one memory, set constraints and cryptographic protocols[END_REF]. Pushdown tree automata [START_REF] Guessarian | Pushdown tree automata[END_REF][START_REF] Chabin | Visibly pushdown languages and term rewriting[END_REF] also permit such tests. However, they are also all limited to local tests, at a bounded distance from the current position.

A new approach was proposed more recently in [START_REF] Filiot | Satisfiability of a spatial logic with tree variables[END_REF][START_REF] Filiot | Tree automata with global constraints[END_REF] with the definition of tree automata with global equality and disequality tests (TAGED). The TAGED do not perform the tests during the computation steps but globally on the tree, at the end of the computation, at positions which are defined by the states reached during the computation. For instance, they can express that all the subtrees that reached a given state q are equal, or that every two subtrees that reached respectively the states q and q ′ are different. The emptiness has been shown decidable for several subclasses of TAGED [START_REF] Filiot | Satisfiability of a spatial logic with tree variables[END_REF][START_REF] Filiot | Tree automata with global constraints[END_REF], but the decidability of emptiness for the whole class remained a challenging open question until this year.

In this thesis, we will mostly work with various formalisms of tree automata with global constraints, as it seems to be one of the most adapted in order to be applied to security issues. We will first show an application of a subclass of TAGED that only do equality tests to the verification of cryptographic protocols. We will follow a classical approach, which is to decide whether a term can be inferred from an automata language using term rewriting rules. Closure of TA languages under term rewriting has been a well-studied field, especially in communication protocol verification (see e.g. [START_REF] Feuillade | Reachability Analysis over Term Rewriting Systems[END_REF][START_REF] Genet | Rewriting for Cryptographic Protocol Verification[END_REF]). However, we present a result which is, to our knowledge, one of the first concerned with automata with (dis)equality constraints. The difficulty lies in the preservation of the equality constraints by the successive rewritings.

Then we will focus on the main aim of this thesis, which is to answer the question of decidability of emptiness for TAGED. The emptiness problem of the subclass of TAGED with only disequality constraints (negative TAGED) has been shown decidable by proving the equivalence with a set constraint problem. This problem was solved by Charatonik and Pacholsky in [START_REF] Charatonik | Set constraints with projections are in NEXPTIME[END_REF]. Charatonik then proved (in [START_REF] Charatonik | Automata on dag representations of finite trees[END_REF]) the emptiness decidability of emptiness of another class of automata, DAGautomata, using similar techniques. In chapter 4, we modify this proof to get decidability in the TAGED case.

We also prove the emptiness decision problem for a class of tree recognizers more general than TAGED. We define (in chapter 1) a class of tree automata with global constraints (TAGC) which, roughly, corresponds to TAGED extended with the possibility to express disequalities between subtrees that reached the same state (specifying key constraints, which are not expressible with TAGEDs), and with arbitrary Boolean combinations (including negation) of constraints. We show in Chapter 5 that emptiness is decidable for TAGC.

The decision algorithm uses an involved pumping argument: every sufficiently large tree recognized by the given TAGC can be reduced by an operation of parallel pumping into a smaller tree which is still recognized. The existence of the bound is based on a particular well quasi-ordering. This thesis is organized as follow:

In chapter 1 we give the formal definitions that we will need along this manuscript. We will mostly introduce the notions of terms and of automata, give the usual notations, and present some basic properties on them. We will also introduce term rewriting systems (TRS) that we will need in chapter 3 and directed acyclic graph representation of terms, which we will intensively use in chapter 4. Finally we give the definition of well quasi-orders that we will need in chapter 5.

In chapter 2 we define the general class of Tree Automata with Global Constraints. We then prove some easy decision results and some closure properties. Then, we will do a quite exhaustive comparative study with most of the automata classes that allow to do similar (dis)equalities test. For each of the presented class, we will give an example of a term that is recognized by TAGC but not by the class, and, when it exists, of a term that is recognized by the class but not by the TAGC. We will mostly prove those propositions, but some of them that required an involved combinatorial argument will just be stated or presented as conjectures.

In chapter 3 we will focus on rigid tree automata (RTA) which are in fact an easy representation of TAGED that can only do equality tests. We justify the use of this representation in the context of protocol verification. We proved some results specific to RTA. Then, we prove the decidability of the emptiness problem of the rewriting closure of RTA languages, and give an application to security protocol verification.

In chapter 4 we first prove a result of equivalence of expressiveness between negative TAGED and t-dag automata. Then, we enhance a former proof of Charatonik of the emptiness problem of t-dag automata in order to apply it to the full class of TAGED.

Finally, in chapter 5, we prove the decidability of the emptiness problem for the whole class of TAGC, which generalizes the class of TAGED. In particular, they allow to handle key constraints, which is not possible with TAGED. We first prove that we can reduce to positive conjunctive constraints by using some arithmetic constraints. Then, we prove the decidability result on TAGC with those positive conjunctive constraints, using a pumping argument and a well quasi-order to prove the existence of a pumping for every big enough term. We then give an extension of this technique for automata that have (dis)equality constraints both global and between brother (as in [START_REF] Bogaert | Equality and disequality constraints on direct subterms in tree automata[END_REF]. Finally, we apply these results to prove the decidability of a strict extension of MSO on trees.

Chapter 1 Preliminaries 1 Ranked Terms

A signature Σ is a finite set of function symbols with arity. We write Σ m for the subset of function symbols of Σ of arity m. Function symbols of arity 0 are also called constant symbols. Given an infinite set X of variables, the set of terms built over Σ and X is denoted T (Σ, X ), and the subset of ground terms (terms without variables) is denoted T (Σ). The set of variables occurring in a term t ∈ T (Σ, X ) is denoted vars(t). A term t ∈ T (Σ, X ) is called linear if every variable of vars(t) occurs at most once in t.

A substitution σ is a mapping from a finite subset of X into T (Σ, X ). The application of a substitution σ to a term t is the homomorphic extension of σ to T (Σ, X ).

The set of positions of a term t is a set of sequences of positive integers, Pos(t) ⊆ N * , defined inductively as follow

• if t = a where a ∈ Σ 0 or if t = x where x ∈ X then Pos(t) = {ε}

• if t = f (t 1 , . . . , t n ) where f ∈ Σ n Pos(t) = {ε} ∪ {1.p | p ∈ Pos(t 1 )} ∪ • • • ∪ {n.p | p ∈ Pos(t n )}
We denote for all i, 0 ≤ i < |p|, we denote p[i] the i-th number of p. Positions are compared wrt the prefix ordering: p 1 < p 2 iff there exists p = ε such that p 2 = p 1 • p (where p 1 • p denotes the concatenation of p 1 and p). In this case, p is denoted p 2p 1 . Two positions p 1 , p 2 incomparable with respect to the prefix ordering are called parallel, and it is denoted by p 1 p 2 . Note that the set of positions is prefix-closed.

A term t can then be seen as a function from its set of positions Pos(t) into function symbols or variables of Σ ∪ X . More precisely, for every position p ∈ Pos(t) we define t(p) as

• if p = ε then -if t = a with a ∈ Σ 0 then t(p) = a -if t = x with x ∈ X then t(p) = x
Chapter 1 : Preliminaries if t = f (t 1 , . . . , t n ) with f ∈ Σ n then t(p) = n

• if p = i.p ′ and t = f (t 1 , . . . , t n ) then t(p) = t i (p ′ )

The subterm of t at position p is denoted t| p . More formally we define its set of positions of t| p is Pos(t| p ) = {p ′ | p.p ′ ∈ Pos(t)} and for all p ′ ∈ Pos(t| p ) we have t| p (p ′ ) = t(p.p ′ ). The replacement in t of the subterm at position p by u is denoted t[u] p . More formally Pos(t[u] p ) = {p ′ | p ∈ Pos(t), p < p ′ } ∪ {p ′ | p ′ = p.p ′′ , p ′′ ∈ Pos(u)} and for all p ′ ∈ Pos(t[u] p ), t[u] p (p ′ ) = t(p ′ ) if p < p ′ and t[u] p (p ′ ) = u(p ′′ ) if p ′ = p.p ′′ . The depth d (t) of t is the length of its longest position. A n-context is a linear term of T (Σ, {x 1 , . . . , x n }). The application of a n-context C to n terms t 1 , . . . , t n , denoted by C[t 1 , . . . , t n ], is defined as the application to C of the substitution {x 1 → t 1 , . . . , x n → t n }.

Unranked Ordered Labeled Trees

Until now, we have only considered terms over signatures (or ranked alphabet). Here we will give a definition of trees over an unranked alphabet where each position may have an unbounded (but finite) number of successors.

Definition 1.1 Let U be an unranked alphabet, and F a ranked alphabet. Let us define Σ = U ∪ F. An unranked ordered labeled tree over Σ is a partial function t : N * → Σ with domain written Pos(t) and such that 1. Pos(t) is finite, nonempty and closed by prefix; 2. ∀p ∈ Pos(t),

• if p ∈ F n then {i | p.i ∈ Pos(r)} = {1, 2, . . . , n};

• if p ∈ U then {i | p.i ∈ Pos(r)} = {1, 2, . . . , k} for some k > 0.

The set of all unranked ordered labeled tree over Σ is denoted T (Σ). A sequence of unranked trees over Σ, even the empty sequence ε, is called a hedge.

Term Rewriting

A term rewrite system (TRS) over a signature Σ is a finite set of rewrite rules ℓ → r, where ℓ ∈ T (Σ, X ) (it is called the left-hand side (lhs) of the rule) and r ∈ T (Σ, vars(ℓ)) (it is called right-hand-side (rhs)). A term t ∈ T (Σ, X ) rewrites to s ∈ T (Σ, X ) by a TRS R (denoted t --→ R s ) if there is a rewrite rule ℓ → r ∈ R, a position p ∈ Pos(t) and a substitution σ such that t| p = σ(ℓ) and s = t[σ(r)] p . In this case, t is called reducible. An irreducible term is also called an R-normalform. The transitive and reflexive closure of --→ R is denoted --→ * R . Given L ⊆ T (Σ, X ), we denote R * (L) = {t ∃s ∈ L, s -→ * R t}. A TRS R is called left-linear (resp. right-linear )) if every variable occurs at most once in the left-hand side term (resp. right-hand side term) of the rule. It is called linear if it is both left-linear and rightlinear. A TRS is called collapsing if every right-hand side term of rules of R is a variable.

DAG Representation of Terms

In Chapter 4, we will extensively use a canonical and succinct graph representation of ground terms. Intuitively, we will represent a ground term with a directed acyclic graph, such that each subterm corresponds to exactly one node in the graph, even if it may occurs several times in the original ground term. So we have to introduce several notations on graph.

Definition 1.2 A directed ordered graph is a couple G = (V G , succ G ) where

• V G is a finite set of nodes
• for all v ∈ V G there is an arity ar(v) ∈ N

• succ G : N × V G → V G is a partial function such that for all node v, succ G (i, v) is defined if and only if i ≤ ar(v)

If succ G (i, v) = v ′ we say that v ′ is the i-th immediate successor (or simply an immediate successor ) of v. If all the nodes of a directed ordered graph G are of arity at most 1, we may forget the "ordered" qualification, and, if it exists, we denote succ G (v) the only immediate successor of v. We denote v → G v ′ the relation "v ′ is an immediate successor of v". We denote

+ → G the transitive closure of → G and * → G its reflexive transitive closure. If v + → G v ′ we say that v ′ is a successor of v. A subgraph G ′ of a directed graph G is closed if G ′ contains
with every node v all the successors of v in G.

A directed ordered graph G is said acyclic if there does not exist a node v ∈ V G such that v + → v. A graph G is rooted at some node u if u is the only node such that there is no node v ∈ V G such that v → u. We call u the root of G. Given a directed ordered graph G and a node v ∈ V G , we denote G| v and we call subgraph of G rooted at v the directed ordered graph G| v = V ′ , succ ′ , where

V ′ = {v ′ | v * → v ′ } and succ ′ is the restriction of succ G to V ′ .
A position is a finite sequence of integers, and ε denotes the empty sequence. The set of positions Pos(G) of a directed ordered acyclic graph G = V G , succ G rooted at u is defined inductively as follow:

• if V G = {u} then Pos(G) = ε • otherwise, let ar(u) = n, then Pos(G) = {ε} ∪ {1.p | p ∈ Pos(G| succ G (1,u) )} ∪ • • • ∪ {n.p | p ∈ Pos(G| succ G (n,u) )}
Given a directed ordered graph G rooted at u, and p ∈ Pos(G), we denote G(p) the node:

• u if p = ε • G| succ(i,u) (p ′ ) if p = i.p ′
We use G| p as a short notation for G| G(p) .

Given a directed ordered acyclic graph a leaf is a node without immediate successors, The main path of a given node v in G is the longest path leading from v to a leaf in G; if there are several paths of the same (biggest) length, then the leftmost of them is the main one. The length of the main path for a given node v is called the height of the node and is denoted h(v). The height of a directed acyclic graph G, denoted h(G), is the maximal height of its nodes.

In a directed ordered acyclic graph, the main successor of a node v is the immediate successor of v lying on the main path for v. The position of the main successor (that is, the number identifying this node in the ordered sequence of successors of v) is called the main position. Note the "leftmost" requirement above; it implies that if v 1 , . . . , v n are the immediate successors of v in G, and v i lies on the main path for v, then the main paths for v 1 , . . . , v i-1 are strictly shorter than the path for v i . A position (resp. a successor) which is not the main position (resp. the main successor) is called secondary.

We say that a node v lies below a node v 0 if the main path for v is shorter than the main path for v 0 (that is, the depth of v is smaller than the depth of v 0 ).

A directed ordered labeled graph is a triplet G = V G , succ G , λ G where V G , succ G is a directed ordered graph, and λ G is mapping from V G to another set. We will always precise this set when defining a new labeled graph. Definition 1.3 A DAG representation of a ground term (t-dag in short) over a signature Σ is a directed acyclic ordered labeled graph

G = V G , succ G , λ G such that • G is rooted at some node u • λ G : V G → Σ is a labeling of nodes of G by function symbols of Σ • for each node v ∈ V G such that λ(v) = f , the arity of v in G is
equal to the arity of f in Σ

• no two subgraphs of G rooted at two different nodes are isomorphic (wrt. structure and labelling)

The last condition is known as maximal sharing of structure. The assumption that a t-dag is ordered (that is, the successors of each node are ordered) is needed to assure that the t-dags representing f (a, b) and f (b, a) are not isomorphic.

We will now formalize how a t-dag represents a ground term.

Definition 1.4 Let G = V, succ, λ be a t-dag. We define inductively a mapping term G : V → T (Σ) the following way

• if λ(v) is a constant, then term G (v) = λ(v) • if λ(v) is a function symbol f of arity n, then term G (v) = f (term G (succ(1, v)), . . . , term G (succ(n, v)))
We denote term(G) the ground term term G (u) where u is the root of G, and we say that G represents term(G).

Given a t-dag G representing a term t, we have that h(G) = h(u) = h(t) where u is the root of G. Due to the maximal sharing property, it is quite obvious that given a ground term t, the t-dag representing t is unique up to isomorphism. Let us give a trivial construction of this t-dag.

Proposition 1.5 Let t be a ground term on a signature Σ. Let us define the directed oriented labeled graph V, succ, λ :

• V = {t ′ | ∃p ∈ Pos(t), t| p = t ′ }
• for all t ′ ∈ V , such that t ′ = f (t ′ 1 , . . . , t ′ n ), for all i, 1 ≤ i ≤ n, succ(i, t ′ ) = t ′ i .

And let λ : V → Σ be defined as follow

• λ(t ′ ) = f if f is a function symbol of arity n and t ′ = f (t ′ 1 , . . . , t ′ n )

Then V, succ, λ is a t-dag representing t, and we denote it dag(t).

proof. It is obvious that dag(t) is a directed ordered labeled graph and that the arity or each node is equals to the arity of its labelling. A subterm t ′ of t has either no successor, if t ′ is a leaf of t, or all its successors are subterms of t ′ , hence, are of height strictly lower than t ′ . So dag(t) is also acyclic. Let t 1 , t 2 be be two different subterms of t, hence, two different nodes of dag(t). Let us show that they are not isomorphic (in order to prove the maximal sharing property). If they are not of same height, then the main path of t 1 in dag(t) is of different length than the main path of t 2 in dag(t), and they are not isomorphic. Assume that they are of same height h. Let us prove by induction on h that they are not isomorphic. If h(t 1 ) = h(t 2 ) = 1, then t 1 and t 2 are two different leafs of t. Hence, they are two different constant symbols of Σ, which are also their labelling. Hence, they are not isomorphic wrt λ. Assume now, that two different nodes of a same height lower than h are necessarily non-isomorphic. Let

h(t 1 ) = h(t 2 ) = h. If λ(t 1 ) = λ(t 2 ), they are not isomorphic. Hence, assume λ(t 1 ) = λ(t 2 ) = f ∈ Σ n . We have that t 1 = f (t 1 1 , . . . , t 1 n ) and t 2 = f (t 2 1 , . . . , t 2 n ). Since t 1 = t 2 there exists a position k, 1 ≤ k ≤ n such that t 1 k = t 2 k . So t 1
k and t 2 k are two different nodes of height lower than h. Either they are of different height, and then they are clearly non-isomorphic, are they are both of same height lower than h, and then, by induction hypothesis, they are not isomorphic. In both cases, t 1 and t 2 are not isomorphic.

2 A term and its t-dag representation coincide in many cases. Especially, they have the same set of positions.

Lemma 1.6 Let t be a ground term, and G = dag(t). Then Pos(t) = Pos(G), and for all p ∈ Pos(t), G| p represents t| p .

proof. It follows mainly from the remark that given a subterm t ′ of t, such that λ(t ′ ) = f ∈ Σ n , t ′ viewed as a term, has the same number n of direct subterms, than the number of immediate successors he has when viewed as a node. Also, we have that, for all i, 1 ≤ i ≤ n, succ(i, t ′ ) = t.i. Then, by induction on the height of t, we prove that Pos(t) = Pos(G). And then, by recurrence on the length of p, we have that, for all p ∈ Pos(t), G| p represents t| p . 2

Tree Automata

Following definitions and notation of [CLDG + 07], we consider tree automata which compute bottom-up (from leaves to root) on (finite) ground terms in T (Σ). At each stage of computation on a tree t, a tree automaton reads the function symbol f at the current position p in t and updates its current state, according to f and the respective states reached at the positions immediately under p in t.

Definition 1.7 A tree automaton (TA) A on a signature Σ is a tuple Σ, Q, F, ∆ where Q is a finite set of nullary state symbols, disjoint from Σ, F ⊆ Q is the subset of final states and ∆ is a set of transition rules of the form: f (q 1 , . . . , q n ) → q where n ≥ 0, f ∈ Σ n , and q 1 , . . . , q n , q ∈ Q.

The size of A, denoted |A|, is the number of symbols in ∆. When given the name A of a tree automaton, we might sometimes use the notations Q A or ∆ A to denote respectively the set of states of A or the set of its transition rules.

Definition 1.8 A run of the TA A on a term t ∈ T (Σ) is a function r : Pos(t) → Q such that for all p ∈ Pos(t) with t(p) = f ∈ Σ n (n ≥ 0), f r(p.1), . . . , r(p.n) → r(p) ∈ ∆. A run r is called successful if r(ε) ∈ F .
We will sometimes use term-like notation for runs. For instance, a run {ε → q, 1 → q 1 , 2 → q 2 } will be denoted q(q 1 , q 2 ).

Definition 1.9 The language L(A, q) of a TA A in state q is the set of ground terms for which there exists a run r of A such that r(ε) = q. The language L(A) of A is q∈F L(A, q), and a set of ground terms is called regular if it is the language of a TA.

Definition 1.10 A TA A = Q, F, ∆ on Σ is deterministic (DTA), resp. complete, if for every f ∈ Σ n , and every q 1 , . . . , q n ∈ Q, there exists at most, resp. at least, one rule f (q 1 , . . . , q n ) → q ∈ ∆.

In the deterministic (resp. complete) cases, given a ground term t, there is at most (resp. at least) one run r of A on t.

Proposition 1.11 Let A be a tree automaton. There exists a deterministic tree automaton B such that

L(A) = L(B).
The idea is to take all the subset of states of A as set of states and B, and all the subsets containing a final state of A as the set of final states of B. Then the transition rules are of the form f (P 1 , . . . , P n ) → P , P, P 1 , . . . , P n ⊆ Q, such that q ∈ P if and only if there exists n states q 1 ∈ P 1 , . . . , q n ∈ P n such that the transition rule f (q 1 , . . . , q n ) → q belongs to ∆. Hence, for each configuration f ∈ Sigma n , P 1 , . . . , P n ⊆ Q, there exists exactly one P ⊆ Q verifying this, and B is actually a deterministic tree automaton. Note that the size of B may be exponential in the size of A, and that it is a lower bound. Hence, since decidability results may focus on deterministic tree automata, it is still important for complexity issues to work with non-deterministic ones.

Tree automata have nice closure properties. One can find the proofs of the following statement in [CLDG + 07].

Proposition 1.12 Let L 1 and L 2 be two tree regular languages. Then the following propositions holds

1. L1 is regular; 2. L 1 ∪ L 2 is regular; 3. L 1 ∩ L 2 is regular.
In the general case, idea is to consider two tree automata A 1 and A 2 recognizing respectively L 1 and L 2 and do simple constructions. The size of the automaton to construct is

O(2 |A 1 | ) for the complementation, O(|A 1 | + |A 2 |) for the union and O(|A 1 | × |A 2 |) for the intersection.
Those sizes and the complexities may vary depending whether you have deterministic tree automata, and whether you want to preserve determinism.

We present now some classical decision problems on tree automata, and we will give their complexity here.

Chapter 1 : Preliminaries Definition 1.13 Given a TA A = Σ, Q, F, ∆ :

• the emptiness problem is the problem to decide whether L(A) = ∅

• the universality problem is the problem to decide whether L(A) = T (Σ)

• the finiteness problem is the problem to decide whether L(A) is finite

•

Given a TA A = Σ, Q, F, ∆ and a term t, the membership problem is the problem to decide whether t ∈ 'L(A).

The emptiness problem is decidable in linear time, the membership and the finiteness problems are in PTIME, whereas the universality problem is EXPTIME-complete (see e.g. [CLDG + 07]).

When introducing extensions of TA, we will often refer to those decision problems. They will be defined the same way, with the name of the concerned class of automata instead of TA.

Automata on Unranked Ordered Labeled Trees

We defined an automata model for ranked terms. Here we generalize this model to unranked labeled ordered trees (see definition 1.1 below). They are called hedge automata, in reference of the denomination of the sequences of unranked ordered labeled trees.

Definition 1.14 A Hedge Automaton is a tuple A = Σ, Q, F, ∆ where Σ = U ∪ F where U is an alphabet of unranked symbols, and F an alphabet of ranked symbols, Q is a finite set of states, F ⊆ Q is a set of finite states, and ∆ is a set of transition rules of the form a(R) → q where R ⊆ Q * is a regular word language over Q, defined by an automaton on word. We call the languages R the horizontal languages.

A run of a hedge automaton A on an unranked tree t is a mapping r : Pos(t) → Q such that for all position p ∈ Pos(t) with a = t(p) and q = r(p) there is a transition rule a(R) → q such that r(p.1) . . . r(p.n) ∈ R where n is the number of successors of p. In particular in order to apply a rule at a leaf, the empty word ε has to be in the horizontal language of the rule. A run r is said successful if r(ε) ∈ F .

An unranked ordered labeled tree t is accepted by A if there exists a successful run r of A on t. The language L(A) of A is the set of all unranked trees accepted by A.

Well Quasi-Ordering

In chapter 5, we use a pumping lemma that relies on the existence of two comparable elements in a given infinite sequence. To prove this existential property, we need to use a well quasi-order. Definition 1.15 A well quasi-ordering [START_REF] Gallier | What's so special about kruskal's theorem and the ordinal γ 0 ? a survey of some results in proof theory[END_REF] ≤ on a set S is a reflexive and transitive relation such that any infinite sequence of elements e 1 , e 2 , . . . of S contains an increasing pair e i ≤ e j with i < j.

Chapter 2

Tree Automata with Equality and Disequality Tests

In this chapter, we define an extension of tree automata with global equality and disequality constraints. We then do a short survey of the existing classes of tree automata that allow similar tests, and compare their properties, the complexity of their decision procedures, and their expressiveness. We will describe many examples of languages of terms that are, or are not, recognized by a given class of tree automata. To prove that a language is recognized, we will only give the description of the corresponding automata: it will be quite obvious that the recognized languages matches. However, we will formally prove that a language is not recognized by some class of automata when we state it.

1 Tree Automata with Global Constraints

Definition and First Examples

We propose here a general class of TA with global constraints that we introduced in [BCG + 10]. It generalizes the class of TAGED that was firstly introduced in [FTT07].

Definition 2.1 A tree automaton with global constraints (TAGC) over a signature Σ is a tuple A = Q, Σ, F, C, ∆ such that Q, Σ, F, ∆ is a TA, denoted ta(A), and C is a Boolean combination of atomic constraints of the form q ≈ q ′ or q ≈ q ′ , where q, q ′ ∈ Q. A TAGC A is called positive if C A is a disjunction of conjunctions of atomic constraints. A TAGC A is called positive conjunctive if C A is a conjunction of atomic constraints. The subclasses of positive and positive conjunctive TAGC are denoted by PTAGC and PCTAGC, respectively. Definition 2.2 A run r of the TAGC A on a term t is a run of ta(A) on t such that r satisfies C A , denoted r |= C A , where the satisfiability of constraints is defined as follows. For atomic constraints, r |= q ≈ q ′ holds (respectively r |= q ≈ q ′ ) if and only if for all different positions p, p ′ ∈ Pos(t) such that r(p) = q and r(p ′ ) = q ′ , t| p = t| p ′ holds (respectively t| p = t| p ′ holds). This notion of satisfiability is extended to Boolean combinations as usual. As for TAs, we say that r is a run of A on t.

A run of A on t ∈ T (Σ) is successful if r(ε) ∈ F A . The language L(A) of A is the set of terms t for which there exists a successful run of A.

It is important to note that the semantics of ¬(q ≈ q ′ ) and q ≈ q ′ differ, as well as the semantics of ¬(q ≈ q ′ ) and q ≈ q ′ . This is because we have a "for all" quantifier in both definitions. The constraint ¬(q ≈ q ′ ) is satisfied by a run r on a term t if and only if ∃p, p ′ ∈ P os(t), r(p) = q, r(p ′ ) = q ′ , t| p = t| p ′ . The difference with ≈ is that it has to have a disequality between one occurrence of each state, and not all, but it forces the existence of at least one occurrence of each state.

We introduced TAGC as a generalization of Tree Automata with Global Equality and Disequality constraints (TAGED) which were first introduced in [START_REF] Filiot | Satisfiability of a spatial logic with tree variables[END_REF]. They can be defined as PCTAGC where the disequality constraints are irreflexive, i.e. there is no atomic constraints of the form q ≈ q. Hence, there are already several known results on PCTAGC, and many of them directly generalizes to TAGC. We will however prove most of them, as they are a good way to get familiar with the manipulation of these automata.

We will several times characterize the subclasses of TAGC with only atomic constraints either of type ≈ or of type ≈. Moreover, in chapter 5, we will introduce new atomic constraints. So from now, we will always specify between brackets the atomic constraints that are used in a given automaton (or class of automata). For example, we will use the notation TAGC[τ ], where τ is either ≈ or ≈, to characterize the subclass of TAGC with only atomic constraints of type τ (and same for PTAGC and PCTAGC). And the general class of TAGC introduced in definition 2.1 will now be referred as TAGC[≈, ≈].

We will prove many undecidability and expressivity results only for PCTAGC [≈]. Since they are clearly a subclass of TAGC[≈, ≈], those results can be directly generalized to this class.

We will here some examples for the expressivity of the equality constraints of the TAGC. The class of regular languages is strictly included in the class of PCTAGC[≈] languages due to the constraints.

Example 2.3 Let Σ = {a : 0, f : 2}. The set {f (t, t) | t ∈ T (Σ)} is not a regular tree language (this can be shown using a classical pumping argument).

However, it is recognized by the following PCTAGC[≈] A = {q 0 , q 1 , q f }, Σ, {q f }, q 1 ≈ q 1 , {a → q 0 | q 1 , f (q 0 , q 0 ) → q 0 | q 1 , f (q 1 , q 1 ) → q f } , where a → q | q r is an abbreviation for a → q and a → q r . An example of successful run of A on t = f (f (a, a), f (a, a)) is q f q 1 (q 0 , q 0 ), q 1 (q 0 , q 0 ) . 3

Note that the above language is not regular; this can be shown using a classic pumping argument.

TA are able to characterize languages of terms which embed a given pattern. However, they are limited to linear patterns for this purpose. For instance, as recalled above, the set of terms embedding the pattern f (x, x) is not a regular term language. The TAGC permit to generalize this pattern matching ability to arbitrary patterns.

Example 2.4 Let us extend the PCTAGC[≈] of Example 2.3 with the transitions rules f (q, q f ) → q f , f (q f , q) → q f ensuring the propagation of the final state q f up to the root. The automaton obtained recognizes the set of terms of T (Σ) containing the pattern f (x, x).

3

The principle of the construction of Examples 2.3 and 2.4 can be generalized into the following result.

Proposition 2.5 For every term t ∈ T (Σ, X ), there exists a PCTAGC[≈] of size linear in the size of t and constructed in linear time which recognizes the terms of T (Σ) having a ground instance of t as a subterm.

proof. The proposition is obvious when t is a variable. Let us assume that t is not a variable and let us associate one state q s to every strict subterm s of t (including variables). The PCTAGC[≈] for Proposition 2.5 has for set of states Q = {q s | s strict subterm of t} ∪ {q, q f }, its constraint is of the form C = x∈vars(t) q x ≈ q x , (we recall that vars(t) is the set of variables occurring in t), the subset of final states is F = {q f }, and its transition set is

∆ = {f (q, . . . , q) → q | f ∈ Σ n , n ≥ 0} ∪ {f (q, . . . , q) → q x | f ∈ Σ n , n ≥ 0, x ∈ vars(t)} ∪ {f (q s 1 , . . . , q sn ) → q f (s 1 ,...sn) | f ∈ Σ n , f (s 1 , . . . s n ) strict subterm of t} ∪ {f (q s 1 , . . . , q sn ) → q f | f (s 1 , . . . s n ) = t} ∪ {f (q 1 , . . . , q n ) → q f | f ∈ Σ n , ∃i ≤ n, q i = q f }.
The transitions in the first four lines ensure the recognition of the pattern t into the final state q f and the transitions in the last line ensure the propagation of q f . The equality constraints q x ≈ q x ensure that the non linearities in t are respected. 2

With disequality constraints, TAGC can recognize languages that are in some sense the duals of the ones it can recognize with equality constraints. For example, by replacing the constraint by q 1 ≈ q 1 in the example 2.3, the TAGC can recognize the language {f (t 1 , t 2 ) | t 1 = t 2 }. Moreover, reflexive disequality constraints such as q ≈ q correspond to monadic key constraints for XML documents, meaning that every

M q M 1 q id N qt 2 q d 0 q N L q L 2 q id N qt 2 q d 0 q N L q L 3 q id N qt 2 q d 0 q N L 0 q L 4 q id N qt 2 q d 0 q N Figure 2
.1: Term and successful run (Ex. 2.6). two distinct positions of type q have different values. A state q of a TAGC[≈, ≈] can be used for instance to characterize unique identifiers as in the following example.

Example 2.6

The TAGC[≈, ≈] of our example accepts (in state q M ) lists of dishes called menus, where every dish is associated with one identifier (state q id ) and the time needed to cook it (state q t ). We have other states accepting digits (q d ), numbers (q N ) and lists of dishes (q L ).

The TAGC

[≈, ≈] A = Q, Σ, F, C, ∆ is defined as follows: Σ = {0, . . . , 9 : 0, N, L 0 : 2, L, M : 3}, Q = {q d , q N , q id , q t , q L , q M }, F = {q M }, and ∆ = {i → q d | q N | q id | q t | 0 ≤ i ≤ 9} ∪ {N (q d , q N ) → q N | q id | q t ,
L 0 (q id , q t ) → q L , L(q id , q t , q L ) → q L , M (q id , q t , q L ) → q M }. The constraint C ensures that all the identifiers of the dishes in a menu are pairwise distinct (i.e. that q id is a key) and that the time to cook is the same for all dish: C = q id ≈ q id ∧ q t ≈ q t . A term in L(A) together with an associated successful run are depicted in Figure 2.1. 3

Decision Problems

We prove here some already known or easy decision problems on TAGC.

Proposition 2.7 Membership is NP-complete for TAGC[≈, ≈].
proof. Given a TAGC A = Q, Σ, F, C, ∆ and a term t ∈ T (Σ), a nondeterministic algorithm consist in guessing a function r from Pos(t) into Q, and checking that r is a successful run of A on t. The checking can be performed in polynomial time.

We show NP-hardness for the restricted class of PCTAGC[≈] as it has already been done in [START_REF] Filiot | Satisfiability of a spatial logic with tree variables[END_REF] and [START_REF] Jacquemard | Rigid tree automata[END_REF]. We propose a reduction of 3-SAT for a formula φ into the membership for a PCTAGC[≈] and a term t representing φ.

Let us consider an instance φ of 3-SAT with variables from a set V . It is represented as a term t over the signature Σ = {0, 1 : 0, ¬ : 1

∧ ∧ ∨ x 0 1 y 0 1 z 0 1 ∧ ∨ ¬ x 0 1 y 0 1 t 0 1 ∨ ¬ x 0 1 ¬ t 0 1 z 0 1 Figure 2.2: Membership NP-hardness: tree encoding of a 3 SAT in- stance. :2, ∨ : 3} ∪ {x : 2 | x ∈ V }. Every variable x is represented by a subterm x(0, 1), a 3 literal clause ℓ 1 ∨ ℓ 2 ∨ ℓ 3 is encoded into ∨(t 1 , t 2 , t 3 ) where t 1 , t 2 , t 3 encode respectively ℓ 1 , ℓ 2 , ℓ 3 . Finally we encode a conjunction of disjunctions D 1 ∧ • • • ∧ D n into ∧(t 1 , . . . , ∧(t n-1 , t n )) where each t i , i ≤ n, is the encoding of D i .
For instance, the tree encoding of the 3-SAT instance (x

∨ y ∨ z) ∧ (¬x ∨ y ∨ t) ∧ (¬y, ¬t, z) is depicted in Figure 2.2.
We define an PCTAGC

[≈] A = ΣQ, F, C, ∆ by Q = {q 1 , q 0 } ∪ {q x , q ¬x | x ∈ V }, F = {q 1 }, C = x∈V (q x ≈ q x ) ∧ (q ¬x ≈ q ¬x ) and ∆ = {0 → q x |q ¬x , 1 → q x |q ¬x | x ∈ V }
∪ {x(q x , q ¬x ) → q 0 , x(q ¬x , q x ) → q 1 | x ∈ V } ∪ {∨(q 0 , q 0 , q 0 ) → q 0 } ∪ {∨(q, q ′ , q ′′ ) → q 1 | at least one of q, q ′ , q ′′ is q 1 , and the others are q 0 } ∪ {¬(q 0 ) → q 1 , ¬(q 1 ) → q 0 } ∪ {∧(q 1 , q 1 ) → q 1 , ∧(q 0 , q 1 ) → q 0 , ∧(q 1 , q 0 ) → q 0 , ∧(q 0 , q 0 ) → q 0 }.

Both the automata A and the tree t are linear in size relatively to the size of the 3-SAT instance φ. The most important transitions of A are those of the two above lines involving the states q x and q ¬x . The states q 0 and q 1 represent the value associated to x (they are propagated bottom-up along t) and the constraints ensures that the same value is associated to all occurrences of the variable x in φ.

Let us show now in detail that A recognizes t iff the corresponding 3-SAT instance φ has a solution.

Assume that the given 3-SAT instance has a solution σ : V → {0, 1} (mapping of propositional variables into truth values). We define a successful run r of A in t as follows. For each variable x ∈ V and for each position p ∈ Pos(t) such that t| p = x, we have by construction of t that t| p.1 = 0 and t| p.2 = 1. If σ(x) = 0, we define r(p.1) = q x and r(p.2) = q ¬x , and if σ(x) = 1, we define r(p.1) = q ¬x and r(p.2) = q x . Both options are possible thanks to the rules 0 → q (¬)x and 1 → q (¬)x , and since we do the same thing for all occurrence of x in t, the constraints on q x and q ¬x in C are satisfied by r. Only one rule can be applied at position p: x(q x , q ¬x ) → q 0 if σ(x) = 0 and x(q ¬x , q x ) → q 1 if σ(x) = 1.

