Romain Pascual

Salim Nibouche

Adrien Dekkers

Yassine Ouali

Je tiens tout d'abord à remercier ma directrice de thèse Pascale Le Gall pour m'avoir encadré tout au long de cette thèse avec beaucoup de bienveillance et de bonne volonté. Elle a toujours été de très bon conseil et aussi très généreuse tant au niveau de son temps que de ses efforts. Je tiens également à remercier Christophe Gaston, mon coencadrant, pour son amitié, ses conseils et aussi pour m'avoir fait me diriger vers ce projet de thèse après ma formation d'ingénieur.

Merci également à Arnault Lapitre et Boutheina Bannour du CEA, avec qui j'ai pu travailler sur différents sujets liés à cette thèse. Arnault m'a donné beaucoup de bonnes idées afin d'améliorer mes implémentations et Boutheina a su apporter son aide, notamment au niveau de l'état de l'art. Je voudrais également mentionner Mathilde Arnaud, Xavier Zeitoun et plus particulièrement Stéphane Salmons qui m'a encadré pendant mon apprentissage au CEA avant la thèse et m'a permis de faire mes premiers pas dans ce milieu.

Résumé

Les langages d'interactions permettent de modéliser le comportement de systèmes distribués via la spécification des échanges asynchrones de messages qui peuvent se produire entre leurs différents sous-systèmes. Ce type de langage est associé à un formalisme graphique intuitif qui permet une compréhension et une prise en main facile. Dans cette thèse nous formalisons ce type de modèles avec un Langage d'Interactions (LI) défini sous la forme d'une algèbre de termes. Ces termes sont construits à partir d'interactions atomiques qui peuvent correspondre à un comportement vide ou l'expression d'évènements de communication atomiques i.e. émissions ou réceptions de messages. Des opérateurs, incluant le séquencement strict et faible, la composition alternative et parallèle ainsi que quatre boucles distinctes, permettent ensuite la spécification de comportements plus complexes et nuancés par composition.

Nous définissons ensuite une sémantique de trace, associant à chaque terme d'interaction un ensemble de séquences d'évènements qui représentent les comportements pouvant être exprimés par le système distribué qui est modélisé. Cette sémantique est formulée dans un premier temps de manière dénotationnelle. La sémantique d'interactions complexes est définie par composition à partir de celles de ses sous-termes, composées à l'aide d'opérateurs algébriques sur les ensembles de traces. Cette formulation prenant la forme d'un morphisme d'algèbre nous pouvons ensuite utiliser les propriétés algébriques des opérateurs sur les ensembles de traces (associativité, commutativité, etc.) pour obtenir des équations reliant des termes d'interactions ayant la même sémantique. Grâce aux techniques de réécriture nous pouvons ensuite définir des formes normales de terme d'interaction. Dans un deuxième temps, nous proposons une formulation opérationnelle de la sémantique de trace, qui permet de rendre les modèles d'interaction exécutables et ouvre la voie à des applications plus poussées en vérification. Ces deux formulations sont prouvées équivalentes.

Les exécutions d'un système distribué peuvent être observées au travers de logs des évènements de communication collectés localement. Sans horloge globale il n'est pas possible de réordonner ces évènements globalement. Analyser une exécution revient donc à analyser un ensemble de traces qu'on appelle une multitrace. De plus, sur chaque composante locale, il se peut que l'observation ait commencé trop tard ou ait cessé trop tôt. Ainsi, une multi-trace peut correspondre à une observation partielle d'une exécution. Tirant parti de la formulation opérationnelle ainsi que de propriétés et transformations prouvées par rapport à la formulation dénotationnelle nous proposons des algorithmes d'analyse permettant d'identifier une multi-trace comme étant une observation d'un comportement spécifié par une interaction.

Notre approche a été implémentée au sein d'un outil appelé HIBOU qui permet de spécifier et dessiner des interactions, d'explorer leur sémantiques, de calculer des formes normales ou d'analyser des multi-traces.

Nous avons étendu notre LI pour inclure des données sous la forme de variables définies localement. Des gardes, expressions booléennes sur les variables, peuvent conditionner l'exécution d'actions et les messages peuvent porter des données exprimées à l'aide des variables. L'extension aux données a été implémentée en utilisant les techniques d'exécution symbolique. Cet outil étendu a été utilisé pour un cas d'usage industriel dans le cadre du projet FUI DisTA.

iii Chapter 1

Introduction

A Distributed System (DS) is of a collection of independent and concurrently running sub-systems, each of which being a locally determined software system or cyber-physical system. Those sub-systems can communicate with each-other and with the outside of the DS via their communication interfaces, on which they can send and receive messages. The transmission of those messages can be ensured by various mechanisms, which we may abstract as a support network. The transmission of those messages can either be synchronous (the emission and reception events are considered simultaneous) or asynchronous (a delay exists, w.r.t. an abstract global clock, between the emission and the reception events) [START_REF] Lamport | Time, clocks, and the ordering of events in a distributed system[END_REF].

The nature of DSs implies a number of issues that are not encountered in classical centralized systems.

Among those we can note:

• The reliance upon a support network can cause issues, with messages not being delivered (packet loss), or being delivered in an order that is different (w.r.t. a global ordering of events) to the one in which they were originally emitted (out-of-order delivery). This non-determinism motivated, among other things, the conception of modern communication protocols, which can ensure the correct transmissions of data through a complexification of the exchanges (or not, if the data is deemed not important enough to bother, see UDP vs TCP [START_REF] Bishop | Rigorous specification and conformance testing techniques for network protocols, as applied to tcp, udp, and sockets[END_REF]).

• Moreover, due to their support network, DSs are especially vulnerable ("vulnerable by construction" [START_REF] Pedroza | Timed-model-based Method for Security Analysis and Testing of Smart Grid Systems[END_REF]) to malicious acts (more so than centralized systems). Indeed, the use of third-party networks, public networks (e.g. the internet) or certain technologies (wireless communications) may allow the interception and / or the modification (man-in-the-middle attack [START_REF] Conti | A survey of man in the middle attacks[END_REF]) of data that is exchanged between the sub-systems of the DS. As for the previous point, handling those security issues can be done at the price of an increase in the complexity of the exchanges that occur within the DS (handshake protocols, etc.).

• The fact that each sub-system runs concurrently w.r.t. all others inherently creates additional nondeterminism and possible interleavings between the events that are expected to occur during the 1 execution of the DS. Moreover, given that most microprocessors nowadays allow multi-threading, several concurrent behaviors involving multiple sub-systems can be executed simultaneously in the DS (for instance, one can have several instances of different behaviors being executed between a client and a server at the same time). This can be the cause of non-deterministic concurrency bugs, which are often referred to as "Distributed Concurrency (DC) bugs" [START_REF] Leesatapornwongsa | Taxdc: A taxonomy of nondeterministic concurrency bugs in datacenter distributed systems[END_REF]. Those bugs are notably studied in the context of datacenter distributed systems.

• Finally, the absence of a global clock, shared by all sub-systems of the DS renders impossible, at least without dedicated mechanisms handling clock synchronization (countering clock drift), the synchronization of behaviors between sub-systems. In the perspective of analyzing log files, this is particularly problematic given that it impacts the ability to reorder events [START_REF] Lamport | Time, clocks, and the ordering of events in a distributed system[END_REF].

Those particularities makes so that DSs are especially difficult to design, model and verify. On the one hand, one-to-one exchanges between any two sub-systems are increasingly complexified by multi-threading and concerns about reliability and security. On the other hand, DSs may contain very high (and which can vary during the execution) numbers of sub-systems. Those intricacies make so that relying on human intuition alone is unreasonable. Methods for ensuring the quality of DSs should be supported by strong mathematical foundations so as to ensure that they behave as intended and should be fully or at least partly automatizable given the potential scale of such systems which incurs increasingly important costs in terms of human effort.

As a result, the development of sound and automatized processes for improving the design of DSs and for formalizing and mechanizing their verification is relevant, both from an academic perspective given the complexity and relative novelty of the subject and from an industrial perspective given the many various applications in which DSs are found. Indeed, with the rise of such practices and applications as the Internet of Things (IoT) in which hundreds, thousands or hundreds of thousands of devices may communicate so as to perform various tasks, the concrete and practical applications of DSs in the industry grow ever larger. This shift in the industry towards distributed and decentralized systems is (1) motivated by gains in terms of which services can be rendered and in terms of performances and ( 2) is fueled by advances in the miniaturization of microchips and the reduction of their costs. In particular, the IoT revolution is enabled by the apparition of affordable and easy to use single-board computers [START_REF]Raspberry pi[END_REF]8] and assimilated hardware. The integration of such connected devices in appliances for the large scale collection of data can be used to implement cost-effective preventive maintenance for company assets. In agriculture, sensor data can be used to predict yields and optimize irrigation and the use of fertilizer and pesticides. In supply-chain and logistics, smart tags can facilitate inventory, help avoid shortages and ensure the smooth operation of a supply chain. Moreover, additional sensors can be used to assess the condition of shipped products (e.g. verifying the cold chain for perishables commodities).

Smart objects can also replace everyday household appliances so as to provide ease of life functionalities in domestic use (smart homes etc.) [START_REF] Ozeer | F3ARIoT: A Framework for Autonomic Resilience of IoT Applications in the Fog[END_REF]. Groups or swarms of autonomous or semi-autonomous commu-1.1. VERIFICATION & VALIDATION AND FORMAL VERIFICATION cation of past executions of the system. This may consist in verifying that a given execution of a system, abstracted and formalized as an object that may be obtained from parsing and translating log files, belongs to the semantics of a formal model of that system. The distributed nature of DSs makes so that a given execution might produce several distinct log files and, as we have mentioned, a lack of synchronization might prevent merging them. Moreover, it might be so that some log files are incomplete. For instance the logging may have started too late or ended too early. As a result the objects resulting from observing executions and that should be analyzed may correspond to "partial" observations in two aspects: (1) that of lacking means to reorder events globally and (2) that of having missing events.

Modeling Distributed Systems

In order to apply FV techniques to DSs, we need a formal modelling language for DSs. In the context of this thesis, we focus on behavioral models i.e. models which specify the intended behaviors of the system they represent. With that in mind, one can model DSs in essentially two manners. We can either model each individual sub-systems with a local model and then the global model is some form of a composition of those local models. Or we can directly design a global model, which will not detail the inner workings of local sub-systems but rather focus on the exchanges between those sub-systems. In the domain of service oriented computing, the distinction between those two kinds of approaches is well identified [START_REF] Lanese | Bridging the gap between interaction and processoriented choreographies[END_REF], with choreography languages being either "interaction-oriented" such as WS-CDL (Web Service Choreography Description Language) [START_REF]Web service choreography description language[END_REF] or "process-oriented" such as WS-BPL (Web Service Business Process Execution Language) [START_REF]Web service choreography business process execution language[END_REF].

Another manner to perceive this distinction is to understand the modelling process as either a "top-down" or "bottom-up" process: "process-oriented" approaches are "bottom-up" given that we start from the local components and then the global behavior is emergent while "interaction-oriented" approaches are "top-down" given that the global behavior is directly modelled. This terminology can be notably found in [START_REF] Crespi | Top-down vs bottom-up methodologies in multi-agent system design[END_REF] in the domain of multi-agent systems.

Bottom-up approaches

In bottom-up approaches, each component of the DS is modeled locally. Then, inputs and outputs of local models are connected to the other sub-models (or the environment) with which they communicate through a certain communication medium [START_REF] Babich | Formal methods for specification and analysis of communication protocols[END_REF][START_REF] Engels | A hierarchy of communication models for message sequence charts[END_REF][START_REF] Basile | Relating two automata-based models of orchestration and choreography[END_REF] and a global model is thus constructed "from the bottom to the top" (or one can also describe it as "from the local to the global"). The global behaviors that are specified in this manner emerge from the executions of local models.

The communication medium [START_REF] Babich | Formal methods for specification and analysis of communication protocols[END_REF][START_REF] Engels | A hierarchy of communication models for message sequence charts[END_REF][START_REF] Basile | Relating two automata-based models of orchestration and choreography[END_REF] orchestrates the exchange of messages between local models by associating outputs to corresponding inputs. This association can take the form of one or several buffers with different policies (FIFO, random access, etc.) as explained in [START_REF] Basile | Relating two automata-based models of orchestration and choreography[END_REF].

Formalisms used in bottom-up approaches include state-transitions modeling languages such as Finite 1.2. MODELING DISTRIBUTED SYSTEMS State Machine (FSM) [START_REF] Brand | On communicating finite-state machines[END_REF][START_REF] Basile | Relating two automata-based models of orchestration and choreography[END_REF], Labelled Transition System (LTS) [START_REF] Tretmans | Model Based Testing with Labelled Transition Systems[END_REF] or more complex formalisms with data such as Input Output Symbolic Transition System (IOSTS) [START_REF] Bannour | Eliciting unitary constraints from timed sequence diagram with symbolic techniques: Application to testing[END_REF] and so on. In the Universal Modeling Language (UML) [24] a particular type of diagrams called State Diagrams [START_REF] Muan | Towards formalizing uml state diagrams in csp[END_REF] also corresponds to this type of models.

Top-down approaches

In a top-down approach, the exchanges between the sub-systems of the DS are directly modelled. As in the bottom-up case, those exchanges can be modelled by atomic observable events that consist in either the emission or the reception of a given message on a specific sub-system. However, instead of focusing on the local ordering of events on specific sub-systems, those events are scheduled (ordered with an order relation that may be partial) globally. This global scheduling is to be found in the structure of the model itself instead of being a result of the execution of local models orchestrated by a communication medium. Formalisms that can be described as top-down include Petri nets and its derivatives such as Coloured Petri Net (CPN) [START_REF] Jensen | Coloured Petri Nets and CPN Tools for modelling and validation of concurrent systems[END_REF] and formalisms derived from Message Sequence Chart (MSC) [22] such as Live Sequence Chart (LSC) [START_REF] Damm | Lscs: Breathing life into message sequence charts[END_REF], which may be referred to as Interaction Languages (ILs). In Universal Modeling Language (UML) [24], Sequence Diagrams are included as an adaptation of MSC into UML.

On the choice of a modeling language

Aspects to consider for the choice of a modeling language may include its expressivity (ability to express detailed behavior), its ease of use (linked to the human effort of the modeling process), ease of understanding (when used as documentation) and ability to be used as input for Formal Verification techniques.

Expressive languages of both types can be found. In terms of usability in FV, "process-oriented" approaches are generally more established and benefit from various ready to use tools with for instance SPIN [START_REF]Spin tool[END_REF], Estelle [11] or LOTOS [13] for Extended Communicating Finite State Machine (ECFSM), PragmaDev Studio [START_REF]Pragmadev studio[END_REF], JADE [START_REF]Jade tool[END_REF], Cinderella [START_REF]Cinderella tool[END_REF] or OpenGeode [START_REF]Opengeode tool[END_REF] for the SDL language, UPPAAL [START_REF]Uppaal tool[END_REF] for networks of timed automata with data or Diversity [START_REF]Diversity tool[END_REF] for sets of communicating Input Output Symbolic Transition System (IOSTS). By contrast, tools for FV based on "interaction-oriented" languages are rarer and they mostly involve Petri nets or rely on translations towards "process-oriented" formalisms (cf. Chap.3).

In terms of ease of use and understanding however, "interaction-oriented" approaches have some advantages. According to [START_REF] Badreddin | Model oriented programming: Bridging the code-model divide[END_REF], the boundary between modeling and implementing is quite blurry; both activities being only differentiated by the level of abstraction and the completeness of the objects they produce. We could argue that with "process-oriented" approaches, more effort is overall required, given that each subsystem must be modeled, and that this effort often overlaps that of implementation given that most systems are implemented in a bottom-up development style. In [START_REF] Lanese | Bridging the gap between interaction and processoriented choreographies[END_REF], the authors also argue that "interaction-oriented" approaches support a more abstract (global) vision.

In the context of this thesis we have chosen to focus on Interaction Languages (languages of the family of MSC) for modelling DSs with asynchronous communication. Those languages represent the behavior of distributed systems in an intuitive graphical format while allowing nuanced and detailed specifications.

Research questions & position of the thesis 1.3.1 Formalisation of Interaction Languages

On the one hand, the particularities of Distributed Systems are such that classical approaches, originally formulated for the design and verification of centralized systems, even though they are well detailed and come a wide array of tools, cannot be transposed for the design and verification of DSs [START_REF] Longuet | Global and local testing from message sequence charts[END_REF]. The formal specification and verification of DSs requires dedicated formalisms and methods.

On the other hand, Interaction Languages are popular and intuitive languages for the (mostly informal) specification of the behaviors of DSs. Interaction models, represented graphically in the fashion of UML Sequence Diagrams are indeed often found in the documentation of software projects. They allow to synthesize in an intuitive manner the explication of communication schemes between entities that would otherwise require the writing of long documents in natural language. Even though human generally find the understanding of such models relatively easy, it is not the case for computers. This is made evident by [START_REF]Official coq website[END_REF] the lack of support for model-based design and testing approaches that rely on interaction models and (2) more generally by their scarce use in FV. The few existing approaches to the formalisation and use of ILs in FV (notably tooled approaches) mostly rely on complicated translations towards other formalisms which are often constrained and incomplete. One of the key factors to the difficulty of formalizing and tooling interaction models lies in weak sequencing. Weak sequencing correspond to the top to bottom direction in which one reads an interaction diagram and that represents the elapse of time during execution. Weak sequencing, which is a form of locally defined sequentiality, induces specific partial orders between the occurrences of events that cannot be otherwise specified using classical strict sequentiality and interleaving.

As a result of this, the question of providing a formalisation of an expressive IL that can be used in FV naturally comes in mind. We propose to discuss this issue in the light of the domains of formal languages, term rewriting and process calculus.

Methods for analysing executions of Distributed Systems

Innovative uses of IoT systems in critical infrastructure such as smart grids or in healthcare require a high level of confidence and security which in turn requires the use of formally verified approaches for design and test. The scale and potential complexity of such systems also requires methodologies which are extensible and that support automation so as to afford reasonable costs in terms of human effort.

In particular, one might be interested in offline (i.e. a posteriori) analysis of the executions of such systems, that may be observed via the collection of log files. Whether it be for making sure of the smooth operation of a Distributed System that is already deployed or for testing an implementation during the 1.3. RESEARCH QUESTIONS & POSITION OF THE THESIS process of designing a DS, this kind of analysis can be used to increase the confidence in the conformance of a DS with regards to its specification [START_REF] Gaudel | Software Testing Based on Formal Specification[END_REF]. In the existing literature, offline analysis is most often limited to verifying local conformance on each sub-system (as in [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] using automata) which can also be completed by methods for checking that each instance of a received message has previously been sent (as in [START_REF] Benharrat | Constraint-based oracles for timed distributed systems[END_REF], which additionally verifies temporal constraints).

In this thesis, we also propose to address the issue of offline analysis by defining algorithms for analyzing observations of some executions of a DS against a formal specification of that DS written as an interaction model. The nature of the approach that we enquire, based on the automated use of models, falls within the issue of defining automatized, reusable and extensible methods for FV based on Interaction Languages.

However, in contrast to the state of the art, we aim at defining an approach that is global by construction and cannot be brought back to a conjunction of local verifications.

Partial observations of distributed executions

In relation to the issue of offline analysis, the observations of DS executions that ought to be analyzed may not be complete. This incompleteness Indeed, without mechanisms to synchronize distant loggers (local testers), it is impossible to ensure that each logger starts and ends logging at the right times. This can result in communication events being missed (i.e. not logged) either at the beginning or the end of any locally defined log file. From a more abstract perspective, this corresponds to having an observation of the execution which is only partial.

The current state of the art regarding the analysis of logs against specifications of DSs mainly revolves around the use of Petri Nets or sets of automata. Moreover those analyses are often constrained by hypotheses on the existence of synchronisation points and partial observation is scantily treated. We propose to address this question through the definition of analysis algorithms that may use either (1) simulation steps so as to "fill-in" the unobserved events by simulating the behavior of sub-systems that were not observed (in a specific span of time) or (2) hiding steps which consists in erasing parts of the formal model against which the analysis is performed once, during the analysis, the sub-systems that are modelled by those parts are not observed anymore.

Position of the thesis

Therefore, an avenue of research exists when it comes to the development of Formal Verification techniques based on formal Interaction Languages. In this thesis we aim at the development of such formal methods. In particular, we are interested in verifying partially observed executions of Distributed Systems with regards to formal specifications written as interaction models. In addition to those theoretical concerns on the formalization of such approaches, the thesis also aims at providing practical and concrete tooled solutions. Indeed, as the thesis has been carried out as part of the DisTA (Distributed Test Automation) FUI project financed by the French ministry of Economy and Finance, we have met with practical challenges that comes with the realization of use cases and proofs of concepts with industrial partners.

Outline

This thesis is composed of four parts.

The zeroth part, which includes this introduction, contains introductory material:

• Chap.2 presents contextual information on several domains which relate to the works of this thesis • Chap.3 gives a quick state of the art on the formal semantics associated to Interaction Languages

The first part is dedicated to the definition of our take on an Interaction Language (IL) and of various trace and multi-trace semantics that can be associated to it:

• in Chap. 4 we define the syntax of an IL which is particularly expressive when it comes to the scheduling and repetitions of events. Indeed, this IL contains operators for strict and weak sequencing, interleaving, alternatives, and four semantically distinct loop operators for expressing nuances in the repetition of behaviors. We then associate this formal language with a trace semantics, associating each interaction to a set of traces, which are globally defined sequences of observed events. A first formulation of that semantics is given in denotational style: we use algebraic operators on sets of traces so as to construct the semantics of complex terms by composition of those of simpler sub-terms. This then allows us to define a process to compute normal forms (within a class of semantically equivalent terms) of interactions using ordered and class rewriting.

• in Chap.5 we define a structural operational semantics for our IL. This small-step semantics relies on making interaction models executable, with each step of execution consisting in the expression of a communication action and transforming the interaction into a "follow-up" which specifies what "remains to be executed". This formulation of a trace semantics is inspired by process calculus. We then prove the equivalence of this second semantics with regards to the denotational semantics which serves as a mathematical foundation (Coq proof in [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF]). The contribution of this operational semantics and its proof of correctness w.r.t. the denotational is the object of [START_REF] Mahe | A structural operational semantics for interactions with a look at loops[END_REF] (submitted in April 2021).

• in Chap.6 we redefine the operational semantics in the style of functional programming languages with a twist. That twist consists in separating concerns between the determination of which actions are immediately executable and the actual computation of the "follow-up" interaction to their execution.

The first concern is translated into the formulation of a "frontier of execution" while the second is transposed as an "execution function". This "algorithmization" of the operational semantics ("execution semantics") is then declined into variants in which intermediate interactions are simplified on the fly to ensure working with compact terms. One of those variants notably uses the normalization of intermediate interaction terms. We then prove the equivalence of the execution semantics and its 1.4. OUTLINE variants w.r.t. the first two semantic (Coq proof in [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF]). This verified functional-style semantics serves as a basis for the later tool implementations.

• in Chap.7 we extend the notion of the semantics of interactions from trace semantics to various "multitrace" semantics, which take into account the distributed nature of observed behaviors and the potentiality for a partial observation of those behaviors.

-We define an algebraic multi-trace semantics in denotational style using algebraic operators on sets of multi-traces and compare it to a projected multi-trace semantics obtained by projection of the trace semantics. Due to weak sequencing, those two semantics do not generally coincide except in two particular cases. The semantics that is "correct" in intention is the projected multitrace semantics. However, the algebraic multi-trace semantics benefits from interesting properties due to its definition. We may notably take advantage of this in the cases in which both semantics coincide.

-Given the nature of multi-traces as sets of sequences the usual notions of prefixes and substrings have to be extended so as to capture the fact that events might be missing at the beginning or end of each local trace component. Accordingly, we define prefixes and slices in the sense of multi-traces and then defined three variants of the projected multi-trace semantics: (1) that of the projections of prefixes of accepted traces, (2) that of prefixes (in the sense of multi-traces) of accepted multi-traces (prefix closure) and (3) that of slices (in the sense of multi-traces) of accepted multi-traces (slice closure). Those semantics cover cases of "partial observation" when collecting multi-traces from observing executions of DSs.

The second part is devoted to the definition of various algorithms for analyzing multi-traces against interaction models, including in case of partial observation:

• in Chap.8 we discuss the problem of analysing multi-traces. This chapter constitutes an introduction to the second part of the thesis.

• in Chap.9 we define a first algorithm for recognizing accepted multi-traces.

-This algorithm constitutes a solution for the membership problem of the projected multi-trace semantics i.e. determining whether or not a given multi-trace belongs to that semantics w.r.t a given interaction. The underlying problem incidentally corresponds to an instance of the problem of offline analysis i.e. the verification of executions of DSs against formal specifications expressed as interactions. In order to define this algorithm, we take advantage of the operational formulation of the trace semantics of interactions which makes available an "execution relation" which may be used to simultaneously execute an action in an interaction and consume it from the head of a given multi-trace component.

-We then prove the correctness of this algorithm i.e. that is is indeed a solution to the aforementioned membership problem (Coq proof in [START_REF] Mahe | Coq proof for the correctness of the multi-trace analysis algorithm[END_REF]).

-In addition, we take an interest in the complexity class of the membership problem and prove that it is NP-hard.

Our initial approach to defining such an algorithm, for the analysis of accepted global traces and their prefixes, is described in [START_REF] Mahe | Revisiting semantics of interactions for trace validity analysis[END_REF] (published in ETAPS-FASE-2020). In [START_REF] Mahe | A small-step approach to multi-trace checking against interactions[END_REF] (published in SAC- SVT-2021) we extend this initial algorithm to cover the analysis of accepted multi-traces. In Chap.9 we synthesize and extend both previous approaches.

• in Chap.10 we define the notion of hiding interactions and propose two applications:

one for defining a second algorithm which can recognize prefixes (in the sense of multi-traces) of accepted multi-traces. This algorithm uses hiding steps to do so. Hiding steps correspond to erasing parts of the model during the analysis once the sub-systems which those erased parts model are no longer observed. We then prove the correctness of this algorithm.

another for improving the efficiency of analysis algorithms via a reduction in their search space.

We reduce this search space by cutting some branches which are guaranteed to yield a F ail verdict (i.e. the multi-trace cannot be recognized as accepted when exploring those branches).

The determination of those branches to cut is made using a notion of local frontier which is that of which actions can be executed next on a specific sub-system.

In the wake of those theoretical results, we present extensions of the formalisms and the implementation of tools in the third part of the thesis:

• in Chap.11 we present immediate extensions which include:

the definition of additional (unproven) algorithms which make use of simulation steps to recognize prefixes and slices of accepted multi-traces. Simulation steps correspond to simulating the behavior of sub-systems which are not observed (not yet observed or not observed anymore) by executing relevant parts of the model.

the addition of a co-region construct to facilitate the design of interaction specifications a discussion on the ease of implementation of the results of this thesis and the presentation of a process by which to implement the analysis algorithms which we have presented in an efficient and configurable manner • in Chap.12 we present the first tool HIBOU (for Holistic Interaction Behavioral Oracle Utility) which is a direct implementation of most theoretical results from the first two parts of the thesis. In addition,

HIBOU proposes:

a user friendly interface (Command Line Interface and entry language) -features for graphically representing interactions, the computation of their normal forms, their semantics and graphs relating to analyses of multi-traces 1.4. OUTLINE various heuristics dedicated to the smooth exploration of execution trees (for computing semantics) and analysis graphs (for analysing multi-traces)

• in Chap. 13 we motivate and introduce an extension of our IL and FV framework to treat interaction models enriched with data. This takes the form of (1) having lifelines being associated to typed variables which can be created and modified at runtime, (2) having the execution of communication actions being preceded or followed by the execution of statements consisting in variable assignment and guards which constrain the current values of variables and condition the execution of said actions and (3) having messages being a more precise abstraction of exchanged information with the addition of typed message parameters. We also discuss extending multi-trace analysis to multi-traces with concrete data as parameters of messages.

• finally, in Chap.14 we present the second tool HIBOUX (for HIBOU with symbolic eXecution) which implements that which we have discussed in the previous chapter. HIBOUX extends the functionalities of HIBOU to treat interaction models enriched with data and uses symbolic execution to execute and animate those enriched models and to analyse multi-traces with typed message parameters. We then present an industrial use-case, provided by Thales, on which HIBOUX was used as part of the DisTA FUI project. For any set (alphabet) Σ the free monoid Σ * generated by Σ contains words on Σ and is defined by: • ∈ Σ * is the empty word • Σ ⊂ Σ * i.e. each individual letter as a word

• for any words u and v in Σ * , the word denoted by u.v or more simply uv is also in Σ *

The "." concatenation operator that is thus induced is such that:

• it admits as a neutral element

• it is associative For any words u and v in Σ * we say that:

• u is a prefix of v and we denote it by u ≤ v iff there exists w ∈ Σ * such that v = u.w

• u is a subword of v iff there exists w and w such that v = w.u.w For any set V of words, we say that V is closed by prefixes if it contains all the prefixes of all its elements. Not all those words are necessarily "well-formed" w.r.t. the formal language. In the definition of a formal language, the manner in which those words are selected is not given. Rules for the systematic generation (e.g. by a computer) of all well-formed words from an alphabet are usually given by a "formal grammar" [START_REF]Handbook of Formal Languages[END_REF] which consists of sets of symbols and production rules which can be used to create increasingly complex words.

Formal grammars can be categorized using the Chomsky hierarchy [START_REF]Handbook of Formal Languages[END_REF] according to their expressivity. Type-3 grammars, which can generate regular languages are the simplest while type-0 grammars can generate the more complex recursively enumerable languages. In the context of this thesis, we will be only interested in type-2 "context-free" grammars.

The semantics of formal languages

The grammars of formal languages describe the syntax of words i.e. which words are or are not well-formed.

By contrast, the study of the meaning of words and languages relates to their semantics. This is particularly relevant in the context of programming languages and modelling languages, which are particular kinds of formal languages.

Programs that can be written in a programming language are well-formed words of that language. However the outputs that can be produced by the program once compiled and executed on a computer are intractably complex and cannot generally be inferred from its code. We can define the formal semantics of a programming language so as to understand, describe and explain the complex relationships that can exist between its code, its inputs and its outputs [START_REF] Winskel | The Formal Semantics of Programming Languages: An Introduction[END_REF][START_REF] Kenneth | Formal syntax and semantics of programming languages -a laboratory based approach[END_REF][START_REF] Harel | Modeling languages: Syntax, semantics and all that stuff, part i: The basic stuff[END_REF].

As illustrated on Fig. 2.1, a semantics of a language can be defined by mapping objects of the syntactic domain (the syntax) into objects of a semantic domain. The definition of what constitutes a semantic domain may vary. For instance, in the case of programming languages (the syntactic domain being that of well-formed programs) it may consist in sequences of strings observed of the standard output of a program. There is a variety of different manners to define formal semantics. [START_REF] Kenneth | Formal syntax and semantics of programming languages -a laboratory based approach[END_REF] proposes the following categories:

• "translational semantics" ( [START_REF] Kenneth | Formal syntax and semantics of programming languages -a laboratory based approach[END_REF] p.187-222), which consist in providing a semantics for a high-level language via a translation towards a lower level language which is already equipped with a semantics.

• "operational semantics" ( [START_REF] Kenneth | Formal syntax and semantics of programming languages -a laboratory based approach[END_REF] p.223-270), which rely on defining a manner to execute the words of the language. In particular, "small-step operational semantics" also called "structural operational semantics" ( [START_REF] Kenneth | Formal syntax and semantics of programming languages -a laboratory based approach[END_REF] p.238-261) explicit atomic computation steps that constitute the execution of a word.

• "denotational semantics" ( [START_REF] Kenneth | Formal syntax and semantics of programming languages -a laboratory based approach[END_REF] p.271-340), which map concepts of the language into some mathematical objects (numbers, sets, tuples, functions, etc.). The resulting mathematical object is called a "denotation". Denotational semantics are compositional. They infer the meaning of a word by building denotations recursively based on the structure of the language's words. By that is meant that the denotation of a word is constructed out of the denotation of its "sub-words".

• various other types of semantics can be described such as "fixed-point semantics" ( [START_REF] Kenneth | Formal syntax and semantics of programming languages -a laboratory based approach[END_REF] p.341-394) or "axiomatic semantics" ( [START_REF] Kenneth | Formal syntax and semantics of programming languages -a laboratory based approach[END_REF] p.395-442) but those are outside the scope of this thesis.

When it comes to modelling languages, the question of what constitute their semantics do not have an obvious answer, as explained in [START_REF] Harel | Modeling languages: Syntax, semantics and all that stuff, part i: The basic stuff[END_REF]. Indeed, there is a wide variety of modelling languages that can be used to express many different concepts; for instance a structural model has a purpose which is entirely different from that of a behavioral model. Nevertheless, we can roughly use the same categorisation of semantics when it comes to describing modelling languages and their semantics. In particular, in the context of this thesis (1) we only consider behavioral models i.e. models which specify the intended behaviors of the system they represent and (2) we are mainly interested in denotational and operational semantics while various translational semantics are found in the related state of the art.

Equational logic & rewriting

Words of a formal language, and more particularly in the case of context-free languages, can be understood as terms built by composition from basic building blocks and using operators. This compositionality in the structure of terms may then allow the definition of denotational semantics as morphisms between the syntactic domain of terms and a given semantic domain. Considering terms which have the same semantics and reasoning on syntactic transformations that preserve said semantics can then lead to the definition of classes of equivalence and normal forms of terms.

In this section we present term algebras, equational logic and term rewriting which will enable us to produce such results for our Interaction Language (IL).

Term algebras

In this section we present term algebras as a means to formalize this understanding of words of a language as terms.

In Def.2.2 we define the notion of operation symbols and how they can constitute "signatures" of term algebras which we then define in Def.2.3.

Definition 2.2: Signature

A signature F is a set of operation symbols: F = j≥0 F j such that for any integer j ≥ 0, the set F j is that of symbols of arity j. For any such symbol f , we denote by |f | its arity. Symbols of arity 0 are called constants.

An operation symbol may correspond to an operator in a mathematical formula. For instance the addition "+" operator or the conjunction "∧" operator could be defined as operation symbols of arity 2.

Operation symbols of arity 0 correspond to the basic building blocks which we mentioned earlier. Continuing on the example of mathematical formulae, the constant integer 1 or the constant truth value could be defined as operation symbols of arity 0.

Definition 2.3: Term Algebras

Given a signature F and a set X of variables that is disjoint from F, the term algebra T F (X ) is the smallest subset of ({(, )} ∪ F ∪ X ) * such that:

• X ∪ F 0 ⊂ T F (X )

• for any symbol f ∈ F of arity n > 0 and for any terms t 1 , • • • , t n from T F (X ),

we have that

f (t 1 , • • • , t n ) ∈ T F (X )
The ground term algebra T F can be defined as T F (∅) and contains all terms without variables.

This manner of constructing elements of a term algebra, called first-order terms [START_REF] Jouannaud | Higher-Order Rewriting: Framework, Confluence and Termination[END_REF], can be described as a definition by closure. Indeed, variables and constants form basic building-blocks and symbols of higher arity can be used as construction rules for the formulation of more complex elements.

This inductive construction also allows us to define functions and to make proofs using structural induction [START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF]. The principle of a proof by structural induction is that once a property is proven for all base elements and, if this property is conserved by the application of the construction rules corresponding to symbols of arity n > 0, then it is proven for all terms.

Variables (via the set X of variables) can be used in the construction of a term so as to abstract some non-determined sub-term. We can draw a distinction between terms without variables, which are called ground terms, and terms in which there are variables. We may use the notation var(t) to designate the set of variables that occur on a given term t, as defined in Def.2.4.

Definition 2.4: Variables of a term

For any term t ∈ T F (X ), we denote by var(t) ∈ P(X ) its set of variables defined by:

• if t ∈ X then var(t) = {t} • if t ∈ F 0 then var(t) = ∅ • if t = f (t 1 , • • • , t n )
with n > 0 and f ∈ F n then var(t) = j∈ [1,n] var(t j )

Another result stemming from the domain of term algebras is that of describing terms as trees. This understanding of terms as trees, which nodes are uniquely associated to positions [START_REF] Jouannaud | Higher-Order Rewriting: Framework, Confluence and Termination[END_REF][START_REF] Dershowitz | Rewrite Systems[END_REF], allows the description of operations on those terms. In Def.2.5 we define the notion of tree (as understood in the context of term algebras [START_REF] Jouannaud | Higher-Order Rewriting: Framework, Confluence and Termination[END_REF]) and positions.

In Def.2.5, we define, for any term t ∈ T F (X ), the set pos(t) as the set of its positions. As in [START_REF] Dershowitz | Rewrite Systems[END_REF][START_REF] Jouannaud | Higher-Order Rewriting: Framework, Confluence and Termination[END_REF],

we denote by t(p) the node at position p and by t |p the sub-term at position p. The definition of positions as words on integers is sometimes referred to as the Dewey Decimal Notation [START_REF] Dershowitz | Rewrite Systems[END_REF][START_REF] Comon | Tree automata techniques and applications[END_REF].

Definition 2.5: Trees and positions

Given a signature F and a set X of variables, a tree on F ∪ X is a partial application t : N * + → F ∪ X defined over a finite domain pos(t) of N * + such that:

• pos(t) is closed by prefixes

• for any p ∈ pos(t) and for any j ∈ N + , we have p.j ∈ pos(t) iff t(p) = f ∈ F and 1 ≤ j ≤ |f |

Let us remark that, in a ground term t (i.e. without variables), nodes t(p) at leaf positions hosts constants (elements of F 0 ) while inner nodes hosts operation symbols of higher arity [START_REF] Dershowitz | Rewrite Systems[END_REF]. In all generality one could define infinite trees. However, in Def.2.5 we have required that they be defined on a finite domain of positions and hence are finite trees. The set of finite trees on F ∪ X is isomorph w.r.t. the set of terms T F (X ). As a result we may describe freely elements of a term algebra as either terms or trees.

In Def.2.6 we define the notion of term replacement, with the notation t[s] p being used to indicate the term that results from replacing the sub-term t |p at position p within t by s.

Definition 2.6: Term replacement

For any (t, s) ∈ T F (X ) 2 , for any p ∈ pos(t), the term t[s] p is defined inductively by:

• t[s] = s • f (t |1 , • • • , t |n )[s] j.p = f (t |1 , • • • , t |j [s] p , • • • , t |n ) for any n > 0, j ∈ [1, n] and f ∈ F n

F-algebras

In the same manner as a term algebra T F (X ) can be used to describe the syntactic domain of a language, we can define an algebra to represent the semantic domain of said language. In this section we define F-algebras for that purpose.

As explained in [START_REF] Dershowitz | Rewrite Systems[END_REF][START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF], given a signature F of operation symbols, a F-algebra consists of (1) a nonempty set A which is a "domain of values" that we may call the "carrier" of the algebra, and (2) a family F A (indexed by F) of operations on A. We formalize this definition in Def.2.7.

Definition 2.7: F-algebras

An F-algebra is a structure A = (A, F A ) where:

• A is a non-empty set called the carrier of the algebra

• F A = {f A | f ∈ F} such that for each operation symbol f ∈ F:

-if |f | = 0 then f A is an element of A -if |f | = n > 0 then f A is a total function f A : A n → A
A purpose of F-algebras, as explained in [START_REF] Dershowitz | Rewrite Systems[END_REF], is to attach meaning to terms of T F (X ). This can be done through the definition of "environments" [START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF] which map terms t ∈ T F (X ) to values in the domain of values A (carrier of the F-algebra) thanks to the operations from F A . We formally define environments in Def.2.8.

Definition 2.8: Environments

Given a mapping ρ : X → A, we denote by ρ : T F (X ) → A and we call an "environment" the unique homomorphism that extends ρ such that:

∀ f ∈ F, of arity n, ρ(f (t 1 , • • • , t n )) = f A (ρ(t 1 ), • • • , ρ(t n ))
The semantic mapping evoked in Sec.2.1 that relates words to their meaning can then be defined as an "environment" as defined in Def.2.8. More particularly, in the case of ground terms, we can define the semantics of elements of a ground term algebra T F as the unique such "environment" between T F and A.

This unique homomorphism is sometimes described as the initial homormorphism or the homomorphism between the initial algebra and the free algebra [START_REF] Kirchner | Equational logic and rewriting[END_REF] associated to F.

Preliminaries on binary relations

Binary relations relate terms of a term algebra. For instance we might be interested in defining a relation on terms that are not necessarily syntactically equal but that have the same semantics. In any case, the purpose of this section is to introduce binary relations and their properties.

Definition 2.9: Binary relations

A binary relation R on a set A is a subset of A × A. We may use the infix notation xRy to denote elements (x, y) ∈ R.

For any two binary relations R 1 and R 2 on the same set A, we may denote by

R 1 • R 2 the composition of both relations such that R 1 • R 2 = {(x, z) ∈ A × A | ∃ y ∈ A, xR 1 y ∧ yR 2 z}.
Also, given that binary relations are defined as sets, we may say that a relation is included in another and use classical set theoretic notations ⊂, ⊆, and ⊆ to describe relations between binary relations.

In Def.2.10 we summarize basic properties that may describe specific binary relations.

Definition 2.10: Basic properties of binary relations

A binary relation R on a set A is said to be:

• symmetric if for any (x, y) ∈ A 2 we have that xRy implies yRx

• antisymmetric if for any (x, y) ∈ A 2 if we have both xRy and yRx then this implies that x = y

• reflexive if for any x ∈ A we have xRx

• antireflexive if for any x ∈ A we do not have xRx

• transitive if for any (x, y, z) ∈ A 3 if we have both xRy and yRz then this implies that xRz Binary relations that satisfy specific combinations of the properties from Def.2.10 may be described by specific terms, some of which are given in Def.2.11.

Definition 2.11: Specific kinds of binary relations

A binary relation R on a set A is said to be:

• a quasiorder if it is reflexive and transitive

• an order if it is reflexive, transitive and antisymmetric

• a strict order if it is antireflexive, transitive and antisymmetric

• an equivalence relation if it is reflexive, symmetric and transitive

As implied by Def.2.11 the notion of orders can be described by binary relations. We may use the notation ≥ to describe a quasiorder. For any such quasiorder ≥ on a set A, and for any two elements x and y of A we may equally denote by y ≤ x the fact that x ≥ y. Likewise we may use the notations > and < to describe a strict order.

In addition, quasiorders, orders and strict orders can be described as being either total or partial. For any order > on a set A, > is said to be total if, for any two distinct elements x and y of A we have either

x > y or x < y. An order is partial if it is not total. For a partial order > on a set A, we may denote by

x < y the fact that we do not have x < y, which, given that the order is partial do not necessarily equates having x > y.

A strict order > on a set A is said to be well-founded or noetherian if there exists no infinite descending ↔ its symmetric, reflexive and transitive closure (which always is an equivalence relation)

Binary relations can be defined on term algebras. For a term algebra T F (X ) defined w.r.t. a signature F, we say that a binary relation R on T F (X ) is F-compatible if it satisfies the definition from Def.2.14. A F-compatible binary relation is compatible with the algebraic structure of the term algebra T F (X ).

Definition 2.14: F-compatible binary relation

A binary relation R on T F (X ) is F-compatible if for any operation symbol f ∈ F n of arity n > 0 and for any terms x 1 , • • • , x n and y 1 , • • • , y n we have:

(∀ j ∈ [1, n], x j Ry j ) ⇒ (f (x 1 , • • • , x n )Rf (y 1 , • • • , y n ))
In the more general context of abstract algebra, an equivalence relation that is defined on and compatible with an algebraic structure is said to be a congruence relation. In the particular case of F-algebras, a Fcompatible equivalence relation on T F (X ) is said to be a congruence relation on T F (X ).

As per [START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF][START_REF] Dershowitz | Rewrite Systems[END_REF], a substitution is a mapping from variables (i.e. X ) to terms (i.e. T F (X )) that is extended to terms i.e. as an endomorphism of T F (X ). In practice, a substitution operates the systematic replacement of specific variables (all occurrences of those variables) within a term.

Definition 2.15: Substitutions

A mapping φ : X → T F (X ) is extended to terms as a substitution φ † s.t. for any term t:

• if t ∈ X then φ † (t) = φ(t) • if t ∈ F 0 then φ † (t) = t • if t = f (t 1 , • • • , t n ) with f ∈ F n given n > 0 then φ † (t) = f (φ † (t 1 ), • • • , φ † (t n ))
We may abusively denote by φ either the initial mapping φ or the substitution φ † .

We denote by Sub(T F (X )) the set of all substitutions on T F (X ).

We call the domain of a substitution φ the set Dom(φ) = {x ∈ X | φ(x) = x} which includes variables that are effectively substituted when applying the substitution. A substitution might not replace all or any variables at all; for instance the identity can be described as the substitution on the empty domain. We can also remark that substitutions replace all occurrences of all variables of their domain at once. As a result we may denote a substitution using its domain: for instance, given φ such that Dom(φ) = {x 1 , x 2 }, φ(x 1 ) = t 1 and φ(x 2 ) = t 2 , we might denote φ by

x 1 → t 1 , x 2 → t 2 .
Also, substitutions do not generally commute. For instance x 1 → t 1 , • • • , x n → t n is not necessarily equivalent to the composition of all x j → t j . This is due to the fact that all variables are replaced at once and the fact that applying a substitution x j → t j might introduce new instances of variables x j (j = j).

Binary relations on terms can also be said to be stable under substitution, as defined on Def.2.16.

Definition 2.16: Binary relations on terms that are stable under substitution

A binary relation R on T F (X ) is stable under substitution if for any substitution φ ∈ Sub(T F (X )) and for any terms x, y ∈ T F (X ) we have:

xRy ⇒ φ(x)Rφ(y)
In Def.2. 13 we have seen that basic properties of binary relations (Def.2.10) can be used to define larger relations by closure. This can also be applied for the properties of being F-compatible and stable under substitution. For any binary relation R on terms of T F (X ):

• the closure under substitution of R is the smallest relation that is stable under substitution and which includes R

• the congruence closure of R is the smallest congruence relation which includes R

Equational logic

In this section we present how we can relate syntactically distinct terms of a term algebra. In particular we can apply those results so as to define equivalence classes of syntactically distinct interaction terms which all have the same semantics (as per the association to a given F-algebra).

For any two terms l and r from T F (X ), we denote by l ≈ r an "equation" or "equational axiom" in which l might be called the "left-hand side" and r may be called the "right-hand side". The l ≈ r equation is a predicate that we may suppose in a certain context and is not equivalent to the syntaxic equality "l = r".

Definition 2.17: Axiom systems

Given a signature F and a term algebra T F (X ), an equation is a pair (l, r) ∈ T F (X ) × T F (X ) that we may denote by l ≈ r.

A set of equations E ⊂ T F (X ) × T F (X ) is an "axiom system".

Given an axiom system E (defined in Def.2.17), an equation x ≈ y is deducible from E, which we denote by E x ≈ y iff x ≈ y can be obtained from successive transformations of equations from E using the six deduction rules that constitute equational logic [START_REF] Jantzen | Basics of Term Rewriting[END_REF] and that are given in Def.2.18.

Definition 2.18: Equational Logic

Considering an axiom system E ⊂ T F (X ) × T F (X ), we define the relation E of deducibility or provability modulo E as follows:

∀ (x ≈ y) ∈ E, E (x ≈ y) ∀ x ∈ T F (X ), E (x ≈ x) ∀ (x, y) ∈ T F (X ) 2 , E x ≈ y E y ≈ x ∀ (x, y, z) ∈ T F (X ) 3 , E x ≈ y E y ≈ z E x ≈ z ∀ (x, y) ∈ T F (X ) 2 , ∀ φ ∈ Sub(T F (X )), E x ≈ y E φ(x) ≈ φ(y) ∀ f ∈ F j , ∀ (x k , y k ) k∈[1,j] ∈ T F (X ) 2j , E x 1 ≈ y 1 • • • E x j ≈ y j E f (x 1 , • • • , x j ) ≈ f (y 1 , • • • , y j )
For any axiom system E, we may denote by ≈ E the relation such that for any terms x and y, we have E x ≈ E y i.e. such that x and y are provably equal in the theory specified by E [START_REF] Jantzen | Basics of Term Rewriting[END_REF] (using the aforementioned rules of equational logic). The reader may have remarked that this means that ≈ E is the reflexive, symmetric, transitive, F-compatible and stable by substitution closure of the relation E. Indeed, in the rules from Def.2.18 the 2nd corresponds to reflexivity, the 3rd to symmetry, the 4th to transitivity, the 5th to being stable by substitution and the 6th to being F-compatible.

Equational bases

As we have seen in Sec.2.2.2, F-algebras can be defined so as to attach meaning [START_REF] Dershowitz | Rewrite Systems[END_REF] to terms of a term algebra T F (X ). As a result, we have, on the one hand a description of the meaning of terms through F-algebras (semantic domain) and, on the other hand a description of relations between terms (syntax) with equational logic. In this section we present how we can bridge the gap between those two kinds of descriptions with the study of equational bases [START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF].

The interpretation of terms from a term algebra T F (X ) by a F-algebra A induces a congruence relation denoted by = A [START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF] on T F (X ), which we define in Def.2.19. Indeed, we may say that x = A y whenever A attaches the same meaning to both x and y. x and y can then be said to be semantically equal [START_REF] Jantzen | Basics of Term Rewriting[END_REF] which means that we have ρ(x) = ρ(y) for every environment ρ (i.e. whichever values are given to the variables from X ).

Definition 2.19: Congruence relation induced by a F-algebra

Let us consider a signature F, a term algebra T F (X ) and a F-algebra A = (A, F A ).

The relation =

A ⊆ T F (X ) × T F (X ) is defined by: ∀ (x, y) ∈ T F (X ) 2 , (x = A y) ⇔ (∀ ρ ∈ A X , ρ(x) = ρ(y))
Let us remark that in the case of ground algebras T F the definition of = A is straightforward given that there exists a single homomorphism between T F and A.

As explained in [START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF], it is sometimes (but not necessarily) possible to offer a syntactic characterization of a relation = A via the definition of an axiom system E which may serve as an equational base of = A i.e. such that ≈ E is equal to = A . In Def.2.19 we explain how a relation defined on the syntax ≈ E can be characterized w.r.t. a relation defined on the semantics = A .

If an equational base E of a relation = A is found then, issues related to semantic equality can be entirely brought back to reasoning on the syntax. Indeed, as explained in [START_REF] Jantzen | Basics of Term Rewriting[END_REF], the validity problem x = A y i.e. whether or not two terms have the same semantics, can be brought back to the question of whether or not

x ≈ E y holds, which can be determined via the application of equational logic (and more particularly term rewriting [START_REF] Dershowitz | Rewrite Systems[END_REF], as we will see in the following).

Definition 2.20: Sound & complete axiom systems

Let us consider a signature F, a term algebra T F (X ) and a F-algebra A = (A, F A ).

An axiom system E ⊆ T F (X ) × T F (X ) is said to be:

• sound w.r.t. A iff ≈ E ⊆= A • complete w.r.t. A iff = A ⊆≈ E • an equational base of A iff ≈ E == A
Determining whether or not an axiom system E is an equational base for a F-algebra A i.e. for the relation = A can be separated into two problems as per Def.2.20:

1. determining whether or not E is sound w.r.t. A.

determining whether or not

E is complete w.r.t. A.
The problem of proving that an axiom system is sound w.r.t. a F-algebra A is most often simple.

However, proving that it is complete is more problematic. Results and open questions relating to this problem are notably discussed in [START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF]. In the context of this thesis however, we will simply be interested the first problem.

Basics of term rewriting

Equational logic allows us to navigate within the congruence classes [ ] ≈ E of a term algebra via the succession of atomic transformations in which a certain equation from E may be applied in a certain direction, at a certain position, and modulo a certain substitution.

This can be quite useful, as it allows for instance to determine whether or not two terms (t α , t β ) ∈ T F (X ) 2 are related by a congruence relation ≈ E . Indeed this then equates to finding a path

t α ≈ E t 1 ≈ E t 2 ≈ E • • • ≈ E t n ≈ E t β in
which each step consists of an atomic transformation derived from E as described above.

However, finding such a path requires knowing which transformations should be applied at which positions and in which order. A brute force exploration of all sequences of transformations is out of the question due to the exponential complexity costs. On specific example, the use of human intuition is possible, however automation is possible with term rewriting, which is the object of this section.

One of the main purposes of term rewriting is to automatize the process of finding paths t 1 ≈ • • • ≈ t n between related terms, and the means by which this automatization is enabled relies on orienting the equations i.e. imposing a direction for the application of syntactic transformations derived from equations.

In the last section we have seen that the base building blocks of equational logic are (unordered) equations.

Similarly, term rewriting is based on a particular kind of oriented equations that are called rewrite rules [START_REF] Dershowitz | Rewrite Systems[END_REF] or reduction rules [START_REF] Jantzen | Basics of Term Rewriting[END_REF].

Definition 2.21: Rewrite Rules

For any two terms (l, r) ∈ T F (X ) 2 , the ordered pair (l, r) is said to be a rewrite rule if:

• l ∈ X • var(r) ⊆ var(l)
We may then denote any such reduction rule (l, r) by l r.

Applying a rewrite rule l r on a term x ∈ T F (X ) requires that a sub-term of x "matches" the left-hand side l of the rule. This means that there exists a position p ∈ pos(x) and a substitution φ ∈ Sub(T F (X ))

such that x |p = φ(l). We may then say that x |p is an instance of the left-hand side. Then, the application of the rule yields x[φ(r)] p i.e. we replace the sub-term at position p by φ(r). We may also say that we replace the instance φ(l) of the left-hand side by the corresponding instance φ(r) of the right-hand side [START_REF] Dershowitz | Rewrite Systems[END_REF].

We can remark that unlike equations, which are unordered, rewrite rules, which are ordered, only allow to replace instances of the left-hand side l by corresponding instances of the right-hand side r and not the other way around.

A Term Rewriting System (TRS) is then defined as a finite set of rewrite rules (we may define TRSs with infinitely many rules [START_REF] Dershowitz | Rewrite Systems[END_REF] but this is outside the scope of this thesis).

A TRS R is associated to a rewrite relation → R which specifies atomic transformations corresponding to the application of a rewrite rule. As explained in [START_REF] Jouannaud | Associative-commutative rewriting via flattening[END_REF], the closure * → R may be called the derivation of → R because it includes all sequences of transformations that may be derived from → R . Also, *

↔ R , which we may also denote by ≈ R may be called the equational theory generated by R when considered as a set of equations (i.e. we remove the constraint on the orientation of rules) [START_REF] Jouannaud | Associative-commutative rewriting via flattening[END_REF].

A rewrite relation → R may relate infinitely many terms. As a result it may be impossible to represent it in-extenso. The TRS R can then be described as a finite representation of → R .

Definition 2.22: Term Rewriting Systems & rewrite relations

A Term Rewriting System (TRS) is a set R of rewrite rules.

Any such TRS R specifies a one-step rewrite relation → R ∈ T F (X ) 2 such that for any two terms x and y in T F (X ) we have x → R y iff there exists a rule l r ∈ R, a position p ∈ pos(x) and a substitution

φ ∈ Sub(T F (X )) such that x |p = φ(l) and y = x[φ(r)] p .
Whenever we have x → R y with x |p = φ(l) and y = x[φ(r)] p we may say that x |p is a redex and that x is reducible by → R . If, considering all rules l r ∈ R, there are no redexes in x, then there exists no y s.t.

x → R y which we may denote by x → R and we may say that x is irreducible modulo R. For any term x, if we have another term y such that x * → R y then we may say that y is a descendent of x and that x is an ancestor of y. If, in addition, y is irreducible, then y is said to be a normal form of x [START_REF] Dershowitz | Rewrite Systems[END_REF].

For any term x and any TRS R, it is not guaranteed that a normal form of x exists. We may indeed never reach an irreducible term. If this is the case then there must exist an infinite chain x → R Given R, a reduction system, → R is "terminating" (also called "strongly normalizing" or "noetherian")

if there exist no infinite series (t j ) j≥1 of terms such that for any j ∈ N, t j → R t j+1 . This means that any reduction sequence must eventually terminate.

Given that there can exist many possible applications of rules derived from R, there can exist many paths

x * → R • • • starting from x.
As a result, even if R is terminating, the uniqueness of the normal form is not guaranteed.

We have seen that the existence of normal forms is linked to the property of termination (which is even stronger than that as we have seen). Similarly, the uniqueness of a normal form can be linked to a property of "confluence". Confluence refers to the ability to find the same resulting terms when taking different paths resulting from the application of → R .

Confluence, that we define in Def.2.24 can be described with the diagram from Fig.

A TRS R is confluent if * ← R • * → R ⊆ * → R • * ← R
When a TRS R is both terminating and confluent, then it is said to be a convergent. In this case, for any term t, we have both the existence and the unicity of a normal form that we may denote 1 by R(t).

Let us now go back to our initial problem, which is that of determining whether or not two terms t α and t β are related by a congruence ≈ E of base E. We have seen that it suffices to find a path if

t α ≈ E t 1 ≈ E • • • ≈ E t n ≈ E t β . Let us then consider a TRS R such that each rule l r ∈ R verifies that either l ≈ r ∈ E or r ≈ l ∈ E i.
R(t α ) = R(t β ) then we have t α * → R R(t α ) = R(t β ) * ← R t β and therefore t α ≈ E t β . This means that R(t α ) = R(t β ) ⇒ t α ≈ E t β
but the reciprocate may not be necessarily true. For it to be true we would need that * ↔ R =≈ E . This can be ascertained when every equation of E is found in R in a certain orientation.