Therefore, for all x ∈ V and p ∈ Pos(t) such that t| p = x, r(p) = q σ(x) . It is obvious, considering the other rules of A that there is only one state possible for each other position in r, and that r(ε) = q 1 because σ is a solution. Hence t ∈ L(A).

Conversely, let r be a successful run of A on t. The transition rules of A ensure that t is a representation of the given 3-SAT instance. We show that the constraint C on r ensures that this instance is satisfiable. Let x ∈ V and p 1 , p 2 ∈ Pos(t) such that t| p 1 = t| p 2 = x. By construction of t, t| p 1 .1 = t| p 2 .1 = 0 and t| p 1 .2 = t| p 2 .2 = 1. Only the two transition rules x(q x , q ¬x ) → q 0 and x(q ¬x , q x ) → q 1 can be applied on p 1 and p 2 . Assume that r(p 1 ) = q 0 , then r(p 1 .1) = q x . If r(p 2 ) = q 1 , then r(p 2 .2) = q x and since t| p 1 .1 = t| p 2 .2 it does not respect the atomic constraint q x ≈ q x . So the only possible values are r(p 2 .1) = q x , r(p 2 .2) = q ¬x and r(p 2 ) = q 0 , which respect the atomic constraints on both q x and q ¬x . Following the same reasoning, if r(p 1 ) = q 1 then r(p 2 ) = q 1 . So, for all x ∈ V , there exists i x ∈ {0, 1} such that for all p ∈ Pos(t) such that t| p = x, r(p) = q ix . Hence, by the construction of t and A, it is obvious that the mapping σ(x) = i x is a solution for the 3-SAT instance.

2 We recall that for plain TA, membership is in PTIME.

The universality problem is known to be undecidable already for the small subclass of PCTAGC[≈], called positive TAGED in [START_REF] Filiot | Tree automata with global constraints[END_REF] or rigid tree automata in [START_REF] Jacquemard | Rigid tree automata[END_REF].

Proposition 2.8 [FTT08, JKV09] Universality is undecidable for PCTAGC[≈].
Given two automata A 1 and A 1 the inclusion (resp. equivalence) problem is the problem of deciding whether L(A 1 ) ⊆ L(A 2 ) (resp. L(A 1 ) = L(A 2 )). The following corollary is easily derived from the proposition 2.8. Theorem 2.9 Inclusion and equivalence are undecidable for PCTAGC [≈].

proof. The equivalence problem is reducible to inclusion. Hence both are undecidable as universality is a particular case of equivalence.

2 The following original result is another consequence of proposition 2.8. Proposition 2.10 It is undecidable whether the language of a given PCTAGC[≈] is regular.

proof. We show that universality is reducible to regularity. Let us define the quotient of a term language L by a term s wrt a function symbol f : L/s := {t | f (s, t) ∈ L}. This operation preserves regular languages: for all s and f , if L is regular then L/s is regular.

Let A be an input of universality for PTAGC[≈], and let L ′ be a language of PTAGC[≈] over Σ which is not regular (such a language exists). Let L 1 := f L(A), T (Σ) ∪ f T (Σ), L ′ where f is a binary symbol, possibly not in Σ (f (L, T (Σ)) denotes {f (s, t) | s ∈ L, t ∈ T (Σ)}). It is obvious that L 1 is a TAGC language.

If L = T (Σ), then L 1 = f T (Σ), T (Σ) and it is regular. Assume that L(A) = T (Σ) and let s ∈ T (Σ)\L(A). By construction, L 1 /s = L ′ which is not regular. Hence L 1 is not regular. Therefore L(A) = T (Σ) iff the TAGC language L 1 is regular.

2

The emptiness is the problem to decide, given a TAGC A, whether L(A) = ∅? The proof that it is decidable for TAGC is rather involved and is presented in section 2.

Closure Properties

Let us conclude this first section with the closure properties of the TAGC languages.

Proposition 2.11 The class of TAGC languages is closed under union and intersection but not closed effectively under complementation.

proof. We use a classical disjoint union for union and Cartesian product of state sets for intersection, with a careful redefinition of constraints on this product. More precisely, let

A 1 = Q 1 , Σ 1 , F 1 , C 1 , ∆ 1 and A 2 = Q 2 , Σ 2 , F 2 , C 2 ,
∆ 2 be two TAGCs. We can assume wlog that Q 1 and Q 2 are disjoint.

The TAGC

A ∪ = Q 1 ⊎ Q 2 , Σ 1 ∪ Σ 2 , F 1 ⊎ F 2 , C 1 ∧ C 2 , ∆ 1 ⊎ ∆ 2 recognizes L(A 1 ) ∪ L(A 2 ).
We define a TAGC

A ∩ = Q 1 ×Q 2 , Σ 1 ∪Σ 2 , F 1 ×Q 2 ∪Q 1 ×F 2 , C ∩ , ∆ ∩ recognizing L(A 1 ) ∩ L(A 2 ). The constraint C ∩ is obtained from C 1 ∧ C 2 by replacing every atom q 1 ≈ q ′ 1 with q 1 , q ′ 1 ∈ Q 1 (resp. q 2 ≈ q ′ 2 with q 2 , q ′ 2 ∈ Q 2 ) by q 2 ,q ′ 2 ∈Q 2 q 1 , q 2 ≈ q ′ 1 , q ′ 2 (resp. q 1 ,q ′ 1 ∈Q 1 q 1 , q 2 ≈ q ′
1 , q ′ 2 ), and similarly for the atoms q 1 ≈ q ′ 1 , q 2 ≈ q ′ 2 . The set of transitions is ∆ ∩ = f q 1,1 , q 2,1 , . . . , q 1,n , q 2,n → q 1 , q 2 f (q i,1 , . . . , q i,n ) → q i ∈ ∆ i for i = 1, 2 . The effective closure under complementation of TAGC would contradict Proposition 2.8. 2 Note that the two above constructions transform two PTAGC (resp. two PCTAGC) into a PTAGC (resp. a PCTAGC). Hence the subclasses of PTAGC and PCTAGC are also closed under union and intersection. Using a disjunctive normal form for the constraint of a PTAGC, it is easy to show that both classes of PTAGC and PCTAGC are equally expressive.

Corollary 2.12 Let B = Q, Σ, F, C, ∆ be a PTAGC. Then one can effectively constructs a PCTAGC A such that L(A) = L(B).

proof. Let B = Q, Σ, F, C, ∆ , and let C ′ = C 1 ∨ . . . ∨ C k where C 1 ,. . . , C k are conjunctions of atomic constraints of the form q ≈ q ′ or q ≈ q ′ for q, q ′ ∈ Q, be the disjunctive normal form of the constraint C. It is obvious that, given the PTAGC

B = Q, Σ, F, C ′ , ∆ , L(B) = L(B ′ ) For all 1 ≤ i ≤ k, let B i = Q, Σ, F, C i , ∆ .
Every such B i is a PCTAGC. Let L(A) be the union construction of the proof of proposition 2.11, modulo state renaming, for k i=1 L(B i ). We have that

L(A) = k i=1 L(B i ) = L(B ′ ) = L(B).
Since the construction in the proof of Proposition 2.11 preserves the positive conjunctive property of the constraints, A is a PCTAGC recognizing the same language as B.

2

2 Related Models with (Dis)Equalities Tests

The formalism of TAGC allows one to test (dis)equalities globally, and to have a succinct representation thanks to the grammar of the constraints. It is a quite natural extension of TAGED that we will present in subsection 2.1. But other models of tree automata already existed that allow to do similar tests, either directly, like the tree automata with local constraints, or by considering specific applications of their features, like tree automata with one memory, or dag automata. We here show the interest of TAGC by doing a short survey of those models. For each of them, we show how it compares to TAGC in expressiveness.

TAGED

Definitions and Known Results

Tree Automata with General Equality and Disequality constraints [START_REF] Filiot | Tree automata with global constraints[END_REF] were introduced in the context of spatial logics for XML querying [START_REF] Filiot | Satisfiability of a spatial logic with tree variables[END_REF].

Definition 2.13 A Tree Automaton with General Equality and Disequality constraints (TAGED for short) is a tuple

A = Σ, Q, F, ∆, ≈ A , ≈ A where • Σ, Q, F, ∆ is a tree automaton;
• ≈ A is a reflexive and symmetric binary relation on a subset of Q;

• ≈ is an irreflexive and symmetric binary relation on Q.

A TAGED A is said to be positive (resp. negative) if ≈ A (resp. ≈ A ) is empty.

A run r of a TAGED on a term t ∈ T (Σ) is a run of the underlying TA on t with the additional condition that for all p 1 , p 2 ∈ Pos(t), if r(p 1 ) ≈ A r(p 2 ) then t| p 1 = t| p 2 and if r(p 1 ) ≈ A r(p 2 ) then t| p 1 = t| p 2 .

It is quite obvious that TAGED are equivalent to PCTAGC[≈, ≈] where ≈ is irreflexive. In fact, we were working on TAGED when we introduced TAGCto generalize our results. Several results on these automata have been shown in [START_REF] Filiot | Tree automata with global constraints[END_REF]. The emptiness problem is EXPTIME-complete for positive TAGED and in NEXPTIME for negative TAGED. Moreover, the authors of [START_REF] Filiot | Tree automata with global constraints[END_REF] prove decidability for the emptiness problem of a subclass combining equality and disequality tests.

Definition 2.14 Let Σ be a ranked alphabet. A vertically bounded TAGED (vbTAGED) over Σ is a pair (A, k) where A is a TAGED over Σ and k ∈ N. A run r of k on a tree t ∈ T (Σ) is a run of A on t. It is an accepting run if r is accepting for A and the number of states from dom( ≈ A ) occurring along any root-to-leaf path is bounded by k:

for all position p such that t|p is a leaf, |{i | i < p ∧ r(i) ∈ dom( ≈ A )}| ≤ k
The authors of [START_REF] Filiot | Tree automata with global constraints[END_REF] show that the emptiness problem for vb-TAGED is decidable in 2NEXPTIME. However they did not solve the emptiness problem for the full class.

One interesting property of TAGED is that the equality relation can be reduced to an identity relation.

Theorem 2.15 [START_REF] Filiot | Tree automata with global constraints[END_REF] Every TAGED A is equivalent to a TAGED A ′ (whose size might be exponential in the size of A) such that

≈ A ′ ⊆ id Q A ′ where id Q a ′ is the identity relation on Q A ′ . Moreover, A ′ can be built in exponential time.
Such a property allows one to manipulate TAGED more easily. Also, some results have a lower complexity when using such a TAGED. For example, the emptiness of a positive TAGED A such that ≈ A ⊆ id Q A can be done in linear time. In chapter 3 we are concerned with Rigid Tree Automata. Those are actually positive TAGED respecting this property.

Comparison with TAGC

The link with PCTAGC is quite obvious.

Proposition 2.16 The class of TAGED is equivalent to the class of PCTAGC[≈, ≈] where ≈ is irreflexive

The requirement of irreflexivity weakens the expressive power of PC-TAGC[≈, ≈]. For example, we have seen that with a reflexive disequality constraint, one can express key constraints on XML documents.

Lemma 2.17 Let Σ = {0 : 0, s : 1, f : 2}. The set L of terms of T (Σ) of the form f (s n 1 (0), . . . , f (s n k (0), 0)), such that k ≥ 0 and the integers n i , for i ≤ k, are pairwise distinct, is recognized by a TAGC[≈, ≈] with an irreflexive disequality relation, but cannot be recognized by a TAGED.

proof. The following PCTAGC[≈, ≈] recognizes L. {q 0 , q, q f }, Σ,

{q f }, q ≈ q,    0 → q 0 | q | q f , s(q 0 ) → q 0 | q, f (q, q f ) → q f    .
Assume that there exists a PCTAGC[≈, ≈] like in proposition 2.16 A recognizing this language L.

There exists an accepting run r of A on the term t = f (s(0), f (s 2 (0), . . . f (s |Q|+1 (0)))). We have therefore r |= C A (the global constraint of A, which is positive by hypothesis).

There are two different positions p i = 2 i-1 .1 and p j = 2 j-1 .1, 1 ≤ i < j ≤ |Q| + 1 such that r(p i ) = r(p j ). Let us show that r ′ = r[r| p i ] p j is an accepting run of A on t ′ = t[t| p i ] p j . Since r(p i ) = r(p j ) and r is a run of A on t, by replacing t| p j with t| p i and r| p j with r| p i , r ′ is a run of ta(A) on t ′ . Hence we only have to ensure that the constraint C A is fulfilled by r ′ .

For all p, p ′ ∈ Pos(t ′ ) such that 2 j-1 .1 is neither a prefix of p nor of p ′ , and such that p and p ′ are no prefix of 2

j-1 .1, if r ′ (p) ≈ r ′ (p ′ ) is in C 1 (resp. r ′ (p) ≈ r ′ (p ′ ) is in C 1 ), we know that r |= r(p) ≈ r(p ′ ) (resp. r |= r(p) ≈ r(p ′ ))
, so the constraints are respected in t, hence also in t ′ since the positions p and p ′ are referring to common subterms of t and t ′ .

If a position p = 2 j-1 .1.v is involved in some constraint, let p ′ = 2 i-1 .1.v. By construction, we have r ′ | p = r ′ | p ′ and t ′ | p = t ′ | p ′ . Due to this last equality, any constraint involving p is satisfied iff the same constraint with p ′ instead of p also holds. And thanks to the equality r ′ | p = r ′ | p ′ , this other constraint holds and is satisfied by r ′ .

Finally, we have to consider constraints that involve a strict prefix p of 2 j-1 .1. It is clear that every subterm of t at a position 2 ℓ , for 0 ≤ ℓ ≤ |Q|, is unique, so every subterm at such a position can only satisfy a disequality constraint or an equality with itself (in that case r(2 ℓ ) is unique in r). In the latter case, r ′ (p) is also unique in r ′ and the equality is obviously satisfied. In the other case, it is easy to see that it also holds in t ′ that all subterms at positions 2 ℓ , and hence the subterm at position p, are unique, and satisfy all the disequalities. So t ′ is recognized by A but is not in the language L, a contradiction. 2

Tree Automata with Local Constraints

Definition and Known Results

A TA with local equality and disequality constraints is a TA whose transitions can perform local equality and disequality tests on the subterms of the term in input (see e.g. [START_REF] Bogaert | Equality and disequality constraints on direct subterms in tree automata[END_REF][START_REF] Dauchet | Automata for Reduction Properties Solving[END_REF]). Definition 2.18 A tree automaton with local equality and disequality constraints (TAC for short) is a tuple A = Σ, Q, F, ∆ where

• Σ is a signature; • Q is a finite set of states; • F ⊆ Q is a set of final states;
• ∆ is a set of transitions of the form f (q 1 , . . . , q n ) -→ c q where f ∈ Σ n , q 1 , . . . , q n , q ∈ Q, and c is a conjunction of constraints of the form π = π ′ or π = π ′ where π and π ′ are positions (sequences of positive integers).

A run of a TAC on a term t is a function r :

Pos(t) → Q such that for all p ∈ Pos(t) with t(p) = f ∈ Σ n (n ≥ 0), there exists a transition f r(p • 1), . . . , r(p • n) -→ c r(p) ∈ ∆ such that for all constraints π = π ′ (resp. π = π ′ ) in c, we have p • π, p • π ′ ∈ Pos(t) and t| p•π = t| p•π ′ (resp. t| p•π = t| p•π ′ ).
A TAC is called positive (resp negative) if all its transitions contain only equalities (resp. disequalities).

Note that the RTA language of Examples 2.3 and 2.4 are recognizable by positives TAC:

A = {q, q f }, {q f }, {a → q, b → q, f (q, q) → q, f (q, q) ---→ 1=2 q f }
for Example 2.3, and the same extended with the transitions f (q, q f ) → q f , f (q f , q) → q f for Example 2.4. The emptiness problem is undecidable in general [START_REF] Mongy | Transformation de noyaux reconnaissables d'arbres[END_REF] for positive TAC. Two decidable subclasses of TAC have been identified: tree automata with equality and disequality tests between brother positions [START_REF] Bogaert | Equality and disequality constraints on direct subterms in tree automata[END_REF] (TACB), where we have the constraint that for all constraint π = π ′ or π = π ′ , |π| = |π ′ | = 1, and Reduction Automata [START_REF] Dauchet | Automata for Reduction Properties Solving[END_REF] (RA), that we will note define here; the complexity of emptiness is at least EXPTIME for these subclasses.

Comparison with TAGC

We can do an interesting comparison if we limit ourselves to positive conjunctive TAGC The tests of TAC are performed locally, on each application of a transition rules with constraints, while the ones of PC-TAGC are performed globally, on all positions labeled by a state of the domains of ≈ and ≈. Those different approaches lead to two incomparable expressiveness.

There is a good intuition to understand the respective power of those two classes. A TAC can test an unbounded number of "classes" of (dis)equalities (one for each application of a transition rule), but each "class" has a bounded number of element (the size of the constraints). Conversely, a PCTAGC A = Σ, Q, F, ∆, C can test only a bounded number of "classes" of (dis)equalities (the size of the constraint C), but each of these "classes" may test an unbounded number of (dis)equalities (one for each occurrence of a state occurring in C).

Following this intuition it is easy to construct a term language that is recognized by one of these models but not by the other. For the sake of simplicity, we will restrict ourselves to positive TAC with test between brothers one one hand, and to PCTAGC[≈] on the other hand. A good candidate for a language recognized by a TAC but not by a PCTAGC[≈] would need to test equalities between two subterms an unbounded number of times.

Example 2.19 Let Σ = {f : 2, a : 0} and let

L = {t | t ∈ T (Σ), ∀p ∈ Post, t(p) = f ⇒ t| p.1 = t| p.2 }.
The language L is recognized by the positive TACB A = Σ, Q, F, ∆ where

• Q = F = {q} • ∆ = {a → q, f (q, q) ---→ 1=2 q}
′ 2 , p 1 ≤ p ′ 1 < p ′ 2 ≤ p 2 such that r(p ′ 1 ) = r(p ′ 2 ). Let p1 < • • • < pk be all the strict prefixes of p 1 such that for all i, 1 ≤ i ≤ k, r( pi ) is a state involved in an equality test wrt r and C. If k > 0 Let us define inductively tk = t| pk [t| p ′ 2 ] p ′ 1 -pk , rk = r| pk [r| p ′ 2 ] p ′ 1 -pk
and ti and ri the term t| pi and the run t| pi where for each position p such that r( pi .p) = r( pi+1 ) or r( pi .p) = r( pi+1 ), we replace t| pi .p ) by ti+1 and r| pi .p ) by ri+1 . We define t ′ and r ′ as t and r where for each position p such that r(p) = r( p1 ) or r(p) ≈ r( p1 ), we replace t| p by t1 and r| p) by r1 .

If k = 0, that is there is no prefix p ′ of p 1 such that the state occurring at position p ′ in r is involved in an equality test, then we just define t ′ and r' as

t ′ = t[t| ′ p 2 ] p ′ 1 and r ′ = r[r| ′ p 2 ] p ′ 1 .
This pumping preserves the compatibility with ∆, since the initial pumping is done between two positions of occurrences of a same state in r: p ′ 1 and p ′ 2 . This initial pumping does not change equality tests done with states that are at positions p 2 . The equality tests done with states that are occurring above p 1 are ensured to be answered positively by the parallel pumping done at each position where a state involved in such an equality test occurs. Equality tests done only between positions parallel to p 1 are not changed. Proving these statements need an exhaustive case study that we do not do here. However, a very similar approach is used and developed later for the proof of lemma 5.20 in chapter 5. Hence, r ′ satisfies C and is a successful run of B on t ′ .

If k > 0, in the subterm tk , it is clear that the term at position

(p ′ 1 -pk ) = 1 |p ′ 1 |-| pk | is different from the term at position (1) |p ′ 1 |-| pk |-1 .
2, because the first one is a pumping of the second one. Hence at each position p ′ such that t ′ (p ′ ) = tk we have that the constraint of the definition of L that states that all brothers are equals is not respected at position p ′ .1

|p ′ 1 |-| pk |-1 . If k = 0
, the brother condition is not respected at the position 1 |p ′ 1 |-1 . Hence t ′ does not belong to L. 2 Conversely, a good candidate for a language recognized by a PC-TAGC and not recognized by a positive TACB would test a single equality between an unbounded number of subterms. However, the counterexample will not need to make the equality to occur an unbounded number of time, but only to occur at two positions not reachable at the same time by a transition rules testing equality. It is quite easy with TACB since transition rules can only test equalities between brothers, but would need further work to be applied to positive TAC.

Example 2.21 Let Σ = {f : 2, g : 1, a : 0} and let L = {t | t ∈ T (Σ), ∀p 1 , p 2 ∈ Pos(t), t(p 1 ) = g∧t(p 2 ) = g ⇒ t| p 1 = t| p 2 . The language L is recognized by the PCTAGC[≈] A = Σ, Q, F, ∆, C where

• F = Q = {q 1 , q 2 } • ∆ = {a → q 1 , f (q 1 , q 1 ) → q 1 , f (q 1 , q 2 ) → q 1 , f (q 2 , q 1 ) → q 1 , f (q 2 , q 2 ) → q 1 , g(q 1 ) → q 2 } • C = q 2 ≈ q 2
Proposition 2.22 The language of the example 2.21 is not recognizable by a positive TACB.

proof. Let B = Σ, Q, F, ∆ be a TACB such that for all t ∈ L, B recognizes t. Let us define t i recursively as follow: t 0 = f (0, 0) and

t i = f (0, t i-1 ). Let t = f (g(t |Q|+1 ), f (0, g(t |Q|+1
))), and let r be a run of B accepting t. It is clear that only two transition rules testing equalities may have been used in r: one at each occurrence of t 0 . Let p = 1.1. For all i, 0 ≤ i ≤ |Q|, let us denote p i = p.2 i . We have that t p i = t |Q|+1-i . By the pigeon hole principle, there exist i, j, 0 ≤ i < j ≤ |Q| such that r(p i ) = r(p j ). Let t ′ = t[p j ] p i , and r ′ = r[p j ] p i . Since equalities may only have been tested on the two occurrences of t 0 in t, and that one is below, p j and p i , and the other one is at a parallel position, r ′ is still compatible with ∆. Hence r ′ is a successful run of B on t ′ , and since t ′ ∈ L, L(B) = L. 2

Tree Automata with One Memory

Definitions and Known Properties

Like pushdown tree automata [START_REF] Guessarian | Pushdown tree automata[END_REF], TA with one memory (TA1M) [START_REF] Comon | Tree automata with one memory, set constraints and cryptographic protocols[END_REF][START_REF] Hubert Comon-Lundh | Tree automata with memory, visibility and structural constraints[END_REF] are TA extended in order to carry an unbounded amount of information along the states in computations. Instead of a stack, a TA1M stores this information in a memory with a tree structure. More precisely, this memory contains a ground term over a memory signature Γ. The memory is updated during the bottom-up computations. The general form of the transitions of TA1M is

f q 1 (m 1 ), . . . , q n (m n ) → q(m)
where f ∈ Σ n , q 1 , . . . , q n , q are states with an argument carrying the memories m 1 , . . . , m n , m ∈ T (Γ, X ). The new current memory m is built from the memories m 1 , . . . , m n which have been reached at the positions immediately below the current position of computation. For instance, in the following push transition, the new current memory m is built by pushing a symbol h ∈ Γ n at the top of memories m 1 , . . . , m n (which are variables x 1 , . . . , x n in this case):

f q 1 (x 1 ), . . . , q n (x n ) → q h(x 1 , . . . , x n ) .

(push)

In a pop transition, the new current memory is a subterm of one of the memories reached so far:

f q 1 (x 1 ), . . . , q i (h(y 1 , . . . , y k )), . . . , q n (x n ) → q(y j ) (pop)

The top symbol h of m i is also read in the above pop transition. In an internal transition, the new current memory is one of the memories reached:

f q 1 (x 1 ), . . . , q n (x n ) → q(x i ) (internal) with 1 ≤ i ≤ n.
Moreover, TA1M can perform equality tests on the memory contents, with transitions like

f q 1 (x 1 ), . . . , q n (x n ) ----→ x i =x j q(x k ) (internal = )
where 1 ≤ i, j, k ≤ n.

Comparison with TAGC

The internal = transition rules make possible the simulation of some tests of the TA with constraints by storing some subterms in memory and comparing them. It even is possible to test an equality an unbounded number of time.

Proposition 2.23 The language of terms of the example 2.21 is recognized by the TA1M A = Σ, Q, F, ∆ where

• Q = F = {q 1 , q 2 , q 3 } • ∆ = {a-> q 1 (a), g(q 1 (x)) → q 2 (g(x)), f (q 1 (x 1 ), q 1 (x 2 )) → q 1 (f (x 1 , x 2 )), f (q 1 (x 1 ), q 2 (x 2 )) → q 3 (x 2 ), f (q 2 (x 1 ), q 1 (x 2 )) → q 3 (x 1 ), f (q 2 (x 1 ), q 2 (x 2 )) ----→ x 1 =x 2 q 3 (x 1 ), f (q 2 (x 1 ), q 3 (x 2 )) ----→ x 1 =x 2 q 3 (x 1 ), f (q 3 (x 1 ), q 2 (x 2 )) ----→ x 1 =x 2 q 3 (x 1 ), f (q 3 (x 1 ), q 3 (x 2 )) ----→ x 1 =x 2 q 3 (x 1 )}
However, since those automata can only store one memory at a time, it has a limitation in the equality tests it can perform. It can easily deal with a bounded number of equality "classes", if all the equal terms of different "classes" appear in distinct parallel subterms: in each of these parallel subterm, the run of the automaton only have to memorize one subterm. But if is not the case, the memory cannot be used to test several "classes" of equalities in full generality. Especially, in a term t, it generally cannot test at the same time that subterms at several positions are equals to a subterm t ′ , and that subterms at other positions are equals to a subterm t ′′ of t ′ . However, since some encoding can be made by an involved use of both the states and the memory alphabet, it seems that proving this fact would be difficult. Also, we only state this as a conjecture.

Example 2.24 Let Σ = {f : 2, g : 1, s : 1, a : 0} and let

L = {f (g n (s m (a)), f (s m (a), g n (s m (a)))) | n, m ∈ N * }. The language L is recognized by the PCTAGC[≈] A = Σ, Q, F, ∆, C where • Q = {q 1 , q 2 , q 3 , q 4 , q 5 , q f }, F = {q f };
• ∆ = {a → q 1 , s(q 1 ) → q 1 , s(q 1 ) → q 2 , g(q 2 ) → q 3 , g(q 3 ) → q 3 , g(q 3 ) → q 4 , f (q 2 , q 4 ) → q 5 , f (q 4 , q 5 ) → q f };

• C = (q 2 ≈ q 2 ) ∧ (q 4 ≈ q 4 ).

Conjecture 2.25 The language of the example 2.24 is not recognizable by a TA1M.

Automata on DAG Representations of Terms

Definitions and Known Results

One way to test equalities or disequalities in subterms, is to use a DAG representation of terms and to ensure the maximal sharing properties. Hence instead of computing on terms, the automata will then compute on their DAG representations (called t-dags). Charatonik ([Cha99]) introduced the t-dag automata.

Definition 2.26 A t-dag automaton is a tuple Σ, Q, F, ∆ where Σ is a finite signature, Q is a finite set of states, F ⊆ Q is the set of final
states, and ∆ is a set of transitions of the form f (q1, . . . , qn) → q with q, q1, . . . , qn ∈ Q and f ∈ Σ n .

Note that up till now there is no difference between t-dag automata and standard bottom-up tree automata. A t-dag can be determinist (resp. complete) the same way as a TA (existence of at most (resp. at least) one transition rule for every f ∈ Σ n and every sequence q 1 , . . . q)n). The difference is that t-dag automata run on t-dags and not terms.

Definition 2.27 A run of a t-dag automaton Σ, Q, F, ∆ on a given t-dag G = V, succ, λ on Σ is a mapping r from the set of nodes V to the set of states Q such that for each node v and each f ∈ Σ, if λ(v) = f , then ∆ contains a transition f (r(succ(1, v)), . . . , r(succ(n, v)) → r(v).
A run r is said successful if it maps the root of G to a final state. We say that the t-dag automaton A accepts the t-dag G, if there is a successful run of A on G.

A set of t-dags T is recognizable if there exists a t-dag automaton A such that T = {G | A accepts G}. We denote L(A) the set of t-dags recognized by A

The classical TA constructions for recognizing the union or the intersection of two recognizable sets also work for t-dag automata as shown in [START_REF] Charatonik | Automata on dag representations of finite trees[END_REF]. However, the complementation does not work, since the determinization procedure does not create an equivalent t-dag automaton, in the sense that the determinized t-dag automaton does not necessarily recognized the same set of t-dags. In [START_REF] Siva Anantharaman | Closure properties and decision problems of dag automata[END_REF], a formal proof that t-dag automata are not determinizable is given.

If we consider the sets of terms terms(L(A)) represented by the tdags recognized by some t-dag automaton, we can compare expressiveness of t-dag automata and TA. A recognizable set of terms L can be described by a t-dag automaton: take a deterministic TA A recognizing L, and L as a t-dag automaton will recognize dag(L).

The reverse is not true: the description of a recognizable set of tdags, whose represented terms is not a regular term language is given in [START_REF] Siva Anantharaman | Closure properties and decision problems of dag automata[END_REF]. Hence, t-dag automata are more expressive than TA.

Comparison with TAGC

The t-dag structure seems to allow to test equalities and disequalities, since equal terms will necessarily have a same state in the run of a t-dag automaton. In particular, to operate a disequality test between two subterms, you only have to ensure that they will be labeled by two different states in the run.

Example 2.28 Let Σ = {f : 2; a : 0}, and

L = {f (t, t ′ ) | t, t ′ ∈ T (Σ), t = t ′ }. Then the following t-dag automaton A recognizes a lan- guage of t-dags L ′ such that term(L ′ ) = L. A = Σ, Q, F, ∆ where • Q = {q 1 , q 2 , q f } • F = {q f } • ∆ contains the following transition rules -a → q 1 , a → q 2 -f (q 1 , q 1 ) → q 1 , f (q 1 , q 1 ) → q 2 -f (q 1 , q 2 ) → q f
Actually, we will show in chapter 4 that the t-dag automata seen as term language recognizers are equivalent to PCTAGC[ ≈] where ≈ is irreflexive.

However, ensuring that two subterms have the same state labeling in a run does not mean they are represented by the same node of the t-dag. Since you cannot force the successors of a node to be equals, you cannot test equalities with a t-dag automaton Lemma 2.29 Let Σ = {f : 2; a : 0}, and L = {f (t, t) | t}. There exists a PCTAGC[≈] recognizing L but there is no recognizable t-dag language

L ′ such that term(L ′ ) = L proof. The term language L is recognized by the PCTAGC[≈] A = Σ, Q, F, ∆, C where • Q = {q 1 , q 2 , q f } • F = {q f } • ∆ contains the following transition rules -a → q 1 , a → q 2 -f (q 1 , q 1 ) → q 1 , f (q 1 , q 1 ) → q 2 -f (q 2 , q 2 ) → q f • C = {q 2 ≈ q 2 }
Briefly, any term of T (Σ) can be recognized by A in the state q 2 : it suffices to label the root by q2 and the other positions by q 1 . excepand non-deterministically choose to stop and to label the root by q 2 . Hence, the transition rule f (q 2 , q 2 ) → ensures that A recognizes the terms f (t 1 , t 2 ) where t 1 , t 2 can be any term of T (Σ), and the constraint q 2 ≈ q 2 forces that t 1 and t 2 are always equals.

Assume A is a t-dag automaton, with a set of states Q, that recognizes the t-dag language L ′ . Let t ∈ T (Σ) be a balanced term of height greater than |Q|, and G = dag(t). Let r be an accepting run of A on dag(f (t, t)). Since a same term can occur only once in a dag, then r(1) = r(2) = r(t). Let q = r(t), then there exists a final state q f in Q such that the transition rule f (q, q) → q f belongs to A. Since t is of height greater than |Q|, there is a path on which there are two different nodes u and v in G such that r(u) = r(v). Let q ′ = r(u), and let p 1 and p 2 be two positions of

G such that G(p 1 ) = u and G(p 2 ) = v. Assume wlog that p 1 < p 2 . Then, let t ′ = t[t| p 2 ] p 1 .
If p 1 = ε, then dag(f (t, t ′ )) and dag(f (t, t)) have the same sets of vertices. The only difference is that the second child of the root is v instead of u. Since r(v) = r(u), by keeping the same labeling of nodes as in r, we have an accepting run of A on dag(f (t, t ′ )).

If p 1 = ε, then let G ′ = dag(t ′ ). Then G ′ and G have the same set of vertices. The only difference is that all the edges oriented to u in G are oriented to V in G ′ . Hence, the run r ′ of A on G ′ by r ′ (u) = r(u) respects the transition rules of A and labels the root of G ′ by g. Let G ′′ = dag(f (t, t ′ ). All the subterms of t ′ at positions p ′ < p 1 are not balanced and hence are not subterms of t. Hence the nodes of G ′′ at positions 1.p ′ and 2.p ′ are distinct. All the subterms of t ′ at positions p ′ = p1.p ′′ or at positions p ′ incomparable with p 1 are also subterms of t at the same positions. Hence there is a unique node of G ′′ at both positions 1.p ′ and 2.p ′ . So the the run r ′′ defined as r ′′ (ε) = q f , r ′′ (1.p) = r(1.p) and r ′′ (2.p) = r ′ (p) is a well-defined run of A on G ′′ , i.e. each node of G ′′ is labeled by a single state. Hence A recognizes dag(f (t, t ′ ) which is not in L ′ . 2

Automatic Clauses

This latter comparison is a bit more informal as the previous ones.

We compare here a subclass of PCTAGC[≈] with a non-automata formalism: finite sets of Horn clauses with rigid variables [START_REF] Peter | Theorem proving via general matings[END_REF]. This formalism was used in several related works [START_REF] Delaune | Protocol verification via rigid/flexible resolution[END_REF][START_REF] Affeldt | Verification of security protocols with a bounded number of sessions based on resolution for rigid variables[END_REF]. These papers do not mention the name of tree automata, they are targeted at the static analysis of security protocols. In chapter 3, we will apply tree automata with global equality constraints to the same application. Therefore, a comparison with this formalism is appropriate.

Definitions and Known Results

We do not recall here the definition of Horn clauses. For an introduction on Horn clauses, see e.g. [Pad88]. Following [START_REF] Frühwirth | Logic programs as types for logic programs[END_REF], it is a common approach to represent tree automata by Horn clause sets. A tree automata transition f (q 1 , . . . , q n ) → q can indeed be encoded into the following first order Horn clause (variables are implicitly universally quantified)

q 1 (y 1 ), . . . , q n (y n ) ⇒ q f (y 1 , . . . , y n ) (reg)
where y 1 ,. . . ,y n are distinct variables and q 1 , . . . , q n , q are unary predicate symbols. Let us call regular clauses the Horn clauses of the above form. Given a finite set C of regular clauses (an automaton in these settings) and a predicate q (a state), the language of C in q, denoted by L(C, q), is the set of terms t ∈ T (Σ) such that q(t) is a logical consequence of C (q(t) is in the smallest Herbrand model of C). This definition corresponds exactly to the language of the TA whose transition are encoded by the clauses of C. One advantage of this presentation of tree automata by Horn clause sets is that it permits to use classical first-order theorem proving techniques in order to decide TA problems. For instance, if C is a finite set of regular clauses, t ∈ T (Σ) then t ∈ L(C, q) iff C ∪ {q(t) ⇒} is inconsistent, and L(C, q) = ∅ iff C ∪ {q(x) ⇒} is inconsistent. These sets can be finitely saturated by a resolution calculus with appropriate strategies [START_REF] Goubault-Larrecq | Deciding H 1 by Resolution[END_REF], hence, the above decision problems can be solved using first order theorem provers.

Comparison with TAGC

This approach can also be suitable for studying Rigid Tree Automata. We recall that we define Rigid Tree Automata (definition 3.1) as PCTAGC [≈] where ≈ is the identity relation on a subset of the set of states, and that it has been shown to be equally expressive to the full class of PCTAGC[≈] in [START_REF] Filiot | Tree automata with global constraints[END_REF]. We can fit the same presentation of tree automata by Horn clause sets as above for RTA, by distinguishing, in regular clauses, some variables as so called rigid variables [START_REF] Peter | Theorem proving via general matings[END_REF]. We use below uppercase letters X, Y... for rigid variables and lowercase x, y... for other variables, called flexible variables. Recently [DLL07, ACL09], some models of Horn clauses with rigid variables (including regular clauses) have been studied in the context of the verification of security protocols. We recall the definitions and results of [START_REF] Affeldt | Verification of security protocols with a bounded number of sessions based on resolution for rigid variables[END_REF] in order to establish connections with RTA.