Ordered rewriting & rewriting modulo theories

Let us consider the example from Fig. 2.3. In this example, we consider a term algebra of Boolean expressions with the "∨" disjunction operator. Given t 1 , t 2 and t 3 three terms, we describe the transformation of

(t 1 ∨ t 2 ) ∨ (t 3 ∨ t 1 ) into t 1 ∨ (t 2 ∨ t 3 )
. This transformation is possible with the following TRS:

R =      (x ∨ y) ∨ z x ∨ (y ∨ z) (1) x ∨ (y ∨ z) (x ∨ y) ∨ z (3) x ∨ y y ∨ x (2) x ∨ x x (4)     
Indeed, the sequence of transformations described on Fig. 2.3 consists in the application of applying rule [START_REF]Official coq website[END_REF] at p = then rule (2) at p = 22, then rule (3) at p = 2, then rule (2) at p = 21, then rule (1) at p = 2, then rule (3) at p = , then rule (4) at p = 1. We can see that we have managed to "simplify" the initial term through some applications of → R .

∨ ∨ t 1 t 2 ∨ t 3 t 1 → R ∨ t 1 ∨ t 2 ∨ t 3 t 1 → R ∨ t 1 ∨ t 2 ∨ t 1 t 3 → R ∨ t 1 ∨ ∨ t 2 t 1 t 3 → R ∨ t 1 ∨ ∨ t 1 t 2 t 3 → R ∨ t 1 ∨ t 1 ∨ t 2 t 3 → R ∨ ∨ t 1 t 1 ∨ t 2 t 3 → R ∨ t 1 ∨ t 2 t 3
However the TRS R is not terminating. Indeed, given variables x, y and z, we have the existence of the

infinite chain x ∨ y → R y ∨ x → R x ∨ y → R • • •
, where we repeat indefinitely the application of rule (2) at p = . Another example of an infinite chain would be x

∨ (y ∨ z) → R (x ∨ y) ∨ z → R x ∨ (y ∨ z) → R • • • ,
where we indefinitely repeat applying rule (3) and then rule (1) at p = .

The TRS not being terminating, we cannot guarantee that the process may yield any normal form. And, as a result, we cannot automatize the process described in Fig. 2.3, which aims at "simplifying" such terms.

As explained in [START_REF] Peterson | Complete sets of reductions for some equational theories[END_REF], properties of operation symbols such as commutativity and associativity are challenging when it comes to the definition of terminating rewrite systems. In this section we explain how we can use ordered rewriting and rewriting modulo theories as a two part solution to tackle those issues. In particular, we show that the human-guided process described on Fig. 2.3 can be automatized.

Ordered rewriting

An Ordered Rewriting System (ORS) [START_REF] Dershowitz | Rewrite Systems[END_REF] is a pair (E, >) denoted as E > where E is an axiom system (i.e.

a set of unordered equations) and > is a rewrite ordering (i.e. an antireflexive, transitive, antisymmetric, F-compatible binary relation that is stable under substitution).

In ordered rewriting we apply equations from E in either order i.e. either from left to right or from right to left. However their application is only enabled under specific conditions [START_REF] Dershowitz | Rewrite Systems[END_REF]. As in the case of TRSs, the application of a rewrite rule l r consists in having a transformation x → y so that there exists a position p ∈ pos(x) and a substitution φ ∈ Sub(T F (X )) such that x |p = φ(l) and y = x[φ(r)] p . However, with ordered rewriting the application of such a transformation is conditioned by having φ(l) > φ(r).

As a result, equations from E can be applied in whichever direction agrees with the ordering > on terms.

Let us for instance suppose that we have an equation f (x, y) ≈ f (y, x) ∈ E, which corresponds to the commutativity of symbol f . Then, if f (x, y) > f (y, x), we may apply f (x, y) → f (y, x). Also, given that > is a rewrite ordering we have that f (x, y) > f (y, x) implies that f (y, x) > f (x, y) and hence f (x, y) → f (y, x)

i.e. we cannot apply the rule in the other direction.

Definition 2.25: Ordered Rewriting System

An Ordered Rewriting System (ORS) is a pair (E, >) denoted as E > where E is an axiom system and > is a rewrite ordering. An ORS E > specifies a one-step rewrite relation

→ E> ∈ T F (X ) 2 s.t. ∀ (x, z) ∈ T F (X ) 2 : (x → E> y) ⇔       ∃ (l r) s.t. ((l ≈ r) ∈ E) ∨ ((r ≈ l) ∈ E), ∃ p ∈ pos(x), ∃ φ ∈ Sub(T F (X )) (x |p = φ(l)) ∧ (y = x[φ(r)] p ) ∧ (φ(l) > φ(r))      
We formally define ORSs in Def.2.25. As for TRSs, ORSs are associated to rewrite relations. We denote by → E> the rewrite relation associated to the ORS E >. Resulting from that definition, we have that, whenever x → E> y, we must have x > y because the transformation x → E> y decreases the rank of a sub-term x p at a certain position p (without modifying the remainder of the term i.e. its context), and because > is F-compatible.

Also, as explained in [START_REF] Dershowitz | Rewrite Systems[END_REF], the ordered-rewriting relation

→ E> verifies → E> ⊆ (≈ E ∩ >).
The fact that it is contained in ≈ E ∩ > (as sets of related terms) is explained by the fact that a transformation specified by → E> can only occur if (1) it corresponds to an equation from E and (2) if it decreases the order of the involved terms.

In particular, if > is a total order, then *

→ E> = (≈ E ∩ ≥) (with ≥= (> ∪ =)) and hence * ↔ E> =≈ E
because ≈ E is a congruence and, > being total, (> ∪ = ∪ <) relates all terms.

Also, given that → E> ⊆>, in order to have a terminating rewrite system, it suffices that > be a noetherian order (defined in Sec.2.2.3).

Let us now go back to our example from Fig. 2.3. Let us consider a rewrite ordering > such that:

• t 1 < t 2 < t 3
• and for any variables x, y and z: In particular, Fig. 2.4 also demonstrates that the first terms of each row are related by E. Indeed, given that → E> ⊆ (≈ E ∩ >) we have that * ↔ E> ⊆≈ E and hence the terms are related by E because we have:

∨ ∨ t 1 t 2 ∨ t 3 t 1 → E> ∨ t 1 ∨ t 2 ∨ t 3 t 1 → E> ∨ t 1 ∨ t 2 ∨ t 1 t 3 → E> ∨ t 1 ∨ ∨ t 2 t 1 t 3 → E> ∨ t 1 ∨ ∨ t 1 t 2 t 3 → E> ∨ t 1 ∨ t 1 ∨ t 2 t 3 ∨ ∨ t 1 t 1 ∨ t 2 t 3 → E> ∨ t 1 ∨ t 1 ∨ t 2 t 3
-if x < y then (x ∨ y) ∨ z > x ∨ (y ∨ z) -if x > y then (x ∨ y) ∨ z < x ∨ (y ∨ z) -if x < y then y ∨ x > x ∨ y Then, given E = {x ∨ (y ∨ z) ≈ (x ∨ y) ∨ z, x ∨ y ≈ y ∨ x},
(t 1 ∨ t 2 ) ∨ (t 3 ∨ t 1 ) * → E> t 1 ∨ (t 2 ∨ t 3 ) * ← E> (t 1 ∨ t 1 ) ∨ (t 2 ∨ t 3 )

Class rewriting

Let us consider an axiom system T , which in this context is called an equational theory and a TRS R. Let us recall that T contains a (finite) number of unordered equations while R contains a (finite) number of ordered rewrite rules. We can generalize the notion of term rewriting as follows [START_REF] Dershowitz | Rewrite Systems[END_REF]: for any two terms x and z, we may say that x rewrites by R into z modulo T which we denote by x → R/T z, if there exists a substitution φ ∈ Sub(T F (X )), a term y ∈ T F (X ), a position p ∈ pos(y) and a rule l r ∈ R such that

x ≈ T y[φ(l)] p and y[φ(r)] p ≈ T z.
In effect, what is done here is that the TRS R is applied, not on the set of terms T F (X ), but instead on the quotient set T F (X )/T of the congruence classes [ ] ≈ T .

This type of rewriting may be called rewriting modulo theories [START_REF] Marché | Modular and incremental proofs of ac-termination[END_REF] (because, on this example, the rewriting by R is done modulo T ) or class rewriting (or congruence class rewriting) [START_REF] Dershowitz | Rewrite Systems[END_REF] because of the previous remark. We formally define Class Rewriting Systems (CRSs) in Def.2.26.

Definition 2.26: Class Rewriting System

A Class Rewriting System (CRS) is a pair (R, T ) denoted as R/T where R is a TRS and T is an axiom

system. A CRS R/T specifies a one-step rewrite relation → R/T ∈ T F (X ) 2 s.t. ∀ (x, z) ∈ T F (X ) 2 : (x → R/T z) ⇔    ∃ (l r) ∈ R, ∃ φ ∈ Sub(T F (X )), ∃ y ∈ T F (X ), ∃ p ∈ pos(y) (x ≈ T y[φ(l)] p ) ∧ (y[φ(r)] p ≈ T z)   
Let us now go back to our example from Fig. This is illustrated on Fig. 2.5. Indeed, we have seen previously that using ordered rewriting, we can ascertain that the two terms t α and tβ on the top left of Fig. 2.5 are related by ≈ T . Then, we immediately have that the rule x ∨ x x can be applied on t β s.t. we have t β → R t γ , as illustrated on the top right of Fig. 2.5. From those two hypotheses, using the definition of rewriting modulo theories, we can conclude that t α → R/T t γ , as illustrated on the bottom of Fig. 2.5. Let us now make an important remark which is that, whenever the equations that constitute the equational theory T correspond to properties of associativity and commutativity of the operation symbols (which was the case in our example), we may use the term Associative-Commutative Rewriting (AC-R) [START_REF] Jouannaud | Associative-commutative rewriting via flattening[END_REF][START_REF] Marché | Modular and incremental proofs of ac-termination[END_REF] to

∨ ∨ t 1 t 2 ∨ t 3 t 1 ≈ T ∨ ∨ t 1 t 1 ∨ t 2 t 3 t α ≈ T t β ∨ ∨ t 1 t 1 ∨ t 2 t 3 → R ∨ t 1 ∨ t 2 t 3 t β → R t γ ∨ ∨ t 1 t 2 ∨ t 3 t 1 → R/T ∨ t 1 ∨ t 2 t 3 t α → R/T t γ
describe → R/T .
AC-R is an interesting subject of study because of its use for defining rewrite systems that terminate on term algebras with associative and commutative operators but also because whenever an equational theory T only contains equations corresponding to those properties then it enjoys additional properties (w.r.t. other equational theories). For instance, as mentioned in [START_REF] Jouannaud | Associative-commutative rewriting via flattening[END_REF], if T only contains equations of AC then ≈ T is always decidable i.e. for any two terms x and y we can always determine whether or not x ≈ T y. This is because the AC-congruence classes of finite terms are finite. Using any total rewrite ordering on the terms, we can then always unify AC-equivalent terms.

Modeling Distributed Systems with Interaction Languages

We have evoked in the Introduction (Chap.1) various manners to model DSs. In the context of this thesis however, we have chosen to focus on Interaction Languages (ILs) which propose models that (1) specify the behavior of DSs in terms of their internal and external communications and (2) can be drawn in a graphical and intuitive manner. In this section, by introducing specific ILs we intend to explain the general principles of interactions and to give a quick overview of existing languages.

We present at first the family of Message Sequence Chart (MSC) and its sub-languages with, in Sec.

Basic Message Sequence Charts

Basic Message Sequence Chart (BMSC) [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF], include the most basic constructs from the Message Sequence Chart (MSC) standard [22]. BMSCs describe some asynchronous communications that can happen within and without a DS in terms of the exchange of messages, which are abstracted as simple labels. Those exchanges consist of observable atomic events corresponding to the emission and / or reception of said messages. A BMSC specifies possible successions of those atomic events, no two distinct events being able to occur simultaneously. Those events occur on the interface of specific sub-systems of the DS. Given that BMSCs do not have to be complete specifications, we can abstract a group of sub-systems as a single actor within the communication scheme that is described. Those abstractions correspond to loci from which we can observe parts of the exchanges that occur within (i.e. with other such loci) or without (i.e. with "the environment") the DS. In BMSC, those abstractions are named instances [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF][START_REF] Gehrke | An algebraic semantics for message sequence chart documents[END_REF][START_REF] Mauw | High-level message sequence charts[END_REF].

Now that we have introduced what

BMSCs aim to model, let us explain how it is done. BMSCs are represented graphically. In those diagrams, each instance is denoted by a vertical line. Those vertical lines are aligned and spaced horizontally. They all start at the top of the diagram and end at its bottom. On the top of each instance, its name can be written so as to distinguish it from the others. On the vertical axis representing a given instance are represented the atomic communication actions (emissions and receptions)

that are expected to occur on the corresponding locus. In BMSCs, there exists a total order (locally w.r.t.

a instance) which defines the order in which those events are supposed to occur. This order is represented graphically by the top to bottom direction. An event represented below another must occur after it. On Fig. 2.6 we have drawn some example BMSCs. In the one on the top-left of Fig. 2.6, we have two instances named "instance 1" and "instance 2". On "instance 1", a message named "message 1" is received from the environment and then another message named "message 2" is send towards the environment".

Likewise, two other atomic communication events : the emission of "message 3", and then that of "message 2" are represented on the "instance 2" instance on the right.

Also, there is a-priori no correlation between the execution of events occurring on different loci. On the example in the top-left of Fig. 2.6, the emission of "message 2" by "instance 2" can occur indifferently before or after the reception of "message 1" by "instance 1". Indeed, the top to bottom order only applies for actions that occur on a same instance. As such, let us remark that the vertical positioning of the actions under "instance 1" w.r.t. those under "instance 2" does not matter. In this example, we could have drawn the two actions on the right above the two on the left, on the same lines, interleaved, or under them.

An order between events occurring on different instances (which are independent) can only exist (be enforced) by a causal relation such as the one linking the emission of a message to its reception (of the same message). In the drawing of BMSCs, we use plain arrows that may link an emission action on a certain instance, to a corresponding reception action on another instance. Those plain arrows represent the concept of the passing of a message, with the logical implication that the reception action must occur after the emission action (given that we model asynchronous communications). We illustrate this in the example in the top-right of Fig. 2.6. Here, for instance, the message "m1" is send from instance "i1" towards "i2". In the global ordering of atomic actions, the reception event occurs after the emission event. Also, by construction, given that the emission of "m2" must occur after the reception of "m1" on "i2", the passing of "m1" must occur entirely before the passing of "m2" can start. Likewise, the passing of "m3" from "i3" to "i1" can only start once "m2" has been received by "i3". Those chained / interlinked precedence relations makes so that only some successions of events globally correspond to what is specified by the BMSC. In the example on the top-right of Fig. 2.6, even though instances "i1", "i2" and "i3" represent independent and concurrently running processes, there is a single possible succession of events due to the interlinked causal relations between receptions and subsequent emissions of messages. That succession is the passing of "m1" (emission then reception) then that of "m2" and then that of "m3".

Let us keep in mind however, that in most cases, many different successions of events can be specified by a single BMSC. It is the case in the example on the top-left of Fig. 2.6, where we have 6 different possible successions of events.

Usually, plain arrows, representing the passing of messages, are drawn horizontally between two instances.

However, exceptions are allowed in some formalisations of BMSCs, to represent the overtaking of a message passing w.r.t. another. This is illustrated on the bottom-left of Fig. 2.6, where message "m1" and "m2" are both send by instance "i1" to instance "i2". However, although the emission of "m1" occurs before that of "m2", here, the reception of "m1" must occur after that of "m2". Another exception concerns messages that an instance may send to itself. In this case, we may draw an arrow that exits the instance (towards the left or the right) and then bends back towards the origin instance to land below the original emission action, as is illustrated on the example in the middle of the bottom row of Fig. Let us also note that some constructions are explicitly forbidden in BMSCs (although it may be possible to draw them and it may be possible to construct them syntactically in some formalisations of BMSCs).

Those constructions violate a principle which states that an emission action may not be causally dependent (directly or though other actions) w.r.t. the reception action it enables. Fig. 2.7 illustrates constructions that violate this principle. On the example on the left, the emission of message "m1" is drawn below the reception of that same message "m1"; here the violation is direct. On the example on the right, the emission of "m1" must come after the reception of "m2"; however, the emission of "m2" must come after the reception of "m1".

High Level Message Sequence Charts

High-Level Message Sequence Chart (HMSC) [START_REF] Mauw | High-level message sequence charts[END_REF] allows the description of more complex scenarios via the composition of BMSCs within graph-like structures.

A HMSC presents itself (i.e. can be drawn) as a graph in which individual nodes can be: start nodes (denoted by ), end nodes (denoted by ), connector nodes (denoted by ) or reference nodes, containing a reference to a BMSC.

HMSCs constitute directed graphs. Nodes are linked by arrows which represent the expected order of execution of the behaviors specified by individual BMSC nodes. An arrow originating from a reference to BMSC "A", and targeting a reference to BMSC "B" signifies that we expect the behavior specified by BMSC "A", followed by the one specified by BMSC "B". When there are several outgoing arrows from a single node (and/or can be represented as an arrow that splits), this means that there is a alternative in the choice of the following behavior, which can be specified by either one of the targeted BMSCs. Also, given that the graph structure of HMSCs allows cycles, one can specify the repetition of behaviors and hence it is possible to represent arbitrarily long behaviors.

An HMSC graph can be divided into (one or several) connected subgraphs (called "components"), each of which having exactly one start node (denoted by ). Components represent processes that are executed in parallel w.r.t. one another.

Let us consider the example from Fig. 2.8. In this HMSC we have 2 components. The component drawn in the left specifies the execution of a single BMSC which is "D". The expected behavior is therefore the emission of "m4" by "i3" and followed by its reception by "i1". The component drawn in the right involves three BMSCs "A", "B" and "C". In a first time, "A" is expected to occur (i.e. the emission of "m1" by "i1" followed by its reception by "i2". Then, because of the split arrow, we have either "B" or "C" i.e. the transmission of either "m2" or "m3" from "i2" to "i3". Given that the two components are expected to be executed in parallel, various interleavings are allowed.

In the example from Fig. 2.9, we modified our previous example so as to express that the behaviors specified by individual components can be repeated (here it is once or more). We can use connector nodes synthesize any combination between an incoming arrow and an outgoing arrow. For example here, without the connector node below nodes "B" and "C", we would have had to draw 4 arrows: from "B" to the end node, from "C" to the end node, from "B" to "A" and from "C" to "A", making the drawing more cluttered.

Message Sequence Charts

Message Sequence Chart (MSC) is a trace language for the description of the communication behavior of system components and their environment. The description of an informal semantics is also provided in [22]. The MSC standard authorizes more complex structural models in the form of "MSC Documents". As a result, within the MSC standard we can discriminate between several sub-languages among which Basic Message Sequence Chart (BMSC) and High-Level Message Sequence Chart (HMSC) which we have already presented. In addition, the MSC standard allows the definition of sequence charts containing more complex features than those of BMSCs, such as the use of inline operators, references or conditions. There is no specific name given for this extension of BMSC, and we may refer to it simply as MSC. Some of the extended features of MSC are illustrated on the example from Fig. 2.10:

• "inline-expression" are operators that can be used to "relate" several parts of an MSC. The "relation" that is defined by an "inline-expression" can correspond to various notions. We have for instance the alternative ("alt") for specifying a choice, the parallel composition ("par") for specifying concurrent execution, or an operator for describing optional behavior ("opt") etc.

• references, which allow the nesting of MSCs by including a reference to another MSC within some part of a parent MSC. In that case, the instances of the parent MSC must match those of the nested MSC (or there must be some correspondence via some renaming mechanism). In addition we can make use of gates so as to link (1) inputs from the environment defined in the nested MSC to outputs produced • the definition of explicit causal orderings between a-priori independent events (for instance the emission of m10 by i2 on the example from Fig. 2.10 explicitly implies the action act on i3)

• etc.

Let us remark however that the MSC language being quite expressive, most formal approaches only deal with some aspects of it.

UML Sequence Diagrams

Universal Modeling Language (UML) is a general-purpose modelling language which aims to standardize and gather, in a coherent ecosystem, various notations that are used for the modelling and design of (predominantly) software systems. UML was adopted in 1997 by the Object Management Group (OMG) and later approved as a standard in 2005 by the International Organization for Standardization (ISO). UML includes in a single ecosystem different types of models which can contain references to one another. Since its 1.1 version was released in 1997, the UML standard has considerably evolved, notably in 2005 with the 2.0 major revision. Given the scope and depth of the UML, there is no formal semantics that is associated In any case, the scope of UML is far greater than that of more specialized formalisms such as MSC. In the context of this overview, we only focus on a specific type of diagram within UML: "Sequence Diagrams" (abbr. UML-SD), which corresponds to the inclusion of a form of MSC into UML (which dates back from version 2.0).

UML-SDs and MSCs are almost identical when it comes to their visual representation (apart from purely aesthetic considerations). They take the form of a set of vertical lines, each representing a sub-system of the modelled system. Horizontal or diagonal arrows drawn between those vertical lines may represent the exchange of messages between sub-systems. The default interpretation of the vertical axis is that of the passage of time, from top to bottom. As in the case of MSCs with inline-operators, some operators may be used to change this default interpretation. On Fig. 2.11 we provide an example UML-SD (drawn using PlantUML [5] / PlantText [4]). In the context of this thesis, we use some vocabulary taken from UML-SDs with, in particular, the word "lifeline" to refer to the vertical lines that may abstract sub-systems of the modelled DS.

Although it is widely used in the industry thanks to its graphical nature and the existence of numerous tools such as Papyrus [START_REF] Papyrus | [END_REF] or Visual Paradigm [START_REF]Visual paradigm[END_REF] which allows the creation and drawing of UML models, UML is often criticized in academia for using an overly complex metamodel [START_REF] Sen | Meta-model pruning[END_REF][START_REF] Fondement | Big metamodels are evil[END_REF] that even contains some unspecified parts ("semantic variation points"). In practice, it is always some formed of restricted and modified version of UML-SDs that are used in formal approaches, with for instance the extraction of a simplified metamodel [START_REF] Micskei | The many meanings of uml 2 sequence diagrams: a survey[END_REF][START_REF] Rocha | Test case generation by efsm extracted from uml sequence diagrams[END_REF]. Moreover, some specific operators of UML-SDs such as "assert" or "neg" are particularly controversial, given that their semantics, as informally described by the norm [24] can be interpreted in different manners, as explained in [START_REF] Micskei | The many meanings of uml 2 sequence diagrams: a survey[END_REF][START_REF] Harel | Assert and negate revisited: Modal semantics for UML sequence diagrams[END_REF]. The authors of [START_REF] Pickin | Using uml sequence diagrams as the basis for a formal test description language[END_REF] describe those "new constructs" as opening-up "a veritable pandora's box of expressions whose meaning is obscure". As a result, most if not all formal approaches to the understanding of UML-SDs use a heavily restricted subset of the language, as in [START_REF] Störrle | Semantics of interactions in uml 2.0[END_REF][START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF][START_REF] Bannour | Eliciting unitary constraints from timed sequence diagram with symbolic techniques: Application to testing[END_REF][START_REF] Eichner | Compositional semantics for uml 2.0 sequence diagrams using petri nets[END_REF][START_REF] Soares | Automatic model transformation from uml sequence diagrams to coloured petri nets[END_REF][START_REF] Rocha | Test case generation by efsm extracted from uml sequence diagrams[END_REF] (among others).

Process Algebras

Process algebras are mathematical constructs used to represent the behavior of a system (in the word "process") and which allow the study of parallel or distributed systems via algebraic means [START_REF] Baeten | A brief history of process algebra[END_REF][START_REF] Rooda | Process algebra[END_REF] (hence the word "algebra").

Process algebras represent behaviors via what can be observed of them i.e. sequences of observable events. Some process algebras can be used to treat continuous phenomena [START_REF] Rooda | Process algebra[END_REF]. However, in the context of this thesis, we only consider discrete events i.e. their occurrences correspond to unique instantaneous points in time. In that case, the authors of [START_REF] Baeten | A brief history of process algebra[END_REF] describe processes as "discrete event systems".

The treatment of behavior with process algebra is said to be algebraic because a process algebra forms an algebra in which we can perform calculations [START_REF] Bergstra | Process algebra for synchronous communication[END_REF][START_REF] Baeten | A brief history of process algebra[END_REF] on objects representing current states of the system via some basic operators. The result of the application of operators can be inferred recursively on the structure of algebraic terms, starting from the application of base axioms.

The study of process algebra has led to the development of use of specific process algebras. Among those formalisms (which constitute formal languages), the most influential or fundamental include Communicating Sequential Process (CSP) [START_REF] Hoare | Communicating Sequential Processes[END_REF] for describing concurrent systems, Calculus of Communicating Systems (CCS) [START_REF] Milner | A Calculus of Communicating Systems[END_REF] for describing in depth communications between 2 participants or Algebra of Communicating Processes (ACP) [START_REF] Bergstra | Process algebra for synchronous communication[END_REF].

In the following we concretize this notion of process algebra by providing a minimalist example of a process algebra. This toy language is in facts the "Basic Process Algebra" from [START_REF] Bergstra | Process algebra for synchronous communication[END_REF]. This toy example will also be used to demonstrate:

• how one can define a denotational-style semantics (inspired from [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF])

• how one can define an operational-style semantics (as is classically done since [START_REF] Plotkin | An operational semantics for CSP[END_REF])

• how one can use the Coq theorem prover to formally prove the equivalence of those two semantics (in the following section)

Presentation of the toy process algebra

Let us consider a system in which one can observe a variety of events, that we model by a finite set E of events. If the system is intended to express a single event e ∈ E once, it is represented by the term e of the process algebra. The occurrence of this event then corresponds to the following transformation:

e e → ,
where denotes the empty process i.e. the process that corresponds to a behavior in which no event is observed. Terms from E and constitute the constants of the algebra. In this context, E can be called the "signature" of the process algebra.

In addition to constants, our example process algebra may include more complex terms via the use of binary operators. Let us for instance introduce a "." operator for (strict) sequential composition and a "+" operator for alternative composition (here a non-deterministic choice). Given two distinct events e 1 and e 2 from E:

• the term e 1 .e 2 denotes a system in which e 1 is expected to occur at first, and then e 2 . As a result we expect the following sequence of transformations:

e 1 .e

→

From the constants E ∪ { } and the operators . and +, one can build words of any arbitrary size (in number of events). Terms of this process algebra can then be defined by the following grammar (using notation in the style of Backus-Naur Form (BNF) as in [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF]) and we denote by P (E) the set of all such process algebraic terms:

P : : = | e | P 1 .P 2 | P 1 + P 2

Semantic domain

Process algebras are by nature well suited for the definition of operational-style semantics. However we can also define semantics in denotational style for this kind of language. We will do both in the following.

However, so as to compare them easily, we use a common semantics domain.

For this toy process algebra, a given execution of the system simply corresponds to a sequence of events from E. We can therefore use E * as a semantic domain. The semantics of a process p ∈ P (E) can be defined as a subset of E * .

Let us note that in the free-monoid (E * , .):

• we denote the empty word (sequence of length 0) by , which is not the empty process

• "." refers to the concatenation operator such that for any two sequences of events t 1 and t 2 in E * , t 1 .t 2 ∈ E * . It is not the same "." as the sequential composition of P (E).

Additionally, we trivially extend the concatenation "." to sets of sequences of events so that for any T 1 and T 2 in P(E * ), we have

T 1 .T 2 = {t 1 .t 2 | t 1 ∈ T 1 , t 2 ∈ T 2 }.

Denotational-style semantics

For the denotational approach, we can determine which are the accepted sequences of events by using the structure of the process algebraic terms (which is simple given the minimalist nature of this toy example).

The following definition highlights the compositional nature of denotational semantics. Let us define σ d :

P (E) → E * such that:

σ d ( ) = σ d (e) = e σ d (p 1 .p 2 ) = σ o (p 1 ).σ o (p 2 )
with "." the extension to sets

σ d (p 1 + p 2 ) = σ d (p 1 ) ∪ σ d (p 2 )

Operational-style semantics

We now define an operational-style semantics for the same syntax of terms P (E), and the same semantic domain E * . The operational semantics rely on the definition of transformation rules p e → p where p and p are terms from P (E) and e is an event in E. We have already seen the axiomatic rules of the form e e → that characterize the execution of a process that is reduced to a single event. Transformation rules for more complex terms can be inferred inductively. To formalize this, a presentation in the style of Plotkin [START_REF] Plotkin | An operational semantics for CSP[END_REF] of structural operational semantics is usually proposed. This kind of semantics consists in inference rules of the form:

p 1 , • • • , p n f c
In those rules, the goal is to assess (in the same manner as a mathematical proof) the conclusion c, which corresponds to a certain transformation on a complex term. The goal transformation c can be proved if some conditions on the sub-terms of the complex term are met. Those conditions are represented by p 1 , • • • , p n , which are called "premises". Most oftentimes they correspond to transformations that are already proven on the subterms. f (for "formula") may correspond to additional conditions on the complex term. In the case where there are no premises (n = 0) and no additional conditions (f = ), then the conclusion c is always accepted (tautology) and can be considered to be an axiom of the algebra.

For any e ∈ E and any processes x, x , y and y : On Fig. 2.12 are given the inference rules for our toy process algebra. Here the predicates x ↓ signify that the process may immediately terminate successfully. The only constant that may terminate immediately is the empty process (successful termination) . However, more complex terms such as + x (for any process x) may also immediately terminate successfully. The x e → x predicates are generalisations of the transformations we previously described informally. This corresponds to the fact that an event e can occur within a process x and, after the execution of this event, what remains to be executed corresponds to the process x .

↓ x ↓ x + y ↓ y ↓ x + y ↓ x ↓ y ↓ x.y ↓
Taking advantage of the definition of the p e → p transformations, we can formalize a small-step operational semantics as a function σ o : P (E) → E * such that:

σ o (p) =      e.s ∃ p ∈ P (E) s.t. (p e → p ) ∧ (s ∈ σ o (p ))      ∪      { } if p ↓ ∅ if ¬(p ↓)
We can immediately see that the two approaches are quite different. The denotational approach, which is compositional is often more practical to prove formal properties on the semantics. By contrast, the operational approach is often more easily implementable in functional programming languages for various uses in software programs and FV tools.

The Coq proof assistant

Coq [START_REF] Bertot | Interactive Theorem Proving and Program Development: Coq'Art The Calculus of Inductive Constructions[END_REF][START_REF]Official coq website[END_REF] is a software tool and development environment in which one can: (1) write mathematical definitions, lemmas and theorems, (2) write machine-checked formal proofs of said lemmas and theorems,

(3) write executable algorithms, machine-check their correctness against formal properties and theorems and (4) extract from those algorithms certified programs to various programming languages. As a result Coq is often described as a "formal proof management system", a "proof assistant", a "proof development system", an "interactive theorem prover", etc.

Coq has been used with success in both:

• the academic world, to prove important theoretical results such as the four-color theorem [START_REF] Gonthier | The Four Colour Theorem: Engineering of a Formal Proof[END_REF] or the Gödel-Rosser incompleteness theorem [START_REF] O'connor | Essential incompleteness of arithmetic verified by coq[END_REF] • and in the context of the software and hardware industry, for instance with the CompCert [START_REF] Leroy | Formal verification of a realistic compiler[END_REF] compiler, which is a formally verified compiler used for programming embedded systems requiring reliability with a variant of the C programming language

Let us now adopt the perspective of a user of Coq. The main features of Coq can be used by writing and compiling ".v" files in which the user can encode the formal definitions of mathematical objects, theorems and programs, as well as proofs of theorems. Within those same files, code can be written using 2 syntactically distinct languages:

• "Gallina", which is used to define objects, declare their properties, state theorems and write algorithms

• another language (unnamed) which can be used in specific sections of the file so as to "machine-proof" theorems and properties that are either stated explicitly in Gallina or derived from programs written in Gallina (the "obligations"). Proving a theorem consists in obtaining a certain "goal" from a list of starting "hypotheses". Goals and hypotheses are logical formulae in intuitionistic propositional logic.

Hypotheses and goals can be transformed step by step so as to obtain either a contradiction (in the hypotheses), or a tautology (the goal is also an hypothesis), in which case the proof is complete. To do so, Coq provides a number of "tactics" (instructions), which use is the object of this second unnamed language.

Even though both languages appear distinct from the point of view of the user, there is in facts only one single language that is processed by Coq : Gallina. The use of tactics in the "second language" are in facts instructions to build progressively a Gallina term. Those instructions are simply provided as a more user friendly manner to do so. The Gallina term that is thus obtained is a proof of the theorem to prove.

Coq relies on the Curry Howard correspondence which states that a proof is a program, and the formula it proves is the type for the program. As a result, checking that a Gallina term is a proof of a theorem equates to checking its type.

Encoding the toy process algebra in Coq

In the following we use Coq so as to formally proof (in a machine-checked manner) the equivalence of the denotational and operational semantics that we proposed for the toy process algebra from Sec. At first we declare the set E of events, which constitutes the signature of the process algebra language.

To do so, we declare it as a Parameter of type Set. The declaration of any object in Coq starts with a keyword (here Parameter) and ends with a dot (". ").

Then we define a data type for sequences of such events with the keyword Definition. Let us call it

Sequence. We declare it to be of type Type and equal to a list of elements of E i.e. list E (with a dedicated library imported using Require Import List).

We then define a data type for the terms of our process algebra. Let us call this type PATerm. Given the inductive nature of the process algebra language, we declare it in Coq using the Inductive keyword, and,

given that we want to define a set of inductively constructed terms, we declare the type of PATerm to be Set.

Then we must specify under which rules can those inductive terms be constructed. There are 4 rules, which correspond to 4 constructors:

• empty_pa, which corresponds to the empty process

• event_pa, which corresponds to processes reduced to a single event e ∈ E. The corresponding constructor is event_pa : E → PATerm, meaning that its type is a function which takes an E and returns a

PATerm

• In Coq, all functions can be curried i.e. instead of having a function f (x, y), applied to arguments

x and y, we have f (x)(y) i.e. a function f applied to x, which turns into a function f (x) which is then applied to y. In particular, constructors with multiple arguments are declared in this fashion. This is the case for the third constructor: seq_pa:PATerm→ PATerm→ PATerm, which corresponds to the "." operator of our process algebra, which forms terms of the form "x.y", where "x" and "y" are two arguments of type PATerm. We named it seq_pa to express the fact that it corresponds to a sequential composition.

• likewise, we declare the constructor corresponding to the "+" operator of the process algebra with:

alt_pa:PATerm→ PATerm→ PATerm, its named referring to the alternative choice it models.

The next step is to encode the predicates ↓ and → of the process algebra. We provide the corresponding Gallina code on Fig. 2.14.

The ↓ predicate can be understood as a recursive function that takes as argument a PATerm and returns a Prop i.e. a proposition in intuitionistic propositional logic (this proposition corresponding to whether or not the given process algebraic term terminates or not). In Gallina, we use the Fixpoint keyword to declare the terminates function which takes an argument p or type PATerm. We then use a pattern-matching notation (similar to that of many functional programming language e.g. ML, OCaml, Rust, Haskell, etc.) so as to define the cases of the induction on the term structure of the argument p. Here, each case of the induction is introduced by the | symbol, followed by the structure of p in that case. Then the symbol ⇒ indicates the value the recursive function is supposed to return in that case. Given that the return type of terminates is Prop, we return:

• True for the empty process i.e. empty_pa

• False for any process that corresponds to a single event e i.e. (event_pa e)

• (terminates p1) ∧ (terminates p2) for any process that corresponds to a sequence of sub-processes p 1 .p 2 i.e. (seq_pa p1 p2)

• (terminates p1) ∨ (terminates p2) for any process that corresponds to an alternative between subprocesses p 1 + p 2 i.e. (alt_pa p1 p2)

Let us note that, in Coq, any recursive function must be able to terminate. This requirement is here to ensure the consistency of the logical proof system provided by Coq (otherwise "false statements" could be proven). Behind the scenes, Coq tries to find a measure on the arguments that is strictly decreasing at each recursive call. If no such measure is found, the code does not compile. This definition relies on a number of rules which can be used to infer a certain (is_next_of x e y).

Those rules correspond to those of the process algebra and their definitions are the exact translation of the mathematical definitions from Sec. Let us note here that, in Gallina, the → symbol can both be used to denote a type (of a function) and to denote an implication (as is the case here). This is in line with the Curry-Howard correspondence, which states that an implication P → Q is in facts the type of functions that can transform proofs of P into proofs of Q. Given that remark, and the previous on currying, implications can also be curried e.g. with

P → Q → R instead of (P ∧ Q) → R.
• likewise, we have the same kind of encoding for the 3 other rules

The semantics of the toy process algebra in Coq

The operational and denotational semantics proposed in Sec.2.4 can then be formalized in Coq as illustrated on Fig. 2.15:

• the operational semantics, by an inductive predicate sem_op : PATerm → Sequence → Prop, with two rules sem_op_empty and sem_op_event corresponding to the base case (whether or not the empty sequence is in the semantics, via the ↓ predicate) and the small-step of the semantics i.e. the execution of events (via the → predicate)

• the denotational semantics, by a recursive function which returns a set of sequences:

Proving the equivalence of both semantics with Coq

Now that we have formalized in Coq both our semantics, let us prove their equivalence. The plan of the proof is represented on Fig. 2. [START_REF]Spin tool[END_REF]. The theorem that we want to prove corresponds to the blue node on the top. Its formulation is Let us consider the inclusion of σ o in σ d , which corresponds to the part of the proof that is on the left on Fig. 2.16. This theorem can be proven thanks to 2 intermediate lemmas given in the teal nodes underneath it and which correspond to:

∀ p ∈ P (E), ∀ s ∈ E, s ∈ σ o (p) ⇔ s ∈ σ d (p).
∀ p ∈ P (E), ∀ s ∈ E * , s ∈ σ o (p) ⇔ s ∈ σ d (p) ∀ p ∈ P (E), ∀ s ∈ E * , s ∈ σ d (p) ⇒ s ∈ σ o (p) ∀ p ∈ P (E), ∈ σ d (p) ⇒ p ↓ ∀ p ∈ P (E), ∀ e ∈ E, ∀ s ∈ E * , e.s ∈ σ d (p) ⇒ ∃ p ∈ P (E), (p e → p ) ∧ (s ∈ σ d (p )) ∀ p ∈ P (E), ∀ s ∈ E * , s ∈ σ o (p) ⇒ s ∈ σ d (p) ∀ p ∈ P (E), p ↓⇒ ∈ σ d (p) ∀ (p, p ) ∈ P (E), ∀ e ∈ E, ∀ s ∈ E * , (p e → p ) ∧ (s ∈ σ d (p )) ⇒ e.
(p) = {s 1 .s 2 | s 1 ∈ σ d (p 1 ), s 2 ∈ σ d (p 2 )}, we have ∈ σ d (p) • if p = p 1 + p 2 for given (p 1 , p 2 ) ∈ P (E) then p ↓ iff p 1 ↓ or p 2 ↓:
in the first case, the induction hypothesis gives ∈ σ d (p 1 ), and given that σ d (p 1 ) ⊂ σ d (p 1 + p 2 ), we have ∈ σ d (p) -likewise, in the second case the induction hypothesis gives ∈ σ d (p 2 ), and given that σ d (p 2 ) ⊂

σ d (p 1 + p 2 ), we have ∈ σ d (p)
The transcription of this lemma and of its proof in Coq is given on Fig. 2.17. The definition of the Lemma contains the predicate (terminates p) → (sem_de p nil) which is the exact translation of the Lemma's mathematical definition, with the curried expression (sem_de p nil) representing the inclusion of the empty sequence nil into the semantics applied to process p. The proof is introduced by the keyword Proof. Then, we use a number of tactics to transform the goals and hypotheses and resolve the intermediate sub-goals until the completion of the proof. The first tactic intros introduces the left part of the goal formulation as an hypothesis named H. The application of this tactic results in the declaration of a hypothesis H : terminates p.

The second tactic induction performs an induction on the term structure of p. This changes the proof into 4 sub-proofs, which can be individually solved. The proof of each sub-proof is introduced by a dash.

• in the first sub-proof, we have the hypothesis H : terminates empty_pa and the goal sem_de empty_pa nil.

The tactic simpl simplifies the goal (as per the definition of sem_de) into nil = nil, which can be immediately proved with the tactic reflexivity • in the second sub-proof, we have the hypothesis H : terminates (event_pa e), with a certain e : E and the goal sem_de (event_pa e) nil. The tactic simpl is here used on the hypothesis H to reveal a contradiction (it transforms the hypothesis into H : False). Then we use the tactic contradiction to resolve the sub-proof • in the third sub-proof, we have several hypotheses:

-H : terminates (seq_pa p1 p2), which is the hypothesis on the overall term p -IHp1 : terminates p1 → sem_de p1 nil, which is the induction hypothesis on the left sub-term p1 -IHp2 : terminates p2 → sem_de p2 nil, which is the induction hypothesis on the right sub-term p2

The goal is sem_de (seq_pa p1 p2) nil, which we can simplify with the simpl tactic to obtain exists s1 s2 : Sequence, sem_de p1 s1 ∧ sem_de p2 s2 ∧ nil = s1 ++s2

Given that we know (from human experience), which are the expected values for the sequences s1 and s2, we can use the exists tactic to declare them (both are nil), which result in the goal sem_de p1 nil ∧ sem_de p2 nil ∧ nil = nil ++nil. We can transform our hypothesis to obtain the 2 clauses on the left. To do so we use simpl in H, which turns H into terminates p1 ∧ terminates p2 which we can separate into two hypotheses H1 and H2 with the destruct tactic. We then use the apply tactic to apply the induction hypotheses IHp1 and IHp2 on respectively H1 and H2. The third clause of the goal is a tautologic equality, which can be resolved with the reflexivity tactic. Therefore, we have all the ingredients to verify our goal. We only need to divide and destroy it. To do so, we use the split tactic, and treat each case as a sub-goal. The assumption tactic is used to prove a goal that is already given as an hypothesis.

• in the fourth sub-proof, we have the hypotheses:

-H : terminates (alt_pa p1 p2), which is the hypothesis on the overall term p -IHp1 : terminates p1 → sem_de p1 nil, which is the induction hypothesis on the left sub-term p1 -IHp2 : terminates p2 → sem_de p2 nil, which is the induction hypothesis on the right sub-term p2

The goal is sem_de (alt_pa p1 p2) nil, which we can simplify with the simpl tactic to obtain sem_de p1 nil ∨ sem_de p2 nil Likewise, we can simplify the H hypothesis to obtain terminates p1 ∨ terminates p2. We have here a disjunction as an hypothesis. We can use the destruct tactic on H so as to treat the two cases (either terminates p1 or terminate p2) as two sub-proofs (with different sets of hypotheses but the same goal).

in the first one, we have H : terminates p1. We use our human intuition to select the clause of the goal (a disjunction) that we want to prove. It is the left clause and we can use the left tactic to select it. By applying the induction hypothesis IHp1 the result is trivial.

the other case is similar, except we choose the right clause and apply IHp2 Now that we have proved all our goals (Coq notices the user of that with No more subgoals.), we can close the Proof with the Qed keyword. The proof is correct by construction, given that, behind the scenes, Coq uses the tactics to construct a functional program in Gallina, which constitutes a proof of the proposition, as per the Curry-Howard correspondence. The terminates_implies_de_accept_empty lemma is now an established fact in the remainder of the ".v" Coq file, and we will be able to use it (for instance with apply terminates_implies_de_accept_empty in other proofs).

The whole proof for the equivalence of σ o and σ d on this toy process algebra is available in [START_REF] Mahe | Example coq proof for a property on a toy process algebra[END_REF]. In it, we use additional tactics, including:

• dependent induction, which is an extension of the induction tactic which makes possible to generalize some variables of which the induction hypothesis found in the resulting sub-goals depend. With the generalizing keyword, we can specify which variables we want to generalize (although it is not always possible to generalize a variable)

• inversion, which, applied to an inductive predicate derives all the possible conditions (may transforms the initial set of hypothesis into several others, each corresponding to a new sub-proof) for it to be true according to its constructors.

An overview / a documentation of the tactics available in Coq's standard library is available in [2].

By detailing a Coq proof for this toy process algebra, we have only scratched the surface of can be done with Coq. However it is an introduction that should suffice to understand the more complex proofs proposed in the thesis and which were encoded in Coq. In particular this proof of semantic equivalence for the toy process algebra [START_REF] Mahe | Example coq proof for a property on a toy process algebra[END_REF] is a miniature version of the proof available on github in [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF] in which we prove the equivalence of three semantics (that from Chap.4, Chap.5 and Chap.6) defined over the Interaction Language which we define in Chap.4 of this thesis. Another proof, pertaining to the correctness of the multi-trace analysis algorithm from Chap.9 is available on github in [START_REF] Mahe | Coq proof for the correctness of the multi-trace analysis algorithm[END_REF].

Conclusion

In this chapter we have presented some elements of context for the works of this thesis. In particular:

• Sec.2.1 and Sec.2.2 pertaining to formal languages and term algebras will be particularly useful in Chap.4 in which we define our IL, its denotational-style trace semantics and a process to normalize interaction terms and in Chap.7 where we extend the notion of the semantics of interactions to multitraces with various multi-trace semantics.

• Sec.2.3 serves as an introduction to Interaction Languages which is one of the main focus of the entire thesis • Sec.2.4, by introducing process calculus is a prelude to Chap.5 where we define a structural operational semantics for our IL • finally, with the presentation of Coq and of a miniature proof for semantic equivalence in Sec.2.5 we foreshadow the proof from Sec.5.2 as well as various other proofs presented in this thesis (Sec.6.2, Sec.9.2) which are encoded in Coq ( [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF][START_REF] Mahe | Coq proof for the correctness of the multi-trace analysis algorithm[END_REF])

In the following chapter, so as to anchor the present thesis in the state of the art, we present a quick survey of formal semantics for ILs that are found in the literature.

53

In this chapter we discuss the state of the art on the definition of formal semantics for Interaction Languages.

The plan of this chapter is as follows:

• in Sec.3.1 we review a short selection of papers and we discuss how they relate to our work,

• in Sec.3.2 we give a broader and shallower survey on the formal semantics of ILs,

• finally, in Sec.3.3 we give some concluding remark and position the works of this thesis with regards to the state of the art.

A discussion on a selection of papers

In this section we discuss a selection of papers from the literature pertaining to the formalisation of the semantics of some ILs. We have chosen those papers to represent a wide variety of formalisms and different approaches to the definition of their corresponding semantics.

An algebraic semantics of BMSCs

In [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] an algebraic semantics of BMSCs is proposed. It relies on corresponding the syntax of BMSCs to process algebraic terms and then simplifying those terms, using a dedicated "state operator" [START_REF] Baeten | Global renaming operators in concrete process algebra[END_REF] λ M to ensure the respect of the emission-reception causality. In [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] the semantics of BMSC is a "free merger" (i.e. an interleaving) of that of its constituant instances (lifelines). Some transformations, constrained by λ M can be applied so as to progressively transform those interleavings into sequences and alternatives. The end result is a process algebraic term which only consists of alternatives and sequences and can therefore be directly mapped to a set of accepted sequences.

The syntax of BMSCs in [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] is quite different from that of our own IL given that each instance is described independently as a list of atomic events and it is then the state operator λ M which (by remembering which messages have been send and not yet received) links reception events to corresponding emission events. The manner in which this λ M operator is used causes some limitations to the formalism. In particular, it is not allowed that two distinct outputs or inputs have the same message name and message instance name. By contrast, our approach handles the issue of the emission-reception causality via the use of a strict-sequencing operator which can schedule the executions of two sub-interactions so that the first occurs strictly before the second. By applying this operator to an atomic emission (on the left) and an atomic reception of the same message (on the right), we can in effect implement message passing, with no restrictions on the number of occurrences of said message. This remark is also linked to the fact that atomic emissions in [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] must specify which is the target instance, and atomic receptions must specify which is the source instance. By contrast, in our formalism, this information do not appear in individual events (as should be the case in all generality, when we consider communications in a distributed context). When a message is observed i.e. logged somewhere in the network, the only information that is available is the data it carries (and the local time of the reception event). It is not a given that it carries information pertaining to its original sender, and, even if it is the case, it could be false (e.g. man-in-the-middle attack).

[97] also details a proposed semantics for a "create" and "stop" atomic events, which correspond to the creation and deletion of temporary instances. This is handled similarly to the passing of messages, with a dedicated λ L operator. λ L keeps track of which instances have been created (and later deleted) and does not allow the execution of events that concern an instance that does not exist. The semantics is likewise extended to include timers. By contrast, in our formalism we only consider a core language and we mainly focus on the different scheduling operators that can be defined to specify exchanges of labelled message within a statically defined distributed system (no creation or deletion of sub-systems). Our aim is to use this core language as a platform to experiment on the definition of different semantics. Those semantics can then be compared and their equivalences proven. Moreover, the addition of new primitives (creation/deletion, timers, etc.) could be the object of further works.

The approach proposed in [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] could easily be implemented into a FV tool given the nature of its models, which are finite terms and describe a finite set of finite executions (no repetitions). To obtain the semantics as a set of sequences, it suffices to process the simplified process algebraic terms and eliminate the alternative operators. To go further, the difficulty lies in having models which allow behaviors to be repeated, which may result in arbitrarily long behaviors. In this thesis, we tackle this with dedicated loop operators.

High-level message sequence charts

In [START_REF] Mauw | High-level message sequence charts[END_REF], a formal syntax and semantics is proposed for HMSC. This approach is an extension of [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] which includes additional operators for "weak sequencing" and "delayed choice" so as to include the increased expressivity of HMSC w.r.t. BMSC.

The weak sequencing of two BMSCs "A" and "B" specifies a partially parallel executions of the behaviors specified by each. In any such execution any event e from "B" can only occur if it is permitted by "A" by a "permission relation". This permission relation refers to the ability of "A" of not expressing actions on the same instance (lifeline) on which e occurs. As a result, weak sequencing allows to compose BMSCs with more flexibility than the classical (strict) sequencing operator. As in [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF], in [START_REF] Mauw | High-level message sequence charts[END_REF] HMSCs are associated to process algebraic terms. In particular, the definition of the permission relation is done inductively on those terms. The delayed choice operator is quite similar to the classical alternative operator, except that the choice of the alternative is delayed as long as possible. This means that whenever the same event can occur in both branches of an alternative then it is executed in both and the choice of which alternative has been taken is delayed.

The semantics of HMSC in [START_REF] Mauw | High-level message sequence charts[END_REF] is defined in two parts. At first a semantics is defined for finite paths within the graph-like structures that a HMSC constitutes. This semantics is defined similarly as that of [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] with the inclusion of weak sequencing and delayed choice.

The semantics of a HMSC, as proposed in [START_REF] Mauw | High-level message sequence charts[END_REF], is then defined as follows:

• if the HMSC is reduced to a single BMSC then its semantics is defined like that of [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF]. Let us note that, in an individual BMSC, the emission-reception causality is enforced by a dedicated stateoperator (as per [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF]). As a result, within a HMSC, a reception in a given node cannot be interpreted as corresponding to an emission from another node.

• else it is given as a denotation consisting of a set of equations in which variables correspond to the semantics of individual nodes and symbols correspond to interleaving (between child nodes in a fork of the graph), weak sequencing (between two successive nodes in the graph) or delayed choice (between child nodes in a split of the graph).

Discussion w.r.t. the thesis

The structure of the HMSC models studied in [START_REF] Mauw | High-level message sequence charts[END_REF] is quite different from that of our models. HMSCs are graph structures whereas our IL is an inductive language which terms can be understood as finite binary trees.

Moreover, the semantics proposed in [START_REF] Mauw | High-level message sequence charts[END_REF] consists in translating a HMSC into a set of equations on process algebra terms. The semantics is then obtained from those terms. By contrast, in our operational semantics, the small-steps operate directly on the syntactic terms that constitute our models (as a by-product, this enables the dynamic animation of models during execution).

In [START_REF] Mauw | High-level message sequence charts[END_REF], process algebra terms can contain references. Those references incidentally serve as a means to represent repeatable behaviors. In other words repetition is handled by process algebraic terms referencing themselves directly or indirectly. By contrast, in our IL, repetition is handled by dedicated loop operators.

As a result, the syntactic structure of a term which defines repeatable behaviors in our language remains a finite and self-contained (no references) binary tree.

Although both formalisms are quite different, we can find many correspondences between the notions found in [START_REF] Mauw | High-level message sequence charts[END_REF] and those found in our thesis. The basic sequence-diagram-like terms are:

• the "empty process" from [START_REF] Mauw | High-level message sequence charts[END_REF] corresponds to our empty interaction ∅

• however, we do not have anything similar to the "deadlock" δ from [START_REF] Mauw | High-level message sequence charts[END_REF]. In our approach, when analyzing the conformity of a trace against an interaction model, we can "be deadlocked" when the next event to analyze cannot be executed by the model (is not found within the model's "frontier of execution").

• atomic models which correspond to atomic events are emissions and receptions of messages in both formalisms. However, [START_REF] Mauw | High-level message sequence charts[END_REF] specifies which is the target instance in emission events, and which is the source instance in reception events. By contrast, in our formalism, this information do not appear in individual events. In all generality, when we consider communications in a distributed context it is the case, otherwise • the "permission relation" defined in [START_REF] Mauw | High-level message sequence charts[END_REF] fulfills the same purpose as our evasion predicate (for determining whether or not an event is executable) and our pruning relation (for constructing a remaining "follow-up" term), which are defined as part of our operational semantics in Chap.5

In the small-step operational semantics that we propose in this thesis, we take advantage of having models as finite binary trees so as to be able to compute, each time an event is observed, what is the "next" model, which specifies "what remains to be executed" (which is another, rewritten finite binary tree). This small-step approach in turns allowed us to implement a tool for the animation of interaction models. In the approach proposed by [START_REF] Mauw | High-level message sequence charts[END_REF], HMSCs are translated into systems of equations between process algebraic terms. However, no method is detailed as how to process those equations.

Operational Semantics for MSC

In [START_REF] Mauw | Operational semantics for msc[END_REF], an operational semantics is defined for a subset of MSC. This subset of MSC includes the exchange of messages, actions on individual lifelines, the inline-expressions for parallel and alternative composition, co-regions and explicit causal ordering. It does not however include references (and gates), conditions, the "optional" and "exception" expressions and any loop operator.

In [START_REF] Mauw | Operational semantics for msc[END_REF], although no formal syntax is provided for encoding MSCs, two manners of doing so are described:

• an "instance-oriented" textual representation, which is similar to that of [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] and which consists in describing one-by-one the instances of the MSC (which is quite different from the syntax of our IL).

• an "event-oriented" textual representation, which lists all the building blocks (events, inline-expressions) that constitute the MSC in an order which is that of the top to bottom order of the corresponding diagram (which is somewhat more similar to the syntax of our IL).

The first step in the approach from [START_REF] Mauw | Operational semantics for msc[END_REF] consists in transforming an MSC described via an "event-oriented" textual representation into a process algebra term. This process is not described in [START_REF] Mauw | Operational semantics for msc[END_REF]. Instead, the process algebra is directly described and its operational semantics given. Let us note that [START_REF] Mauw | Operational semantics for msc[END_REF] is written by the same authors as [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] and [START_REF] Mauw | High-level message sequence charts[END_REF] and that the process algebra that is provided is based on that of [START_REF] Mauw | High-level message sequence charts[END_REF].

Instead of relying on a state operator as in [START_REF] Mauw | An algebraic semantics of basic message sequence charts[END_REF] to enforce an order between the occurrences of events, [START_REF] Mauw | Operational semantics for msc[END_REF] proposes a more generalizable approach. It consists in the attribution of some ordering requirements to the operators themselves. Those requirements concern the subterms on which the operators are applied. In more practical terms, this consists in attaching mappings to operators which keep track of constraints that must be enforced in relation to the precedence of events. Those mappings may then be checked whenever one needs to verify whether or not an event is executable and may be updated during execution. Indeed, during execution an event that is executed disappears from the term and must be removed from the mappings in which it appears as a precondition to the execution of some other events.

Discussion w.r.t. the thesis

The operational semantics which we define in Chap.5 for our IL shares some similarities with that of [START_REF] Mauw | Operational semantics for msc[END_REF] which include:

• the general principle of the language with basic building blocks being emission and reception events and constructors being used to express sequencing, interleaving and choice

• the use of a pruning relation which, in [START_REF] Mauw | Operational semantics for msc[END_REF] is called a permission relation However we have some major distinctions concerning:

(i)
which constructors are defined: we propose the addition of the four loop constructors while there were no loops in [START_REF] Mauw | Operational semantics for msc[END_REF] and, in addition, there is no strict constructor in [START_REF] Mauw | Operational semantics for msc[END_REF] (this also relates to point (iii))

(ii) how the alternative and the parallel composition are handled: in [START_REF] Mauw | Operational semantics for msc[END_REF] they use a delayed choice constructor which allows to delay the choice between two alternative branches whenever an action can be executed in both branches. In that case, the follow-up term is the alternative composition of the follow-ups of the two sub-interactions. This also effects parallel composition

given that whenever an action can be executed in both parallel branches we can define the follow-up interaction as a choice between interpreting the action as having been executed in either the left or the right branch of the parallel. In our IL and our semantics however we have not proposed this mechanism for three reasons:

• in Chap.6 we will see how we have "algorithmicized" this operational semantics for it to be easily and efficiently implemented and further used in Formal Verification (FV) techniques.

This algorithmization relies on separating concerns between the determination of which actions are executable and the execution of said actions. Immediately executable actions are uniquely identified by their positions in the term structure. The execution function then corresponds to the execution of a specific action at a specific position. If we used delayed choice we would need to determine which identical actions at which positions can safely be executed simultaneously and propose an execution function to execute several actions at the same time in the model.

• in Chap.14, we will see how we have, in our tool implementation HIBOUX, added data in interaction models and how we complemented the operational semantics to include symbolic execution in order to treat the modification and exchange of typed data. Without delayed choice, the execution of an action is uniquely defined and uniquely modifies the symbolic interpretation of variables and the symbolic path condition of the system. Each intermediate interaction i is associated to a unique interpretation η and a unique path condition π to form a state (i, η, π) of the system. Given that several instances of a same action within the model can be associated to different statements (e.g. assignment of variables), simultaneously executing them in the model would yield the same interaction term i but different symbolic states (η 1 , π 1 ), -→ alt(∅, a 2 ). This could be useful in FV techniques to diminish overhead when exploring the semantics of models.