A set C of clauses with rigid variables X 1 , . . . , X n and flexible variables y 1 , . . . , y m is satisfiable if there exists a Σ-algebra A such that for all valuation σ : {X 1 , . . . , X n } → A, there exists a model S with domain A such that S, σ |= ∀y 1 , . . . , y m C. It is equivalent to say that for all valuation σ : {X 1 , . . . , X n } → T (Σ), there exists an Herbrand model L such that L |= ∀y 1 , . . . , y m σ(C).

This semantics permits to redefine the languages of RTA in term of models of regular clauses with rigid variables. Let us consider an RTA A = Q, R, F, ∆ and let us associate a rigid variable X q to each q ∈ R. We associate to A the set C of regular clauses with rigid variables

q 1 (α 1 ), . . . , q n (α n ) ⇒ q f (α 1 , . . . , α n ) (reg')
such that f (q 1 , . . . , q n ) → q ∈ ∆ and for all i ≤ n, α i = X q i if q i ∈ R and α i is a flexible variable y i otherwise. Then, we have (X = {X q | q ∈ R})

σ:X→T (Σ) L σ(C), q = L(A, q).
In [START_REF] Affeldt | Verification of security protocols with a bounded number of sessions based on resolution for rigid variables[END_REF], a translation of clauses with rigid variables into first order clauses (without rigid variables) preserving satisfiability is proposed. In the case of the above regular clause with rigid variables (reg'), the translation returns

q 1 (x, α ′ 1 ), . . . , q n (x, α ′ n ) ⇒ q x, f (α ′ 1 , . . . , α ′ n )
where x = (x q ) q∈R is a sequence of |R| flexible variables, one variable x q for each rigid state q ∈ R (hence one for each rigid variable X q ). Every variable

α ′ i , i ≤ n, is either x q i if α i is the rigid variable X q i (i.e. if q i ∈ R) and α ′ i is the (flexible) variable α i = y i otherwise.
Such clauses can alternatively be seen as transitions of tree automata extended with |R| auxiliary registers storing terms of T (Σ). For such an automaton, the values are stored in the registers once and for all at the beginning of the computation (in the variables of x) and during the application of a transition, the current subterm can be compared to the content of one register (in the case where α ′ i = y i ). It is shown in [START_REF] Affeldt | Verification of security protocols with a bounded number of sessions based on resolution for rigid variables[END_REF] that binary resolution with an appropriate ordered strategy terminates on such clauses as long as there is only one unary predicate; [ACL09] consider also other kinds of clauses, some of them that can be seen as a generalization of RTA to two way and alternating rigid tree automata.

Hence, in the result of [START_REF] Affeldt | Verification of security protocols with a bounded number of sessions based on resolution for rigid variables[END_REF], termination is limited to automata with one state. The resolution strategy of [START_REF] Affeldt | Verification of security protocols with a bounded number of sessions based on resolution for rigid variables[END_REF] does not terminate on automata with more than one state and a terminating resolution strategy for this case is not known. Some progress in this direction would enable the application of first order theorem proving techniques to decision problem for RTA. This could permit in particular to consider extensions of RTA with e.g. equational tests or language modulo equational theories, like what was done in [JRV08] for standard tree automata using a Horn clauses approach and a paramodulation calculus. In particular, the latter extension (modulo equational theories) is related to the problem of Section 4.3 of chapter 3, and in this context, first order theorem proving tools could provide an efficient alternative to the complicated decision algorithm described this section.

Chapter 3

Rigid Tree Automata and Rewrite Closure

As presented in previous chapter, given a TAGED, one can always compute an equivalent TAGED such that the equality relation is the identity relation on a subset of the states of the automaton. We defined the class of Rigid Tree Automata (RTA), that we first introduced in [JKV09], as the class of positive TAGED, where this property is respected. The additional constraint on the equality relation allows to have decision procedure with lower complexities. In particular, the emptiness problem is shown decidable in linear time for RTA whereas membership of a given tree to the language of a given RTA is NP-complete. On the other side, positive TAGED give a more succinct way to represent equivalent languages. In this chapter, the applications that we aim may be intuitively modelized into some RTA. We will try as much as possible to keep the RTA property when operating transformations on our automata, in order to keep a complexity as low as possible.

Properties like determinism, pumping lemma, Boolean closure, and several decision problems are studied in detail.

Term rewriting systems (TRS) is a general formalism for the symbolic evaluation of terms by replacement of some patterns by others, following rewrite rules. Combining tree automata and term rewriting techniques has been very successful in verification see e.g. [START_REF] Bouajjani | On computing reachability sets of process rewrite systems[END_REF][START_REF] Genet | Rewriting for Cryptographic Protocol Verification[END_REF]. In this context, term rewriting systems (TRS) can describe the transitions of a system, the evaluation of a program [START_REF] Bouajjani | On computing reachability sets of process rewrite systems[END_REF], the specification of operators used to build protocol messages [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF] or also transformation of documents. If a TA A is used to finitely represent an infinite set L(A) of states of a system, the rewrite closure R * L(A) of the language L(A) using R represents the set of states reachable from states described by A. When R * L(A) is again a TA language, the verification of a safety property amounts to checking for the existence of an error state in R * L(A) (either a given term t or a term in a given regular language). This technique, sometimes referred as regular tree model checking, has driven a lot of attention to the rewrite closure of tree automata languages. However, there has been very few studies of this issue for constrained TA (see e.g. [JRV08]). The reason is the difficulty to capture the behavior of constraints after the application of rewrite rules.

In Section 4, we show that it is decidable whether a given term t belongs to the rewrite closure of a given RTA language for a restricted class of linear TRS called invisibly pushdown, whereas this closure is generally not an RTA language. Linear and invisibly pushdown TRS can typically specify cryptographic operators like decrypt(encrypt(x, pk(A)), sk(A)) → x. A potential application of RTA to the verification of security protocola is described in Section 5. Using RTA instead of positive TAGED is at the same time more intuitive in the field of protocol verification, where we want terms built by the same rules to be equals, and simpler to handle with rewrite systems. It is an original use of tree automata with global constraints, wince they were at first introduced in the field of databases and semi-structured document verifications.

RTA: Definition, Examples and Properties

Definition

We mentioned in section 2.1 of chapter 2 Rigid Tree Automata as being positive TAGED (i.e. PCTAGC[≈]) where the equality relation ≈ is the identity relation on a subset of the set of states.

Definition 3.1 A Rigid Tree Automaton (RTA for short) is a positive TAGED A = Σ, Q, F, ∆, ≈ A such that ≈ A ⊆ id Q . A state q of A is said rigid if q ∈ dom(≈ A ).
We denote R = dom(≈ A ) and we call it the set of rigid states of A.

We may latter define an RTA the following way: A = Σ, Q, F, R, ∆ , where R is the set of rigid states, i.e. ≈ A is implicitely defined as the identity relation on R ⊆ Q.

Examples

The PCTAGC[≈] given in example 2.3 and in proposition 2.5 are actually rigid tree automata. Hence we have a first idea of what RTA can do, i.e. testing local equalities, or recognizing terms embedding a nonlinear pattern-matching. However, it is also possible to test equalities between subterms at arbitrary position in a term.

Example 3.2 Let Σ = {a : 0, g : 1, f : 2}. The set of terms t ∈ T (Σ) such that s 1 = s 2 for every two subterms g(s 1 ), g(s 2 ) of t is recognizable by the following RTA: A = {q, q r }, {q r }, {q, q r }, a → q, g(q ′ ) → q r , f (q ′ , q ′ ) → q | q ′ ∈ {q, q r } .

3

RTA are not limited to testing equalities. Using rigid states also permits to test some disequality and inequality as well, like the subterm relation.

Example 3.3 Let Σ = {a : 0, b : 0, f : 2, < : 2}. The set of terms <(s, t) such that s, t ∈ T Σ \ {<} and s is a strict subterm of t is recognized by the following RTA on Σ, {q, q r , q ′ , q f }, {q r }, {q f }, ∆ , with

∆ =    a → q|q r , b → q|q r , f (q, q) → q|q r , f (q, q r ) → q ′ , f (q r , q) → q ′ , f (q, q ′ ) → q ′ , f (q ′ , q) → q ′ , <(q r , q ′ ) → q f    .
For instance, a successful run on < a, f (a, b) is q f q r , q ′ (q r , q) . The idea is that in a successful run, the rigid state q r identifies (by a nondeterministic choice) the subterm s on the left side of <, and, on the right side t of <, the state q ′ is reached immediately above q r and propagated up to the root, in order to ensure that t is a superterm of s. 3

The RTA can also test disequalities between subterms built only with unary and constant symbols.

Example 3.4 Let Σ = {c : 0, a : 1, b : 1, = : 2}. The set of terms of T (Σ) of the form =(s, t), where s, t ∈ T Σ \ { =} and s is distinct from t is recognized by the following RTA on Σ, {q, q r , q a , q b , q f }, {q r }, {q f }, ∆ , with

∆ = {c → q|q r , a(q) → q|q r , b(q) → q|q r , a(q r ) → q a , b(q r ) → q b } ∪ a(q x ) → q x , b(q x ) → q x | q x ∈ {q a , q b } ∪ =(q 1 , q 2 ) → q f | q 1 , q 2 ∈ {q a , q b , q r }, q 1 = q 2 .
A successful run on = a(a(c)), b(a(c)) is q f q a (q r (q)), q b (q r (q)) . The rigid state q r will be placed at the position of the largest common postfix of s and t and q a or q b are used to memorize the letters immediately above this position, in order to check that s and t differ when reaching the top symbol = in =(s, t). 3

The construction of Example 3.3 cannot be generalized to the characterization of a maximal subterm amongst some subterms. This is shown in the following counter example, using a pumping argument.

Example 3.5 Let Σ = {0: 0, g : 1, h: 2}, and let L max be the set of terms of the form H g m (0), g n 1 (0), . . . , g n k (0) where k is an arbitrary positive integer, m ≥ n 1 , . . . , n k , H is an k + 1-context made of the symbol h only, and g n represents n nested symbols g. Fact 3.6 L max is not an RTA language.

proof. Assume that L max is recognized by an RTA A with n states and d rigid states. We can assume wlog that d < n. Let t ∈ L max be of the form H[t 0 , . . . , t d+1 ] where for each 0

≤ i ≤ d + 1, t i = g (d+2-i)(n+1) (0).
Let r be a run of A on t. We show, by a pumping argument, that for one i ≥ 1, we can increase as much as we want the number of g's in t i , while keeping the term recognized by A (a contradiction).

First, note that the t i 's are pairwise distinct. It follows that there are no rigid states in r at the positions of the symbols h in t, except rigid states which occur only once in r (such rigid states are not affected by a modification of some t i ). Second, a rigid state of A cannot occur twice in some t i . By a pigeonhole principle, it follows that there exists some i > 0 such that the n + 1 smaller (wrt prefix ordering) positions of t i are not labelled by a rigid state in r. Hence, there exists one nonrigid state of A labelling two of these n + 1 positions. Let k be the distance between these two positions. For all j ≥ 0, we can build from r a successful run of A on t ′ j := H[t 0 , . . . , t i-1 , g jk (t i ), t i+1 , . . . , t d+1 ]. But for a j sufficiently large, t ′ j / ∈ L max , a contradiction. 2

Pumping Lemma

Following some ideas developed in the proof of Fact 3.6 above, we propose a weak form, adapted to RTA, of the pumping (or iteration) lemma for TA. Pumping on runs of RTA is not as easy as for standard TA. Indeed, we must take care of the position of rigid states in order to preserve recognizability. For this reason, the transformation of a subterm must be performed in several branches in parallel (instead of one single branch for TA) in order to preserve the rigidity condition. Moreover, we cannot repeat a term containing a rigid state, because the same rigid state cannot label two different positions on the same branch. ] and for all n ≥ 0,

C C ′ [D n [u]], . . . , C ′ [D n [u]] ∈ L(A).
proof. Let t ∈ L(A) be such that d (t) > (|Q| + 1)|R|, let r be a successful run of A on t, and let p be a position in Pos(t) of length at least (|Q| + 1)|R|.

With the rigidity condition in the definition of successful runs, a rigid state can occur at most once on a path of r. Hence, there exist two positions p 0 < p ′ 0 < p such that |p ′ 0 | -|p 0 | > |Q| and no rigid state occurs between p 0 and p ′ 0 in r. By a pigeon-hole principle, there exist two positions p 1 , p 2 with p 0 ≤ p 1 < p 2 ≤ p ′ 0 labeled with the same state of Q \ R in r. We let u := t| p 2 and D = (t| p 1 )[x 1 ] p 2 -p 1 . This situation is depicted in Figure 3.1.

In order to preserve the property of being a run while iterating D, we need to take care of rigid states above p 0 in r (rigid states below p ′ 0 and below D are not affected by iteration of D). Let π 1 be the maximal position of a rigid state in r smaller than p 0 wrt the prefix ordering. Let q r = r(π 1 ) and let π 2 , . . . , π k be the other positions of q r in r. Note that by definition of r being a run the positions π 1 , . . . , π k are pairwise incomparable wrt the prefix ordering. We let

C = t[x 1 ] π 1 . . . [x k ] π k and C ′ = (t| π 1 )[x 1 ] p 1 -π 1 (x 1 , . . . , x k are distinct variables). C π 1 C ′ p 1 D p 2 u π 2 . . .
C C ′ [D n [u]], . . . , C ′ [D n [u]] ∈ L(A).
2 As usual, such a lemma can be used to show that a language is not in RTA.

Example 3.8 As a consequence of the above pumping lemma, we can show that the set B of balanced binary trees built over the signature {a : 0, f : 2} is not an RTA language. Assume indeed that it is recognized by an RTA A = Q, R, F, ∆ and let t ∈ L(A) such that d (t) > (|Q| + 1)|R| and C, C ′ , D, u be as in Lemma 3.7. By hypothesis,

C ′ [D[u]] is balanced, but for any n > 1, C ′ [D n [u]] is not balanced since C ′ and D are not trivial. It contradicts the fact that C C ′ [D n [u]], . . . , C ′ [D n [u]] ∈ L(A)
by Lemma 3.7. 3

Boolean Closure

We show below that the class of RTA languages is closed under union and intersection but not under complement. These are not new results, since they use the same proofs as the ones already done for TAGED (see [START_REF] Filiot | Tree automata with global constraints[END_REF]). However, we give here a lower bound for intersection, and an effective example of a RTA language whose complement is not a RTA language.

Theorem 3.9 Given two RTA A 1 and A 2 , there exist two RTA of respective sizes

O(|A 1 | + |A 2 |) and O(2 |A 1 ||A 2 |
), constructed respectively in polynomial and exponential time, and recognizing respectively For L(A 1 ) ∩ L(A 2 ), it is easy to construct a positive TAGED A ′ recognizing L(A 1 ) ∩ L(A 2 ) by a Cartesian product operation like for standard TA.

L(A 1 ) ∪ L(A 2 ) and L(A 1 ) ∩ L(A 2 ). proof. Let A i = Q i , R i , F i , ∆ i with i = 1, 2. For L(A 1 ) ∪ L(A 2 ),
We can use Lemma 1 of [START_REF] Filiot | Tree automata with global constraints[END_REF] in order to transform this positive TAGED into an RTA recognizing the same language, at the price of an exponential blowup. Combining the two above steps results in an exponential construction for the intersection of RTA.

2 The following lemma shows that the exponential time complexity for the construction of the intersection automaton in Theorem 3.9 is a lower bound, with a reduction of the EXPTIME-complete problem of the non-emptiness of the intersection of n TA.

Lemma 3.10 Given n TA A 1 , . . . , A n on Σ, we can compute in polynomial time two RTA A × and A r , both of size

O |A 1 | + . . . + |A n | , and such that L(A 1 ) ∩ . . . ∩ L(A n ) = ∅ iff L(A × ) ∩ L(A r ) = ∅. proof. Let Σ d = Σ⊎{0:0, d:2}. Both the RTA constructed will compute on Σ d . Let A r = {q, q r , q f }, {q r }, {q f }, {0 → q f , d(q r , q f ) → q f }∪{f (q, . . . , q) → q|q r | f ∈ Σ} . It recognizes the set of terms of the form d(t, d(t, . . . d(t, 0))) with t ∈ T (Σ). Let A i = Q i , R i , F i , ∆ i for all 1 ≤ i ≤ n.
We assume wlog that Q 1 , . . . , Q n are disjoint and that for each i ≤ n, F i = {q i }.

Let

A × = n i=1 Q i ⊎ {q 0 , q ′ 1 , . . . , q ′ n }, n i=1 R i , {q ′ 1 }, ∆ × , with ∆ × = n i=1 ∆ i ⊎ {0 → q 0 , d(q n , q 0 ) → q ′ n } ∪ n-1 i=1 d(q i , q ′ i+1 ) → q ′ i .
This RTA A × recognizes the set of right combs of the form

d(t 1 , . . . d(t n , 0))) with t i ∈ L(A i ) for all i ≤ n. Hence L(A × ) ∩ L(A r ) is exactly the set of right combs d(t 1 , . . . d(t n , 0))) such that t i ∈ L(A i )
for all i ≤ n and t 1 = . . . = t n . Therefore, this intersection is empty iff

L(A 1 ) ∩ . . . ∩ L(A n ) is empty as well.
2 Note that the above construction also works (hence Lemma 3.10 also holds) for n given RTA. With Lemma 3.10, we have a polynomial time reduction into the non-emptiness of the intersection of two RTA of the problem of the intersection non-emptiness for n TA (given n TA A 1 , . . . , A n , do we have L(A 1 ) ∩ . . . ∩ L(A n ) = ∅?), a problem which is known to be EXPTIME-complete [START_REF] Seidl | Haskell overloading is dexptime-complete[END_REF]. Since by Theorem 3.9, the intersection of two RTA is an RTA, and the emptiness of RTA can be decided in linear time (Theorem 3.19 below), we conclude that EXP-TIME is a lower bound for the construction of an RTA for the intersection. Moreover, in the above construction, A × is a TA if every A i (1 ≤ i ≤ n) is a TA. Hence the intersection of an RTA with a TA also leads to an exponential construction.

Deterministic and Visibly Rigid Tree Automata

Non-determinism is crucial for an RTA recognizing the terms of the form f (t, t) like in Example 2.3. Indeed, in a bottom-up computation, such an automaton needs to guess both positions of the two occurrences of t under the symbol f , and put one rigid state at these positions.

Example 3.11 Let us come back to Example 2.3, where Σ = {a : 0, b : 0, f :2} and the RTA A with transition set {a → q|q r , b → q|q r , f (q, q) → q|q r , f (q r , q r ) → q f } recognizing {f (t, t) | t ∈ T (Σ)}. Applying a classical subset construction to the transition set of A returns a deterministic set of transitions a → {q, q r }, b → {q, q r }, f {q, q r }, {q, q r } → {q, q r , q f }, f {q, q r , q f }, {q, q r , q f } → {q, q r , q f } .

However, it is not possible to choose a subset of rigid states amongst the two states obtained, in order to recognize the above language. 3

In this section, we will study the expressiveness of deterministic RTA. We will show that they are strictly less expressive than RTA, but still more expressive than standard TA. Hence RTA cannot be determinized, and moreover, determinism is not sufficient here to provide the closure by complementation. Therefore, we will define a subclass of RTA, inspired by a previous work on tree automata with memory [START_REF] Hubert Comon-Lundh | Tree automata with memory, visibility and structural constraints[END_REF], that can be determinized, but which is still not closed under complementation.

Determinism and Completeness

Definition 3.12 A deterministic rigid tree automaton (DRTA) on a signature Σ is an RTA A whose underlying TA ta(A) is deterministic.

It is well-known that DTA are as expressive as TA, and that every TA can effectively be determinized, at the price of an exponential blowup. We show below that it is not the case for RTA: the class of DRTA languages is strictly included in the class of RTA languages. We show now that L is not recognized by a DRTA. Assume that there is a DRTA A = Q, R, F, ∆ recognizing L. For every term t such that there exists a run r of A on t, and for every path p ∈ Pos(t) from the root to a leaf, let us denote

|p| R = |{p ′ | p ′ ≤ p, r(p ′ ) ∈ R}|, t ′ = t ′ 0 p ′ 1 t ′ 1 p ′ 2 t ′ 2 p ′ t t ′′ = t ′ 0 p ′ 1 t ′ 2 t Figure 3.2: Proof that DRTA RTA
the number of rigid states occurring on the path p. Then let us denote |t| R the maximal |p| R among all the paths p from the root to a leaf of t. Then, we define max R = max t∈L(A) |t| R .

Since each rigid state can only appear once on a path, otherwise it would not respect the rigid condition, there is at most |R| occurrences of rigid states on every path. Hence max R is well-defined and is lower or equals to |R| Given Let t be a term recognized by A such that |t| R = max R . Let r be the unique run of A on t, and p be a path of t from the root to a leaf such that |p| R = max R .

We build a tree t ′ such that there exists a position

p ′ ∈ Pos(t ′ ), |p ′ | > |Q| -|R| and t ′ | p ′ = t. Since f (t ′ , t ′
) is recognized by A, there exists a (unique) run r ′ on t ′ . Since A is deterministic, we know that r ′ | p ′ = r. Hence there exists a path in r ′ from the position p ′ to a leaf that contains the maximal number of rigid states. So for each strict prefix

p ′ 0 of p ′ , r ′ (p ′ 0 ) ∈ Q \ R. Since |p ′ | > |Q| -|R|, there exists two strict prefixes p ′ 1 , p ′ 2 of p ′ , such that p ′ 1 is a strict prefix of p ′ 2 and r ′ (p ′ 1 ) = r ′ (p ′ 2 ). Let t ′′ be the tree t ′ [t ′ p ′ 2 ] p ′ 1 . This construction is illustrated in Figure 3.2. Then r ′′ = r ′ [r ′ p ′ 2 ] p ′
1 is a valid run of A on t ′′ : no rigid states occur between the root and p ′ 1 , and between p ′ 1 and p ′ 2 , so a position p ′ 3 of an occurrence of a rigid state was either • a position incomparable (wrt prefix ordering) with p ′ 1 , which still exists with the same subtree and the same rigid states in t ′′ ,

• a position p ′ 2 • π, π ∈ Pos(t ′ | p ′ 2 )
, and then the position p ′ 1 • π in t ′′ has the same subtree and the same rigid state,

• a position p ′ 1 • π, π ∈ Pos(t ′ | p ′ 1 )
, where π is not a suffix of p ′ 2 , and in this case, this occurrence of the rigid states disappears in t ′′ . Therefore, r ′′ satisfies the rigid condition on every rigid state of R. Since r ′′ (ε) = r ′ (ε), A recognizes the tree f (t ′′ , t ′ ) which is not in L.

2 Moreover, the class of regular tree languages is strictly included into the class of DRTA languages.

Theorem 3.14 TA DRTA.

proof. The inclusion TA ⊂ DRTA is immediate since DTA ≡ TA and DTA are particular cases of DRTA.

Let Σ = {a:0, g:1, f :2}. The language f (g(t), g(t)) | t ∈ T (Σ\{g} is recognized by the DRTA A = {q, q r , q f }, {q r }, {q f }, a → q, f (q, q) → q, g(q) → q r , f (q r , q r ) → q f } .

But this language if not regular. 2

Visibly Rigid Tree Automata

We propose here a class of restricted RTA which can be determinized. The definition of the restriction is inspired by the theory of visibly pushdown automata (VPA) [START_REF] Alur | Visibly pushdown languages[END_REF]. VPA define a subset of context-free languages closed under intersection and complement. They were generalized to tree recognizers in [START_REF] Chabin | Visibly pushdown languages and term rewriting[END_REF][START_REF] Hubert Comon-Lundh | Tree automata with memory, visibility and structural constraints[END_REF]. The idea in these works is that the signature Σ is partitioned into Σ = Σ c ⊎ Σ r ⊎ Σ ℓ and the operation performed by the VPA on the stack depends on the current symbol in the input: if it is a call symbol of Σ c , the VPA can only do a push, for a return symbol of Σ r it can do a pop and it must leave the stack untouched for a local symbol of Σ ℓ . The transition of a VPA follows this discipline, determinization is possible for this class of pushdown automata, and it is closed under intersection and complement. The RTA have no stack but they permit the comparison between subterms based on the rigid states. Hence, a natural way for defining a condition similar to the one of visibly pushdown automata, and enabling determinization for some RTA, is to restrict the rigid states that can be reached according to the function symbol in the input. In that sense, the rigidity of the states is made visible by the input signature. Definition 3.15 A visibly rigid tree automaton (VRTA) is an RTA A = Q, R, F, ∆ on a signature Σ such that there exists a partial function ν from Σ to R such that for every transition f (q 1 , . . . , q n ) → q ∈ ∆, q = ν(f ) if ν is defined on f and q ∈ Q \ R otherwise.

Example 3.16 The RTA of Example 3.2 is visibly rigid, with a function ν defined only on g by ν(g) = q r . The DRTA in the above proof of Theorem 3.14 is also visibly rigid, with the same function.

Conversely, the RTA of Example 2.3 (recognizing the terms f (t, t) with t ∈ T {a : 0, b : 0, f : 2} is not visibly rigid. Intuitively, some nondeterminism is needed for the bottom-up recognition of this language (because t may contain the symbol f ), and it is not compatible with the visibly rigid condition. Indeed, the above language is not regular, hence at least one rigid state is necessary for the definition of a RTA recognizing it. Defining rigid states for ν(a) and ν(b), is pointless (it can be simulated by standard tree automata). Hence,ν(f ) must be defined in order to ensure the visibly rigid condition, but this would contradict the recognition a term such as e.g. f (f (a, a), f (a, a)).

3

With the visibly rigid condition, a determinization procedure can be applied to VRTA.

Theorem 3.17 Given a VRTA A on Σ, a deterministic VRTA A ′ on Σ of size exponential in |A| and such that L(A ′ ) = L(A) can be constructed in exponential time.

proof. The RTA A ′ is obtained by a classical subset construction. Let

A = Q, R, F, ∆ and let A ′ = 2 Q , 2 R , {S ⊆ Q | S ∩ F = ∅}, ∆ ′ with ∆ ′ = f (S 1 , . . . , S n ) → S | S 1 , . . . S n , S ⊆ Q, S = {q ∈ Q | ∃q 1 ∈ S 1 , . . . , ∃q n ∈ S n , f (q 1 , . . . , q n ) → q ∈ ∆ .
The RTA A ′ is deterministic. Moreover, because of the visibly rigid condition for A, every state of A ′ occurring in ∆ (i.e. every state of A ′ with a non empty language) is either a subset of Q \ R (and it is not a rigid state of A ′ ) or is a singleton subset of R (and it is a rigid state of A ′ ). Hence, given a function ν associated to the VRTA A like in Definition 3.15, there exists a function ν ′ making A ′ a VRTA, defined by ν

′ (f ) = {q r } iff ν(f ) = q r ∈ R.
We can show by induction on t ∈ T (Σ) that there exists a run r of A on t iff there exists a run r ′ of A ′ on t such that for all p ∈ Pos(t), r(p) ∈ r ′ (p). The part of the proof which is specific to (V)RTA concerns the rigidity condition, and uses the above observation about the states of A ′ : all the rigid states in a run r ′ of A ′ are singleton subsets of R. Hence, for the if direction, given a run r ′ of A ′ on t, every relabeling r : Pos(t) → Q extracted from r ′ (i.e. such that r(p) ∈ r ′ (p), p ∈ Pos(t)) satisfies the rigidity condition. Similarly, for the only if direction, a relabeling r ′ : Pos(t) → 2 Q embedding a given run r of A on t also satisfies the rigidity condition. It follows that t ∈ L(A) iff t ∈ L(A ′ ). 2

Being able to determinize VRTA is not enough however to ensure the closure of this subclass of RTA under complement. Intuitively, the reason is that for the (unique) run r of a deterministic VRTA to be successful, a conjunction of two conditions must be realized: the top state of r must be final and the rigidity condition has to be enforced. In comparison, for a TA, only the first condition is necessary, and in order to construct the complement of a deterministic and complete TA, an inversion of final and non final states is sufficient. But in order to characterize the complement of a VRTA language, the disjunction of the negation of the two above conditions is necessary, and VRTA are not expressive enough in order to characterize a term not satisfying a rigidity condition.

Theorem 3.18 The class of VRTA languages is not closed under complement.

proof. Let us consider the language L g of Example 3.2: the set of terms t ∈ T (Σ), with Σ = {a : 0, g : 1, f : 2}, such that s 1 = s 2 for every two Assume that the complement T (Σ) \ L g of L g is recognized by a VRTA A ′ and let ν ′ be the function associated to A ′ like in Definition 3.15. Since L g is not regular, L(A ′ ) is neither regular, and hence A ′ has to contain at least one rigid state q r such that L(A ′ , q r ) = ∅. Hence, there exists a function symbol h ∈ Σ such that ν(h) = q r . It cannot be g, otherwise A ′ would not be able to recognize any term of the form f (g(t 1 ), g(t 2 )) with t 1 = t 2 (such a term is in the complement of L g ). It cannot be f either, otherwise A ′ would not be able to recognize terms of the form f (g(t 1 ), g(t 2 )) with t 1 = f (t 3 , t 4 ) and t 1 = t 2 (those terms are also all is in the complement of L g ). Hence h has to be a, but with rigid states bound to constant symbols, VRTA do not have more expressive power than standard TA. It follows that there does not exist any VRTA A ′ recognizing T (Σ) \ L g . 2 It is not known whether or not, in general, the complement of a VRTA language is an RTA language.

Decision problems

All decision problems studied in section 1.2 naturally apply to RTA. However, the decidability of the emptiness problem for PCTAGC[≈], i.e. positive TAGED has not been proved. We will do it here, especially because we have a lower complexity with RTA. We will also study two decision problems for RTA: intersection non-emptiness, that have not been studied for TAGED, and finiteness. Table 3.1 provides a summary of closure and decision results and a comparison with plain TA and full positive TAGED.

Emptiness

Emptiness is the problem of deciding, given an RTA A whether L(A) = ∅. We show below that deciding emptiness for an RTA amounts to decide emptiness for the underlying TA.

Theorem 3.19 The emptiness problem is decidable in linear time for RTA.

proof. Let A = Σ, Q, R, F, ∆ and let rigid (A) = Σ, Q, Q, F, ∆ be a copy of A where every state is rigid. We show that the emptiness of L(A) and L rigid (A) and L ta(A) are equivalent. The latter problem (emptiness for standard TA) is known to be decidable in linear-time (see e.g. [CLDG + 07]) with an algorithm marking the inhabited states of ta(A) and appropriate data structure for the transitions rules. The idea of the proof is that if L(ta(A)) is not empty, then the classical "state marking" algorithm builds a witness which respects the rigidity condition for all states, and is therefore a witness for L(A) non-emptiness.

In order to establish the above equivalence, we use a similar algorithm for A except that every inhabited state q is marked by a witness (minimal) term t q ∈ L(rigid (A), q) and a run r q of rigid (A) on t q . At the beginning, each t q and r q are set undefined. Then we iterate the following transformation until it is applicable: if q ∈ Q, t q is undefined, and there exists f (q 1 , . . . , q n ) → q ∈ ∆ such that t q 1 , . . . , t qn are all defined, then let t q := f (t q 1 , . . . , t qn ) and r q := q(r q 1 , . . . , r qn ).

The above step will be repeated at most |Q| times, and using suitable data structures (see [CLDG + 07]) for the representation of transition rules ensures that it runs in linear time (note that the update of t q and r q can be performed in constant times at each step). For all q ∈ Q, the following facts are equivalent:

i. t q is defined, ii. L(rigid (A), q) = ∅, iii. L(A, q) = ∅. iv. L(ta(A), q) = ∅.
i ⇒ ii follows from the construction: if t q is defined then r q is a run of L(rigid (A)) on t q . This can be shown e.g. by induction on the number of iteration steps before t q is defined.

ii ⇒ iii and iii ⇒ iv are immediate, because by definition we have L(rigid (A), q) ⊆ L(A, q) ⊆ L(ta(A), q). iv ⇒ i can be shown by induction on the number of transition rules of A. This procedure terminates and at the end, t q is defined iff L(rigid (A), q) = ∅ iff L(A, q) = ∅ iff L(ta(A), q) = ∅. 2 In the deterministic case, there is at most one labelling of the term t compatible with the transition rules. It can be computed in PTIME and it can be checked in PTIME that this labelling is a successful run. Hence the membership problem is decidable in PTIME for DRTA.

Intersection non-Emptiness

Intersection non-emptiness is the problem of deciding, given a finite sequence of RTA whether there exists a term recognized by each RTA of the sequence.

Theorem 3.20 Intersection non-emptiness is EXPTIME-complete for RTA.

proof. The upper-bound is a consequence of Lemma 3.10, Theorem 3.9 and Theorem 3.19. The lower-bound follows from the EXPTIMEhardness of the problem for TA [START_REF] Seidl | Haskell overloading is dexptime-complete[END_REF]. 2

Finiteness

Theorem 3.21 Finiteness is decidable in PTIME for RTA.

proof. Like for TA [CLDG + 07], checking finiteness amounts to detecting (in PTIME) some loops and paths in the accessibility graph of an RTA. The accessibility graph of a given RTA

A = Q, R, F, ∆ is an ori- ented graph G A = Q, E A whose set of vertexes is Q and set of edges is E A := { q, q ′ | ∃f (. . . q . . .) → q ′ ∈ ∆}.
A path in G A is a finite sequence of states q 1 , . . . , q n such that q i , q i+1 ∈ E A for all 1 ≤ i < n.

We have that L(A) is infinite iff there exists a state q ∈ Q \ R such that L(A, q) = ∅, a loop on q in G A (path starting and ending with q) whose states are all in Q \ R, and a path in G A starting with q and ending with a final state of F . The if direction is easy. The other direction can be shown with arguments similar as those in the proof of Lemma 3.7. If L(A) is infinite then it contains a term t of depth larger than (|Q| + 1)|R|. The idea is that the loop on q is the path from the variable position up to the root of the context D in a successful run r of A on t, and the path from q to a final state is the path from the root of D up to the root of t in r.

Checking that L(A, q) = ∅ can be done in linear time according to Theorem 3.19, and deciding the existence of the loop and the path can both be done in polynomial time in the size of A. Altogether, the finiteness of L(A) can be checked in polynomial time. 2

Rewrite Closure

Following the motivations presented in the introduction of this chapter, we study here the closure under term rewriting of RTA languages. We observe first that in general, the rewrite closure of an RTA language is not an RTA language (Section 4.1) and even not recursive (Section 4.2) for linear and collapsing TRS. This is in contrast with TA languages, which are closed under rewriting with such TRS [START_REF] Salomaa | Deterministic tree pushdown automata and monadic tree rewriting systems[END_REF]. We show next that, under a syntactical restriction, namely for a linear and invisibly pushdown TRS R, it is decidable whether a given tree belongs to the rewrite closure of a given RTA language (Section 4.3).

Linear and Collapsing Rewrite Systems

We show first that the closure of an RTA language under rewriting is not an RTA language, even for a very restricted class of TRS.

Proposition 3.22 R * (L) is not an RTA language in general when L is an RTA language and R a linear and collapsing TRS.

proof. Let Σ = {h : 2, f : 1, g : 1, 0 : 0}, let R = {f (g(x)) → x}, and let A = Q, R, F, ∆ be the RTA on Σ with Q = {q 0 , q 1 , q 2 , q r , q f }, R = {q r }, F = {q f }, and ∆ = 0 → q 0 , g(q 0 ) → q 0 |q r , f (q r ) → q 1 , f (q 1 ) → q 1 , h(q r , q 1,2 ) → q f , h(q 1,2 , q 1,2 ) → q 2 , h(q f , q 1,2 ) → q f , where q 1,2 is either q 1 or q 2 . Every term of L(A) has the form H g m (0), f * (g m (0)), . . . , f * (g m (0)) where H is an k-context made of the symbol h only (with k ≥ 2), g m represents a nesting of m symbols g and f * represents a nesting of an arbitrary number of f 's. In other word, the leftmost argument of the context H contains m symbols g, and the other arguments of the context consist in an arbitrary number of f 's followed by m g's and finished by a 0. Indeed, the rigid state q r enforces that each argument has the same number of g's.

The terms of the closure R * L(A) of L(A) by R have a similar form except that the number of g's in the different arguments might not be equal. They only have to be all less than or equal to the number of g's in the leftmost argument. The intersection of this set R * L(A) with the regular tree language containing the terms of the form H g * (0), . . . , g * (0) is the language of Example 3.5, which is not recognized by RTA. It follows that R * L(A) is not an RTA language. 2 Note that the terms H g m (0), g n 1 (0), . . . , g n k (0) in the language of Example 3.5 are R-normal forms in the above counterexample in the proof of Proposition 3.22 (since they do not contain the symbol f ). Hence, restricting to the terms of the rewrite closure in normal form does not help: the intersection of R * L(A) with R-normal-forms is not an RTA language in general, when A is an RTA and R a linear and collapsing TRS.