However we will see in Chap.10 that, with "local frontiers", we can provide mechanisms that offset this disadvantage of not using delayed choice.

(iii) how strict sequencing and the emission-reception causality is handled. Indeed, we use a dedicated strict constructor to generalize causality between actions occurring on different lifelines while [START_REF] Mauw | Operational semantics for msc[END_REF] use mappings between causally-related events that are updated at each step of execution.

(iv) how the weak sequencing is handled: indeed, due to the differences in how causation is handled (with maps that are updated) and because of the use of delayed choice the operational rules corresponding to weak sequencing that are proposed in [START_REF] Mauw | Operational semantics for msc[END_REF] are quite different from our own.

UML Interactions Meet State Machines -An Institutional Approach

In [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF], a simplified version of UML-SDs (interactions) is formalised as an institution. In this institution, the signature of an interaction is defined by a set of lifelines and a set of messages. Interactions defined over this signature are then sentences build by composition from basic building blocks which may consist of the empty interaction or communication events (4 kinds: emissions with and without explicit targets and receptions with and without explicit sources) using some operators which are strict and weal sequencing, interleaving and alternative composition.

The semantics of such interactions is then formulated in denotational style in the form of sets of event traces i.e. sequences of events. The semantics of a complex interaction is build by composition from those of its subterms using some algebraic operators on sets of event traces. In particular, the operator for weak sequencing uses a notion of conflict so as to determine which interleavings are allowed and which are not.

Discussion w.r.t. the thesis

The syntax of our IL and the denotational formulation of its corresponding trace semantics in Chap.4 is inspired by and extends that of [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF] with the addition of loops.

Global and Local Testing from Message Sequence Charts

In [START_REF] Longuet | Global and local testing from message sequence charts[END_REF], a semantics for a subclass of HMSC is proposed. This subclass of HMSC is Message Sequence Graph (MSG). It consists in HMSC models where every node must contain a BMSC (i.e. it cannot contain another nested HMSC). Moreover only closed systems are considered, i.e. messages cannot be sent to or received from the environment; all exchanges have to occur between the sub-systems of the distributed system.

[83] proposes a denotational semantics for MSG. Its general principle is to correspond individual BMSCs to partial orders sets (posets) which synthesize precedence relations between events. Every sequence of events that the BMSC specifies in intention can be obtained via a linearization of a partial order from the BMSC's corresponding poset. By linearization we mean to consider sequences of events such that each appears exactly once in the partial order and such that their relative order of occurrence, as specified by the partial order is respected. The semantics of a BMSC can then be understood as the set of all such linearizations. Then, in order to define the semantics of MSGs, it suffices to consider all finite paths within the graph, all of which being associated to a BMSC which is the "concatenation" (using weak sequencing) of all the BMSC nodes encountered in the path.

In addition to providing a denotational-style semantics for MSGs, [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] also discusses testing. This paper proposes a notion of global conformance between a system and its MSG specification. A system is conform to a MSG iff all the traces (sequences of events) it can express correspond to a prefix of a linearization of the MSG (i.e. the "semantics" we referred to). [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] then proposes a method for testing specific words (traces) via the definition of an automaton which execution is concomitant to the execution of the test and terminates in either a "pass", "fail" or "inc" (inconclusive) state. Those automata can be used to test well-founded words i.e. words in which each reception event is preceded by a corresponding emission event (it is not sufficient to be well-founded, words must be well-founded and conform to the MSG specification).

A test set, which includes tests for all words diverging from prefixes of linearizations of the MSG is then proposed and proven to suffice to imply the conformance relation. Finally, a technique to factorize such tests is informally described. This technique allows the obtention of a single automaton to test the system. This automaton has a tree-like structure and allows the off-line analysis of execution traces. Elements from the trace can be analyzed via the execution of this automata, each transition corresponding to the consumption of an event in the trace.

In [START_REF] Longuet | Global and local testing from message sequence charts[END_REF], no formal methodology is given for the realisation of those automata. Moreover, the provided example only concerns a single BMSC and not a MSG. Among other things, this raises the question of what happens to the automaton when dealing with a cyclic MSG. Given that some behaviors can be repeated any number of times within a cyclic MSG, this would result in an automaton with infinitely many states.

[83] also discusses some considerations about local testing i.e. testing the system from the point of view of every local process. This discussion relies on two important notions, which are defined on MSG specifications:

• "local-synchronicity", which roughly means that there cannot be arbitrarily long one-sided exchanges between two processes (for instance in a MSG which loops back around a BMSC consisting of a message passing, there can be infinitely many emissions of the message before any corresponding reception, so the MSG is not locally-synchronised).

• "k-testability", which is defined for any k ∈ [1, n] with n the number of processes in the modelled DS.

A MSG model is 1-testable if it is not possible to reconstruct wrong BMSCs from independent local observations of correct BMSCs obtained from paths within the graph. The notion of "k-testability" is an extension of "1-testability" where, instead of projecting the model on single processes, we project them on subsets of processes of size k.

Different notions of local testing are proposed:

• Such a guarantee can only be ensured when the specification respects a "closure condition", which is very restricting. This condition is that the MSG specification is locally-synchronised and "1-testable".

• "Local Testing with Gathered Observations", in which the local traces produced by several sub-systems are gathered and analyzed together w.r.t. the specification. According to the number k ∈ [1, n] of such local traces that are gathered, the paper defines a notion of "k-local conformance". [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] then generalizes results obtained for "1-local conformance" to "k-local conformance" and concludes that "klocal conformance" is equivalent to the global conformance iff the MSG is locally synchronized and "k-testable".

Local conformance is most generally a weaker property than global conformance. However, this last result of [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] implies that for k = n (with n the number of processes), and for locally-synchronized distributed systems, local testing with gathered observations is equivalent to global testing. Indeed, n-testability is always true for an MSG.

Discussion w.r.t. the thesis

In the second part of the thesis, we define various multi-trace analysis algorithms. Those in fact perform a form of off-line testing which can be related to that found in [START_REF] Longuet | Global and local testing from message sequence charts[END_REF]. In [START_REF] Longuet | Global and local testing from message sequence charts[END_REF], the analysis of a trace corresponds to having it being recognized by a test automaton generated from the MSG specification. This is somewhat similar to the analysis graphs that are central to the definition of our multi-trace analysis algorithms. The main differences between those two approaches being that:

• [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] presupposes that the trace to analyze is well-founded (every reception is preceded by a corresponding emission) and that events are uniquely defined (no degeneracy), while our approach requires no such hypothesis on the nature of the trace (it can be any sequence of events).

• the nature of our analysis graph is quite different, with each vertex containing an intermediate multitrace which is the multi-trace which "remains to be analyzed" at that point in the analysis and an intermediate interaction model which is the continuation of the executable interaction specification

• our analysis graphs can be computed on-the-fly given that, from any given vertex, the information to compute neighboring vertices is entirely self-contained (the current interaction model and what remains of the multi-trace to analyze). This allows in our approach to analyse arbitrarily long multitraces against models which allows repeatable behaviors (with loops).

In [START_REF] Longuet | Global and local testing from message sequence charts[END_REF], there are 3 different verdicts: "pass", which is returned when the trace is recognized to be a prefix of a trace specified by the MSG, "fail", which is returned when there is a deviation from said specification, and "inc" otherwise. With the various algorithms defined in this thesis in Chap.9, Chap.10 and Chap.11, we allow the identification and discrimination between multi-traces which might correspond to exactly accepted multi-traces, projections of prefixes of accepted traces, prefixes (in the sense of multi-traces) of accepted multi-traces or slices (i.e. "sub-words" in the sense of multi-traces) of accepted multi-traces.

The analysis algorithms defined in this thesis may take as input generalized multi-traces i.e. sets of sequences of events, each occurring on a subset of lifelines called a co-localization. This positions our algorithms in the case of "Local Testing with Gathered Observations" described in [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] with k = n, given that in our concept of "multi-trace", all the sub-systems are represented by a trace "component" of the multi-trace.

Another remark is that our notion of "multi-trace" is more general than the notion of "k-observation from [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] given that we allow trace components of the multi-trace to represent several sub-systems (components may represent co-localizations non reduced to singletons i.e. a set of several sub-systems).

A broader and shallower survey

In this section, we propose a broad and shallow survey on the formal semantics of Interaction Languages that can be found in the literature and of their potential uses in Formal Verification (FV).

From studying the state of the art, we have found that most approaches to the definition of formal semantics for ILs can be categorized into three groups depending on the type of formulation of the semantics that is proposed. Those correspond to translational semantics, denotational semantics and operational semantics. We have remarked however that the first two groups are dominant, with translational semantics being quasi-exclusively used for applications in FV. By contrast, fewer direct operational semantics (that do not rely on translations) of ILs are found in the literature.

In any case the reader can refer to the surveys [START_REF] Micskei | The many meanings of uml 2 sequence diagrams: a survey[END_REF] and [START_REF] Lund | 4 Semantics of UML Models for Dynamic Behavior[END_REF] for a different perspective on the state of the art.

Translational approaches

Many formal approaches to the semantics of ILs rely on translations that map concepts of the given IL into a target formal framework, most often based on automata [START_REF] Firley | Timed sequence diagrams and tool-based analysis -A case study[END_REF][START_REF] Bannour | Eliciting unitary constraints from timed sequence diagram with symbolic techniques: Application to testing[END_REF][START_REF] Waeselynck | Termos: A formal language for scenarios in mobile computing systems[END_REF][START_REF] Longuet | Global and local testing from message sequence charts[END_REF] or Petri nets [START_REF] Eichner | Compositional semantics for uml 2.0 sequence diagrams using petri nets[END_REF][START_REF] Soares | Automatic model transformation from uml sequence diagrams to coloured petri nets[END_REF][START_REF] Faria | A toolset for conformance testing against uml sequence diagrams based on event-driven colored petri nets[END_REF]. Depending on which is the target formal framework, those translations may have the advantage of allowing the use of Formal Verification tools designed for the target framework. As indicated in this survey [START_REF] Babich | Formal methods for specification and analysis of communication protocols[END_REF] (among others), there exist a wide array of tools for applying formal methods to the verification of communicating processes.

Those tools however mostly rely on input models in the form of communicating automata or Petri nets (UPPAAL [START_REF] Larsen | Uppaal in a nutshell[END_REF], DIVERSITY [START_REF] Hussein | An end-to-end framework for safe software development[END_REF], CPNTools [START_REF] Jensen | Coloured Petri Nets and CPN Tools for modelling and validation of concurrent systems[END_REF] etc.).

However, relying on translations to capture semantics leads to reasoning on foreign concepts and it often leads to having some limitations:

• many translations are incomplete (not all concepts of ILs are mapped), for instance in [START_REF] Firley | Timed sequence diagrams and tool-based analysis -A case study[END_REF], the UML-SDs that are used can only contain synchronous complete (i.e. end-to-end) message exchanges and only a form of strict sequencing (which can be repeated using a loop operator) is handled.

• in some approaches, restrictions are imposed on how the original IL can be used and interpreted. For instance:

in [START_REF] Waeselynck | Termos: A formal language for scenarios in mobile computing systems[END_REF], there is a need to synchronize at specific points in the interaction; here when entering or exiting some operators. This implies that some interleavings of actions (some actions that are inside the operator w.r.t. others that are not in it) may not be taken into consideration.

in [START_REF] Soares | Automatic model transformation from uml sequence diagrams to coloured petri nets[END_REF], the rule for translating loops (Loop Combined Fragment of UML) states that there must be a unique "Deciding Lifeline" that "decides the number of iterations to be used by all other lifelines" and that "Deciding Lifeline" is the one which executes the "first event" of the loop.

However nothing in UML-SDs says that such a lifeline should or must exist.

In this section we give a broad overview of translational approaches.

Translations into automata-like formalisms

In [START_REF] Firley | Timed sequence diagrams and tool-based analysis -A case study[END_REF], UML-SD are translated into timed automata, which are then verified with the UPPAAL tool [START_REF] Larsen | Uppaal in a nutshell[END_REF] (this process is applied to a case study concerning a communication protocol of audio/video components).

The translation mechanisms that are proposed only concern models with synchronous communications and are only partially automated; many design choices for the UPPAAL model being left to the designer. An "observer automaton" has to be designed so as to intercept communications between automata, make them observable, and enter an error state if other events are observed. The notion of "visual order" of the diagram is similar to our notion of "ordering". However, the process to build the observer automaton from the "visual order" is only detailed in the case where this order is total (i.e. no "par" or "alt"...). This approach still has the advantage of benefiting from UPPAAL's temporal logic model checker, allowing the verification of predicates such as ∀ P (in all reachable states predicate P holds) or ∃ P (a state satisfying predicate P is reachable).

In [START_REF] Bannour | Eliciting unitary constraints from timed sequence diagram with symbolic techniques: Application to testing[END_REF], each lifeline is translated into an associated Timed Input Output Symbolic Transition System (TIOSTS) and message passing relies on some synchronous product. In order to cope with the high level of asynchronism between executions associated to different lifelines, FIFO based communication schema have been introduced to ensure the consistency of executions on different lifelines. Also, given that distinct automata may take different paths when reaching brancing choices specified by alt or loop operators, so as to maintain consistency, the authors of [START_REF] Bannour | Eliciting unitary constraints from timed sequence diagram with symbolic techniques: Application to testing[END_REF] introduced dedicated variables to keep track of those choices. This approach allows translating UML-SD specifications written with the Papyrus visual modelling tool [START_REF] Gérard | Papyrus: A UML2 Tool for Domain-Specific Language Modeling[END_REF] into automata-like models (TIOSTS), complete with symbolic variables, guards and operations, that can then be formally analyzed via the DIVERSITY tool [START_REF] Hussein | An end-to-end framework for safe software development[END_REF].

In [START_REF] Waeselynck | Termos: A formal language for scenarios in mobile computing systems[END_REF], a symbolic automaton is built from UML-SD specifications. [START_REF] Waeselynck | Termos: A formal language for scenarios in mobile computing systems[END_REF] is interested in the problem of "trace analysis". Here, test traces can be checked against the automaton and provided a verdict (valid, invalid or inconclusive). The proposed TERMOS framework has limitations e.g. entering and exiting combined fragments are considered to be synchronization points between all lifelines; however it allows lifeline mobility, different nodes being able to appear, disappear and get in or out of range of one another.

Translations into Petri nets

In [START_REF] Eichner | Compositional semantics for uml 2.0 sequence diagrams using petri nets[END_REF], UML-SD specifications are translated into multivalued nets (M-nets). The translation is compositional, entry and exit places of the M-nets corresponding to subinteractions being connected differently according to the parent combined fragment. However this process is complicated by the tracking of actions that are completely unordered w.r.t. one another. Indeed, so as not to overspecify the translation, "maximal independent sets" are computed and glued together when reconstructing the M-net. As is the case for our approach, goes with the assumption that all behaviour is explicitly specified in the diagrams. There is therefore no use for neg, assert, consider or ignore combined fragments. However, like [START_REF] Waeselynck | Termos: A formal language for scenarios in mobile computing systems[END_REF], [START_REF] Eichner | Compositional semantics for uml 2.0 sequence diagrams using petri nets[END_REF] imposes synchronization points (each combined fragment is prefixed and postfixed sequentially). [START_REF] Eichner | Compositional semantics for uml 2.0 sequence diagrams using petri nets[END_REF] treats data in the form of variables, message parameters and guards but does not deal with time.

In [START_REF] Soares | Automatic model transformation from uml sequence diagrams to coloured petri nets[END_REF], the authors propose an approach to automatically translate UML-SDs designed with the Papyrus tool [START_REF] Gérard | Papyrus: A UML2 Tool for Domain-Specific Language Modeling[END_REF] to Coloured Petri Nets (CPNs) in a format compatible with CPNTools [START_REF] Jensen | Coloured Petri Nets and CPN Tools for modelling and validation of concurrent systems[END_REF] for execution / simulation / testing. CPNs come with an execution semantics that is particularly adapted for the description and analysis of distributed and concurrent systems. A CPN is indeed a network of "places" owning "tokens" and being connected by "arcs". Each such place can behave independently and fire an outgoing transition ("arc") if it fulfills certain requirements (owning specific tokens, etc.). When an "arc" is fired, corresponding tokens are passed between the origin and target "places", signifying the progression of the executed behavior. In [START_REF] Soares | Automatic model transformation from uml sequence diagrams to coloured petri nets[END_REF],

the translation revolves around a list of 11 rules with different priorities and which apply to translate different concepts (lifelines, message occurences, combined fragments, etc.) while iterating sequentially through the UML-SD's elements (model-to-model transformation enabled by EMF).

In [START_REF] Faria | A toolset for conformance testing against uml sequence diagrams based on event-driven colored petri nets[END_REF] a set of UML-SDs specifying partial behaviors of a SUT are translated into Extended Petri Nets.

Input execution traces can then be checked against the EPNs. The advantage provided by EPNs is that they combine the token of Colored Petri Nets allowing the handling of data values, and the port event places of Event Driven Petri Nets so as to treat exchanges with the environment. This toolset can be applied (for SUTs that are Java programs) to automatically generate and run JUnit testcases.

Denotational approaches

In [START_REF] Störrle | Semantics of interactions in uml 2.0[END_REF], the author proposes a denotational semantics based on partial order sets (as in [START_REF] Longuet | Global and local testing from message sequence charts[END_REF] which we reviewed in Sec.3.1.5) defined on the set of UML event occurrences. [START_REF] Störrle | Semantics of interactions in uml 2.0[END_REF] also evokes the issues caused by the assert and negate operators being taken as operators and not as modalities.

[65] proposes a semantics that is a detailed version of the one from [START_REF] Störrle | Semantics of interactions in uml 2.0[END_REF]. [START_REF] Haugen | STAIRS towards formal design with sequence diagrams[END_REF] evacuate the modality issue by only considering the negate operator and by having it characterize traces absolutely (as opposed to relatively).

In [START_REF] Cengarle | An institution for uml 2.0 interactions[END_REF], an institutional approach, likened to that of [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF] (which we reviewed in Sec.3.1.4) is proposed.

However it includes a loops operator (which corresponds to our loop W ) and deals with modality by including the neg and assert operators and separating the semantics in sets of accepted and refused traces.

Operational approaches

In addition to [START_REF] Mauw | Operational semantics for msc[END_REF], which we have reviewed in Sec.3.1.3, the literature contains few attempts at defining operational semantics for ILs.

The contribution in [START_REF] Lund | A fully general operational semantics for uml 2.0 sequence diagrams with potential and mandatory choice[END_REF] presents an operational semantics that is somewhat similar to our own in the sense that it builds traces from transformations of the form i act --→ i . However, in addition to the interaction syntax, it relies on a so-called communication medium to define its semantics as the output of a combination of two transitions systems: an execution system which keeps track of the state of the communication medium, and a projection system which selects the next action to execute and provide the interaction resulting from the execution. Communication models, as explained in [START_REF] Engels | A hierarchy of communication models for message sequence charts[END_REF], are tasked with keeping track of which messages have been sent and which are pending receptions. They often take the form of a set of dedicated buffers (e.g. FIFO). Our approach has the advantage of making such communication models implicit as they are implied by the mechanism that construct continuation interactions.

On the analysis of logs

We have seen with [START_REF] Longuet | Global and local testing from message sequence charts[END_REF], which we reviewed in Sec.3.1.5, that it is possible to test MSGs (and more generally ILs) both when the system can be observed globally and when it cannot (local observability). In this section, we discuss some more on the state of the art related to the question of trace analysis w.r.t. interaction models.

Part of our work is indeed related to the general problem of the automatic analysis and debugging of DSs based on local logging of traces [START_REF] Neves | Falcon: A practical log-based analysis tool for distributed systems[END_REF][START_REF] Benharrat | Constraint-based oracles for timed distributed systems[END_REF][START_REF] Nguyen | Passive conformance testing of service choreographies[END_REF][START_REF] Mace | Pivot tracing: dynamic causal monitoring for distributed systems[END_REF][START_REF] Andrés | Formal passive testing of service-oriented systems[END_REF]. We are positioned at the intersection of two main issues: (1) that of tracking the causality of actions in traces [START_REF] Neves | Falcon: A practical log-based analysis tool for distributed systems[END_REF][START_REF] Mace | Pivot tracing: dynamic causal monitoring for distributed systems[END_REF] based on the happened-before relation of Lamport [START_REF] Lamport | Time, clocks, and the ordering of events in a distributed system[END_REF] and (2) that of checking multi-traces against formal properties [START_REF] Andrés | Formal passive testing of service-oriented systems[END_REF] or models [START_REF] Nguyen | Passive conformance testing of service choreographies[END_REF][START_REF] Benharrat | Constraint-based oracles for timed distributed systems[END_REF].

Interactions have been extensively used to validate DSs using Test Case generation [START_REF] Dan | Conformance testing from message sequence charts[END_REF][START_REF] Bannour | Eliciting unitary constraints from timed sequence diagram with symbolic techniques: Application to testing[END_REF][START_REF] Longuet | Global and local testing from message sequence charts[END_REF]. Much effort is spent on the generation of local test cases to mitigate the following problems: (1) "observability", i.e.

the difficulty in inferring global executions from partial visions of message exchanges and (2) "controllability", i.e. the difficulty in determining when to apply stimuli in order to realize a targeted global execution. In this present thesis we do not address Test Case generation. However, our work confronts the issue of "observability". With the multi-trace analysis algorithms presented in Chap.9, Chap.10 and Chap.11 we provide methods so as to reconstruct global executions from partial observations (which are partial both in terms of a lack of global reordering and in terms of having missing events) of distibuted executions.

With multi-trace analysis, our work rather falls within the domain of Passive Testing [START_REF] Andrés | Formal passive testing of service-oriented systems[END_REF][START_REF] Nguyen | Passive conformance testing of service choreographies[END_REF] (in which testers are only observers). This notably relates to the Test Oracle Problem [START_REF] Dan | The oracle problem when testing from mscs[END_REF] which is that of determining expected outputs w.r.t. given stimuli. Such a problem also falls into the domain of offline approaches to Runtime Verification [START_REF] Sen | Efficient decentralized monitoring of safety in distributed systems[END_REF][START_REF] Bauer | Decentralised LTL monitoring[END_REF]. In [START_REF] Andrés | Formal passive testing of service-oriented systems[END_REF] and [START_REF] Nguyen | Passive conformance testing of service choreographies[END_REF], authors have proposed approaches to check a set of local logs recorded in Service Oriented Systems. Authors of [START_REF] Andrés | Formal passive testing of service-oriented systems[END_REF] propose a methodology to verify the conservation of invariants during the execution of the system. Both local and global invariants can be checked, although the latter is more costly in terms of computations. Our approach is different in that the reference for the analysis is not a correctness property but a model of interaction as in [START_REF] Nguyen | Passive conformance testing of service choreographies[END_REF][START_REF] Dan | The oracle problem when testing from mscs[END_REF].

Logics such as Linear Temporal Logic (LTL), are widely used in runtime verification to specify and verify requirements as logical properties. For DSs, either local properties are considered for synthesizing verifiers (as in the centralized case) in which case verification at a global level is difficult to reason about, or a global property is considered. In the latter case, either the property is transformed into decentralized verifiers and can lose meaning in the process, or all verifiers use the same global property, but they must be informed of other's local states [START_REF] Sen | Efficient decentralized monitoring of safety in distributed systems[END_REF]. There remains the possibility of coming back to the centralized case, but the accuracy of the global ordering of events using timestamping requires keeping the remote clocks synchronised [START_REF] Bauer | Decentralised LTL monitoring[END_REF]. In this perspective, models of interactions are well-suited to be used as a reference for correctness when analyzing DS executions. This is all the more relevant in cases where the temporal ordering of remote events is not feasible.

[104] discusses passive testing against models of interactions expressed in the Chor [START_REF] Qiu | Towards the theoretical foundation of choreography[END_REF] language. It differs from our approach in so far as: (1) Chor is less expressive than the IL we propose (particularly w.r.t.

the absence of weak sequencing and the nature of loops), (2) [START_REF] Nguyen | Passive conformance testing of service choreographies[END_REF] only handles synchronous communication between services, which cannot always describe accurately concrete implementations and (3) the local logs are not directly checked against the model but first pass through a synthesis step in which a global log is reconstituted based on timestamp information, and then this global log is checked. In [START_REF] Nguyen | Passive conformance testing of service choreographies[END_REF], putting logs together is facilitated by assuming synchronized clocks, which is not a prerequisite to applying our analysis approach.

Authors in [START_REF] Dan | The oracle problem when testing from mscs[END_REF] investigate the computational cost of log analysis w.r.t. graphs of MSCs. This cost is compared in different cases according to the quality of observations (local or tester observability i.e. whether one has a set of independent local logs or a globally ordered log) and the expressivity of the MSC graphs (presence of choice, loop or parallelism). The work echoes results for "MSC Membership" [START_REF] Alur | Realizability and verification of MSC graphs[END_REF][START_REF] Genest | Pattern matching and membership for hierarchical message sequence charts[END_REF] which state that this problem is NP-complete. The main factor of the cost blow-up lies in the fact that distributed actions can be equally re-ordered in multiple ways. In this thesis, we address this issue of the complexity of multi-trace analysis in Chap.9.

Conclusion and position of the thesis

ILs include a variety of specific formalisms, some being particularly expressive in terms of the intended meanings (informal semantics) of the models they can define. However, most formal approaches are restricted to specific sub-languages and, in the case of applications to FV, mostly rely on translations towards other formalisms.

With our thesis, we propose an expressive Interaction Language (IL) and a framework for FV based on a structural operational semantics which directly manipulates interaction terms (guaranteeing traceability and allowing the graphical animation of the execution of interaction models) and which is backed-up by (i.e. proven equivalent to) a denotational semantics which serves as a mathematical foundation. We use this framework to implement multi-trace analysis algorithms that provide solutions to the membership problems associated to various multi-trace semantics (that of accepted multi-traces and various notions of prefixes, reflecting partially observed behavior).

Part I The Interaction Language

In the previous chapters, we have introduced the context in which this thesis falls (Chap.2) and a state of the art on the semantics of Interaction Languages (Chap.3) that is formal languages for specifying the behaviors of distributed systems in sequence-diagram-like models.

In this chapter, we present our own take on a formal Interaction Language (IL). Our interactions are terms of a term algebra. Those terms are then associated to a semantics, which represents the behaviors that are specified by the model. The semantics of an interaction takes the form of a set of traces. Each trace -a sequence of atomic events (emission or reception of a message) -represents a behavior that the modelled system can express. The trace semantics that we propose in this section is a denotational-style semantics that uses some operators on sets of traces (the semantic domain) to construct the semantics of interactions by composition.

As a result, the layout of this chapter is the following:

• in Sec.4.1 we formally define the semantic domain and some algebraic operators on this domain,

• in Sec.4.2 we introduce the IL and its associated denotational-style semantics,

• in Sec.4.3 we discuss equivalent interaction terms and define a process to compute normal forms of interaction terms.

The formalization and all the results presented in Sec.4.1 and Sec.4.2 of this chapter have been encoded

and proven using the Coq proof assistant in [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF].

Semantic domain

In this section, we will define the semantic domain of our IL. This domain is that of sets of traces. Traces are sequences of observable events that characterize specific executions of Distributed System (DS)s. Given that a system may express several distinct behaviors, their models (interactions) can be associated to semantics in the form of sets of traces.

Traces

As in [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF], that we reviewed in Chap.3, interactions and the behaviors they can express are defined up to a given signature Ω = (L, M ) where:

• L is a set of lifelines. Lifelines are abstractions which can be used to represent sub-systems, or groups of sub-systems of a DS.

• M is a set of messages. Messages are abstractions which can be used to represent what is exchanged between several sub-systems of the DS, or between a sub-system and the external environment of the DS.

The atomic events that can be defined to represent the exchange of messages, which characterize the execution of the DS are communications actions. Indeed, the principle of interactions is to represent DSs through the perspective of their internal and external communications. A communication action is:

• either the emission of a message m ∈ M from a lifeline l ∈ L, noted l!m

• or the reception of a message m ∈ M by a lifeline l ∈ L, noted l?m

We note A Ω the set of such actions, defined up to the signature Ω. For any such action a, the notation θ(a)

denotes the lifeline on which a occurs.

Definition 4.1: Communication Action

For any signature Ω = (L, M ), we define the set of communication actions:

A Ω = {l∆m | (l ∈ L) ∧ (∆ ∈ {!, ?}) ∧ (m ∈ M )}
For any action a ∈ A Ω of the form l∆m, θ(a) denotes the lifeline l.

As in [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF], an execution of a DS defined over a signature Ω = (L, M ) can be characterized by a sequence of actions from A Ω that occurred globally. Such a sequence is called a trace and describes an execution from a global perspective. There is a total order between actions disregarding the lifelines on which they occur.

We define traces over Ω as words in A * Ω , with "." as concatenation law and the empty trace. The set of traces is denoted by T Ω .

Definition 4.2: Traces of Execution

For any signature Ω = (L, M ), we define the set of traces of execution:

T Ω = A * Ω
For any t ∈ T Ω , we denote by |t| the length of t i.e. the number of actions in the sequence, which is defined by:

• | | = 0 • |a.t| = 1 + |t| for any action a ∈ A Ω and trace t ∈ T Ω For example, t = l 1 !m 1 .l 2 ?m 1 .l 2 !m 2 is a trace on the signature Ω = (L, M ) with L = {l 1 , l 2 } and M = {m 1 , m 2 } and we have |t| = 3.
In the following, we will introduce some operators which can be applied to elements of T Ω , and state some of their properties, as preliminaries to later definitions and proofs. Those operators are then extended to sets of traces as in [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF].

Interleaving operator

The interleaving operator, denoted by || corresponds to the shuffling of elements from two traces t 1 and t 2 such that the local orders of elements within t 1 and t 2 are respected, but there is no such order that is enforced when it comes to ordering elements from t 1 w.r.t. those of t 2 .

Interleaving operator on traces

Let us at first define the || operator on traces in Def.4.3.

Definition 4.3: Interleaving on traces

For any signature Ω, we define || : T Ω × T Ω → P(T Ω ) the function s.t. for any t 1 and t 2 in T Ω and any a 1 and a 2 in A Ω :

||t 2 = {t 2 } t 1 || = {t 1 } (a 1 .t 1 )||(a 2 .t 2 ) = {a 1 .t | t ∈ t 1 ||(a 2 .t 2 )} ∪ {a 2 .t | t ∈ (a 1 .t 1 )||t 2 }
For example, we have:

a 1 .a 2 || a 4 =            a 4 .a 1 .a 2 , a 1 .a 4 .a 2 , a 1 .a 2 .a 4           
In the following, we will state and prove some properties w.r.t. the interleaving operator.

Lem.4.1 states that for any two traces t 1 and t 2 , the set of their interleavings (t 1 ||t 2 ) contains at least one trace.

Lemma 4.1: Existence of at least one interleaving

For any t 1 and t 2 in T Ω , we have:

(t 1 ||t 2 ) = ∅ Proof.
Let us reason by induction on trace t 1 .

• If t 1 = then ||t 2 = {t 2 } = ∅ • Let us suppose that t 1 ||t 2 = ∅. Then, given that {a.t | t ∈ (t 1 ||t 2 )} ⊂ (a.t 1 ||t 2 ), it immediately follows that (a.t 1 ||t 2 ) = ∅ Lem.4.
2 is another property related to the existence of a certain decomposition given that a non-empty trace of the form a.t is an interleaving of two traces t 1 and t 2 .

Lemma 4.2: Implications of having a non-empty interleaving

For any t 1 , t 2 and t in T Ω and for any a ∈ A Ω we have:

(a.t ∈ (t 1 ||t 2 )) ⇒     ∃ t 3 ∈ T Ω ,     (t 1 = a.t 3 ) ∧ (t ∈ (t 3 ||t 2 )) ∨ (t 2 = a.t 3 ) ∧ (t ∈ (t 1 ||t 3 ))        
Proof. This property is an immediate consequence of the definition of the || operator.

In Lem.4.3 we consider some properties of the interleaving operator w.r.t. the empty trace .

Lemma 4.3: Some properties of the interleaving operator w.r.t.

For any t 1 , t 2 and t in T Ω , we have:

(i) (∃ t ∈ (t 1 ||t 2 ), t = ) ⇔ ((t 1 = ) ∨ (t 2 = )) (ii) ( ∈ (t 1 ||t 2 )) ⇔ ((t 1 = ) ∧ (t 2 = )) (iii) (t ∈ ( ||t 2 )) ⇒ (t = t 2 ) (iv) (t ∈ (t 1 || )) ⇒ (t = t 1 )
Proof.

Let us prove the first property (i):

⇒ We suppose the existence of t. The other points are immediate given the definition of the || operator.

Finally, in Lem.4.4, we consider some algebraic properties of the || operator on traces. We can remark that this operator is symmetric and associative.

Lemma 4.4: Algebraic properties of the interleaving operator on traces

For any t 1 , t 2 , t 3 and t in T Ω , we have:

symmetry (t ∈ (t 1 ||t 2 )) ⇔ (t ∈ (t 2 ||t 1 )) associativity t ∈ ((t 1 ||t 2 )||t 3 ) ⇔ t ∈ (t 1 ||(t 2 ||t 3 ))
Proof.

Let us start by the symmetry. Let us suppose the existence of t ∈ (t 1 ||t 2 ) and prove that t ∈ (t 2 ||t 1 )

(the other direction is the same). Let us reason by induction on (the size of) t.

• If t = , then, as per Lem.4.3, we have t 1 = t 2 = so ∈ ( || ) all the same.

• If t = a.t , then, as per Lem.4.2, we have: ⇐ The other direction can be proven in a similar fashion.

-either t 1 = a.

Interleaving operator on sets of traces

We then extend the definition of the interleaving operator to sets of trace in Def.4.4. We will use the same overloaded notation || which is not problematic given that for any two traces t 1 and t 2 we have

t 1 ||t 2 = {t 1 }||{t 2 }.

Definition 4.4: Interleaving on sets of traces

We extend || to sets of traces with || : P(T Ω ) × P(T Ω ) → P(T Ω ) s.t. for any sets of traces T 1 and T 2 :

T 1 ||T 2 = t1∈T1 t2∈T2 (t 1 ||t 2 )
For example, we have:

     a 1 .a 2 , a 3      || a 4 =                        a 4 .a 1 .a 2 , a 1 .a 4 .a 2 , a 1 .a 2 .a 4 , a 4 .a 3 , a 3 .a 4                       
In Lem.4.5 we state some algebraic properties of this extended operator.

Lemma 4.5: Algebraic properties of the interleaving operator on sets of traces

For any sets T , T 1 , T 2 and T 3 in P(T Ω ):

neutral element T ||{ } = T = { }||T commutativity T 1 ||T 2 = T 2 ||T 1 associativity (T 1 ||T 2 )||T 3 = T 1 ||(T 2 ||T 3 ) left-distributivity T 1 ||(T 2 ∪ T 3 ) = (T 1 ||T 2 ) ∪ (T 1 ||T 3 ) right-distributivity (T 1 ∪ T 2 )||T 3 = (T 1 ||T 3 ) ∪ (T 2 ||T 3 )
Proof. The fact that { } is a neutral element is implied by definition and by Lem.4.3. The commutativity and associativity are implied by the respective properties from Lem.4.4. The distributivity is immediate.

Strict sequencing operator

Strict sequencing operator on traces

The strict sequencing operator, denoted by ";" corresponds to the concatenation of traces.

Definition 4.5: Strict Sequencing on traces

For any signature Ω, we define ; : T Ω × T Ω → P(T Ω ) the function s.t. for any t 1 and t 2 in T Ω and any a in A Ω :

;

t 2 = {t 2 } and (a.t 1 ); t 2 = {a.t | t ∈ t 1 ; t 2 }
In fact, the strict sequencing of two traces t 1 and t 2 , denoted by t 1 ; t 2 is the singleton containing the concatenation t 1 .t 2 of both traces. This formulation in terms of a set of trace can be explained by a will to have the same formulation as that of the other operators. This notation has notably been used in [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF].

For example, we have:

a 1 .a 2 ; a 4 .a 5 = a 1 .a 2 .a 4 .a 5
As what we did for the interleaving operator, let us consider analogous properties for the strict sequencing operator concerning the existence of strict sequences. In Lem.4.6 we state the existence and the unicity of the strict sequencing of two traces t 1 and t 2 .

Lemma 4.6: Existence of exactly one strict sequence

For any t 1 and t 2 in T Ω , we have:

(t 1 ; t 2 ) = {t 1 .t 2 } Proof. Immediate.
Lem.4.7 is analogous to Lem.4.2. It states the the existence of a certain decomposition given that a non empty trace of the form a.t is a strict sequence of two traces t 1 and t 2 .

Lemma 4.7: Implications of having a non-empty strict sequence

For any t 1 , t 2 and t in T Ω and for any a ∈ A Ω we have:

(a.t ∈ (t 1 ; t 2 )) ⇒     ∃ t 3 ∈ T Ω ,     (t 1 = a.t 3 ) ∧ (t ∈ (t 3 ; t 2 )) ∨ (t 1 = ) ∧ (t 2 = a.t)         Proof. Immediate.
In Lem.4.8, we consider some properties of the strict sequencing operator w.r.t. the empty trace .

Lemma 4.8: Some properties of the strict sequencing operator w.r.t.

For any t 1 , t 2 , t 3 and t in T Ω , for any l ∈ L, and any a ∈ A Ω we have:

(i) (∃ t ∈ (t 1 ; t 2 ), t = ) ⇔ ((t 1 = ) ∨ (t 2 = )) (ii) ( ∈ (t 1 ; t 2 )) ⇔ ((t 1 = ) ∧ (t 2 = )) (iii) (t ∈ ( ; t 2 )) ⇒ (t = t 2 ) (iv) (t ∈ (t 1 ; )) ⇒ (t = t 1 )
Proof. Immediate.

Finally, in Lem.4.9, we consider some algebraic properties of the ; operator. We can remark that this operator is associative.

Lemma 4.9: Algebraic properties of the strict sequencing operator on traces

For any t 1 , t 2 and t 3 in T Ω we have:

associativity t ∈ ((t 1 ; t 2 ); t 3 ) ⇔ t ∈ (t 1 ; (t 2 ; t 3 ))
Proof. Immediate.

Strict sequencing operator on sets of traces

Similarly to what we did for the interleaving operator, we extend, in Def.4.6 the strict sequencing operator to sets of traces. We will likewise use the same overloaded notation ; which is not problematic given that for any two traces t 1 and t 2 we have t 1 ; t 2 = {t 1 }; {t 2 }.

Definition 4.6: Strict Sequencing on sets of traces

We extend ; to sets of traces with ; : P(T Ω ) × P(T Ω ) → P(T Ω ) s.t. for any sets of traces T 1 and T 2 :

T 1 ; T 2 = t1∈T1 t2∈T2 (t 1 ; t 2 )
For example, we have:

     a 1 .a 2 , a 3      ; a 4 .a 5 =      a 1 .a 2 .a 4 .a 5 , a 3 .a 4 .a 5     
In Lem.4.10 we state some algebraic properties of this extended operator.

Lemma 4.10: Algebraic properties of the strict sequencing operator on sets of traces

For any sets T , T 1 , T 2 and T 3 in P(T Ω ):

neutral element T ; { } = T = { }; T associativity (T 1 ; T 2 ); T 3 = T 1 ; (T 2 ; T 3 ) left-distributivity T 1 ; (T 2 ∪ T 3 ) = (T 1 ; T 2 ) ∪ (T 1 ; T 3 ) right-distributivity (T 1 ∪ T 2 ); T 3 = (T 1 ; T 3 ) ∪ (T 2 ; T 3 )
Proof. The fact that { } is a neutral element is implied by definition and by Lem.4.8. The associativity is implied by the respective property from Lem.4.9. The distributivity is immediate.

Weak sequencing operator

The weak sequencing operator, denoted by ;× × corresponds to the reordering of events from traces such that events from the right-hand side trace can only be placed when all the events occurring on the same lifeline from the left-hand side trace have already been placed.

Conflict

The definition of this operator relies on a notion of conflict, denoted by the × × function, which is formally defined in Def.4.7. For any lifeline l and any trace t, t × × l denotes the occurrence of a conflict between l and t, i.e. that there is at least one action in t that occurs on lifeline l.

Definition 4.7: Conflict

For any signature Ω, we define × × : T Ω × L → { , ⊥} s.t. for any lifeline l and any trace t:

× × l = ⊥ (a.t) × × l = (θ(a) = l) ∨ (t × × l)
We can extend × × to sets of traces as × × : P(T Ω ) × L → { , ⊥} s.t. for any T ∈ P(T Ω ) and l ∈ L:

T × × l ⇔ (∃ t ∈ T s.t. t × × l)

Weak sequencing operator on traces

Weak sequencing then functions in a similar fashion as interleaving but with the added constraint that events occurring on the right-hand side trace are only added if they have no conflict w.r.t. what remains to be added in the left-hand side trace. Its formal definition is given in Def.4.8.

Definition 4.8: Weak Sequencing on traces

For any signature Ω, we define ;× × : T Ω × T Ω → P(T Ω ) the function s.t. for any t 1 and t 2 in T Ω and any a 1 and a 2 in A Ω :

;× × t 2 = {t 2 } t 1 ;× × = {t 1 } (a 1 .t 1 );× × (a 2 .t 2 ) = {a 1 .t | t ∈ t 1 ;× × (a 2 .t 2 )} ∪      a 2 .t (t ∈ (a 1 .t 1 );× × t 2 ) ∧(¬(a 1 .t 1 × × θ(a 2 )))     
Let us remark that, although it may be due to a typographical error or an oversight in [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF], we provide a different definition than that of [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF]. Indeed, in [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF] it suffices that the first element a 1 of the left-hand side a 1 .t 1 do not enter into conflict with the first element a 2 of the right-hand side a 2 .t 2 for a 2 to be added at the beginning of the reconstructed trace (it is the condition ¬(a 1 × × a 2 ) in [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF], with the definition of × × being that of a conflict between two actions).

For example, we have:

l 1 !m 1 .l 2 !m 2 ;× × l 1 !m 3 =      l 1 !m 1 .l 1 !m 3 .l 2 !m 2 , l 1 !m 1 .l 2 !m 2 .l 1 !m 3     
In the following, we will state some properties of the weak sequencing operator as we have done for the two previous operators.

In Lem.4.11, we state that for any two traces t 1 and t 2 , the set of their weak sequences (t 1 ;× × t 2 ) contains at least one trace.

Lemma 4.11: Existence of at least one weak sequence

For any t 1 and t 2 in T Ω , we have:

(t 1 ;× × t 2 ) = ∅
Proof. Analogous too that of Lem.4.1.

Lem.4.12 is another property related to the existence of a certain decomposition given that a non empty trace of the form a.t is a weak sequence of two traces t 1 and t 2 .

Lemma 4.12: Implications of having a non-empty weak sequence For any t 1 , t 2 and t in T Ω and for any a ∈ A Ω we have:

(a.t ∈ (t 1 ;× × t 2 )) ⇒     ∃ t 3 ∈ T Ω ,     (t 1 = a.t 3 ) ∧ (t ∈ (t 3 ;× × t 2 )) ∨ (¬(t 1 × × θ(a))) ∧ (t 2 = a.t 3 ) ∧ (t ∈ (t 1 ;× × t 3 ))        
Proof. Analogous too that of Lem.4.2, except for the added condition ¬(t 1 × × θ(a)) in the case where the action a is found in the right trace t 2 , and which stems from the fact that it wouldn't be otherwise possible, if there were some conflicts between θ(a) and t 1 .

In Lem.4.13, we consider some properties of the weak sequencing operator w.r.t. the empty trace .

Lemma 4.13: Some properties of the weak sequencing operator w.r.t.

For any t 1 , t 2 and t in T Ω , we have:

(i) (∃ t ∈ (t 1 ;× × t 2 ), t = ) ⇔ ((t 1 = ) ∨ (t 2 = )) (ii) ( ∈ (t 1 ;× × t 2 )) ⇔ ((t 1 = ) ∧ (t 2 = )) (iii) (t ∈ ( ;× × t 2 )) ⇒ (t = t 2 ) (iv) (t ∈ (t 1 ;× × )) ⇒ (t = t 1 )
Proof. Analogous too that of Lem.4.3.

Before introducing the algebraic properties of the weak sequencing operator (its associativity), let us quickly digress on the relationships of the × × "conflict" function w.r.t. the three previously defined operators (strict and weak sequencing and interleaving). We remark some distributive properties of × × w.r.t. the three operators. This property of distributivity will be required to prove the associativity of ;× × .

Lemma 4.14: Distributive properties of × ×

Let us consider ∈ {; , ;× × , ||}. Then, for any traces t 1 and t 2 and any lifeline l we have:

(∃ t ∈ (t 1 t 2 ), ¬(t × × l)) ⇔ ((¬(t 1 × × l)) ∧ (¬(t 2 × × l))) ⇔ (∀ t ∈ (t 1 t 2 ), ¬(t × × l))
And for any non-empty sets of traces T 1 and T 2 we have:

(T 1 T 2 ) × × l ⇔ (T 1 × × l) ∨ (T 2 × × l) (T 1 ∪ T 2 ) × × l ⇔ (T 1 × × l) ∨ (T 2 × × l)
Proof. Let us discuss both properties:

For the first property, the sketch of the proof is that the absence of conflict for any recomposed trace t w.r.t. a lifeline l means that all of its actions do not occur on l. Given that the set of the actions that occur within this recomposed trace is exactly the union of those that occur in either t 1 and/or t 2 , then this absence of conflict is equivalent to having an absence of conflict for both t 1 and t 2 w.r.t. l.

For the second property, the sketch of the proof is that the presence of a conflict w.r.t lifeline l for a certain recomposed trace t ∈ (T 1 T 2 ) means that it contains an action occurring on l. Then this action must either come from a trace from T 1 or from a trace from T 2 . Reciprocally any action occurring on l found in a trace from either T 1 or T 2 will also be found on a least one trace from T (given non-emptiness).

Let us finally consider the algebraic properties of the ;× × operator. We can remark that this operator is associative, as stated by Lem.4.15.

Lemma 4.15: Algebraic properties of the weak sequencing operator

For any t 1 , t 2 , t 3 and t in T Ω , we have:

associativity t ∈ ((t 1 ;× × t 2 );× × t 3 ) ⇔ t ∈ (t 1 ;× × (t 2 ;× × t 3 ))
Proof. The proof is analogous to that of the associativity of || from Lem.4.4. The main difference occurs in the induction, when considering a trace of the form t = a.t . If the action a is to be found in t 2 then there must be no conflict between t 1 and θ(a). If a is found in t 3 then there must be no conflict between t 1 and θ(a) and no conflict either between t 2 and θ(a). When recomposing the traces t 23 this must also be taken into account. To do that we need the distributivity of × × over ;× × , which was introduced in Lem.4.14 (hence the digression).

Weak sequencing operator on sets of traces

Similarly to what we did for the two previous operators, we extend, in Def.4.9 the weak sequencing operator to sets of traces. We will likewise use the same overloaded notation ;× × which is not problematic given that for any two traces t 1 and t 2 we have t

1 ;× × t 2 = {t 1 };× × {t 2 }.

Definition 4.9: Weak Sequencing on sets of traces

We extend ;× × to sets of traces with ;× × : P(T Ω ) × P(T Ω ) → P(T Ω ) s.t. for any sets of traces T 1 and T 2 :

T 1 ;× × T 2 = t1∈T1 t2∈T2 (t 1 ;× × t 2 )
For example, we have:

     l 1 !m 1 .l 2 !m 2 , l 2 ?m 1      ;× × l 1 !m 3 =                  l 1 !m 1 .l 1 !m 3 .l 2 !m 2 , l 1 !m 1 .l 2 !m 2 .l 1 !m 3 , l 1 !m 3 .l 2 ?m 1 , l 2 ?m 1 .l 1 !m 3                 
In Lem.4.16 we state some algebraic properties of this extended operator.

Lemma 4.16: Algebraic properties of the weak sequencing operator on sets of traces

For any sets T , T 1 , T 2 and T 3 in P(T Ω ):

neutral element T ;× × { } = T = { };× × T associativity (T 1 ;× × T 2 );× × T 3 = T 1 ;× × (T 2 ;× × T 3 ) left-distributivity T 1 ;× × (T 2 ∪ T 3 ) = (T 1 ;× × T 2 ) ∪ (T 1 ;× × T 3 ) right-distributivity (T 1 ∪ T 2 );× × T 3 = (T 1 ;× × T 3 ) ∪ (T 2 ;× × T 3 )
Proof. The fact that { } is a neutral element is implied by definition and by Lem.4.13. The associativity is implied by the respective property from Lem.4.15. The distributivity is immediate.

Comparing the scheduling operators

We can remark that compositions enabled by the strict sequencing operator are also enabled by the weak sequencing operator, and, in turn, compositions enabled by the weak sequencing operator are also enabled by the interleaving operator. As a result, we can order the operators as follows: (1) the interleaving operator is the weakest of the three, given that it is less strict w.r.t. which compositions it allows, and (2) the strict sequencing operator is the strongest.

Lemma 4.17: Comparing scheduling operators on traces

For any traces t 1 and t 2 we have:

(t 1 ; t 2 ) ⊂ (t 1 ;× × t 2 ) and (t 1 ;× × t 2 ) ⊂ (t 1 ||t 2 )
Proof.

For the first predicate, let us proceed by induction on t 1 .

• If t 1 = then ( ; t 2 ) = {t 2 } and ( ;× × t 2 ) = {t 2 } so the property holds.

• If t 1 = a.t 1 then (a.t 1 ; t 2 ) = {a.t | t ∈ t 1 ; t 2 }
and given that, by the induction hypothesis (t

1 ; t 2 ) ⊂ (t 1 ;× × t 2 ), this is included in (a.t 1 ;× × t 2 ).
We can proceed in a similar fashion for the second predicate i.e. the inclusion of (t

1 ;× × t 2 ) into (t 1 ||t 2 )
This property can be immediately extended to sets of traces as is done in Lem.4.18.

Lemma 4.18: Comparing scheduling operators

For any sets of traces T 1 and T 2 we have:

(T 1 ; T 2 ) ⊂ (T 1 ;× × T 2 ) and (T 1 ;× × T 2 ) ⊂ (T 1 ||T 2 )
Proof. Immediately implied by Lem.4.17.

Kleene closures

Definition & basic properties

We have seen in the lemmas Lem.4.5, Lem.4.10 and Lem.4.16, that all three scheduling operators are associative. This allows us to define the Kleene closures of those operators in Def.4.10.

Definition 4.10: Kleene closures

For any scheduling operator ∈ {; , ;× × , ||}, we define, for any set of traces T ∈ P(T Ω ): 1) for j > 0

T 0 = { } T j = T T (j-
T * = j∈N T j
The three Kleene closures defined in Def.4.10 may be called as follows:

• ; * is the strict Kleene closure,

• ;× × * is the weak Kleene closure,

• || * is the interleaving Kleene closure.

Within the Kleene closure T * we can find traces obtained from the repetition (using the specific scheduling operator ) of any number of traces of T .

Let us consider the following example. In this example we have a set T of traces in which there are two traces l 1 !m 1 .l 2 !m 2 in orange and l 2 ?m 1 in red. We consider here the weak Kleene closure of T i.e. T ;× × * . We display a subset of T ;× × * (the rest being indicated by the

• • • ) which consists of T ;× × 0 ∪ T ;× × 1 ∪ T ;× × 2 i.e. the first 3 powersets of T .      l 1 !m 1 .l 2 !m 2 , l 2 ?m 1      ;× × * =                                , l 1 !m 1 .l 2 !m 2 , l 2 ?m 1 , l 1 !m 1 .l 2 !m 2 .l 1 !m 1 .l 2 !m 2 , l 1 !m 1 .l 1 !m 1 .l 2 !m 2 .l 2 !m 2 , l 1 !m 1 .l 2 !m 2 .l 2 ?m 1 , l 2 ?m 1 .l 2 ?m 1 , l 2 ?m 1 .l 1 !m 1 .l 2 !m 2 , l 1 !m 1 .l 2 ?m 1 .l 2 !m 2 , • • •                               
In the following we state some properties of the Kleene closures.

Following what has already been done for the three scheduling operators, we remark in Lem.4.19 the distributivity of × × w.r.t. the Kleene closures.

Lemma 4.19: Distributivity of × × over the Kleene closures

For any ∈ {; , ;× × , ||}, for any set of traces T ∈ P(T Ω ) and any lifeline l ∈ L, we have:

∃ t ∈ (T * \ { }), ¬(t × × l) ⇔ ∃ t ∈ (T \ { }), ¬(t × × l) (T * × × l) ⇔ (T × × l)
Proof. As for Lem.4.14 the sketch of the proof relies on discussing the implications of the presence or absence of conflicts.

In the first case there exists a non empty recomposed trace in T * with no conflicts w.r.t. l. This trace has been recomposed from at least one non empty trace from T in which there are no conflicts w.r.t. l.

In the second case we simply remark that the presence of an action occurring on l in T implies its presence in T * , and, reciprocally, if it is found in T * then it must be found in T .

In Lem.4.20 we state that the set { } containing only the empty trace is a fixed-point w.r.t. any of the three Kleene closures.

Lemma 4.20: A fixed-point for the Kleene closures

For any ∈ {; , ;× × , ||}, we have:

{ } * = { } Proof. Trivial.

Comparing closures & idempotence properties

In Lem.4.18 from before, we have seen that the three scheduling operators can be characterized w.r.t. each other by inclusion. Given that the three Kleene closures are based on those operators, those properties of inclusions can be extended. We formalize this observation in Lem.4.21.

Lemma 4.21: Comparing the three Kleene closures

For any set of traces T , we have:

T ; * ⊂ T ;× × * and T ;× × * ⊂ T || *
Proof. The Kleene closures are obtained from unions of the powersets of T . It then suffices to prove that, for any index j ∈ N we have:

T ;j ⊂ T ;× × j and T ;× × j ⊂ T ||j
Let us therefore reason by induction on j:

• we have T ;0 = T ;× × 0 = T ||0 = { } therefore the property holds for j = 0

• we have T ;0 = T ;× × 0 = T ||0 = T therefore the property holds for j = 1

• let us suppose that T ;j ⊂ T ;× × j ⊂ T ||j we then have:

T ;(j+1) = T ; T ;j by definition ⊂ T ; T ;× × j by induction hypothesis ⊂ T ;× × T ;× × j by Lem.4.18 ⊂ T ;× × (j+1)
by definition

In the same manner, we have:

T ;× × (j+1) = T ;× × T ;× × j by definition ⊂ T ;× × T ||j by induction hypothesis ⊂ T ||T ||j by Lem.4.18 ⊂ T ||(j+1) by definition
Hence the property holds.

A consequence of those properties of inclusions is given in Lem.4.22. It pertains to the composition of several Kleene closures. Those properties are akin to properties of idempotence.

Lemma 4.22: Idempotence properties of the Kleene closures

For any set of traces T , we have:

(i) (T ; * ) ; * = T ; * (iv) (T ;× × * ) ; * = T ;× × * (vii) (T || * ) ; * = T || * (ii) (T ; * ) ;× × * = T ;× × * (v) (T ;× × * ) ;× × * = T ;× × * (viii) (T || * ) ;× × * = T || * (iii) (T ; * ) || * = T || * (vi) (T ;× × * ) || * = T || * (ix) (T || * ) || * = T || *
Proof. Let us prove each predicate one by one.

(i) Let us prove both inclusions of the equality:

⊂ Let us consider t ∈ (T ; * ) ; * . This implies the existence of j 1 ≥ 0 s.t. t ∈ (T ; * ) ;j1 . This trace t is obtained from recomposing a finite number j 1 of traces from T ; * . As a result there exists an index j 2 such that all of those trace are included in T ;j2 . Therefore we have t ∈ (T ;j2 ) ;j1 and as a result, given that ; is associative as per Lem.4.10, we have t ∈ T ;(j1+j2) and therefore t ∈ T ; * ⊃ Let us consider t ∈ T ; * . We immediately have that t ∈ (T ; * ) ;1 and therefore t ∈ (T ; * ) ; * (ii) Let us prove both inclusions of the equality:

⊂ Let us consider t ∈ (T ; * ) ;× × * . This implies the existence of j 1 ≥ 0 s.t. t ∈ (T ; * ) ;× × j1
. This trace t is obtained from recomposing a finite number j 1 of traces from T ; * . As a result there exists an index j 2 such that all of those trace are included in T ;j2 . Then, as per Lem.4.21, this implies that those traces are also included in T ;× × j2 . Therefore we have t ∈ (T ;× × j2 ) ;× × j1 . As a result, given that ;× × is associative as per Lem.4.16, we have t ∈ T ;× × (j1+j2) and therefore t ∈ T ;× × * ⊃ Let us consider t ∈ T ;× × * . We immediately have that t ∈ (T ;1 ) ;× × * and therefore t ∈ (T ; * ) ;× × * (*) all the other points can be proven similarly

Operational-style characterizations of Kleene closures

In this section we will provide an operational-style characterization for the strict Kleene closure ; * and the interleaving Kleene closure || * . We will then show, using a counter-example that this characterization does not hold for the weak Kleene closure ;× × * .

Head-First closure

For any scheduling operator ∈ {; , ;× × , ||} whenever a.t ∈ T 1 T 2 (with a and t any action and trace and T 1 and T 2 any sets of traces), we may "take" the action a either from a trace of T 1 or from a trace of T 2 .

The restricted scheduling that we define in Def.4.11 correspond to a narrower definition of the corresponding scheduling operators, that do not allow the recomposition of traces which start with an action taken from a right-hand side set.