Undecidability of Membership Modulo

We show in this section that the rewrite closure of an RTA under a linear collapsing TRS is even not recursive. Let us call membership modulo the problem of deciding whether t ∈ R * (L(A)) given an RTA A, a TRS R and a ground term t ∈ T (Σ). proof. Let Γ be a finite alphabet and let u 1 , v 1 . . . u n , v n ∈ Γ * be a PCP instance P . A solution of this PCP instance is a sequence i 1 , . . . , i m of integers smaller or equal to n such that u

h f im g im f i 1 g i 1 u i 1 u im 0 k f im g im f i 1 g i 1 v i 1 v im 0
i 1 . . . u im = v i 1 . . . v im .
Let us consider the signature Σ = {g i : 1, f i : 1 | i ≤ n} ∪ {a : 1 | a ∈ Γ} ∪ {0 : 0, k : 1, h : 2}, and the language (for all w = a 1 , . . . , a p ∈ Γ * , the term a 1 (. . . a p (t)) is written w(t))

L = {h(s, k(s)) | s = f im (g im (. . . f i 1 (g i 1 (w(0)), 1 ≤ i 1 , . . . , i m ≤ n, m > 0, w ∈ Γ * }
Let R be a TRS on Σ containing the rules

f i (g i (u i (x))) → x (i ≤ n), g i (x) → x (i ≤ n), g j (f i (v i (x))) → x (i, j ≤ n), k(f i (v i (x))) → x (i ≤ n).
The tree language L is recognizable by an RTA on Σ. Hence the following property permits us to conclude the proof of Theorem 3.23.

Lemma 3.24 h(0, 0) ∈ R * (L) iff P has a solution.

The if direction is easy. Let i 1 , . . . , i m be a solution of P and let h(s, k(s)) be the term of L corresponding to this solution (i.e.

s = f im (g im (. . . f i 1 (g i 1 (w(0))))) and w = u i 1 . . . u im (0) = v i 1 . . . v im (0)).
This term is depicted in Figure 3.3. The s in the left branch can be reduced to 0 using the first rule of R, and the s in the second branch can be reduced to k(f im (v im (0))) using the two next rules of R. This latter term is in turn reduced to 0 using the last rule of R.

For the only if direction, assume that L ∋ h(s, k(s)) --→ * R h(0, 0). In order to show that in this case, s corresponds to a solution, it is sufficient to make the following observations. First, only the first rule of R (with u i ) can be applied in order to reduce the s in the left branch to 0. Indeed, the only other rule of R applicable to s is g i (x) → x and after using this rule, only g j (f i (v i (x))) → x can be applied, and s cannot be reduced to 0. Moreover, assuming s minimal, and having the k at the top of the right branch imposes us to use only the last three rules of R in order to reduce k(s) to 0 (it is possible to start the reduction of the right branch with a sequence of applications of f i (g i (u i (x))) → x but this would contradict the minimality of s). Altogether, it follows that s corresponds to a solution of P . 2

Linear and Invisibly Pushdown Rewrite Systems

We show in this section that the problem of membership modulo becomes decidable with some further syntactic restrictions on R, based on the definition of visibly pushdown automata [START_REF] Alur | Visibly pushdown languages[END_REF].

The VPA (see also Section 2.2) recognize languages of words. They were generalized into tree recognizers in [START_REF] Chabin | Visibly pushdown languages and term rewriting[END_REF][START_REF] Hubert Comon-Lundh | Tree automata with memory, visibility and structural constraints[END_REF]. In [START_REF] Chabin | Visibly pushdown languages and term rewriting[END_REF], Chabin and Rety show that the class of visibly pushdown tree automata (VPTA) languages is closed under rewriting with so called linear visibly context-free TRS. We use a similar definition in order to characterize a class of TRS for which membership modulo is decidable. In the following definition, we assume a partition of the signature Σ into Σ c ⊎ Σ r ⊎ Σ ℓ . Definition 3.25 A collapsing TRS R is called inverse-visibly pushdown (invisibly pushdown) if for every rule ℓ → x ∈ R, d (ℓ) ≥ 1, x occurs once in ℓ, and if x occurs at depth 1 in ℓ then ℓ ∈ T (Σ ℓ , X ), otherwise, ℓ(ε) ∈ Σ c , the symbol immediately above x is in Σ r and all the other symbols of ℓ are in Σ ℓ .

Example 3.26 The TRS R = {fst(pair(x 1 , x 2 )) → x 1 , snd(pair(x 1 , x 2 )) →
x 2 , dec(inc(x)) → x, decrypt(encrypt(x, pk(A)), sk(A)) → x} is linear and invisibly pushdown with Σ c = {fst, snd, dec, decrypt} and Σ r = {pair, inc, encrypt}, Σ ℓ = {pk, sk, A}.

3

The TRS in the proof of Proposition 3.22, {f (g(x)) → x}, is invisibly pushdown, but not the one in the proof of Theorem 3.23. Indeed, there exists no partition of Σ making this latter TRS invisibly pushdown.

According to Definition 3.25, having a rule g i (x) → x implies that g i ∈ Σ ℓ but also having a rule g j (f i (v i (x))) → x implies that g i ∈ Σ c .

Theorem 3.27 Membership modulo is decidable for RTA and linear and invisibly pushdown TRS.

proof.

The decision algorithm involves the construction of a visibly pushdown automata recognizing the language of ancestors of t wrt R that belong to L(A). We do this in three steps:

1. we compute a (big) context-free tree grammar that generates all terms that can rewrite to a single variable by R rules, such that there exists a run of A on them where the positions of the rigid states are not contradictory.

2. we add initial rules to the grammar in order to make it generate terms that rewrite to t instead of those rewriting to a variable.

3. finally, we transform the tree grammar obtained into a visibly pushdown tree automaton, and take the subterms under rigid states as independent languages. We replace each language under an occurrence of a rigid state by the intersection of all languages under all occurrences of the same rigid state.

After these constructions have been completed, we only need to check whether the given visibly pushdown language is empty or not in order to solve the problem. Let A = Q, R, F, ∆ be an RTA, R an inverse-visibly pushdown TRS and t ∈ T (Σ) a term in normal form. We want to construct a CF tree grammar which simulates the application of the rules of R backwards, by expanding subterms into left-hand side of rules, in a way that the application of rules of A is possible. For this purpose, we shall use some tuples of the following form q 1 q 2 , ℓ, lbl , occ, occ x , < where

• q 1 , q 2 ∈ Q,
• ℓ is either the lhs of some rule ℓ → x ∈ R, or the single variable x,

• lbl is a labeling of ℓ by pairs of states denoted q q ′ ,

• occ is a set of pairs q r , p where q r ∈ R and p ∈ Pos(ℓ),

• occ x is a subset of occ where each rigid state occurs in at most one pair,

• < is a strict partial order on the set of rigid states R.

For each tuple ψ of this form, we will denote lq(ψ) for q 1 , rq(ψ) for q 2 and pair(ψ) for q 1 q 2 . When the use of lbl , occ, occ x or < is ambiguous we will index them with the tuple they are referencing (ex. occ ψ ). W.l.o.g. we will assume that the rule of R in which ℓ occurs rewrites to the variable x, and we will denote p x the position of this variable in ℓ. For the rest of the proof, we will need the following definition of a valid labelling of a term by those tuples. Definition 3.28 A labelling ξ of a term t by tuples of the form q 1 q 2 , ℓ, lbl , occ, occ x , < is said to be valid if 1. ∀p ∈ Pos(t), t(p)(lq(ξ(p.1)), . . . , lq(ξ(p.n))) → rq(ξ(p)) ∈ ∆, 2. there do not exist two rigid states q r 1 , q r 2 and two positions p, p ′ such that q r 1 < ξ(p) q r 2 and q r 2 < ξ(p ′ ) q r 1 , 3. there do not exist two positions p and p.w such that a rigid state q r appears in occ

ξ(p) x
and in occ ξ(p.w) , 4. there do not exist three positions p, p.w and p ′ such that a rigid state q r 1 appears in occ

ξ(p)
x , a distinct rigid state q r 2 appears in occ ξ(p.w) , and q r 1 < ξ(p ′ ) q r 2 .

We will build a set T of tuples by induction. We start with

T 0 = { q q , x, q q , ∅, ∅, ∅ | q ∈ Q\R}∪{ q r q r , x, q r q r , {(q r , ε)}, {(q r , ε)}, ∅ | q r ∈ R}.
The set T i+1 is built from T i as follows

• for every ψ ∈ T i , we add ψ to T i+1 ,

• for every lhs ℓ of R and every valid labelling ξ of ℓ by tuples of T i , we add the tuple q 1 q 2 , ℓ, lbl, occ, occ x , < to T i+1 , where:

-q 1 = lq(ξ(ε)), q 2 = rq(ξ(p x )), -∀p ∈ Pos(ℓ), lbl(p) = lp(ξ(l))
rp(ξ(l)) , -occ = { q r , p | q r appears in occ ξ(p) }, -occ x = { q r , p | p ≤ p x and q r appears in occ ξ(p)

x }, -q r 1 < q r 2 iff ∃p, q r 1 < ξ(p) q r 2 or ∃p, p.w ∈ Pos(ℓ), q r 1 appears in occ ξ(p) x and q r 2 appears in occ ξ(p.w) .

By induction, each tuple q 1 q 2 , ℓ, lbl , occ, occ x , < added in T verifies 1. q 1 is the top state of lbl(ε), 2. q 2 is the bottom state of lbl(p x ), 3. < is a partial strict order on R,

4. occ x ⊆ occ, 5. each position in occ x is a prefix of p x .
Since the number of lhs of R, the size of each lhs, the number of (rigid) states of A are all finite, each step takes a finite (in fact polynomial) amount of time. Also, the number of distinct tuples that can be added in some T i is also finite, so we will eventually reach a set T i where no new tuple can be added. We define T as the first T i where no new tuple can be added.

The terminal symbols of our CF tree grammar are the function symbols of Σ. Its non-terminals symbols are elements of N = Σ ∪ {⊤} × T , and f, ψ has arity n if f ∈ Σ n and every ⊤, ψ has arity zero.

Let us first define the main production rules of the grammar: for every f ∈ Σ ∪ ⊤ and every tuple φ = q 1 q 2 , ℓ, lbl, occ, occ x , < , -if ℓ = x, then we have in the grammar all the production rules:

f, ψ (x 1 , . . . , x n ) := u
where, f ∈ Σ n and u is a term of T Σ ∪ N , {x 1 , . . . , x n } such that Pos(u) = Pos(ℓ) and defined by, for every position p, u(p) = f ′ , ψ p with

• ψ p ∈ T • pair(ψ p ) = lbl(p)
• if q r , p ∈ occ, then q r occurs in occ ψp

• if q r , p ∈ occ x , then q r occurs in occ ψp x

• < ψp ⊆< By construction of T there exists a tuple ψ satisfying these conditions. Moreover,

• f ′ = ℓ(p) if ℓ(p) ∈ Σ (i.e. if p is not a variable position in ℓ), • f ′ = f (x 1 , . . . , x n ) if p = p x (the position of x in ℓ),
• f ′ = ⊤ elsewhere.

-if ℓ = x, then q 1 = q 2 = q, and we add to our grammar the production rule f, ψ (x 1 , . . . , x n ) := f (x 1 , . . . , x n ) if f = ⊤. We also add to the tree grammar some non-terminal of arity zero and production rules that generates the terms of L(A, q), which is a regular language. With this construction, the rules of our CF tree grammar generate the terms that rewrite to a single variable x with R, and that have a run r of A on them and where positions of rigid states are not contradictory with the rigid conditions. But we still need to ensure that we generate terms that rewrite to t instead of x and that subterms under rigid states are equal.

In order to generate terms rewriting to t instead of x, we just need to add initial rules to the grammar. Let S be the initial non-terminal symbol (of arity zero). For each valid labelling ξ of t such that lq(ξ(ε)) is a finite state of A, we add to our grammar the production rule: S := u where u(p) = (t(p), ξ(p)) for all p ∈ Pos(t).

The CF tree grammar constructed generates all the terms rewriting to t with R and with a run of A that have non-contradictory positions of rigid states. Only the rigidity condition is missing.

For the rigidity condition, we need to compare the languages generated by the grammar's production rules, starting from the non-terminal symbols of the form f, ψ with ψ = qr qr , x, qr qr , { q r , ε }, { q r , ε }, < for some rigid state q r ∈ R. Let us call such languages the language of the grammar associated to q r . For this purpose, we use the fact that R is a linear and invisibly pushdown rewrite system. Indeed, it ensures that the above languages of the grammar associated to rigid states are languages of visibly pushdown tree automata (VPTA). Such languages are closed under intersection, and the emptiness is decidable.

We consider the languages of the grammar associated to rigid states, beginning by the maximal rigid states according to the partial order. We compute the intersection of every language that can be generated at different occurrences of a same rigid state. We do that for each rigid state. Then, the intersection language of the minimal rigid states (according to the partial order) is used in the languages of greater rigid sates and in the general language of ancestors of t instead of the different languages of the different occurrences. We repeat this procedure, following the partial order, until having replaced each language of an occurrence of a rigid state by the corresponding intersection. Finally, we just have to decide the emptiness of the general language to know whether a term recognized by A (with a run respecting the rigidity condition for all rigid states) does rewrite to t. 2

Application to the Verification of Security Protocols

In this final section, we would like to present an application of RTA to the verification of security protocols; this model is also presented in [JKV] (extends version of [START_REF] Jacquemard | Rigid tree automata[END_REF]). Our purpose is not to propose new results in this domain, but rather to illustrate the potential of RTA for the automatic verification of some infinite state systems, in particular communicating processes.

Using automata for protocol analysis is a quite popular approach, see e.g. [CLC05, GK00, Gou05]. In particular it is possible to analyze protocols with infinitely many sessions. But this kind of analysis has limitations due to approximations with regular sets. Such approximations may conduct to false alarms, as discussed e.g. in [START_REF] Amadio | On name generation and set-based analysis in the dolev-yao model[END_REF] or [START_REF] Affeldt | Verification of security protocols with a bounded number of sessions based on resolution for rigid variables[END_REF]. The approach with RTA overcomes several sources of imprecision such as incorrect chaining of messages sent by agents, or ignoring the multiple occurrences of variables in the body of messages sent. Moreover, rigid state also permit to model a local finite memory in which both honest and dishonest agents can store read messages. This feature is generally not supported in other models.

Protocol Model

We consider a model of security protocols where a finite number of agents exchange messages, following a protocol, asynchronously over an insecure network. The messages are ground terms of T (Σ) build over cryptographic operators and are interpreted modulo an invisibly TRS R with rules like the above one for decrypt. For instance, we assume that Σ contains the binary operator encrypt for encryption of data (in the first argument) with a public or secret key (in the second argument), and decrypt for the decryption with the associated secret key. We also use two unary operators pk and sk, associating to the name of an agent its public, respectively secret, key. For the name of agents, we use a finite set of constant function symbols of Σ 0 , A, B... Amongst the set of function symbols Σ, we distinguish a subset Σ pub of public function symbols, which represent the function publicly known. Below we assume that Σ pub contains encrypt and decrypt, all the agent's names, the function pk (hence we assume that knowing somebody's name is sufficient to know his public key), a function inc for incrementation, but Σ pub does not contain the function sk.

We have the following rewrite rules in R (for each agent's name A) decrypt(encrypt(x, pk(A)), sk(A)) → x (a message x encrypted using the function encrypt with the public key of A, pk(A), can be recovered using decrypt and the secret key of A, sk(A)).

We also have the symmetric rules decrypt(encrypt(x, sk(A)), pk(A)) → x

We also consider a binary constructor pair and two unary operators fst and snd for pairing and projection, and the associated rewrite rules

fst(pair(x 1 , x 2 )) → x 1 , snd(pair(x 1 , x 2 )) → x 2
As noticed in Section 4.3, the TRS containing the above rules is linear invisibly (see Example 3.26).

Example 3.29 We consider as a running example a simplified version of the mutual authentication protocol SPLICE/AS [YOM91], which consists of the following two messages exchanged between a client C and a server S. The purpose of this protocol is to establish a handshake between C and S: C sends to S some integer value N , encrypted with encrypt and the public key of S, pk(S). Then, S sends to C in reply the successor of N , inc(N ), encrypted with encrypt and the public key of C, pk(C), in order to prove that he was the real receiver of the first message -since only S has the secret key sk(S) which is necessary in order to recover N from encrypt(N, pk(S)).

Moreover, in the first message, C further encrypts encrypt(N, pk(S)) using the function encrypt and its secret key of C, sk(C). The purpose of this second step of encryption is to act as a signature: only C is supposed to know his secret key, and the receiver of the message S, who knows C's public key pk(C) can check whether this part of the message was really encrypted with sk(C).

Finally, some more information is wrapped in the messages: C recalls his name in the signed part of the first message, for the purpose of the double check of the signature described above; moreover both messages start with a "header", i.e. a pair containing the name of the sender and the intended receiver.

The original SPLICE/AS protocol [YOM91] contains additional messages for the distribution of public keys pk(S) and pk(S) by a trusted authority AS, and timestamps. Here, we make the simplifying assumption that every public key is known by everyone (since everyone can obtain it from AS), and we skip the timestamps.

3

We consider a simple formal representation of programs executing cryptographic protocols which should fit with most of the formalisms in use.

A program is a finite set of agents, and each agent is a finite sequence of pairs of instructions of the form recv(x).send(s).i where i is a program point (in an arbitrary domain), x ∈ X and s ∈ T (Σ, X ). We assume that moreover every agent starts with an initial program point and that all the program points in a program are pairwise distinct. Note that every message is received as a variable (the argument of recv is always a variable). Hence recv acts as a variable binder, like in [START_REF] Abadi | Mobile values, new names, and secure communication[END_REF]. Every agent is supposed to be closed, i.e. every variable x occurring in a send(s) is in the scope of a binder recv(x). For convenience, we assume that the variables in different instructions recv(x) of a program are distinct. C : c 0 .recv(x).send pair pair(C, S), encrypt(pair(C, encrypt(N, pk(S))), sk(C)) .c 1 S : s 0 .recv(y).send pair pair(t s , t c ), encrypt(pair(t s , inc(t n )), pk(t c )) .s 1 where t s = snd(fst(y)), t c = fst(fst(y)), t n = decrypt snd decrypt(snd(y), pk(t c )) , sk(S)

The terms t s , t c and t n describe the recipes used by S to recover respectively the values S, C and N from the message received y. The variable x is useless. It is only for technical purpose that we assume that C receives an arbitrary value before sending the initial message of the protocol. 3

In order to define a semantics for the execution of these programs, we describe in the next section a model of the network used for the communications.

Protocol Semantics

The network is assumed to be under the control of an active attacker who is able to read and divert messages and to sent newly forged messages under fake identities. The attacker is able to use terms and function symbols that he knows (like terms sent by honest processes and public functions such as encrypt or decrypt), in order to forge new messages.

To summarize, in this network model, the communication of one message m between two agents C and S can be decomposed into three phases:

• C sends the message m to the attacker (send instruction),

• the attacker analyze the message as much as he can (applying public functions like decrypt, known public keys like pk(S) and the rewrite rules of R) and possibly changes m into m ′ (but m ′ may be equal to m),

• the attacker transfers m ′ to S, pretending that the sender is C, and S reads m ′ (recv instruction).

Later, S may reuse m ′ in order to prepare an answer to C, following the rules of the protocol. A configuration of a program P is a triple (S, σ, N ) where S is a set of programs points (one for each agent), σ is a substitution whose domain is the variables of P and codomain is a subset of T (Σ) and N ⊂ T (Σ). Intuitively, S contains the current program point of each agent of P , σ is the list of messages read by the agents so far with instructions recv(x), and N represents the set of terms known by the attacker. Hence, according to the above hypotheses, N corresponds to the content of the network (at a step of execution defined by S and σ) i.e. it is the set of all terms which can be read (with recv(x)) by the agents.

We define now small step semantics for the execution of programs. Each step changes the running configuration S, σ, N of P into S ′ , σ ′ , N ′ if S = {i} ∪ U , the program point i appears in one agent of P (this agent is unique by assumption that the program points are pairwise distinct) and in this agent, i is followed by the instructions recv(x).send(s).i ′ , x is not in the domain of σ and

• S ′ = {i ′ } ∪ U , • σ ′ = σ ∪ {x → m} for some m ∈ N ,
• N ′ is the closure of cl(N ∪ {σ(s)}) under application of public function symbols and R, as defined below.

The closure cl(M ) of a set M ⊆ T (Σ) is defined recursively as the smallest set containing all the terms of M and such that for all f ∈ Σ pub of arity n, for all t 1 , . . . , t n ∈ cl(M ), R * {f (t 1 , . . . , t n )} ⊆ cl(M ). Intuitively, cl(M ) represents the set of terms than the attacker can deduce from the terms of M .

Example 3.31 The following sequence of configurations represents a valid execution of the program in Example 3.30, where the agent's messages are smoothly transferred without tampering.

({c 0 , s 0 }, ∅, N 0 ), ({c 1 , s 0 }, {x → t 0 }, N 1 ), ({c 1 , s 1 }, {x → t 0 , y → s 0 }, N 2 )
The set N 0 in the first configuration contains the initial knowledge of the attacker. For instance, N 0 contains A, pk(A), sk(A) (A is the official identity of the attacker), the identity of other agents and their public keys C, S, pk(C), pk(S)... and the terms build with these terms by application of the public function symbols pair, fst, snd, inc, encrypt, decrypt, e.g. pair(A, S), pair(A, pair(A, S))... In other word,

N 0 = cl {A, pk(A), sk(A), C, S, pk(C), pk(S)} .
Note that this set N 0 is infinite but regular. The term t 0 is an arbitrary element of N 0 , and

N 1 = cl (N 0 ∪ {s 0 }),
s 0 = pair pair(C, S), encrypt(pair(C, encrypt(N, pk(S))), sk(C)) , N 2 = cl (N 1 ∪ {s 1 }), s 1 = pair pair(t s , t c ), encrypt(pair(t s , inc(t n )), pk(t c )) , t s = snd(fst(s 0 )), t c = fst(fst(s 0 )), t n = decrypt snd decrypt(snd(s 0 ), pk(t c )) , sk(S) .

Note that in the sequence, the two agents exchange the messages of the protocol, as described in Example 3.29, because s 1 --→ * R pair pair(S, C), encrypt(pair(S, inc(N )), pk(C)) . 3

With the above semantics, every message is build on the top of former messages (either by an agent or the attacker). The monotonicity of the definition of the messages sets N i makes bottom-up RTA suitable for their representation.

RTA Construction

We show below that it is possible to build an RTA A recognizing exactly the sets of messages N (representing the state of the attacker's knowledge) in reachable configurations of a given program P . By reachable, we mean reachable from an initial configuration, which is specified precisely below and is assumed to be part of the problem. The RTA A models both the behavior of the honest agents and of the attacker. It uses uses one rigid state to memorize every message received by the honest agents (the codomain of the substitution σ in configuration).

The first component of configurations (program points of all agent) is encoded directly into the states (as the amount of information needed is finite).

Assume that the program P contains n agents P 1 , . . . , P n . We detail below the construction of the states and transitions of A. We have in A one state q i 1 ...in for each tuple of values (i 1 , . . . , i n ) of program points of respectively P 1 , . . . , P n .

Example 3.32 For the program of Example 3.30 (for the simplified version of the SPLICE/AS protocol presented in Example 3.29), with two agents called C and S, we have the states q c 0 s 0 , q c 1 s 0 , q c 0 s 1 , q c 1 s 1 .

3

Intuitively, A will be such that L(A, q i 1 ...in ) is the set of messages N such that a configuration ({i 1 . . . i n }, σ, N ) is reachable, for some σ. Hence this language contains the set of terms readable (at this point) by the agents and the attacker.

For each state q i 1 ...in and each (bound) variable x occurring in P , we consider one copy denoted q x i 1 ...in , which is a rigid state.

Example 3.33 For the program of Example 3.30, we have the rigid states q x c 0 s 0 , q y c 0 s 0 , q x c 1 s 0 , q y c 1 s 0 . . . Intuitively, A will be such that L(A, q y c 1 s 0 ) is exactly the set of terms t such that there exists a reachable configuration ({c 1 , s 0 }, {x → t 0 , y → t}, N ), for some t 0 and N .

3

Now, we will describe the transitions of A modeling the operations recv and send of the agents. The idea is that when an agent P i has an instruction send(s), then A will perform pattern matching of s, using transitions similar to the ones described in the construction of Proposition 2.5. Like in Proposition 2.5, we consider for this purpose some auxiliary states of the form q u i 1 ...in for every strict subterm u of s and tuple (i 1 , . . . , i n ) of program points values. Note that for every variable x ∈ vars(s), one rigid states q x i 1 ...in has already been added above. Let (i 1 , . . . , i n ) be a tuple of program point values, such that i j occurs in the agent P j and is followed by the instructions recv(x).send(s).i ′ j . Then the following transitions are added to A for the recognition of s (like in Proposition 2.5, we assume that s is not a variable):

g(q u 1 i 1 ...in , . . . , q um i 1 ...in ) → q g(u 1 ,...,um) i 1 ...in s.t. g ∈ Σ m , g(u 1 , . . . , u m ) strict subterm of s, g(q u 1 i 1 ...in , . . . , q um i 1 ...in ) → q i ′ s.t. g(u 1 , . . . u m ) = s, i ′ = i 1 . . . i j-1 i ′ j i j+1 . . . i n .
Note that since the states q x i 1 ...in are rigid (when x is a variable), the non linearities in s are respected.

Example 3.34 Let us consider for instance the instructions of the agent S in the program of Example 3.30 s 0 .recv(y).send pair pair(t s , t c ), encrypt(pair(t s , inc(t n )), pk(t c )) .s 1 with t s = snd(fst(y)), t c = fst(fst(y)), and t n = decrypt snd decrypt(snd(y), pk(t c )) , sk(S) .

We have the following transitions in A

fst q y c 1 s 0 → q fst(y) c 1 s 0 snd q fst(y) c 1 s 0 → q ts c 1 s 0 . . . pair q pair(ts,tc) c 1 s 0 , q crypt(...) c 1 s 0 → q c 1 s 1 3
We need next some transitions in A modeling the behavior of the attacker. As said above, the purpose of a state q i 1 ...in is to characterize the set of messages N in a reachable configuration ({i 1 . . . i n }, σ, N ). In other words, this state characterizes the knowledge of the attacker when the n agents reached the respective steps i 1 , . . . , i n .

Let us consider first the tuple (i 0 1 , . . . , i 0 n ) of the initial program points of the agents P 1 , . . . , P n of P . The corresponding set of terms N 0 is characterized explicitly by a set of transitions of A using the states q i 0 1 ...i 0 n and q x i 0 1 ...i 0 n (and possibly some auxiliary states used only for that purpose, see the Example 3.35 below). This set N 0 defines a unique initial configuration ({i 0 1 , . . . , i 0 n }, ∅, N 0 ), which was mentioned when we discussed the reachable configurations, and N 0 is assumed to be part of the verification problem. Note that with this approach, it is possible to consider an infinite initial knowledge for the attacker. Moreover, the regular language N 0 is defined in a way that cl(N 0 ) = N 0 , in order to conform to the above semantics.

Example 3.35 The initial set of the attacker's knowledge N 0 which was mentioned in Example 3.31 is defined by the following transitions of A (for the sake of readability, we denote below the state q c 0 s 0 by q 0 and the states q c 0 s 0 |q x c 0 s 0 |q y c 0 s 0 by q xy 0 )

A → q xy 0 , A → q A , C → q xy 0 , S → q xy 0 , pk(q 0 ) → q xy 0 , sk(q A ) → q xy 0 , fst(q 0 ) → q xy 0 , snd(q 0 ) → q xy 0 , inc(q 0 ) → q xy 0 , encrypt(q 0 , q 0 ) → q xy 0 , decrypt(q 0 , q 0 ) → q xy 0 , pair(q 0 , q 0 ) → q xy 0 .

where q A is an auxiliary state that occurs only in the above 2 transitions of A, in order to have sk(A) ∈ N 0 . 3

Next, we define some transitions modeling the evolution of the attacker's knowledge during the execution of the protocol. With the transitions defined above, we know that the states q i 1 ...in characterize the messages that can be sent to the network by the agents. Moreover, we want to enrich the languages of these states with the information that the attacker is able to learn form the messages sent. According to the semantics presented above, the technique used by the attacker to learn information from messages consists in applying public function symbols of Σ pub at the top of the terms of its knowledge, i.e. the terms recognized in states q i 1 ...in . It is expressed by transitions of the form:

f (q i 1 , . . . , q im ) → q i |q x i f ∈ Σ pub , i = max 1≤j≤m i j , x variable of P
where the operator max is applied componentwise to the vectors i j and refers to an order defined on the program points of each agents by their order of appearance in the P j 's.

Example 3.36 For the program of Example 3.30, we have the following attacker's transitions (additionally to the one presented in Example 3.35 above)

pk(q c 0 s 1 ) → q c 0 s 1 |q x c 0 s 1 |q y c 0 s 1 , pk(q c 1 s 0 ) → q c 1 s 0 |q x c 1 s 0 |q y c 1 s 0 , pk(q c 1 s 1 ) → q c 1 s 1 |q x c 1 s 1 |q y c 1 s 1
(and idem for fst, snd, inc), encrypt(q c 0 s 1 , q c 0 s 1 ) → q c 0 s 1 |q x c 0 s 1 |q y c 0 s 1 , encrypt(q c 0 s 1 , q c 1 s 0 ) → q c 1 s 1 |q x c 1 s 1 |q y c 1 s 1 , . . . (and idem for decrypt, pair).

3

Verification of Security Properties

We will see that in our setting, it is possible to express and verify confidentiality and authentication properties for a protocol by a reduction to decision problems for the RTA A constructed above.

Example 3.37 The protocol of Example 3.29 is supposed to ensure the authenticity of the message of S and also the confidentiality of inc(N ) (for instance the value inc(N ) can be supposed to be reused later as a key for symmetric encryption of a communication tunnel). However, both these properties can be attacked with a replay attack described in the following counter example.

1.

C → A(S) : pair pair(C, S), encrypt(pair(C, encrypt(N, pk(S))), sk(C)) 1 ′ .

A → S : pair pair(A, S), encrypt(pair(A, encrypt(N, pk(S))), sk(A)) 2 ′ . S → A : pair pair(S, A), encrypt(pair(S, inc(N )), pk(A))

A(S) → C

: pair pair(S, C), encrypt(pair(S, inc(N )), pk(C))

This counter example involves two parallel sessions of the protocol. In the first session (messages 1 and 2), the client C contacts the server S, following the protocol. But the first message is diverted by the attacker, (i.e. the message 1 stays in the network without being delivered to S) as indicated by the receiver denoted by A(S). Then the attacker opens a new session (messages 1 ′ and 2 ′ ), between himself, A, (acting as a client) and the same server S. It is important to note that in message 1 ′ , the attacker reuses the same number N as in 1.

Actually, the attacker is not able to decrypt encrypt(N, pk(S)), because he does not know the secret key sk(S). However, he is able to decrypt encrypt(pair(C, encrypt(N, pk(S))), sk(C)), using the public key of C. Hence he reuses this ciphertext encrypt(N, pk(S)) in 1 ′ , as a ciphertex protecting a fresh value of N . The server, who is not aware that this is a replay, replies with encrypt(pair(S, inc(N )), pk(A)), a message that the attacker is able to decrypt, with his own secret key sk(A). Hence the attacker learns the value inc(N ) which is supposed to be shared only by S and C. It means that N is also compromised if we assume that inc is invertible, i.e. that there exists a public unary function dec ∈ Σ pub and a rewrite rule dec(inc(x)) = x ∈ R (we did not consider these additional symbols and rules in our example above because they are not necessary for our purpose).

Moreover, the attacker can send the last message 2, impersonating S (this is denoted by the sender A(S)). Hence this is also an attack on the authenticity of this message (the server S was actually not involved in the session of the protocol made of messages 1 and 2).

3

The existence of a confidentiality flaw like the one described in Example 3.37 is reducible to the problem of membership modulo R (t ∈ R * L(A) , see Section 4.2), for the RTA A constructed above.

Example 3.38 The confidentiality attack described in Example 3.37 occurs with two parallel sessions, involving 3 agents: 1 agent C playing the role of the client in the first session, and 2 agents playing the role of the server, respectively in the first and second session. The server agent in the first session is inactive. The role of the client in the second session is played by the attacker.

We can recognize this attack by analyzing a program made of the 2 agents C and S defined in Example 3.30 plus the following second instance of a server S : s ′ 0 .recv(y ′ ).send pair pair(t ′ s , t ′ c ), encrypt(pair

(t ′ s , inc(t ′ n )), pk(t ′ c )) .s ′ 1 where t ′ s = snd(fst(y ′ )), t ′ c = fst(fst(y ′ )), t ′ n = decrypt snd decrypt(snd(y ′ ), pk(t ′ c ))
, sk(S) This agent has the same identity S as the first one in Example 3.30. Despite the renaming of the variable y into y ′ and of the program points (for technical convenience), this agent is the same as the one of Example 3.30. Let us construct the RTA A for this 3 agents as above. The states of A have the form q c i s j s ′ k or q z c i s j s ′ k for i, j, k ∈ {0, 1} and z ∈ {x, y, y ′ }.

We have that inc(N ) ∈ R * L(A, q c 1 s 0 s ′ 1 ) . Since the closure under R of the language in state q c 1 s 0 s ′ 1 represents the knowledge of the attacker, it means that the value inc(N ) has been compromised. Indeed, following the construction of A, we have t 1 = pair pair(C, S), encrypt(pair(C, encrypt(N, pk(S))), sk(C)) ∈ L(A, q c 1 s 0 s ′ 0 ). This term t 1 corresponds to the message 1 (of C) in Example 3.37. Using the transitions of the attacker, we obtain that t 1 ′ = pair pair(A, S), encrypt(pair(A, snd(decrypt(snd(t 1 ), pk(C)))), sk(A)) ∈ L(A, q y ′ c 1 s 0 s ′ 0 ).

Note that snd(decrypt(snd(t 1 ), pk(C))) --→ * R encrypt(N, pk(S)). With the transitions for the pattern matching of the message of the second agent playing the role of S, we have

t 2 ′ = pair pair(t ′ s , t ′ c ), encrypt(pair(t ′ s , inc(t ′ n )), pk(t ′ c )) ∈ L(A, q c 1 s 0 s ′ 1 ) with t ′ s = snd(fst(t 1 ′ )), t ′ c = fst(fst(t 1 ′ )), t ′ n = decrypt snd decrypt(snd(t 1 ′ ), pk(t ′ c )) , sk(S) .
Next, using again the transitions of the attacker, we obtain

t ′ = snd(decrypt(snd(t 2 ′ ), sk(A))) ∈ L(A, q c 1 s 0 s ′ 1 ),
and we have t ′ --→ * R inc(N ). Hence there is a positive answer to the problem of membership modulo for A, R and inc(N ), meaning that there exists a confidentiality attack.

3

Let us make a few remarks on the above analysis. The construction of two generic agents like in Example 3.30 is the specification of the protocol, written by the user. These agents represent the 2 roles (client and server in the protocol). Adding several instances of each agent in a program (to be verified) can be done automatically, just by variable and program point renaming as described above. The second part of the user specification is the construction of a TA recognizing the initial attacker's knowledge N 0 , like in Example 3.35. The construction of the rest of the RTA, on the top of the agents and the TA for N 0 is automatic and the definition of the signature Σ and the TRS R are generic and independent of the protocol.

To summarize, RTA techniques permit an automatic analysis of the confidentiality property for security protocols, by reduction to the problem of membership modulo for RTA, given

• a definition of the set of public symbols Σ pub ,

• a user specification (as programs) of the roles of the protocol,

• the number and identities of the agents playing the different roles of the protocol (generic results like [START_REF] Comon | Security properties: Two agents are sufficient[END_REF] can help),

• a finite representation of the initial knowledge of the attacker N 0 , and

• a ground term whose confidentiality must be ensured.

Note that the verification technique described above is exact: it requires no approximation on the protocol and attacker model (as long as the protocol is a program in the syntax of Section 5.1). Hence, every attack reported is a real attack, all the confidentiality attacks are reported and a negative answer is reported to the problem of membership modulo only if there exists no confidentiality attack, under the above hypotheses.

Authentication flaws like the one described in Example 3.37 can be reduced to the problem of emptiness of the intersection between the RTA A and a TA E (does L(A) ∩ L(E) = ∅). The idea is to add some tags in the agent's messages, for instance marking the end of every agent. The tags are built with function symbols which are not public (hence they can only be added by the agents, with special instructions), but we can also consider other public functions that the attacker can apply to remove the tags (modulo some rules in R for that purpose). Then the TA E characterizes some traces corresponding to authentication errors. For instance, the authentication flaw described in Example 3.37 can be characterized by the fact that C has received a message 2 (in the first session) and entered program point c 1 (this is characterized by the presence of a tag T c in the term) while S did not send it, and is still at program point s 0 (this is characterized by the absence of a tag above T c in the term). The emptiness of the intersection of L(E) and L(A) (note that this language is not considered modulo R in this case) means that there is no authentication flaw.

However, with the above model this approach is quite limited, since the agents can accept any message in the input. Hence, many false authentication attacks will be reported. This verification technique, related to regular tree model checking, would make more sense with a model with some conditionals in the agents, between instructions recv(x) and send(s).

Conclusion

In this chapter, we have studied the closure of RTA languages under term rewriting, and proposed an algorithm to decide that a given term belong to the closure of an RTA language by linear and invisibly pushdown TRS.

This class of tree automata is thought to be well suited for the automatic verification of some infinite state systems, and in particular for the verification of traces or equivalence properties of security protocols, using regular tree model checking like techniques. In this context, it would be interesting to extend the result of Theorem 3.27 to invisibly pushdown (non-linear) TRS, in order to handle axioms like decrypt(encrypt(x, y), y) = x. We are also interested about the symmetric form of the TRS of [START_REF] Chabin | Visibly pushdown languages and term rewriting[END_REF], whose rhs's are not single variables but have the form f (x 1 , . . . , x n ).

In section 2.5, of chapter 2 we have also mentioned the possibility to define RTA as sets of Horn clauses and the use of general purpose first order theorem proving tools in order to decide properties like the ones related to the rewrite closure. Such an approach could be interesting for instance for the extension of RTA with equational tests like in [JRV08], in order to be able to capture conditionals in the model of security protocols presented in Section 5.

Another use of TAGED in model checking has been recently studied in [START_REF] Courbis | Taged approximations for temporal properties model-checking[END_REF]. We did not manage to fully study this work, but it seems that, even if the application is very close, the use of TAGED is very different than the one presented here.

In section 2.2, we add a visibly constraints to RTA that allows to determinize them, but not to complement them. In the context of the analysis and processing of trees containing data, like XML documents, it could be interesting to find a decidable class of tree automata with (dis)equality constraints closed under complement.

Chapter 4

Emptiness Decision for TAGED

As mentioned in section 2.1 the emptiness decision problem has been shown decidable for several subclasses of TAGED in [START_REF] Filiot | Tree automata with global constraints[END_REF]. It is decidable for positive TAGED, for negative TAGED but also for vertically bounded TAGED which allow to mix equalities and disequalities up to a certain point. The decision procedure of the emptiness problem decidability for vbTAGED uses elegant intermediate results. However, we did not manage to enhance these techniques to have a positive result for a full TAGED class.

The decision procedure for negative TAGED is a reduction of the emptiness problem to a problem of verification of a system of set constraints. The proof of decidability of this result has been done in [START_REF] Charatonik | Set constraints with projections are in NEXPTIME[END_REF]: it translates the system of set constraints into a formula, and show that if there exists a model for the formula then there exists a finite one. Then, the rest of the proof shows how to produce an herbrand model (i.e. a model which is a term) from a generic model. To extend to the full class of TAGED, we need to add equality tests. Unfortunately they lead to more complex formula, where the proof of the existence of a Herbrand formula seems harder. On the other hand, the encoding of TAGED do not require all the logic formula used for the translation of set constraints.

Charatonik also proved in [START_REF] Charatonik | Automata on dag representations of finite trees[END_REF] the decidability of emptiness problem for the class of DAG-automata, using similar techniques and notations as the ones in [START_REF] Charatonik | Set constraints with projections are in NEXPTIME[END_REF]. In fact, we will show an equivalence between t-dag automata and negative TAGED in the first section. The idea is that the maximal sharing property of t-dags ensure that two different nodes necessarily represents two different terms. Hence to provide the inequality q ≈ q ′ in a term it suffices to guarantee that, in the dag representation, no node represents a term recognized by both q and q ′ . Once again, this technique does not work with equality tests, because t-dag automata cannot enforce multiple use of a state in a run to correspond to only one node in the t-dag. However, we managed to

proof. Let P = 2 Q \ {Q ′ ⊆ Q | ∃q 1 , q 2 ∈ Q ′ , q 1 ≈ q 2 }. Let ∆ ′ be the set of transition rules of the form {f (Q 1 , . . . , Q n ) → Q ′ where f ∈ Σ n , Q 1 , . . . Q n , Q ′ ∈ P and for all q ∈ Q ′ , there exists q 1 ∈ Q 1 , . . . , q n ∈ Q n such that f (q 1 , . . . , q n ) → q ∈ ∆} Let F ′ = {{q f } | q f ∈ F } We define the t-dag automaton B = Σ, P, F ′ , ∆ ′ .
⇒: Let t be a term recognized by A and let r be a successful run of A on t. Let us define a mapping r ′ from the nodes of G = dag(t) to 2 Q . Using the canonical description of the nodes of G of being the set of subterms of t, we define r ′ (t ′ ) = {q | ∃p ∈ Pos(t), t| p = t ′ , r(p) = q} for all subterm t ′ of t. Since, there is no subterm t ′ of t such that ∃p 1 , p 2 ∈ Pos(t), t| p 1 = t| p 2 = t ′ and r(p 1 ) ≈ r(p 2 ), then, there is no subterm t ′ of t such that r ′ (t ′ ) contains two different states q 1 and q 2 such that q 1 ≈ q 2 . Hence, for all subterm t ′ of t, r ′ (t ′ ) ∈ P . Moreover, since r is an accepting run, r ′ (t) is a singleton {q f } where q f ∈ F , so r ′ (t) ∈ F ′ .

Let us show that r ′ is compatible with ∆ ′ . Let t ′ be a subterm of t such that t ′ (ε) ∈ Σ n . If n = 0, then, by construction, for all q ∈ r ′ (t ′ ), there exists some leaf position p of t such that r(p) = q, hence, there exists

t(p) → r(p) ∈ ∆. So t(p) → r ′ (t ′ ) ∈ ∆ ′ .
If n > 0, then for all q ∈ r ′ (t ′ ), there exists a position p such that t| p = t ′ and r(p) = q. Hence, there exists a transition rule t(p)(q 1 , . . . , q n ) →∈ ∆, such that, for all i, 1 ≤ i ≤ n, r(p.i) = q i and t| p.i = t ′ | i . Hence, for all i, 1 ≤ i ≤ n, q i ∈ r ′ (t ′ | i ), so we have that t(p)(r ′ (t ′ | 1 ), . . . , r ′ (t ′ | n )) → r ′ (p) ∈ ∆ ′ . So r ′ is compatible with ∆ ′ and is a successful run of B on G.

⇐: Let G = dag(t) be a t-dag recognized by B, and r ′ a successful run of B on G. Let us define by induction a mapping r from Pos(t) to Q, such that for all p ∈ Pos(t), r(p) ∈ r ′ (t| p ), and which is compatible with ∆. We start with r(ε) = q f where r ′ = {q f }, q f being a state of F . By induction, for all position p ∈ Pos(t), such that t(p) ∈ Σ n , n > 0, and r(p) = q ∈ r ′ (t| p ), by construction of ∆ ′ there exists q 1 ∈ r ′ (t| p.1 ), . . . , q n ∈ r ′ (t| p.n ) such that t(p)(q 1 , . . . , q n ) → q ∈ ∆. We define r(p.i) = q i for all i, 1 ≤ i ≤ n, and the position p of r is compatible with ∆. And for all position p ∈ Pos(t) such that t(p) ∈ Σ 0 and r(p) ∈ r ′ (t| p ), by construction of ∆ ′ there exists t(p) → r(p) ∈ ∆. The mapping r is then compatible with ∆, and r(ε) ∈ F , so r is a successful run of ta(A).

In order to prove that r is a successful run of A, we only have to prove that the relation ≈ is respected. For all q 1 , q 2 ∈ Q such that q 1 ≈ q 2 , there is no set Q ′ ⊆ Q, Q ′ ∈ P such that Q ′ contains both q 1 and q 2 . So, by construction of r, there is no subterm t ′ of t, such that there exists two positions p 1 , p 2 ∈ Pos(t) with r(p 1 ) = q 1 , r(p 2 ) = q 2 and t| p 1 = t| p 2 = t ′ . So ≈ is respected by r and t, and r is a successful run of A on t 2

2 Deciding Emptiness of TAGED

We use here the same vocabulary and the similar constructions as the ones introduced by Charatonik in [START_REF] Charatonik | Automata on dag representations of finite trees[END_REF] for the emptiness decision for t-dag automata. The general idea is to prove that for each term recognized by a TAGED, one can build another term of bounded height that is also recognized. In order to do this, we will need to work on the t-dag representation of the terms to preserve the (dis)equality properties required by the TAGED. The main difference with the pumping for tdag automata is that, here, the t-dag is labelled by sets of states, like in the proof of Theorem 4.2, since each node corresponds to several positions in the term recognized by the TAGED, instead of states, since t-dag automata directly runs on t-dags. We first introduce an example that we will refer to all along this section.

Example 4.3 Let

A = Σ, Q, F, ∆, ≈ A , ≈ A be the TAGED such that • Σ = {a : 0, g : 1, f : 2, h : 3}; • Q = {q 0 , q 1 , q 2 , q 3 , q 4 , q f }; • F = {q f };
• ∆ = {a → q 0 , g(q 0 ) → q 0 , g(q 0 ) → q 1 f (q 1 , q 0 ) → q 2 , g(q 2 ) → q 3 , g(q 3 ) → q 3 g(q 2 ) → q 4 , h(q 2 , q 3 , q 4 ) → q f } • q 1 ≈ A q 1 ;

• q 3 ≈ A q 4

Let t = h(f (g(g(a)), g(g(a))), g(g(f (g(g(a)), g(a)))), g(f (g(g(a)), a))). The figure 4.1 gives a graphic representation of t, and of a successful run of A on t. Note that g(g(a)) is the only term recognized (several times) by q 1 , and that the terms recognized respectively by q 3 and q 4 are different.

Mapping Nodes to a Set of States

We begin by defining a mapping from the set of nodes of a t-dag to the subsets of states of a TAGED, according to a given run. Definition 4.4 Let t be a term recognized by an accepting run r of A Let G = (V, succ, λ) = dag(t). We define the function states r : V → 2 Q , the following way: states r (v) = {q | ∃p ∈ Pos(t), t| p = term(G| v ) ∧ r(p) = q}. For all node v and for all set P ⊆ Q, if states r (v) = P , we say that v provides P . q 2 q 1 q 0 q 0 q 0 q 0 q 0 q 3 q 3 q 2 q 1 q 0 q 0 q 0 q 0 q 4 q 2 q 1 q 0 q 0 q 0 The figure 4.2 shows the t-dag representation G of the term t of example 4.3, where we write at each node v, the couple λ G (v) : states r (v).

We will present several transformations on t-dags. Given a t-dag G = (V, succ, λ) = dag(t) and a run r of a TAGED on t, we will define several subgraphs or t-dag whose set of nodes will be a subset of V . However, we will always manipulate state r as it is defined on all V (and hence, on all subset of V ). In particular, the following properties will still hold for every node of V , even if we consider these nodes in the set of nodes of a smaller t-dag. Proposition 4.5 Given a t-dag G representing a term t and an accepting run r of a TAGED A on t, the following properties hold:

1. let u be the root of G, then states r (u) = {q f } for some q f ∈ F 2. if q 1 ≈ A q 2 there exists at most one node v ∈ V such that q 1 and/or q 2 ∈ states r (v)

3. if q 1 ≈ A q 2 there is no node v ∈ V such that states r (v) contains both q 1 and q 2 4. ∀v ∈ V labeled by f ∈ Σ n , ∀q ∈ states r (v), ∃f (q 1 , . . . , q n ) → q ∈ ∆ such that ∀i, 1 ≤ i, ≤ n, q i ∈ states r (succ(i, v))
proof. 1 -r is an accepting run so there exists some q f ∈ F such that r(ε) = q f . By definition of states r , since term G (u) = t = t| ε , we have that states r (u) is the singleton {q f }.

2 -If neither q 1 nor q 2 occur in r, then by definition of states r there is no node v such that states r (q) contains q 1 or q 2 , and we are done. Otherwise, either q 1 or q 2 occurs at least once in r. Wlog, assume that q 1 h : occurs in states r (v) for some node v. By definition of states r , there exists some position p ∈ Pos(t) such that r(p) = q 1 , and term G (v) = t| p . For every node v ′ of G such that either q 1 or q 2 belongs to states r (v ′ ), there exists a position p ′ ∈ Pos(t) such that r(p ′ ) = q 1 or q 2 . Since r satisfies the equality constraints and since ≈ A is reflexive and symmetric, we have that t| p = t| p ′ . Hence term G (v) = term G (v ′ ), so v = v ′ . v is therefore the unique node of G such that states r (v) may contain q 1 and q 2 .

{q f } g : {q 3 } g : {q 3 } f : {q 2 } g : {q 0 , q 1 } g : {q 0 } a : {q 0 } f : {q 2 } g : {q 4 } f : {q 2 }
3 -If r contains only one of the states q 1 or q 2 , or none of them, then the property is obviously satisfied. So assume there is at least one occurrence of each of them in r. Let v 1 be a node of G such that q 1 ∈ states r (v 1 ). By definition of states r there is a position p 1 ∈ Pos(t) such that term G (v 1 ) = t| p 1 and r(p 1 ) = q 1 . For every node v 2 of G such that q 2 ∈ states r (v 2 ), there exists p 2 ∈ Pos(t) such that r(p 2 ) = q 2 and term G (v 2 ) = t| p 2 . Since r satisfies the disequality condition, we have that t| p 1 = t| p 2 , so term G (v 1 ) = term G (v 2 ). Hence v 1 = v 2 , and q 2 ∈ states r (v 1 ). By a symmetric reasoning, we have that for every node v 2 such that q 2 ∈ states r (v 2 ), q 1 ∈ states r (v 2 ). So there is no node v such that states r (v) contains both q 1 and q 2 . 4 -Let v be a node of G labeled by f ∈ Σ n , and let q be a state in states r (v). By definition of states r , there exists a position p ∈ Pos(t) such that r(p) = q and term G (v) = t| p . By definition of a run, we know that there exist a rule f (q 1 , . . . , q n ) → q ∈ ∆ where q i = r(p.i) for all i. For all i, 1 ≤ i ≤ n, we have that term G (succ(i, v)) = t| p.i . Hence, by definition of states r , q i = r(p.i) ∈ states r (v i ) for all i. The rule f (q 1 , . . . , q n ) → q satisfies the wanted condition. 2

Definitions and Notations

In order to prove the existence of a small enough term for every nonempty TAGED language, we will need to manipulate some new objects that we introduce here. Let G = (V, succ, λ) be a t-dag on a signature Σ, and some linear ordering < on function symbols of Σ. By induction, we define ≺ on V to extend the "lies below" partial order into a linear ordering the following way: let v 1 , v 2 be in V , v 1 ≺ v 2 if and only if:

• v 1 lies below v 2 ; or • v 1 and v 2 have the same height, and λ(v 1 ) < λ(v 2 ); or

• v 1 and v 2 are of same height, λ(v 1 ) = λ(v 2 ) ∈
Σ n , and succ(1, v 1 ), . . . , succ(n, v 1 ) is lower than succ(1, v 2 ), . . . , succ(n, v 2 ) wrt the lexicographic extension of ≺.

Let us define the order ⊏ on tuples of nodes of

G: v 1 1 , . . . , v k 1 ⊏ v 1 2 , . . . , v m 2 if and only if • max 1≤i≤k {h(v i 1 )} < max 1≤j≤m {h(v j 2 )} or • 1. max 1≤i≤k {h(v i 1 )} = max 1≤i≤m {h(v j 2 )} and 2. v 1 1 , . . . v k 1 is strictly smaller than v 1 2 , . . . v m 2 wrt the lexico- graphic extension of ≺.
Note that since ≺ is a linear ordering on nodes of G, ⊏ is a linear ordering on tuples of nodes of G.

A pointer is a pair (P, i), where P is a subset of Q and i is a number. We write P [i] instead of (P, i). Given a t-dag G representing a term t, r an accepting run of a TAGED A on t, we say that the pointer P [i] points to the i-th (according to the order ≺) node v such that states r (v) = P . By index of a given node v (in symbols, ind r (v)) we mean the number i such that the pointer states r (v)[i] points to v. A transition with pointers, is an expression of the form f (P 1 [i 1 ], . . . , P k-1 [i k-1 ], P k , P k+1 [i k+1 ], . . . , P n [i n ]) → P , where P, P 1 , . . . , P n ⊆ Q A We say that such a transition is compatible with some node v of G if

• k is the main position of v;

• P = states r (v);
• for all i, 1 ≤ i ≤ n, P i = states r (succ(i, v)).

Building a Skeleton

Our goal here will be to define a directed acyclic graph, whose node set is a subset of the node set of G, from which we can infer a t-dag representing a shorter term, that will be recognized by the same TAGED. The construction will first keep all the main path of the roof of the t-dag. But to have a smaller t-dag, it will try to use as less nodes as possibles for every secondary position. However, we cannot use a single node for each set of states in states r (V G ), since it may broke some (dis)equalities. We define more formally this situation. Definition 4.6 Let G be a t-dag representing a term t, and r be a successful run of a TAGED A on t. Let P 1 , . . . , P n ⊆ Q and v a node of G. We say that there is a fork of degree m at the node v and at position k wrt P 1 , . . . , P n if there exists m nodes v 1 , . . . v m in G such that

• λ G (v i ) = • • • = λ G (v m ) = f ∈ Σ n ; • for all i, 1 ≤ i ≤ m, k is the main position of v i ; • for all i, 1 ≤ i ≤ m, succ(k, v i ) = v;
• and for all i, j,

1 ≤ i ≤ m, 1 ≤ j ≤ n, states r (succ(j, v i )) = P j .
Intuitively, a fork of degree m is a situation where m nodes are labeled by the same function symbol, have the same main successor, and all their successors represent terms that are respectively recognized by the same states by A in r. Since those m nodes represent m different terms, if we replace all their secondary successors by the same nodes, we may break some disequality constraints. So to build our skeleton, we will need to generate m different sequences of nodes providing the sets P 1 , . . . , P n . Note that a fork may be of degree 1. Here is the construction of our skeleton, respecting these observations. Definition 4.7 Given a t-dag G representing t, a TAGED A and an accepting run r of A on t, we want to build a directed acyclic S r G whose node set is a subset of V G , and such that each node is labeled by a transition with pointers to some other nodes below.

We apply the following procedure that marks nodes of V G and define a labeling of each marked node by a transition rule with pointers:

1. Let u be the root of G we mark u and all the nodes in its main path.

2. For h = h(G) to 1 for each fork of degree m at the node v ′ and position k wrt P 1 , . . . , P n , we define

λ S (v i ) = f (P 1 [ind r (v 1 i ′ )], . . . P k-1 [ind r (v k-1 i ′ )], P k , P k+1 [ind r (v k+1 i ′ )], . . . , P n [ind r (v n k ′ )]) → states r (v i ) for all i, 1 ≤ i ≤ m, where v 1 1 ′ , . . . v k-1 1 ′ , v k+1 1 ′ , . . . , v n 1 ′ ⊏ . . . , ⊏ v 1 m ′ , . . . , v k-1 m ′ , v k+1 m ′ , . . . , v n m
′ are the first (according to the linear ordering ⊏) m sequences of nodes of G providing the sets P 1 , . . . , P k-1 , P k+1 , P n . We say that the fork defines those labels. Then we mark the nodes pointed by all the pointers P j [ind r (v j i ′ )] and all the nodes on their main path. We say that the fork marked those nodes.

for each marked leaf

v of G, we define λ S (v) = λ G (v) → states r (v)
We define V S as the set of nodes of V G that have been marked during the procedure. We define the successor relation succ S over V S by v ′ = succ S (v) if and only if v ′ is the main successor of v in G.

We define the direct acyclic labeled graph S r G = V S , succ S , λ S .

The figure 4.3 shows the result of this construction applied to the t-dag of figure 4.2. Note that there is a fork of degree 2 involving the two nodes labeled by f .

We will show that this construction is well-defined and that it satisfies several useful properties. First, we will prove the following lemma on the construction. Lemma 4.8 Let G be a t-dag representing a term t, and r a successful run of a TAGED A on t. Then, given a fork of degree m occurring in the procedure of definition 4.7, there is at most m -1 nodes of indexes greater than 1 used in the transition rules defined by this fork, and the maximal index used in such a transition is m.

h({q 2 }[1], {q 3 }, {q 4 }[1]) → {q f } g({q 3 }) → {q 3 } g({q 2 }) → {q 3 } f ({q 0 , q 1 }, {q 0 }[1]) → {q 2 } g({q 0 }) → {q 0 , q 1 } g{q 0 } → {q 0 } a → {q 0 } g({q 2 }) → {q 4 } f ({q 1 , q 0 }, {q 0 }[2]) → {q 2 }
proof. Given a fork of degree m at a marked node v ′ at position k wrt P 1 , . . . , P n that labels m marked nodes v

1 . . . v m with λ S (v j ) = f (P 1 [ind r (v 1 j ′ )], . . . , P k , . . . P n [ind r (v n j ′ )]). Let k1, . . . , k n the numbers of different nodes v 1 j ′ , . . . , v n j
′ whose indexes are used in these transitions. We can construct k 1 .k 2 . . . . .k n different sequences of the form v 1 ′ , . . . , v n ′ . As we need m different sequences, so we have that k 1 . . . . .k n ≥ m. Since we take the m first sequences according to ⊏, and that P 1 [1], . . . , P n [1] is the lowest sequence, there is a node of index 1 for each of the subsets of states, so there are (k

1 -1)+• • •+(k n -1) nodes of index greater than 1. And since k 1 . . . . .k n ≥ (k 1 -1)+• • •+(k n -1)+1, it is sufficient to have (k 1 -1) + • • • + (k n -1) ≥ m -1.
Therefore, a fork of degree m requires at most m -1 nodes of index greater than 1. In particular, the maximal index used in a transition rule defined by a fork of degree m is m. 2 Theorem 4.9 Given a t-dag G representing t, a TAGED A and an accepting run r of A on t, the directed acyclic labeled graph S r G is welldefined. Moreover, for all node v ∈ V S the height of v in S r G is equals to its height in G, all the indexes of the pointers in the transition λ S (v) are lower or equal to 2 |Q| , and the pointers point to nodes below v.

proof. First, when a node is marked, in either the initial step, or during the loop, we also mark all the nodes in its main path. Hence, since the successor of a node v in S r G is its main successor in G, we have that its height is equal in both graphs.

We will then prove the well-definition of V G and λ S (v), and the property on the indexes by proving some invariants in the procedure.

For each height h, 1 ≤ h ≤ h(G), at a given moment of the procedure, we will define the width w(h) as the number of marked nodes of G of height h. We will define mil 1 = (h) as the number of nodes

v ∈ V G of index 1 (v is of index 1 if and only if v = states r (v)[1])
of height h, and mil 1 < (h) as the number of nodes v ∈ V G of index 1 and of height strictly lower than h. Note that for all h,

1 ≤ h < h(G), mil 1 < (h + 1) = mil 1 < (h) + mil 1 = (h).
We define also mil > < (h) as the number of nodes of index greater than 1 and of height lower than h that are pointed by some transition labelling of some marked node of height greater or equals to h, and mil > = (h) as the number of nodes of index greater than 1 and of height h that are pointed by some transition labelling some marked node of height greater than h.

For each fork of degree m, we call extra degree the number m -1. For each height h, 1 ≤ h ≤ h(G), we denote ex(h) the sums of the extra degrees of all the forks at the marked nodes of height h -1.

For each height h, 1 ≤ h ≤ h(G), we will prove the following invariants on the procedure.

1. the step h define λ S (v) for all marked node v of height h; 2. The step h only mark nodes of height lower than h; 3. at the end of the step h the following inequations hold:

• w(h) + mil 1 < (h) + mil > < (h) + ex(h) ≤ 2 |Q| + ex(h). • w(h) + mil 1 < (h) ≤ 2 |Q| .
4. for all marked node v, λ S (v) points only to nodes of index lower or equal to 2 |Q| ; First, note that to prove the invariant 2, it is enough to prove that the transitions with pointers that are defined for the marked nodes of height h, all the pointers point to node of height lower than h.

Let us prove these invariants recursively. For the first step, h = h(G), w(h) = 1 since the root u of G is the only node of height h, and it is marked. There is only one fork of degree 1 at the main successor u ′ of u which is at this moment the only marked node of height h -1. Since the fork is of degree 1, we have that ex(h) = 0, and we only take the indexes of the lowest tuple of nodes. The labelling λ S (u) is hence defined and is of the form

f (P 1 [1], . . . P k-1 [1], P k , P k+1 [1], P n [1])
where f = λ G (u) ∈ Σ n , for all i, 1 ≤ i ≤ n, P i = states r (G(i)), and k is the main position of u. Since the node pointed belong to G they are necessarily of height lower than u. This transition points only to nodes of indexes 1 ≤ 2 |Q| , and hence mil > < (h) = 0. Since there is at most one node of index 1 for each set of states P ⊆ Q, and since we assume that states r (u) is the only set of states r (V G ) containing a final state, we have that mil 1 < (h) ≤ 2 |Q| -1. Hence at the end of the first step, we have that

w(h) + mil 1 < (h) ≤ 2 |Q| and w(h) + mil 1 < (h) + mil > < (h) ≤ 2 |Q| + ex(h)
. Assume now that the invariants are true at the step of height h + 1, h > 1. We will prove the correctness of the invariants one by one Invariant 1: For every marked node v of height h, its main successor v ′ is also marked and is of height h -1. Therefore, v will be involved in a fork at v ′ and will then be labeled.

Invariant 2: Let us now prove that each node pointed by a transition rule defined at this step is of height lower than h.

For each fork of degree m at some marked node v ′ of height h -1, at position k and wrt P 1 , . . . , P n , where

v 1 1 ′ , . . . v k-1 1 ′ , v k+1 1 ′ , . . . , v n 1 ′ , . . . , v 1 m ′ , . . . , v k-1 m ′ , v k+1 m ′ , . . . , v n m ′
are the first (according to the linear ordering ⊏) m sequences of nodes providing P 1 , . . . , P k-1 , P k+1 , . . . , P n .

We have to show that, for all i, 1 ≤ i ≤ m, and for all j, 1 ≤

j ≤ n, j = k, h(v j i ) ′ ≤ h. Let v j i = succ G (j, v i ). The sequences v 1 1 , . . . v k-1 1 , v k+1 1 , . . . , v n 1 , . . . , v 1 m , . . . , v k-1 m , v k+1 m , .
. . , v n m are all distinct and are such that for all i, 1 ≤ i ≤ n and all j, 1 ≤ j ≤ m, j = k, states r (v i j ′ = P i ). Let j be the number such that

v 1 j , . . . v k-1 j , v k+1 j , . . . , v n j
is the greatest of those sequences wrt ⊑.

For all i, 1 ≤ i ≤ m we have that v 1 i ′ , . . . , v k-1 i ′ , v k+1 i ′ , . . . , v n i ′ ⊑ v 1 j , . . . , v k-1 j , v k+1 j , . . . , v n j , which implies that max 1≤s≤n,s =k {h(v s i ′ )} ≤ max 1≤s≤n,s =k {h(v s j )}
, and since all v j i are of height less or equal to the main successor of v i , they are all of height lower or equal to h. Invariant 3: A marked node of height h at which occurs a fork of degree m, is the common main successor of m different marked nodes of height h + 1, so the number of marked nodes that are main successors of marked nodes of height h + 1 is w(h + 1)ex(h + 1). Since a node of height h is either a main successor of m nodes for some m, or a node of index 1, or a node of index greater than 1 pointed by some node of height h > 1, we have that w(h

) ≤ w(h + 1) -ex(h + 1) + mil 1 = (h) + mil > = (h). Since mil 1 < (h) = mil 1 < (h + 1) -mil 1 = (h), we have that w(h) + mil 1 < (h) ≤ w(h + 1) + mil 1 < (h + 1) -ex(h + 1) + mil > = (h). By recurrence hypothesis, we have that w(h+1)+mil 1 < (h+1)+mil > < (h+1) ≤ 2 |Q| +ex(h+1), from which we can derive w(h+1)+mil 1 < (h+1)-ex(h+1) ≤ 2 |Q| -mil > < (h+ 1). Therefore, w(h) + mil 1 < (h) ≤ 2 |Q| -mil > < (h + 1) + mil > = (h)
. By definition, every node counted in mil > = (h) is also counted in mil > < (h + 1), so we clearly have mil > = (h) ≤ mil > < (h + 1). Hence, the invariant w(h) + mil 1 < (h) ≤ 2 |Q| is respected. For each fork of degree m at a marked node of height h -1, by lemma 4.8, the number of nodes of index greater than 1 pointed by some pointer in a transition defined by this fork is at most m -1. Hence, the total number of nodes of index greater than 1 and of height lower than h pointed by some pointer at some transition labelling a node of height h is bounded by ex(h). So we have the following inequality:

mil > < (h) ≤ mil > < (h + 1) -mil > = (h) + ex(h).
Using the previously proved inequality, it follows directly that the invariant w(h)

+ mil 1 < (h) + mil > < (h) = 2 |Q| + ex(h) is also respected.
Invariant 4: from the previous invariant, we can deduce w(h) ≤ 2 |Q| , so there cannot be a fork of degree greater than w(h) at a marked node of height h -1. Then, by lemma 4.8, we have that the maximal index of a node pointed by a labelling of a marked node of height h is 2 |Q| . 2

The use of the order ⊏ ensures that every pointer points to nodes below. In [START_REF] Charatonik | Automata on dag representations of finite trees[END_REF], the order used is the lexicographic extension of without consideration of the maximal height amongst the nodes of the sequences. Hence, assume that at some fork of arity 2, we need two distinct sequences v 1 1 , . . . , v 1 n and v 2 1 , . . . , v n 2 . Then, if they are two different nodes v n ≺ v n ′ in G which are the two lowest nodes such that state r (v n ) = state r (v n ′ ) = P n , the two first sequences according to the lexicographic extension of ≺ will be v 1 , v 2 , . . . v n and v 1 , v 2 , . . . v n ′ . But nothing can guarantee that v n ′ lies below the fork. Intuitively, S r G gives a reduced construction of a t-dag representation of a term recognized by the same TAGED. It can be seen as a skeleton, since it only contains the longest paths of the t-dag, but give the hints to build the whole t-dag. The t-dag that we can infer from S r G will have less states than G since we bound the number of nodes used at secondary positions. However, we are not yet able to bound the total number of states that such a t-dag will have. We will need to operate some transformations on S r G . To be sure that we keep the properties that allow one to build a t-dag, we will regroup these properties under the name of skeleton. Definition 4.10 Given a t-dag G = V G , succ G , λ G representing a term t, given a TAGED A, and an accepting run r of A on t, a semi-skeleton of G and r is a directed acyclic labeled graph S = (V S , succ S , λ S ) such that

• V S ⊆ V G , • V S contains the root of G,
• for each node v in V S , λ S (v) is a transition with pointers, compatible with v,

• each node v such that λ S (v) = f (P 1 [i 1 ], . . . , P k , . . . , P n [i n ]) → P has a unique immediate successor succ S (v) such that states r succ S (v) = P k ,

• for all pointer P [i] occurring in a transition labelling a node v such that

P [i] points to some node v 0 in V G , v 0 is in V S .
Moreover, a semi-skeleton S of G is a skeleton if for all pointer P [i] used in a transition labelling a node v such that P [i] points to some node v 0 , v 0 lies below v in S.

A node v of S is a milestone if it is either the root u of G or if it is pointed by some pointer P [i] in a transition labeling some node of S. It is called an ordinary node if it is neither a milestone nor a node with more than one predecessor.

Note that each node of a semi-skeleton has at most one immediate successor. In particular, a semi-skeleton not a t-dag. We want the properties of a skeleton to characterize S r G .

Proposition 4.11 Let G be a t-dag representing a term t, and r be an accepting run of a TAGED A on t. S r G is a skeleton, and has at most 2 2|Q| milestones proof. It follows directly from the above definition and from the theorem that S r Q is a skeleton. The maximal index of a node pointed in some transition in S r G is 2 |Q| . Since a milestone of S r Q is either such a node or the root u of G, and since u is the unique node such that states r (u) contains a final state, we have that the number of milestones of

S r Q is bounded by 2 |Q| × 2 |Q| = 2 2|Q| . 2
As previously mentioned, we want to generate from S r G , and more generally, from any semi-skeleton, some t-dag with a bounded number of states which will be eventually represent term recognized by the TAGED. We define here how we can obtain a directed ordered labeled graph from a semi-skeleton. Definition 4.12 Given a semi-skeleton S of a t-dag G and a run r, the induced graph of S is the unique directed ordered labeled graph

G ′ = V G ′ , succ G ′ , λ G ′ such that • V G ′ = V S • for all v ∈ V S , if λ S (v) = f (P 1 [i 1 ], . . . , P k , . . . , P n [i n ]) → P then -λ G ′ (v) = f -succ G ′ (k, v) = succ S (v) -for all j = 1, . . . , k -1, k + 1, . . . , n, succ G ′ (i, v) is the node pointed by P j [i j ].
We will focus on semi-skeleton whose induced graphs are t-dags: Definition 4.13 A (semi-)skeleton is said perfect if its induced graph is a t-dag.

Let us prove that we can build a t-dag from S r G .

Proposition 4.14 Let G be a t-dag representing a term t, and r be an accepting run of a TAGED A on t. The directed acyclic labeled graph S r G is a perfect skeleton.

proof.

Let G ′ = V G ′ , succ G ′ , λ G ′ be the induced graph of S r G .
In order to prove that G ′ is a t-dag, we first have to prove that it is acyclic. An immediate successor of a node v in G ′ is either an immediate successor of v in G or a node pointed by the labelling for v in S. In both cases, it is a node below v in G, and hence, G ′ is an acyclic graph. Moreover, G ′ is labeled on Σ, and each node labeled with a function symbol of arity n has exactly n immediate successors.

We still have to prove that two subdags of G ′ rooted at two different nodes are not isomorphic. Let us first recall that G is a t-dag, and the height of each node in G ′ is equals to its height in S r G which is equals to its height in G. Let v 1 ′ and v 2 ′ be two different nodes in V G ′ and let

G 1 ′ = G ′ | v 1 ′ and G 2 ′ = G ′ | v 2 ′ . If v 1 ′ and v 2 ′ have different height, they
cannot represent the same term, and we are done. So we can assume that v 1 ′ and v 2 ′ are of same height. Let us prove that they represent different terms by induction on their common height.

If v 1 ′ and v 2 ′ are of height 1 in G ′ , then, they are of height 1 in G and hence, are representing constant symbols. Since v 1 ′ = v 2 ′ and G is a t-dag, they represent two different constant symbols.

Assume by induction that no two closed subgraphs of G ′ rooted at nodes of height h are isomorphic, and that v 1 ′ and v 2 ′ are of height

h + 1. If λ(v 1 ′ ) = λ(v 2 ′ ), then G ′ 1 and G 2 ′ are not isomorphic. Assume that λ(v 1 ′ ) = λ(v 2 ′ ).
If their main successors are at different positions k 1 and k 2 (assume wlog k 1 < k 2 ), then the k 1 -th immediate successor of v 1 ′ has a greater height than the k 1 -th immediate successor of v 2 ′ in G ′ . Hence the closed subgraphs rooted at those two nodes are not isomorphic and neither are G 1 ′ and G 2 ′ . Assume that the main successors of v 1 ′ and v 2 ′ are at the same position k. If they are different, then by induction hypothesis, the closed subgraphs rooted at them are non-isomorphic and neither are G 1 ′ and G 2 ′ . So we can assume that v 1 ′ and v 2 ′ are labeled by the same n-ary symbol f in G ′ , and that they have the same main successor v ′ at the same position k.

Let

f (P 1 1 [i 1 1 ], . . . , P 1 k , . . . P 1 n ) → P 1 be the labelling of v 1 ′ in S and f (P 2 1 [i 2 1 ], . . . , P 2 k , . . . P 2 n [i 2 n ]) → P 2 be the labelling of v 2 ′ in S.
If there exists some j such that P 1 j = P 2 j , then P 1 j [i 1 j ] and P 2 j [i 2 j ] necessarily point to two different nodes. Hence, the j-th immediate successors of v 1 ′ and v 2 ′ are different, and by induction their closed subgraphs are non-isomorphic. So neither are G ′ 1 and G ′ 2 .