Definition 4.11: Restricted scheduling operators

For any ∈ {; , ;× × , ||}, we define : P(T Ω ) × P(T Ω ) → P(T Ω ) such that for any sets of traces T 1 and T 2 we have:

T 1 T 2 =      t ∈ T 1 T 2 (t = a.t ) ⇒   ∃ t 1 ∈ T Ω , s.t. (a.t 1 ∈ T 1 ) ∧ (t ∈ {t 1 } T 2 )        
Let us consider the following example:

T 1 ;× × T 2 with T 1 =      l 1 !m 1 , l 2 !m 3      and T 2 =      l 1 !m 1 , l 1 !m 2      Let us remark that T 1 ;× × T 2 = T 2 ;× × T 1 . Indeed, we have for example that l 1 !m 1 .l 1 !m 2 ∈ T 1 ;× × T 2 but it is not in T 2 ;× × T 1 . Likewise, we have that l 1 !m 2 .l 1 !m 1 ∈ T 2 ;× × T 1 but it is not in T 1 ;× × T 2 .
By composition, we can compute the resulting set of traces as follows:

T 1 ;× × T 2 =          (l 1 !m 1 ;× × l 1 !m 1 ) ∪(l 1 !m 1 ;× × l 1 !m 2 ) ∪(l 2 !m 3 ;× × l 1 !m 1 ) ∪(l 2 !m 3 ;× × l 1 !m 2 )          =                   l 1 !m 1 .l 1 !m 1 ∪ l 1 !m 1 .l 1 !m 2 ∪      l 2 !m 3 .l 1 !m 1 , l 1 !m 1 .l 2 !m 3      ∪      l 2 !m 3 .l 1 !m 2 , l 1 !m 2 .l 2 !m 3                        =                                l 1 !m 1 .l 1 !m 1 , l 1 !m 1 .l 1 !m 2 , l 2 !m 3 .l 1 !m 1 , l 1 !m 1 .l 2 !m 3 , l 2 !m 3 .l 1 !m 2 , l 1 !m 2 .l 2 !m 3                               
However, if we use ; × × instead of ;× × we obtain the following:

T 1 ; × × T 2 =             l 1 !m 1 .l 1 !m 1 ∪ l 1 !m 1 .l 1 !m 2 ∪ l 2 !m 3 .l 1 !m 1 ∪ l 2 !m 3 .l 1 !m 2             =                  l 1 !m 1 .l 1 !m 1 , l 1 !m 1 .l 1 !m 2 , l 2 !m 3 .l 1 !m 1 , l 2 !m 3 .l 1 !m 2                 
We can then define head-first closures of scheduling operators using the notion of restricted scheduling and of Kleene closure as is done in Def.4.12.

Definition 4.12: Head-first closures

For any ∈ {; , ;× × , ||}, we define the Head-First closure of as * i.e. the Kleene closure of the restricted operator.

The restricted operators that we have just defined can trivially be characterized w.r.t. their unrestricted counterparts (Lem.4.23).

Lemma 4.23: Relating the restricted operators to their unrestricted counterparts

For any ∈ {; , ;× × , ||}, for any sets of traces T 1 , T 2 and T we have:

(T 1 T 2 ) ⊂ (T 1 T 2 ) and T * ⊂ T *
Proof. The first point is immediate. The second is implied by the first.

In a similar fashion to what we did in Lem.4.18 and Lem.4.21, we compare, in Lem.4.24, the different restricted operator we have just defined.

Lemma 4.24: Comparing the restricted operators

For any sets of traces T 1 , T 2 and T we have:

(T 1 ; T 2 ) ⊂ (T 1 ; × × T 2 ) and (T 1 ; × × T 2 ) ⊂ (T 1 || T 2 )
and This notion of Head-First closure constitutes an operational-style counterpart to the notion of Kleene closure. Indeed, it provides a means to ensure that the occurrence of the first action in a trace a.t comes from the expression of a behavior that is found in the first instance of the repeatable specification T .

In the following we will show that this notion of Head-First closure is equivalent to that of the Kleene closure for the strict sequencing ; and the interleaving || operators. However, as we will later see, those two notions are not equivalent whenever =;× × i.e. for the weak sequencing operator.

Characterizations for the strict and interleaving Kleene closures

In Lem. we have:

(a.t ∈ T * ) ⇒   ∃ t ∈ T Ω s.t.      (a.t ∈ T ) ∧ (t ∈ ({t } T * ))   
Proof. By definition of the Kleene closure, a.t ∈ T * implies the existence of j ≥ 0 s.t. a.t ∈ T j . We can then reason by induction on the power j:

• we cannot have j = 0 because T 0 = { } • if j = 1 then a.t ∈ T 1 = T and t ∈ {t} { } ⊂ {t} T * therefore the property holds • if j > 1 the fact that a.t ∈ T j = T T (j-1) implies the existence of t ∈ T s.t. a.t ∈ {t } T (j-1)
then:

if =; we have, as per Lem.4.7 that: * either t is of the form a.t and t ∈ {t }; T ;(j-1) and therefore t ∈ {t }; T ; * and hence the property holds * or t = and a.t ∈ T ;(j-1) In this case we can use the induction hypothesis so that the property holds

-if = ||
t ∈ {t }||({t }||T || * ) ⇒ t ∈ {t }||(T || * ||{t }) commutativity ⇒ t ∈ ({t }||T || * )||{t } associativity ⇒ t ∈ T || * ||{t } property of Kleene closure ⇒ t ∈ {t }||T || * commutativity
As a result, we have found t such that the property holds.

From Lem.4.25 we can then immediately conclude that:

• the head-first closure ; * and the Kleene closure ; * of the strict sequencing ; are equivalent

Counter-example for the weak Kleene closure

In the following we will show, using a counter example that the weak Kleene closure ;× × * and the weak Head-First closure ; × × * are not equivalent.

Let us consider the following example set of traces T :

T =      l 1 !m 1 .l 2 ?m 1 , l 2 !m 2     
We will then show that T ;× × * ∈ T ; × × * . To do that let us consider the powerset T ;× × 2 of T :

T ;× × 2 =      l 1 !m 1 .l 2 ?m 1 , l 2 !m 2      ;× ×      l 1 !m 1 .l 2 ?m 1 , l 2 !m 2      =          (l 1 !m 1 .l 2 ?m 1 ;× × l 1 !m 1 .l 2 ?m 1 ) ∪(l 1 !m 1 .l 2 ?m 1 ;× × l 2 !m 2 ) ∪(l 2 !m 2 ;× × l 1 !m 1 .l 2 ?m 1 ) ∪(l 2 !m 2 ;× × l 2 !m 2 )          =                        l 1 !m 1 .l 2 ?m 1 .l 1 !m 1 .l 2 ?m 1 , l 1 !m 1 .l 1 !m 1 .l 2 ?m 1 .l 2 ?m 1      ∪ l 1 !m 1 .l 2 ?m 1 .l 2 !m 2 ∪      l 2 !m 2 .l 1 !m 1 .l 2 ?m 1 , l 1 !m 1 .l 2 !m 2 .l 2 ?m 1      ∪ l 2 !m 2 .l 2 !m 2                   =                                l 1 !m 1 .l 2 ?m 1 .l 1 !m 1 .l 2 ?m 1 , l 1 !m 1 .l 1 !m 1 .l 2 ?m 1 .l 2 ?m 1 , l 1 !m 1 .l 2 ?m 1 .l 2 !m 2 , l 2 !m 2 .l 1 !m 1 .l 2 ?m 1 , l 1 !m 1 .l 2 !m 2 .l 2 ?m 1 , l 2 !m 2 .l 2 !m 2                               
We have underlined the fact that

l 1 !m 1 .l 2 !m 2 .l 2 ?m 1 ∈ T ;× × 2 and therefore this trace is in T ;× × * . Moreover,
given that it contains one instance of each of the actions l 1 !m 1 , l 2 !m 2 and l 2 ?m 1 , and given that ∈ T , this means that this trace is obtained from repeating exactly two instances of T .

As a result, if this trace was in T ; × × * , it would be in T ; × × T . However, we have:

T ; × × T =                     l 1 !m 1 .l 2 ?m 1 .l 1 !m 1 .l 2 ?m 1 , l 1 !m 1 .l 1 !m 1 .l 2 ?m 1 .l 2 ?m 1      ∪ l 1 !m 1 .l 2 ?m 1 .l 2 !m 2 ∪ l 2 !m 2 .l 1 !m 1 .l 2 ?m 1 ∪ l 2 !m 2 .l 2 !m 2                =                        l 1 !m 1 .l 2 ?m 1 .l 1 !m 1 .l 2 ?m 1 , l 1 !m 1 .l 1 !m 1 .l 2 ?m 1 .l 2 ?m 1 , l 1 !m 1 .l 2 ?m 1 .l 2 !m 2 , l 2 !m 2 .l 1 !m 1 .l 2 ?m 1 , l 2 !m 2 .l 2 !m 2                       
Therefore, we have shown that T ;× × * ∈ T ; × × * . For a more detailed discussion on this topic, we can study the properties of the objects that correspond to the notions of weak Kleene closure and weak Head-First closure in the world of interaction terms. This will notably be addressed in Chap.5 in the context of the operational-style formulation of the trace semantics (more particularly one can refer to Sec.5.1.13 for details on the same counter-example).

Inclusions and properties of closures

Given that we have shown that ; × × * and ;× × * are different operators, we can take an interest in how they relate to each-other, and, how ; × × * relates to ; * and || * .

In Lem.4.27, we precise the results from Lem.4.21 on the inclusions of the different closures.

Lemma 4.27: Comparing the four closures

For any set of traces T , we have: For any set of traces T , we have:

T ; * ⊂ T ; × × * ⊂ T ;× × * ⊂ T || * Proof. Given
(i) (T ; × × * ) ; × × * = T ; × × * (ii) (T ; * ) ; × × * = T ; × × * (v) (T ; × × * ) ; * = T ; × × * (iii) (T ;× × * ) ; × × * = T ;× × * (vi) (T ; × × * ) ; × × * = T ;× × * (iv) (T || * ) ; × × * = T || * (vii) (T ; × × * ) || * = T || *
Proof. Similar proof to that of Lem.4.22.

Syntax & Denotational Semantics

In the previous section, we have introduced the semantic domain P(T Ω ) (defined up to a signature Ω), its main operators and their algebraic properties. In this section, we introduce the syntax of our Interaction Language (IL) and its associated trace semantics:

• in Sec.4.2.1 we progressively introduce the different elements that constitute the IL, from its basic building blocs to the constructors that allow the definition of more complex interactions.

• in Sec.4.2.2 we formalize the syntax of the IL as a term algebra

• in Sec.4.2.3, we define a denotational-style trace semantics for the IL.

The syntax and denotational-style semantics presented in this section is partly inspired from [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF].

Informal description of the syntax

Interactions are defined up to a given signature Ω = (L, M ). Interaction terms are built by composition from a set of basic building blocks and using some constructors to define more complex terms. We use here the word "constructor" (in the domain of the syntax) so as not to confuse the reader with the usage of the word "operator" in the semantic domain.

Any interaction i constitutes a specification for a certain set of behaviors that it may express. During the execution of an interaction it must express a behavior that is found in that set, but it may express any one of those (non-deterministically).

Given that behaviors are modelled by traces from the semantic domain T Ω , the set of behaviors, or "semantics", that is associated to an interaction i is a non-empty subset of T Ω . This means, that the semantic domain of that language is P(T Ω ), which we have described in the previous section.

Basic building blocks

Communication actions (from A Ω ) constitute basic building blocks for both the traces of execution (i.e. T Ω ) and the interaction terms (which constitute the syntax), with the addition of a special empty interaction ∅. • the empty interaction, noted ∅, and represented by an empty sequence diagram, models the empty behavior i.e. the behavior in which no observable event occurs. As a result, its semantic, i.e. the set of traces that it may express is the singleton { }, where is the empty trace.

• the other building blocks are all the possible atomic reception and emission actions (defined up to the signature Ω). The semantics of an atomic action a ∈ A Ω (when considered as an atomic interaction) is the singleton {a}, i.e. it contains a single trace representing the occurrence of action a once globally.

When it comes to drawing such atomic interactions, we distinguish between:

atomic emissions of the form l!m. Those can be drawn in a sequence diagram as an horizontal arrow exiting lifeline l and carrying message m, with the arrowhead being drawn in an empty space, meaning the message is send to the external environment of the distributed system.

atomic receptions of the form l?m. Those can be drawn in a sequence diagram as an horizontal arrow entering lifeline l and carrying message m, with the tail of the arrow being in empty space -meaning the message comes from the external environment of the distributed system -and the arrowhead touching lifeline l.

In the following, we introduce the different constructors that can be defined so as to build more complex interactions.

Scheduling constructors

Scheduling constructors are binary constructors, and as such, specify interactions of the form f (i 1 , i 2 ) where f is the given scheduling constructors, i 1 is an interaction called the left sub-interaction, and i 2 is another interaction called the right sub-interaction. A behavior expressed by such a f (i 1 , i 2 ) interaction, is a certain composition of a behavior expressed by i 1 and of another behavior expressed by i 2 . Given that those behaviors are traces, one can define three scheduling constructors corresponding to the three scheduling operators ";", ";× × " and "||" from the previous section.

Given that the semantic domain is P(T Ω ) all the behaviors specified by i 1 and i 2 correspond to two sets of traces T 1 and T 2 . The semantics of f (i 1 , i 2 ) can simply be obtained by composition as T 1 T 2 for a certain scheduling operator .

In more details, we distinguish between the three scheduling constructors:

• strict for "strict sequencing" such that the semantics of strict(i 1 , i 2 ) is T 1 ; T 2 whenever T 1 and T 2 respectively are the semantics of i 1 and i 2

• seq for "weak sequencing" such that the semantics of seq(i 1 , i 2 ) is T 1 ;× × T 2 whenever T 1 and T 2 respectively are the semantics of i 1 and i 2

• par for "parallelization" such that the semantics of par(i 1 , i 2 ) is T 1 ||T 2 whenever T 1 and T 2 respectively are the semantics of i 1 and i 2 • in strict(i 1 , i 2 ), for any trace expressed by sub-interaction i 1 , all the actions from this trace must occur before any action from any trace expressed by i 2 may occur. In other terms, sub-interaction i 1 must be entirely executed before sub-interaction i 2 may start to be executed. In the column on the left, two examples are provided for the use of strict:

in strict(l!m 1 , l!m 2 ) (the example at the top of the left column), action l!m 1 must occur before action l!m 2 . This results, in the semantics {l!m 1 .l!m 2 }, which only contains one trace, for the example interaction.

in strict(l 1 !m 1 , l 2 !m 2 (the example at the bottom of the left column) we have likewise a single trace that is specified i.e.

l 1 !m 1 .l 2 !m 2 .
In both examples, there is a single possible total order between the actions that is authorized, resulting in a single accepted trace. As illustrated on Fig. 4.2, the representation of a strict constructor in the drawn sequence diagram is that of a square with two subsections divided horizontally by a line. In the top one is drawn the left sub-interaction, and on the bottom one is drawn the right sub-interaction of the interaction term. We draw a strict label on the top left corner of the square to indicate the use of the strict constructor, so as not to confuse the drawing with that of other constructors, which also use the square representation. in seq(l!m 1 , l!m 2 ) (the example at the top of the middle column), action l!m 1 must occur before action l!m 2 . Here, using seq equates to using strict i.e. we obtain the same semantics {l!m 1 .l!m 2 }. This is because both actions occur on the same lifeline l.

however, in seq(l 1 !m 1 , l 2 !m 2 ), actions l 1 !m 1 and l 2 !m 2 occur on distinct lifelines l 1 and l 2 . As a result they may occur in any order w.r.t. one another. Consequently, the semantics of that interaction contains two traces:

{l 1 !m 1 .l 2 !m 2 , l 2 !m 2 .l 1 !m 1 }.
As illustrated on Fig. 4.2, in contrast with strict, the representation of a seq constructor in the drawn sequence diagram does not include the square that surrounds the sub-interactions. The left subinteraction is simply drawn on top of the right one. This coincides with the fact that, in the graphical format of sequence diagrams, the top to bottom direction is usually associated with the passing of time.

The implicit sequencing of the top to bottom direction (i.e. what is drawn higher occurs "before", and what is drawn underneath occurs "after"), that is often only described in natural language, exactly corresponds to the seq weak sequencing constructor.

• in par(i 1 , i 2 ), any interleaving between the executions of i 1 and i 2 is allowed. In the column on the right of Fig. 4.2, two examples are provided for the use of par:

in par(l!m 1 , l!m 2 ) (the example at the top of the right column), actions l!m 1 and l!m 2 can occur in any order. We therefore obtain the semantics {l!m 1 .l!m 2 , l!m 2 .l!m 1 }.

in par(l 1 !m 1 , l 2 !m 2 ), we have likewise that actions l 1 !m 1 and l 2 !m 2 can occur in any order. We then have the semantics As for strict, the par constructor is represented graphically by using the square notation, with a par label on the top left corner.

{l 1 !m 1 .l 2 !m 2 , l 2 !m 2 .l 1 !m 1 },
Within the scheduling constructors, seq can be considered to be a hybrid, at the crossroads between strict and par. Indeed, it behaves like strict when we consider local behaviors (i.e. the orders of execution that are enforced between the actions occurring on a same localization) but when we consider global behaviors, it is more akin to par.

Message passing and broadcasts

We can use scheduling constructors to model specific patterns that are characteristic of the exchange of messages within a distributed system. Two of those are illustrated on Fig. • on the example on the left, the illustration of the passing of a message from an origin lifeline (emitter) to a target lifeline (receiver). This passing of message can be modelled by the pattern strict(l 1 !m, l 2 ?m)

i.e. we use the strict operator to schedule the reception of message m on the receiver lifeline l 2 w.r.t. its previous emission from the emitter lifeline l 1 .

• on the example on the right, the illustration of the broadcast of a message from an origin lifeline (emitter) to a set of target lifelines (receivers).

Let us note that, of course, given the nature of this IL, there can be several distinct manners to model a broadcast, in addition to the one presented in Fig. 4.3. We could have used a par constructor instead of the seq (i.e. strict(l 1 !m, par(l 2 ?m, l 3 ?m)) or we could have inverted the order of l 2 ?m and l 3 ?m in the term (i.e. strict(l 1 !m, seq(l 3 ?m, l 2 ?m)). Those changes would not have made any differences as for the semantics (sets of accepted traces).

If recognized within an interaction term, those specific patterns can be drawn in a dedicated manner.

For the passing of a message m from lifeline l 1 to lifeline l 2 , as in Fig. 4.3, we can draw an horizontal arrow carrying m from the representation of lifeline l 1 to that of lifeline l 2 . For broadcasts, we can draw, as in In addition to the scheduling constructors, one can also define choice constructors, which, instead of scheduling the behaviors expressed by sub-interactions, select them. In our IL we propose a single choice constructor which is the non-deterministic alternative "alt" constructor.

alt is a binary constructor which specifies an exclusive alternative between 2 sub-interactions. In alt(i 1 , i 2 ), any behavior specified by either the left sub-interaction i 1 or by the right sub-interaction i 2 is acceptable. In Fig. 4.4, the use of the alt constructor is illustrated on 2 examples:

• in alt(l!m 1 , l!m 2 ) (the example on the left), if l!m 1 occurs then l!m 2 does not occur and vice-versa.

This leads to a semantics containing two traces: {l!m 1 , l!m 2 }.

• in alt(l!m, ∅) (the example on the right), action l!m may occur, or may not occur, because the empty interaction is selected. This likewise lead to the acceptance of two traces: {l!m, }.

In effect, the semantics of an interaction of the form alt(i 1 , i 2 ) is an union of that of i 1 and i 2 i.e. it is T 1 ∪ T 2 whenever T 1 and T 2 respectively are the semantics of i 1 and i 2 .

Similarly to strict and par, the alt constructor is represented graphically by using the square notation, with a alt label on the top left corner.

Repetition constructors

Repetition constructors, also called loops, specify the possible repetition (any number of times) of a given sub-interaction. As such, an interaction loop k (i) (with k being the "kind" of the loop of which we define four) synthesizes into a finite interaction term the specification of any arbitrary repetitions of behaviors specified by the sub-interaction i.

As the reader may expect, those loop constructors are associated to the three Kleene closures ; * , ;× × * and || * and the weak Head-First closure ; × × * operators from the previous section. Therefore we define four loop constructors such that, whenever T is the semantics of an interaction i then the semantics of:

• loop S (i) is T ; * and we may call loop S the strict loop constructor

• loop W (i) is T ;× × * and we may call loop W the weak loop constructor

• loop P (i) is T || * and we may call loop P the parallel or interleaving loop constructor

• loop H (i) is T ; × × * and we may call loop H the head loop constructor

We can describe those operators as loops or repetition operators because they enable the repetition, any number of times, and according to a certain scheduling operator, of behaviors:

• loop S uses strict sequencing as a scheduler

• loop P uses interleaving as a scheduler

• both loop W and loop H use weak sequencing as a scheduler. However, loop H restrict accepted traces to those in which one take the first action (the head) in the first instance of the sub-behavior while loop W has no such restriction.

• As a side note, let us remark that there is no use in defining a "loop alt " constructor i.e. using the alt constructor as a scheduler for the repetition of the behavior. Indeed, if we consider loop alt (i), such a loop is simply equivalent to alt(i, ∅). If we choose to repeat 0 times the sub-interaction i then we have the ∅ alternative. If we choose to repeat it once, we get i and if twice, we get alt(i, i) which equates having i.

The pertinence of defining four loops can be intuitively understood given that the three scheduling operators indeed have different semantics and, as a result, repeating their use should also result in different semantics. As for the loop H constructor, we can link it to the unique ; × × * operator which we have shown to be distinct from and i B = seq(l!m 1 , l!m 2 ). In each of the six cells of the table from Fig. 4.5, we have on top the diagram representation of an interaction, in the middle the corresponding term and on the bottom a partial representation of its associated semantics. The three top cells correspond to loop S (i A ), loop W (i A ) and loop P (i A ) while the three bottom cells correspond to loop S (i B ), loop W (i B ) and loop P (i B ).

          0 : , 1 : l1!m.l2?m, 2 : l1!m.l2?m.l1!m.l2?m, l1!m.l1!m.l2?m.l2?m, ...      with i A = strict(l 1 !m, l 2 ?m) diagram term loop S (i B ) loop W (i B ) loop P (i B ) traces 0 : , 1 : l!m1.l!m2, 2 : l!m1.l!m2.l!m1.l!m2, ... 0 : , 1 : l!m1.l!m2, 2 : l!m1.l!m2.l!m1.l!m2, ...      0 : , 1 : l!m1.l!m2, 2 : l!m1.l!m2.l!m1.l!m2, l!m1.l!m1.l!m2.l!m2, ...      with i B = seq(l!m 1 , l!m 2 )
We can remark that the graphical representation of a loop is that of a square, containing the representation of the nested sub-interaction and decorated with a label on the top left corner, which is either loopS, loopH, loopW or loopP depending on the type of loop.

For each example interaction of Fig. 4.5, its semantics is, as mentioned before, partially represented i.e. a subset of the semantics is detailed:

• in all six cases the empty trace belongs to the semantics. It indeed corresponds to the repetition zero times of the sub-interaction (either i A or i B )

• when the sub-interaction is repeated once, we get, for the three cases from the top line (i.e. corresponding to i A ) the subset {l 1 !m.l 2 ?m}, and, for the three cases from the bottom line (i.e. corresponding to

i B ) the subset {l!m 1 .l!m 2 }
• when the sub-interaction is repeated twice we can observe that:

in the case where the sub-interaction that is repeated is i A (top row), the semantics of loop W (i A ) and loop P (i A ) remain the same, but the semantics of loop S (i A ) is different from the others, only allowing strictly less traces in the case where the sub-interaction that is repeated is i B (bottom row), the semantics of loop S (i B ) and loop W (i B ) remain the same, but the semantics of loop P (i B ) is different from the others, allowing more traces As for the head loop operator loop H it mostly behaves as loop W except on certain cases due to the restriction imposed on the first action that is taken. loop H is indeed associated to the weak Head-First closure operator ; × × * .

⊃ ⊂ On page 92, we have introduced an example in the semantic domain P(T Ω ) demonstrating the distinctness of ; × × * and ;× × * . On Fig. 4.6 is illustrated its counterpart in the world of interaction terms. On the left, we have an interaction i A = loop W (i 1 ) where i 1 = alt(strict(l 1 !m 1 , l 2 ?m 1 ), l 2 !m 2 ), in the middle we have an interaction i B = seq(i 1 , i 1 ) and on the right we have i C = loop H (i 1 ). We can remark that the trace

l 1 !m 1 .l 2 !m 2
.l 2 ?m 1 belongs to the semantics of i B given that we can choose to execute at first the occurrence of l 1 !m 1 from the second instance of i 1 i.e. the one underneath. By definition, this trace also belongs to the semantics of i A . However it does not belong to that of i C because it corresponds to the case of taking the first action l 1 !m from the second instance of behavior i 1 .

Even though the loop H is not associated to a Kleene closure contrary to the three other loops, we have decided to include it for two reasons:

• because it is indeed a unique artifact, distinct from the three other loops. Indeed, as we have seen in Sec.4.1.7 while the HF-closures for the strict sequencing and the interleaving operators are equivalent to the K-closures of the same operators (Lem.4.26) this is not the case for weak sequencing.

• and also because it corresponds to a notion of "loop" which may appear more intuitive

As a result of those observations, one can conclude that the four constructors loop S , loop H , loop W and loop P are indeed different. From a system designer perspective, using either loop is motivated by different goals:

• With loop S (i), each existing instance of a repeatable behavior (specified by i) must be executed entirely before any other can start. This implies that, at any given moment there can only exists zero or a single instance. loop S can therefore be used to specify some critical repeatable behavior of which there can only exist one instance at a time.

• With loop P (i), all existing instances can be executed concurrently w.r.t. one another, and, at any given moment, new instances can be created. loop P can therefore be used to specify protocols in which any number of new sessions can be created and run in parallel.

• With loop W (i), new instances can be created whenever the action triggering the instantiation occurs on a lifeline which is not occulted by previous instances. This can be roughly explained as follows: [START_REF]Official coq website[END_REF] on each individual lifeline only one instance can be active and (2) given that, for any such instance, a lifeline might "have finished" before the others then it is allowed to start another instance. loop W can therefore be used to specify repeatable behaviors that are sequential but that have no enforced synchronization mechanisms.

• The head loop loop H is associated to the weak HF-closure operator ; × × * which is an ad-hoc algebraic artifact which might correspond to a more intuitive understanding of sequential loops than loop W .

Formal syntax

Now that we have informally introduced all the building blocks and constructors that constitute the syntax of our Interaction Language (IL), let us provide a full formalization.

Definition 4.13: Interaction Language

The set I Ω of interactions defined over the signature Ω = (L, M ) is the set of ground terms T F associated to the term algebra of signature F such that:

F 0 = A Ω ∪ {∅} F 2 = {strict, seq, par, alt} F 1 = {loop S , loop H , loop W , loop P } F j = ∅ for any j > 2
In Def.4.13 we define our IL as that of the ground terms of a term algebra. This allows us to use notations and benefit from results from the fields of equational logic and term rewriting which we introduced in Sec.2.2.

A first benefit of this presentation is that of structural induction. In order to prove a given property ψ on all interactions terms, it suffices to prove it for the empty interaction ∅ and for any action a ∈ A Ω and then to prove that for any interaction of the form i = f (i 1 , i 2 ) and i = loop k (i 1 ) (given f ∈ {strict, seq, par, alt} and k ∈ {X, H, S, P }) if i 1 and i 2 satisfy ψ then i satisfies ψ.

A second benefit is the ability to represent interactions as trees. Given that, in I Ω , the arity of the operation symbols is at most 2, words describing positions within interaction terms are in {1, 2} * . Using notations from Sec.2.2, we may denote by pos(i) the set of positions associated to an interaction term i. In the middle is a syntactic term in our interaction language which corresponds to this diagram and which is represented as a tree. On the right is represented a tree structure corresponding to that of the syntactic term, with each node being replaced by its position within the tree:

• the empty position is that of the root node of the interaction term / tree

• whenever a node at position p ∈ {1, 2} * has a left child or a unique child (in the case of loop constructors), then this child is at position p.1

• whenever a node at position p ∈ {1, 2} * has a right child, then this child is at position p.2

As a result, and roughly speaking, starting from the empty position , adding "ones" at the end corresponds to going to the left and adding "twos" at the end corresponds to going to the right. In the example from Fig. 4.7, the root node of the interaction hosts a seq constructor and is at position . The node at its left hosts a loop H constructor and is at position 1 while the node at its right hosts a par constructor and is at position 2.

Those positions allow the unambiguous designation of any sub-tree in the tree structure and therefore, we can pinpoint any sub-terms of an interaction. Considering the inductive nature of the language, any such sub-term is in itself a fully-fledged interaction, which we may call a "sub-interaction".

Using the notations from Sec.2.2, for any interaction i and any position p ∈ pos(i), i |p refer to the sub-interaction of i which root node is at position p within i.

l 2 !m 2 l 3 ?m 2 ∅ l 2 !m 3 par l 1 !m 1 strict l 3 !m 4 l 1 ?m 4 • i |111 • i |1121 • i |21

Denotational semantics

As the reader may expect, we can define a denotational semantics of interactions as a homomorphism between the semantic domain P(T Ω ), which admits the structure of a F-algebra and the term algebra I Ω of interaction terms.

Let us indeed consider the carrier A = P(T Ω ) i.e. the set of sets of traces. On this carrier A = P(T Ω )

we have the following operators: We can see that those operators can be described as interpretations of the constructors from F the signature of the term algebra T F = I Ω of interaction terms.

In addition, for the basic building blocks ∅ (the empty interaction) and actions a ∈ A Ω , which are constants of F 0 , we can match them respectively with { }, meaning that the semantics of ∅ only contains a single trace which is the empty trace (observation of no action) and with {a}, meaning that the semantics of a (interaction reduced to a single action) only contains a single trace which is a (observation of a single action).

In Def.4.14 we formalize in this manner the F-algebra of sets of traces.

Definition 4.14: Semantic domain P(T Ω ) as a F-algebra

A = (P(T Ω ), F A ) (with F A = {f A | f ∈ F })
is the F-algebra defined by its carrier P(T Ω ) and the following interpretations of the operation symbols in F:

∅ A = { } a A = {a} strict A = ; seq A = ;× × par A = || alt A = ∪ loop A S = ; * loop A H = ; × × * loop A W = ;× × * loop A P = || *
We then define in Def.4.15 a denotational-style semantics σ d of interactions as the unique homomorphism between T F = I Ω and A = (P(T Ω ), F A ). Fig. 4.9 illustrates this definition by representing σ d as a morphism which preserves algebraic structures.

Definition 4.15: Denotational semantics of interactions

The denotational semantics σ d of I Ω is the unique F-homomorphism σ d :

I Ω → P(T Ω ) between T F = I Ω and A = (P(T Ω ), F A )
This denotational-style semantics constitutes the mathematical foundation for some other contributions of this present thesis, notably:

• we use it as a reference to justify the correctness of another semantics, defined in operational-style, that will be introduced in Chap.5. A proof for the equivalence of both semantics is presented in Sec.5.2.

• it serves as the basis to characterize an equivalence relation between interaction terms and to compute normal forms via rewriting. This will be covered in the next section.

  I Ω ,    ∅, a ∈ A Ω , alt, strict, seq, par loop S , loop H , loop W , loop P        P(T Ω ),    { }, {a}, ∪, ; , ;× × , ||, ; * , ; × × * , ;× × * , || *      homomorphism σ d (denotational semantics)
Figure 4.9: The denotational semantics as a homomorphism

Normal forms of interactions

In this section we use results from the domain of (1) equational theory [START_REF] Aceto | Finite Equational Bases in Process Algebra: Results and Open Questions[END_REF][START_REF] Jouannaud | Higher-Order Rewriting: Framework, Confluence and Termination[END_REF] so as to define classes of interactions which have the same semantics, and (2) term rewriting [START_REF] Dershowitz | Rewrite Systems[END_REF][START_REF] Jantzen | Basics of Term Rewriting[END_REF] so as to define normal forms of interactions.

Those two points are related in so far as whenever two interactions have the same normal form (defined up to a certain rewrite system) then they are equivalent (up to a certain equational theory).

Working with normal forms instead of general interactions can be useful in various ways. It can notably help reduce the complexity of some problems in which one can explore the space of normal forms instead of exploring the larger space of all interaction terms. This section is organised as follows:

• in Sec.4.3.1 we define an axiom system on I Ω that is sound w.r.t. A,

• in Sec.4.3.2 we define a process to normalize interactions modulo Associativity-Commutativity,

• in Sec.4.3.3 we present automated proofs for the convergence of this process i.e. that it yields unique AC classes for any interaction,

• in Sec.4.3.4 we present a total rewrite order on interactions that can be used to select unique representatives of AC classes,

• finally, in Sec.4.3.5 we present an implementation of the whole process and demonstrate its use on some examples.

A sound axiom system for interactions

As explained in Sec.2.2, a F-algebra A induces a congruence relation = A on a corresponding term algebra T F (X ). This also holds in the case of interactions and their semantics, and, in that case, = A refers to semantic equality i.e. for any two interactions i 1 and i 2 we have (i

1 = A i 2 ) ⇔ (σ d (i 1 ) = σ d (i 2 )).
Finding an equational base that can generate = A is outside the scope of this thesis. However, using algebraic properties of the operators on sets of traces defined in Sec.4.1, we define in this section a sound axiom system w.r.t. = A .

Let us consider the axiom system E I defined in Def.4.16 on the set of interaction terms with variables.

Those 39 equations can be informally summarized as follows, given variables x, y and z:

∀ f ∈ {strict, seq, par}, f (∅, y) ≈ y (Simpl-Left) ∀ f ∈ {strict, seq, par}, f (x, ∅) ≈ x (Simpl-Right) ∀ f ∈ {strict, seq, par, alt}, f (f (x, y), z) ≈ f (x, f (f, z)) (Flush) ∀ f ∈ {par, alt}, f (x, y) ≈ f (y, x) (Invert) alt(x, x) ≈ x (Duplicate) ∀ f ∈ {strict, seq, par}, f (x, alt(y, z)) ≈ alt(f (x, y), f (x, z)) (Factorize-Left) ∀ f ∈ {strict, seq, par}, f (alt(x, y), z) ≈ alt(f (x, z), f (y, z)) (Factorize-Right) ∀ k ∈ {S, H, W, P }, loop k (∅) ≈ ∅ (Loop-Simpl) ∀ (k 1 , k 2 ) ∈ {S, H, W, P } 2 , loop k1 (loop k2 (x)) ≈ loop min(k1,k2) (x) (Loop-Unnest)
We have here gathered the 39 equations from Def.4.16 under 9 named transformations. Those names informally describe the intended effect of the transformation they describe. It is then trivial to show that this axiom system E I is sound w.r.t. the F-algebra A = (P(T Ω ), F A ) which is the semantic domain of sets of traces. Indeed, all those equations correspond to algebraic properties of the operators on P(T Ω ) which are the counterparts f A of the operation symbols f ∈ F that are involved.

Indeed, we have that:

• "Simpl-Left" and "Simpl-Right" respectively describes the simplification by removal of an empty interaction ∅ on the left and on the right of a scheduling constructor. and ∪ operators. The 4 equations related to "Flush" are therefore sound.

• "Invert" describes the inversion of the left and right sub-interactions underneath a par or alt constructor.

The 2 equations related to this transformation are sound because they correspond to the commutativity of the || (Lem.4.5) and ∪ operators.

• "Duplicate" describes the duplication or simplification of an alt whenever its two branches are identical.

The equation related to this transformation is sound because it corresponds to the idempotence of the union ∪ operator.

• "Factorize-Left" and "Factorize-Right" respectively describes the factorization of a prefix/suffix x whenever two branches of an alternative "start/end" (given a scheduling constructor) with x. • "Loop-Simpl" describe the simplification of a loop constructor that specify the repetition of the empty behavior ∅. The 4 equations related to this transformation are sound because { } is a neutral element for ; * , ; × × * , ;× × * and || * as per Lem.4.20.

• "Loop-Unnest" describe the simplification of nested loops whenever they specify the repetition of a repetition, which can be brought back to a simple repetition. Here, min : {S, H, W, P } 2 → {S, H, W, P } is the minimum according to the total order P < W < H < S. The 16 equations related to this transformation are sound because they correspond to the idempotency properties of the Kleene closures and Head-First closures that we have described in Lem.4.22 and Lem.4.28.

Definition 4.16: An axiom system on interaction terms

Given the signature F = { } ∪ A Ω ∪ {strict,seq,par,alt,loop S ,loop H ,loop W ,loop P } and a set of variables X which includes {x, y, z}, let us consider the following axiom system E I on the set T F (X ) of interaction terms with variables, which contains the following equations:

strict(x, ∅) ≈ x seq(x, ∅) ≈ x par(x, ∅) ≈ x strict(∅, x) ≈ x seq(∅, x) ≈ x par(∅, x) ≈ x strict(strict(x, y), z) ≈ strict(x,
loop S (∅) ≈ ∅ loop H (∅) ≈ ∅ loop W (∅) ≈ ∅ loop P (∅) ≈ ∅ loop S (loop S (x)) ≈ loop S (x) loop S (loop H (x)) ≈ loop H (x) loop S (loop W (x)) ≈ loop W (x) loop S (loop P (x)) ≈ loop P (x) loop H (loop S (x)) ≈ loop H (x) loop H (loop H (x)) ≈ loop H (x) loop H (loop W (x)) ≈ loop W (x) loop H (loop P (x)) ≈ loop P (x) loop W (loop S (x)) ≈ loop W (x) loop W (loop H (x)) ≈ loop W (x) loop W (loop W (x)) ≈ loop W (x)
(l!m 1 , l!m 2 ) = A strict(l!m 1 , l!m 2 ) but we also have that seq(l!m 1 , l!m 2 ) ≈ E I strict(l!m 1 , l!m 2 ) and therefore = A ⊆≈ E I .
Given that the denotational semantics σ d of interactions is defined as the initial homomorphism between the ground term algebra I Ω and P(T Ω ) we have in particular that, for any two interactions i and i

, if i ≈ E I i then we have that σ d (i) = σ d (i ).
Lemma 4.30:

≈ E I preserves σ d
For any two interactions i and i we have that:

(i ≈ E I i ) ⇒ (σ d (i) = σ d (i ))
Proof. Implied by Lem.4.29.

We have therefore identified a syntactic relation on interaction terms that relate (some but not all) semantically equivalent interactions. This relation ≈ E I naturally partitions the set of interaction terms into classes [ ] ≈ E I of semantically equivalent terms.

A process to normalize interaction terms

In Sec.2.2, we have seen that Associative-Commutative Rewriting (AC-R) can be used to define terminating rewrite systems on languages in which some operators may be associative or commutative. Given that this is the case for our IL, we use AC-R in this section so as define a process to normalize interaction terms.

Let us consider the following equational theory T I , which gathers all equations from E I related to the associativity and commutativity of constructors:

T I =            strict(strict(x, y), z) ≈ strict(x, strict(y, z)) seq(seq(x, y), z) ≈ seq(x, seq(y, z))
par(par(x, y), z) ≈ par(x, par(y, z)) alt(alt(x, y), z) ≈ alt(x, alt(y, z)) par(x, y) ≈ par(y, x) alt(x, y) ≈ alt(y, x)

          
T I contains exactly the equations from E I (defined in Sec.4.3.1) which correspond to the properties of associativity and commutativity of the symbols of the Interaction Language (IL). Indeed we have that strict, seq, par and alt are associative and alt and par are commutative.

By putting those equations from E I in T I , we remove concerns of non-terminations related to those equations. However, there are still some equations in E I that are problematic w.r.t. non-termination.

The distributivity of scheduling constructors w.r.t. alt

Indeed, in E I , there are 6 equations relating to the distributivity of the scheduling constructors (strict, seq and par) w.r.t. to the alt constructor. When simplifying an interaction term, we might need to use those equations in both directions. This is exemplified in Fig. 4.10, where, in order to simplify the interaction at the top left into the one at the bottom right, we make use of both directions of the "Factorize-Right"

transformation. Indeed we have that:

• the first transformation consists in applying "Factorize-Right" at position 2, in the direction that complexifies the term. Doing so reveals that the sub-interactions at positions 1 and 22 are identical (syntaxically).

alt strict l 1 !m l 3 ?m strict alt l 2 !m l 1 !m l 3 ?m ≈ E I alt strict l 1 !m l 3 ?m alt strict l 2 !m l 3 ?m strict l 1 !m l 3 ?m ≈ E I alt strict l 1 !m l 3 ?m alt strict l 1 !m l 3 ?m strict l 2 !m l 3 ?m ≈ E I alt alt strict l 1 !m l 3 ?m strict l 1 !m l 3 ?m strict l 2 !m l 3 ?m ≈ E I alt strict l 1 !m l 3 ?m strict l 2 !m l 3 ?m ≈ E I strict alt l 1 !m l 2 !m l 3 ?m Figure 4
.10: Simplification of an example interaction which uses distributivity in both directions

• then, we apply "Invert" at position 2 and then "Flush" at the root position . Those two successive transformations allow to place the two identical sub-interactions as siblings under an alt node.

• this then allows the use of "Duplicate" so as to eliminate a duplicate branch.

• finally, we apply "Factorize-Right" again but this time in the other direction, at the root position

In the example from Fig. 4.10 we therefore use the distributivity of strict w.r.t. alt in both direction. A first time as strict(alt(x, y), z) alt(strict(x, z), strict(y, z)) in order to reveal that there exists two identical branches of the alternative modulo AC. And then, once this duplicated branch has been removed, we use alt(strict(x, z), strict(y, z)) strict(alt(x, y), z). As a result, if one were to use a single rewrite system to normalize interactions in this fashion, we would have both directions of this equation and the rewrite system would be non-terminating.

This remark can be likewise made for all equations of E I pertaining to the left and right distributivity of all three scheduling operators w.r.t. the alternative operator.

In order to solve this problem we simply define two distinct rewrite systems, which we then apply one after the other so as to normalize interactions. The first one uses distributivity in the direction that expands the terms and, at the same time, eliminates duplicated branches underneath alternatives. Then, the second rewrite system uses the distributivity in the direction that contracts the terms. In the following we may say that our process to normalize interactions is a two phases process, in which phases 1 and 2 respectively correspond to the application of the first and second rewrite system.

First phase of the process

Let us at first consider the set R 0 I of rewrite rules defined by:

R 0 I =                                                                  strict(x, ∅) x seq(x, ∅) x par(x, ∅) x strict(∅, x) x seq(∅, x) x par(∅, x) x loop S (∅) ∅ loop H (∅) ∅ loop W (∅) ∅ loop P (∅) ∅ loop S (loop S (x)) loop S (x) loop S (loop H (x)) loop H (x) loop S (loop W (x)) loop W (x) loop S (loop P (x)) loop P (x) loop H (loop S (x)) loop H (x) loop H (loop H (x)) loop H (x) loop H (loop W (x)) loop W (x) loop H (loop P (x)) loop P (x) loop W (loop S (x)) loop W (x) loop W (loop H (x)) loop W (x) loop W (loop W (x)) loop W (x) loop W (loop P (x)) loop P (x) loop P (loop S (x)) loop P (x) loop P (loop H (x)) loop P (x) loop P (loop W (x)) loop P (x) loop P (loop P (x)) loop P (x)                                                                 
This set R 0 I contains all the rules that are straightforward and do not pose any problem regarding nontermination. R 0 I will serve as a baseline rule set to define both rewrite systems. We then define the set R 1 I of rewrite rules as follows:

R 1 I = R 0 I ∪                                      alt(x,
                                    
The set R 1 I contains additional rules which are exclusive to the first phase of the process. Those rules contains:

• the elimination of duplicated branches underneath alternatives with alt(x, x)

x. Given that we use rewriting modulo AC, and given that the alt operator is AC, we only need a single rule to do so.

Indeed, we have that for instance alt(x, alt(y, x)) or alt(alt(x, y), x) and so on can all be simplified into alt(x, y) modulo AC.

• and the use of the distributive properties of strict, seq and par w.r.t. alt in the direction that expands the terms with f (x, alt(y, z)) alt(f (x, y), f (x, z)) for the left distributivity and f (alt(x, y), z) alt(f (x, z), f (y, z)) for the right distributivity of any f ∈ {strict, seq, par}

We can then define phase 1 as the normalisation associated with rewrite relation → R 1 I /T I , which we prove to be convergent in Sec.4.3.3.

Second phase of the process

Likewise, we can define the second phase of the process in a similar fashion. We complement the set R 0 I of baseline rules into a set R 2 I which includes additional rules which exploit the distributivity of scheduling operators w.r.t. alt in the direction that contracts terms. However, as illustrated by the example from Fig. 4.11 it does not suffice to include the rule alt(strict(x, y), strict(x, z)) strict(x, alt(y, z)). Indeed with only that rule we cannot simplify the example from from Fig. 4.11 without relying on using x strict(x, ∅).

Indeed, on Fig. 4.11 we use at first x strict(x, ∅) ("Simpl-Right") at position 1 before being able to use the distributivity ("Factorize-Left") of strict. However, adding the rule x strict(x, ∅) is not compatible with having a terminating rewrite system.

To be able to operate the simplification from Fig. 4.11 we need the additional rule alt(x, strict(x, y)) strict(x, alt(∅, y)). Then given that we operate rewriting modulo AC we do not need any additional rules.

For instance it is no use looking for x at a deeper level that strict(x, y) on the left-hand side because, if we have strict(strict(x, y), z) we can always equate it to strict(x, strict(y, z)) thanks to the equational theory This reasoning can be applied to all three scheduling operator and also to their properties of rightdistributivity. As a result, we may define the set R 2 I of rewrite rules as follows:

T (i.e. using AC-R). alt l 1 !m strict l 1 !m l 2 ?m ≈ E I alt strict l 1 !m ∅ strict l 1 !m l 2 ?m ≈ E I strict l 1 !m alt ∅ l 2 ?m
R 2 I = R 0 I ∪                                                                        alt(x,
                                                                      
With the definition of R 2 I we can then define phase 2 as the process of normalisation associated to the → R 2 I /T I rewrite relation.

We then define our process to normalize interactions as the successive application of the two rewrite systems which are R1 I /T I and then R 2 I /T I . In Sec.4.3.3 we provide automated proofs for the convergence (i.e. termination and confluence) of both rewrite systems. Given that those rewrite systems are convergent they define unique normal forms. For any interaction i let us denote by R 1 (i), and R 2 (i) the normal forms which are respectively associated to the application of R 1 I /T I and R 2 I /T I . We then consider, for any interaction i, the normal form R 2 (R 1 (i)) which is uniquely defined (by composition). However, given that we are here considering rewriting modulo theories, and in particular modulo AC, R 2 (R 1 (i)) does not designates an interaction term but a class of equivalent interaction terms modulo AC.

Indeed, the process which we have formalized is a process modulo AC. As a result it yields classes of equivalence modulo AC and not normal forms of interactions. To actually implement an algorithm for computing a normal form, we need to impose a total rewrite ordering on terms. We define such an ordering in Sec.4.3.4.

Before introducing the rewrite ordering, let us, in the next section, prove the convergence of R 1 I /T I and R 2 I /T I . As previously mentioned, those proofs consist in automated proofs of termination and confluence obtained from the use of dedicated software.

Automated proofs of convergence

There exist many software tools for automating proofs of termination or confluence for rewriting systems.

We can for instance cite CiME3 [START_REF] Contejean | Automated certified proofs with cime3[END_REF] (termination and confluence), TTT2 [START_REF] Korp | Tyrolean termination tool 2[END_REF] (termination), NaTT [START_REF] Yamada | Nagoya termination tool[END_REF] (termination), CSI [START_REF] Zankl | Csi -a confluence tool[END_REF] (confluence), CoLL [START_REF] Shintani | Coll: A confluence tool for left-linear term rewrite systems[END_REF] (confluence) etc. Those tools may use various methods, which we will not address, to prove those results.

A standard format called the WST format (format for the international WorkShop on Termination 1 ) enables the encoding of Class Rewriting Systems for use in various tools such as the ones that we have mentioned.

On Fig. 4.12 we encode in WST format the first phase of our process i.e. the CRS R 1 I /T I . Likewise, on Fig. 4.13 we encode R 2 I /T I . Then, using TTT2 (version 1.20) and CSI (version 1.2.4) we respectively proved the termination and the confluence of both CRSs.

( VAR x y z ) ( THEORY ( AC alt ) ( AC par ) ( A strict ) ( A seq )) ( RULES strict (x , o ) → x seq (x , o ) → x par (x , o ) → x strict (o , x ) → x seq (o , x ) → x par (o , x ) → x loopS ( o ) → o loopH ( o ) → o loopW ( o ) → o loopP ( o ) → o loopS ( loopS ( x )) → loopS ( x ) loopS ( loopH ( x )) → loopH ( x ) loopS ( loopW ( x )) → loopW ( x ) loopS ( loopP ( x )) → loopP ( x ) loopH ( loopS ( x )) → loopH ( x ) loopH ( loopH ( x )) → loopH ( x ) loopH ( loopW ( x )) → loopW ( x ) loopH ( loopP ( x )) → loopP ( x ) loopW ( loopS ( x )) → loopW ( x ) loopW ( loopH ( x )) → loopW ( x ) loopW ( loopW ( x )) → loopW ( x ) loopW ( loopP ( x )) → loopP ( x ) loopP ( loopS ( x )) → loopP ( x ) loopP ( loopH ( x )) → loopP ( x ) loopP ( loopW ( x )) → loopP ( x ) loopP ( loopP ( x )) → loopP ( x ) alt (x , x ) → x strict (x , alt (y , z )) → alt ( strict (x , y ) , strict (x , z )) seq (x , alt (y , z ))
→ alt ( seq (x , y ) , seq (x , z )) par (x , alt (y , z ))

→ alt ( par (x , y ) , par (x , z )) strict ( alt (x , y ) , z ) → alt ( strict (x , z ) , strict (y , z )) seq ( alt (x , y ) , z ) → alt ( seq (x , z ) , seq (y , z )) par ( alt (x , y ) , z )

→ alt ( par (x , z ) , par (y , z )) )

Figure 4.12: Phase 1/2 for normalizing interactions

( VAR x y z ) ( THEORY ( AC alt ) ( AC par ) ( A strict ) ( A seq )) ( RULES strict (x , o ) → x seq (x , o ) → x par (x , o ) → x strict (o , x ) → x seq (o , x ) → x par (o , x ) → x loopS ( o ) → o loopH ( o ) → o loopW ( o ) → o loopP ( o ) → o loopS ( loopS ( x )) → loopS ( x ) loopS ( loopH ( x )) → loopH ( x ) loopS ( loopW ( x )) → loopW ( x ) loopS ( loopP ( x )) → loopP ( x ) loopH ( loopS ( x )) → loopH ( x ) loopH ( loopH ( x )) → loopH ( x ) loopH ( loopW ( x )) → loopW ( x ) loopH ( loopP ( x )) → loopP ( x ) loopW ( loopS ( x )) → loopW ( x ) loopW ( loopH ( x )) → loopW ( x ) loopW ( loopW ( x )) → loopW ( x ) loopW ( loopP ( x )) → loopP ( x ) loopP ( loopS ( x )) → loopP ( x ) loopP ( loopH ( x )) → loopP ( x ) loopP ( loopW ( x )) → loopP ( x ) loopP ( loopP ( x )) → loopP ( x )
alt (x , strict (x , y )) → strict (x , alt (o , y )) alt ( strict (x , y ) , strict (x , z )) → strict (x , alt (y , z )) alt ( strict (x , y ) , y )

→ strict ( alt (x , o ) , y ) alt ( strict (x , z ) , strict (y , z )) → strict ( alt (x , y ) , z ) alt (x , seq (x , y ))

→ seq (x , alt (o , y )) alt ( seq (x , y ) , seq (x , z )) → seq (x , alt (y , z )) alt ( seq (x , y ) , y )

→ seq ( alt (x , o ) , y ) alt ( seq (x , z ) , seq (y , z )) → seq ( alt (x , y ) , z ) alt (x , par (x , y ))

→ par (x , alt (o , y )) alt ( par (x , y ) , par (x , z )) → par (x , alt (y , z )) alt ( par (x , y ) , y )

→ par ( alt (x , o ) , y ) alt ( par (x , z ) , par (y , z )) → par ( alt (x , y ) , z ) )

A total rewrite ordering on interactions

As mentioned previously, in order to be able to compute normal forms of interactions (as uniquely defined terms), we need to specify a total rewrite ordering on ground interaction terms. The purpose of this section is to define this order.

To do so, let us at first define a total order on the set of atomic actions A Ω . We define such an order ≺ A in Def.4.17.

Definition 4.17: A total order on actions

Given a signature Ω = (L, M ), let us consider the total orders ≺ L and ≺ M on the (finite) sets of lifelines L and messages M . Let us also denote by ≺ ∆ the total order on {!, ?} such that ! ≺ ∆ ?.

We can then define a total order ≺ A on the set of actions A Ω such that for any two actions

a 1 = l 1 ∆ 1 m 1 and a 2 = l 2 ∆ 2 m 2 with l 1 , l 2 ∈ L, ∆ 1 , ∆ 2 ∈ {!, ?} and m 1 , m 2 ∈ M we have a 1 ≺ A a 2 iff: • either l 1 ≺ L l 2 • or l 1 = l 2 and ∆ 1 ≺ ∆ ∆ 2 • or l 1 = l 2 and ∆ 1 = ∆ 2 and m 1 ≺ M m 2
We then define in Def.4.18 the total orders ≺ F0 , ≺ F1 and ≺ F2 on the symbols of our Interaction Language.

Definition 4.18: Total orders on operation symbols

Given F 0 = {∅} ∪ A Ω , we define the total order ≺ F0 such that:

≺ F0 =≺ A ∪{(∅, a) | a ∈ A Ω }
Given F 1 = {strict, seq, par, alt}, we define the total order ≺ F1 such that:

par ≺ F1 seq ≺ F1 strict ≺ F1 alt
Given F 2 = {loop S , loop H , loop W , loop P }, we define the total order ≺ F2 such that:

loop P ≺ F2 loop W ≺ F2 loop H ≺ F2 loop S
This finally allow us to define the total order ≺ I on interaction terms in Def.4.19.

Definition 4.19: A total order on ground interaction terms

We can then define a total order ≺ I on I Ω s.t. for any two interactions i α and i β we have i α ≺ I i β iff:

• i α ( ) ∈ F kα and i β ( ) ∈ F k β with k α < k β i.e. at the root node we have operation symbols f α and f β s.t. the arity of f α is smaller than that of f β • or the root nodes are symbols of the same arity k and then i α ≺ I i β iff:

-either i α ≺ F k i β -or f α and f β are the same symbol f of arity n and, given i α = f (i α|1 , • • • , i α|n ) and i β = f (i β|1 , • • • , i β|n ), we have that ∃j ∈ [1, n] s.t. ∀j < j, i α|j = i β|j and i α|j ≺ I i β|j
The total order on interaction terms defined in Def.4.19 is a rewrite ordering as per Lem.4.31.

Lemma 4.31: ≺ I is a total rewrite ordering on I Ω

We have that ≺ I is a total rewrite ordering on I Ω Proof. ≺ I is antireflexive, transitive, antisymmetric, F-compatible and stable under substitution.

We can then define the normal form of any interaction term i as the unique interaction R(i) which is irreducible by the Ordered Rewriting System (ORS) → T I and such that for any i ∈ R 2 (R 1 (i)) we have i * → T I R(i) i.e. R ≺ (i ) = i. We may then abusively use the notation

R(i) = R ≺ (R 2 (R 1 (i))).

Implementation & examples

We have implemented the process to normalize interaction terms using the previously defined mechanisms of ordered rewriting and class rewriting. In this section we illustrate the application of this process on some examples. In particular, we demonstrate the successful automation of the initially human-guided simplification of interaction terms which we have presented on Fig. 4.10 and Fig. 4.11.

On Fig. 4.14 we illustrate the application of the normalisation process on two examples. We can note that the example on the left corresponds to that of Fig. 4.11.

The initial interaction term i is represented at the top in each case. Then, successive applications of some atomic transformations, indicated by arrows, transform this initial term from top to bottom. The first phase of the process is illustrated in the area that is colored in blue. The term at the bottom of the area in blue (in each case) is the normal form R ≺ (R 1 (i)) of the initial interaction i. This term is then passed on to the second phase, which application is represented in the area in green. Finally, the term at the bottom is

the normal form R(i) = R ≺ (R 2 (R 1 (i))).
On Fig. 4.15 we provide two more examples. We can remark that the one on the left is that from The process displayed on Fig. 4.14 and Fig. 4.15 is implemented in the HIBOU tool (those images are generated by HIBOU) which we present in Chap.12. It is possible to explore all paths from the initial interaction to its normal form (as on Fig. 4.15) or only one (as on Fig. 4.14). Given that the finite rewrite systems have been proven convergent, there is a finite number of such paths and all paths are finite and lead to the same end result.

Conclusion

In this chapter we have defined our Interaction Language (IL). This language takes the form of an algebra of terms that are build inductively from atomic actions which specify the occurrence of communication events and constructors which organize and schedule the occurrences of those events w.r.t. one another.

Constructors of our IL allow the specification of strict sequencing so as to strictly order the occurrence of events, weak sequencing so as to order events occurring on the same sub-systems, interleaving so as to allow events to occur in any order, choice between the occurrence of events as well as four different kinds of repetitions. This algebra of terms can be associated to an algebra of sets of traces. A set of traces corresponds to a set of behaviors that may be expressed. Each interaction term can be associated to a correspond (possibly infinite) set of traces which constitutes its semantics. We can then characterize interaction terms which are syntaxically distinct but have the same semantics as members of a common class of equivalence. A specific and unique member of each such class, called the normal form can then be defined and computed using term rewriting.

In the next chapter we define another semantics of interactions in the style of operational semantics that can be found in the field of process calculus.