Otherwise, we have that P 1 j = P 2 j for all j. So according to the fork conditions, we have that the two tuples i 1 1 , . . . , i 1 k-1 , i 1 k+1 , . . . , i 1 n and i 1 1 , . . . , i 1 k-1 , i 1 k+1 , . . . , i 1 n are distinct. So there is some j such that i 1 j = i 2 j and hence P 1 j [i 1 j ] and

P 1 j [i 1 j ] point to two different nodes. So succ G ′ (j, v 1 ′ ) = succ G ′ (j, v 2 ′
), and by induction, their closed subgraphs are non-isomorphic, and neither are G 1 ′ and G 2 ′ 2

Properties of Semi-Skeleton

We are able to build a perfect skeleton from a given t-dag and the run of a TAGED, and to build its induced graph that we proved to be a t-dag. It is not sufficient for our purpose, since we want this t-dag to be recognized by the same TAGED. In this section, we will prove that this is the case. First, we have to show that given an induced graph of a perfect semi-skeleton, and that for each node, one can always find a transition rule of the TAGED consistent with the mapping of the nodes.

Lemma 4.15 Let G = V G , succ G , λ G be a t-dag representing a term t, let A = Q, F, ∆, C be a TAGED, and r an accepting run of A on t. Let S = V S , succ S , λ S be a perfect semi-skeleton of G and r, and

G ′ = V G ′ , succ G ′ , λ G ′ its induced graph. Then, for all v ∈ V G ′ such that
G is such that states r (v) may contain both q 1 and q 2 , we have that the subgraphs of G ′ representing t ′ | p 1 and t ′ | p 2 are rooted by two different nodes v 1 ′ and v 2 ′ . Since G ′ is a t-dag, we hence have that t

′ | p 1 = t ′ | p 2 . 2

Pumping Within a Skeleton

We now are able to build a skeleton with a bounded number of milestones from which we can build a t-dag that is recognized by the TAGED we want. However, bounding the number of milestones is not enough, since there can be an unbounded number of ordinary nodes. In this section, we show than we can pump on ordinary nodes as we would have done in TA.

Proposition 4.17 Given a (perfect) semi-skeleton S of a t-dag G and of a run r of a TAGED A, if there exists a sequence (v 0 , v 1 , . . . v n ) of ordinary nodes of S such that

• for all i, 0 ≤ i ≤ m -1, v i+1 is the immediate successor of v i , and
• the set of states provided by v 1 and v m are the same. then the graph S ′ obtained from S by removing the nodes v 1 , . . . , v m-1 and defining v m as the immediate successor of v 0 S is a (perfect) semiskeleton of G and r.

proof. It is obvious that the set of vertices is still a subset of the vertices of G. Since the root of G is a milestone, it will not be removed, and neither will the nodes pointed by any labelling since they are all milestones. The transitions with pointers label the same nodes, so they still are compatible with their respective nodes. Let f (P 1 [i 1 ], . . . , P k , . . . , P n [i n ]) be the transition labelling v 0 . Thus, since v 1 and v m provides the same set of states, and since S is a semi-skeleton, v m provides P k . The other nodes' immediate successors have not changed. So S ′ is a semi-skeleton If S is a perfect semi-skeleton, then its induced graph G ′ is a t-dag. Let G ′′ be the induced graph of S ′ . It is the same graph excepted that it does not contain the nodes v 1 , . . . , v m-1 and that succ

G ′′ (k, v 0 ) = v m .
It is easy to see that there is a path between two nodes of G ′′ if and only if there is a path between those two nodes in G ′ . Hence G ′′ is acyclic. Since the labeling and the arity of each node in G ′′ are the same than the ones in G ′ , it is sufficient to prove that two subgraphs of G ′′ rooted at two different nodes are not isomorphic.

Let

v 1 ′ and v 2 ′ be two different nodes of G ′′ . Let G 1 ′ = G ′ | v 1 ′ , G ′ 2 = G ′ | v 2 ′ G 1 ′′ = G ′′ | v 1 ′ and G 2 ′′ = G ′′ | v 2 ′ . The node v m is a successor of v 1 ′ in S ′ if and only if v 1 ′ is v 0 or v 0 is one of its successors. So if v m is not a successor of v 1 ′ in S ′ , then none of the nodes v 1 , . . . , v m is a successor of v 1 ′ in S.
And since v 1 , . . . , v m are not milestones, none of these nodes belongs to G ′ 1 , and so no node of

G 1 ′ is removed from S to obtain S ′ . Hence G 1 ′ = G 1 ′′ . If v m is neither a successor of v 1 ′ in S ′ nor one of v 2 ′ , then, since G 1 ′ is not isomorphic to G 2 ′ , neither are G 1 ′′ and G 2 ′′ . If v m is a successor of both v 1
′ and v 2 ′ in S ′ , then, since they are different, they have different height in S ′ , and hence different height in

G ′′ . Hence G 1 ′′ and G 2 ′′ are not isomorphic. Assume that v m is a successor of v ′ 1 in S ′ but not of v 2 ′ . Then we have G 2 ′ = G 2 ′′ . If G 1
′′ and G 2 ′′ are isomorphic, they have the same set of positions. Moreover, let p be the position of v m in G 1 ′′ , then p is a position of G 2 ′′ , and

G 1 ′′ | p and G 2 ′′ | p are isomorphic. Since, G 1 ′′ | p = G ′′ | vm = G ′ | vm and G 2 ′′ | p = G 2 ′ | m it means that G ′ | vm is isomorphic to G 2 ′ | p . But v m does not belong to G 2 ′ , so G 2 ′ [p] = v m , and since G ′ is a t-dag, G ′ | vm and G 2 ′ | p are not isomorphic. Hence G 1
′′ and G 2 ′′ are not isomorphic, so G ′′ is a t-dag and S ′ is a perfect semi-skeleton.

2 Note that this transformation does not preserve the skeleton property, since a labelling of a node below v m may point to a node that will be below it in S but not in S ′ .

The figure 4.4 shows a pumping of the skeleton of figure 4.3. Note that it only removed one node. Then, a graphic representation of its induced graph G ′ is done in figure 4.5 where at each node v we wrote λ ′ G (v) : states r (v). The order of the edges of the nodes is misleading. The leftmost edge on the graphic is actually its second edge. Now, we have all the components we need in order to reduce the emptiness problem of TAGED to the existence of a small term recognized by the automaton.

Theorem 4.18 Let A be a TAGED. The language L(A) is not empty if and only if it contains a term t such that dag(t) has less than 2 3|Q| + 2 2|Q|+1 + 2 |Q| nodes.

proof. It is obvious that if such a term exists, L(A) is not empty. Reciprocally, if L(A) is not empty, then, there exists a term t ∈ L(A). Let r be a successful run of A on t. Let G = dag(t). Then according to propositions 4.11 and 4.14, S r G is a perfect skeleton of G that has less than 2 2|Q| milestones. Since each node that does not have a predecessor is necessarily a milestone, there are at most 2 |Q| node with more than one predecessors. By repeating several times the construction of proposition 4.17 we can obtain a perfect semi-skeleton such that there is at most 2 |Q| successive ordinary nodes. So there exists a perfect semiskeleton with less than (2 |Q| + 1)(2 2|Q| + 2 |Q| ) = 2 3|Q| + 2 2|Q|+1 + 2 |Q| nodes. The induced graph G ′ of this perfect-semi skeleton is a t-dag whose node set is the same and representing a term t ′ which is recognized by A according to theorem 4.16.

2 It follows directly from this theorem a non-deterministic procedure to decide whether the language of a TAGED is empty. q 2 q 1 q 0 q 0 q 0 q 3 q 2 q 1 q 0 q 0 q 0 q 4 q 2 q 1 q 0 q 0 q 0 q 0 proof. Following the previous theorem, to decide whether the language of a TAGED A is empty, we can guess a t-dag G with at most O(2 3|Q| ) nodes, and a labelling states : V G → 2 Q and verify that we can deduce an accepted run of A on the term t represented by G. Such a run exists, if the root of A is labeled by a single final state, if no node is labeled by two different states q 1 , q 2 such that q 1 ≈ q 2 , and if each labeling verifies the property 4 of Proposition 4.5. We can check the labeling of the root in constant time. Then, for each node of G, we can verify that no two nodes in disequality relations label G in O(|Q| 2 ), and the property 4 in O(|Q| m ) where m is the maximal arity of the function symbols of Σ. Since we can assume that m is a constant, the verification for each node can be done in polynomial time. As there are O(2 3|Q| ) nodes to check, we can verify that G is the t-dag representation of an accepted term in exponential time. Hence, the emptiness problem for TAGED is in NEXPTIME. 2

Corollary 4.19 The emptiness problem for TAGED is decidable in NEXPTIME

h({q 2 }[1], {q 3 }, {q 4 }[1]) → {q f } g({q 2 }) → {q 3 } f ({q 0 , q 1 }, {q 0 }[1]) → {q 2 } g({q 0 }) → {q 0 , q 1 } g{q 0 } → {q 0 } a → {q 0 } g({q 2 }) → {q 4 } f ({q 1 , q 0 }, {q 0 }[2]) → {q 2 }
With our running example, given the induced graph of the pumping of the initial skeleton, we obtain the term and the successful run of the figure 4.6.

Conclusion

In this chapter, we answered positively the open problem of decidability of the emptiness problem for the TAGEDS [START_REF] Filiot | Tree automata with global constraints[END_REF]. We give an upper bound on the complexity, NEXPTIME. Indeed, the emptiness decision problem for t-dag automata presented in [START_REF] Charatonik | Automata on dag representations of finite trees[END_REF], that we adapt to prove our result, has been shown NP-complete. Since we use quite a same construction but with a data input exponential in size, it could be possible that emptiness for TAGED is NEXPTIME-complete.

As a direct consequence, our result extends the satisfiability result of the fragment of the tree query-logic described in [START_REF] Filiot | Tree automata with global constraints[END_REF] (TQL was introduces in [START_REF] Cardelli | Tql: A query language for semistructured data based on the ambient logic[END_REF]). Moreover, it can also be used to encode some structural constraints on XML documents, and satisfies some extension of MSO on trees. However, these results cannot be applied to the full class of TAGC, presented in chapter 2 because the disequality is not limited to irreflexive relations. The emptiness decision procedure for this full class is more complex and will be presented in the next chapter.

Chapter 5

Deciding Emptiness for TAGC

We proved in the last chapter that the emptiness problem is decidable for TAGED. This result can be used to decide the satisfiability of structural constraints on XML documents. As we showed in the example 2.6, some constraints known as "key constraints" cannot be encoded into a TAGED. Yet, they are common integrity constraints on XML documents (see [START_REF] Fan | On XML integrity constraints in the presence of DTDs[END_REF]). Those require to have reflexive disequality constraints, which are provided by TAGC.

In order to prove the decision result of emptiness to TAGC, there are two problems to solve. First, the constraints of TAGED are only positive conjunctive, as for PCTAGC. And second, reflexive disequalities (constraints of the form q ≈ q) are not handled by TAGED.

We solve the first problem in the first section of this chapter. We show that TAGC and PCTAGC are equally expressive. In order to do this, we add some arithmetic constraints on the number of different terms occurring in a given state. We show that negations of atomic constraints ≈ and ≈ can be eliminated using new states and arithmetic constraints. Then, we show that TAGC with those arithmetic constraints can be encoded by PCTAGC. We also prove some properties of this extension of TAGC.

The pumping technique described in chapter 4 cannot deal with reflexive disequality constraints. So in the second section we present a new pumping lemma and apply it to PCTAGC to prove the decidability of the emptiness problem. The pumping lies on some well quasi-order, leading to a non-primitive recursive complexity. The complexity gap between this emptiness decision procedure, and the one seen in the previous chapter justifies the interest of presenting both of them, one being slightly more complex, but dealing with a more expressive class than the other.

We show that the emptiness decision algorithm can also be applied to the combination of TAGC with local tests between sibling subtrees a la [START_REF] Bogaert | Equality and disequality constraints on direct subterms in tree automata[END_REF] (section 3), and to unranked ordered labeled trees (section 4). This demonstrates the robustness of the method.

As an application of our results, in section 5 we present a (strict) extension of the monadic second order logic on trees whose existential fragment corresponds exactly to TAGC. In particular, we conclude its decidability.

TAGC with Arithmetic Constraints

We study first the addition of counting constraints to TAGC.

Definition 5.1 Let Q be a set of states. A linear inequality over Q is an expression of the form q∈Q a q .|q| ≥ a or q∈Q a q . q ≥ a where every a q and a belong to Z.

Let r be a run on a term t of a TA or TAGC A over F and with state set Q, and let q ∈ Q. The interpretations of |q| and q wrt r (and t) are defined respectively by the following cardinalities |q| r = |r -1 (q)| and q r = {s ∈ T (F) | ∃p ∈ Pos(t), r(p) = q, s = t| p } . This permits to define the satisfiability of linear equalities wrt t and r and the notion of successful runs for extensions of TAGC with atomic constraints which can have the form of the above linear inequalities.

Example 5.2 Let us add a new argument to the dishes of to the menu of Example 2.6 which represents the price coded on two digits by a term N (d 1 , d 0 ). We add a new state q p for the type of prices, and other states q cheap , q moderate , q expensive , q chic describing price level ranges, and transitions 0|1 → q cheap , 2|3 → q moderate , 4|5|6 → q expensive , 7|8|9 → q chic and N (q cheap , q d ) → q p ,... The price is a new argument of L 0 , L and M , hence we replace the transitions with these symbols in input by L 0 (q id , q t , q p ) → q L , L(q id , q t , q p , q L ) → q L , M (q id , q t , q p , q L ) → q M . We can use a linear equality |q cheap | + |q moderate | -|q expensive | -|q chic | ≥ 0 to characterize the moderate menus, and |q expensive | + |q chic | ≥ 6 to characterize the menus with too many expensive dishes. A linear equality q p ≤ 1 expresses that all the dishes have the same price. = 0(φ) be a Diophantine equation with m variables x 1 , . . . , x m , i j,k ≥ 0 for all j ≤ n, k ≤ m and a 1 , . . . , a n ∈ Z. We will construct a TAGC[≈, |.| Z ] A such that L(A) = ∅ iff there exists a valuation of x 1 , . . . , x m in N satisfying the above equation.

Relative Linear Inequalities

The most important step of the construction is that we can encode (non negative) integer multiplication with TAGC[≈,

|.| Z ].
Let us consider for instance the product x 1 .x 2 and three TAGC states q 1 , q 2 and q 12 , whose number of occurrences will represent the respective valuations of x 1 , x 2 and their product (with our notations,

|q 1 | = x 1 , |q 2 | = x 2 , |q 12 | = x 1 .
x 2 ). We use a signature with symbols a and b of arity 0, f of arity 2, and * of arity 3. For x ≥ 1, let t x be the right comb f (a, f (a, . . . , f (a, b))) with x occurrences of a and one occurrence of b. The product x 1 .x 2 is represented by

t x 1 ,x 2 := f (t x 1 , . . . , f (t x 1 , b)) with x 2 occurrences of t x 1 .
Let us now construct a TAGC[≈, |.| Z ] A * recognizing all * (t x 1 , t x 2 , t x 1 ,x 2 ). During the computation of A * , in the first argument t x 1 , every leaf labeled with a goes to the state q 1 , with the transition rule a → q 1 , and t x 1 goes to a state r 1 . For the intermediate steps, we use a state p 1 and transitions b → p 1 , f (q 1 , p 1 ) → p 1 , and f (q 1 , p 1 ) → r 1 . We proceed in the same manner for t x 2 with the states q 2 , r 2 , p 2 . Finally, for the recognition of the third argument t x 1 ,x 2 by A * , every leaf labeled with a goes to the state q 12 , every subterm t x 1 goes to a state r ′ 1 and the term t x 1 ,x 2 goes to r 12 . For this purpose we have the transitions a → q 12 , b → p ′ 1 , f (q 12 , p ′ 1 ) → p ′ 1 , f (q 12 , p ′ 1 ) → r ′ 1 , and b → p 12 , f (r ′ 1 , p 12 ) → p 12 , f (r ′ 1 , p 12 ) → r 12 . Finally, we add a rule * (r 1 , r 2 , r 12 ) → q * to A * . Let r be a run of A * on a term t = * (t x 1 , t x 2 , t 3 ) similar to the one presented in Figure 5.1. By construction, the number of occurrences of

q 1 in r is x 1 , i.e. |q 1 | r = x 1 . Similarly, |q 2 | r = x 2 . Let us consider the constraint C * = |r ′ 1 | = |q 2 | ∧ r 1 ≈ r ′ 1 (
for simplicity, we use linear equalities representing the conjunction of two linear inequalities). By imposing the constraint C * to the run r of A * , we ensure that t 3 , the third argument of t, contains x 2 nested copy of t x 1 . It follows that the number |q 12 | r of occurrences of q 12 in the run r is equal to x 1 .x 2 .

The general construction of the TAGC[≈, |.| Z ] A = Q, F, F, C, ∆ associated to the above Diophantine equation (φ) follows the same principle, except that we may have several level of nesting in a term like t 3 above. For encoding the product of more than two integers, we have in A some constraints ≈ and |.| Z similar to the above ones, and an addi-

q * r 1 q 1 p 1 q 1 p 1 r 2 q 2 p 2 q 2 p 2 r 12 r ′ 1 q 12 p ′ 1 q 12 p ′ 1 p 12 r ′ 1 p 12 Figure 5.1: A run on * (t x 1 , t x 2 , t x 1 .x 2 )
tional constraint a j .|q j | = 0 where each q j is uniquely associated to a variable x j , as above.

Let W be the set containing all the variables of (φ), {x 1 , . . . , x m } and all the prefixes of the monomials of (φ) x i j,1 j . . . x i j,m m for all j ≤ n (we consider every monomial as a word over the alphabet {x 1 , . . . , x m }). Let us denote the prefix ordering over strings by , and for every words v, v ′ , w such that w = v.v ′ (i.e. v w) we recall that wv = v ′ and let w ÷ v be the first letter of v ′ when this latter word is not empty. We assume below that W is ordered arbitrarily in a sequence without duplicates -→ w = (w 1 , . . . , w N ).

The signature F contains the symbols a, b, and f with the respective arity 0, 0 and 2 as above, and two symbols c of arity 0 and g of arity 2. Let Q = {q w , s w , r v w , p v w | v, w ∈ W, v w} ∪ {s 0 } and F = {s w N }. The transitions of ∆ are the following: a → q w , b → p v w , f (q w , p v w ) → p v w , f (q w , p v w ) → r v w for all v, w ∈ W with v w, and f (r v w , p v.x i w ) → p v.x i w , f (r v w , p v.x i w ) → r v.x i w , for all v, w ∈ W and x i variable of (φ) (i ≤ m), with v.x i w. Moreover, we also have: c → s 0 , g(r w 1 w 1 , s 0 ) → s w 1 and g(r w ′ w ′ , s w ) → s w ′ for all w, w ′ ∈ W such that w = w i and w ′ = w i+1 in the sequence -→ w , for some i < N .

We can observe that with these transitions, if r is an accepting run of ta(A) on some term t, then for all w ∈ W, the state s w occurs exactly once in r at some position p w ∈ 2 * , and the leaves of r|p w .1 are all labelled by the state q w . Moreover, the state q w occurs only in this subterm of r.

Finally, the constraint C of A is defined as the conjunction of the following atomic constraints: In iii., the a j 's are the coefficients of (φ) and w j = x i j,1 1 . . . x i j,m m (we assume that the n first elements of the sequence -→ w correspond to these monomials).

With the above observation, the construction of the transition rules of A, and the above constraints i. and ii. we have that for all run r of A on a term t, all variables x i of (φ) and all w.x i ∈ W, |q w.x i | r = |q w | r . |q x i | r . It follows, using the constraint iii, that L(A) = ∅ iff (φ) has a solution in N. 2

Natural Linear Inequalities

We present now a restriction on linear equalities which enables the reduction to PTAGC when combined with ≈ and ≈ as global constraints.

Definition 5.4 A natural linear inequality over Q is a linear inequality as in Definition 5.1 whose coefficients a q and a all have the same sign.

Note that it is equivalent to consider inequalities in both directions whose coefficients are all non-negative, like a q .|q| ≤ a, with a q , a ∈ N, to refer to -a q .|q| ≥ -a. We also consider linear equalities a q .|q| = a, with a q , a ∈ N, to refer to a conjunction of two natural linear disequalities. The types of the natural linear inequalities are denoted by |.| N and . N . Below, we shall abbreviate these two types by N.

The main difference between the linear inequalities of type |.| Z and |.| N (and respectively . Z and . N ) is that the former permits to compare the respective number of occurrences of two states, like e.g. in |q| ≤ |q ′ |, whereas the latter only permit to compare the number of occurrences of one state (or a sum of the number occurrences of several states with coefficients) to a constant as e.g. in |q| ≤ 4 or |q| +2.|q ′ | ≤ 9. This difference permits to encode the (in)equalities with additional states and (dis)equalities constraints, and to reduce TAGC[≈, ≈, N] to PCTAGC[≈, ≈], which we will prove emptiness decidability in next section.

The proof that TAGC[≈, ≈, N] are equally expressive as PTAGC[≈ , ≈] works in two steps. In the first step (Proposition 5. Lemma 5.6 Every conjunction ϕ of natural linear inequalities over Q can be effectively rewritten into an equivalent disjunction 1≤i≤n q∈Q α |q| ∧ α q for some n ∈ N, where α |q| (resp. α q ) is either |q| = a q or |q| ≥ a q for some a q ∈ N, or ⊤ (resp. q = b q or q ≥ b q for some b q ∈ N, or ⊤). is the conjunction of all the inequalities of ϕ . of the form q = a or q ≥ a where q does not occur in another inequality, and ψ . contains all the other inequalities. Let

ψ |.| = 1≤i≤k q∈Q a i q .|q| ≤ a i ∧ 1≤j≤l q∈Q b j q .|q| ≥ b j
for some k and l, with a i q , a i , b j q , b j ∈ N for all i ≤ k, j ≤ l. Let q be a state for which either there exists i ≤ k such that a i q = 0 or there exists j ≤ l such that b j q = 0. Then, we do one of the following transformations.

1. If there exists some i such that a i q = 0, then we define

s q = inf ⌊ a i a i q ⌋ 1 ≤ i ≤ k, a i q = 0 .
If |q| > s q , then there exists some inequality which can not be satisfied. So in order to erase the occurrences of |q| in the inequalities, we can make an enumeration of the values of |q| between 0 and s q . We replace | is defined as follows: First, we replace every inequality

q ′ ∈Q a i q ′ • |q ′ | ≤ a i of ψ |.| by q ′ ∈Q\{q} a i q ′ • |q ′ | ≤ sup{0, a i -s • a i
q } and we replace every inequality

q ′ ∈Q b j q ′ • |q ′ | ≥ b i of ψ |.| by q ′ ∈Q\{q} b j q ′ • |q ′ | ≥ sup{0, b j -s • b j q }.
Then, for every inequality with no occurrence of a state in the lefthand side, which can be seen as an inequality between integers with a 0 on the left-hand side:

• if the inequality is true, then we erase it,

• if the inequality is false, then we delete the whole conjunction, which cannot be satisfied with the value given to |q|.

2. Otherwise (for all a i q = 0), there exists some j such that b i q = 0 and we define

s q = sup ⌈ b j b j q ⌉ 1 ≤ j ≤ l, b j q = 0 .
Note that if |q| ≥ s q , then all the inequalities involving q are satisfied. So in order to erase the occurrences of |q|, we only have to do an enumeration of the value of |q| between 0 and s q -1 and to erase all the inequalities with an occurrence of |q| if |q| ≥ s q . We replace

ϕ |.| by a disjunction 0≤s≤sq ϕ s |.| where ϕ s |.| = χ s |.| ∧ ψ s |.| and χ s |.| = χ |.| ∧ q = s if s < s q , χ s |.| = χ |.| ∧ q ≥ s is s = s q and ψ s |.
| is defined as above (except that there is no a i q = 0) if s < s q and ψ sq |.| is as ψ |.| where every inequality q∈Q b j q ≥ b j where b j q = 0 is deleted. Note that, at this point of the procedure, q does not occur anymore in any ψ We apply the same procedure to ϕ . , which becomes a disjunction 1≤j≤m χ j . for some n where each χ j . is a conjunction of (in)equalities of the form q = a or q ≤ a. Hence, we have that φ is equivalent to

1≤i≤n χ i |.| ∧ 1≤j≤m χ j . .
Since each q occurs at most once in each χ i |.| and once in each χ j . , we can obtain what we are looking for by rewriting this expression into disjunctive normal form and adding a ⊤ symbol for each q than does not occur in χ i |.| , and one for each that does not occur in χ i . . 2

Let C be the constraint of a PTAGC[≈, ≈, N] A. The PTAGC[≈, ≈ , N] A ′ , defined as a copy of A where the constraint C ′ is the disjunctive normal form of C is obviously equivalent to A. By associativity of ∧ one can rewrite C ′ the following way

C ′ = 1≤i≤n (C i + ∧ C i N )
where, for all i, 1 ≤ i ≤ n, C i + is a conjunction of atomic constraints of the form q ≈ q ′ or q ≈ q ′ , and C i N is a conjunction of natural arithmetic constraints. Let A i be a copy of A with the constraint

C i = C i + ∧ C i N .
We have that L(A) = ∪ 1≤i≤n L(A i ). Since PCTAGC[≈, ≈] are closed by union (see proposition 2.11), we only have to prove that each A i is equivalent to a PCTAGC. Lemma 5.7 Given a PTAGC[≈, ≈, N] A = Σ, Q, F, F, C, ∆ , with C = C + ∧ C N , where C + is a conjunction of atomic constraints of the form q ≈ q ′ or q ≈ q ′ , and C N is a conjunction of natural arithmetic constraints, one can effectively compute a PTAGC[≈, ≈] A ′ such that L(A ′ ) = L(A).

proof. First, we just rewrite C + into a disjunction of conjunction of simple arithmetic constraints like in Lemma 5.6.

Since PCTAGC are closed by union, it suffices to effectively constructs a PCTAGC for each PTAGC[≈, ≈, N] with constraints of the form C + ∧ C ′ N where C ′ N is of the form q∈Q p |.| (q) ∧ p . (q). Let us then assume that C N The general idea is to have multiple copies of the states involved in natural (in)equality constraints, and to create ≈ and ≈ relations between them, in order to ensure that the wanted cardinality of the original state is reached by any successful run. Then we count the first occurrence of each state, in order to ensure that any successful run also have the correct number of occurrences of each original state. First, we compute for each q ∈ Q the number c(q) of copies of this state that we need, depending on the constraints on q in D N .

• if α q is ⊤ then c(q) = 1,

• if α q is q = a q then c(q) = a q , each state will recognize only one of the a q different subterms,

• if α q is q ≥ a q then c(q) = a q +1, the extra state will recognize the possible extra terms.

We construct now a PCTAGC

[≈, ≈] A ′ = Q ′ , F, F ′ , C ′ + , ∆ ′ recog- nizing L(A). Let us define M = max sup b q q ∈ Q, α q is q = b q , sup b q q ∈ Q, α q is q ≥ b q .
Intuitively, in a run, M is the maximal number of occurrences of a given state in a run that is needed to satisfy the arithmetic constraints.

Then we define a new set of copies of states of Q, Q = q∈Q,c(q)>0 {q 1 , . . . , q c(q) }, and

Q ′ = Q × {0, . . . , M + 1} Q .
Hence a state of Q ′ is a pair q i , δ where q ∈ Q, 1 ≤ i ≤ c(q), q i ∈ Q and δ is a mapping δ : Q → {0, . . . , M + 1}. The number M + 1 is needed to deal with constraints of the form |q| = M . If there are strictly more than M occurrences of q, then the term should not be accepted. So if more than M occurrences occur, it suffices to say that M + 1 copies occurred. Hence, when counting the number of occurrences of a given state, we will bound the count at M + 1.

The intuition behind the definition of states of Q ′ is that the index i in q i is the number (up to M + 1) of terms encountered so far in the disjoint, and let A ′ be the disjoint union of all the A σ (constructed as in Proposition 2.11). It is clear that A ′ is positive. Let us show that L(A ′ ) = L(A).

Lemma 5.10 L(A ′ ) = L(A).

proof. Let t ∈ L(A ′ ). By construction, there exists a solution σ ∈ sol (φ A ) such that t ∈ L(A σ ). Let r ′ be a successful run of A σ on t. By definition of C σ , for each i ≤ p, there exists n i = |σ(X i )| copies of q i : q 1 i , . . . , q n i i , and each copy q j i occurs exactly once in r ′ at a position called p j i (i.e. r -1 (q j i ) = {p j i }). Moreover, still by definition of C σ , the subterms t| p j i are pairwise disjoint. The mapping θ which associate to each variable in X i the corresponding position p j i is isomorphic to σ. Let r be obtained from r ′ by replacement of every subrun r ′ | p j i by a run of ta(A) headed by q i . It is clear by construction of ∆ σ that r is a run of ta(A). Moreover, following the property of θ above, t, r |= C -and t, r |= C + ∧ C N . It follows that r is a successful run of A on t.

Conversely, let t ∈ L(A), and let r be a successful run of A on t. By definition, for every

d k = ¬(q u k ≈ q u ′ k ) in C -, there exists two positions p d k u k and s d k u k in Pos(t) such that t| p d k u k = t| s d k u ′ k
, and for every

e ℓ = ¬(q v ℓ ≈ q v ′ ℓ ) in C -there exists two positions p e ℓ v ℓ and s e ℓ v ′ ℓ in Pos(t) such that t| p e ℓ v ℓ = t| s e ℓ v ′ ℓ
. The set of subterms of t at these positions define therefore a solution σ of φ A . We can construct from r a run successful run r ′ of A σ on t. The principle of the construction is to replace every subrun of r at the position e.g. p d k u k by a run of A σ headed by a copy of q u k . Therefore, t ∈ L(A σ ) ⊆ L(A ′ ).

2 2

Since TAGC[≈, ≈] are a particular case of TAGC[≈, ≈, N], one can construct an equally expressive PCTAGC. Indeed, given a TAGC[≈, ≈ ] A, Proposition 5.9 permits to construct a PTAGC[≈, ≈, N] B ′ with L(B ′ ) = L(A) and then Proposition 5.5 permits to construct a PTAGC B with L(B) = L(B ′ ) = L(A). Using DNF for the constraints of B and the construction of Proposition 2.11 for union (which preserves the property of being PCTAGC), we obtain a PCTAGCA ′ such that L(A ′ ) = L(A). Hence the following corollary.

Corollary 5.11 Given a TAGC A, one can effectively construct a PC-TAGC A ′ such that L(A) = L(A ′ ).

The complexity of this effective construction has not been studied. However, the constructions used for the propositions and lemma of this section are all primitive recursive. The decidability procedure that we will present in next section for PCTAGC implies a non-primitive recursive complexity. Regarding this, we can consider to have the translation from TAGC into PCTAGC for free.

Emptiness Decision Algorithm

In this section we prove the decidability of the emptiness problem for TAGC. Using the corollary 5.11 it suffices to prove the decidability of the emptiness problem for PCTAGC.

The decidability of emptiness for PCTAGC is proved in three steps. In subsection 2.1, we present a new notion of pumping which allows to transform a run into a smaller run under certain conditions. In subsection 2.2, we define a well quasi-ordering ≤ on a certain set S. In subsection 2.3, we connect the two previous subsections by describing how to compute, for each run r with height h = h(r), a sequence e h , . . . , e 0 of elements of S satisfying the following fact: there exists a pumping on r if and only if e i ≤ e j for some h ≥ i > j ≥ 0. Finally, all of these constructions are used as follows. Suppose the existence of an accepting run r on a term t. If r is "too high", the fact that ≤ is a well quasi-ordering and the property of the sequence imply the existence of such i, j. Thus, it follows the existence of a pumping providing a smaller accepting run r ′ . We conclude the existence of a computational bound for the height of an accepting run, and hence, decidability of emptiness.

Global Pumpings

Pumping lemma is a traditional concept in automata theory, and in particular, they are very useful to reason about tree automata. The basic idea is to convert a given run r into another run by replacing a subrun at a certain position p in r by a run r ′ , thus obtaining a run r[r ′ ] p . Pumpings are useful for deciding emptiness: if a "big" run can always be reduced by a pumping, then decision of emptiness is obtained by a search of an accepting "small" run.

For plain tree automata, a necessary and sufficient condition to ensure that r[r ′ ] p is a run is that the resulting states of r| p and r ′ coincide, since the correct application of a rule at a certain position depends only on the resulting states of the subruns of the direct children. In this case, an accepting run with height bounded by the number of states exists, whenever the accepted language is not empty.

When the tree automaton has global equality and disequality constraints, the constraints may be falsified when replacing a subrun by a new run. For PCTAGC, we will define a notion of pumping ensuring that the constraints are satisfied. This notion of pumping requires to perform several replacements in parallel. We first define the sets of positions involved in such a kind of pumping. Definition 5.12 Let t be a term of T (Σ). Let i be an integer between 0 and h(t). We define H i as {p ∈ Pos(t) | h(t| p ) = i} and Ȟi as {p.j ∈ Pos(t) | h(t| p.j ) < i ∧ h(t| p ) > i}.

Example 5.13 According to Definition 5.12, for our running example (Example 2.6), we have the H i and Ȟi presented in Figure 5 The following lemma is rather straightforward from the previous definition.

Lemma 5.14 Let t be a term of T (Σ). Let i be an integer between 0 and h(r). Then, any two different positions in H i ∪ Ȟi are parallel, and for any arbitrary position p in Pos(r) there is a position p in H i ∪ Ȟi such that, either p is a prefix of p, or p is a prefix of p.

proof. For the first fact, note that any proper prefix p of a position p in H i ∪ Ȟi satisfies h(t| p ) > i. Thus, such a p is not in H i ∪ Ȟi . For the second fact, consider any p in Pos(t). If h(t| p ) ≤ i holds, then the smallest position p satisfying p < p and h(t| p) ≤ i is in H i ∪ Ȟi , and we are done. Otherwise, if h(t| p ) > i holds, then the smallest position p of the form p.1. . . . .1 and satisfying h(t| p) ≤ i is in H i ∪ Ȟi , and we are done.

2

Definition 5.15 Let A be a PCTAGC. Let r be a run of A on a term t. Let i, j be integers satisfying 0 ≤ j < i ≤ h(r). A pump-injection I : (H i ∪ Ȟi ) → (H j ∪ Ȟj ) is an injection function such that the following conditions hold:

(C 1 ) I(H i ) ⊆ H j and I( Ȟi ) ⊆ Ȟj . (C 2 ) For each p in H i ∪ Ȟi , r(p) = r(I(p)). (C 3 ) For each p1 , p2 in H i ∪ Ȟi , (t| p1 = t| p2 ) ⇔ (t| I(p 1 ) ) = t| I(p 2 ) )).
Let {p 1 , . . . , pn } be H i ∪ Ȟi more explicitly written. The pair formed by the run r[r| I(p 1 ) ] p1 . . . [r| I(pn) ] pn and the term t[t| I(p 1 ) ] p1 . . . [t| I(pn) ]( p)n is called a global pumping on r and t with indexes i, j, and injection I.

By the condition C 2 , r[r| I(p 1 ) ] p1 . . . [r| I(pn) ] pn is clearly a run of ta(A) on t[t| I(p 1 ) ] p1 . . . [t| I(pn) ]( p)n , but it is still necessary to prove that it is a run of A.

By abuse of notation, when we write r[r| I(p 1 ) ] p1 . . . [r| I(pn) ] pn , or t[t| I(p 1 ) ] p1 . . . [t| I(pn) ]( p)n we sometimes consider that I and {p 1 , . . . , pn } are still explicit, and say that it is a global pumping with some indexes 0 ≤ j < i ≤ h(r).

i.b. If h(t| p 1 .α ) ≥ i and h(t| p 2 .α ) < i, then t| p 1 .α = t| p 2 .α holds, and moreover, h(t| p 1 .α ) = i + k 1 for some k 1 ≥ 0, and p 2 .α belongs to Ȟi . By Lemma 5.17, h(t ′ | p 1 .α ) = j + k 1 holds. By Condition (C 1 ) of the definition of pump-injection, h(t ′ | p 2 .α ) < j holds. Thus, t ′ | p 1 .α = t ′ | p 2 .α holds, and we are done.

i.c. The case where h(t| p 1 .α ) < i and h(t| p 2 .α ) ≥ i hold is analogous to the previous one. i.d. If h(t| p 1 .α ), h(t| p 2 .α ) < i, then p 1 .α, p 2 .α belong to Ȟi , say p 1 .α is p1 and p 2 .α is p2 . Therefore, t ′ | p 1 .α is t| I(p 1 ) and t ′ | p 2 .α is t| I(p 2 ) . By Condition (C 3 ) of the definition of pump-injection, (t| p1 = t| p2 ) ⇔ (t| I(p 1 ) = t| I(p 2 ) ) holds. Thus, (t|

p 1 .α = t| p 2 .α ) ⇔ (t ′ | p 1 .α = t ′ | p 2 .α
) holds and we are done.