In this chapter we define another semantics for our Interaction Language (IL). This new semantics, that we denote by σ o is a small-step operational-style in contrast to σ d which can be described as being denotational-style. This new semantics is presented in the fashion of structural operational semantics that can be found in the field of process calculus.

The plan of this chapter is as follows:

• in Sec.5.1, we introduce our small-step operational semantics σ o ,

• in Sec.5.2 we prove (with the support of a Coq proof in [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF]) that both semantics are equivalent i.e that for any interaction i, the sets of traces σ d (i) and σ o (i) obtained using both methods are equal.

Let us remark that the content of this chapter, formalization and proof have been encoded in Coq in [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF].

Results related to this chapter can be found in [START_REF] Mahe | A structural operational semantics for interactions with a look at loops[END_REF].

Definition of the Operational Semantics

The small-step operational semantics σ o consists in reconstructing accepted traces of an original interaction i 0 via the dynamic execution of i 0 . Fig. 5.1 illustrates this principle. It describes the construction of a trace t = a 1 . • • • .a n that belongs to the semantics σ o (i 0 ) of the interaction i 0 . This trace can be obtained (as all traces of the semantics) by the concatenation of individual actions a k that can succeed each-other during the execution of the initial interaction term i 0 .

Syntax Semantics

I Ω T Ω i 0 i 1 i n σ o (i 0 ) a 1 a n Figure 5
.1: Principles of small-step operational semantics applied to interactions

The process described on Fig. 5.1 to reconstruct this trace can be explained as follows:

• At first, action a 1 can be immediately executed in i 0 . Doing so leads to a "follow-up" interaction i 1 which semantics is that of all traces of σ o (i 0 ) which start with the specific action a 1 (that exists at a given position within the term structure of interaction i 0 ). We note this i 0 a1 -→ i 1 .

• In the same manner, there is a certain action a 2 that can be executed in i 1 , which leads to another interaction i 2 (noted i 1

a2

-→ i 2 ) and so on.

• As a result, we obtain a path i 0 a1 -→ • • • an --→ i n such that i n can express the empty trace (which can be asserted statically).

• Since i n expresses the empty trace , this guarantees that the trace t = a 1 . • • • .a n (in dark red on Fig. 5.1) obtained by concatenation is an accepted trace of the initial interaction i 0 . Of course there may exist many such paths, each corresponding to an accepted trace. The overall semantics of the original interaction i 0 is then the set regrouping all of those traces (the area in light red in Fig. 5.1).

With the operational semantics, instead of considering all the traces that an interaction may express as a set, we rewrite the interaction on demand, so as to express certain actions. In particular, we may unfold a given loop on demand, when executing an action that is found within its sub-interaction. This formulation of the semantics is much more practical for later use in multi-trace analysis, as we will see in the second part of the thesis, beginning with Chap.8. • Some basic transitions are simply admitted to be true (like axioms in a theory). Those basic transitions corresponds to the executions of interactions that simply consists in individual actions a ∈ A Ω . The single action that forms the interaction can of course be immediately executed; and only the empty interaction ∅ "remains" to be executed i.e. we have a a -→ ∅. This base case is represented in the top right cell of Fig. 5.2.

• Any other (more complex) transition i a -→ i must be proved to be true using this base case and a set of rules that deals with constructors (strict, seq, par, alt, etc.) in an inductive manner. Those rules take the general form that is represented in the bottom right cell of Fig. 5.2. If a certain transition i a -→ i is valid (as well as some optional additional conditions on expressed by "φ" on Fig. 5.2), then a more complex transition c(i) a -→ c (i ) is valid; where c is a syntactic context in which we find i (for instance within strict(i, i 2 ), c = strict(_, i 2 ) is the syntactic context that applies on i) and c is the new syntactic context in which we include i so as to form the follow-up interaction c (i ) after the execution of a in c(i).

Executing atomic actions

As we have seen earlier, the execution of atomic actions constitutes the base case for the operational semantics. The corresponding rule is the following:

For any action a ∈ A Ω : a a -→ ∅ Fig. 5.3 illustrates the base rule (which enables the execution of interactions that consists in single actions) and its application on an emission (example 1, on the left) and a reception (example 2, on the right).

Example 1

Example 2 on term

l 1 !m l 1 !m --→ ∅ l 2 ?m l 2 ?m --→ ∅ on diagram l 1 !m --→ l 2 ?m --→

Executing actions on the left of strict and seq constructors

In the graphical representation of sequence diagrams, the top to bottom direction corresponds, by default, to the passing of time. Actions that are drawn below some other actions occur after them. In the term structure of a corresponding interaction, this top-to-bottom direction corresponds to a left-to-right relationship. Indeed, within the tree-structure of an interaction, actions are found on leaf nodes, and an action a 1 that is drawn above some other action a 2 in the sequence diagram correspond to a leaf node that is on the left of that of a 2 . By "the left" it is meant that a 1 is a left cousin of a 2 w.r.t. some common ancestor which is a binary constructor.

This remark is meant for the default interpretation of the top-to-bottom direction i.e. w.r.t. the weak sequencing "seq" constructor. However it also holds for the strict sequencing "strict" constructor. Actions found on the left of a strict must occur before those found on its right.

Also, whenever an action a is executable within the left sub-interaction i 1 of an interaction i = f (i 1 , i 2 )

with f ∈ {strict, seq}, then it is also executable within i. As a result, we have the following two rules:

For any action a ∈ A Ω :

i 1 a -→ i 1 strict(i 1 , i 2 ) a -→ strict(i 1 , i 2 ) and i 1 a -→ i 1 seq(i 1 , i 2 ) a -→ seq(i 1 , i 2 )
Fig. 5.4 illustrates this in the case of the strict operator. As explained earlier, the strict operator can be used to express the passing of a message m from a lifeline l 1 to another lifeline l 2 , via strict(l 1 !m, l 2 ?m), which is the example used in Fig. 5.4. Given that the execution of the emission l 1 !m, when considered to be an interaction in its own right, is possible, that of l 1 !m within strict(l 1 !m, l 2 ?m) is authorized (by induction).

In this context, the execution of l 1 !m leads to strict(∅, l 2 ?m), as illustrated on Fig. 5.4.

on term

l 1 !m l 1 !m --→ ∅ strict l 1 !m l 2 ?m l 1 !m --→ strict ∅ l 2 ?m on diagram l 1 !m --→ l 1 !m --→

Executing actions on either side of a par constructor

The par constructor specifies a concurrent execution of two distinct behaviors, each modelled by a subinteraction. Those executions being done in parallel, there is no difference in how they should be treated.

As a result, there is a symmetry between the rule that specifies the execution of actions on the left of a par operator, and the rule that specifies the execution of actions on its right.

Given an interaction i = par(i 1 , i 2 ), if an action a is executable in any of the two sub-interactions, then it is executable in i. As a result, we have the following two rules:

For any action a ∈ A Ω :

i 1 a -→ i 1 par(i 1 , i 2 ) a -→ par(i 1 , i 2 ) and i 2 a -→ i 2 par(i 1 , i 2 ) a -→ par(i 1 , i 2 )
Fig. 5.6 illustrates the application of the second rule, which is that of executing an action on the right of a par constructor, using a simple example. In the example from Fig. 5.6, the interaction models a parallel composition of two behaviors:

on term strict l 1 !m 2 l 2 ?m 2 l 1 !m 2 ---→ strict ∅ l 2 ?m 2 par strict l 1 !m 1 l 2 ?m 1 strict l 1 !m 2 l 2 ?m 2 l 1 !m 2 ---→ par strict l 1 !m 1 l 2 ?m 1 strict ∅ l 2 ?m 2 on diagram l 1 !m 2 ---→ l 1 !m 2 ---→
• a behavior describing the passing of a message m 1 from lifeline l 1 to lifeline l 2

• and another which describes the passing of another message m 2 from lifeline l 1 to lifeline l 2

In the second behavior (at the right in the term and on the bottom in the diagram), which execution is illustrated on Fig. 5.6, m 2 can be emitted by l 1 so that only its reception l 2 ?m 2 by l 2 remains to be executed. The "right" rule for the par constructor can therefore be applied (which is shown on Fig. In the first behavior (at the left in the term and at the top in the diagram), m 1 can be emitted by l 1 so that only its reception l 2 ?m 1 by l 2 remains to be executed. Here, the "left" rule for the par operator could be applied, which would likewise imply that l 1 !m 1 can be executed and that what remains to be executed would be the parallelization of the original right sub-interaction on the right, and of l 2 ?m 1 on the left.

Executing actions on either side of a alt constructor

The alt constructor specifies an exclusive non-deterministic alternative between two sub-behaviors, each modelled by a sub-interaction. Similarly to the par constructor, the alt treats both its sub-interactions in the same "symmetric" manner. Given an interaction i = alt(i 1 , i 2 ), if an action a is executable in any of the sub-interactions, then it is executable in i.

Executing an action from one of the two sub-interaction means that it has been selected, at the expense of the other. The other sub-interaction can therefore be eliminated, and the choice to take it removed from the interaction term. This means that whenever an action is executed underneath an alt constructor, this alt constructor is eliminated in the follow-up interaction.

Concretely, executing actions underneath a alt constructor is formalized by the following two rules:

For any action a ∈ A Ω :

i 1 a -→ i 1 alt(i 1 , i 2 ) a -→ i 1 and i 2 a -→ i 2 alt(i 1 , i 2 ) a -→ i 2
Fig. 5.7 illustrates the application of the second rule, which is that of executing an action on the right of a alt constructor, using a simple example. We do not provide another example for the left side given that it is similar. In the example from Fig. 5.7, the interaction models a choice between of two behaviors:

on term strict l 1 !m 2 l 2 ?m 2 l 1 !m 2 ---→ strict ∅ l 2 ?m 2 alt strict l 1 !m 1 l 2 ?m 1 strict l 1 !m 2 l 2 ?m 2 l 1 !m 2 ---→ strict ∅ l 2 ?m 2 on diagram l 1 !m 2 ---→ l 1 !m 2 ---→
• a behavior describing the passing of a message m 1 from lifeline l 1 to lifeline l 2

• and another which describes the passing of another message m 2 from lifeline l 1 to lifeline l 2

In the second behavior (at the right in the term and on the bottom in the diagram), which execution is illustrated on Fig. 5.7, m 2 can be emitted by l 1 so that only its reception l 2 ?m 2 by l 2 remains to be executed.

The "right" rule for the alt constructor can therefore be applied (which is shown on Fig. 5.7). It implies that l 1 !m 2 can be executed and that what remains to be executed is simply l 2 ?m 2 (which remains to be executed w.r.t. the right sub-behavior, that has been selected at the expense of the other).

In the first behavior (at the left in the term and at the top in the diagram), m 1 can be emitted by l 1 so that only its reception l 2 ?m 1 by l 2 remains to be executed. Here, the "left" rule for the alt operator could be applied, which would likewise imply that l 1 !m 1 can be executed and that what remains to be executed would be l 2 ?m 1 .

Termination predicate

The next rule that we are going to introduce is that for executing actions on the right of strict constructors.

However before doing so, we need to introduce an intermediary notion which is that of the termination of an interaction.

Termination

If an interaction can express the empty trace then it means that it can immediately terminate i.e. that it is able to not express anything anymore. The problem of whether or not an interaction i can immediately terminate can be answered systematically via the analysis of the term structure of i.

We provide a solution in the form of the termination predicate "↓" given on Def.5.1. The formulation of that predicate is inspired from process algebras as in [START_REF] Mauw | High-level message sequence charts[END_REF][START_REF] Mauw | Operational semantics for msc[END_REF], which we reviewed in Chap.2. For any interaction i, i ↓ signifies that i can terminate immediately.

Let us remark that the fact that the termination predicate indeed characterizes the ability to express the empty trace i.e. that for any interaction i we have (i ↓) ⇔ ( ∈ σ d (i)) will be proven in Lem.5.4 of the following section (Sec.5.2).

Let us also remark that, in our previous publication [START_REF] Mahe | Revisiting semantics of interactions for trace validity analysis[END_REF] we have used a exp function instead of the ↓ predicate. For any interaction i, exp (i) returns whether or not i can express the empty trace . We used the verb "express" in the name exp so as not to risk confusion between this simple static function and a fully-fledged semantics, for which we rather use the verb "accept". With the ↓ notation, the concept that is evoked is that of an immediate termination of the process. For any interaction i, i ↓ means that i may terminate immediately without the observation of any further actions. Those two concepts are therefore equivalent.

In any case, the ↓ predicate can be inferred inductively from the term structure of interactions:

• naturally the empty interaction ∅ only accepts , and can only terminate. As a result, we have ∅ ↓

• any loop accepts because it is possible to repeat zero times its content. Therefore, for any i ∈ I Ω , and any k ∈ {S, H, W, P } we have loop k (i) ↓

• for interactions of the form alt(i 1 , i 2 ), if either i 1 or i 2 terminates then alt(i 1 , i 2 ) terminates

• for interactions of the form f (i 1 , i 2 ) with f being a scheduling constructor (strict, seq, par) it is required that both i 1 and i 2 terminate for f (i 1 , i 2 ) to terminate

Definition 5.1: Termination "↓" predicate

We define inductively the predicate ↓⊂ I Ω such that for any two interactions i 1 and i 2 from I Ω , for any f ∈ {strict, seq, par} and for any k ∈ {S, H, W, P } we have:

∅ ↓ i 1 ↓ alt(i 1 , i 2 ) ↓ i 2 ↓ alt(i 1 , i 2 ) ↓ i 1 ↓ i 2 ↓ f (i 1 , i 2 ) ↓ loop k (i 1 ) ↓

Non-Termination

Similarly, we can define (Def.5.2) a "non-termination" predicate ↓ from a static analysis of the structure of interactions:

• an interaction that consists of a single action a ∈ A Ω do not express (a must be executed) and cannot terminate. As a result we have a ↓

• for interactions of the form alt(i 1 , i 2 ), if both i 1 ↓ and i 2 ↓ then we have alt(i 1 , i 2 ) ↓

• for interactions of the form f (i 1 , i 2 ) with f ∈ {strict, seq, par} (scheduling constructors), it suffices

that either i 1 ↓ or i 2 ↓ in order to have f (i 1 , i 2 ) ↓

Definition 5.2: Non-Termination " ↓" predicate

We define inductively the predicate ↓⊂ I Ω such that for any action a ∈ A Ω , for any two interactions i 1 and i 2 from I Ω and for any f ∈ {strict, seq, par} we have:

a ↓ i 1 ↓ i 2 ↓ alt(i 1 , i 2 ) ↓ i 1 ↓ f (i 1 , i 2 ) ↓ i 2 ↓ f (i 1 , i 2 ) ↓
The termination and non-termination predicates are negations of one another, and, for any interaction term i, one can always decide whether i ↓ or i ↓.

Lemma 5.1: Termination & non-termination

We have that for any interaction i ∈ I Ω :

(i ↓) ∨ (i ↓) and (i ↓) ⇔ ¬(i ↓)
Proof. Immediate by induction on the term structure of interactions. In this illustration, we represent the application of the termination predicate ↓ on the syntaxic structure of the term using two symbols: and . For any node at position p in the tree structure, if it is decorated with then it means that i |p ↓ and if it is decorated with then it means that i |p ↓. In order to decorate all the nodes of the tree we can proceed as follows:

Illustrating example

Let

• as a first step, we can immediately decorate the leaf nodes:

if a leaf node contains the empty interaction ∅ then we decorate it with if a leaf node contains an action a ∈ I Ω then we decorate it with

• then, the decoration of parent nodes is inferred by their natures (the operation symbol they carry) and by the decoration of child nodes:

for nodes containing strict, seq or par, we decorate them with if both children are decorated with and, otherwise, we decorate them with for nodes containing alt, we decorate them with if any one child is decorated with and, otherwise, we decorate them with we always decorate loop nodes with

On the example from Fig. 5.8, given that the root node is decorated by we can conclude that the interaction terminates. Indeed, we can choose the right branch of the alternative and choose not to instantiate the loop which results in expressing the empty trace.

On the left of Fig. 5.8 we have roughly illustrated the counterpart of this process on the sequence diagram representation.

Executing actions on the right of strict operators

We have seen earlier how actions on the left of a strict operator might be executed. Given the nature of the strict operator we might at first glance imagine that it is not possible to execute actions on the right of strict but there are situations in which it is actually possible. For instance, we have the trivial strict(∅, a), with a ∈ A Ω a certain action that is immediately executable so that strict(∅, a) a -→ ∅.

In fact, an action on the right of a strict in a certain strict(i 1 , i 2 ) and such that i 2 a -→ i 2 can be executed if the sub-interaction i 1 (that on the left) can express the empty trace . Indeed, if it is the case, then nothing prevents action a to be at the first position in a trace expressed by strict(i 1 , i 2 ). We can see that this notion of "expressing the empty trace" corresponds to the termination predicate ↓ that we have previously defined.

Given i = strict(i 1 , i 2 ), if a can be executed in i 2 and if i 1 ↓, then a can be executed in i and the follow-up interaction is i 2 , which is the follow-up from the execution of a within i 2 . Indeed, the execution of a within i in that configuration forces the choice, for i 1 to express the empty trace. As a result, in the next step of the execution, nothing remains to be executed in i 1 and therefore i 1 can be eliminated. Given that i 1 can express the empty trace, this elimination of i 1 does not violate its semantics.

As a result, the definition of the termination predicate ↓ allows us to define the rule for executing actions on the right of strict constructors. This rule is formalized as follows:

For any action a ∈ A Ω : where one branch holds the empty interaction ∅. As a result, this left sub-interaction terminates. Given that the left sub-interaction i 1 verifies i 1 ↓ and that an action (here l 1 !m 2 ) can be executed on the right sub-interaction i 2 , then, as per the previous rule, this action can be executed in strict(i 1 , i 2 ), as shown on Fig. 5.9. The application of the rule leads to the elimination of i 1 and only remains i 2 which results from the execution of the action in the right sub-interaction i 2 . In "Example 1" from Fig. 5.9, this yields l 2 ?m 2 .

i 2 a -→ i 2 i 1 ↓ strict(i 1 , i 2 ) a -→ i 2
l 1 !m 2 ---→ strict ∅ l 2 ?m 2 strict alt strict l 1 !m 1 l 2 ?m 1 ∅ strict l 1 !m 2 l 2 ?m 2 l 1 !m 2 ---→ strict ∅ l 2 ?m 2 strict l 1 !m 2 l 2 ?m 2 l 1 !m 2 ---→ strict ∅ l 2 ?m 2 strict loop H strict l 1 !m 1 l 2 ?m 1 strict l 1 !m 2 l 2 ?m 2 l 1 !m 2 ---→ strict ∅ l 2 ?m 2 on diagram l 1 !m 2 ---→ l 1 !m 2 ---→ l 1 !m 2 ---→ l 1 !m 2 ---→
The second example from Fig. 5.9 can be understood similarly, except that here, the sub-interaction on the left of the strict, which is loop H (strict(l 1 !m 1 , l 2 ?m 1 )) is a loop H instead of an alt. Likewise, it can express the empty trace, but the choice that allows it to do so is not a choice of an alternative branch, but that of not instantiating the loop H .

Evasion & Collision predicates

Let us now introduce the three following notions:

• that, for an interaction, to "evade" a lifeline,

• that, for an interaction, to "collide" with a lifeline

• and that, for an interaction, to be pruned w.r.t. a lifeline (which we will address in Sec.5.1.8)

Evasion

For any interaction i ∈ I Ω , its termination i ↓ states that it is able to express the empty trace. "Evasion" is a similar, although weaker, notion than "Termination" that can be described as a form of local termination.

For any interaction i, and for any lifeline l, we say that i evades l, which is denoted by the predicate i ↓ × × l, if i is able to express at least one trace that does not contain any action occurring on lifeline l. In other words, i ↓ × × l iff there exists a trace t expressed by i such that ¬(t × × l) (with the notation from Sec.4.1)

i.e. such that t does not have any conflict w.r.t. l (this is proven in Lem.5.5 of Sec.5.2).

Like "termination", "evasion" i.e. the fact that an interaction can (or cannot) express traces that do not involve a specific lifeline can be inferred statically (similarly to ↓) from the term structure of interactions.

We indeed define "↓ × × " in Def.5.3 as an inductive predicate s.t.:

• the empty interaction ∅ "evades" every lifeline i.e.∀ l ∈ L we have ∅ ↓ × × l

• for an interaction that is reduced to a single action a ∈ A Ω , a evades a lifeline l iff it occurs on a different lifeline i.e. we have θ(a) = l

• similarly to termination, any loop may evade any lifeline because it is always possible to express the empty trace, which does not have conflicts w.r.t. l

• for binary constructors the definition of ↓ × × is similar to that of ↓. For alt is it sufficient that one of the two direct sub-interactions evades a lifeline for the parent to evade it. For the scheduling constructors (seq, strict, par), both have to evade the lifeline.

Definition 5.3: Evasion "↓ × × " predicate

We define the predicate ↓ × × ⊂ I Ω × L such that for any lifeline l ∈ L, for any action a ∈ A Ω , for any two interactions i 1 and i 2 from I Ω , for any f ∈ {strict, seq, par} and for any k ∈ {S, H, W, P } we have:

∅ ↓ × × l θ(a) = l a ↓ × × l i 1 ↓ × × l alt(i 1 , i 2 ) ↓ × × l i 2 ↓ × × l alt(i 1 , i 2 ) ↓ × × l i 1 ↓ × × l i 2 ↓ × × l f (i 1 , i 2 ) ↓ × × l loop k (i 1 ) ↓ × × l
As a side note, about the proximity of ↓ and ↓ × × , let us remark that:

• on the one hand, for any interaction i ∈ I Ω , if we have i ↓ then this implies that ∀ l ∈ L, we have i ↓ × × l. Indeed, if an interaction can express the empty trace then it is able to express a trace with no conflict w.r.t. every lifeline.

• on the other hand, the opposite implication is false: if we suppose that for ∀ l ∈ L we have i ↓ × × l, we do not necessarily have i ↓. It suffices to consider the following example:

i = alt(l 1 !m, l 2 !m) with L = {l 1 , l 2 }.
Here we have i ↓ × × l 1 because we can take the right branch of the alt, and ↓ × × l 2 because we can take the left branch of the alt. However we do not have i ↓ because i must express either l 1 !m or l 2 !m.

Collision

For any interaction i, and for any lifeline l, we say that i collides with l, which is denoted by the predicate i ↓ × × l, if all the traces expressed by i have conflicts w.r.t. l i.e. contain actions occurring on lifeline l.

Like "termination" and "evasion", "collision" can be inferred statically from the term structure of interactions. We indeed define " ↓ × × " in Def.5.4 as an inductive predicate:

• for interactions that consist in a single action a ∈ A Ω , a collides with a lifeline l iff it occurs on l i.e.

we have θ(a) = l

• for interactions of the form alt(i 1 , i 2 ) if both i 1 and i 2 collide with l then i also collides with l

• for interactions of the form f (i 1 , i 2 ) with f ∈ {strict, seq, par} (scheduling constructor), it suffices that either i 1 or i 2 collides with l for i to collide with l Definition 5.4: Collision " ↓ × × " predicate

We define the predicate ↓ × × ⊂ I Ω × L such that for any lifeline l ∈ L, for any action a ∈ A Ω , for any two interactions i 1 and i 2 from I Ω and for any f ∈ {strict, seq, par} we have: The evasion and collision predicates are negations of one another (bivalence), and, for any interaction term i and lifeline l, one can always decide whether i evades or collides with l (decidability). Those properties are stated in Lem.5.2.

θ(a) = l a ↓ × × l i 1 ↓ × × l i 2 ↓ × × l alt(i 1 , i 2 ) ↓ × × l i 1 ↓ × × l f (i 1 , i 2 ) ↓ × × l i 2 ↓ × × l f (i 1 , i 2 ) ↓ × × l alt strict l 1 !m 1 l 2 ?m 1 seq strict l 3 !m 2 l 1 ?m 2 loop S strict l 1 !m 3 l 2 ?m 3

Lemma 5.2: Decidability & bivalence of the evasion & collision predicates

We have that for any interaction i ∈ I Ω and any lifeline l ∈ L:

(i ↓ × × l) ∨ (i ↓ × × l) and (i ↓ × × l) ⇔ ¬(i ↓ × × l)
Proof. Immediate by induction on the term structure of interactions.

Illustrating example

Let us consider the example from Fig. 5.10. On the right of Fig. 5.10 is represented the syntaxic structure of an interaction i, and, on the left of Fig. 5.10 the corresponding drawing as a sequence diagram. In a similar

fashion as what we did on the illustrating example for the termination predicate (Fig. 5.8), we have here illustrated the application of the evasion predicate (w.r.t. lifeline l 2 ) on the term structure via the use of and symbols. Let us recall that, for any node at position p in the tree structure, if it is decorated with then it means that i |p ↓ × × l and if it is decorated with then it means that i |p ↓ × × l. In order to decorate all the nodes of the tree we can proceed as follows:

• as a first step, we can immediately decorate the leaf nodes (which are either actions or ∅) with the and symbols

• then, the decoration of parent nodes is inferred by their natures (the operation symbol they carry) and by the decoration of child nodes On the left of Fig. 5.10 we can illustrate the application of the evasion predicate by drawing a line over that of the lifeline of interest, which is l 2 in this example. This line can be decomposed into several segments that correspond to specific areas of the diagram (operands) and that are colored either in green or in red.

The coloration of the segment depends on whether or not the sub-interaction corresponding to the operand evades or collides with the lifeline of interest. If the first and last segments are colored in green then it means that the diagram evades the lifeline of interest.

In the particular example represented on Fig. 5.10, we can see that by taking the right branch of the alternative and by choosing not to instantiate the loop, we can express traces that have no conflict w.r.t. lifeline l 2 . As a result the interaction i verifies i ↓ × × l 2 .

The pruning of interactions

Pruning is a process by which an interaction i that can evade a lifeline l (i.e. such that i ↓ × × l) is rewritten into a new interaction which characterizes exactly all the executions of i that do not involve lifeline l. In other words, the pruning process removes from the input interaction i all the behaviors (and only those behaviors)

that may enter into conflict with the input lifeline l. We denote by i × × l -→ i the fact that the pruning process applied to interaction i w.r.t. lifeline l returns interaction i .

Definition

To formalize the notion of pruning we define i × × l -→ i as an inductive relation in Def.5.5. Then, in Lem.5.3, we prove, for any interaction i such that i ↓ × × l, the existence and unicity of the "pruned" interaction i such

that i × × l - → i .
Let us remark that the fact that the pruning process applied to i and l indeed returns an interaction i which characterizes exactly all the executions of i that do not involve lifeline l i.e. that we have σ d (i ) = {t ∈ σ d (i) | ¬(t × × l)} will be proven in Lem.5.6 of the following section (Sec.5.2).

Definition 5.5: Pruning relation " × × -→"

We define the pruning relation × × -→⊂ I Ω × L × I Ω such that for any lifeline l ∈ L, for any f ∈ {strict, seq, par} and for any k ∈ {S, H, W, P }:

∅ × × l - → ∅ θ(a) = l a × × l - → a i 1 × × l - → i 1 i 2 × × l - → i 2 f (i 1 , i 2 ) × × l - → f (i 1 , i 2 ) i 1 × × l - → i 1 i 2 × × l - → i 2 alt(i 1 , i 2 ) × × l - → alt(i 1 , i 2 ) i 1 × × l - → i 1 i 2 ↓ × × l alt(i 1 , i 2 ) × × l - → i 1 i 2 × × l - → i 2 i 1 ↓ × × l alt(i 1 , i 2 ) × × l - → i 2 i 1 × × l - → i 1 loop k (i 1 ) × × l - → loop k (i 1 ) i 1 ↓ × × l loop k (i 1 ) × × l - → ∅

Properties

In the following we will state some properties of the inductive relation of Def.5.5. The pruning relation and the evasion predicate can be used to describe similar characteristics of interactions terms. Whenever an interaction evades a lifeline then it means that is can be pruned w.r.t. that lifeline. Reciprocally, whenever an interaction can be pruned w.r.t. a lifeline then it means that it evades that lifeline. Those observations as well as the unicity of pruning are given in Lem.5.3

Lemma 5.3: Conditional existence & unicity of pruned interaction

For any interaction i ∈ I Ω and for any lifeline l ∈ L we have:

(∃ i ∈ I Ω s.t. i × × l - → i ) ⇒ (i ↓ × × l) and (i ↓ × × l) ⇒ (∃! i ∈ I Ω s.t. i × × l - → i )
Proof. We can reason by induction on the term structure of interactions.

Description & illustrative examples

The pruning relation i × × l -→ i eliminates from a given interaction i (s.t. the precondition i ↓ × × l is satisfied) all actions occurring on lifeline l while preserving "a maxima" the original semantics of i i.e. so that

σ d (i ) ⊆ σ d (i)
and σ d (i ) is the maximum subset of σ d (i) that contains no trace in which there are actions occurring on l.

So as to preserve the semantics, the interaction term i can only be modified in two manners with the aim to eliminate actions:

1. by forcing the choice of a given sub-interaction in alt nodes (illustrated on Fig. 5.11)

2. by choosing to forbid the repetition of a sub-interaction in loop nodes (illustrated on Fig. 5.12)

Those two kinds of modifications strictly correspond to the elimination of some possible executions of i while preserving all others.

We describe in the following the mechanism of pruning formalised in Def.5.5. Let us consider a lifeline l.

We then have:

• ∅ × × l -→ ∅ because there is nothing to eliminate

• for any action a ∈ A Ω , a is prunable iff a ↓ × × l. Therefore, a is not an action that needs to be eliminated and a × × l -→ a

• for i = alt(i 1 , i 2 ), in order for the precondition i ↓ × × l to be satisfied, we have either or both of i 1 ↓ × × l or i 2 ↓ × × l. If both branches evade l they can be pruned and kept in the interaction term. If only a single one does, we only keep the pruned version of this single branch

• for any scheduling constructor f , if i = f (i 1 , i 2 ), in order to have i ↓ × × l we must have both i 1 ↓ × × l and

i 2 ↓ × × l.
In that case the unique interaction i such that i × × l -→ i is simply defined as the scheduling, using f , of the pruned versions of i 1 and i 2

• finally, for loops, i.e. with i of the form loop k (i 1 ) with k ∈ {S, H, W, P }, we distinguish two cases:

if i 1 ↓ × × l then any execution of i 1 will yield a trace containing actions occurring on l. Therefore it is necessary to forbid the repetition of the loop. This is done by specifying that loop k (i

1 ) × × l - → ∅ -if i 1 ↓
× × l then it is not necessary to forbid the repetition of the loop, given that sub-interaction i 1 can be pruned and therefore may not yield traces with actions occurring on l. This being the modification which preserves a maximum amount of traces of the semantics, we have, if

i 1 × × l - → i 1 then loop k (i 1 ) × × l - → loop k (i 1 )
The recursive nature of the prune relation then guarantees that only the minimally required modifications are done on the interaction term so as to eliminate from it undesired actions. (strict), it must also be eliminated. The grand-parent node is an alt operator. The right cousin underneath this alt is ∅, which evades l 3 . Therefore, we can force the choice of the right branch of this alt to solve the pruning. The remaining interaction then does not contain any action occurring on l 3 . As explained earlier, the pruning made the minimal modifications to i so as to eliminate l 3 ?m 2 . For instance, we could have simply (and naively) forbidden the repetition of the loop at the root position; but this would also have eliminated from the semantics of the remaining interaction a number of traces which we do not want to be eliminated.

Fig. 5.12 illustrates another specific application of the pruning process. We consider the same interaction i as in Fig. 5.11, However we consider the pruning w.r.t. lifeline l 1 instead of l 3 . The only action occurring on l 1 in i is l 1 !m 1 . It must be eliminated. Its parent and grand-parent being respectively a strict and a seq constructor, they must both be eliminated. Finally, a loop node is reached. At this point, the only choice is to forbid the repetition of this loop. We therefore replace it by the empty interaction ∅ (as indicated in blue) to obtain the interaction on the right. operator. Given an interaction seq(i

1 , i 2 ), if i 2 a -→ i 2 then it is possible to execute a from seq(i 1 , i 2 ) if a
certain condition is met on i 1 . However this condition is not as strong as what would be the case for a strict operator (i.e. we would require i 1 ↓).

Here we only need i 1 to be able to express a trace that do not contain any action occurring on lifeline θ(a) i.e. on the lifeline on which a occurs. Indeed, if this is the case then it means that it is possible to observe no action at all on lifeline θ(a) during an execution of i 1 . This therefore implies that it is possible, during an execution of seq(i 1 , i 2 ) that the first action that is observed on lifeline θ(a) comes from i 2 . The reader may have recognized that this condition is in fact i 1 ↓ × × θ(a), with the evasion predicate that we have defined in Sec.5.1.7.

In the case of strict, when executing an action on the right, we simply eliminate entirely the subinteraction on the left i.e. in strict(i 1 , i 2 ) a -→ i 2 we only keep i 2 and discard i 1 . However, for seq, we might need to keep i 1 or at least some reconstruction of i 1 on the left. This reconstruction of i 1 that is kept is, in fact, the result i 1 of the pruning process i 1 × × θ(a) --→ i 1 which we introduced in Sec.5.1.8. Keeping i 1 on the left ensures that the first action occurring on lifeline θ(a) can be a and that we will not contradict the order specified by the seq by having some other actions occurring on θ(a) being later executed from within the left sub-term. Indeed, i 1 do not contain any action occurring on θ(a). Moreover, keeping i 1 instead of simply getting rid of the left sub-term ensures that we preserve the expressive power of the model i.e. that we do not get an under-approximated model as a follow-up interaction.

As a result, the execution of actions on the right of seq constructors is formalized by the following rule:

For any action a ∈ A Ω :

i 1 × × θ(a) --→ i 1 i 2 a -→ i 2 seq(i 1 , i 2 ) a -→ seq(i 1 , i 2 )
Let us now consider the example from Fig. 5.13. Here, lifeline l 1 sends message m to lifeline l 3 and then (with weak sequentially seq) lifeline l 2 sends another message m to lifeline l 3 . Even though the emission of m by l 2 is within the right sub-interaction, it can happen immediately because the left subinteraction strict(l 1 !m, l 3 ?m) do not involve in any way lifeline l 2 , which can be determined via the predicate strict(l 1 !m, l 3 ?m) ↓ × × l 2 . On Fig. 5.13, we illustrated the use of the ↓ × × predicate in the same manner as we did in Sec.5.1.7. We can see, on the bottom row, in the overall interaction term, that the left sub-interaction evades the lifeline l 2 which hosts the action to execute l 2 !m. We can interpreted that as having no interruption between the top of the lifeline and the location on this lifeline of said action. Here we represented this with a bold green line. Indeed, we have no intermediate action that can interrupt the bold green line between the top of lifeline l 2 and l 2 !m. In this particular example, we did not need to rewrite the left sub-interaction strict(l 1 !m, l 3 ?m), and we used it unaltered so as to reconstruct the follow-up interaction seq(strict(l 1 !m, l 3 ?m), l 3 ?m). This corresponds to the fact that strict(l 1 !m, l 3 ?m) × × l2 -→ strict(l 1 !m, l 3 ?m).

However, as we will see in another example, there are cases where we need to do some actual rewriting of the left sub-interaction using the pruning process. interaction, we need to rewrite the left sub-interaction alt(strict(l 1 !m, l 2 ?m), l 1 ?m) so as to enforce the choice of the alternative that allows lifeline l 2 to be avoided. This is done by the pruning process, which effect on the interaction term is illustrated on Fig. 5.14 in blue. The problematic action in the term is l 2 ?m. If we were to let it be in the reconstructed interaction, we risk a contradiction in the semantics, with l 2 ?m being able to occur after l 2 !m (violating the intended semantics of the seq constructor). As a result, we need to eliminate l 2 ?m, which we illustrate with a blue cross on the node. Given that its parent is a strict constructor, it must also be eliminated (no choice can be made here), which we illustrate with another blue cross. In the grand-parent node, an alt constructor, a choice can be made to solve the contradiction / conflict caused by the action l 2 ?m. Here we can enforce the choice of the right branch of the alt by replacing the alt node by its right child, which is represented by the blue arrow. At this point we have finished rewriting the left sub-interaction under the root seq constructor. Finally we obtain the follow-up interaction seq(l 1 ?m, l 3 ?m). Let us consider i = loop S (i 1 ), with i 1 an interaction. Let us suppose the existence of an action a that can be executed in sub-interaction i 1 and let us suppose that its execution in i 1 yields i 1 as a follow-up interaction, Given that i models the repetition of i 1 , if a can be executed in i 1 then it can be executed in i too. However, once it is executed, this means that a full repetition of i 1 , which starts by a has to be executed.

This full repetition to complete corresponds to the execution of i 1 which remains to be done. As a result, the follow-up interaction to i is strict(i 1 , i). Indeed, we use strict to schedule this first repetition w.r.t. some other repetitions that may occur later-on. The initial interaction i = loop S (i 1 ) remains unaltered because it is the model for further repetitions.

Similarly to the case of the alt constructor, the execution of an action comes with forcing a choice, which is here that of repeating once (at least) the repeatable behavior. This choice can be understood as that of "instantiating" the loop i.e. creating an instance of the sub-behavior that is repeated. It is then the execution of this instance (here i 1 ) that corresponds to the occurrence of the repeated behavior. And it is this instance that is scheduled w.r.t. the original loop (which can be later repeated and therefore must not be altered) using (in this case) the strict scheduling constructor.

The execution of actions underneath loop S constructors therefore correspond to the following rule:

For any action a ∈ A Ω :

i 1 a -→ i 1 loop S (i 1 ) a -→ strict(i 1 , loop S (i 1 ))
Let us remark that executing actions within loops, and therefore instanciating those loops, generally complexifies the interaction term. Indeed, instantiating a loop might add new nodes and new actions to the interaction term. This offers a contrast with the execution of actions in any other case, which rather simplifies the interaction term by removing actions.

on term In this behavior, m can be emitted by l 1 so that only its reception l 2 ?m by l 2 remains to be executed.

strict l 1 !m l 2 ?m l 1 !m --→ strict ∅ l 2 ?m loop S strict l 1 !m l 2 ?m l 1 !m --→ strict strict ∅ l 2 ?m loop S strict l 1 !m l 2 ?m on diagram l 1 !m --→ l 1 !m --→
The rule for the loop S constructor can therefore be applied (which is shown on Fig. 5.15). It implies that l 1 !m can be executed and that what remains to be executed is the strict sequencing of l 2 ?m, which is what remains to be executed of the instantiated behavior and the original interaction i.

Executing actions underneath a loop P constructor

Executing actions underneath loop P constructors works in a similar fashion except that instead of scheduling the remaining behavior w.r.t. the loop using strict, we rather use par. This therefore correspond to the following rule:

For any action a ∈ A Ω :

i 1 a -→ i 1 loop P (i 1 )
a -→ par(i 1 , loop P (i 1 )) Fig. 5.16 illustrates, on a simple example, the application of the rule. We have here the sub-behavior Action l 1 !m can be immediately executed and there remains to be executed par(l 2 ?m, loop P (strict(l 1 !m, l 2 ?m))).

i 1 = strict(l 1 !m, l 2 ?m) that
In the previous example, in which there remained strict(l 2 ?m, loop P (strict(l 1 !m, l 2 ?m))) to be executed we could not once again immediately execute l 1 !m. With this kind of loop however, thanks to the use of the par constructor, we can do so. The action l 1 !m underneath the loop can once again be directly executed and this results in a second instanciation of the behavior. This is illustrated on Fig. 5.17.

l 1 !m --→ l 1 !m --→ Figure 5
.17: Showcasing several consecutive instantiations of the loop P from the example of Fig. 5.16 Fig. 5.17 illustrates two points:

• the iterative nature of the execution of actions within interaction terms. This allows the construction of paths of executions which are fundamental for the definition of the operational semantics. In Fig. 5.17, we can see that l 1 !m.l 1 !m is a prefix of traces accepted by the initial interaction loop P (strict(l 1 !m, l 2 ?m))

• the fact that it is not necessary for previous instances of a sub-behavior to be entirely executed before that another instance can be created. Here a second instance of the behavior is created (the second pending reception l 2 ?m) even though the first one has not been executed entirely. This of course depends depends on the nature of the loop constructor that is used, as explained in Sec.4.2.1.

Executing actions underneath a loop H constructor

Executing actions underneath loop H constructors also works similarly. Here, instead of scheduling the remaining behavior w.r.t. the loop using strict or par, we use seq. This therefore correspond to the following rule:

For any action a ∈ A Ω : ples, we repeat the sub-behavior i 1 = strict(l 1 !m, l 2 ?m). We can see that the follow-up interaction is seq(l 2 ?m, loop H (strict(l 1 !m, l 2 ?m))). As was the case for the loop P constructor, we can also here immediately execute l 1 !m once again, resulting in the creation of a second instance of the repeatable behavior. We illustrate this on Fig. 5. [START_REF]Web service choreography business process execution language[END_REF]. In the following we will introduce the last repetition constructor which is loop W . loop W also uses weak sequencing as a scheduler. However we will see that it is not the same constructor as loop H . This will be made clear using an illustrative example.

i 1 a -→ i 1 loop H (i 1 ) a -→ seq(i 1 , loop H (i 1 )) on term strict l 1 !m l 2 ?m l 1 !m --→ strict ∅ l 2 ?m loop H strict l 1 !m l 2 ?m l 1 !m --→ seq strict ∅ l 2 ?m loop H strict l 1 !m l 2 ?m on diagram l 1 !m --→ l 1 !m --→
l 1 !m --→ l 1 !m --→

Executing actions underneath a loop W constructor

Whenever we execute an action underneath a loop W constructor we cannot know in advance if this action comes from the first instance of the repeated behavior or if it comes from later instances. Indeed, it is possible to execute at first an action that comes from another instance than the first. This is illustrated on (second from the left). From that point on the execution of the remainder is straightforward, and, in total, we can conclude that the trace t = l 1 !m 1 .l 2 !m 2 .l 2 ?m 1 is expressed by the interaction. We can see that the second action of t which is l 2 !m 2 is not immediately executable in this interaction.

l 1 !m 1 ---→ l 2 !m 2 ---→ l 2 ?m 1 ---→
l 1 !m 1 ---→
Indeed, the presence of l 2 ?m 1 at the top of the diagram prevents it to be executed.

As we have indicated multiple times earlier (and by definition) the loop H constructor is associated to the weak HF-closure ; × × * and not to the K-closure ;× × * . It is therefore expected that t could not be recognized by loop H (i 1 ) in this example.

We will now see how we can define an operational rule for loop W so that loop W (i 1 ) is able to recognize t. This rule is as follows:

For any action a ∈ A Ω : contrast to the previous case, the follow-up interaction (second from the left) contains loop W (l 2 !m 2 ) at the top of the diagram (resulting from the pruning of the original loop W ). This then allows the execution of l 2 !m 2 , leading to the third interaction. From that third interaction, l 2 ?m 1 can then be executed given that we can choose not to instantiate the above loop. Hence we have recognized t.

i 1 a -→ i 1 loop W (i 1 ) × × θ(a) --→ i loop W (i 1 ) a -→ seq(i , seq(i 1 , loop W (i 1 ))) l 1 !m 1 ---→ l 2 !m 2 ---→ l 2 ?m 1 ---→
With this special rule for loop W we can recognize traces obtained using the weak Kleene closure ;× × * (this will be formally proven in Sec.5.2). Let us remark that this can be described as delaying the determination of as part of which instance of the loop the initial action l 1 !m 1 was executed. If we have then immediately executed l 2 ?m 1 then this would mean that l 1 !m 1 was executed as part of the first instance. However, given that we have executed l 2 ?m 2 once, this means that l 1 !m 1 was executed as part of the second instance.

Let us recall that in Lem.4.26 from Chap.4 we have proven that for the strict sequencing and interleaving operators, their respective HF and K closures were equivalent. As a result the constructors loop S and loop P are sufficient to recognize traces obtained from the strict Kleene closure and the interleaving Kleene closure.

However, given that the weak HF closure and the weak Kleene closure are different operators, we have defined loop H and loop W as distinct counterparts in the world of interaction terms.

Formalisation of the set of rules

Now that we have introduced and illustrated the different manners in which actions can be executed in interactions, we formalize this process as an execution relation in Def.5.6.

Definition 5.6: Execution relation for labelled interactions

We define the execution relation →⊂ I Ω × A Ω × I Ω such that for any action a ∈ A Ω :

a a -→ ∅ i 1 a -→ i 1 alt(i 1 , i 2 ) a -→ i 1 i 2 a -→ i 2 alt(i 1 , i 2 ) a -→ i 2 i 1 a -→ i 1 par(i 1 , i 2 ) a -→ par(i 1 , i 2 ) i 2 a -→ i 2 par(i 1 , i 2 ) a -→ par(i 1 , i 2 ) i 1 a -→ i 1 strict(i 1 , i 2 ) a -→ strict(i 1 , i 2 ) i 2 a -→ i 2 i 1 ↓ strict(i 1 , i 2 ) a -→ i 2 i 1 a -→ i 1 seq(i 1 , i 2 ) a -→ seq(i 1 , i 2 ) i 1 × × θ(a) --→ i 1 i 2 a -→ i 2 seq(i 1 , i 2 ) a -→ seq(i 1 , i 2 ) i 1 a -→ i 1 loop S (i 1 ) a -→ strict(i 1 , loop S (i 1 )) i 1 a -→ i 1 loop H (i 1 ) a -→ seq(i 1 , loop H (i 1 )) i 1 a -→ i 1 loop W (i 1 ) × × θ(a) --→ i loop W (i 1 ) a -→ seq(i , seq(i 1 , loop W (i 1 ))) i 1 a -→ i 1 loop P (i 1 ) a -→ par(i 1 , loop P (i 1 ))
This execution relation defines, for any interaction, which of its actions can be executed, and, if so, which interactions may result from those executions. This constitutes the "small-step" of the small-step operational semantics σ o which we define in Def.5.7.

Definition 5.7: Operational semantics for labelled interactions

For any signature Ω = (L, M ), we define σ o : I Ω → P(T Ω ) by:

i ↓ ∈ σ o (i) t ∈ σ o (i ) i a -→ i a.t ∈ σ o (i)
In the following section, we ensure the correctness of the operational-style semantics σ o we have just defined with regards to the fundational denotational-style semantics σ d from Chap.4. This proof of equivalence amounts to proving that, for any interaction i, the sets σ o (i) and σ d (i) are equal.

Proof of equivalence between σ o and σ d

In this section, a proof for the equivalence between the denotational semantics σ d from Sec. 4 Once this is done, the proof can be written in two steps:

• in Sec.5.2.3 we prove that for any interaction i we have σ o (i) ⊂ σ d (i),

• in Sec.5.2.4 we prove that for any interaction i we have σ o (i) ⊃ σ d (i).

Properties of σ d w.r.t. the termination and evasion predicates

The termination predicate ↓ characterizes the fact that an interaction can express the empty trace and therefore that it is in its semantics. As a result we formulate and prove this in Lem.5.4.

Lemma 5.4: Characterization of termination w.r.t. σ d

For any i ∈ I Ω :

(i ↓) ⇔ ( ∈ σ d (i))
Proof. Let us prove the equivalence of both predicate by induction on the term structure of i.

• If i = ∅ the empty interaction, then we have both ∅ ↓ and ∈ σ d (∅).

• If i ∈ A Ω , we have neither i ↓ nor ∈ σ d (i).
• Let us now suppose that i is of the form strict(i 1 , i 2 ), with i 1 and i 2 two sub-interactions that satisfy the induction hypotheses (i 1 ↓) ⇔ ( ∈ σ d (i 1 )) and (i 2 ↓) ⇔ ( ∈ σ d (i 2 )).

⇐ Let us suppose that ∈ σ d (i). By definition of σ d for the strict constructor, this implies the existence of t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ) such that ∈ (t 1 ; t 2 ). Then, as per Lem.4.8, this implies that t 1 = and t 2 = . We can therefore apply the induction hypotheses, to obtain that i 1 ↓ and i 2 ↓. This in turn means that strict(i 1 , i 2 ) ↓ by definition of the termination predicate.

⇒ Reciprocally, if strict(i 1 , i 2 ) ↓, this means that both i 1 ↓ and i 2 ↓. As per the induction hypotheses, this means that ∈ σ d (i 1 ) and ∈ σ d (i 2 ). Therefore ∈ σ d (i).

• For interactions of the form par(i 1 , i 2 ) and seq(i 1 , i 2 ), the reasoning is the same as for the previous case except that we use properties on (respectively) the operators || (Lem.4.3) and ;× × (Lem.4.13).

• Let us now suppose that i is of the form alt(i 1 , i 2 ), with i 1 and i 2 two sub-interactions that satisfy the

induction hypotheses (i 1 ↓) ⇔ ( ∈ σ d (i 1 )) and (i 2 ↓) ⇔ ( ∈ σ d (i 2 )).
⇐ Let us suppose that ∈ σ d (i). By definition of σ d , this means that either ∈ σ d (i 1 ) or ∈ σ d (i 2 ) or both. Let us suppose that it is in σ d (i 1 ) (the other cases can be treated similarly). As per the induction hypothesis, we therefore have i 1 ↓. Then, by definition of the termination predicate, this implies that given that alt(i 1 , i 2 ) ↓. ⇒ Reciprocally, if alt(i 1 , i 2 ) ↓, this means that either i 1 ↓ or i 2 ↓ (or both). Let us suppose we have i 1 ↓. As per the induction hypothesis, this means that ∈ σ d (i 1 ). Therefore ∈ σ d (i).

• Let us finally consider the case where i is of the form loop k (i 1 ), with k ∈ {S, H, W, P }. By definition, we always have i ↓ and ∈ σ d (i).

As explained in Sec.5.1.7, the evasion predicate ↓ × × , applied to an interaction i and a lifeline l, characterizes the fact for i to be able to express traces that have no conflict w.r.t. lifeline l i.e. that "evades" l. This characterization, is formulated w.r.t. the semantics σ d and proven in Lem.5.5.

Lemma 5.5: Characterization of ↓ × × w.r.t. σ d

For any lifeline l ∈ L and any interaction i ∈ I Ω :

(i ↓ × × l) ⇔ (∃ t ∈ σ d (i), ¬(t × × l))
In other words, i evades l iff it can express a trace t that do not have any conflict w.r.t. l.

Proof. Let us consider a certain lifeline l ∈ L, and let us reason by induction on the term structure of i.

• If i = ∅ the empty interaction, then we have of course ∅ ↓ × × l and ∈ σ d (∅) satisfies ¬( × × l).

• If i = a ∈ A Ω , we have:

-a ↓ × × l iff θ(a) = l
and, given that σ d (i) = {a}, a single trace made of that single action, we have that trace a verifies

¬(a × × l) iff θ(a) = l
Those two conditions are therefore equivalent.

• Let us now suppose that i is of the form strict(i 1 , i 2 ), with i 1 and i 2 two sub-interactions that satisfy the induction hypotheses.

⇒ Let us suppose that i ↓ × × l. By definition, this implies that both i 1 ↓ × × l and i 2 ↓ × × l. We can therefore apply the induction hypotheses, which lets us consider two traces t 1 ∈ σ d (i 1 ) and and ¬(t 2 × × l). We can therefore apply the induction hypothesis which implies that i 1 ↓ × × l and i 2 ↓ × × l, which, per the definition of ↓ × × , implies that i ↓ × × l.

t 2 ∈ σ d (i 2 ) such that ¬(t 1 × × l)
• For interactions of the form par(i 1 , i 2 ) and seq(i 1 , i 2 ), the reasoning is the same as for the previous case except that we reason on (respectively) the operators || and ;× × over both of which the conflict × × is also distributive according to Lem.4.14.

• Let us now suppose that i is of the form alt(i • Let us finally consider the case where i is of the form loop k (i 1 ), with k ∈ {S, H, W, P }. By definition, we always have i ↓ × × l and the empty trace ∈ σ d (i) verifies ¬( × × l).

Properties of σ d w.r.t. pruning

As explained in Sec.5.1.8, for any lifeline l ∈ L, pruning can be applied to an interaction i that satisfies i ↓ × × l to obtain a unique (Lem.5.3) rewritten interaction which exactly expresses the traces that can be expressed by i and that do not involve lifeline l. This characterization of pruning w.r.t. the σ d semantics is formulated and proven in Lem.5.6.

Lemma 5.6: Characterization of pruning w.r.t. σ d

For any lifeline l ∈ L and for any two interactions i and i from I Ω :

(i × × l - → i ) ⇒ (σ d (i ) = {t ∈ σ d (i) | ¬(t × × l)})
Proof. Let us consider a certain lifeline l ∈ L, and let us reason by induction on the term structure of i.

• If i = ∅ the empty interaction, we have ∅ × × l -→ ∅ and σ d (∅) = { }. Given that the empty trace has no conflict with any lifeline, the property is satisfied.

• If i = a ∈ A Ω , the precondition a ↓ × × l implies that θ(i) = l. Also, we have a × × l -→ a and σ d (a) = {a} has a single trace with no conflict w.r.t. lifeline l. The property therefore holds.

• Let us now suppose that i is of the form strict(i 1 , i 2 ), with i 1 and i 2 two sub-interactions that satisfy induction hypotheses i.e. such that, given i • For interactions of the form par(i 1 , i 2 ) and seq(i 1 , i 2 ), the reasoning is the same as for the previous case except that we reason on (respectively) the operators || and ;× × over both of which the conflict × × is also distributive according to Lem.4.14.

1 × × l - → i 1 and i 2 × × l - → i 2 we have σ d (i 1 ) = {t 1 ∈ σ d (i 1 ) | ¬(t 1 × × l)} and σ d (i 2 ) = {t 2 ∈ σ d (i 2 ) | ¬(t 2 × × l)}. Also,
• Let us now suppose that i is of the form loop k (i 1 ) with k ∈ {S, H, W, P } and let us note the corresponding operator on sets of traces, i.e. =; if k = S, =;

× × if k = H, =;× × if k = W and = || if k = P .
We then have:

-if i 1 ↓ × × l, then loop k (i 1 ) × × l - → ∅.
As per the reciprocate of Lem.5.5, if i 1 does not avoid l, this means that all the traces from σ d (i 1 ) have conflicts with l. As per Lem.4.19 this means that all the traces obtained from merging traces from i 1 have conflicts with l. Therefore the empty trace is the only trace from σ d (loop k (i 1 )) which has no conflict with l. Given that σ d (∅) = { }, the property holds.

if i 1 ↓ × × l, then there exists a unique i 1 such that i 1 × × l -→ i 1 and we suppose the induction hypothesis

σ d (i 1 ) = {t 1 ∈ σ d (i 1 ) | ¬(t 1 × × l)}.
Then, using Lem.4.19 we have:

σ d (loop k (i 1 )) = σ d (i 1 ) * = {t ∈ σ d (i 1 ) | ¬(t × × l)} * = {t ∈ σ d (i 1 ) * | ¬(t × × l)} = {t ∈ σ d (loop k (i 1 ))) | ¬(t × × l)}
Indeed, as per Lem.4.19, any trace obtained from merging traces from i 1 has no conflict w.r.t. l iff it is obtained from merging traces from i 1 that all have no conflict with l. Therefore, traces that have no conflict w.r.t. l are exactly those that are obtained from merging traces with no conflicts w.r.t. l. Those traces are those from loop k (i 1 ) as per the induction hypothesis. Therefore the property holds.

Left inclusion

In this section, we prove that, for any interaction i ∈ I Ω , we have σ o (i) ⊂ σ d (i). A first Lemma (Lem.5.7)

proposes a characterization of the execution relation "→" w.r.t. σ d .

Lemma 5.7: Characterization (left side) of → w.r.t. σ d

For any action a ∈ A Ω , for any trace t ∈ T Ω and for any interactions i and i from I Ω :

(i a -→ i ) ∧ (t ∈ σ d (i )) ⇒ (a.t ∈ σ d (i))
Proof. Let us consider i and i in I Ω and a in A Ω and t ∈ T Ω . Let us then suppose that i a -→ i and that t ∈ σ d (i ). Let us then reason by induction on the cases that makes the hypothesis i a -→ i possible. There are 13 such cases, as per the 13 rules from Def.5.6:

1. when executing an atomic action, we have i ∈ A Ω and i = ∅. Then σ d (i) = {i} and σ d (∅) = { }.

The property i. = i ∈ σ d (i) holds.

2. when executing an action on the left of an alternative, we have i of the form alt(i 1 , i 2 ), and i = i 1 such that i 1 a -→ i 1 . By construction of σ d , we have that t ∈ σ d (i 1 ). By the induction hypothesis on the sub-interaction i 1 , we have that a.t ∈ σ d (i 1 ). Given that σ d (i 1 ) ⊂ σ d (i), the property holds.

3. when executing an action on the right of an alternative, we have i of the form alt(i

; × × t 2 ) ⊂ σ d (i)
• Also, given that t ∈ (t 1 ;× × t 2 ), we have immediately that a.t ∈ (a.t 1 ; × × t 2 ) because it is always possible to add actions from the left and here we select a on the left.

• Therefore a.t ∈ σ d (i), so the property holds.

12. when executing an action underneath a loop W , we have i of the form loop W (i 1 ) and i = seq(i 0 , seq(i 1 , loop W (i 1 )))

such that i 1 a -→ i 1 and i × × θ(a) --→ i 0 . We have that t ∈ σ d (i ). Therefore there exists

t 0 ∈ σ d (i 0 ), t 1 ∈ σ d (i 1 )
and

t 2 ∈ σ d (i) s.t. t ∈ (t 0 ;× × t 1 ;× × t 2 ).
• Given that i × × θ(a) --→ i 0 we have that:

σ d (i 0 ) ⊂ σ d (i) and, given that σ d (i) = σ d (i 1 ) ;× × * , is a weak Kleene closure we have that

σ d (i);× × σ d (i) ⊂ σ d (i) and therefore σ d (i 0 );× × σ d (i) ⊂ σ d (i)
and, given that t 0 ∈ σ d (i 0 ), we have as per Lem.5.6 that ¬(t 0 × × θ(a)). ). Indeed, it may be so that, if it were formulated using construction rules, σ d would also verify some other construction rules in addition to the aforementioned two, which would allow the acceptation of some more traces.