2

As a consequence of the previous lemmas, we prove that the result of a global pumping is a run. Lemma 5.20 Let A be a PCTAGC. Let r be a run of A on a term t. Let r ′ , t ′ be the global pumping with indexes 0 ≤ j < i ≤ h(r) and injection I such that r ′ = r[r| I(p 1 ) ] p1 . . . [r| I(pn) ] pn and t ′ = t[t| I(p 1 ) ] p1 . . . [t| I(pn) ]( p)n . Then, r ′ is a run of A on t ′ . proof. By Condition (C 2 ) of the definition of pump-injection, in order to see that r ′ is a run, it suffices to see that all global constraints are satisfied. Thus, let us consider two different positions p 1 , p 2 of Pos(r ′ ) involved in an atom of the constraint of A, i.e. either r ′ (p 1 ) ≈ r ′ (p 2 ) or r ′ (p 1 ) ≈ r ′ (p 2 ) occurs in the constraint of A. According to Lemma 5.14, we can distinguish the following cases:

• Suppose that a position in H i ∪ Ȟi , say p1 , is a prefix of both p 1 , p 2 . Then, r ′ | p 1 = r| I(p 1 ).(p 1 -p 1 ) and r ′ | p 2 = r| I(p 1 ).(p 2 -p 1 ) hold. Hence, r ′ | p 1 and r ′ | p 2 are also subruns of r occurring at different positions. Thus, since r is a run, they satisfy the atom involving r ′ (p 1 ) and r ′ (p 2 ).

• Suppose that two different positions in H i ∪ Ȟi , say p1 and p2 , are prefixes of p 1 and p 2 , respectively. Then, r ′ | p 1 = r| I(p 1 ).(p 1 -p 1 ) and r ′ | p 2 = r| I(p 2 ).(p 2 -p 2 ) hold. By the injectivity of I, I(p 1 ) = I(p 2 ) holds. Moreover, by Lemma 5.14, I(p 1 ) I(p 2 ) holds. Hence, as before, r ′ | p 1 and r ′ | p 2 are subruns of r occurring at different (in fact, parallel) positions. Thus, they satisfy the atom involving r ′ (p 1 ) and r ′ (p 2 ).

• Suppose that one of p 1 , p 2 , say p 1 , is a proper prefix of a position in H i ∪ Ȟi , and that p 2 satisfies that some position in H i ∪ Ȟi is a prefix of p 2 . It follows that h(r ′ | p 2 ) is smaller than or equal to j, and r ′ | p 2 is also a subrun of r. Moreover, p 1 is also a position of r, r ′ (p 1 ) = r(p 1 ) holds, and h(r| p 1 ) = i + k holds for some k > 0. Hence, t| p 1 = t ′ | p 2 holds. Since r is a run and r ′ | p 2 is a subrun of r, the atom involving r(p 1 ) and r ′ (p 2 ) is necessarily of the form r(p 1 ) ≈ r ′ (p 2 ). Thus, the atom involving r ′ (p 1 ) and r ′ (p 2 ) is necessarily of the form r ′ (p 1 ) ≈ r ′ (p 2 ). By Lemma 5.17, h(t ′ | p 1 ) is j + k. Therefore, t ′ | p 1 = t ′ | p 2 holds, and hence, such an atom is satisfied for such positions in r ′ .

• Suppose that both p 1 , p 2 are proper prefixes of positions in H i ∪ Ȟi . Then, p 1 , p 2 are positions of t satisfying h(r| p 1 ), h(r| p 2 ) ≥ i. Moreover, r(p 1 ) = r ′ (p 1 ) and r(p 2 ) = r ′ (p 2 ) hold. Since r is a run, the atom involving r(p 1 ) and r(p 2 ) is satisfied in the run r for positions p 1 and p 2 . By Lemma 5.19, (t| p 1 = t| p 2 ) ⇔ (t ′ | p 1 ) = t ′ | p 2 ) holds. Thus, the atom involving r ′ (p 1 ) and r ′ (p 2 ) is satisfied in the run r ′ for positions p 1 and p 2 . 2

A Well Quasi-Ordering

In this subsection we define a well quasi-ordering. It assures the existence of a computational bound for certain sequences of elements of the corresponding well quasi-ordered set. It will be connected with global pumpings in the next subsection.

Definition 5.21 Let ≤ denote the usual quasi-ordering on natural numbers. Let n be a natural number. We define

• the extension of ≤ to n-tuples of natural numbers as x 1 , . . . , x n ≤ y 1 , . . . , y n if x i ≤ y i for each i in {1, . . . , n}.

•

sum( x 1 , . . . , x n ) := x 1 + • • • + x n .
• the extension of ≤ to multisets of n-tuples of natural numbers as [e 1 , . . . , e α ] ≤ [e ′ 1 , . . . , e ′ β ] if there is an injection I : {1, . . . , α} → {1, . . . , β} satisfying e i ≤ e ′ I(i) for each i in {1, . . . , α}.

• sum([e 1 , . . . , e α ]) := sum(e 1 ) + • • • + sum(e α ).

• the extension of ≤ to pairs of multisets of n-tuples of natural numbers as P 1 , P1 ≤ P 2 , P2 if P 1 ≤ P 2 and P1 ≤ P2 .

As a direct consequence of Higman's Lemma [START_REF] Gallier | What's so special about kruskal's theorem and the ordinal γ 0 ? a survey of some results in proof theory[END_REF] we have the following: Lemma 5.22 Given n, ≤ is a well quasi-ordering for pairs of multisets of n-tuples of natural numbers.

In any infinite sequence e 1 , e 2 , . . . of elements from a well quasi-ordered set there always exist two indexes i < j satisfying e i ≤ e j . In general, this fact does not imply the existence of a bound for the length of sequences without such indexes. For example, the relation ≤ between natural numbers is a well quasi-ordering, but there may exist arbitrarily long sequences x 1 , . . . , x k of natural numbers such that ( ‡) x i > x j for all 1 ≤ i < j ≤ k. In order to bound the length of sequences satisfying ( ‡), it is sufficient to force that the first element and each next element of the sequence are chosen among a finite number of possibilities. Indeed in this this case, by König's lemma, the prefix trees describing all such (finite) sequences is finite. As a particular case of this fact we have the following result.

Lemma 5.23 There exists a computable function B : N × N → N such that, given two natural numbers a, n, B(a, n) is a bound for the length ℓ of the maximum-length sequence T 1 , Ť1 , . . . , T ℓ , Ťℓ of pairs of multisets of n-tuples of natural numbers such that the following conditions hold:

1. The tuple 0, . . . , 0 does not occur in any T i , Ťi for i in {1, . . . , ℓ}.

2. sum(T 1 ) = 1 and sum( Ť1 ) = 0.

For each

i in {1, . . . , ℓ -1}, sum(T i+1 ) + sum( Ťi+1 ) ≤ a • sum(T i ) + sum( Ťi ).
4. There are no i, j satisfying 1 ≤ i < j ≤ ℓ and T i , Ťi ≤ T j , Ťj proof. We construct a rooted tree S = (V, E) labelled by sequences of pairs of multiset of n-tuples, where the depth of each node is equal to the length of the sequence labeling it and such that the set of internal nodes of S corresponds exactly to the set of sequences satisfying conditions (1) to (4). Then we show that S is finite, which implies that B(a, n) exists and is the maximal depth of S. Let V = {ε} ∪ W , where W is the set of all the sequences T 1 , Ť1 , . . . , T ℓ , Ťℓ of pairs of multisets of n-tuples satisfying the conditions (1) to (3) and such that there are no i, j, satisfying 1 ≤ i < j < ℓ and T i , Ťi ≤ T j , Ťj . This last condition, that we will refer to as (5), is weaker than (4). In particular, all sequences satisfying conditions (1) to (4) belong to W . Let E ⊆ V 2 be the set of edges containing • ε -→ T 1 , Ť1 for all sequence T 1 , Ť1 of length 1 in W ,

• T 1 , Ť1 , . . . , T i , Ťi -→ T 1 , Ť1 , . . . , T i , Ťi , T i+1 , Ťi+1 for every such couple of sequences in W .

It is quite obvious that S = (V, E) is a tree rooted at ε: ε does not have an input edge, each sequence of length 1 has a unique input edge coming from ε, and each sequence of length i > 1 has a unique input edge coming from its unique prefix sequence of length i -1.

We will call depth of a node v of S, and note d(v) the number

d(v) = 0 if v = ε and d(v) = ℓ if v is a sequence of length ℓ. It is obvious that there is always a path of length d(v) + 1 from the root to a node v ∈ V .
If a sequence T 1 , Ť1 , . . . , T ℓ , Ťℓ in W satisfies the condition (4), then any sequence T 1 , Ť1 , . . . , T ℓ , Ťℓ , T ℓ+1 , Ťℓ+1 satisfying the conditions (1) to (3) also belongs to W , because there is is no i, j such that 1 ≤ i < j < ℓ + 1 and T i , Ťi ≤ T j , Ťj .

Since there always exists such a sequence (take T ℓ+1 , Ťℓ+1 = T 1 , Ť1 ), then every sequence satisfying condition (1) to (4) is an internal node of S.

If a sequence T 1 , Ť1 , . . . , T ℓ , Ťℓ in W does not satisfy condition (4), then, by condition (5), it means that T 1 , Ť1 ≤ T ℓ , Ťℓ .

Hence no sequence T 1 , Ť1 , . . . , T ℓ , Ťℓ , T ℓ+1 , Ťℓ+1 can satisfy condition (5), and hence do not belong to W . So any sequence satisfying conditions (1) to (3) and (5) but not (4) is a leaf of S.

Moreover, with the previous result, we also know that the set of internal nodes of S is exactly the set of sequences satisfying conditions (1) to (4), and the set of leaves of S is exactly the set of sequences satisfying conditions (1) to (3), (5), but not (4).

Let us show that S is finite. First, each node v ∈ V has a finite branching: ε links to all the sequences of length 1, the number of which is bounded by condition (2); and each sequence of length i, T 1 , Ť1 , . . . , T i , Ťi can only link to sequences of length i + 1 of the following form T 1 , Ť1 , . . . , T i , Ťi , T i+1 , Ťi+1 , the number of which is bounded by condition (3).

We now have to show that there is no infinite branch in S. Assume that we have an infinite branch v 0 , v 1 , v 2 , v 3 , . . . (∀i, v i ∈ V , and (v i , v i+1 ) ∈ E). By construction, we have v 0 = ε, and for all i ≥ 1 and all j ≥ i, the prefix of length i of the sequence v j is equal to v i . Consider the infinite sequence T 1 , Ť1 , T 2 , Ť2 , . . . where for all i ≥ 1, T i , Ťi is the last element of the sequence v i . Since ≤ on pairs of multisets of n-tuples is a well quasi-ordering, there exists two indexes i, j, such that i < j and T i , Ťi ≤ T j , Ťj . Hence, all sequences v k such that k > j do not satisfy condition (5) and do not belong to V , and there is not infinite branch in S.

Now we can show the existence of B(a, n). Since S is finite we can define a number D(S) = max v∈V d(v). Consider a sequence T 1 , Ť1 , . . . , T ℓ , Ťℓ of length ℓ ≥ D(S), satisfying conditions (1) to (3). If this sequence belongs to W , since D(S) is the maximal depth of the nodes in V , it is necessarily a leaf, and hence, does not satisfy (4). And if it does not belong to W , since it satisfies conditions (1) to (3), it does not satisfy condition (5), and hence, does not satisfy condition (4). So there is no sequence of length ℓ ≥ D(S) satisfying conditions (1) to (4). So B(a, n) = D(S). D(S) is computable because S is. It can easily be built by a depth-first algorithm. Initialize S with the root ε linking to all the sequences T 1 , Ť1 of length 1 (there is a finite and computable number of them). Now, in order to construct nodes of depth (ℓ + 1) from nodes of depth ℓ, one can consider each previously built sequence T 1 , Ť1 , . . . , T ℓ , Ťℓ of length ℓ. If T 1 , Ť1 ≤ T ℓ , Ťℓ , then we reached a leaf, and do not add new nodes. Otherwise, we add all the sequences T 1 , Ť1 , . . . , T ℓ , Ťℓ , T ℓ+1 , Ťℓ+1 satisfying the conditions (1) to (3) (there is a finite and computable number of them). The algorithm stops when at some depth ℓ, all nodes of depth ℓ are leaves: then we finished the construction of S, and B(a, n) = D(S) = ℓ.

2 In order to bound the height of a term accepted by a given PCTAGC A (and of minimum height), Lemma 5.23 will be used by making a to be the maximum arity of the signature of A, and making n to be the number of states of A. [ 0,0,0,0,1,0 ] [ 0,0,1,0,0,0 , 0,0,0,1,0,0 ] 3 [ 0,0,0,0,1,0 ] [ 0,0,1,0,0,0 , 0,0,0,2,0,0 , 0,0,1,0,0,0 ] 2 [ 0,0,0,0,1,0 ] [ 0,0,1,0,0,0 , 0,0,0,3,0,0 , 0,0,1,0,0,0 , 0,0,1,0,0,0 ] 1 [ 0,0,0,4,0,0 ] [ 0,0,1,0,0,0 , 0,0,1,0,0,0 , 0,0,1,0,0,0 , 0,0,1,0,0,0 ] 0 [ 0,0,1,0,0,0 , 4,0,1,0,0,0 , 0,4,0,0,0,0 , 0,0,1,0,0,0 , 0,0,1,0,0,0 ] [ ] Figure 5.4: Multisets r H i , r Ȟi (Example 5.26).

Mapping a Run to a Sequence of the Well Quasi-Ordered Set

We will associate, to each number i in {0, . . . , h(r)}, a pair of multisets of tuples of natural numbers, which can be compared with other pairs according to the definition of ≤ in the previous subsection. To this end, we first associate tuples to terms and multisets of tuples to sets of positions.

Definition 5.24 Let A be a PCTAGC. Let q 1 , . . . , q n be the states of A. Let r be a run of A on a term t. Let P be a set of positions of r. Let t ′ be a term. We define r t ′ ,P as the following tuple of natural numbers: {p ∈ P | t| p = t ′ ∧ r(p) = q 1 } , . . . , {p ∈ P | t| p = t ′ ∧ r(p) = q n } Definition 5.25 Let A be a PCTAGC. Let r be a run of A on a term t. Let P be a set of positions of r. Let {t 1 , . . . , t k } be the set of terms {t ′ | ∃p ∈ P : t| p = t ′ }. We define r P as the multiset [r t 1 ,P , . . . , r t k ,P ].

Example 5.26 Following our running example, for the representation of the tuples of natural numbers we order the states as q d , q N , q id , q t , q L , q M . The multisets r The following lemma connects the existence of a pump-injection with the quasi-ordering relation.

Lemma 5.27 Let A be a PCTAGC. Let r be a run of A on a term t. Let i, j be integers satisfying 0 ≤ j < i ≤ h(r). Then, there exists a pumpinjection I : (H i ∪ Ȟi ) → (H j ∪ Ȟj ) if and only if r H i , r Ȟi ≤ r H j , r Ȟj . proof. ⇒. Assume that there exists a pump-injection I : (H i ∪ Ȟi ) → (H j ∪ Ȟj ). We just prove r H i ≤ r H j , since r Ȟi ≤ r Ȟj can be proved Theorem 5.31 Emptiness is decidable for PCTAGC.

proof. Let a be the maximum arity of the symbols in the signature of A. Let n be the number of states of A. Let r be an accepting run of A on a term t with minimum height.

Suppose that h(r) ≥ B(a, n) holds. Then, by Lemma 5.30, there exists a global pumping r ′ , t ′ on r and t. By Corollary 5.18, h(t ′ ) < h(t) holds. Moreover, by the definition of global pumping, r ′ (ε) = r(ε) holds. Finally, by Lemma 5.20, r ′ is a run of A on t ′ . Thus, t ′ contradicts the minimality of t. We conclude that h(t) < B(a, n) holds. The decidability of emptiness of A follows, since the existence of successful runs implies that one of them can be found among a computable and finite set of possibilities.

2 Using Lemma 5.11 and Theorem 5.31, we can conclude the decidability of emptiness for TAGC.

Corollary 5.32 Emptiness is decidable for TAGC.

Since, we used TAGC with natural arithmetic constraints to obtain this reduction, another consequence is the decidability of this class.

Equality Tests Between Brothers

The constraints of TAGC are checked once for all on a whole run. There exists another kind of equality and disequality constraints for extending TA which are tested locally at every transition step, as in the TAC that we mentioned in section 2.2. Definition 5.34 A tree automaton with constraints between brothers (TACB) is a tuple A = Σ, Q, F, F, ∆ where Σ, Q, F , F are defined as with TA and the transitions rules of ∆ have the form: f (q 1 , . . . , q n ) -→ c q, where c is a conjunction of atoms of the form i = j or i = j with 1 ≤ i, j ≤ n.

A run of the TACB A on a term t ∈ T (F) is a function r from Pos(t) into Q such that, for all p ∈ Pos(t), there exists a rule t(p) r(p.1), . . . , r(p.m) -→ c r(p) ∈ ∆ satisfying t(p) ∈ F m , and moreover, for all i = j in the conjunction c, t| p.i = t| p.j holds, and for all i = j in the conjunction c, t| p.i = t| p.j holds.

The notions of successful runs and languages can be extended straightforwardly from TA to TACB. Global constraints can also be added to TACB in the natural way. The automata of the resulting classes TACB[≈, ≈, ...] will therefore perform global and local test during their computations.

Example 5.35 Assume that the terms of Example 2.6 are now used to record the activity of a restaurant, and that we add a second argument of type q t to L 0 , L and M , so that the first argument q t will characterize the theoretical time to cook, and the second q t will characterize the real time that was needed to cook the dish. Let us replace the transitions with L 0 , L and M in input by L 0 (q id , q t , q t ) ---→ 2=3 q L , L 0 (q id , q t , q t ) ---→ 2 =3 q ′ L , L(q id , q t , q t , q L ) ---→ 2=3 q L , L(q id , q t , q t , q L ) ---→

=3

q ′ L , M (q id , q t , q t , q L ) ---→ 2=3 q M , M (q id , q t , q t , q L ) ---→ 2 =3 q ′ M , where q ′ L is a new state meaning that there was an anomaly. We also also add a transition L(q id , q t , q t , q ′ L ) → q ′ L to propagate q ′ L and M (q id , q t , q t , q ′ L ) → q ′ M . The language of the TAGC obtained is the set of records well cooked, i.e. such that for all dishes, the real time to cook is equal to the theoretical time.

3

The emptiness decision algorithm of section 2 still works for this extension of TAGC with local brother constraints. This is because a global pumping r[r| I(p 1 ) ] p1 . . . [r| I(pn) ] pn on a run r can be proved to satisfy the constraints between brothers in a completely analogous way as in the proof of Lemma 5.20 and Theorem 5.33.

Theorem 5.36 Emptiness is decidable for TACB[≈, ≈, N].

Unranked Ordered Trees

Our tree automata models and results can be generalized from ranked to unranked ordered terms. In this setting, F is called an unranked signature, meaning that there is no arity fixed for its symbols, i.e. that in a term a(t 1 , . . . , t n ), the number n of children is arbitrary and does not depend on a. Let us denote by U (F) the set of unranked ordered terms over F. The notions of positions, subterms etc are defined for unranked terms of U (F) as for ranked terms of T (F). We extend the definition of automata for unranked ordered terms, called hedge automata [START_REF] Murata | Hedge automata: a formal model for XML schemata[END_REF], with global constraints.

Definition 5.37 A hedge automaton with global constraints (HAGC) is a tuple A = Q, F, F, C, ∆ where Q, F and C are as in the definition of TAGC (def. 2.1) and the transitions of ∆ have the form a(L) → q where a ∈ F, q ∈ Q and L is a regular (word) language over Q * , assumed given by a NFA with input alphabet Q.

A run of A on an unranked ordered term t ∈ U (F) is a function r from Pos(t) into Q such that for all position p ∈ Pos(t) with n child, there exists a transition t(p)(L) → r(p) in ∆ such that r(p.1) . . . r(p.n) ∈ L. The run r is called successful if moreover r(ε) ∈ F and r |= C, where satisfiability is defined like in definition 2.1. As above, we use the notation HAGC[τ 1 , . . . , τ n ] where the τ i 's can be ≈, ≈, |.| N , . N ... a → init a,q for all q ∈ Q, where init a,q is the initial state of B a,q , @(p, q) → p ′ if there is a transition p -→ q p ′ in some B a ′ ,q ′ , and @(p, q) → q ′ if there is a transition p -→ q p ′ in some B a ′ ,q ′ , where p ′ is a final state of B a ′ ,q ′ . We can show by induction on t ∈ U (F) that t ∈ L ha(A) iff curry(t) ∈ L ta(A ′ ) . More precisely, for all t ∈ U (F), to every run r of ha(A) on t, we can associate a run r ′ of ta(A ′ ) on curry(t) with r ′ (ε) = r(ε), and reciprocally. Moreover, by construction, there exists an injective mapping θ from Pos(t) into Pos(curry(t)), such that for all p ∈ Pos(t), the states r(p) and r ′ (θ(p)) coincide and curry(t| p ) = curry(t)| θ(p) . Since curry is bijective, it follows that the run r is successful for A iff the run r ′ is successful for A ′ . 2

The following emptiness decision result is a direct consequence of Proposition 5.38 and Theorem 5.33.

Theorem 5.39 Emptiness is decidable for HAGC[≈, ≈, N].

Monadic Second Order Logic

In this section, we discuss the application of our results to second order logics interpreted over domains defined by terms. We propose a strict extension of the second order monadic logic of the tree with predicates corresponding to the above equality, disequality and arithmetic constraints, and show that satisfiability is decidable for this extension thanks to a correspondence with TAGC[≈, ≈, N].

MSO on Ranked Terms

A ranked term t ∈ T (Σ) over Σ can be seen as a model for logical formulae, with an interpretation domain which is the set of positions Pos(t). We consider monadic second order formulae interpreted on such models, built with the usual Boolean connectors, with quantifications over first order variables (interpreted as positions), denoted x, y . . . and over unary predicates (i.e. second order variables interpreted as sets of positions), denoted X, Y . . ., and with the following predicates, 1. equality: x = y, and membership: X(x) 2. labeling: a(x), for a ∈ F 3. navigation: S i (x, y), for all i smaller than or equal to the maximal arity of symbols of F (we call +1 the type of such predicates), 4. term equality: X ≈ Y , term disequality: X ≈ Y (predicate types ≈ and ≈), 5. linear inequalities: a i .|X i | ≥ a or a i . X i ≥ a, where every a i and a belong to Z (predicate types |.| Z and . Z ).

123

We write MSO[τ 1 , . . . , τ k ] for the set of monadic second order logic formulae with equality, membership, labeling predicates and other predicates of type τ 1 , . . . , τ k , amongst the above types +1, ≈, ≈, and |.| Z , . Z . We also use the notations |.| N and . N for natural linear inequalities and the abbreviations Z and N as in section 1. Let EMSO[τ 1 , . . . , τ k ] be the fragment of MSO[τ 1 , . . . , τ k ] containing the formulae of the form ∃X 1 . . . ∃X n φ such that all the atoms of type ≈, ≈, Z or N involve only second order variables amongst X 1 , . . . , X n .

A variable assignment into a term t ∈ T (Σ) is a function σ mapping first order variables into positions of Pos(t) and second order variables into subsets of Pos(t). The validity of a formula φ in a term t ∈ T (Σ) under the variable assignment σ, denoted t, σ |= φ is defined in the usual Tarksian manner, with (below, |S| denotes the cardinality of the set S): t, σ |= x = y iff σ(x) = σ(y) t, σ |= X(x) iff σ(x) ∈ σ(X) t, σ |= a(x) iff t(σ(x)) = a t, σ |= S i (x, y) iff σ(y) = σ(x).i t, σ |= X ≈ Y iff for all p in σ(X) and p ′ in σ(Y ), t| p = t| p ′ t, σ |= X ≈ Y iff for all p in σ(X) and p ′ in σ(Y ),

t| p = t| p ′ t, σ |= a i .|X i | ≥ a iff i a i .|σ(X i )| ≥ a t, σ |= a i . X i ≥ a iff i a i . {t| p | p ∈ σ(X i )} ≥ a
Example 5.40 The following formula of EMSO[≈, ≈], ∃X a (∀x X a (x) ↔ a(x)) ∧ X a ≈ X a expresses that all the subterms headed by a in a term t are pairwise different. It other words, a is used to mark monadic keys in t (see Example 2.6). This can also be expressed by X a ≤ 1.

It is well known that MSO[+1] has exactly the same expressiveness as TA [START_REF] Thatcher | Generalized finite automata theory with an application to a decision problem of second-order logic[END_REF] and therefore it is decidable. The extension MSO[+1, ≈] is undecidable, see e.g. [START_REF] Filiot | Satisfiability of a spatial logic with tree variables[END_REF], as well as MSO[+1, |.| Z ] [KR02] (the latter extension is also undecidable for unranked ordered terms when counting constraints are applied to sibling positions [START_REF] Seidl | Numerical document queries[END_REF]), but the fragment EMSO[+1, |.| Z ] is decidable [START_REF] Klaedtke | Parikh automata and monadic second-order logics with linear cardinality constraints[END_REF].

In [START_REF] Filiot | Tree automata with global constraints[END_REF] the fragment EMSO with ≈ and a restricted form of ≈ is shown decidable, with a two way correspondence between these formulae and a decidable subclass of TAGEDs. This construction can be straightforwardly adapted to establish a two way correspondence between EMSO[+1, ≈, ≈, N] and TAGC[≈, ≈, N].

Theorem 5.41 EMSO[+1, ≈, ≈, N] is decidable on ranked terms. proof. Following the same proof scheme as [START_REF] Filiot | Tree automata with global constraints[END_REF], we show that for every formula φ in EMSO[+1, ≈, ≈, N], we can construct a TAGC[≈, ≈ , N] recognizing exactly the set of models of φ. Then, the decidability of the logic follows from Theorem 5.33.

The above transformation also works in the other direction (this result is not necessary for the proof of Theorem 5.41 though): for every TAGC[≈, ≈, N], we can construct a formula φ in EMSO[+1, ≈, ≈, N], whose set of models is L(A).

Note that EMSO[+1, ≈] is strictly more expressive than MSO, since the equality between subterms is not expressible in MSO (see e.g. [CLDG + 07]). The TA construction of [START_REF] Thatcher | Generalized finite automata theory with an application to a decision problem of second-order logic[END_REF] for the decidability of MSO[+1] involves the closure under projection on components for TA languages over signatures made tuples of symbols (for the elimination of ∃ quantifiers). TAGC languages are not closed under projection, as it is already the case for simpler form tree automata with equality [START_REF] Treinen | Predicate logic and tree automata with tests[END_REF].

MSO on Unranked Ordered Terms

In unranked ordered terms of U (Σ), the number of children of a position is unbounded. Therefore, for navigating in such terms with logical formulae, the successor predicates S i (x, y) of Section 5.1 are not sufficient. In order to describe unranked ordered terms as models, we replace these above predicates S i by:

• S ↓ (x, y) (y is a child of x),

• S → (x, y) (y is the successor sibling of x).

The type of these predicates is still called +1. Note that the above predicates S 1 , S 2 , . . . can be expressed using these two predicates only.

The validity of the above atoms in a term t ∈ U (Σ) under a variable assignment σ is defined as follows.

t, σ |= S ↓ (x, y) iff there exists i such that σ(y) = σ(x).i, t, σ |= S → (x, y) iff there exists p ∈ Pos(t) and i such that σ(x) = p.i and σ(y) = p.i + 1.

It is shown in [START_REF] Seidl | Numerical document queries[END_REF] that the extension MSO[+1, |.| Z ] is undecidable for unranked ordered terms when counting constraints are applied to sibling positions.

Using the results of Section 4, and an easy adaptation of the automata construction in the proof of Theorem 5.41, we can generalize Theorem 5.41 to EMSO over unranked ordered terms.

Theorem 5.42 EMSO[+1, ≈, ≈, N] is decidable on unranked ordered terms.

Conclusion

We have proposed a decision algorithm for the emptiness problem of the class of TAGC, generalizing the result we had in chapter 4 for TAGED. Our method for emptiness decision, presented in section 2 appeared to be robust enough to deal with several extensions like global counting constraints, local equality tests between sibling subterms and extension to unranked terms. It has been since extended to equality modulo commutativity in a yet unpublished work. Another interesting subject mentioned in the introduction is the combination of the HAGC of section 4 with the unranked tree automata with tests between siblings [START_REF] Wong | Unranked tree automata with sibling equalities and disequalities[END_REF][START_REF] Löding | On nondeterministic unranked tree automata with sibling constraints[END_REF]. We come back to this point in the conclusion of the thesis.

There are some similarities between the technique presented in chapter 4 and the one presented here. They are both handling (dis)equalities depending on the height of the subterms. For each given height, they seek for terms below that are able to satisfy the constraints, and at the same time, to provide the states expecting by the transition rules. The termination of such a procedure depends on whether the number of those sets of terms for a given height is finite or not. In chapter 4, this property is satisfied because we manage to use only a finite number of milestones. Here, it works because we can order these sets with a well quasi-order, hence the non-primitive recursive complexity. A deeper study of these common properties could help in refining the complexity of those emptiness decision problems.

Another branch of research related to TAGC concerns automata and logics for data trees, i.e. trees labeled over an infinite (countable) alphabet (see [START_REF] Segoufin | Automata and logics for words and trees over an infinite alphabet[END_REF] for a survey). Indeed, data trees can be represented by terms over a finite alphabet, with an encoding of the data values into terms. This can be done in several ways, and with such encodings, the data equality relation becomes the equality between subterms. Therefore, this could be worth studying in order to relate our results on TAGC to decidability results on automata or logics on data trees like those in [Jur07, BMSS09]. Testing (dis)equalities of data with these techniques does not require the use of different tests at positions that are may be prefixes one from another. Hence, it would only use a rather limited class of TAGC, and maybe lead to some better complexity. On the other hand, representing data as terms allows to manipulate the structures of the data in order to test relations more complex than simple (dis)equalities, which are generally avoided by data automata since it easily leads to undecidability. Therefore, this approach would probably provide a less expressive model for representing XML data data documents.

Conclusion

With this thesis, we contribute to a deeper and better understanding of the tree automata with global equality and disequality constraints. We provide a model, that is TAGC[≈, ≈], that generalizes the previously existing model of TAGED. We proposed an extensive comparative study of this model, relatively to the previously existing ones.

Our major contributions are the following:

• we provided one of the first result of decidability of membership for the closure of a language of tree automata with equality constraints by a term rewriting system;

• we answer positively the emptiness problem for TAGED, and show that it is in NEXPTIME;

• we prove the decidability of the emptiness problem for the more general class of TAGC. This procedure is robust enough to handle tree automata with both global and local equality and disequality constraints.

In addition to these results, we also made some more modest contributions, which can help a better understanding of the behavior of tree automata with global constraints:

• we proved the undecidability of the regularity problem of languages of tree automata with global equality constraints;

• we showed that the class of TAGED containing only disequality constraints and the t-dag automata are equally expressive.

We already discussed longly how our result on rewrite closure of the Rigid Tree Automata could be applied to communication protocols verification, and more generally how tree automata with global constraints could help in this domain. It seems that those intuitions were right, as TAGED have been since applied in a new model-checking result (see [START_REF] Courbis | Taged approximations for temporal properties model-checking[END_REF]), but the way they are used is apparently slightly different from our approach. Those applications need efficient implementations of decision algorithms. Some work has been done to encode the membership decision problem in a SAT-solver in an efficient way in [START_REF] Héam | Sat solvers for queries over tree automata with constraints[END_REF]. Both for communication protocols and for the context of XML programming, it would be very useful, but also challenging, to have a (quite) efficient implementation of the emptiness problem for tree automata with global constraints.

One major problem to handle is a lower bound for the complexity of the emptiness problem. For TAGED, we show that the problem is in NEXPTIME, but we do not have a lower bound. However, the proof of the decidability of emptiness for t-dag automata that inspired our work has been proved NP-complete. Since, we do a very similar proof using an automaton which is exponential in the size of the input, it seems reasonable to assume that one can prove that the emptiness decision problem is NEXPTIME-complete.

Another complexity issue that this thesis arises, is whether the decidability of the emptiness problem for TAGC is elementary, i.e. does our solution provide an optimal complexity. In order to prove this, one will need to find an explicit elementary decision or procedure. However, the stronger expressiveness of TAGC compared to TAGED, and the robustness of our decision procedure let us think that there is a complexity gap between our two results. It is maybe possible to encode this problem into one that is already known to be, for example, non-primitive recursive. Some recent works provide such problems, like decision problems on lossy-channel systems, or the Post Embedding Problem [START_REF] Chambart | Post embedding problem is not primitive recursive, with applications to channel systems[END_REF].

An interesting further work would be to compare the expressiveness of TAGC with automata on data trees (like the ones studied in [START_REF] Bojańczyk | Two-variable logic on data trees and Chapter 5 : Deciding Emptiness for TAGC applications to xml reasoning[END_REF]). As explained earlier, it would require to encode data on trees as extra subterms, which causes several complications that we already discussed. Another suggestion, that we were given when presenting our results, is to use query-like techniques to select nodes that will later be tested for equality or disequality in global constraints. At a first approach, it seems that we may have a model of automata that could be both powerful and with a decidable emptiness problem. Moreover, using queries on unranked ordered labeled trees could be a way to decide emptiness for unranked tree automata with both global constraints of TAGC, and constraints between sibling subterms like in the model UTASC of [START_REF] Löding | On nondeterministic unranked tree automata with sibling constraints[END_REF] which are not handled by TAGC. Hence, we would get a very powerful model combining the expressive power of both TAGC and UTASC.

Lemma 3. 7

 7 For all RTA A = Q, R, F, ∆ , for all terms t ∈ L(A) such that d (t) > (|Q| + 1)|R|, there exist a context C, two 1contexts C ′ and D, with D non-trivial (non-variable), and a term u such that t = C C ′ [D[u]], . . . , C ′ [D[u]

  Theorem 3.13 DRTA RTA. proof. Let Σ = {a : 0, f : 2}. The language L = {f (t, t) | t ∈ T (Σ)} is recognized by the RTA of Example 2.3, without the transitions rules for symbol b.

Figure 3

 3 Figure 3.3: Undecidability of membership modulo: encoding of a solution of PCP. Theorem 3.23 Membership modulo is undecidable for RTA and linear and collapsing TRS.

  1. C → S : pair pair(C, S), encrypt(pair(C, encrypt(N, pk(S))), sk(C)) 2. S → C : pair pair(S, C), encrypt(pair(S, inc(N )), pk(C))

Example 3. 30

 30 An example of program executing the simplified version of the SPLICE/AS protocol of Example 3.29 is made of the two following agents called C and S.

Figure 4

 4 Figure 4.1: The term and the run of example 4.3 Intuitively, states r (v) is, in the run r, the set of states recognizing the term represented by G v .The figure4.2 shows the t-dag representation G of the term t of example 4.3, where we write at each node v, the couple λ G (v) : states r (v).We will present several transformations on t-dags. Given a t-dag G = (V, succ, λ) = dag(t) and a run r of a TAGED on t, we will define several subgraphs or t-dag whose set of nodes will be a subset of V . However, we will always manipulate state r as it is defined on all V (and hence, on all subset of V ). In particular, the following properties will still hold for every node of V , even if we consider these nodes in the set of nodes of a smaller t-dag.

Figure 4 . 2 :

 42 Figure 4.2: The t-dag representation of the term of example 4.3 with the set states r (v) for each node v.

Figure 4 . 3 :

 43 Figure 4.3: The graph S r G where G is the t-dag of figure 4.2

Figure 4

 4 Figure 4.4: A pumping of the skeleton of figure 4.3

Figure 4 . 6 :

 46 Figure 4.6: The term and the run inferred from the t-dag of figure 4.5

  i. |r v w | = |q w÷v | for all v, w ∈ W with v ≺ w, ii. r v w ≈ r v w ′ for all v, w, w ′ ∈ W with v w, w ′ ,iii.n j=1 a j .|q w j | = 0.

  5) we restrict ourselves to positive TAGC (let us recall that PTAGC denotes the class of positive TAGC[≈, ≈]) and show that we can get rid of |.| N and . N while keeping the same class of recognized languages. Then, in Proposition 5.9, we show how to get rid of negative constraints in TAGC[≈, ≈, N]. Proposition 5.5 For all PTAGC[≈, ≈, N] A, one can effectively construct a PTAGC[≈, ≈] A ′ such that L(A ′ ) = L(A). The first step of this construction consists in rewriting conjunctions of constraints with |.| N and . N into disjunctions of conjunctions of simpler constraints.

  proof. First, we separate the conjunction of inequalities in two parts: we denote by ϕ |.| the conjunction of atomic constraints of type |.| N (inequalities on occurrences), and ϕ . the conjunction of atomic constraints of type . N (inequalities on cardinality). So ϕ = ϕ |.| ∧ ϕ . . Then, we further separate the two parts into ϕ |.| = χ |.| ∧ ψ |.| and ϕ . = χ . ∧ ψ . where χ |.| contains all the inequalities of the form |q| = a or |q| ≥ a where q occurs there only, and ψ |.| contains all the other inequalities. Note that each state occurring in χ |.| occurs only in this subformula and does not occur in ψ |.| . Respectively, χ .