Theorem 5.1: Inclusion of σ o in σ d

For any interaction i ∈ I Ω : In the next section we tackle the other inclusion that we have to prove i.e. that of σ d into σ o .

σ o (i) ⊂ σ d (i) Proof.

Right inclusion

In this section, we prove that, for any interaction i ∈ I Ω , we have σ d (i) ⊂ σ o (i). An intermediate Lemma, Lem.5.8, which is, in a certain manner, the reciprocate of Lem.5.7, is required at first.

Lemma 5.8: Characterization (right side) of → w.r.t. σ d

For any action a ∈ A Ω , for any trace t ∈ T Ω and for any interaction i ∈ I Ω :

(a.t ∈ σ d (i)) ⇒ ∃ i ∈ I Ω , (i a -→ i ) ∧ (t ∈ σ d (i )) Proof.
; × × j = σ d (i 1 ); × × σ d (i 1 ) ; × × (j-1)
, and, given that σ d (i 1 ) ; × × (j-

};× × • • • ;× × {t j-1 };× × {t j };× × {t j+1 };× × • • • ;× × {t n }.
We can then remark the following:

-considering i 0 such that loop W (i 1 ) × × θ(a)
--→ i 0 (which existence is guaranteed by Lem.5.3 given that a loop always evades any lifeline), because, for any k < j, we have ¬(t k × × θ(a)) then, as per Lem.5.6, for all k < j, we have t k ∈ σ d (i 0 ). Then: * If all the t k are the empty trace then

{t 1 };× × • • • ;× × {t j-1 } = { } ⊂ σ d (i 0 ) (σ d (i 0 ) contains at
least because loop W (i 1 ) does) * If at least one t k is not the empty trace then i 0 is a non empty loop W , and, because it is a loop W , given that for all k < j, we have

t k ∈ σ d (i 0 ) then {t 1 };× × • • • ;× × {t j-1 } ⊂ σ d (i 0 ) (because a loop W is closed under repetition by ;× × )
In any case we have

{t 1 };× × • • • ;× × {t j-1 } ⊂ σ d (i 0 ) and therefore t ∈ {t 1 };× × • • • ;× × {t j-1 };× × {t j };× × {t j+1 };× × • • • ;× × {t n } ⊂ σ d (i 0 );× × {t j };× × {t j+1 };× × • • • ;× × {t n }
given that, for any k > j we have that t k ∈ σ d (i) and because i is a loop (i = loop W (i 1 )), then

{t j+1 };× × • • • ;× × {t n } ⊂ σ d (i) and therefore t ∈ σ d (i 0 );× × {t j };× × {t j+1 };× × • • • ;× × {t n } ⊂ σ d (i 0 );× × {t j };× × σ d (i)
given that t j = a.t j ∈ σ d (i 1 ) we can apply the induction hypothesis on sub-interaction i 1 to reveal the existence of i 1 such that i 1 a -→ i 1 and t j ∈ σ d (i 1 ). By definition of the execution relation "→", this implies that loop W (i 1 ) a -→ seq(i 0 , seq(i 1 , loop W (i 1 )))

finally, given that we have shown that t ∈ σ d (i 0 );× × {t j };× × σ d (i) and because t j ∈ σ d (i 1 ), by definition of σ d we can conclude that t ∈ σ d (seq(i 0 , seq(i 1 , loop W (i 1 )))). Therefore we have identified i = seq(i 0 , seq(i 1 , loop W (i 1 ))) which satisfies the property.

Thanks to the Lem.5.8 as well as the characterization from Lem.5.4 we can conclude on the inclusion of the σ d semantics into the σ o semantics.

Theorem 5.2: Inclusion of σ d in σ o

For any interaction i ∈ I Ω : By definition of the operational semantics, this implies that a.t ∈ σ o (i). Hence the property holds.

σ o (i) ⊃ σ d (i) Proof.
We have finally proven both inclusion and we conclude with Th.5.3 that the operational semantics σ o that we have defined in Sec.5.1 is indeed equivalent to the fundational denotational-style semantics σ d from Chap.4.

Theorem 5.3: Equivalence of the σ d and σ o semantics

For any interaction i ∈ I Ω :

σ o (i) = σ d (i)
Proof. Immediately implies by Th.5.1 and Th.5.2.

Hence we have proven the correctness of our operational semantics w.r.t. the denotational-style semantics (which acts as a mathematical foundation).

Conclusion

In this chapter we have defined a structural operational semantics for our Interaction Language (IL). This semantics is a small-step operational semantics in so far as it defines accepted traces t ∈ σ o (i 1 ) by unveiling sequences of small-steps i 1

a1

-→ i 2

a2

-→ i 3 • • • corresponding to the occurences of atomic communication events and such that the accepted trace t is a concatenation of the actions a j that are successively expressed. The semantics is also structural given that its definition, in the form of a set of rules, is inductive on the structure of interaction terms. We have then proven the equivalence of this operational semantics with regards to the denotational semantics from Chap.4 which acts as a reference and mathematical foundation. By equivalence, we mean that for any interaction, its set of accepted traces is the same according to both semantics.

In the next chapter, we propose an algorithmization of this operational semantics to facilitate its implementation and use in Formal Verification (FV).

Chapter 6

Some execution semantics

163

The purpose of this chapter is to define an "algorithmicized" version of the operational semantics from the previous chapter that is expressed in functional style i.e. in the style of functional programming languages.

We name "execution semantics" this "algorithmicized" operational semantics. Additionally, we define variants of this execution semantics which incorporate simplifications, as allowed by the ≈ E I relation from Chap.4.

The plan of this chapter is as follows:

• in Sec.6.1, we present the initial execution semantics σ e ,

• in Sec.6.2, we prove that this new semantics σ e is in facts equivalent to σ o i.e. that for any interaction i, we have σ e (i) = σ o (i),

• in Sec.6.3, we use results from equational theory and term rewriting seen in Chap.4 to define variants of σ e which include term simplification.

Let us remark that the contents of Sec.6.1 and Sec.6.2 i.e. the formalization of the execution semantics and the proof of its equivalence w.r.t. the previous semantics have been encoded in Coq in [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF].

Definition of the execution semantics

In this section we redefine, in functional style, the operational semantics σ o . However we add a twist in that re-definition by separating concerns between, on the one side, the determination of which actions are immediately executable, and, on the other side, the determination or computation of follow-up interactions.

This section is organized as follows:

• in Sec.6.1.1 we redefine the predicates of termination, evasion and the pruning relation in functional style.

• in Sec.6.1.2 we present a first algorithmization of the execution relation and explain its limitations which leads to proposing a second algorithmization which relies on a separation of concerns as previously mentioned.

• in Sec.6.1.3 we define the frontier of execution, which computes the positions of all immediately executable actions.

• in Sec.6.1.4 we define the execution function, which computes the unique follow-up of the execution of an action at a specific position.

• finally, in Sec.6.1.5, we define the execution semantics.

Termination, evasion & pruning in functional style

In this section we redefine ↓, ↓ × × and × × -→ in functional style. We use a style of pseudo-code with Pattern-Matching inspired from Pattern-Matching notations found in functional programming languages such as ML (OCaml, etc.), Rust or Haskell. The use of this style underlines the ease of implementation of the various definitions proposed in this chapter.

Definition 6.1: Termination in functional style

trm : I Ω → bool is the function s.t. for any i ∈ I Ω :

• trm(i) match i with

| ∅ → | a ∈ A Ω → ⊥ | f (i 1 , i 2 ) → trm(i 1 ) ∧ trm(i 2 ) for f ∈ {strict, seq, par} | alt(i 1 , i 2 ) → trm(i 1 ) ∨ trm(i 2 )
| loop k (i 1 ) → for k ∈ {S, H, W, P } Lemma 6.1: Correctness of "trm" w.r.

t. "↓"

For any i ∈ I Ω , (trm(i) = ) ⇔ (i ↓)

Proof. By induction on the term structure of interactions.

Definition 6.2: Evasion in functional style

vad : I Ω × L → bool is the function s.t. for any (i, l) ∈ I Ω × L: • provided vad(i, l) = then prn(i, l) = match i with

• vad(i, l) = match i with | ∅ → | a ∈ A Ω → (θ(a) = l) | f (i 1 , i 2 ) → vad(i 1 , l) ∧ vad(i 2 , l) for f ∈ {strict, seq, par} | alt(i 1 , i 2 ) → vad(i 1 , l) ∨ vad(i 2 , l) | loop k (i 1 ) → for k ∈ {S,
| ∅ → ∅ | a ∈ A Ω → a | alt(i 1 , i 2 ) →            prn(i 2 , l) if (vad(i 1 , l) = ⊥) ∧ (vad(i 2 , l) = ) prn(i 1 , l) if (vad(i 1 , l) = ) ∧ ¬(vad(i 2 , l) = ⊥) alt(prn(i 1 , l), prn(i 2 , l)) if (vad(i 1 , l) = ⊥) ∧ (vad(i 2 , l) = ) | f (i 1 , i 2 ) → f (prn(i 1 , l), prn(i 2 , l)) for f ∈ {strict, seq, par} | loop k (i 1 ) →      loop k (prn(i 1 , l)) if (vad(i 1 , l) = ⊥)
∅ else for k ∈ {S, H, W, P } Lemma 6.3: Correctness of "prn" w.r.t. " × × -→"

For any i ∈ I Ω and any l ∈ L:

(∃ i ∈ I Ω , s.t. i × × l - → i ) ⇒ (prn(i, l) = i ) and (i ↓ × × l) ⇒ (i × × l - → prn(i, l))
Proof. By induction on the term structure of interactions and using Lem.6.2 and Lem.5.3.

Given Lem.6.1 and Lem.6.2 we will, in the remainder of this chapter, use the notations ↓ and ↓ × × instead of that of their functional style equivalent.

An argument for separating concerns when determining follow-ups

With the operational-style semantics from Chap.5, the determination of which are the actions that can be executed within an interaction term, and the computation of the new interactions that remain after the executions of those actions are intertwined. Indeed, any predicate i a -→ i must be inferred inductively without prior knowledge of which actions a can be executed. As a result, so as to know which are the possible follow-ups to a given interaction i, one has to infer all the possible predicates of the form i a -→ i .

This can be done for instance with the algorithm given in pseudo-code on Def.6.4. This "nxt" function exploits the small-step operational semantics to infer, given an interaction i, which are the follow-up interactions resulting from the execution of actions in i. Definition 6.4: Computing all follow-ups with "nxt"

nxt : I Ω → (A Ω × I Ω ) * is s.t. for any i ∈ I Ω : • nxt(i) = match i with | ∅ → [ ] | a ∈ A Ω → [(a, ∅)] | strict(i 1 , i 2 ) →      [(a, strict(i 1 , i 2 )) for (a, i 1 ) ∈ nxt(i 1 )] if (vad(i 1 , l) = ⊥) [(a, strict(i 1 , i 2 )) for (a, i 1 ) ∈ nxt(i 1 )] + nxt(i 2 ) if (vad(i 1 , l) = ) | seq(i 1 , i 2 ) →    [(a, seq(i 1 , i 2 )) for (a, i 1 ) ∈ nxt(i 1 )] +[(a, seq(prn(i 1 , θ(a)), i 2 )) for (a, i 2 ) ∈ nxt(i 2 ) if (vad(i 1 , θ(a)) = )]    | par(i 1 , i 2 ) →    [(a, par(i 1 , i 2 )) for (a, i 1 ) ∈ nxt(i 1 )] +[(a, par(i 1 , i 2 )) for (a, i 2 ) ∈ nxt(i 2 )]    | alt(i 1 , i 2 ) → nxt(i 1 ) + nxt(i 2 ) | loop S (i 1 ) → [(a, strict(i 1 , i)) for (a, i 1 ) ∈ nxt(i 1 )] | loop H (i 1 ) → [(a, seq(i 1 , i)) for (a, i 1 ) ∈ nxt(i 1 )] | loop W (i 1 ) → [(a, seq(prn(i, θ(a)), seq(i 1 , i))) for (a, i 1 ) ∈ nxt(i 1 )] | loop P (i 1 ) → [(a, par(i 1 , i)) for (a, i 1 ) ∈ nxt(i 1 )]
With the "nxt" algorithm from Def.6.4, we exploit the tree-like structure of interaction terms and the inductive definition of the semantics to return, for a given interaction i, all its follow-ups as a list of tuples (a, i ) such that the predicate i a -→ i holds true. The algorithm takes the form of a recursive function nxt which:

• if applied to a base case interaction, immediately returns all its follow-ups. In details this means that:

for the empty interaction ∅, given that there are no follow-ups, nxt(∅) returns an empty list for atomic actions a ∈ A Ω , given that there is a single possible follow-up, nxt(a) returns a list [(a, ∅)] with a single element such that a a -→ ∅

• if applied to a more complex interaction, nxt is called recursively on the children of the interaction term (i.e. its immediate sub-interactions). Then, follow-up interactions are reconstructed, as specified by the rules of the operational semantics from Def.5.6, from the follow-ups of the sub-interactions that have been computed.

However, we argue that this manner of algorithmizing the operational semantics is not ideal, especially when one consider applications for some Formal Verification (FV) techniques. Indeed we do not necessarily need to systematically compute all follow-up interactions. To avoid those unnecessary computations, we propose to separate the process into two parts:

• the computation of a "frontier of execution", which enumerates all the actions that are immediately executable • the computation of specific follow-up interactions, obtained after the execution of a specific action from the frontier of execution With this method, we can specifically choose to execute a precise action so as to obtain a specific followup interaction. In the operational semantics, the small-steps are of the form i a -→ i . However, given that there can be several occurrences of the same action a within the interaction i, there can exist several such executions. For instance we can have two distinct interactions i A and i B such that i

a -→ i A and i a -→ i B .
Given that the execution semantics aims at allowing the execution of specific actions, we need a manner to unambiguously identify those actions within an interaction. This manner of doing so is positions, which we have introduced in Chap.4.

As explained earlier, the execution semantics is an approach that is equivalent to that of the operational semantics but in which we decorrelate the identification of the actions that are immediately executable from the computation of the corresponding follow-up interactions. This approach is described schematically on Fig. 6.1. It consists:

• at first in identifying all the positions of the actions found within the interaction term i that can be immediately executed. The set of those positions is the frontier of interaction i.

• then, for any one of those actions a that is found at a specific position p ∈ pos(i) i.e. such that a = i |p , we can execute it within i and compute a uniquely defined follow-up interaction i

i ∈ I Ω execution frontier i ∈ I Ω a = i |p

Frontier of execution

Among all the actions that can be found at the leaf nodes of an interaction term, only some of them are immediately executable. We name this subset of leaf nodes the frontier of execution of the interaction. Given an interaction i ∈ I Ω , we note frt(i) its frontier of execution. Each node being uniquely identified by its position within i, we use those positions when defining "frt" so that frt(i) ⊆ pos(i) (with pos(i) the set of positions in the term i). Let us indeed recall that there can be several instances of a same action at different positions, and several of those can be present in a frontier of execution at the same time. Actions a = i |p corresponding to frontier positions p ∈ frt(i) are called frontier actions. The "frt" function is formally defined in Def.6.5. Definition 6.5: Frontier of execution frt : I Ω → P({1, 2} * ) is the function s.t. for any i ∈ I Ω :

• frt(i) = match i with | ∅ → ∅ | a ∈ A Ω → { } | strict(i 1 , i 2 ) →      1.frt(i 1 ) ∪ 2.frt(i 2 ) if i 1 ↓ 1.frt(i 1 ) else | seq(i 1 , i 2 ) → 1.frt(i 1 ) ∪ {p | p ∈ 2.frt(i 2 ) , i 1 ↓ × × θ(i |p )} | f (i 1 , i 2 ) → 1.frt(i 1 ) ∪ 2.frt(i 2 ) for f ∈ {alt, par} | loop k (i 1 ) → 1.frt(i 1 ) for k ∈ {S, H, W, P }
The frontier of an interaction can be statically inferred from its term structure. The "frt" function is defined inductively such that:

• the empty interaction has an empty frontier: frt(∅) = ∅

• for any interaction that consists in a single atomic action a ∈ A Ω , frt(a) = { }, because the position , which designates the root node of the interaction then designates the action leaf node itself ( is the position of a which is immediately executable)

• for any interaction i of the form f (i 1 , i 2 ), with f any of the four binary constructors, frt(i) is inferred from frt(i 1 ) and frt(i 2 ).

-In all cases, actions that are immediately executable within the left sub-interaction i 1 are also immediately executable in i. Indeed, the term being read from left to right, all constructors, if they introduce ordering constraints, will only do so on the right sub-interaction i 2 . Thus 1.frt(i 1 ) is included in frt(i).

-As for the actions that are immediately executable within the right sub-interaction i 2 , whether or not they are also immediately executable in i depends on the nature of the constructor f and that of the left sibling interaction i 1 . * If f = alt or f = par, 2.frt(i 2 ) is also included in frt(i) because no constraint may prevent the execution of actions from i 2 . * If f = strict, any action from i 2 can only be executed in i if no action from i 1 is executed in the same execution (otherwise it would violate the strict sequencing). Therefore 2.frt(i 2 ) is included in frt(i) iff i 1 accepts the empty trace i.e. iff i 1 ↓. * If f = seq, elements p from 2.frt(i 2 ) are included in frt(i) iff i 1 accepts an execution that does not involve the lifeline on which the action i |p occurs i.e. iff i 1 ↓ × × θ(i |p ).

• for any interaction i of the form loop k (i 1 ), with k ∈ {S, H, W, P }, we have frt(i) = 1.frt(i 1 ) because the loop can be instantiated through the execution of any one of the immediately executable actions from its sub-interaction, which specifies the behaviors that can be repeated. Another manner to describe the frontier of the example interaction from Fig. 6.2 is to say that it is composed of three distinct observable actions and we can explain why they are immediately executable as follows:

• both of the instances of the emission of message m 1 by lifeline l 1 can immediately occur.

-The one within the loop, at position 1111, is at the top of the diagram and therefore nothing prevents it from being executed.

-The other one, at position 21 can be immediately executed because we can choose not to instantiate the loop. If the loop is repeated zero times, then nothing prevents the emission of that message.

• the emission of message m 4 by lifeline l 3 , at position 221 can immediately occur. Indeed, we can, for instance, choose not to instantiate the loop. Then, nothing prevents the emission of that message.

Execution function

With "frt", we have isolated the responsibility of determining which actions are executable, and proposed an implementation of it. Now remains the ability to reconstruct efficiently "follow-up" interactions issued from the execution of said actions. As explained earlier and in Chap.5, the follow-up interaction specifies all the continuations of the executions of the original interaction that start with the execution of a specific action.

↓ l 3 !m 4 @221 interaction can be computed by rewriting the original interaction via a process that is described graphically on the right of Fig. 6.3:

• In this example, executing action l 3 !m 4 at position 221 simply consists in deleting the corresponding node from the interaction so that it may not be executed again. This is represented on Fig. • However this replacement of the node at position 221 is not sufficient to obtain the follow-up interaction.

As we have seen in Chap.5, we may need to clean-up the interaction term via the process of pruning.

Pruning is applied to all the left cousins of the node at position 221 (the executed action) if their common ancestor is a seq constructor. Here, the root node is a seq. Therefore we must replace i |1 by prn(i |1 , θ(i |p )). As explained in Chap.5, the process of pruning removes from the interaction model any contradiction that could occur. In this example, if l 3 emits m 4 then it forfeits its ability to receive m 2 because otherwise, this would contradict the top to bottom order of the diagram which corresponds to a weak sequencing between the reception of m 2 and the emission of m 4 on l 3 . If it were to occur, the reception of m 2 should precede the emission of m 4 . As a result it cannot occur at all if m 4 is emitted at first. Let us recall that the pruning cleans up the interaction term so as to minimally remove those contradictions. A naive clean-up would be to simply remove the loop. However it is not necessary to do so because the reception of m 2 is contained within an alternative, and, in that alternative, the empty branch can be chosen to solve the contradiction. Operating this minimal pruning, which corresponds to forcing the choice of the alternative still allows the repetition of the emission of m 1 by l 1 and so on. If we were to choose the native pruning, by removing the loop in its entirety we would obtain an under-approximated follow-up interaction because it would be an interaction that do not specifies all but only some of the continuations of the executions starting by the emission of m 4 at position 221.

The process we have described allows one to rewrite the original interaction term into the specific followup interaction that corresponds to the execution of an action at a specific position. The transformation that is illustrated on Fig. 6.3 may be denoted by i l3!m4@221 -------→ i , which signifies that the execution of action l 3 !m 4 at position 221 within the interaction i results in i as a follow-up interaction.

We can generalize this notation such that for any interaction i, the fact that an action a at position p can be executed which yields to the follow-up interaction i can be denoted by i a@p --→ i .

The formalisation of this process (for the computation of the follow-up interaction) takes the form of an inductive function exe that we define in Def.6.6. This function takes as arguments an interaction i and one of its frontier position p ∈ f ront(i) and returns an i that characterizes all the continuations of the executions of i that begin with the execution of the action i |p that is at the specific position p within i. exe in effects isolates and implements the "small-step" from our operational semantics. • exe(i, p) = match (i, p) with

| (act, ) → ∅ | (alt(i 1 , i 2 ), 1.p 1 ) → exe(i 1 , p 1 ) | (alt(i 1 , i 2 ), 2.p 2 ) → exe(i 2 , p 2 ) | (strict(i 1 , i 2 ), 1.p 1 ) → strict(exe(i 1 , p 1 ), i 2 ) | (strict(i 1 , i 2 ), 2.p 2 ) → exe(i 2 , p 2 ) | (seq(i 1 , i 2 ), 1.p 1 ) → seq(exe(i 1 , p 1 ), i 2 ) | (seq(i 1 , i 2 ), 2.p 2 ) → seq(prn(i 1 , θ(i 2|p2 )), exe(i 2 , p 2 )) | (par(i 1 , i 2 ), 1.p 1 ) → par(exe(i 1 , p 1 ), i 2 ) | (par(i 1 , i 2 ), 2.p 2 ) → par(i 1 , exe(i 2 , p 2 )) | (loop S (i 1 ), 1.p 1 ) → strict(exe(i 1 , p 1 ), i) | (loop H (i 1 ), 1.p 1 ) → seq(exe(i 1 , p 1 ), i) | (loop W (i 1 ), 1.p 1 ) → seq(prn(i, θ(i 1|p1 )), seq(exe(i 1 , p 1 ), i)) | (loop P (i 1 ), 1.p 1 ) → par(exe(i 1 , p 1 ), i)
exe is defined inductively on both the structure of the interaction i and the position p

= d 1 ...d n ∈ {1, 2} n .
The execution of exe(i, p) traverses recursively the syntactic structure of i guided by the path defined by the position p, that is, from exe(i | , d 1 ...d n ) (root node), ..., up to exe(i |p , ) (target action leaf to execute).

• exe(i |p , ) = ∅ constitutes the stopping criterion and i is then constructed when the algorithm goes back up through the syntactic structure of i. Assigning ∅ to exe(i |p , ) ensures that the action i |p is removed in the construction of i .

• When a par node is encountered during the upward traversal, i.e. for j ∈

...d n )) if d j+1 = 2
Indeed, as par specifies parallel executions, there is no need for pruning.

• When an alt node is reached, using the same notations, we would have:

-exe(i |d1...dj , d j+1 ...d n ) = exe(i |d1...dj+1 , d j+2 ...d n )
Indeed, we can 'skip' the alt node itself and replace it directly with the interaction resulting from the execution of the chosen branch.

• When a loop is reached, i.e. i |d1...dj = loop f (i |d1...dj .1 ) (with a mandatory d j+1 = 1), we have:

-exe(i |d1...dj , d j+1 ...d n ) = f (exe(i |d1...dj+1 , d j+2 ...d n ), i |d1...dj )
Indeed, the execution is done on a copy of the loop content that precedes (with f operator) the loop i |d1...dj itself, that is, on an unfolding of the loop.

...d n )) if d j+1 = 2
Indeed, when executing an action on the right of a seq (i.e. when d j+1 = 2), we must prune the left cousin i |d1...dj .1 w.r.t. the lifeline on which the action that is executed occurs.

Let us remark that the domain of definition of exe is defined by the precondition p ∈ f ront(i). Its inductive definition, on the cases authorized by its precondition, guarantees that it is well-defined:

• If i ∈ A Ω , p can only be (and vice-versa). In this case exe(i, ) = (∅, i) because the action i is executed and nothing remains to be executed.

• In any other case, p is either of the form 1.p 1 or 2.p 2 .

-If p = 1.p 1 then the action to be executed is in the left sub-interaction i |1 . Then the result of exe(i, p) is a reconstruction of an interaction term using exe(i 1 , p 1 ) and i 2 .

-If p = 2.p 2 then the action to be executed is in the right sub-interaction i |2 . Then the result of exe(i, p) is a reconstruction of an interaction term using i 1 and exe(i 2 , p 2 ).

• The most subtle case occurs when p = 2.p 2 and i = seq(i |1 , i |2 ). The precondition p ∈ f ront(i) implies that i |p ∈ A Ω and that the left child i |1 avoids θ(i |p ). In this case, to construct exe(i, 2.p 2 ), exe does not use i |1 but rather its pruned version prn(i |1 , θ(i |p )) which eliminates all traces involving θ(i |p ) while preserving all others.

Execution semantics

This process of identification and execution of frontier actions can be repeated on the follow-up interactions and their own follow-up interactions so as to identify all the executions that are specified by the original interaction term. For each of those follow-up interactions, one can identify a new frontier and execute those actions and so on. This results in the construction of a tree which we call the "execution tree" and in which each path corresponds to parts of an execution of the original interaction.

On the diagram from Fig. 6.4 such an execution tree is (partially) illustrated. This execution tree is that of the interaction from our previous examples (that from Fig. 6.2 and Fig. 6.3). Let us note that the transformation i l3!m4@221 -------→ i in which the interaction on the top part becomes the one underneath on its right (after transition l 3 !m 4 @221), corresponds to the execution illustrated on Fig. 6.3. The three child interactions underneath the top one correspond to the executions of the 3 frontier actions of i (detailed in Fig. 6.2).

Let us consider the path represented in the middle on Fig. 6.4. We can see that it corresponds to the successive execution of three actions l 1 !m 1 , l 3 !m 4 and l 1 ?m 4 ; the first in the original interaction, and the following in intermediate follow-up interactions. Let us then consider the interaction that remains after those three executions. We can see that is is the empty interaction ∅ drawn as a white square ( ). The empty interaction can express the empty behavior i.e. we have ∅ ↓. As a result, we can conclude that the sequence of events constituted of the concatenation of those three events i.e. the trace

l 1 !m 1 .l 3 !m 4 .l 1 ?m 4
constitutes a full execution of the system as specified by the original interaction and is therefore part of its trace semantics.

This observation can be generalized. Each path within the execution tree of an interaction that terminates in a node hosting an interaction that can express the empty behavior corresponds to an "accepted" trace of the original interaction. As a result, the execution tree represents the semantics of the original interaction.

The principle of the execution semantics is in fact the same as that of the operational semantics from Chap.5, except that we explicit the positions of the actions that are executed.

For any interaction i, if it can express the empty behavior (which can be statically inferred from its structure via the "↓" predicate) then the empty trace belongs to its semantics. If an action a at position p can be executed which yields to the follow-up interaction i , then any trace of the form a.t where t is a trace accepted by i , is accepted by i.

In other words, starting from an initial interaction i 0 , we may have a succession of transformations i 0

a1@p1 ----→ i 1 a2@p2 ----→ • • • an@pn ----→ i n such that i n ↓.
We can then reconstitute a sequence a 1 . • • • .a n which is an accepted trace. By grouping all such paths together, we obtain a tree, called the execution tree, whose nodes are interactions and arcs can be labelled by couples (p, a) (where a is the action that is executed and p its position within the given interaction term) noted a@p. For a node i, child nodes are interactions i obtained via the execution of any frontier action a = i |p with p ∈ f ront(i). Any such child node i corresponds to an interaction that accepts traces that are suffixes of traces accepted by i and which start with a (corresponding to a specific instance of a at a specific position p).

Let us also note that, given the existence of loops, execution trees can be infinite, and traces can be arbitrarily long. For instance, on Fig. 6.4 the execution tree is only partially drawn (as indicated by the

• • •)
given that, in any case, the original interaction having a non-empty loop node, this tree is infinite.

l 1 !m 1 @1111 l 1 !m 1 @21 l 3 !m 4 @221 l 3 !m 4 @221
σ e (i) = empty(i) ∪ p∈frt(i) i |p .σ e (exe(i, p))
with:

empty(i) =      { } if i ↓ ∅ if i ↓
In Def.6.7, we formally define our execution semantics σ e , which can be obtained from the exploration of execution trees.

We have therefore formally defined our "execution semantics" σ e which serves as an algorithmization of the operational semantics σ o for the purposes of facilitating its application to Formal Verification (FV)

techniques in the context of a tool implementation. So as to ensure its correctness, we will prove in the next section (Sec.6.2) that it is equivalent to the operational semantics i.e. that we have, for any interaction i ∈ I Ω , σ e (i) = σ o (i). Given that we have also proven, in Chap.5, that σ o is equivalent to the foundational denotational-style semantics σ d , we will then have proven that σ e is equivalent to σ d .

Proof of equivalence between σ e and σ o

The operational-style semantics σ o and the execution semantics σ e are very similar. Their main point of divergence concerns the use of the frontier and execution functions in σ e , which substitute the execution

relation → used in σ o .
As a result, the crux of the proof will be to characterize "exe" and "frt" with regards to the execution relation →. This is what we do in the next section (Sec.6.2.1). Then, in Sec.6.2.2 we use this characterization to prove the equivalence of both semantics.

Let us remark that this proof is machine-checked using the Coq proof assistant in [START_REF] Mahe | Coq proof for the equivalence of the semantics[END_REF].

Characterization of the execution function w.r.t. the execution relation

In Lem.6.4, we explain that for any predicate i a -→ i , the execution of a in i to obtain i in facts corresponds to the execution of a specific action a at a specific position p in the frontier of i. This corresponds to the fact that i a -→ i implies the existence of a position p ∈ frt(i) such that:

• i |p = a meaning that within interaction i, the node at position p is a leaf node hosting an instance of action a (there can be several such instances)

• and exe(i, p) = i meaning that the follow-up interaction i can be computed using "exe" and results from the execution of the specific instance of a at the specific position p Lemma 6.4: Characterization (left side) of exe w.r.t. → For any interactions i and i in I, for any action a ∈ A Ω , we have:

i a -→ i ⇒ ∃ p ∈ {1, 2} * , (p ∈ frt(i)) ∧ (i |p = a) ∧ (i = exe(i, p))
Proof. Let us suppose that i a -→ i and let us reason by induction on the structure of i.

• If i = ∅ then it is not possible to have an i such that i a -→ i

• If i = a ∈ A Ω then:
-On the one hand, the only possible i such that i a

-→ i is ∅ i.e. we have a a -→ ∅.
-On the other hand, we have ∈ frt(a) and a | = a and exe(a, ) = ∅. Therefore the property holds.

• If i = strict(i 1 , i 2 ) then i a -→ i implies:

either that there exists i 1 such that i 1 a -→ i 1 and i = strict(i 1 , i 2 ). We can then apply the induction hypothesis on sub-interaction i 1 to obtain the existence of a position p 1 ∈ frt(i 1 ) such that i 1|p1 = a and i 1 = exe(i 1 , p 1 ). Then, by construction 1.p 1 ∈ frt(i) and i |1.p1 = i 1|p1 = a and exe(i, 1.p 1 ) = strict(exe(i 1 , p 1 ), i 2 ) = strict(i 1 , i 2 ) = i . Therefore the property holds.

or that we have i 1 ↓ and that there exists i 2 such that i 2 a -→ i 2 and i = i 2 . We can then apply the induction hypothesis on sub-interaction i 2 to obtain the existence of a position p 2 ∈ frt(i 2 )

such that i 2|p2 = a and i 2 = exe(i 2 , p 2 ). Then, given that i 1 ↓, we have by construction that 2.p 2 ∈ frt(i) and i |2.p2 = i 2|p2 = a and exe(i, 2.p 2 ) = exe(i 2 , p 2 ) = i 2 = i . Therefore the property holds.

• If i = seq(i 1 , i 2 ) then i a -→ i implies:
either that there exists i 1 such that i 1 a -→ i 1 and i = seq(i 1 , i 2 ). We can then apply the induction hypothesis on sub-interaction i 1 to obtain the existence of a position p 1 ∈ frt(i 1 ) such that i 1|p1 = a and i 1 = exe(i 1 , p 1 ). Then, by construction 1.p 1 ∈ frt(i) and i |1.p1 = i 1|p1 = a and exe(i, 1.p 1 ) = seq(exe(i 1 , p 1 ), i 2 ) = seq(i 1 , i 2 ) = i . Therefore the property holds.

or that we have i 1 ↓ × × θ(a) and that there exists i 2 such that i 2 a -→ i 2 and i = seq(prn(i 1 , θ(a)), i 2 ).

We can then apply the induction hypothesis on sub-interaction i 2 to obtain the existence of a position p 2 ∈ frt(i 2 ) such that i 2|p2 = a and i 2 = exe(i 2 , p 2 ) and i |2.p2 = i 2|p2 = a. Then,

given that i 1 ↓ × × θ(i |2.p2
), we have by construction that 2.p 2 ∈ frt(i) and i |2.p2 = i 2|p2 = a and exe(i, 2.p 2 ) = seq(prn(i 1 , θ(i 2|p2 )), exe(i 2 , p 2 )) = seq(prn(i 1 , θ(a)), i 2 ) = i . Therefore the property holds.

• If i = par(i 1 , i 2 ) then i a -→ i implies:
either that there exists i 1 such that i 1 a -→ i 1 and i = par(i 1 , i 2 ). We can then apply the induction hypothesis on sub-interaction i 1 to obtain the existence of a position p 1 ∈ frt(i 1 ) such that i 1|p1 = a and i 1 = exe(i 1 , p 1 ). Then, by construction 1.p 1 ∈ frt(i) and i |1.p1 = i 1|p1 = a and exe(i, 1.p 1 ) = par(exe(i 1 , p 1 ), i 2 ) = par(i 1 , i 2 ) = i . Therefore the property holds.

either that there exists i 2 such that i 2 a -→ i 2 and i = par(i 1 , i 2 ). We can then apply the induction hypothesis on sub-interaction i 2 to obtain the existence of a position p 2 ∈ frt(i 2 ) such that i 2|p2 = a and i 2 = exe(i 2 , p 2 ). Then, by construction 2.p 2 ∈ frt(i) and i |2.p2 = i 2|p2 = a and exe(i, 2.p 2 ) = par(i 1 , exe(i 2 , p 2 )) = par(i 1 , i 2 ) = i . Therefore the property holds.

• If i = alt(i 1 , i 2 ) then i a -→ i implies:
either that there exists i 1 such that i 1 a -→ i 1 and i = i 1 . We can then apply the induction hypothesis on sub-interaction i 1 to obtain the existence of a position p 1 ∈ frt(i 1 ) such that i 1|p1 = a and i 1 = exe(i 1 , p 1 ). Then, by construction 1.p 1 ∈ frt(i) and i |1.p1 = i 1|p1 = a and exe(i, 1.p 1 ) = exe(i 1 , p 1 ) = i 1 = i . Therefore the property holds.

either that there exists i 2 such that i 2 a -→ i 2 and i = i 2 . We can then apply the induction hypothesis on sub-interaction i 2 to obtain the existence of a position p 2 ∈ frt(i 2 ) such that i 2|p2 = a and i 2 = exe(i 2 , p 2 ). Then, by construction 2.p 2 ∈ frt(i) and i |2.p2 = i 2|p2 = a and exe(i, 2.p 2 ) = exe(i 2 , p 2 ) = i 2 = i . Therefore the property holds.

• If i = loop k (i 1 ) with k ∈ {S, H, W, P }, then i a -→ i implies that there exists i 1 such that i 1 a -→ i 1
and i is either strict(i 1 , i) or seq(i 1 , i) or seq(prn(i, θ(a)), seq(i 1 , i)) (as per Lem.6.3) or par(i 1 , i). In any case, we can apply the induction hypothesis on sub-interaction i 1 to obtain the existence of a position p 1 ∈ frt(i 1 ) such that i 1|p1 = a and i 1 = exe(i 1 , p 1 ). Then, by construction 1.p 1 ∈ frt(i) and i |1.p1 = i 1|p1 = a and exe(i, 1.p 1 ) = i . Therefore the property holds.

In Lem.6.5, we explain that for any frontier position p and corresponding action a within the frontier of an interaction i (i.e. p ∈ frt(i) and a = i |p ), then exe(i, p) indeed corresponds to a follow-up interaction of i after the execution of a according to the transition relation →. This equates to implying that i a -→ exe(i, p). For any interaction i ∈ I, for any position p ∈ {1, 2} * and for any action a ∈ A Ω , we have:

(p ∈ frt(i)) ∧ (i |p = a) ⇒ i a -→ exe(i, p)
Proof. Let us suppose that p ∈ frt(i) and that i |p = a. Let us then reason by induction on the structure of i:

• If i = ∅ then we have frt(∅) = ∅ so it is not possible to have a p ∈ frt(i).

• If i = a ∈ A Ω then we have frt(a) = { } and p must be , which satisfies a | = a. Then:

-On the one hand, we have a a -→ ∅.

-On the other hand, exe(a, ) = ∅. Therefore the property holds.

• If i = strict(i 1 , i 2 ) then p ∈ frt(i) implies:

either that p is of the form 1.p 1 and p 1 ∈ frt(i 1 ). Also we have i 1|p1 = i |1.p1 = a. We can then apply the induction hypothesis on sub-interaction i 1 to get that we have i 1 a -→ exe(i 1 , p 1 ). This implies, as per the definition of the execution relation, that strict(i

1 , i 2 ) a -→ strict(exe(i 1 , p 1 ), i 2 ).
Then, given that exe(i, 1.p 1 ) = strict(exe(i 1 , p 1 ), i 2 ) this equates to i a -→ exe(i, p). Therefore the property holds.

or that we have i 1 ↓, that p is of the form 2.p 2 and that p 2 ∈ frt(i 2 ). Also we have i 2|p2 = i |2.p2 = a. We can then apply the induction hypothesis on sub-interaction i 2 to get that we have i 2 a -→ exe(i 2 , p 2 ). Given that we have i 1 ↓, this implies, as per the definition of the execution relation, that strict(i 1 , i 2 ) a -→ exe(i 2 , p 2 ). Then, given that exe(i, 2.p 2 ) = exe(i 2 , p 2 ) this equates to i a -→ exe(i, p). Therefore the property holds.

• If i = seq(i 1 , i 2 ) then p ∈ frt(i) implies:
either that p is of the form 1.p 1 and p 1 ∈ frt(i 1 ). Also we have i 1|p1 = i |1.p1 = a. We can then apply the induction hypothesis on sub-interaction i 1 to get that we have i 1 a -→ exe(i 1 , p 1 ).

This implies, as per the definition of the execution relation, that seq(i

1 , i 2 ) a -→ seq(exe(i 1 , p 1 ), i 2 ).
Then, given that exe(i, 1.p 1 ) = seq(exe(i 1 , p 1 ), i 2 ) this equates to i a -→ exe(i, p). Therefore the property holds.

or that we have i 1 ↓ × × θ(i |p ), that p is of the form 2.p 2 and that p 2 ∈ frt(i 2 ). Also we have

i 2|p2 = i |2.p2 = a.
We can then apply the induction hypothesis on sub-interaction i 2 to get that we have i 2 a -→ exe(i 2 , p 2 ). Given that we have i 1 ↓ θ(a), this implies, as per the definition of the execution relation, that seq(i

1 , i 2 ) a -→ seq(prn(i 1 , θ(a)), exe(i 2 , p 2 ))
. Then, given that exe(i, 2.p 2 ) = seq(prn(i 1 , θ(i 2|p2 )), exe(i 2 , p 2 )) this equates to i a -→ exe(i, p). Therefore the property holds.

• If i = par(i 1 , i 2 ) then p ∈ frt(i) implies:

either that p is of the form 1.p 1 and p 1 ∈ frt(i 1 ). Also we have i 1|p1 = i |1.p1 = a. We can then apply the induction hypothesis on sub-interaction i 1 to get that we have i 1 a -→ exe(i 1 , p 1 ).

This implies, as per the definition of the execution relation, that par(i

1 , i 2 ) a -→ par(exe(i 1 , p 1 ), i 2 ).
Then, given that exe(i, 1.p 1 ) = par(exe(i 1 , p 1 ), i 2 ) this equates to i a -→ exe(i, p). Therefore the property holds.

either that p is of the form 2.p 2 and p 2 ∈ frt(i 2 ). Also we have i 2|p2 = i |2.p2 = a. We can then apply the induction hypothesis on sub-interaction i 2 to get that we have i 2

a -→ exe(i 2 , p 2 ).
This implies, as per the definition of the execution relation, that par(i

1 , i 2 ) a -→ par(i 1 , exe(i 2 , p 2 )).
Then, given that exe(i, 2.p 2 ) = par(i 1 , exe(i 2 , p 2 )) this equates to i a -→ exe(i, p). Therefore the property holds.

• If i = alt(i 1 , i 2 ) then p ∈ frt(i) implies:

either that p is of the form 1.p 1 and p 1 ∈ frt(i 1 ). Also we have i 1|p1 = i |1.p1 = a. We can then apply the induction hypothesis on sub-interaction i 1 to get that we have i 1 a -→ exe(i 1 , p 1 ). This implies, as per the definition of the execution relation, that alt(i 1 , i 2 ) a -→ exe(i 1 , p 1 ). Then, given that exe(i, 1.p 1 ) = exe(i 1 , p 1 ) this equates to i a -→ exe(i, p). Therefore the property holds.

or that p is of the form 2.p 2 and p 2 ∈ frt(i 2 ). Also we have i 2|p2 = i |2.p2 = a. We can then apply the induction hypothesis on sub-interaction i 2 to get that we have i 2 a -→ exe(i 2 , p 2 ). This implies, as per the definition of the execution relation, that alt(i 1 , i 2 ) a -→ exe(i 2 , p 2 ). Then, given that exe(i, 2.p 2 ) = exe(i 2 , p 2 ) this equates to i a -→ exe(i, p). Therefore the property holds.

• If i = loop k (i 1 ) with k ∈ {S, H, W, P } then p ∈ frt(i) implies that p is of the form 1.p 1 and p 1 ∈ frt(i 1 ).

Also we have i 1|p1 = i |1.p1 = a. We can apply the induction hypothesis on sub-interaction i 1 to get that we have i 1 a -→ exe(i 1 , p 1 ). Let us then denote by i 1 the interaction exe(i 1 , p 1 ). This then implies, as per the definition of the execution relation, that loop k (i 1 ) a -→ i with i being either strict(i 1 , i) or seq(i 1 , i) or seq(prn(i, θ(a)), seq(i 1 , i)) (as per Lem.6.3) or par(i 1 , i) Then, given that exe(i, 1.p 1 ) is exactly defined as i 1 , this equates to i a -→ exe(i, p). Therefore the property holds.

Conclusion

Thanks to the previous characterization of f ront and χ w.r.t. →, the actual proof is quite short. In this section, we will:

• in Th.6.1 prove the inclusion of σ e in σ o

• in Th.6.2 prove the inclusion of σ o in σ e

• conclude on the equivalence of the semantics with Th.6.3

Theorem 6.1: Inclusion of σ e in σ o

For any interaction i ∈ I Ω :

σ e (i) ⊃ σ o (i)
Proof. Let us consider i ∈ I Ω and t ∈ σ d (i) and let us reason by induction on the trace t.

• If t = , the fact that t = ∈ σ e (i) implies that empty(i) = { } and therefore that i ↓. Then, by definition of σ o , this means that ∈ σ o (i).

• If t = a.t then, the fact that a.t ∈ σ e (i) implies the existence of a frontier position p ∈ frt(i) such that i |p = a and t ∈ σ e (exe(i, p)).

-On the one hand, given that trace t is strictly smaller than t, we can apply the induction hypothesis which implies that t ∈ σ o (exe(i, p))

-On the other hand, we can apply Lem.6.5 to get that i a -→ exe(i, p)

-Those two facts combined imply that t = a.t ∈ σ o (i)

Theorem 6.2: Inclusion of σ o in σ e

For any interaction i ∈ I Ω :

σ o (i) ⊃ σ e (i)
Proof. Let us consider i ∈ I Ω and t ∈ σ d (i) and let us reason by induction on the (size of the) trace t.

• If t = , the fact that t = ∈ σ o (i) implies that i ↓. Then, this implies that empty(i) = { } and therefore that ∈ σ e (i).

• If t = a.t then, the fact that a.t ∈ σ o (i) implies the existence of an action a and an interaction i such that i a -→ i and t ∈ σ o (i ).

-On the one hand, we can apply the induction hypothesis on t , which implies that t ∈ σ e (i )

-On the other hand, we can apply Lem.6.4 to reveal the existence of a position p ∈ frt(i) such that i |p = a and i = exe(i, p) -As a result we have p ∈ frt(i) and t ∈ σ e (exe(i, p)). Therefore, by definition of σ e we have

t = a.t = i |p .t ∈ σ e (i)
We conclude with Th.6.3 that the three semantics that we have defined on our IL, namely σ d , σ o and σ e are all equivalent.

Theorem 6.3: Equivalence of all three semantics

For any interaction i ∈ I Ω :

σ d (i) = σ o (i) = σ e (i)
Proof. Immediately implies by Th.5.3, Th.6.1 and Th.6.2.

Execution semantics with simplifications

The operational semantics σ o and its algorithmization σ e are defined in such a manner that the nodes within an interaction term that host the actions that are executed are progressively (at each small-step) replaced by the empty interaction ∅. Also, when executing actions that are found within loops, the interaction term is complexified with the addition of new nodes that correspond to a duplication of the sub-interaction underneath the loop that is instanciated. This results in an accumulation of useless nodes which increases with each application of a small-step. In other words, and informally, interactions may become less and less "canonic" during their executions, especially when they contain loops.

seq loop H seq strict l 1 !m 1 l 2 ?m 1 seq alt strict l 2 !m 2 l 3 ?m 2 ∅ l 2 !m 3 par l 1 !m 1 strict l 3 !m 4 l 1 ?m 4 ↓ l 3 !m 4 @221 seq loop H seq strict l 1 !m 1 l 2 ?m 1 seq ∅ l 2 !m 3 par l 1 !m 1 strict ∅ l 1 ?m 4 ↓ l 1 !m 1 @1111 seq seq seq strict ∅ l 2 ?m 1 seq ∅ l 2 !m 3 loop H seq strict l 1 !m 1 l 2 ?m 1 seq ∅ l 2 !m 3 par l 1 !m 1 strict ∅ l 1 ?m 4 ↓ l 1 !m 1 @21 seq seq seq strict ∅ l 2 ?m 1 seq ∅ l 2 !m 3 ∅ par ∅ strict ∅ l 1 ?m 4 seq loop H seq strict l 1 !m 1 l 2 ?m 1 seq alt strict l 2 !m 2 l 3 ?m 2 ∅ l 2 !m 3 par l 1 !m 1 strict l 3 !m 4 l 1 ?m 4 ↓ l 3 !m 4 @221 seq loop H seq strict l 1 !m 1 l 2 ?m 1 l 2 !m 3 par l 1 !m 1 l 1 ?m 4 ↓ l 1 !m 1 @1111 seq seq seq l 2 ?m 1 l 2 !m 3 loop H seq strict l 1 !m 1 l 2 ?m 1 l 2 !m 3 par l 1 !m 1 l 1 ?m 4 ↓ l 1 !m 1 @21 seq seq l 2 ?m 1 l 2 !m 3 l 1 ?m 4
Let us indeed consider the illustration from Fig. 6.5, which details two possible successions of transformations starting from the same initial interaction which is the example of Fig. 6.3.

The example on the left of Fig. 6.5 consists in the exploration using σ e of a path in the execution tree of the initial interaction, which reveals that l 3 !m 4 .l 1 !m 1 .l 1 !m 1 is a prefix of an (at least one) accepted trace. We can see however that at each execution of a small-step, redundant ∅ nodes are added, and, in the interaction term that is reached at the end of the path, many such occurrences of redundant ∅ nodes are present.

Removing those redundant ∅ (among other potential simplifications) would allow an implementation of the semantics to work with simplified, more compact interaction terms. Working with simpler terms would in turn improve overall performances given that it both reduces the memory footprint and the length of the traversals for computing inductive predicates on the terms.

On the example on the right of Fig. 6.5 is represented the execution of the same (prefix of) trace from the same initial interaction. However, in this case, we have used some simplifications when defining each intermediate interaction term. The resulting term at the end of the path is here simpler and more compact than the one reached in the example on the left.

In the following we define two manners of defining a (proven correct) execution semantics which incorporate such simplifications. Doing so involves results from equational logic and term rewriting which we have covered in Chap.4.

Normalizing intermediate interaction terms

In Chap. 4 we have defined a process to normalize interaction terms. Let us recall that, for any interaction i we may denote by R ≺ (i) its unique normal form through the rewriting process (given the three phases

R 1 I , R 2
I and R 3 I for simplifications and the total rewrite order ≺ I for selecting a unique represent in the AC-equivalence class).

A first obvious method for incorporating simplifications into the execution semantics is to normalize each intermediate interaction term. Doing so leads to defining the semantics which we denote by σ n (for "normalizing") from Def.6.8

Definition 6.8: Normalizing execution semantics

We define σ n : I Ω → P(T Ω ) and (the tool function) sem : I Ω → P(T Ω ) as:

σ n : i → sem(R(i))
and

sem : i → empty(i) ∪ p∈frt(i) i |p .σ n (exe(i, p))
with empty from Def.6.7 and R from Chap.4

The "normalizing" execution semantics that is thus defined is correct w.r.t. the previous semantics, which we state in Th.6.4.

Theorem 6.4: Correctness of the normalizing execution semantics

For any interaction i ∈ I Ω :

σ n (i) = σ e (i)
Proof. Let us proceed by induction on a member trace t:

• if t = then ∈ σ n (i)
-→ i imply that R ≺ (i) a -→ R ≺ (i ) and the fact that t ∈ σ n (i ) = σ n (R ≺ (i )) imply that a.t ∈ σ n (R ≺ (i)) = σ n (i)
However, we might argue that this algorithmicized semantics may have high overhead costs due to the fact that, in between each step of execution, we normalize the follow-up interaction which involves trying to find redexes and which can be costly.

As a result, in the next section, we propose another execution semantics with simplifications, which, instead of simplifying a-posteriori the i such that i a -→ i merges the simplification with the process of reconstructing i itself. As we will see this can be very simply done by introducing modifications in the inductive definitions of the pruning and execution functions.

Simplifying while computing the intermediate interaction terms

As mentioned previously, we can define variants of the prune and execution functions which introduce term simplification in their inductive definitions. As mentioned previously, we formalize this process by defining a prn ≈ and a exe ≈ function.

I Ω × L → I Ω is s.t. for any (i, l) ∈ I Ω × L verifying ↓ × × (i, l): • provided ↓ × × (i, l) then prn ≈ (i, l) = match i with | ∅ → ∅ | a ∈ A Ω → a | alt(i 1 , i 2 ) →            prn ≈ (i 2 , l) if ↓ × × (i 2 , l) ∧ ¬ ↓ × × (i 1 , l) prn ≈ (i 1 , l) if ↓ × × (i 1 , l) ∧ ¬ ↓ × × (i 2 , l) alt(prn ≈ (i 1 , l), prn ≈ (i 2 , l)) if ↓ × × (i 1 , l) ∧ ↓ × × (i 2 , l) | f (i 1 , i 2 ) →            prn ≈ (i 2 , l) if prn ≈ (i 1 , l) = ∅ prn ≈ (i 1 , l) if prn ≈ (i 2 , l) = ∅ f (prn ≈ (i 1 , l), prn ≈ (i 2 , l)) else for f ∈ {strict, seq, par} | loop k (i 1 ) →      loop k (prn ≈ (i 1 , l)) if ↓ × × (i 1 , l) and prn ≈ (i 1 , l) = ∅ ∅ else for k ∈ {S, H, W, P }
The new prn ≈ function from Def.6.9 operates the pruning process with simplifications. We characterize this new prn ≈ function w.r.t. prn in Lem.6.6. An interaction term prn ≈ (i, l) resulting from the application of this new pruning process being equivalent according to ≈ E I to prn(i, l).

Lemma 6.6: Characterization of pruning with simplifications

For any interaction i ∈ I Ω and any l ∈ L such that i ↓ × × l we have:

prn(i, l) ≈ E I prn ≈ (i, l)
Proof. Let us reason by induction on the term structure of i

• if i = ∅ then prn(i, l) = ∅ and prn ≈ (i, l) = ∅ then ≈ E I being reflexive, the property holds

• if i = a ∈
A Ω which implies that θ(a) = l then prn(i, l) = a and prn ≈ (i, l) = a and then ≈ E I being reflexive, the property holds

• if i = alt(i 1 , i 2 ) then: -if ↓ × × (i 2 , l) ∧ ¬ ↓ × × (i 1 , l) then prn(i, l) = prn(i 2 , l) and prn ≈ (i, l) = prn ≈ (i 2 , l).
We can then apply the induction hypothesis on i 2 which implies that prn(i 2 , l) ≈ E I prn ≈ (i 2 , l) and therefore the property holds

-if ↓ × × (i 1 , l) ∧ ¬ ↓ × × (i 2 , l
) then prn(i, l) = prn(i 1 , l) and prn ≈ (i, l) = prn ≈ (i 1 , l). We can then apply the induction hypothesis on i 1 which implies that prn(i 1 , l) ≈ E I prn ≈ (i 1 , l) and therefore the property holds

-if ↓ × × (i 1 , l) ∧ ↓ × × (i 2 , l) then prn(i, l) = alt(prn(i 1 , l), prn(i 2 , l)) and prn ≈ (i, l) = alt(prn ≈ (i 1 , l), prn ≈ (i 2 , l)).
We can then apply the induction hypothesis on both i 1 and i 2 , and, given that ≈ E I is F-compatible (congruence), the property holds

• if i = f (i 1 , i 2 )
with f ∈ {strict, seq, par} then we have prn(i, l) = f (prn(i 1 , l), prn(i 2 , l)) and, as per the induction hypothesis on i 1 and i 2 we have both prn(i 1 , l)

≈ E I prn ≈ (i 1 , l) and prn(i 2 , l) ≈ E I prn ≈ (i 2 , l)
and then:

-if prn ≈ (i 1 , l) = ∅ then: prn ≈ (i, l) = prn ≈ (i 2 , l) ≈ E I f (∅, prn ≈ (i 2 , l)) (as per Simpl-Left) ≈ E I f (prn(i 1 , l), prn(i 2 , l)) ≈ E I prn(i, l)
hence the property holds

-if prn ≈ (i 2 , l) = ∅ then: prn ≈ (i, l) = prn ≈ (i 1 , l) ≈ E I f (prn ≈ (i 1 , l), ∅) (as per Simpl-Right) ≈ E I f (prn(i 1 , l), prn(i 2 , l)) ≈ E I prn(i, l)
hence the property holds else the property is implied by the fact that

≈ E I is F-compatible (congruence) • if i = loop k (i 1 )
with k ∈ {S, H, W, P }, we have, as per the induction hypothesis that prn(i 1 , l) ≈ E I prn ≈ (i 1 , l) and then:

-if ↓ × × (i 1 , l) then prn(i, l) = loop k (prn(i 1 , l)) and: * if prn ≈ (i 1 , l) = ∅ then prn ≈ (i) = loop k (prn ≈ (i 1 , l))
and the property holds because

≈ E I is a congruence * if prn ≈ (i 1 , l) = ∅ then: prn ≈ (i, l) = ∅ ≈ E I loop k (∅)
(as per Loop-Simpl)

≈ E I loop k (prn(i 1 , l)) ≈ E I prn(i, l) -else then prn(i, l) = ∅ = prn ≈ (i, l)
As a result, pruning with simplification that we defined in Def.6.9 is equivalent (in the sens of ≈ E I ) to the original pruning.