  ϕ |.| by a disjunction 0≤s≤sq ϕ s |.| , where ϕ s |.| = χ s |.| ∧ ψ s |.| and χ s |.| = χ |.| ∧ |q| = s, and ψ s |.

  s |.| and occurs only once in each χ s |.| . While there is still a nonempty conjunction ψ s |.| , we apply the procedure to ϕ s |.| . At the end, we have an expression equivalent to ϕ |.| that can be written 1≤i≤n χ i |.| for some n where each χ i |.| is a conjunction of (in)equalities of the form |q| = a or |q| ≥ a.

  H i and r Ȟi are presented in Figure 5.4. 3

Corollary 5 .

 5 33 Emptiness is decidable for TAGC[≈, ≈, N].

  We will detail the construction of a term t ′ recognized by B which is not in L. However, we will only give a hint why it is recognized by B. Let N be the number of states of Q occurring in C. It is quite obvious that for all i ∈ N * there is a unique term of height |i| in L that we can define inductively as follow: t 1 = 0 and t i = f (t i-1 , t i-1 ) for i > 1. Let t = t N (|Q|+2) , and let r be a run of B accepting t. Let p = 1 N (|Q|+2)-1 , p is a position of the leftmost leaf of t. Let M be the number of prefixes p ′ of p such that r(p ′ ) is involved in an equality test wrt r and C, that is, there exists p ′′ ∈ Pos(t), p ′′ = p ′ such that the atomic constraint r(p ′ ) ≈ r(p ′′ ) occurs in C. Obviously M ≤ N . There are at most N occurrences of states involved in an equality test in the branch from the root to the leaf at position p. And since |p| = N (|Q|+2), by the pigeon hole principle, there exists two positions, p 1 and p 2 on the branch, such that p 1 < p 2 , |p 2p 1 | ≥ |Q|, and for all p ′ , p 1 ≤ p ′ ≤ p 2 , r(p ′ ) is not involved in an equality test wrt r and C. So there exists two positions p ′ 1 and p

	Proposition 2.20 The language of the example 2.19 is not recognizable
	by a PCTAGC[≈].
	proof. Let B = Σ, Q, F, ∆, C be a PCTAGC[≈] such that for all t ∈ L,
	A recognizes t.

  we do a classical disjoint union of automata. Let us assume wlog that the state sets Q 1 , Q 2 of A 1 and A 2 are disjoint. Like for the union of TA, the RTA A is obtained by disjoint union of the state sets, rigid state sets, final state sets and transitions sets.

  Let us denote by |.| Z and . Z the types of the above linear inequalities, seen as atomic constraints of TAGC. The class TAGC[ |.| Z ] has been studied under different names (e.g. Parikh automata in[START_REF] Klaedtke | Parikh automata and monadic second-order logics with linear cardinality constraints[END_REF], linear constraint tree automata in[START_REF] Bojańczyk | Two-variable logic on data trees and Chapter 5 : Deciding Emptiness for TAGC applications to xml reasoning[END_REF]) and it has a decidable emptiness test. Indeed, the set of successful runs of a given TA with state set Q describes a context free language (over Q * ), and the Parikh projection (the set of tuples over N |Q| whose components are the |q| r for every run r) of such a language is a semi-linear set. The idea for deciding emptiness for a TAGC[|.| Z ] A is to compute this semi linear set and test the emptiness of its intersection with the set of solutions in N |Q| of C A , (a Boolean combinations of linear inequalities of type |.| Z ) which is also semi-linear. This can be done in NPTIME, see[START_REF] Bojańczyk | Two-variable logic on data trees and Chapter 5 : Deciding Emptiness for TAGC applications to xml reasoning[END_REF].Combining constraints of type ≈ and counting constraints of type |.| Z however leads to undecidability. Emptiness is undecidable for PTAGC[≈,|.| Z ].proof. We reduce Hilbert's tenth problem. Let a 1 x

	Theorem 5.3 i 1,1 1 . . . x a n x i n,1 1 . . . x in,m m	i 1,m m + . . . +

  .2.

	i	H i	Ȟi
	5	{ε}	∅
	4	{3}	{1, 2}
	3	{3.3}	{1, 2, 3.1, 3.2}
	2	{3.3.3}	{1, 2, 3.1, 3.2, 3.3.1, 3.3.2}
	1	{2, 3.2, 3.3.2, 3.3.3.2}	{1, 3.1, 3.3.1, 3.3.3.1}
	0 {1, 2.1, 2.2, 3.1, 3.2.1,	∅
		3.2.2, 3.3.1, 3.3.2.1, 3.3.2.2,
		3.3.3.1, 3.3.3.2.1, 3.3.3.2.2}
		Figure 5.2: H i and Ȟi (Example 5.13).

Remerciements

Chapter 4 : Emptiness Decision for TAGED enhance the proof in [START_REF] Charatonik | Automata on dag representations of finite trees[END_REF] to deal with equalities and be applied to the decidability of the emptiness problem of the full class of TAGED.

That is what we will do in the second section of this chapter, by defining a pumping lemma on TAGED.

1 Negative TAGED and t-dag Automata are Equally Expressive

Negative TAGED recognize terms languages whereas t-dag automata recognize languages of t-dag representations of terms. As in chapter 2, we will here compare the expressiveness of these two models by considering the terms represented by the t-dags of the t-dag automaton language. The easy way is to build a negative TAGED recognizing the same language as a t-dag automaton.

Theorem 4.1 Let A = Σ, Q, F, ∆ be a t-dag automaton. There exists a negative TAGED B such that, for all t ∈ T (Σ), t is recognized by B if and only if dag(t) is recognized by A.

proof. Let us define B = Σ, Q, F, ∆, ≈ where, for all q 1 , q 2 ∈ Q, q 1 = q 2 implies that q 1 ≈ q 2 . Let G = dag(t) be a t-dag recognized by A and let r be a successful run of on G. Obviously, r ′ defined as ∀p ∈ Pos(t), r ′ (p) = r(G(p)) is an accepting run of the underlying tree automaton ta(B) on t, since the states, the final states, and the transition rules are the same. For all p 1 , p 2 ∈ Pos(t) such that r ′ (p 1 ) = q 1 = q 2 = r ′ (p 2 ), we have that r(G(p 1 )) = r(G(p 2 )), hence the nodes G(p 1 ) and G(p 2 ) are distinct. Since G is a t-dag, G| p 1 and G| p 2 are not isomorphic, which implies that t| p 1 = t| p 2 . The disequalities q 1 ≈ q 2 are respected, and r ′ is a successful run of B on t.

Reciprocally, let t be recognized by a run r ′ of B. Since for all p 1 , p 2 ∈ Pos(t) such that r(p 1 ) = r(p 2 ), the disequality constraint ≈ implies that t p 1 = t p 2 , we have that for all subterm t ′ of t there exists a unique state q t ′ such that, for all position p, if t| p = t ′ then r ′ (p) = q ′ . Considering the construction of proposition 1.5, where each node of dag(t) corresponds to a subterm of t, we build the run r such that, for all subterm t ′ of t, r(t ′ ) = q t ′ . Since the states, the final states, and the transition rules are the same in A and B, r is a successful run of A on dag(t).

2 The other way, encoding a negative TAGED into a t-dag automaton, is a bit more complex, and may involve an exponential blowup of the size of the automaton.

Theorem 4.2 Let A = Σ, Q, F, ∆, ≈ a negative TAGED.

There exists a t-dag automaton B such that for all term t ∈ T (Σ), t is recognized by A if and only if dag(t) is recognized by B.

λ G ′ = f , and for all q ∈ states r (v), there exists f (q 1 , . . . , q n ) → q ∈ ∆ such that for all i, 1 ≤ i, ≤ n, q i ∈ states r (succ(i, v))

proof. Let v be a node in G ′ . By definition of a semi-skeleton, λ S (v) = f (P 1 [i 1 ], . . . , P k , . . . , P n [i n ]) → P such that P = states r (v), and

By definition of a semi-skeleton and by construction of the induced graph, we have that states r [succ G ′ (i, v)] = P i for all i, 1 ≤ i ≤ n. where v i ′ is the i-th immediate successor of v in G ′ . And by Proposition 4.5, we have that for all q ∈ P there exists f (q 1 , . . . , q n ) → q ∈ ∆ where for all i, q i ∈ P i . 2

Now, we can prove that the induced graph of a perfect semi-skeleton is in the language of the TAGED.

Theorem 4.16 Let G = V G , succ G , λ G be a t-dag representing a term t, let A = Q, F, ∆, C be a TAGED, and r an accepting run of A on t. Let S = V S , succ S , λ S be a perfect semi-skeleton of G and r, and

proof. We prove this proposition constructively by building a run r ′ of A on the term t ′ represented by G ′ , and showing that this is an accepting run. We define r ′ , Pos(r ′ ) = Pos(t ′ ), recursively on the length of the positions, respecting the following invariant: for all position p, r ′ (p) ∈ states r (v) where v is the root of the subdag G ′ | p .

• for length 0, we define r ′ (ε) = q f . Since the root of G ′ is the root u of G and states r (u) = q f with q f the final state used in r, the invariant is respected

is defined for all position p of length n, and such that r ′ (p) is a state q occurring at states r (v ′ ) where v ′ is the root of the subdag G ′ | p . If t(p) is a function symbol of arity n > 0, then, by proposition 4.5 there exists a rule f (q 1 , . . . , q n ) → q ∈ ∆ such that for all i,

we respect the invariant

Clearly with this construction, we have that r ′ is a run of the underlying tree automaton of the TAGED A on t ′ . Let us prove that it is an accepting one. First, we have that r ′ [ε] = q f which is a final state. So r is an accepting run of the underlying tree automaton, and we only have to ensure that (dis)equalities are respected.

Let q 1 ≈ q 2 ∈ C and p 1 and p 2 be two positions such that r ′ (p 1 ) = q 1 and r ′ (p 2 ) = q 2 . According to proposition 4.5, there is at most one node v of G such that states r (v) may contain both q 1 and q 2 . We have that v is the root of both the subdags

Let q 1 ≈ q 2 ∈ C and p 1 and p 2 be two positions such that r ′ (p 1 ) = q 1 and r ′ (p 2 ) = q 2 . Since that, according to proposition 4.5, no node v of bottom-up computation of the automaton (for the evaluation of q ), and δ(q) is the number (up to M + 1) of occurrences of q encountered so far in the computation (for the evaluation of |q|).

We define the sum m 1 +m 2 of two elements m 1 , m 2 ∈ {0, . . . , M +1} as the result of the addition of m 1 and m 2 in N if it is lower or equals to M , or as M + 1 otherwise (if the result of the addition in N is greater than M + 1).

Then, we define the constraints, transitions rules, and final states of A ′ . For each atomic constraint c occurring in C we define a conjunction of atomic constraints const(c) on Q ′ as follow:

We define

, where c ∈ C means that c is an atomic constraint occurring in C. The set of transition rules ∆ ′ contains all the transition rules f ( q i 1 1 , δ 1 , . . . , q in n , δ n ) → q i , δ such that q 1 ,. . . , q n , q ∈ Q, f (q 1 , . . . , q n ) → q ∈ ∆, for all j ≤ n, 1 ≤ i j ≤ c(q j ), i = i 1 + . . . i n , for all q ′ ∈ Q \ {q}, δ(q ′ ) = 1≤j≤n δ j (q ′ ), and δ(q) = 1 + 1≤j≤n δ j (q). The set of final states F ′ contains the states q i f , δ , such that q f ∈ F and δ satisfies the followings conditions for all q ∈ Q • if α |q| is |q| = a q then 1≤i≤c(q) δ(q i ) = a q ,

• if α |q| is |q| ≥ a q then 1≤i≤c(q) δ(q i ) ≥ a q or 1≤i≤c(q) δ(q i ) = M + 1,

We now have to prove the correctness of this construction.

Lemma 5.8 For all t ∈ T (Σ) there exists an accepting run r of A on t iff there exists an accepting run r ′ of A ′ on t.

proof. only if direction : Let r be an accepting run of A on t, such that r |= C. First, we compute a labelled tree r : Pos(t) → Q such that for all p ∈ Pos(t), r(p) is a copy q i ∈ Q of the state r(p) = q.

For every q ∈ Q, if α q is ⊤, then there is only one copy q 1 of q in Q. So, for all p with r(p) = q we define r(p) = q 1 . If α q is q = b q (resp. α q is q ≥ b q ) there exists b q (resp b q + 1) copies of q. Since r |= ϕ, there exists exactly (resp. at least) b q different terms t 1 , . . . , t bq such that there exists b q positions p 1 , . . . , p bq verifying r(p 1 ) = • • • = r(p bq ) = q and t| p 1 = t 1 , . . . , t| p bq = t bq . For every position p ∈ Pos(t) such that r(p) = q and t| p = t i , we define r(p) = q i . And, if α q is q ≥ b q , for every p ∈ Pos(t) such that r(p) = q and t| p is different from all the t 1 , . . . , t bq , we define r(p) = q bq+1 . Then, we define r ′ : Pos(t) → Q ′ as follows. For all position p ∈ Pos(t), r ′ (p) = r(p), δ p where for all q ∈ Q, δ p (q) = |q| r|p if |q| r|p ≤ M and δ p (q) = M + 1 otherwise. It is easy to see that the rules of ∆ ′ allow us to define such a run of A ′ on t. We now have to check that the constraint C ′ is satisfied by r ′ and t.

This construction satisfies the atomic constraints q i 1 , δ 1 ≈ q j 2 , δ 2 (resp. q i 1 , δ 1 ≈ q j 2 , δ 2 ), that were added to C ′ because every constraint q 1 ≈ q 2 (resp. q 1 ≈ q 2 ) was already in C. Whatever copies q i 1 and q j 1 we have chosen in r in order to replace occurrences of q 1 and q 2 at positions p 1 and p 2 in r, we know that those constraints will be respected because C already implied that t| p 1 = t p 2 (resp. t| p 1 = t| p 2 ).

For every state q ∈ Q such that α q is q = b q , or α q is q ≥ b q , there are constraints of two types: q i , δ 1 ≈ q j , δ 2 for 1 ≤ i < j ≤ b q , for all δ 1 , δ 2 and q i , δ 1 ≈ q i , δ 2 for 1 ≤ i ≤ b q and for all δ 1 , δ 2 . By construction of r ′ , for all 1 ≤ i ≤ b q all the positions p such that r ′ (p) = q i , δ , for all δ, have the same subterm t| p = t i . Moreover, for all 1 ≤ i < j ≤ b q we have that t i = t j . So both types of constraints are respected.

Now we have to make sure that r ′ is an accepting run, that is that r ′ (ε) ∈ F ′ . Since r is an accepting run of A we know that r ′ (ε) = q i f , δ where q f ∈ F and δ(q

Since q f ∈ F we just have to make sure that δ satisfies the conditions. By construction of r ′ , every occurrence of a state q ∈ Q in r corresponds to an occurrence of one of the copies q i ∈ Q ′ in r ′ . So, for all q ∈ Q it holds that |q| r is equals to 1≤i≤c(q) |q i | r ′ and that 1≤i≤c(q) δ(q i ) is either |q| r if |q| r ≤ M or M + 1 otherwise. Hence, if α |q| is |q| = a q or |q| ≥ a q , then the associated conditions on δ are satisfied since ϕ (and in particular α |q| ) is satisfied by r. By construction, for every q ∈ Q such that α q is q = b q or q ≥ b q , we have instantiated each copy q i for all 1 ≤ i ≤ b q at least once in r ′ . Hence the associated conditions are also respected: r ′ is an accepting of A ′ on t.

if direction : Let r ′ be an accepting run of A ′ on t. We define a run r of A on t in the following way: for all p ∈ Pos(t), r(p) is the original state q ∈ Q corresponding to the copy q i such that r ′ (p) = q i , δ . By construction of A ′ we have that r is a valid run wrt ∆ and that r(ε) ∈ F . For every positions p 1 , p 2 ∈ Pos(t) with r(p 1 ) = q 1 , r(p 2 ) = q 2 , such that there exists a constraint q 1 ≈ q 2 (resp. q 1 ≈ q 2 ), there was, by construction of A ′ , a constraint q i 1 , δ 1 ≈ q j 2 , δ 2 (resp. q i 1 , δ 1 ≈ q j 2 , δ 2 ) for all copies q i 1 of q 1 and q j 2 of q 2 and for all δ 1 , δ 2 . In particular, there is in

Hence, all the constraints of A are satisfied by r and t.

We now have to ensure that the arithmetic constraints in C are satisfied by r and t. As above, by construction of r ′ , it is easy to see that for all q ∈ Q we have that 1≤i≤c(q) δ(q i ) is either |q| r if |q| r ≤ M or M + 1 otherwise. Hence, all the expressions α |q| of C are satisfied. And for every expression α q equal to q = b q , we have exactly b q copies of q in Q. The constraints q i , δ 1 ≈ q i , δ 2 and q i , δ 1 ≈ q j , δ 2 for all δ 1 , δ 2 , i = j ensure that each copy q i is used for only one subterm t i and that, for all 1 ≤ i < j ≤ b q t i = t j . Since all the copies q i are guaranteed to occur at least once in r ′ , by the arithmetic constraints, we know that we have exactly b q different subterms at the positions labelled by q. And if α q is q ≥ b q , the extra copy q bq+1 recognizes all the extra subterms that are recognized in q if q > b q is satisfied by r and t. Hence, C is fully satisfied by r and t, and r is a successful run of A on t.

2 2

We can know construct a PCTAGC[≈, ≈] equivalent to a given PTAGC[≈, ≈, N]. The missing step is to get such an automaton from a TAGC[≈, ≈, N].

where C + is a conjunction of atomic constraints of the form q ≈ q ′ or q ≈ q ′ , C -is a conjunction of negations of atomic constraints of the form ¬(q ≈ q ′ ) or ¬(q ≈ q ′ ), and C N is a conjunction of natural linear inequalities. Otherwise, we can put C is disjunctive normal form C = n i=1 C i , where every C i has the above form, apply the transformation below to each

The idea for the construction of A ′ is to replace the negative constraints of C -by positive constraints and arithmetic constraints, using copies of states of Q. For instance, assume that C - contains only ¬(q 1 ≈ q 2 ). By definition, for every successful run r of A on a term t ∈ T (F), there exist two positions p 1 , p 2 ∈ Pos(t) such that r(p 1 ) = q 1 , r(p 2 ) = q 2 and t| p 1 = t| p 2 . For expressing this property without the negative constraint, we add two copies q ′ 1 , q ′ 2 of respectively q 1 and q 2 (i.e. we let

) and define ∆ ′ by adding to ∆ all the transitions obtained from ∆ by replacing at least one occurrence of q 1 by q ′ 1 or one occurrence of q 2 by q ′ 2 . We define similarly C ′ + and

In general, when C -contains several negative constraints, we have to take care of the multiple occurrences of states in the different negative constraints of C -. For instance, let C -= ¬(q 1 ≈ q 2 ) ∧ ¬(q 1 ≈ q 3 ). For a successful run r of A on t, there exist positions p 1 1 , p 2 , p 2 1 , p 3 ∈ Pos(t) such that r(p 1 1 ) = r(p 2 1 ) = q 1 , r(p 2 ) = q 2 , r(p 3 ) = q 3 and and t| p 1 1 = t| p 2 and t| p 2 1 = t| p 3 . In order to replace C -by positive constraints as above, we must decide how many copies of q 1 , q 2 and q 3 we will need. If p 1 1 = p 2 1 , then we can choose two copies q 1 1 and q 2 1 of q 1 , that will reach respectively p 1 1 and p 2 1 in a computation of A ′ on t. With constraints q 1 1 ≈ q 2 1 , |q 1 1 | = 1 and |q 2 1 | = 1 as above, we are done. However, if p 1 1 = p 2 1 , then we must have only one copy of q 1 , because only one state can reach this position in a computation of A ′ on t. We shall enumerate below all the cases of the number of copies needed for each state, using the number of finite models of a first-order formula.

Let Q = {q 1 , . . . , q p } and let

and for all ℓ ≤ n, e ℓ = ¬(q v ℓ ≈ q v ′ ℓ ). Let us associate the following closed first order formula to A:

Let N be the number of variables in φ A . Every variable of φ A is uniquely associated to an occurrence of a state of Q in C -. For instance,

) is associated to the occurrence of q u k is the left (resp. right) hand side of d k . For a A with the above example of C -, we have

For each 1 ≤ i ≤ p, we define X i as the set of variables associated to occurrences of q i : X

where Q σ contains the states of Q and, for each i ≤ p, n i = |σ(X i )| copies of q i : q 1 i , . . . , q n i i . The transition set ∆ σ contains all the transitions of ∆ plus additional transitions obtained from ∆ by replacing at least one occurrence of one of the q i by one of its copies q j i . The final states set is defined by

Finally, we let

where C σ + contains all the positive constraints of C + where some (possibly zero or more) instances of states of Q are replaced by copies, and C σ N is obtained from C N by replacement of every |q i | by |q i | + |q 1 i | + . . . + |q n i i | and of every q i by q i + q 1 i + . . . + q n i i . Finally, let us rename the respective states of the A σ such that there states sets are pairwise

Example 5.16 Following our running example, we define a pumpinjection I : (H 4 ∪ Ȟ4 ) → (H 3 ∪ Ȟ3 ) as follows: I(1) = 3.1, I(2) = 2, I(3) = 3.3. We note that I is a correct pump-injection: I(H 4 ) ⊆ H 3 and I( Ȟ4 ) ⊆ Ȟ3 hold, thus (C 1 ) holds. For (C 2 ), we have r(1) = r(I(1)) = q id , r(2) = r(I(2)) = q t , and r(3) = r(I(3)) = q L . Regarding (C 3 ), for each different p1 , p2 in H 4 ∪ Ȟ4 , t| p1 = t| p2 and t| I(p 1 ) = t| I(p 2 ) hold.

After applying the pump-injection I, we obtain the term t ′ and run r ′ of Figure 5.3.

3

Our goal is to prove that any global pumping r[r| I(p 1 ) ] p1 . . . [r| I(pn) ] pn is a run on t[t| I(p 1 ) ] p1 . . . [t| I(pn) ]( p)n , and in particular, that all global equality and disequality constraints are satisfied. To this end we first state the following intermediate statement, which determines the height of the terms pending at some positions after the pumping action.

Lemma 5.17 Let A be a PCTAGC. Let r be a run of A on a term t. Let r ′ , t ′ be the global pumping on r and t with indexes 0 ≤ j < i ≤ h(r) and injection I, such that r ′ = r[r| I(p 1 ) ] p1 . . . [r| I(pn) ] pn and t ′ = t[t| I(p 1 ) ] p1 . . . [t| I(pn) ]( p)n , Let k ≥ 0 be a natural number and let p be a position of t such that h(t| p ) is i + k. Then, p is also a position of t ′ and h(t

proof. Position p is obviously a position of t ′ since no position in H i ∪ Ȟi is a proper prefix of p. We prove the second part of the statement by induction on k. First, assume that k = 0. Then, h(t| p ) is i. Thus, p is in H i , say p is p1 . Therefore, t ′ | p is t| I(p 1 ) . By Condition (C 1 ) of the definition of pump-injection, I(p 1 ) ∈ H j holds. Hence, h(t

Now, assume that k > 0. Let m be the arity of t(p). Thus, p.1, . . . , p.m are all the child positions of p in t. Since h(t| p ) is i + k, all h(t| p.1 ), . . . , h(t| p.m ) are smaller than or equal to i + k -1, and at least one of them is equal to i + k -1.

Consider any α in {1, . . . , m}. If h(t| p.α ) is i + k ′ for some 0 ≤ k ′ ≤ k -1, then, by induction hypothesis, h(r ′ | p.α ) is j + k ′ . Otherwise, if h(r| p.α ) is strictly smaller than i, then p.α is one of the positions in Ȟi , say p1 . Moreover, t ′ | p1 is t| I(p 1 ) , and by Condition (C 1 ) of the definition of I, I(p 1 ) belongs to Ȟj . Therefore, h(t| I(p 1 ) ) < j holds, and hence,

From the above cases we conclude that, if h(t| p.α ) is i + k -1, then h(t ′ | p.α ) is j + k -1, and if h(t| p.α ) is smaller than i + k -1, then h(t ′ | p.α ) is smaller than j + k -1. It follows that all h(t ′ | p.1 ), . . . , h(t ′ | p.m ) are smaller than or equal to j + k -1, and at least one of them is equal to

Corollary 5.18 Let A be a PCTAGC. Let r be a run of A on a term t. Let r ′ , t ′ be a global pumping of r and t. Then, h(t ′ ) < h(t).

The following lemma states that equality and disequality relations are preserved, not only for terms pending at the positions of the domain of I, but also for terms pending at prefixes of positions of such domain.

Lemma 5.19 Let A be a PCTAGC. Let r be a run of A on a term t. Let r ′ , t ′ be the global pumping with indexes 0 ≤ j < i ≤ h(r) and injection I, such that r ′ = r[r| I(p 1 ) ] p1 . . . [r| I(pn) ] pn and t ′ = t[t| I(p 1 ) ] p1 . . . [t| I(pn) ]( p)n , Let p 1 , p 2 be positions of p satisfying h(t| p 1 ), h(t| p 2 ) ≥ i. Then, p 1 , p 2 are also positions of t ′ and (t|

proof. The first statement follows by Lemma 5.17. We prove the second part of the statement by induction on h(t| p 1 ) + h(t| p 2 ). We distinguish the following cases: i. Assume that h(t| p 1 ) = h(t| p 2 ). Then, t| p 1 = t| p 2 hold and, moreover, h(t| p 1 ) = i + k 1 and h(t| p 2 ) = i + k 2 hold for some different natural numbers k 1 and k 2 . By Lemma 5.17, h(t ′ | p 1 ) = j + k 1 and h(t ′ | p 2 ) = j + k 2 . Thus, t ′ | p 1 = t ′ | p 2 hold, and we are done.

ii. Assume that h(t| p 1 ) = h(t| p 2 ) = i + k for some k. We start by assuming the case k = 0. Then, h(t| p 1 ) is i. Thus, p 1 , p 2 are in H i , say p 1 is p1 and p 2 is p2 . Therefore, t ′ | p 1 is t| I(p 1 ) and t ′ | p 2 is t| I(p 2 ) . By Condition (C 3 ) of the definition of pump-injection, (t| p1 = t| p2 ) ⇔ (t| I(p 1 ) = t| I(p 2 ) ) holds. Thus, (t|

) holds and we are done. Now, we assume that k > 0. Note that, in this case, t ′ (p 1 ) = t(p 1 ) and t ′ (p 2 ) = t(p 2 ) hold. In the case where t(p 1 ) differs from t(p 2 )), it is clear that t| p 1 ) = t| p 2 ) and t ′ | p 1 ) = t ′ | p 2 hold, and we are done. Hence, we consider the remaining case where t(p 1 ) = t(p 2 ) holds. Let m be the arity of t(p 1 ). Thus, p 1 .1, . . . , p 1 .m and p 2 .1, . . . , p 2 .m are all the child positions of p 1 and p 2 in t, respectively. In order to prove (t|

) for all α in {1, . . . , m}. Thus, we consider any of such α's and distinguish the following cases: i.a. If h(t| p 1 .α ), h(t| p 2 .α ) ≥ i holds, then the result follows by induction hypothesis.

analogously. By Condition (C 1 ) of the definition of pump-injection, I(H i ) ⊆ H j . We write {t| p |p ∈ H i } and {t| p |p ∈ H j } more explicitly as {t i,1 , . . . , t i,α } and {t j,1 , . . . , t j,β }, respectively. Hence, it remains to prove that [r t i,1 ,H i , . . . , r t i,α ,H i ] ≤ [r t j,1 ,H j , . . . , r t j,β ,H j ]. To this end we define the function I ′ : {1, . . . , α} → {1, . . . , β} as follows. For each γ in {1, . . . , α}, we choose a position p in H i satisfying t| p = t i,γ , determine the index δ of the term t j,δ satisfying t j,δ = t| I(p) , and define I ′ (γ) := δ. This function I ′ is injective due to Condition (C 3 ) of the definition of pump-injection. In order to conclude, it suffices to prove r t i,γ ,H i ≤ r t j,I ′ (γ) ,H j for each γ in {1, . . . , α}. We just prove it for γ = 1. For proving r t i,1 ,H i ≤ r t j,I ′ (1) ,H j it suffices to prove the following statement for each state q of A: {p ∈

To this end, since I is injective, it suffices to prove that I({p

Let p ′ be the chosen position for defining I ′ (1). In particular, t| p ′ = t i,1 and t| I(p ′ ) = t j,I ′ (1) hold. Note that t| p = t| p ′ = t i,1 holds. Thus, by Condition (C 3 ) of the definition of pump-injection, t| I(p) = t| I(p ′ ) holds. Therefore, t| I(p) = t j,I ′ (1) holds. In order to show the inclusion I(p) ∈ {p | t| p = t j,I ′ (1) ∧ r(p) = q} it rests to see r(I(p)) = q. Note that, since p belongs to {p | t| p = t i,1 ∧ r(p) = q}, r(p) = q holds. By Condition (C 2 ) of the definition of pump-injection, r(I(p)) = r(p) = q holds, and we are done.

⇐. Assume that r H i , r Ȟi ≤ r H j , r Ȟj holds. We have to construct a pump-injection I : (H i ∪ Ȟi ) → (H j ∪ Ȟj ). We just define I : H i → H j and prove Conditions (C 2 ) and (C 3 ) for p, p1 , p2 in H i . This is because I : Ȟi → Ȟj can be defined analogously, and Conditions (C 2 ) and (C 3 ) for the corresponding positions can be checked analogously. Moreover, for positions p′ 1 ∈ H i and p′ 2 ∈ Ȟi , Condition (C 3 ) holds whenever Condition (C 1 ) holds since in this case t| p′ 1 = t| p′ 2 and t|

hold. Hence, this simple case is enough to prove the whole statement. We write {t| p | p ∈ H i } and {t| p | p ∈ H j } more explicitly as {t i,1 , . . . , t i,α } and {t j,1 , . . . , t j,β }, respectively. Since r H i , r Ȟi ≤ r H j , r Ȟj holds, r H i ≤ r H j also holds. Thus, there exists an injective function I ′ : {1, . . . , α} → {1, . . . , β} satisfying the following statement for each δ in {1, . . . , α} and each state q of A:

In order to define I : H i → H j , we define I for each of such sets {p ∈ H i | t| p = t i,δ ∧ r(p) = q} as any injective function To this end just note that [ 0, 0, 0, 0, 1, 0 ] ≤ [ 0, 0, 0, 0, 1, 0 ], [ 0, 0, 1, 0, 0, 0 ] ≤ [ 0, 0, 1, 0, 0, 0 ], and [ 0, 0, 0, 1, 0, 0 ] ≤ [ 0, 0, 0, 2, 0, 0 ] hold.

We can define I : (H 4 ∪ Ȟ4 ) → (H 3 ∪ Ȟ3 ) from this relation according to Lemma 5.27. Doing the adequate guess we obtain the following definition: I(1) = 3.1, I(2) = 2, I(3) = 3.3 which is the pump-injection considered above for our running example.

3

The following lemma follows directly from the definition of the sets H i and Ȟi , and allows to connect such definitions with Lemma 5.23.

Lemma 5.29 Let A be a PCTAGC. Let a be the maximum arity of the symbols in the signature of A. Let r be a run of A on a term t. Then, the following conditions hold:

(1) |H h(t) | = 1 and | Ȟh(t) | = 0.

(2) For each i in {1, . . . , h(r)},

proof. Item (1) is trivial by definition of H i and Ȟi for i = h(r). For Item (2), it suffices to observe that the positions in H i-1 ∪ Ȟi-1 are all the positions of Ȟi plus all the child positions in H i , and that each position has at most a children. For Item (3) we just prove The emptiness decision results of Corollary 5.32 can be extended from TAGC to HAGC using a standard transformation from unranked to ranked binary terms, like the extension encoding described in [CLDG + 07], Chapter 8.

Let us associate to the unranked signature Σ the (ranked) signature F @ := {a : 0 | a ∈ F} ∪ {@ : 2} where @ is a new symbol. The operator curry, recursively defined in the following, is a bijection from U (F) into T (F @ ). curry(a) = a for all a ∈ F curry a(t 1 , . . . , t n ) = @ curry a(t 1 , . . . , t n-1 ) , curry(t n ) An example of application of this operator is presented in Figure 5.5. We extend the application of the operator curry to set of trees by curry(L) = {curry(t) | t ∈ L}.

Proposition 5.38 For all HAGC[≈, ≈, N] A over F, one can construct effectively in PTIME a TAGC[≈, ≈, N] A ′ over F @ such that L(A ′ ) = curry L(A) . proof. Let A = Q, F, F, C, ∆ . We call ha(A) the underlying hedge automaton of A: ha(A) = Q, F, F, true, ∆ i.e. ha(A) computes the same way as A but without the global constraints (note however that the top state of successful runs must be a final state).

We can assume wlog that ∆ contains at most one transition a(L) → q for each pair a, q ∈ Σ × Q. Otherwise, we can replace two transitions a(L) → q and a(L ′ ) → q by the unique transition a(L ∪ L ′ ) → q, preserving the language recognized. Let B a,q be the NFA recognizing L in the (unique) transition a(L) → q of ∆ associated to a and q. Note that such an automaton has Q as input alphabet. Let P be the union (assumed disjoint) for all transitions in ∆ of the state sets of the automata B a,q .

The transitions of the automaton A ′ , when computing on curry(t) for some t ∈ U (F), will simulate both the transitions of A (vertical transitions) and the transitions of the NFAs B a,q (horizontal transitions).

Let A ′ = Q ∪ P, F, F, C, ∆ ′ where ∆ ′ contains the transitions:

a → q if B a,q recognizes the empty word,

We may assume wlog that φ has the form φ = ∃X 1 . . . ∃X n (φ 0 (X) ∧ φ ≈ (X) ∧ φ N (X))

where φ 0 (X) is a MSO[+1] formula with free variables X = X 1 , . . . , X n , and φ ≈ (X) and φ N (X) are Boolean combinations of atoms of the respective form X i ≈ X j , X i ≈ X j and a j .|X i j | ≥ a, a j . X i j ≥ a. Moreover, we shall also assume that φ ≈ (X) and φ N (X) are conjunctions of the atoms or negations of atoms of the above form. Otherwise, we put them into disjunctive normal form and then split φ into an equivalent formula φ 1 ∨ . . . ∨ φ k , where each φ i , i ≤ k, is of the form requested (φ i = ∃X 1 . . . ∃X n (φ i 0 (X) ∧ φ i ≈ (X) ∧ φ i N (X)), with φ i 0 (X) ∈ MSO[+1] and φ i ≈ (X) and φ i N (X) are conjunctions of atoms or negations of atoms as above) and we solve satisfiability separately for each φ i .

First, using the construction of [START_REF] Thatcher | Generalized finite automata theory with an application to a decision problem of second-order logic[END_REF], we associate to φ 0 (X) a TA A 0 = Q, F × {0, 1} n , F, ∆ 0 which recognizes the set of set of terms t ⊗ σ ∈ T F × {0, 1} n | t, σ |= φ 0 (X). Here, the arity of a symbol f, b 1 , . . . , b n in Σ × {0, 1} n is the arity of f in F and t ⊗ σ denotes the term obtained from t ∈ T (F) by relabeling every position p ∈ Pos(t) by t(p), b 1 , . . . , b n where for each i ≤ n, b i = 1 if p ∈ σ(X i ) and b i = 0 otherwise. Note that the size of the above automaton A 0 is in general non-elementary in the size of φ.

Then, following a construction in [NPTT05], we shift in A 0 the bit-vectors from the signature into the state symbols, obtaining A ′ 0 = Q × {0, 1} n , Σ, F × {0, 1} n , ∆ where ∆ contains all the transition rules f q 1 , b 1,1 , . . . , b 1,n , . . . , q m , b m,1 , . . . , b m,n → q, b 1 , . . . , b n such that f ∈ F, f, b 1 , . . . , b n q 1 , . . . , q m → q ∈ ∆ 0 and b 1,1 , . . . , b 1,n , . . . , b m,1 , . . . , b m,n ∈ {0, 1}. This automaton A ′ 0 recognizes the projection (on the first components) of the terms recognized by A 0 , i.e. it recognizes the set of terms t ∈ T (F) such that there exists σ : {X 1 , . . . , X n } → 2 Pos(t) with t, σ |= φ 0 (X). Now, let us construct a constraint C by rewriting the atoms of φ ≈ (X) ∧ φ N (X), following the rules:

q, b 1 , . .