In the same spirit, we define in Def.6.10 a variant of the execution function exe ≈ that incorporates simplification steps. We then prove with Lem.6.7 that this new execution with simplifications is equivalent (in the sens of ≈ E I ) to the original. Definition 6.10: Execution with simplifications exe ≈ : I Ω × {1, 2} * → I Ω is the function s.t. for any i ∈ I Ω and p ∈ frt(i):

• exe ≈ (i, p) = match (i, p) with | (act, ) → ∅ | (alt(i 1 , i 2 ), 1.p 1 ) → exe ≈ (i 1 , p 1 ) | (alt(i 1 , i 2 ), 2.p 2 ) → exe ≈ (i 2 , p 2 ) | (strict(i 1 , i 2 ), 1.p 1 ) →      strict(exe ≈ (i 1 , p 1 ), i 2 ) if exe ≈ (i 1 , p 1 ) = ∅ i 2 else | (strict(i 1 , i 2 ), 2.p 2 ) → exe ≈ (i 2 , p 2 ) | (seq(i 1 , i 2 ), 1.p 1 ) →      seq(exe ≈ (i 1 , p 1 ), i 2 ) if exe ≈ (i 1 , p 1 ) = ∅ i 2 else | (seq(i 1 , i 2 ), 2.p 2 ) →            exe ≈ (i 2 , p 2 ) if prn(i 1 , θ(i 2|p2 )) = ∅ prn(i 1 , θ(i 2|p2 )) if exe ≈ (i 2 , p 2 ) = ∅ seq(prn(i 1 , θ(i 2|p2 )), exe ≈ (i 2 , p 2 )) if both are not ∅ | (par(i 1 , i 2 ), 1.p 1 ) →      par(exe ≈ (i 1 , p 1 ), i 2 ) if exe ≈ (i 1 , p 1 ) = ∅ i 2 else | (par(i 1 , i 2 ), 2.p 2 ) →      par(i 1 , exe ≈ (i 2 , p 2 )) if exe ≈ (i 2 , p 2 ) = ∅ i 1 else | (loop S (i 1 ), 1.p 1 ) →      strict(exe ≈ (i 1 , p 1 ), i) if exe ≈ (i 1 , p 1 ) = ∅ i else | (loop H (i 1 ), 1.p 1 ) →      seq(exe ≈ (i 1 , p 1 ), i) if exe ≈ (i 1 , p 1 ) = ∅ i else | (loop W (i 1 ), 1.p 1 ) →                  seq(prn(i, θ(i 1|p1 )), seq(exe ≈ (i 1 , p 1 ), i)) if exe≈ (i 1 ,p 1 ) =∅ and prn(i,θ(i 1|p 1 )) =∅ seq(exe ≈ (i 1 , p 1 ), i) if exe≈ (i 1 ,p 1 ) =∅ and prn(i,θ(i 1|p 1 ))=∅ seq(prn(i, θ(i 1|p1 )), i) if exe≈ (i 1 ,p 1 )=∅ and prn(i,θ(i 1|p 1 )) =∅ i if exe≈ (i 1 ,p 1 )=prn(i,θ(i 1|p 1 ))=∅ | (loop P (i 1 ), 1.p 1 ) →      par(exe ≈ (i 1 , p 1 ), i) if exe ≈ (i 1 , p 1 ) = ∅ i else Lemma 6

.7: Characterization of execution with simplifications

For any interaction i ∈ I Ω and any frontier position p ∈ f ront(i) we have:

exe(i, p) ≈ E I exe ≈ (i, p)
Proof. As for the proof of Lem.6.6 we can proceed by induction. For the case where i = seq(i 1 , i 2 ) and p = 2.p 2 and for the case i = loop W (i 1 ) and p = 1.p 1 we apply Lem.6.6 related to pruning.

Finally, we define the execution semantics with simplifications in Def.6.11. This new semantics makes use of the prn ≈ and exe ≈ functions to incorporate simplification during the computation of intermediate interactions. We then prove in Th.6.5 that this new variant of the execution semantics, which we denote by σ≈ e is equivalent to σ e and therefore to all the previously defined semantics.

Definition 6.11: Execution semantics with simplifications

We define σ≈ e : I Ω → P(T Ω ) as:

σ≈ e (i) = empty(i) ∪ p∈f ront(i) i |p .σ≈ e (exe ≈ (i, p))
with empty from Def.6.7

Theorem 6.5: Correctness of the simplifying execution semantics

For any interaction i ∈ I Ω :

σ e (i) = σ≈ e (i)
Proof. Let us prove both inclusions:

⊆ Let us consider t ∈ σ e (i) and let us reason by induction on the trace t: We have therefore defined a "simplifying" execution semantics which guarantees that we won't have useless ∅ nodes that accumulate during execution. This σ≈ e semantics makes use of simplifications that are incorporated in the inductive definitions of the prune and execution functions. We argue that this semantics might have less overhead costs than the "normalizing" execution semantics σ n from the previous section.

-if t = then t ∈ σ e (i)
However, unlike σ n , which guarantees that each intermediate term is a normal form, σ≈ e offers no such guarantee.

Conclusion

In this chapter we have redefined the operational semantics from Chap.5 in the style of functional programming languages and with the added benefit of being able to separate concerns between the evaluation of which actions are immediately executable (the frontier of execution) and the computation the the follow-up interaction issued from the execution of a specific action at a specific position (the execution function).

Separating those concerns allows to reduce overhead whenever we do not need to compute all follow-up interactions. For instance we may only want to compute follow-ups resulting from executions of frontier actions that match a certain action (there can be several occurrences at distinct positions). We have proven this algorithmicized "execution semantics" to be equivalent to the previously defined trace semantics. In addition, to further reduce potential overheads, we defined two variants of the execution semantics: a "normalizing execution semantics" and a "simplifying execution semantics" which respectively use results from equational logic and term rewriting from Chap.4 in order to guarantee working with intermediate interaction terms (that are computed during the exploration of the execution tree) that are kept simple and compact.

Given that all the previously defined trace semantics (σ d from Chap.4, σ o from Chap.5 and σ e , σ n and σ e ≈ from this chapter) have been proven to be equivalent, in the remainder of this manuscript, we will simply use the notation σ to refer to the trace semantics of interactions.

Let us remark that the semantics that is implemented in the HIBOU tool presented in Chap.12 is σ≈ e .

However, in the remainder of this manuscript, we will rather use notations related to σ o (and sometimes σ d ) when presenting the formal verification algorithms that we have build on top of the semantics of interactions.

In the next chapter we extend the notion of the semantics of interactions to objects that are not traces but "multi-traces".

T Ω|C = c∈C T Ω|c
With, for any c ⊂ L:

T Ω|c = A * Ω|c and A Ω|c = {a ∈ A Ω | θ(a) ∈ c}

Inclusion of global traces & classical multi-traces in the new definition

The definition of generalized multi-traces in Def.7.1 encompasses that of both global traces (from Chap.4)

and "classical" multi-traces, defined such that each lifeline has its own component in the multi-trace as in [START_REF] Mahe | A small-step approach to multi-trace checking against interactions[END_REF].

If we consider the trivial partition C = (L) of L, then we have T Ω|(L) = T Ω and we recognise the definition of global traces. Indeed, a global trace is a generalized multi-trace in which there is a single co-localization which includes all the lifelines.

If we consider the discrete partition Ľ = ({l}) l∈L of L, then we recognize in T Ω| Ľ the definition of classical multi-traces (as per [START_REF] Mahe | A small-step approach to multi-trace checking against interactions[END_REF]). Indeed, every co-localization is reduced to a singleton, and reciprocally, every lifeline is associated with its own trace component.

In Fig. 7.1 are represented three multi-traces that are defined up to different partitions. All three multitraces describe the same execution of a given distributed system. However the level of detail regarding that description may vary in so far as the information regarding the ordering between events is of unequal quality:

• The multi-trace which has the most information is the one on the left, which corresponds to a global trace. Indeed, in that case, all lifelines are co-localized and as a result, the information regarding the order in which all events occurred globally is present. This multi-trace corresponds to the case in which the partition according to which it is defined is the trivial partition.

• The multi-trace which has the least amount of information about the execution of the distributed system is the one in the middle. This case corresponds to the one of classical multi-traces in which there is no information regarding the relative order in which events occurring on different lifelines occurred during the execution. This multi-trace corresponds to the case in which the partition according to which it is defined is the discrete partition.

• The multi-trace on the right is an intermediate case in which some information is gathered and some is lost. It corresponds to a case in which the partition is neither the trivial partition nor the discrete partition.

Notations

For any partition C of L, we will use the greek letter µ to designate a multi-trace from T Ω|C . And for any c ∈ C, we will denote by µ |c the trace component of µ corresponding to the co-localization c. We will also use a substitution notation µ[t] c to designate the multi-trace µ in which the component for co-localization c has been replaced by t ∈ T Ω|c . Additionally, we may denote by C the empty multi-trace ( ) c∈C ∈ T Ω|C .

Given a lifeline l ∈ L, there exists a unique co-localization c ∈ C such that l ∈ c. We denote by θ C (l) this unique co-localization. We extend this notation to any action a so that θ C (a) = θ C (θ(a)) to designate the unique co-localization in which action a occurs.

The F-algebra of multi-traces up to a partition

In Chap.4, we have seen that the set of sets of traces P(T Ω ), when fitted with the following set of operation symbols A Ω ∪ {{ }, ∪, ; , ;× × , ||, ; * , ; × × * , ;× × * , || * } has the structure of a F-algebra w.r.t. the term algebra I Ω of interactions. By analogy, we can define similar operations on the set of sets of multi-traces up to a partition P(T Ω|C ).

In the following, given a partition C ∈ Part(L) we introduce algebraic operators on P(T Ω|C ) so as to define the F-algebra of multi-traces.

Concatenation of multi-traces

At first, we need to define some finer notion of concatenation (compared to the classical ".") that acts on multi-traces. We do so in Def.7.2.

Definition 7.2: Appending actions on multi-traces

We define the:

• left concatenation law → C : A Ω × T Ω|C → T Ω|C
• and the right concatenation law

← C : T Ω|C × A Ω → T Ω|C
such that for any action a ∈ A and any µ ∈ T Ω|C we have:

a → C µ = µ[a.µ |θ C (a) ] θ C (a) and µ ← C a = µ[µ |θ C (a) .a] θ C (a)
Those concatenation laws respectively correspond to appending action a either to the left or to the right

a → C T = {a → C µ | µ ∈ T } and T ← C a = {µ ← C a | µ ∈ T }
Using the left and right concatenation laws, we define inductively the concatenation of two multi-traces.

Definition 7.3: Concatenation of multi-traces

We define C : T Ω|C × T Ω|C → T Ω|C so that for any two multi-traces µ 1 and µ 2 :

• if µ 2 = C then µ 1 C µ 2 = µ 1 • if µ 2 = a → C µ 2 then µ 1 C µ 2 = (µ 1 ← C a) C µ 2
We then extend it to sets of multi-traces with C : P(T Ω|C ) × P(T Ω|C ) → P(T Ω|C ) so that for any two sets of multi-traces T 1 and T 2 :

T 1 C T 2 = µ1∈T1 µ2∈T2 {µ 1 C µ 2 }
The C operator is trivially associative so that for any three multi-traces µ 1 , µ 2 and µ 3 , we have

µ 1 C (µ 2 C µ 3 ) = (µ 1 C µ 2 ) C µ 3
, which we may simply denote by µ 1 C µ 2 C µ 3 .

Strict sequencing for multi-traces

In Def.7.4, we define a strict sequencing operator ; C on multi-trace via the application of the strict sequencing operator ; on each local trace component.

Definition 7.4: Strict sequencing for multi-traces

We define ; C : T Ω|C × T Ω|C → P(T Ω|C ) so that for any two of multi-traces µ 1 and µ 2 :

µ 1 ; C µ 2 = {µ ∈ T Ω|C | ∀ c ∈ C, µ |c ∈ (µ 1|c ; µ 2|c )}
We then extend it to sets of multi-traces with ; C : P(T Ω|C ) × P(T Ω|C ) → P(T Ω|C ) such that for any two sets of multi-traces T 1 and T 2 :

T 1 ; C T 2 = µ1∈T1 µ2∈T2 (µ 1 ; C µ 2 )
We can then show that the operator that is thus defined describes the same notion of concatenation than the C operator. However, while C is defined inductively in the world of multi-traces via the successive appending and removing of actions using → C and ← C , the ; C operator is defined by reconstructing individually every local component of the multi-trace using ";".

Lemma 7.1: Strict sequencing on multi-traces is multi-trace concatenation

For any two multi-traces µ 1 and µ 2 :

µ 1 ; C µ 2 = {µ 1 C µ 2 } i.e. (µ 1|c ; µ 2|c ) c∈C = µ 1 C µ 2
Proof. Let us reason by induction on µ 2 :

• for µ 2 = C we have:

(µ 1|c ; C|c ) c∈C = (µ 1|c ; ) c∈C = (µ 1|c ) c∈C = µ 1 = µ 1 C C • for µ 2 = a → C µ 2 = a → C ( C C µ 2 ) = (a → C C ) C µ 2 = C [a] θ C (a) C µ 2 we have: (µ 1|c ; ( C [a] θ C (a) C µ 2 ) |c ) c∈C = ((µ 1|c ; ( C [a] θ C (a) ) |c ) ; µ 2|c ) c∈C = (µ 1|c ; ( C [a] θ C (a) ) |c ) c∈C C (µ 2|c ) c∈C = ((µ 1 [µ 1|θ C (a) .a] θ C (a) ) |c ) c∈C C µ 2 = µ 1 [µ 1|θ C (a) .a] θ C (a) C µ 2 = (µ 1 ← C a) C µ 2 = µ 1 C (a → C µ 2 )
As a result, even though they are not defined in the same manner, both the C and ; C operators describe the same notion of concatenating multi-traces. In the following we may therefore use them interchangeably.

The notation ; C can be used to keep in line with the notations from Chap.4 which are inspired from [START_REF] Knapp | UML Interactions Meet State Machines -An Institutional Approach[END_REF] and to clearly relate this symbol to the notion of strict sequencing. The notation C can be used more trivially to manipulate multi-traces in a more general context.

However, having at disposal both definitions i.e. both manners of understanding multi-trace concatenation (from a global or a local point of view) can have some practical uses:

• We may notably use the inductive definition of C in proofs or to define prefixes of multi-traces.

• The definition of ; C , which makes use of ; can be used to relate both operators.

Interleaving on multi-traces

We also extend interleaving to multi-traces with C corresponding to the application of the interleaving || on each local component.

Definition 7.5: Interleaving for multi-traces

We define C : T Ω|C × T Ω|C → T Ω|C so that for any two of multi-traces µ 1 and µ 2 :

µ 1 C µ 2 = {µ ∈ T Ω|C | ∀ c ∈ C, µ |c ∈ (µ 1|c || µ 2|c )}
We then extend it to sets of multi-traces with C : P(T Ω|C ) × P(T Ω|C ) → P(T Ω|C ) such that for any two sets of multi-traces T 1 and T 2 :

T 1 C T 2 = µ1∈T1 µ2∈T2 (µ 1 C µ 2 )
It is notable that we can characterize C as is done in Lem.7.2.

Lemma 7.2: Characterization of interleaving on multi-traces

For any µ 1 and µ 2 in T Ω|C and any a 1 and a 2 in A Ω :

C C µ 2 = {µ 2 } µ 1 C C = {µ 1 } (a 1 → C µ 1 ) C (a 2 → C µ 2 ) =    {a 1 → C µ | µ ∈ µ 1 C (a 2 → C µ 2 )} ∪ {a 2 → C µ | µ ∈ (a 1 → C µ 1 ) C µ 2 }   
Proof. Let us prove each point:

• we have that:

C C µ 2 = {µ ∈ T Ω|C | ∀ c ∈ C, µ |c ∈ (( C ) |c || µ 2|c )} = {µ ∈ T Ω|C | ∀ c ∈ C, µ |c ∈ ( || µ 2|c )} = {µ ∈ T Ω|C | ∀ c ∈ C, µ |c = µ 2|c } = {µ ∈ T Ω|C | µ = µ 2 } = {µ 2 } • likewise µ 1 C C = {µ 1 }
• we have:

(a 1 → C µ 1 ) C (a 2 → C µ 2 ) = {µ ∈ T Ω|C | ∀ c ∈ C, µ |c ∈ ((a 1 → C µ 1 ) |c || (a 2 → C µ 2 ) |c )} then: -if θ C (a 1 ) = θ C (a 2 ) = c a : T = (a 1 → C µ 1 ) C (a 2 → C µ 2 ) =      µ ∈ T Ω|C ∀ c ∈ C \ {c a }, µ |c ∈ µ 1|c || µ 2|c µ |ca ∈ a 1 .µ 1|ca || a 2 .µ 2|ca      =            µ ∈ T Ω|C ∀ c ∈ C \ {c a }, µ |c ∈ µ 1|c || µ 2|c µ |ca ∈    {a 1 .t | t ∈ µ 1|ca || a 2 .µ 2|ca } ∪ {a 2 .t | t ∈ a 1 .µ 1|ca || µ 2|ca }               =      µ ∈ T Ω|C ∀ c ∈ C, µ |c ∈    {(a 1 → C µ) c | µ ∈ µ 1 a 2 → C µ 2 } ∪ {(a 2 → C µ) c | µ ∈ a 1 → C µ 1 µ 2 }         =    {a 1 → C µ | µ ∈ µ 1 C (a 2 → C µ 2 )} ∪ {a 2 → C µ | µ ∈ (a 1 → C µ 1 ) C µ 2 }    -the case for θ C (a 1 ) = θ C (a 2
) can be proven similarly

Weak sequencing on multi-traces

We also define weak sequencing × × C on multi-traces via the application of the weak sequencing ;× × on each local trace component.

Definition 7.6: Weak sequencing for multi-traces

We define × × C : T Ω|C × T Ω|C → P(T Ω|C ) so that for any two of multi-traces µ 1 and µ 2 :

µ 1 × × C µ 2 = {µ ∈ T Ω|C | ∀ c ∈ C, µ |c ∈ (µ 1|c ;× × µ 2|c )}
We then extend it to sets of multi-traces with × × C : P(T Ω|C ) × P(T Ω|C ) → P(T Ω|C ) such that for any two sets of multi-traces T 1 and T 2 :

T 1 × × C T 2 = µ1∈T1 µ2∈T2 (µ 1 × × C µ 2 )
However we do not provide any characterization for this operator.

Closures of scheduling operators on multi-traces

By analogy to the results from Chap.4, let us also define the three Kleene closures for the ; C , × × C and C operators.

Definition 7.7: Kleene closures for multi-traces

For any scheduling operator ∈ { ; C , × × C , C }, we define, for any set of multi-traces T ∈ P(T Ω|C ): 1) for j > 0

T 0 = { C } T j = T T (j-
T * = j∈N T j
We have seen in Chap.4 that the Head-First closure of weak sequencing is uniquely defined. As a result, let us also define an analogue of this operator on multi-traces.

Definition 7.8: Weak HF-closure for multi-traces

We define × × C : P(T Ω|C ) × P(T Ω|C ) → P(T Ω|C ) s.t. for any two sets of multi-traces T 1 and T 2 :

T 1 × × C T 2 =      µ ∈ T 1 × × C T 2 (µ = a → C µ ) ⇒   ∃ µ 1 ∈ T Ω|C s.t. (a → C µ 1 ∈ T 1 ) ∧ (µ ∈ {µ 1 } × × C T 2 )         We then define × × C * as the K-closure of × × C .

Algebraic considerations

Similarly to the operators on traces from Chap.4, it follows that the previously defined operators on multitraces present some interesting algebraic properties. For instance, those properties include, among others, that: ; C and × × C are associative or that C is associative commutative.

We will not enter into the details here but, in fact, all of the properties defined in Chap.4 for operators on traces also apply to their respective counterparts on multi-traces.

The set of sets of multi-traces P(T Ω|C ) then admits the structure of a F-algebra as defined in Def.7.9.

Definition 7.9: Semantic domain P(T Ω|C ) as a F-algebra

A C = (P(T Ω|C ), F A C (with F A C = {f A C | f ∈ F})
is the F-algebra of carrier P(T Ω|C ) and the following interpretations of the operation symbols in F:

∅ A C = { C } a A C = {a → C C } strict A C = ; C seq A C = × × C par A C = C alt A C = ∪ loop A C S = ; C * loop A C H = × × C * loop A C W = × × C * loop A C P = C *
The case of the trivial partition

In the case of the trivial partition C = {L} i.e. when we have a single co-localization which gathers all lifelines then A C is isomorph w.r.t. A i.e. we have a bijective homomorphism between the two F-algebras.

For all intents and purposes manipulating multi-traces defined on the trivial partition is then equivalent to manipulating global traces.

The case of the discrete partition

In the case of the discrete partition Ľ of lifelines, the × × Ľ and ; Ľ operators behave identically as stated in Lem.7.3.

Lemma 7.3: Equivalence of multi-trace weak and strict sequencing on the discrete partition

For any signature Ω = (L, M ), for any µ 1 and µ 2 in T Ω| Ľ we have:

µ 1 × × Ľµ 2 = µ 1 ; Ľµ 2
Proof. Indeed:

• in any given co-localization c = {l} ∈ Ľ, for any t 1 and t 2 from T Ω|{l} we have t 1 ;× × t 2 = t 1 ; t 2 given that it is not possible to interleave any actions using weak sequence because they all occur on the same lifeline.

• which implies that:

µ 1 × × µ 2 = {µ ∈ T Ω| Ľ | ∀ l ∈ L, µ |{l} ∈ (µ 1|{l} ;× × µ 2|{l} )} = {µ ∈ T Ω| Ľ | ∀ l ∈ L, µ |{l} ∈ (µ 1|{l} ; µ 2|{l} )} = µ 1 ; µ 2
This last result can be extended to conclude that the strict and weak K-closures and the weak HF-closure also behave identically on the discrete partition (Lem.7.4).

Lemma 7.4: Equivalent repetition operators on the discrete partition

For any signature Ω = (L, M ), for any set of multi-traces T ∈ T Ω| Ľ up to the discrete partition:

T ; Ľ * = T × × Ľ * = T × × Ľ *
Proof. Implied by Lem.7.3.

This means that weak and strict sequencing are indistinguishable when observing multi-traces defined up to the discrete partition.

Projecting traces

The F-algebras A of sets of traces and the F-algebras A C of sets of multi-traces up to a partition C ∈ Part(L)

have similar algebraic structures.

In this section we discuss the possibility of relating those two F-algebras via a projection operator which projects traces into multi-traces. We will see that depending on which is the partition C, this projection may or may not preserve algebraic structures.

The projection function

In Def.7.10 we define a proj C function for projecting global traces into multi-traces defined up to a partition C.

Definition 7.10: Trace Projection

For any signature Ω = (L, M ) and any partition C ∈ Part(L), we define proj C : T Ω → T Ω|C such that: For any partition C ∈ Par(L), the projection function proj C is always surjective but not necessarily injective. Indeed, several global traces can be projected into the same multi-trace. Let us for instance consider, given

• proj C ( ) = C the empty multi-trace C = ( ) c∈C • for any t ∈ T Ω and any a ∈ A Ω , if proj C (t) = µ then proj C (a.t) = a → µ i.e. given c = θ C (a)
L = {l 1 , l 2 } and C = ({l 1 }, {l 2 }), the global traces t α = l 1 !m.l 2 !m and t β = l 2 !m.l 1 !m. We then have proj C (t α ) = proj C (t β ) = (l 1 !m, l 2 !m).
Given that multi-traces do not specify any order between events occurring on different co-localizations, the global order l 1 !m < l 2 !m specified in t α and the global order l 2 !m < l 1 !m specified in t β is not preserved after the projection as a multi-trace of T Ω|C .

We extend the projection function to sets of traces in Def.7.11.

Definition 7.11: Extensions of trace projection

We extend proj C to sets of traces as proj C : P(T Ω ) → P(T Ω|C ) such that for any set T of traces:

proj C (T ) = {proj C (t) | t ∈ T }

Preservation of algebraic structures

As we hinted earlier, the projection function proj C preserves some (but not all) algebraic structure of A into A C . In the following we explain which structures are preserved and which are not.

As stated in Lem.7.5, strict sequencing and interleaving are preserved by projection.

Lemma 7.5: Projection preserves strict sequencing & interleaving

For any traces t 1 and t 2 :

proj C (t 1 ; t 2 ) = proj C (t 1 ) ; proj C (t 2 ) proj C (t 1 ||t 2 ) = proj C (t 1 ) proj C (t 2 )
And hence, for any sets of traces T 1 and T 2 :

proj C (T 1 ; T 2 ) = proj C (T 1 ) ; proj C (T 2 ) proj C (T 1 ||T 2 ) = proj C (T 1 ) proj C (T 2 )
Proof. Let us consider traces t 1 and t 2 .

Let us start by the strict sequencing. We reason by induction on the trace t 1 :

• when t 1 = we have:

proj C ( ; t 2 ) = proj C (t 2 ) = C ; proj C (t 2 ) = proj C ( ) ; proj C (t 2 )
• when t 1 = a.t 1 we have:

proj C ((a.t 1 ); t 2 ) = proj C ({a.t | t ∈ t 1 ; t 2 }) = {proj C (a.t) | t ∈ t 1 ; t 2 } = {a → proj C (t) | t ∈ t 1 ; t 2 } = a → proj C (t 1 ; t 2 ) = a → (proj C (t 1 ) ; proj C (t 2 )) induction hypothesis = (a → proj C (t 1 )) ; proj C (t 2 ) = proj C (a.t 1 ) ; proj C (t 2 )
Let us now consider the interleaving and let us reason by induction on both t 1 and t 2 :

• when t 1 = we have:

proj C ( ||t 2 ) = proj C (t 2 ) = C proj C (t 2 ) = proj C ( ) proj C (t 2 )
• when t 2 = we have:

proj C (t 1 || ) = proj C (t 1 ) = proj C (t 1 ) C = proj C (t 1 ) proj C ( )
• when t 1 = a 1 .t 1 and t 2 = a 2 .t 2 we have:

proj C ((a 1 .t 1 )||(a 2 .t 2 )) = proj C ({a 1 .t | t ∈ t 1 ||(a 2 .t 2 )} ∪ {a 2 .t | t ∈ (a 1 .t 1 )||t 2 }) = a 1 → C proj C (t 1 ||(a 2 .t 2 )) ∪ a 2 → C proj C ((a 1 .t 1 )||t 2 ) (induction) = a 1 → C (proj C (t 1 ) proj C (a 2 .t 2 )) ∪ a 2 → C (proj C (a 1 .t 1 ) proj C (t 2 )) =    a 1 → C (proj C (t 1 ) (a 2 → C proj C (t 2 ))) ∪ a 2 → C ((a 1 → C proj C (t 1 )) proj C (t 2 ))    (Lem.7.2) = (a 1 → C proj C (t 1 )) (a 2 → C proj C (t 2 )) = proj C (a 1 .t 1 ) proj C (a 2 .t 2 )
Given that the algebraic structures of strict sequencing and interleaving are preserved by projection, it comes that repetitions of those structures with their Kleene closures are also preserved by projection. We state this in Lem.7.6.

Lemma 7.6: Projection preserves strict and interleaving K-closures

For any set of traces T :

proj C (T ; * ) = proj C (T ) ; * proj C (T || * ) = proj C (T ) *
Proof. Implied by Lem.7.5

However, weak sequencing is not preserved. It suffices to consider the following example, with L = {l 1 , l 2 , l 3 } and the partition C = ({l 1 , l 2 }, {l 3 }). Here we have:

proj C ({l 1 !m 1 .l 3 ?m 1 };× × {l 3 !m 2 .l 2 ?m 2 }) = proj C ({l 1 !m 1 .l 3 ?m 1 .l 3 !m 2 .l 2 ?m 2 }) =         l 1 !m 1 .l 2 ?m 2 , l 3 ?m 1 .l 3 !m 2        
However:

proj C ({l 1 !m 1 .l 3 ?m 1 }) × × C proj C ({l 3 !m 2 .l 2 ?m 2 }) =         l 1 !m 1 , l 3 ?m 1         × × C         l 2 ?m 2 , l 3 !m 2         =         l 1 !m 1 .l 2 ?m 2 , l 3 ?m 1 .l 3 !m 2    ,    l 2 ?m 2 .l 1 !m 1 , l 3 ?m 1 .l 3 !m 2        
In the world of interactions, this example corresponds to the diagram given on Fig. 7.2. We have indeed that the semantics of this interaction is the weak sequencing of l 1 !m 1 .l 3 ?m 1 which is the passing of message m 1 followed by l 3 !m 2 .l 2 ?m 2 which is the passing of message m 2 . On co-localization {l 1 , l 2 } we are therefore supposed to observe at first l 1 !m 1 and then l 2 ?m 2 . Observing the reception of m 2 i.e. l 2 ?m 2 at first is impossible because its emission must occur after the reception of m 1 . However, when projecting onto multitraces, the information pertaining to this chain of causality is lost, which is why in the second computation, using × × C , the interleaving between l 1 !m 1 and l 2 ?m 2 is authorized. We generalize those remarks on the inclusion of projected weak sequences in Lem.7.7.

Lemma 7.7: Inclusion of projected weak sequences

For any traces t 1 and t 2 , any sets of traces T 1 , T 2 and T :

proj C (t 1 ;× × t 2 ) ⊂ proj C (t 1 ) × × proj C (t 2 ) proj C (T 1 ;× × T 2 ) ⊂ proj C (T 1 ) × × proj C (T 2 ) proj C (T ;× × * ) ⊂ proj C (T ) × × * proj C (T ; × × * ) = proj C (T ) × × *
Proof. We can reason in terms of which interleavings are allowed or not allowed. More formally, we can proceed by induction on traces t 1 and t 2 similarly as what we did for Lem.7.5.

We can conclude that, in the general case of any partition C ∈ Part(L), the projection function proj C is not a homomorphism between A and A C because weak sequencing (and therefore its K-closure and HFclosure) is not preserved.

However, as we have seen with Lem.7.3 and Lem.7.4, in the case of the discrete partition, all the problematic operators related to weak sequencing behave like their strict counterpart. As a result, and in that case, proj Ľ on the discrete partition is a homomorphism between A and A Ľ. Also, and more trivially, in the case of the trivial partition {L}, proj {L} is also a homomorphism between A and A {L} . Those two remarks are illustrated on Fig. 7.3.

Semantics of accepted multi-traces

In this section we define two different semantics of "accepted" multi-traces: an algebraic multi-trace semantics defined as a homomorphism between I Ω and P(T Ω|C ) and a projected multi-trace semantics defined as the composition of proj C and σ. We then explain how those two semantics can be related.

  P(T Ω ),    { }, {a}, ∪, ; , ;× × , ||, ; * , ; × × * , ;× × * , || *        P(TΩ|{L}),      { {L} }, {a → {L} {L} }, ∪, ; {L} , × × {L} , {L} , ; {L} * , × × {L} * , × × {L} * , {L} *         proj {L}   P(T Ω ),    { }, {a}, ∪, ; , ;× × , ||, ; * , ; × × * , ;× × * , || *        P(T Ω| Ľ),      { Ľ}, {a → Ľ Ľ}, ∪, ; Ľ, × × Ľ, Ľ, ; Ľ * , × × Ľ * , × × Ľ * , Ľ *         proj Ľ Figure 7
.3: Extreme cases where proj C is a homomorphism

Algebraic multi-trace semantics

In Chap.4 we defined the trace semantics σ in denotational-style semantics as a homomorphism between the term algebra I Ω and the F-algebra A of sets of traces. In the same manner, we can define a multi-trace semantics σ C in denotational-style as a homomorphism between the term algebra I Ω and the F-algebra A C of sets of multi-traces.

Definition 7.12: Algebraic multi-trace semantics

σ C : I Ω → P(T Ω|C ) is defined as the unique F-homomorphism between T F = I Ω and A C = (P(T Ω|C ), F A C )
In the same manner as σ is the initial homomorphism between I Ω and A, σ C is the initial homomorphism between I Ω and A C , as illustrated on Fig. 7.4.

  I Ω ,    ∅, a ∈ A Ω , alt, strict, seq, par loop S , loop H , loop W , loop P        P(TΩ|C),      { C }, {a → C C }, ∪, ; C , × × C , C , ; C * , × × C * , × × C * , C *         homomorphism σ C (denotational semantics)

Multi-trace semantics by projection

By contrast, we can define another semantics of multi-traces, as the projection of the trace semantics. We define this semantics by projection in Def.7.13.

Definition 7.13: Projected multi-trace semantics

σ |C : I Ω → P(T Ω|C ) is such that for any i ∈ I Ω :

σ |C (i) = proj C (σ(i))
This "projected" multi-trace semantics benefits from results that we have proven for the trace semantics.

We notably have the property stated in Lem.7.8.

Lemma 7.8: A characterization of projected multi-trace semantics

For any interaction i ∈ I Ω we have that:

∀ (a, µ , i ),    (µ ∈ σ |C (i )) ∧ (i a -→ i )    ⇒ (a → C µ ∈ σ |C (i))
And:

∀ (µ),    (µ ∈ σ |C (i)) ∧ (µ = C )    ⇒       ∃ (a, µ , i ), (µ = a → C µ ) ∧ (i a -→ i ) ∧ (µ ∈ σ |C (i ))      
Proof. Let us prove both properties:

• The fact that µ ∈ σ |C (i ) implies the existence of a trace t ∈ σ(i

) such that proj C (t ) = µ . Then it comes that i a -→ i and t ∈ σ(i ) implies a.t ∈ σ(i). Hence proj C (a.t ) = a → C µ ∈ σ |C (i) • The fact that µ ∈ σ |C (i) implies the existence of a trace t ∈ σ(i) such that proj C (t) = µ. Then,
given that µ = C we have t = and hence there exists a and t such that t = a.t ∈ σ(i). Therefore there exists i such that i a -→ i and t ∈ σ(i ). Then, let us denote by µ the projection of t i.e. µ = proj C (t ). We then have proj

C (t) = µ = proj C (a.t ) = a → C µ and proj C (t ) = µ ∈ σ |C (i )

Relating the algebraic and projected multi-trace semantics

We have seen in Sec.7.2.2 that the projection operator do not preserve the algebraic structure related to weak sequencing. In practice, we have that σ C allows interleavings between actions that would otherwise be forbidden in σ |C , as can be inferred from the counter-example given in Sec.7.2.2.

We therefore characterize, in the general case of any partition C, the relationship between σ |C and σ C as an inclusion. We do so in Lem.7.9. The counter-example from Sec.7.2.2 proves that the reciprocate inclusion does not hold.

Lemma 7.9: Inclusion of the projected multi-trace semantics into the algebraic one

For any i ∈ I Ω we have:

σ |C (i) ⊂ σ C (i)
Proof. We can simply use Lem.7.5, Lem.7.7 and Lem.7.6. Let us however detail the proof to illustrate the difference between the weak sequence and the other operators.

Let us use the denotational formulation of σ and reason by induction on the structure of interactions:

• for the empty interaction:

σ |C (∅) = proj C ({ }) = { C } = σ C (∅)
• for any action a: σ

|C (a) = proj C ({a}) = {a → C C } = σ C (a)
• for any (f, , ) ∈ {(strict, ; , ; ), (par, ||, ), (alt, ∪, ∪)} we have:

σ |C (f (i 1 , i 2 )) = proj C (σ(f (i 1 , i 2 ))) = proj C (σ(i 1 ) σ(i 2 )) = proj C (σ(i 1 )) proj C (σ(i 2 )) as per Lem.7.5 = σ |C (i 1 ) σ |C (i 2 ) = σ C (i 1 ) σ C (i 2 ) induction hypothesis = σ C (f (i 1 , i 2 ))
• for the weak sequencing we have:

σ |C (seq(i 1 , i 2 )) = proj C (σ(seq(i 1 , i 2 ))) = proj C (σ(i 1 );× × σ(i 2 )) ⊂ proj C (σ(i 1 )) × × proj C (σ(i 2 )) as per Lem.7.7 ⊂ σ |C (i 1 ) × × σ |C (i 2 ) ⊂ σ C (i 1 ) × × σ C (i 2 ) induction hypothesis ⊂ σ C (seq(i 1 , i 2 ))
• for the repetition operators and constructors we can proceed similarly, using Lem.7.6 for the strict and interleaving K-closures and using Lem.7.7 for the weak K-closure and weak HF-closure Pragmatically, the semantics that is "correct" is σ |C . However, given that σ C is a homomorphism while σ |C is not, it is easier to manipulate and find interesting results related to σ C . In particular, we might be interested in the two extreme cases of the trivial and discrete partitions, where, as we state in Th.7.1 both semantics coincide.

Theorem 7.1: When 2 multi-trace semantics coincide

We have that:

σ |{L} = σ {L} and σ | Ľ = σ Ľ
Proof. Using Lem.7.3 and Lem.7.4 to eliminate the operators related to weak sequencing. And then using Lem.7.5 and Lem.7.6.

On Fig. 7.5, we illustrate the relationships between the trace semantics σ, the projection function proj C and the two multi-trace semantics σ |C and σ C . Let us recall that σ and σ C are both homomorphisms i.e.

  I Ω ,    ∅, a ∈ A Ω , alt, strict, seq, par loop S , loop H , loop W , loop P        P(T Ω ),    { }, {a}, ∪, ; , ;× × , ||, ; * , ; × × * , ;× × * , || *        P(TΩ|C),      { C }, {a → C C }, ∪, ; C , × × C , C , ; C * , × × C * , × × C * , C *         σ σ |C = proj C • σ proj C σ C

Prefixes and slices of multi-traces

During the process of recording the multi-trace, the observation of what occurs on each co-localization starts at a given time, which may not be exactly the same for each co-localization, and ends at a given time, which may also differ according to the co-localization. As a result, it may be so, that on different co-localizations, the observation starts and ends at different times. Moreover the span of time during which the observation occurs may not necessarily include the span of time during which observable events occur on a given colocalization. In practice those issues may arise due to the lack of a strict synchronization mechanism between local testers.

In any case, the occurrence of some events may not be recorded as a result. Indeed:

• if the observation starts too late on a given co-localization, some events occurring at the beginning of the execution on the corresponding sub-systems may not have been recorded

• if the observation ends too early on a given co-localization, some events occurring at the end of the execution on the corresponding sub-systems may not have been recorded

This notion of "partial" or "degraded" observation is illustrated on Fig. 7.6 which represents different possible recordings of the same execution of a certain distributed system. In the context of this example, we

have Ω = (L, M ) with L = {l 1 , l 2 , l 3 } and M = {m 1 , m 2 , m 3 , m 4 }. We consider an execution of a distributed system constituted of the three sub-systems represented by lifelines l 1 , l 2 and l 3 . Lifelines l 2 and l 3 are grouped in the same co-localization and therefore events occurring on them can be reordered. As a result, the recorded multi-traces are expressed as elements of T Ω|C with C = ({l 1 }, {l 2 , l 3 }).

In the right of Fig. 7.6, four different recordings (as multi-traces) of the same execution of the example distributed system are illustrated. Those four examples are as follows: • In ideal conditions, the full execution of the system is recorded, with no events missing. This is represented by the multi-trace at the top of Fig. 7.6. On each of the two co-localization, three events were recorded.

• As explained earlier, it may be so that the observation or the recording of events may cease too early on any given co-localization. An example of such a case is given on the second multi-trace from the top in the right of Fig. 7.6. We can see that the same execution of the distributed system have been observed but that two events have been missed at the end of the component trace corresponding to the co-localization {l 2 , l 3 }. The omission of those two events correspond to an early cessation of observation on the corresponding component.

• The third example from the top, in the right of Fig. 7.6 corresponds to a case in which the same execution has been observed but the observation has begun too late on the component corresponding to lifeline l 1 . Here, one event, at the beginning of the l 1 component has been missed.

• The bottom example of a multi-trace in the right of Fig. 7.6 corresponds to a case in which we had both an early cessation of observation on component {l 2 , l 3 } and a late start of observation on component

{l 1 }.
We can characterize the multi-traces obtained from recordings under degraded observability with regards to the multi-trace recorded under a full observability. This characterization consists in describing partially observed multi-traces as prefixes (in the sens of multi-traces) or slices of the fully observed multi-trace.

Let us at first introduce some preliminaries on the notion of prefixes, applied to globally defined traces.

Definition 7.17: Semantics of interaction with degraded observability

For any interaction i ∈ I Ω :

• σ † |C : I Ω → P(T Ω|C ) is s.t. σ † |C (i) = {proj C (t) | t ∈ σ(i)} • σ |C : I Ω → P(T Ω|C ) is s.t. σ |C (i) = σ |C (i) • σ C : I Ω → P(T Ω|C ) is s.t. σ C (i) = σ C (i)
• and σ |C :

I Ω → P(T Ω|C ) is s.t. σ |C (i) = σ |C (i)
While σ |C is a semantics of fully observed multi-traces, σ † |C , σ |C and σ |C describe varying degrees of partial observations. With σ † |C , events that are expected to occur, globally, at the end of accepted behaviors might be missing. With σ |C , missing events might be those at the end of some local behaviors even though they may not be at the end of the behavior globally. Finally, σ |C describe a more general case of partial observation in which events might be missing either at the beginning or the end of any local behavior.

We of course have that, for any interaction i ∈ I Ω :

σ |C (i) ⊆ σ † |C (i) ⊆ σ |C (i) ⊆ σ |C (i)
In the second part of the thesis, we will detail analysis methods that allow one to identify and discriminate between elements of those new semantics.

Conclusion

In this chapter we have defined the notion of multi-traces. A multi-trace can be described as a distributed observation of a global trace, in which events occurring on different localization are not ordered. Concretely, a multi-trace takes the form of a finite set of locally defined traces, each of which corresponding to a local behavior. As a result, a multi-trace describes a global behavior as a set of locally observed behaviors. The set of sets of multi-traces can be fitted with algebraic operators so as to constitute a F-algebra similarly as the set of sets of traces was in Chap.4. Multi-traces can also be obtained by projecting global traces. The projection operator displays some interesting properties, which we have described and proved. It is notable that it preserves some algebraic structures but not all. Then, we described various notions of prefixes of multi-traces which in fact correspond to partial observations, as we will see in the following chapter.

In this chapter, we also extended the notion of what is the semantics of interactions by defining various semantics in terms of accepted multi-traces and various prefixes of accepted multi-traces.

With this chapter we end the first part of the thesis which consisted in the definition of the Interaction Language (IL), from syntax to semantics.

In the second part of the thesis we will be interested in defining various algorithms to solve the membership problem i.e. determining whether or not a multi-trace belongs to a certain semantics. Because those algorithms consist in analyzing multi-traces against interaction models we may call them multi-trace analysis algorithms.

Part II

Multi-trace analysis

As a result, we can relate multi-traces collected from observations of concrete executions of a DS to multi-traces specified by interaction models. In particular we might be interested in checking whether or not a multi-trace observed on a DS belongs to a certain semantics of an interaction which is intended to specify the behavior of that same DS.

We illustrate this process of "checking", which we may call multi-trace analysis on Fig. 8.1. On the top right is represented a concrete implementation of a DS (here with three sub-systems, each represented by a lifeline). An execution of that DS yields (through observation, collection, and transposition) the multi-trace represented underneath it. We then analyze this multi-trace against a specification of the DS written in the form of an interaction model. The analysis may yield a certain verdict, which may not necessarily be a binary verdict. We have seen that, in intention, behaviors specified by interaction models correspond to the projected multi-trace semantics σ |C . Therefore, a first try at defining such an analysis process would be to check the membership of the multi-trace to the semantics σ |C of the specifying interaction model.

However, it might be so that the execution of the DS from which the multi-trace is collected is only partially observed. This results in having some missing events in the multi-trace. On each co-localization, the observation can either start too late or end too early or both. As a result, the multi-trace resulting from this partial observation of the execution can be a prefix or a slice of an accepted multi-trace.

If we assume full observation then we should check the inclusion into σ |C . In cases where we may suppose a degraded observation then the execution might still be that of a specified behavior even though the multitrace that was collected is not in the σ |C semantics. In that case we may rather consider the σ † |C , σ |C or σ |C semantics depending on what it is that we want to check and what are our hypotheses concerning the observation. This problem of "belonging to a semantics" may be called the "membership problem". What we have described above is an application of that problem for a very particular case of testing the conformance of an implementation against a formal specification.

In this second part of the thesis we address the general problem of solving the membership problem for the various multi-trace semantics which we have defined in Chap.7. Let us remark that the membership problem for global traces is included in the latter given that we can equate global traces to multi-traces defined on a trivial partition of lifelines.

In this chapter we informally discuss how we can use the operational formulation of the trace semantics of interaction to recognize accepted multi-traces under various condition of full or partial observation. At the same time it may help in the understanding of partial observation and of the various notions of prefixes (and their distinctness) which we have defined.

The plan of this chapter is as follows:

• in Sec.8.1 we explain how the operational semantics defined in Chap.5 can be used to recognize accepted multi-traces,

• in Sec.8.2 we explain how we can characterize projections of prefixes of accepted global traces operationally,

• in Sec.8.3 we characterize prefixes in the sense of multi-traces and illustrate how they are not included in the previous notion of projections of prefixes,

• finally, in Sec.8.4 we provide an operational characterization of slices of multi-traces.

Recognizing accepted multi-traces

Let us consider the example from Fig. 8.2. On the top left we have a globally defined trace ς which exactly corresponds to a given execution of a certain Distributed System (DS). With

ς = l 1 !m 1 .l 2 ?m 1 .l 2 !m 2 .l 1 ?m 2 ,
it describe the successive occurrence (globally ordered) of four events. On the top of Fig. 8.2, we have an We then analyze this observed multi-trace µ w.r.t. the model i. This multi-trace is defined up to a partition C = ({l 1 }, {l 2 }) in this example (although it could be any partition). In the example on Fig. 8.2 the multi-trace corresponds to a full observation of the behavior.

interaction model i = seq(loop H (• • • ), • • • ) which
The key principle behind the analysis is to reconstruct a globally defined traces accepted by i that project onto µ by proj C . Constructing such a trace is made possible by taking elementary steps (i, µ) (i , µ ) such that there exists an action a such that:

executed behavior as a global trace

l 1 !m 1 l 2 ?m 1 l 2 !m 2 l 1 ?m 2 fully observed multi-trace µ ∈ σ |C (i)
interaction model This means that in any such step (i, µ) (i , µ ) we simultaneously consume an action at the beginning of a component of the multi-trace µ and execute an instance of that action that is found in the interaction i.

As a result, the analysis may uncover a path in the execution tree of the interaction which allows the consumption of multi-trace µ. If, at the end of this path, we reach a (i j , C ) in which the remaining interaction i j can express the empty trace (which can be verified by the termination predicate from Chap.5), then this guarantees that µ ∈ σ |C (i).

On the bottom part of Fig. 8.2, we have represented such a path, which allows the consumption of the multi-trace µ. Here, the final pair that is reached contains the empty interaction which of course verifies that ∅ ↓. Therefore we decorate this path with a local verdict Cov (in blue on Fig. 8.2) which signifies that the multi-trace is an accepted multi-trace.

Recognizing projections of prefixes of accepted traces

Let us now consider the example analysis illustrated on Fig. 8.3, which is a variation of the previous example.

We observe here the same behavior of the same distributed system, which is also modelled by the same interaction term. However, in this example, the observation is degraded. We have indeed missed the observation of the event which occurred last globally (as illustrated on the top left corner of Fig. 8.3). As a result, the multi-trace that we analyze is partially observed. In this precise example, this multi-trace µ is in σ † |C (i) \ σ |C (i) meaning that it is the projection (as a multi-trace) of a strict prefix of an accepted (global) trace but it is not itself an accepted multi-trace.

executed behavior as a global trace

l 1 !m 1 l 2 ?m 1 l 2 !m 2 l 1 ?m 2 u n
Elements of this set σ † |C (i) \ σ |C (i) can be identified as illustrated on the bottom part of Fig. 8.3. It suffices to find a path in the execution tree of the interaction which allows the consumption µ while reaching a (i j , C ) in which the remaining interaction cannot express the empty trace i.e. that we have i j ↓. On Fig. 8.3 we decorated this path with a local verdict Short in cyan.

Finding such a path guarantees that µ ∈ σ † |C (i) although it does not guarantees that µ ∈ σ |C (i) because there may be some other paths that consume µ while reaching an interaction that terminates (i.e. we may also be able to reach a Cov local verdict).

So as to guarantee that µ ∈ σ † |C (i) \ σ |C (i) one would have to ascertain that at least one path leads to Short and that no path leads to Cov.

Recognizing prefixes of accepted multi-traces

Let us now consider the example analysis illustrated on Fig. 8.4, which, in the same manner, is also a variation of our example. Here, we also have a degraded observation but this degradation is somewhat different. Indeed, as illustrated on the top left corner of Fig. 8.4 it is the l 2 !m 2 event which observation has been missed. This event is not the last to have occurred globally but it is the last to have occurred on the co-localization {l 2 }. This may for instance be due to the local tester on co-localization {l 2 } having ceased its observation too early.

The multi-trace µ that we analyze is therefore partially observed but in this case, µ is in σ |C (i) \ σ † |C (i). Indeed, it is a prefix (in the sense of multi-traces) of an accepted multi-trace but it is not the projection of a prefix (in the sense of traces) of an accepted trace.

Elements of this set σ |C (i) \ σ † |C (i) can be identified as illustrated on the bottom part of Fig. 8.4. This process of identification is similar to the ones we have described previously i.e. it relies on the simultaneous consumption of events from the multi-trace and their execution in the interaction model. However, once a component trace of the multi-trace has been entirely consumed, we allow the execution of some events on the corresponding co-localization so as to simulate the behavior of the unobserved lifelines. Those simulation steps can be used to fill-in the place left by events missing (because not observed) from the multi-trace during the exploration of the tree.

executed behavior as a global trace

l 1 !m 1 l 2 ?m 1 l 2 !m 2 l 1 ?m 2
(i 0 , µ 0 ) (i 1 , µ 1 ) (i 2 , µ 2 ) (i 3 , µ 3 ) (∅, C ) M ultiP ref
In this precise example, we can see that we manage to reach the (i 2 , µ 2 ) vertex in which we have a multi-trace in which only l 1 ?m 2 remains. From this vertex we can see that it is not possible to consume the remaining event. However, the component trace on co-localization {l 2 } has been entirely emptied. This means that observation have ceased on l 2 , and, as a result, we may simulate its behavior. This allows us to execute action l 2 !m 2 at position 2 which is the action that has not been observed (see top left corner of Fig. 8.4).

Executing this action via simulation allows us to resume the consumption of the multi-trace. We then manage to reach the (∅, C ) vertex in which the multi-trace is empty and the remaining interaction can express the empty trace. Given that we memorized that we needed some simulation steps to explore this path, we decorate this path not with a Cov local verdict, but with a dedicated M ultiP ref local verdict.

Finding such a path guarantees that µ ∈ σ |C (i) although it does not guarantees that µ ∈ σ † |C (i) because there may be some other paths that may reach some other local verdicts (Cov or Short).

So as to guarantee that µ ∈ σ |C (i) \ σ † |C (i) one would have to ascertain that at least one path leads to M ultiP ref and that no path leads to either Cov or Short.

Recognizing slices of accepted multi-traces

Let us now consider our final example analysis illustrated on Fig. 8.5. This time, events have been missed both at the end and at the beginning of some trace component of the multi-trace. Indeed, as illustrated on the top left corner of Fig. 8.5 two events are missing:

• l 1 !m 1 at the beginning of component µ |{l1} • l 2 !m 2 at the end of component µ |{l2}
In that case, we have both a local tester which ceased its observation too early (the one on co-localization {l 2 }) and another local tester which started its observation too late (the one on co-localization {l 1 }).

The multi-trace µ that we analyze is therefore partially observed with µ ∈ σ |C (i) \ σ |C (i). Indeed, it is a slice (in the sense of multi-traces) of an accepted multi-trace but it is not a prefix (in the sense of multi-traces) of an accepted multi-trace.

Elements of this set σ |C (i) \ σ |C (i) can be identified as illustrated on the bottom part of Fig. 8.5. This process of identification allows simulation steps both:

• after the entire consumption of any given trace component (as in the previous case)

• and before one has started consuming any event from a certain trace component As in the previous case, those simulation steps can be used to fill-in the place left by events missing (unobserved) from the multi-trace during the exploration of the tree.

Let us use the same notations as before for describing the path described in Fig. 8.5 i.e. we denote by (i 0 , µ 0 ) the first vertex at the top left and we have (i

0 , µ 0 ) (i 1 , µ 1 ) (i 2 , µ 2 ) (i 3 , µ 3 ) (∅, C ) Slice
At the start of the analysis, from the (i 0 , µ 0 ) vertex, we can see that we cannot consume any event.

Indeed frontier actions consists in l 1 !m 1 and l 2 !m 2 which are neither of the head actions of the multi-trace. However, given that we have not started the consumption on any of the two components, we allow simulation steps to be taken. Those simulation steps will act as a preliminary for the consumption of the multi-trace.

In the path described on Fig. 8.5 we have chosen to simulate the execution of action l 1 !m 1 at position 11. We can then see that this unlocked the further consumption of the multi-trace by allowing l 2 ?m 1 to be consumed.

Then, another simulation step is taken, this time as a postamble to the consumption of the component on {l 2 }. This use of simulation step is the same as in the previous example.

Finally, we then manage to reach the (∅, C ) vertex in which the multi-trace is empty and the remaining interaction can express the empty trace. Given that we memorized that we needed some simulation steps both before and after the consumption of some trace components, we decorate this path with a dedicated Slice local verdict.

Finding such a path guarantees that µ ∈ σ |C (i) although it does not guarantees that µ ∈ σ |C (i) because there may be some other paths that may reach some other local verdicts (Cov or Short or M ultiP ref ).

So as to guarantee that µ ∈ σ |C (i) \ σ |C (i) one would have to ascertain that at least one path leads to Slice and that no path leads to either Cov or Short or M ultiP ref .

Conclusion

In this chapter we have introduced the problematic of analyzing multi-traces against interaction models and proposed a solution in the form of analysis algorithms which key principle is to successively consume actions from the multi-trace while executing them on the interaction model. We have also indirectly characterized the various notions of prefixes which we defined in Chap.7. While in Chap.7 we have define those notions of prefixes from an algebraic perspective i.e. as closures of sets, we provided in this chapter, an operational characterization of their nature, with some events (corresponding to atomic small-steps) not being observed during the execution. We have also provided a first sketch of a solution to recognize multi-traces that were observed under conditions of degraded observability. This sketch of solution relies on replacing missing events by simulation steps in which we explore what could have been expressed by the sub-systems that were not observed.

In this second part of the thesis we will define various algorithms so as to solve the membership problem for the various semantics which we have defined in Chap.7.

Chapter 9

Algorithm for recognizing accepted multi-traces if the remaining interaction can express the empty trace, we can conclude that the multi-trace is accepted via the formulation of a Cov local verdict, which decorates the path leading to that vertex (as illustrated in the bottom of Fig. 9.1)

i 0 µ 0 i 1 µ 1 i 11 µ 11 i 2 µ 2 U nCov Cov i j µ j j matches • • • i 1 cov µ 1 cov • • • • • • i 2 cov µ 2 cov • • • • • • • • • i r cov µ r cov r = |µ 0 | rule R1 rule R2 or R4 rule R3 229
if the remaining interaction cannot express the empty trace, then it means that the multi-trace cannot be consumed in the manner described by the path leading to that vertex. From the point of view of that last vertex, the empty behavior cannot be expressed so the empty multi-trace is not an accepted multi-trace. As a result, we decorate this path with an U nCov local verdict (as illustrated on the right of Fig. 9.1)

• or be in a situation in which we cannot match any executable action in i with any head action from components of µ. In that case, we assign a local verdict U nCov to the path leading to the vertex in which no matches have been found. As for the previous case, this U nCov local verdict signifies that the multi-trace cannot be consumed in this manner. From the point of view of the last vertex in the path, the remaining multi-trace does not characterize any behavior that is accepted by the remaining interaction.

Given that a multi-trace has a finite number of actions, and that there may be only a finite number of matches between frontier actions of an interaction and a head action of a multi-trace, an analysis graph constructed in this manner is a finite graph.

As a result of the two last points, for any vertex (i, µ) there exists a finite number of outgoing paths, all of them are finite, and all such paths can be prolonged so as to eventually reach a local verdict Cov or U nCov. Hence, there exists at least one path between any (i, µ) and either Cov or U nCov, and, reciprocally, either Cov or U nCov are reachable from any vertex (i, µ).

As explained previously, this allows us to define a global verdict for the analysis of the initial multi-trace µ 0 w.r.t. the initial interaction i 0 . If there exists a path leading to Cov, the global verdict is P ass given that there exists a manner to reorder all the events from multi-trace µ 0 into a global trace t 0 ∈ σ(i 0 ) accepted by i 0 and therefore µ 0 = proj C (t 0 ) ∈ σ |C (i 0 ). If no such path exists then the global verdict is F ail.

Detailed description of Fig. 9.1

Let us consider the illustration on Fig. 9.1. Starting from vertex (i 0 , µ 0 ), a number of paths can be explored.

From (i 0 , µ 0 ), there exists j outgoing transitions to other vertices, j being the number of matches between immediately executable actions (frontier actions) of i 0 and actions at the heads of components from µ.

Exploration steps (which are not represented but implicitly designated by • • • in Fig. 9.1) are then repeated for every one of those children. Ultimately, every path that is thus created leads back to one of the two local verdicts U nCov or Cov (given the decreasing size of the multi-trace).

Paths starting from (i 0 , µ 0 ) may have different lengths and different outcomes. This is explained by the fact that the graph explores how some executions of i 0 might (or might not) cover the behavior expressed by the multi-trace µ 0 . It may be so that there exists several executions of i 0 that match µ 0 . At the same time there might exists some that do not, and the fact that they do not match µ 0 can be made clear after an arbitrary number (bounded by the length of µ 0 ) of small-steps.

With regard to Cov, the fact that several paths might lead to it may be explained by the fact that several global traces can be projected into the same multi-trace (as explained in Chap.7). Therefore, when trying to reorder µ 0 into a global trace that satisfies i 0 , we can find several of those.

In the example illustrated in Fig. 9.1, there exists (at least one) such path (i 0 , µ 0 )

(i 1 cov , µ 1 cov ) • • • (i r cov , µ r cov
) that leads to Cov. Given that obtaining Cov requires to empty the initial multi-trace µ 0 we have that:

• the final remaining multi-trace is the empty multi-trace i.e. µ r cov = C

• the length of the path (within the analysis graph) r is equal to that of the multi-trace |µ 0 | (in number of actions)

The existence of this path then implies that the global verdict P ass will be returned.

Let us also remark that all paths leading to Cov are of the same length (that of the initial multi-trace:

|µ 0 |).
However paths leading to U nCov are of any length smaller or equal to |µ 0 |.

The process which allows the exploration of the analysis graph and the discovery of paths leading to local verdicts can be described by a set of four rules denoted by R1 through R4. On Fig. 9.1, we have illustrated the application of those rules via differently colored arrows between the vertices of the graph (see the legend on the bottom-left corner). In the following section we define those four rules and detail their applications on some examples.

Presentation of the rules for exploring the analysis graph

In the previous section we have briefly explained the principle behind the multi-trace analysis algorithm.

We will now detail each rule on which it is based.

Rule R3 for the consumption of events from the multi-trace

Let us start by describing rule R3 on an example. The application of the rule on that example is illustrated on

µ |{l3} = l 3 ?m 2 .
The analysis is then that of µ 0 (the multi-trace to analyze) with regards to i 0 (the interaction which serves as a specification).

The first step in the analysis is to determine the frontier of the interaction i 0 . In that case, we have three Rule R3 can be formalized as follows; for any interaction i and any multi-trace µ over a partition C of L:

i a → C µ (R3) i a -→ i i µ
Every application of rule R3 reduces the size of the multi-trace by 1. As a result, repeating the application of rule R3 can eventually yield to either emptying the multi-trace or being in the impossibility to apply R3 anymore.

• What happens in the first case is then specified by either rule R1 or rule R2 that we will introduce in the following.

• The second case corresponds to the case in which the multi-trace µ is not empty but we cannot find any matches between frontier actions and the heads of trace components of µ. What happens then is dictated by rule R4.

Rule R4 when it is impossible to consume any event

As explained before, rule R4 specifies what happens during the analysis when the multi-trace is not empty and it is not possible to consume any event from it. Let us continue on the previous example by selecting one of the explored branches. We have represented this branch of the analysis graph on Fig. 9.3. As the reader may have noticed, a previous application of rule R3 yielded a vertex (i, µ) in which we have the interaction i = strict(l 3 !m 4 , l 1 ?m 4 ) and a multi-trace µ defined over the discrete partition of L = {l 1 , l 2 , l 3 }.

The frontier of i contains a single instance of l 3 !m 4 at position 1. However, on the component µ |{l3} of the multi-trace we have µ |{l3} = l 3 ?m 2 . As a result, in the remaining multi-trace to analyse there is no match for this action.

Given that there is no match at all, we can apply rule R4, which allows the transition (i, µ) U nCov,

where U nCov is a local verdict (signifying that the multi-trace cannot be consumed in this manner). From the point of view of the (i, µ) vertex, the remaining multi-trace does not characterize any behavior that is accepted by the remaining interaction.

Rule R4 can be formalized as follows; for any interaction i and any multi-trace µ over a partition C of L: In the top-right vertex, the remaining interaction i can express the empty behavior. This can be statically inferred from its term structure using the termination predicate i ↓ from Chap.5. Here we have a loop which can be repeated zero times, and an alternative in which one branch is the empty interaction. Given that this interaction can express the empty trace, we can apply rule R1, which links local verdict Cov to this path (signifying that the multi-trace characterizes an accepted behavior).

i µ (R4)      (µ = C ) ∧( ∃ i a -→ i s.t. µ = a → C µ ) U nCov

Rules

In the bottom-right vertex, the remaining interaction i cannot express the empty behavior i.e. we have i ↓. As a result, the empty multi-trace is not accepted at this point. The application of rule R2 links the U nCov local verdict to the path. The U nCov verdict here has the same meaning as in the case of the application of rule R4. It signifies that, at this point, the remaining multi-trace is not accepted by the remaining interaction.

Rules R1 and R2 can be formalized as follows; for any interaction i and any partition C of L:

i C (R1) i ↓ Cov i C (R2) i ↓ U nCov i ↓ i ↓ µ is empty applying R1 applying R2

Formal Definition of the analysis process

As we have seen, the analysis of multi-trace analysis relies on four rules, denoted by R1, R2, R3 and R4.

Those rules define a directed graph G in which vertices are either a tuple (i, µ) ∈ I Ω × T Ω|C or a local verdict v ∈ {Cov, U nCov}. We note V = {Cov, U nCov} ∪ (I Ω × T Ω|C ) the set of all such vertices. For x in {1, 2, 3, 4}, the rule (Rx) v v cond, with v ∈ I Ω × T Ω|C and v ∈ V specifies edges of the form v v of that graph, provided that v satisfies condition cond.

The formal definition of the graph G and how to construct it is given on Def.9.1.

Definition 9.1: Rules of Multi-Trace Analysis

The analysis relation ⊆ V × V is defined as:

i C (R1) i ↓ Cov i C (R2) i ↓ U nCov i a → C µ (R3) i a -→ i i µ i µ (R4)      (µ = C ) ∧( ∃ i a -→ i s.t. µ = a → C µ ) U nCov
We can remark that vertices of the form (i, µ) are not sinks. Indeed:

• if µ is the empty multi-trace C , given that we must either have i ↓ or i ↓, either R1 or R2 applies and therefore there exists an outgoing edge from any (i, C )

• if µ = C , one can either have or not have matches between frontier actions and multi-trace component heads. Hence, an outgoing edge exists according to either rule R3 or rule R4.

As a result, local verdicts {Cov, U nCov} are the only two sinks of graph G.

Rules R1, R2 and R4 specify edges from vertices of the form (i, µ) to local verdicts.

The rule R3 specifies edges (i, µ) (i , µ ) such that there exists an action a that is both:

• immediately executable in i i.e. such that there exists a follow-up interaction i s. Then, the vertex that is reached after applying R3 is (i , µ ) as specified above i.e. such that i is a follow-up in i a -→ i and µ is such that a → C µ .

For applying R3, we must consider an action that is immediately executable in i. We have seen in Chap.6

that there is a finite number of such actions and that we can compute them as a "frontier of execution" frt(i).

As in G, we define multi-trace analysis in Def.9.2.

Definition 9.2: Multi-Trace Analysis

For any signature Ω = (L, M ) and any partition C ∈ Part(L) of lifelines, we define ω C : I Ω × T Ω|C → {P ass, F ail} such that for any i ∈ I Ω and µ ∈ T Ω|C we have:

• ω C (i, µ) = P ass iff there exists a path (i, µ) * Cov

• ω C (i, µ) = F ail otherwise;

i.e. for all path (i, µ)

* v with v ∈ {Cov, U nCov}, then v = U nCov
The function ω C is well-defined. Indeed, we established that any maximal path from a vertex (i 0 , µ 0 ) has a maximum length of |µ| + 1 and end on a local verdict (Cov or U nCov). Besides, each intermediate vertex (i, µ) between (i 0 , µ 0 ) and a local verdict has a number of children bounded by the number of actions of i.

Therefore, the number of vertices reachable from (i 0 , µ 0 ) is finite

Application on an example

ω C (i, µ) = P ass ω C (i, µ) = F ail As the reader may have noticed, in the multi-trace, l 1 emits m but it is an unexpected message m 2 that is received on l 2 . The analysis graph starting from (i, µ) is drawn on the right part of Fig. 9.5. In this case, all the paths starting from (i, µ) lead to the U nCov local verdict. As a result, the analysis yields the F ail global verdict. Now that we have formally defined our process to analyze multi-trace, we will, in the next section, prove its correctness with regards to the semantics of interactions.

Proof of correctness of the multi-trace analysis algorithm

Let us consider a given signature Ω = (L, M ) and a given partition C ∈ Part(L) of lifelines.

In the following, we prove that the function ω C in charge of analysing multi-traces defined over C w.r.t.

interactions exactly captures the semantics of interactions. More precisely, we will prove that for any (i, µ) in I Ω × T Ω|C we have that:

• ω C (i, µ) = P ass iff µ ∈ σ |C (i)

• and by extension,

ω C (i, µ) = F ail iff µ ∈ σ |C (i)
Let us remark that this proof has been machine-checked using the Coq proof assistant in [START_REF] Mahe | Coq proof for the correctness of the multi-trace analysis algorithm[END_REF] in the case of the discrete partition as in [START_REF] Mahe | A small-step approach to multi-trace checking against interactions[END_REF].

Given that σ |C (i) is the set of multi-traces obtained by projecting (with proj C ) accepted global traces from σ(i), it then suffices to prove that for any trace ς ∈ T Ω we have ω C (i, proj C (ς)) = P ass iff ς ∈ σ(i).

This can be done in two steps. The first step is given by Th.9.1 and states that whenever a global trace ς is accepted by an interaction i then this means that its projection as a multi-trace must yield P ass when analysed w.r.t. i. • If ς = we have an interaction i such that ∈ σ(i). As per Lem.5.4, this implies that i ↓. As a result, if we start an analysis with (i, C ) we can immediately apply rule R1 and we obtain ω C (i, C ) = P ass.

Then, given that proj C ( ) = C the property holds.

• Let us then consider ς of the form a.ς . We then denote by µ = proj C (ς) and µ = proj C (ς ) the projections and we have, by definition that µ = a → C µ . The hypothesis is that we have an interaction i such that a.ς ∈ σ(i). Then:

-As per the operational formulation of the semantics of interactions, this implies the existence of a follow-up interaction i ∈ I Ω such that i a -→ i and ς ∈ σ(i ). Also, given that we have µ = a → C µ , we can apply rule R3 from the node (i, µ) so that we have (i, µ) (i , µ ).

-Given that |ς | < |ς|, we can apply the induction hypothesis (on a strictly smaller global trace) such that we obtain ω C (i , µ ) = P ass. This implies the existence of a path (i , µ ) * Cov in the analysis graph.

We then observe that (i, µ) (i , µ ) * Cov and hence (i, µ) * Cov and therefore ω C (i, µ) = P ass

The second step is given by Th.9.2 and states that whenever a multi-trace µ yields P ass when analyzed w.r.t. an interaction i, then this means that it is in fact the projection of a global trace accepted by i.

Theorem 9.2: P ass implies Accepted

For any interaction i ∈ I Ω and any multi-trace µ ∈ T Ω|C :

ω C (i, µ) = P ass ⇒   ∃ ς ∈ T Ω s.t.      (proj C (ς) = µ) ∧ (ς ∈ σ(i))   
Proof. Let us reason by induction on the size of multi-trace µ, i.e. on |µ|.

• If |µ| = 0 then µ is the empty multi-trace C . Let us then consider an interaction i such that ω C (i, C ) = P ass. Since ω C (i, C ) = P ass given that is is not possible to apply rule R3, the only possible option to obtain P ass is that rule R1 can apply. This then implies that i ↓. Then, as per Lem.5.4 this implies that ∈ σ(i), and given that proj C ( ) = C , the property holds.

• Let us then consider µ of size z + 1 i.e. |µ| = z + 1 with z ≥ 0 and let us suppose that the property holds for any multi-trace of size z.

Let us then consider an interaction i such that ω C (i, µ) = P ass. Since ω C (i, µ) = P ass, there exists a path (i, µ) * Cov. Also, given that |µ| > 0 we have µ = C therefore rule R1 cannot immediately apply. The only possibility to have a path towards Cov is that rule R3 applies. This consists in the existence of an action a, a multi-trace µ and an interaction i such that i a -→ i and µ = a → C µ so that we have a transition (i, µ) (i , µ ) and then (i , µ ) * Cov.

Given that applying rule R3 involves the consumption of action a in µ, we have |µ | = |µ| -1 = z.

Therefore we can apply the induction hypothesis which implies the existence of a global trace ς ∈ T Ω such that proj C (ς ) = µ and ς ∈ σ(i ).

Then, given that we have both i a -→ i and ς ∈ σ(i ), by definition, a.ς ∈ σ(i).

Let us then denote ς = a.ς .

Then, by definition, we have proj

C (ς) = proj C (a.ς ) = a → C µ = µ.
We have therefore found ς ∈ T Ω such that proj C (ς) = µ and ς ∈ σ(i).

The two theorems Th.9.1 and Th.9.2 demonstrate that ω C (i, µ) = P ass characterizes the membership of a multi-trace µ to σ |C (i).

The computational cost of ω C varies greatly depending on the initial (i, µ) couple. It can be reduced substantially in certain cases via the use of some heuristics to guide the exploration of the analysis graph and by stopping the analysis once a Cov local verdict is reached. Another technique which drastically reduce this cost will be detailed in Chap.10.

However, in the worst cases (and without the technique from Chap.10), the complexity costs remain high.

In the following section we will discuss the complexity class of the underlying problem which is that of the membership of a multi-trace. We will demonstrate the NP-hardness of this membership problem through a reduction of the 1-in-3-SAT problem [START_REF] Schaefer | The complexity of satisfiability problems[END_REF]. This discussion is inspired by [START_REF] Alur | Realizability and verification of MSC graphs[END_REF][START_REF] Genest | Pattern matching and membership for hierarchical message sequence charts[END_REF][START_REF] Dan | The oracle problem when testing from mscs[END_REF].

Complexity class of the multi-trace analysis problem

In this section we will prove the NP-hardness of the problem of analysing multi-traces w.r.t. interactions in the worst case, that is when the partition upon which multi-traces are defined is the discrete partition C = ({l}) l∈L . To do so we will explain a process to reduce instances of a certain Boolean satisfiability problem, which is known to be NP-complete, into instances of the analysis of a multi-trace against an interaction.

• in Sec.9.3.1 we present this Boolean satisfiability problem which is called 1-in-3-SAT,

• in Sec.9.3.2 we present the reduction of a particular instance of 1-in-3-SAT into a particular instance of multi-trace analysis,

• in Sec.9.3.3 we generalize this process for any instance of 1-in-3-SAT and we conclude.

The 1-in-3-SAT problem

Boolean variables and formulae

A Boolean variable is a symbol or placeholder for a Boolean truth value i.e. either true, which we denote by or false, which we denote by ⊥. A Boolean expression also called a propositional logic formula or more simply a formula is an expression that is build inductively:

• from some Boolean variables from a set V of Boolean variables

• and using the following three truth-functional connectives:

the conjunction AND, denoted by ∧ such that for any formulae φ 1 and φ 2 , φ 1 ∧φ 2 is also a formula the disjunction OR, denoted by ∨ such that for any formulae φ 1 and φ 2 , φ 1 ∨ φ 2 is also a formula the negation NOT, denoted by ¬ such that for any formula φ, ¬φ is also a formula. For any given variable v ∈ V we may denote by v the negation ¬v of v.

We may call a literal a formula that is reduced to a single variable v ∈ V or its negation v. In the first case a literal v may be called a positive literal and in the case, a literal v may be called a negative literal.

As a result, the set of variables V is also the set of all positive literals. We may then denote by V the set {v | v ∈ V } of all negative literals.

Satisfying a Boolean formula

An interpretation of a set of Boolean variables V is a mapping ρ : V → { , ⊥} that assigns a truth value to each variable. A Boolean satisfiability problem is a problem which consists in finding an interpretation of some Boolean variables that satisfies some conditions.

For instance, given a set V = {v 1 , v 2 } containing two Boolean variables, and given a formula

φ = v 1 ∧ v 2 ,
finding an interpretation ρ : V → { , ⊥} of the variables, that satisfies φ, which we denote by ρ |= φ consists in finding values for v 1 and v 2 such that v 1 ∧v 2 equates . The problem of finding ρ is a Boolean satisfiability problem. In this example,

ρ 0 = [v 1 → , v 2 →
] is a solution such that ρ |= φ. Given the existence of ρ 0 , we say that φ is satisfiable. If such an interpretation (assignement of variables) do not exist, we can say that φ is unsatisfiable.

The 1-in-3-SAT problem

The 1-in-3-SAT problem [START_REF] Schaefer | The complexity of satisfiability problems[END_REF] is a particular Boolean satisfiability problem in which the formula φ to satisfy has a particular form and in which the solution interpretation ρ must satisfy some additional properties.

Let us start by introducing some intermediate notions:

• we call a clause a formula ψ that is a disjunction of literals (or a single literal). This means that a clause is a formula ψ of the form x 1 ∨ • • • ∨ x n with n ∈ N + and (x j ) j∈ [1,n] a collection of literals from V ∪ V

• we say that a formula φ is in Conjunctive Normal Form (or that φ is a CNF formula) if it is a conjunction of clauses (or a single clause). This means that there exists a family (ψ j ) j∈ [1,n]

of n ∈ N + clauses such that φ = ψ 1 ∧ • • • ∧ ψ n
• for any integer k ∈ N + , we say that a formula is k-CNF if it is a CNF formula in which each clause has exactly k literals

The 1-in-3 SAT problem then corresponds to finding an interpretation ρ of V that satisfy a 3-CNF formula φ and such that for any clause of φ, only one in the three literal is set to by ρ.

In the following we will use the following notations:

• V = {v 1 , • • • , v p }
meaning we consider p ∈ N + to be the cardinal of the set V of variables and we index those variables with [1, p] • φ = ψ 1 ∧ • • • ∧ ψ q denotes the 3-CNF formula of the 1-in-3-SAT problem meaning that we consider q ∈ N + to be the number of clauses in φ and we index those clauses with [1, q] with, for any j ∈ [1, q]:

the clause ψ j being of the form α j ∨ β j ∨ γ j with all three literals in V ∪ V and for any given solution ρ of the problem, only one of either ρ(α j ), ρ(β j ) or ρ(γ j ) is set to Then:

• in Sec.9.3.2 we will detail a reduction of a particular instance of 1-in-3-SAT with p = 4 and q = 2 to the problem of analysing a particular multi-trace against a particular interaction • in Sec.9.3.3 we generalize the reduction for any 1-in-3-SAT problem with p ∈ N + and q ∈ N +

Reduction on a particular instance of the 1-in-3-SAT problem

Let us consider a 1-in-3-SAT problem in the case where p = 4 and q = 2.

From formula φ = ψ 1 ∧ ψ 2 , we define a certain interaction i. Given that q = 2, this interaction will be defined up to the signature Ω = (L, M ) with L = {l 1 , l 2 }, with one lifeline per clause, and M = {m}.

This interaction i is then of the form exemplified on Fig. 9.6 which is that of a parallelisation of 4 alternatives alt(i v , i v ) for any of the p = 4 variables v 1 , v 2 , v 3 and v 4 from V . Those 8 sub-interactions i x for any of the 8 literals x from V ∪ V are then defined as follows:

• if x occurs in ψ 1 and ψ

2 then i x = seq(l 1 !m, l 2 !m) • if x occurs in ψ 1 but not in ψ 2 then i x = l 1 !m • if x occurs in ψ 2 but not in ψ 1 then i x = l 2 !m • if x occurs neither in ψ 1 nor in ψ 2 then i x = ∅
Then, the 1-in-3-SAT problem defined by φ is equivalent to knowing whether or not the multi-trace µ = (l 1 !m, l 2 !m) defined over the discrete partition C = {{l 1 }, {l 2 }} of L belongs to the semantics σ |C (i).

Indeed, we can remark the following:

• for each variable v k the choice of ρ(v k ) = or ρ(v k ) = ⊥ corresponds to the choice of which alternative branch to execute in the sub-interactions

i k = alt(i v k , i v k ), with i v k being chosen if ρ(v k ) = and i v k being chosen if ρ(v k ) = ⊥.
The nature of the exclusive alternative constructor alt guarantees that exactly one branch is chosen in any execution of the interaction. The overall structure of interaction i then guarantees that all the 4 choices between the i v k or i v k are made in any given full execution of the interaction.

• for each clause ψ j , the component µ |{lj } = l j !m of the multi-trace µ is expressed exactly once in any given execution of the interaction i iff exactly one of the sub-interactions i αj , i βj or i γj is "chosen" during the execution of i. Indeed, if none are chosen then nothing is expressed on lifeline l j and if more than one are chosen then several instances of l j !m are expressed on l j . As a result, the expression of component µ |{lj } on lifeline l j is equivalent to the satisfaction of clause ψ j .

In other words, during the execution of i, given the use of exclusive alternative constructors in alt(i v , i v ) sub-terms, the choice of either one of the alt branch constitutes an assignment of Boolean variable v. The overall parallel composition then simulates all possible variable assignments (i.e. the search space for ρ).

Then, the satisfaction of φ as the conjunction of clauses ψ 1 and ψ 2 in 1-in-3-SAT is equivalent to that of µ = (l 1 !m, l 2 !m) ∈ σ |C (i). Indeed, the same ρ must be used to solve both ψ 1 and ψ 2 and the same global execution of i must be used to consume both µ |{l1} and µ |{l2} exactly.

On a particular formula

Let us consider the example illustrated on the left of Fig. 9.6 which corresponds to an interaction constructed to reflect a specific formula which is:

φ = ψ 1 ∧ ψ 2 = (v 1 ∨ v 2 ∨ v 4 ) ∧ (v 1 ∨ v 3 ∨ v 4 )
In the example, with

ψ 1 = (v 1 ∨ v 2 ∨ v 4 ), the fact that ρ |= ψ 1 with ρ : [v 1 → ⊥, v 2 → , v 3 → , v 4 → ]
is equivalent to the fact that l 1 !m is expressed exactly once during the execution of i when i v1 is chosen over i v1 , i v2 over i v2 , i v3 over i v3 , and i v4 over i v4 .

In the example,

φ = (v 1 ∨ v 2 ∨ v 4 ) ∧ (v 1 ∨ v 3 ∨ v 4 ) is solvable in 1-in-3-SAT by ρ : [v 1 → ⊥, v 2 → , v 3 → , v 4 → ]
. This is equivalent to the fact that µ = (l 1 !m, l 2 !m) is consumed exactly by the execution of i from Fig. 9.6 when i v1 is chosen over i v1 , i v2 over i v2 , i v3 over i v3 , and i v4 over i v4 .

For any such 3-CNF formula φ = ψ 1 ∧ ψ 2 defined over V = {v 1 , v 2 , v 3 , v 4 }, the 1-in-3-SAT problem can therefore be reduced to that of the acceptance of µ = (l 1 !m, l 2 !m) w.r.t. a specific interaction i that can be inferred in polynomial time from the structure of formula φ.

As explained earlier, this sketch of proof can be extended to include any numbers p and q of resp. variables and clauses. This will be the object of the following section.

Generalization for any 1-in-3-SAT problem

For practicity, we will use n -ary notations for binary operators f ∈ {strict, seq, par, alt}, with i =

f (i 1 , • • • , i n ) designating the folding of f s.t. i = f (i 1 , f (• • • , f (i n-1 , i n ) • • • ))
. We now reduce the 1-in-3-SAT Boolean satisfiability problem to multitrace membership so as to prove the NP-hardness of the latter.

Let us consider a 3-CNF formula

φ = ψ 1 ∧ • • • ∧ ψ q defined over a set V = {v 1 , • • • , v p } of Boolean
variables. φ being a 3-CNF formula, for any j ∈ [1, q], ψ j is a disjunction of 3 literals α j ∨ β j ∨ γ j from

V ∪ V .
The 1-in-3 SAT problem consists in finding an interpretation ρ : V → { , ⊥} s.t. for every clause ψ j only one of either α j , β j or γ j is set to .

We will in the following reduce this 1-in-3-SAT problem into a multi-trace analysis problem. This problem will be defined over a signature Ω = (L, M ) with:

• M = {m} • L = {l 1 , • • • , l q }
with q lifelines, one for each clause

• C = {{l} | l ∈ L} the discrete partition of L
The multi-trace we will consider is µ ∈ T Ω|C such that for any l ∈ L, µ |{l} = l!m.

For any k ∈ [1, p] let us define i k = alt(i v k , i v k ) with:

• i v k = seq(i 1 v k , • • • , i q v k ) • and i v k = seq(i 1 v k , • • • , i q v k )
• such that for any j ∈ [1, q]:

-if v k occurs in C j then i j v k = l j !m and else i j v k = ∅ -if v k occurs in C j then i j v k = l j !m and else i j v k = ∅
Let us then consider i = par(i 1 , • • • , i p ) as illustrated on Fig. 9.7. For instance, given

ψ 1 = v 1 ∨ v 2 ∨ v p we have i 1 v1 = l 1 !m, i 1 v1 = ∅, i 1 v2 = l 1 !m, i 1 v2 = ∅, i 1 vp = l 1 !m and i 1 vp = ∅.
Likewise, the other emissions of m drawn in Fig. 9.7 correspond to

ψ 2 = v 1 ∨ v 2 ∨ v p and ψ q = v 1 ∨ v 2 ∨ v p .
The 1-in-3-SAT problem defined by φ is then equivalent to knowing whether or not µ ∈ σ |C (i).

Indeed, for any component µ |{lj } = l j !m of µ, µ |{lj } is expressed exactly once iff exactly one of the sub-interactions i αj , i βj or i γj is chosen during the execution of i (choice w.r.t. their respective parent alt operator). The satisfaction of component µ |{lj } is therefore equivalent to that of clause ψ j .

i v 1 i v 1 i v 2 i v 2 • • • i v p i v p •••
ψ 1 = v 1 ∨ v 2 ∨ v p in 1-in-3-SAT,
In other words, during the execution of i, given the use of exclusive alternative operators in alt(i v , i v ) sub-terms, the choice of either one of the alt branch constitutes an assignment of Boolean variable v. The overall parallel composition then simulates all possible variable assignment (i.e. the search space for ρ).

Then, the satisfaction of φ as the conjunction of clauses ψ j in 1-in-3-SAT is equivalent to that of µ ∈ σ |C (i), given that the same execution of the model i must satisfy conjointly every component σ j .

Given that we have identified a case of multi-trace membership equivalent to a NP-complete problem, by reduction, multi-trace membership is NP-hard.

Conclusion

In this chapter, we have defined an algorithm for analysing multi-traces (defined up to any partition of the lifelines into co-localizations) against interaction models. We have proven that this ω C algorithm solves the membership problem for the semantics of accepted multi-traces σ |C (by projection) of interactions that we have defined in Chap.7.

We have presented ω C through the use of the operational formulation of the semantics with the execution relation →. However, results from Chap.6 show that we can use the algorithmicized execution semantics for the same results. All definitions related to the execution semantics from Chap.6 are structured by induction on terms and positions, and as such, allow a direct implementation. Similarly, one can implement the ω C

In Chap.9, we have described an algorithm for recognizing (exactly) accepted multi-traces and in Chap.8, we have discussed analyzing multi-traces that were collected from partial observations of executions and might therefore be prefixes of accepted multi-traces. We concluded that simulation steps could be used to replace missing events (i.e. events which were not observed) when analyzing multi-traces obtained from partial observations of executions.

However, in some more extreme cases, large parts of the distributed system may not be observed at all or some sub-systems may remain unobserved for large periods of time resulting in many events being missed.

In those situations, it is likely that using simulation steps comes with high overhead costs. It is all the more true when analyzing against interaction models that allow many interleavings or when analyzing incorrect behavior in which case it does not suffice to find one correct path in the graph G (to ascertain that a behavior

is not accepted we have to make sure no path leads to a positive verdict).

A solution to that problem is to restrict the analysis of the multi-trace to a smaller interaction model.

Instead of using the whole interaction specification, we use a sub-specification that only concerns the subsystems that are still observed. This notion of restricting the model to a group of observed sub-systems corresponds to the definition of a "hiding" operator, which is the object of this chapter.

The structure of this chapter is as follows:

• in Sec.10.1 we define the hiding operator and its counterpart in the world of multi-traces.

• in Sec.10.2 we define an algorithm which solves the membership problem for the σ Ľ semantics which is the prefix closure of the algebraic multi-trace semantics σ Ľ (which we have defined in Chap.7). Let us also recall that, on the discrete partition of lifelines Ľ, this semantics is equivalent to σ | Ľ. As a result, this algorithm equally recognizes σ | Ľ. The algorithm makes use of hiding steps to erase parts of the interaction model once observation have ceased on those parts. The correctness of this algorithm is formally proven i.e. that it indeed recognizes σ Ľ = σ | Ľ.

• finally, in Sec.10.3, going back to the general case of any partition C, we define the concept of local frontiers and describe how they can be used to improve the previously defined analysis algorithms by allowing the elimination of some branches of the analysis tree. The principle of hiding a co-localization is the same as that of hiding a lifeline. Instead of removing actions whenever they occur on a given lifeline, we remove them whenever they occur on a lifeline that is included in a given co-localization.

The process of hiding a lifeline from an interaction enjoys interesting properties. For instance, hiding commutes i.e. it is the same to hide at first a lifeline l 1 and then l 2 than the other way around. We will also see that the semantics of hidden interactions can be characterized. In the following we formalize hiding as a signature projection.

The reader may have noticed that, whenever we hide a lifeline, the resulting interaction does not contain any action occurring on that lifeline. As a result, if i ∈ I Ω , with Ω = (L, M ), then, given l ∈ L, the Therefore, hiding can be described as a projection between I Ω and I Ω . For the sake of practicity, in the following we will fix the set M of messages and we will simply denote by I L interactions defined on (L, M ).

Likewise, we extend those notations to actions, traces, and multi-traces.

In Def.10.1 we define hiding as a projection operator.

Definition 10.1: Hiding as a projection operator

For any set L and any h ∈ P(L) we define: hide h : I L → I L\h the function s.t. for any i ∈ I L :

• hide h (i) = match i with | ∅ → ∅ | a ∈ A Ω →      a if θ(a) ∈ h ∅ if θ(a) ∈ h | f (i 1 , i 2 ) → f (hide h (i 1 ), hide h (i 2 )) for f ∈ {strict, seq, alt, par} | loop k (i 1 ) → loop k (hide h (i 1 )
) for k ∈ {S, H, W, P }

Elimination operator on multi-traces

We can remark that the hiding operator in the algebra of interaction terms is the dual of a certain operator in the algebra of sets of multi-traces. This operator consists of the elimination of a trace component. We

elim h (µ) = (µ |c ) c∈C\{h}
We extend it to sets of multi-traces elim h : P(T L|C ) → P(I L\h|C\{h} ) s.t. for any T ∈ P(I L|C ):

elim h (T ) = {elim h (µ) | µ ∈ T }
The function elim h is well defined given that C \ {h} is indeed a partition of L \ h.

In fact, the elimination operator elim h erases the trace component µ |h from µ. In order to simplify the notations from that point onwards, for any h ∈ C, we will simply denote by L the set L \ h and by C the set C \ {h} so that the signature of elim h is elim h : P(T L|C ) → P(T L |C ).

elim h preserves the algebraic structures between the F-algebras A C and A C . In the following, in the same manner as what we did in Chap.7 for the projection operator proj C , we will explain how algebraic structures are preserved.

Lemma 10.1: Elimination preserves sequencing & interleaving

For any multi-traces µ 1 and µ 2 from T L|C :

elim h (µ 1 ; C µ 2 ) = elim h (µ 1 ) ; C elim h (µ 2 ) elim h (µ 1 × × C µ 2 ) = elim h (µ 1 ) × × C elim h (µ 2 ) elim h (µ 1 C µ 2 ) = elim h (µ 1 ) C elim h (µ 2 )
And hence, for any sets of multi-traces T 1 and T 2 from P(T L|C ):

elim h (T 1 ; C T 2 ) = elim h (T 1 ) ; C elim h (T 2 ) elim h (T 1 × × C T 2 ) = elim h (T 1 ) × × C elim h (T 2 ) elim h (T 1 C T 2 ) = elim h (T 1 ) C elim h (T 2 )
Proof. Let us consider multi-traces µ 1 and µ 2 . We then have:

elim h (µ 1 ; C µ 2 ) = elim h ((µ 1|c ; µ 2|c ) c∈C ) = (µ 1|c ; µ 2|c ) c∈C = elim h (µ 1 ) ; C elim h (µ 2 ) elim h (µ 1 × × C µ 2 ) = elim h ((µ 1|c ;× × µ 2|c ) c∈C ) = (µ 1|c ;× × µ 2|c ) c∈C = elim h (µ 1 ) × × C elim h (µ 2 ) elim h (µ 1 C µ 2 ) = elim h ((µ 1|c ||µ 2|c ) c∈C ) = (µ 1|c ||µ 2|c ) c∈C = elim h (µ 1 ) C elim h (µ 2 )
Given that the algebraic structures of strict and weak sequencing and interleaving are preserved by the elimination operator, it comes that repetitions of those structures with their Kleene and Head-First closures are also preserved by the elimination operator. We state this in Lem.10.2.

Lemma 10.2: Elimination preserves K-closures and weak HF-closure

For any set of multi-traces T from P(T L|C ):

elim h (T ; C * ) = elim h (T ) ; C * elim h (T × × C * ) = elim h (T ) × × C * elim h (T × × C * ) = elim h (T ) × × C * elim h (T C * ) = elim h (T ) C *
Proof. Implied by Lem.10.1

As a result, the elimination operator preserves all the algebraic structures that are defined in the Falgebra A C of sets of multi-traces up to partition C.

A last interesting property on elim is its relationship w.r.t. the multi-trace prefix closure. We state this property in Lem.10.3.

Lemma 10.3: Elimination and prefix closure

For any multi-trace µ ∈ T Ω|C , any set of multi-traces T ∈ P(T Ω|C ) and any co-localization h ∈ C:

   (elim h (µ) ∈ elim h (T )) ∧ (µ |h = )    ⇒ (µ ∈ T )
Proof. If elim h (µ) ∈ elim h (T ) this means that (µ c ) c∈C\{h} ∈ elim h (T ). Then, there must exist a trace component t ∈ T Ω|h such that a multi-trace µ 0 ∈ T verifies ∀ c ∈ C \ {h}, µ 0|c = µ |c and µ 0|h = t.

Let us then consider the multi-trace µ 1 such that ∀ c ∈ C \ {h}, µ 1|c = and µ 1|h = t. We then have, because µ |h = , that µ 0 = µ C µ 1 and hence µ is a prefix (in the sense of multi-traces) of µ 0 ∈ T .

Therefore µ ∈ T .

Duality of hiding and elimination

In Chap.7, we have seen that σ C is a homomorphism between the algebra of interaction terms (I L , F) and the algebra of sets of multi-traces A C = (P(T L|C ), F A C ). This holds for any L and C and therefore it also holds for L and C with the notations from this chapter.

In this chapter, we have introduced the elim h operator. We have seen that elim h preserves the algebraic structures of the algebra of sets of multi-traces A C into A C . Therefore it is a homomorphism between A C and A C .

We have also introduced the hide h operator. This operator trivially preserves the algebraic structures of (I L , F) into (I L , F). It suffices to consider its inductive definition in which the operation symbols from F of arity n > 0 are always left untouched. As a result, it is a homomorphism between (I L , F) and (I L , F).

Theorem 10.1: Characterizing the multi-trace semantics of hidden interactions

For any interaction i ∈ I L and any h ∈ C:

σ C (hide h (i)) = elim h ( σ C (i))
Proof. Let us reason by induction on the structure of interaction terms:

• σ C (hide h (∅)) = σ C (∅) = { C } = elim h ({ C }) = elim h ( σ C (∅))
• for any a ∈ A L we have:

-if θ(a) ∈ h: σ C (hide h (a)) = σ C (∅) = { C } = elim h ({ C }) = elim h ({a → C C }) = elim h ( σ C (a)) -if θ(a) ∈ h: σ C (hide h (a)) = σ C (a) = {a → C C } = elim h ({a → C C }) = elim h ( σ C (a))
• for any interactions i 1 and i 2 and any (f, ) ∈ {(strict, ; ), (seq, × × ), (par, ), (alt, ∪)}:

σ C (hide h (f (i 1 , i 2 ))) = σ C (f (hide h (i 1 ), hide h (i 2 ))) = σ C (hide h (i 1 )) C σ C (hide h (i 2 )) = elim h ( σ C (i 1 )) C elim h ( σ C (i 2 )) per induction hypothesis = elim h ( σ C (i 1 ) C σ C (i 2 )) = elim h ( σ C (f (i 1 , i 2 )))
• for any interaction i and any (k, ) ∈ {(S, ; ), (H, × × ), (W, × × ), (P, )}:

σ C (hide h (loop k (i))) = σ C (loop k (hide h (i))) = σ C (hide h (i)) C * = elim h ( σ C (i)) C * per induction hypothesis = elim h ( σ C (i) C * ) = elim h ( σ C (loop k (i)))   I L ,    ∅, a ∈ A L ,
       P(TL|C),      { C }, {a → C C }, ∪, ; C , × × C , C , ; C * , × × C * , × × C * , C *           P(T L |C ),    { C }, {a → C C if θ(a)∈h else C }, ∪, ; C , × × C , C , ; C * , × × C * , × × C * , C *      σ C σ C hide h elim h
All four arrows are homomorphisms (preserve algebraic structures) and the diagram commutes.

A multi-trace analysis algorithm using hiding steps

In this section we define a multi-trace analysis algorithm so as to recognize elements of σ | Ľ(i) for any interaction term i. The presentation of this algorithm is similar to the simpler algorithm which we have detailed in Chap.9.

Definition of the algorithm

In the following we will denote by L the infinite universe of lifelines such that for any set of lifelines L, we have L ⊂ L. We then denote by I L the universe of interaction terms and by T | Ľ = L⊂L T L| Ľ the universe of multi-traces defined up to the discrete partition of any set L of lifelines.

The new algorithm also relies on four rules, denoted by R p (for "pass"), R h (for "hide"), R e (for "execute") and R f (for "fail"). Those rules define a directed graph G in which vertices are either a tuple (i, µ) ∈ I L × T | Ľ or an local verdict v ∈ {Obs, Out}. We note V = {Obs, Out} ∪ (I L × T | Ľ) the set of all such vertices.

The formal definition of the graph G and how to construct it is given on Def.10.3.

Definition 10.3: Rules of Multi-Prefix Analysis

The analysis relation ⊆ V × V is defined as:

i Ľ (R p ) Obs i µ (R h ) (µ |{l} = ) ∧ (| Ľ| > 1) hide {l} (i) elim {l} (µ) i a → Ľ µ (R e ) i a -→ i i µ i µ (R f )      ( ∃ l ∈ L s.t. µ |{l} = ) ∧( ∃ i a -→ i s.t. µ = a → Ľ µ ) Out
We can remark that vertices of the form (i, µ) are not sinks. Indeed:

• if µ is the empty multi-trace Ľ then R p can apply and there exists an outgoing edge from (i, Ľ)

• if µ = Ľ:
if a component µ |{l} of µ is empty then rule R h can apply and there exists an outgoing edge from (i, µ) -if there is a match between a frontier action and the head of a component of the multi-trace then rule R e can apply and there exists an outgoing edge from (i, µ) -if neither condition holds then rule R f can apply and there exists an outgoing edge from (i, µ) As a result, local verdicts {Obs, Out} are the only two sinks of graph G.

Rules R o and R f specify edges from vertices of the form (i, µ) to local verdicts.

The rule R e behaves identically as the rule R3 of the algorithm from Chap.9.

The rule R h specifies edges (i, µ) (i , µ ) such that, given the existence of a lifeline l ∈ L on which µ is empty i.e. such that µ |{l} = , we have i = hide {l} (i) and µ = elim {l} (µ).

Definition 10.4: A measure for the vertices of the graph

For any vertex v ∈ G we define its measure |v| as a tuple of integers such that:

• if v ∈ {Obs, Out} then |v| = (-1, -1) • there cannot be more than |frt(i)| different applications of R e because there cannot be more matches than the cardinal of the frontier of execution frt(i)

• if v = (i, µ) then,
• there cannot be more than |L| different applications of R h because there cannot be more than |L| empty trace components on µ

From the two last points, we can conclude that, from any given vertex (i, µ) there is only a finite subgraph of G that is reachable. Also, as in Chap.9, G is an acyclic graph. Then, similarly as in Chap.9 we define the verdict of multi-trace analysis in Def.10.5.

Definition 10.5: Multi-Prefix Analysis

For any L ⊂ L, we define ω L : I L × T L| Ľ → {P ass, F ail} such that for any i ∈ I L and µ ∈ T L| Ľ we have:

• ω L (i, µ) = P ass iff there exists a path (i, µ) * Obs

• ω L (i, µ) = F ail otherwise;

i.e. for all path (i, µ) * v with v ∈ {Obs, Out}, then v = Out

In the following section, we prove the correctness of this algorithm, i.e. that it exactly recognize all the elements of σ Ľ(i). In other words that we have, for any i ∈ I L and µ ∈ T L| Ľ:

( ω L (i, µ) = P ass) ⇔ (µ ∈ σ | Ľ(i))

Proof of correctness

At first, we need to prove a property of confluence of the graph G that is explored during the analysis. This property, given in Lem.10.4 states that if, from a given node (i, µ), we can reach Obs by any given means, then, if we can also apply rule R h so that (i, µ) (hide {l} (i), elim {l} (µ)) for any lifeline l, then we can also reach Obs from (hide {l} (i), elim {l} (µ)). This is indeed a property of confluence given that it states that we may take another path, in which we might as well hide lifeline l, so as to reach Obs.

Lemma 10.4: A confluence property for the analysis graph

For any interaction i ∈ I L , any action a ∈ A L , any multi-trace µ ∈ T L| Ľ and any lifeline l we have that:

(i, µ) * Obs (i, µ) (hide {l} (i), elim {l} (µ)) (hide {l} (i), elim {l} (µ)) * Obs
Proof. Let us reason by induction on the measure |(i, µ)| = (x, y):

• If x = 0 then µ = Ľ and:

if y = 1 the premise do not hold because we cannot apply R h if y > 1 we have that (i, Ľ) (hide {l} (i), Ľ ) and we can immediately apply rule R p so that the conclusion holds

µ ∈ σ | Ľ(i) ⇔ ω L (i, µ) = P ass
Proof. Let us reason by induction on the measure |(i, µ)| = (x, y).

• If x = 0 then µ = Ľ and hence we have both ω L (i, µ) = P ass because rule R p immediately applies and µ ∈ σ | Ľ(i) because the empty multi-trace Ľ is in the prefix closure of any non-empty set of multi-traces.

• If y = 1 then there is a single co-localization i.e. a single lifeline that is still observed. Then:

either µ = Ľ and we are in the same case as the one above • Let us then consider x > 0 and y > 1. Then:

-or µ = Ľ.
-If there exists a lifeline l s.t. µ |{l} = then we can apply rule R h and we have (i, µ)

(hide {l} (i), elim {l} (µ)) and then:

⇒ if µ ∈ σ |L (i) = σ L (i)
Ľ µ + = a → Ľ µ * = (a → Ľ µ ) Ľ µ + and therefore µ Ľ µ + = µ * ∈ σ | Ľ(i ). Hence µ ∈ σ | Ľ(i ) = σ |L (i )
. Then:

• on the one hand we can apply the induction hypothesis on i and µ so that we have • on the one hand we can apply the induction hypothesis on i and µ so that we have

µ ∈ σ | Ľ(i ) which implies the existence of µ + such that µ Ľ µ + ∈ σ | Ľ(i )
• on the other hand the fact that i a -→ i and µ Ľ µ + ∈ σ | Ľ(i ), as per Lem.7.8 this implies that a

→ Ľ (µ Ľ µ + ) ∈ σ |C (i). In particular, this implies that µ = a → Ľ µ ∈ σ | Ľ(i)
We have therefore defined an algorithm which solves the membership problem for σ | Ľ. In fact, this multi-trace µ is such that µ Ľ µ + ∈ σ Ľ(i) with µ + such that µ +|{l1} = , µ +|{l2} = l 2 ?m 1 .l 2 !m 2 .l 2 !m 3 and µ +|{l3} = . And, as a result, µ ∈ σ | Ľ(i).

Illustrative example

In other words, the execution which observation corresponds to µ corresponds to a behavior that is indeed specified by the interaction, with one instanciation of the loop H . However, the observation of that execution has only been partial, given that nothing was observed on lifeline l 2 . As a result, the collected multi-trace is a prefix (in the sense of multi-traces) of an accepted multi-trace. It is not however the projection of a prefix of an accepted trace given that the events that are missing do not occur at the end of the globally reordered behavior.

In Fig. 10.4 we represent the use of two algorithms to recognize that µ ∈ σ | Ľ(i). On the left, an algorithm with simulation steps, which we have informally described in Chap.8. And, on the right, the ω L algorithm with hiding steps which we have formally defined.

The algorithm based on simulation steps, which application is represented on the left of Fig. 10.4, reconstitutes the entire global trace which projects onto µ Ľ µ + . When events of this trace are in µ, this is done via steps in which the action is consumed from µ. And, when this is not the case, simulation steps fill-in the gaps. Let us then consider the algorithm based on hiding steps, which application is represented on the right of Fig. 10.4. We can see that similarly to the first, we can, as a first step, consume action l 1 !m 1 with a normal execution step. From that second vertex we have no match between head actions of the multi-trace and frontier actions and hence, no action can be consumed. However, we have that the component trace on lifeline l 2 is empty. As a result, we can hide this lifeline on the model. This allows the further consumption of the multi-trace until the same verdict (as the one from the algorithm with simulation steps) is reached.

By contrast to the algorithm with simulation, the algorithm with hiding takes less steps. In this particular example it took only 4 steps instead of 6. However, in more complex cases, we argue that the algorithm with hiding is increasingly more efficient that the one with simulation.

Local frontiers

Let us now consider the example from Fig. 10.5. In this example, the behavior that is analyzed corresponds to a multi-trace µ that is in the semantics σ † | Ľ(i) of the specifying interaction i. Also, we use an algorithm which makes use of hiding steps. From the starting vertex at the top of Fig. 10.5 we can see that we have two matches between head actions and frontier actions. Indeed, in the interaction term we have two occurrences of action l 1 !m 1 . As a result, both branches are explored. However, the branch on the left yields Out which means that it cannot consume the multi-trace. The branch on the right however yields T ooShort which signifies (as we have seen on Chap.8) that the algorithm recognized that µ ∈ σ † | Ľ(i).

In the example analysis represented on Fig. 10.5, when there are several matches, the algorithm explores the paths opened-up by matching frontier actions in the lexicographic order of their respective positions in i. Also, we use a Depth-First-Search heuristic to explore the graph G. As a result, the branch on the left of Fig. 10.5 is entirely explored before the right branch is. Once we have found T ooShort we then decide to stop the analysis even though there may remain some other branches to explore (in this precise example we can identify 5 distinct paths to local verdicts).

More generally, depending on heuristics that might be used to explore the graph G and depending on whether or not we stop the analysis when reaching a certain local verdict, the number of vertices that are explored during a given analysis may widely vary. Reducing the span of the sub-graph of G that is explored before concluding the analysis is important because it mechanically reduces the time and memory complexity of the analysis1 .

In the following we propose one such mechanism. It relies on the definition of "local frontiers" which, for any given co-localization c ∈ C, gathers the actions which may be executed on c the next time an action is executed on that co-localization c. In other words, by contrast to the frontier of execution which gathers actions which are immediately executable globally, a local frontier gathers actions which may be executed next locally.

Definition

For any co-localization c, the local frontier of an interaction i up to c is the frontier of hide L\c (i) where we have hidden all lifelines not in c. We thus define the "locfrt" function in Def.10.6. We can therefore see that local-frontier and frontier are two distinct notions. In the example from Fig. 10. [START_REF]Raspberry pi[END_REF] we can indeed see that frt(i) and locfrt(i, c) do not even intersect. Indeed, aside from its definition, locfrt is not necessarily related to frt. A characterization which holds however, is that given in Lem.10.5.

Lemma 10.5: A characterization of local frontiers

For any i ∈ I Ω and any c ∈ P(L):

{p ∈ frt(i) | θ(i |p ) ∈ c} ⊂ locfrt(i, c)
Proof. It suffices to reason by induction on the structure of interaction terms and use the facts that locfrt(i, c) = frt(hide L\c (i)) and that hide L\c preserves the structure of terms.

Characterization w.r.t. the multi-trace semantics

As mentioned earlier, and as illustrated in Fig. 10.6, a local frontier gathers actions which can be executed at the soonest on a certain co-localization. In the example from Fig. 10.6 it is indeed not possible to have any other action than either l 3 ?m 1 or l 3 ?m 2 being the first action to be executed on c = {l 2 , l 3 }.

We can formalize this property of local frontiers in terms of accepted multi-traces. Whenever a multitrace µ is accepted by an interaction i, then all its head actions i.e. all the actions a such that µ = a → C µ , must be the first action which is executed on the co-localization θ C (a) on which it occurs. As a result, we must have the existence of p ∈ locfrt(i, θ C (a)) such that a = i |p . In Lem.10.6, we state this property for multi-traces that belong to σ C (i), but, because σ |C (i) ⊂ σ C (i) as per Lem.7.9, this also holds true for µ ∈ σ |C (i).

Lemma 10.6: Local frontiers and multi-trace semantics

For any C ∈ Part(L), any i ∈ I Ω , any a ∈ A Ω and any µ ∈ T Ω|C :

(a → C µ ∈ σ C (i)) ⇒ (∃p ∈ locfrt(i, θ C (a)), s.t. i |p = a)
Proof. Let us then reason by induction on |C|:

• If |C| = 1 then we are on the trivial partition. Let us then use notations and results pertaining to the global trace semantics σ. We have a.t ∈ σ(i), which implies that there must exist i s.t. i a -→ i and hence as per the equivalence of the execution and operational semantics, there must exist p ∈ frt(i) such that i |p = a (and exe(i, p) = i ). Then, we can conclude using Lem.10.5. The checking of local frontiers can be used to improve the efficiency of any multi-trace analysis algorithm of the type which we have described. We can for instance use it to improve ω C from Chap.9 or ω L from Sec.10.2. In Chap.8 we have discussed algorithms based on simulation steps. In particular, one can use simulation steps as a preamble to the consumption of actions from a certain co-localization. The checking of local frontiers can be adapted to be compatible with those algorithms as well, as we will see in the next chapter.

• If

Conclusion

In this chapter we have presented the notions of hiding interactions and eliminating co-localizations from multi-traces. We have shown the duality of those two notions with regards to the algebraic multi-trace semantics. We then defined two practical uses of those operators. The first one is an algorithm which makes use of hiding steps to recognize prefixes (in the senses of multi-traces) of accepted multi-traces defined up to the discrete partition. The second one is a technique to improve the efficiency of any analysis algorithm. This technique allows one to avoid exploring some paths of the analysis graph that cannot yield a positive result.

The issue of termination & loops

In Chap.8, we explained that simulation steps could be used to fill-in gaps in a partially observed multi-traces in which events that have not been observed are missing. However, let us then consider this very trivial example: given L = {l} and M = {m 1 , m 2 }, let us suppose that we have i = loop S (l!m 1 ) and we want to analyze µ = (l!m 2 ). Then, a very naive algorithm with simulation steps might hope that by simulating the execution of l!m 1 so that i l!m1 ---→ i it might somehow unlock the further consumption of l!m 2 . Moreover, if there are no mechanisms to limit simulation steps, this algorithm might even never terminate. This issue of termination ultimately relates to the presence of loops in the interaction term. Indeed, if there are no loops, then there can only be a finite number of simulation steps, until all the actions that are present in the initial term have been executed either via the usual execution and consumption of the action from the multi-trace or via some simulation step.

Hence, so as to ensure termination of the process, one must fix a limit to the number of times loops may be instantiated. However, this limit might not be global i.e. the same during the whole of the analysis. Indeed, a global behavior to which a multi-trace projects might be interspersed with missing events (i.e. gaps in observation). As a result, we might need to alternate between steps of consumption and steps of simulation. We argue for resetting this limit each time the normal consumption of the multi-trace is resumed.

Consequently, the limit on the instanciation of loops corresponds to the number of times loops may be instantiated during any given sub-path of G consisting of consecutive applications of simulation steps. We can fix the limit as an initial value to a certain index. Then, each time a loop is instantiated in a simulation step, this index is decremented of a certain value. Once the simulation has unlocked the further consumption of the multi-trace, and once an event has effectively been consumed from the multi-trace, this index can be reset. Details on this will be presented in Sec.11.1.2 and Sec.11.1.3 in which we concretely define algorithms which make use of simulation steps. In any case, this method allows to ensure the termination of the process.

Indeed there can only be a finite number of "reset" and hence only a finite number of instanciations of loops and hence only a finite number of actions that can be executed either via consumption or simulation.

The limit that we fix i.e. the initial value of the index is set at the maximum loop depth of the current interaction term. We formalize this notion of "loop depth" β and "maximum loop depth" β in Def.11.1. This limit β (i) corresponds to the maximum depth of nested loops that can be found in the interaction term i.

From any node of the form (i, µ, j), we can apply one of the five rules (and as a result, (i, µ, j) nodes are not sinks):

• if µ = C i.e. if it is empty, then we can apply R p and reach the Obs local verdict • if µ is not empty then:

if the checking of local frontiers fails then we can apply R d and reach the Out local verdict if not (i.e. if checkloc C (i, µ) = ) then: * if there is a match between an immediately executable action from the interaction i and the head of a component of µ then we can apply R e . With this rule, we simultaneously execute the matching action in the interaction term and consume it in the multi-trace. Also, as explained before, we reset the value of the index j to the maximum loop depth of the new follow-up interaction. * if there exists an empty trace component, let us then consider c ∈ C such that µ |c = .

Then we may allow the simulation of the behavior of lifelines l ∈ c. This means that we may allow the execution of frontier actions i |p with p ∈ frt(i) if θ C (i |p ) = c. However, as explained before, we restrict which actions can be executed depending on whether or not their execution involves the instantiation of loops. This constraint corresponds to the j ≥ β (i, p) condition, and allows the process to terminate. Those simulation steps therefore correspond to the application of rule R s . Given the execution of a frontier action i a@p --→ i , if the previous constraints are satisfied then R s yields the node (i , µ, (j -β (i, p)), with the index j being decremented by the loop-depth of the executed action. * if no action can be executed either via consumption or simulation then we can apply rule R f and reach the Out local verdict.

As in case of the previous algorithms, the only two sinks of the graph G are the local verdicts Obs and Out. We define the analysis relation, which defines edges of graph G in Def.11.2.

Definition 11.2: Rules for Multi-Prefix Analysis with simulation

The analysis relation ⊆ V × V is defined as:

i C j (R p ) Obs i µ j (R d ) checkloc C (i, µ) = ⊥ Out i a → µ j (R e )      (checkloc C (i, a → µ) = ) ∧ (i a -→ i ) i µ β (i ) i µ j (R s )            (checkloc C (i, µ) = ) ∧ (i a@p --→ i ) ∧ (j ≥ β (i, p)) ∧ (µ = C ) ∧ (µ |θ C (a) = ) i µ (j -β (i, p)) i µ j (R f )            (checkloc C (i, µ) = ) ∧ (µ = C ) ∧    ∃i a@p --→ i s.t.    (µ = a → C µ ) ∨ (µ θ C (a) = ) ∧ (j ≥ β (i, p))      

Out

Similarly as what we did in Chap.9, we can then remark that the sub-graph of G (the analysis graph) that is thus defined (starting from (i 0 , µ 0 , β (i 0 ))) is finite and:

• there exists at least one path from (i 0 , µ 0 , β (i 0 )) to either Obs or Out • either Obs or Out are reachable from any node of the form (i, µ, j)

As a consequence, we can define a function ω C : I Ω × T Ω|C → {P ass, F ail} which returns the global verdict resulting from the analysis of a multi-trace µ 0 against an interaction i 0 . The definition of this ω C is reminiscent of that of ω C from Chap.9 and is given in Def.11.3.

Definition 11.3: Multi-Trace Prefix Analysis with simulation

ω C : I Ω × T Ω|C → {P ass, F ail} is s.t. for any i ∈ I Ω and µ ∈ T Ω|C we have:

• ω C (i, µ) = P ass iff there exists a path (i, µ, β (i))

* Obs

• ω C (i, µ) = F ail otherwise;

i.e. for all path (i, µ, β (i))

* v with v ∈ {Obs, Out}, then v = Out
The correctness of algorithm ω C from Chap.9 has been proven in Th.9.1 and Th.9.2 and equates having, for any interaction i and any multi-trace µ:

ω C (i, µ) = P ass ⇔ µ ∈ σ |C (i)
By analogy the correctness of this new algorithm ω C equates to having, for any interaction i and any multi-trace µ:

ω C (i, µ) = P ass ⇔ µ ∈ σ |C (i)
Writing a formal proof of this predicate would require the formulation of a property stating that fixing the maximum number of loop instantiation at β (i) is sufficient to explore all paths that would allow the further consumption of µ. We have not written such a proof. However, extensive use of this algorithm via the HIBOU tool implementation (that we will present in Chap.12) seems to confirm that this predicate holds. Moreover, we have defined in Chap.10 the ω L algorithm which is proven correct. Given that both ω L and ω Ľ are implemented in HIBOU, we can compare their outputs.

Algorithm to discriminate elements of different semantics

In this chapter we present an algorithm that allows to discriminate between multi-traces belonging to any or none of the four semantics σ |C , σ † |C , σ |C and σ |C . This algorithm is defined in the same manner as the previous. It relies on defining and exploring a directed graph G in which vertices are:

• either a tuple (i, µ, j, s, O) where:

i ∈ I Ω is the specifying interaction µ ∈ T Ω|C is the multi-trace to analyse j is an index to count the number of loops that one is still allowed to instantiate in successive simulation steps (as in the previous algorithm) s ∈ P({s pre , s post }) is a set that keeps track of whether or not we have already done some simulation steps, either as a preambule or as a postambule to the consumption of any given trace component -O ∈ P(C) is a set that keeps track of the co-localization of which the corresponding trace component we have already started to consume during the analysis

• or a local verdict v ∈ {Cov, Short, M ultiP ref, Slice, Out}

As was previously done, we can denote by V the set of such vertices and we then define the algorithm via a relation on V.

The analysis of the multi-trace µ 0 against the interaction i 0 then corresponds to the exploration of a sub-graph of G that starts from the node (i 0 , µ 0 , β (i 0 ), ∅, ∅).

We adapt the checking of local frontiers to the fact that we may allow simulation steps to be taken as a preamble to the consumption of actions. The analysis relation ⊆ V × V is defined as:

i C j s O (R p1 ) (i ↓) ∧ (s = ∅) Cov i C j s O (R p2 ) (i ↓) ∧ (s = ∅) Short i C j s O (R p3 ) (s post ∈ s) ∧ (s pre ∈ s) M ultiP ref i C j s O (R p4 ) (s pre ∈ s) Slice i µ j s O (R d ) checkloc C (i, O, µ) = ⊥ Out i a → µ j s O (R e )      (checkloc C (i, O, µ) = ) ∧ (i a -→ i ) i µ β (i ) s (O ∪ {θ C (a)}) i µ j s O (R - s )                  (checkloc C (i, O, µ) = ) (i a@p --→ i ) ∧ (j ≥ β (i, p)) ∧ (µ = C ) ∧ (µ |θ C (a) = ) ∧ (θ C (a) ∈ O) i µ (j -β (i, p)) (s ∪ {s pre }) O i µ j s O (R + s )            (checkloc C (i, O, µ) = ) (i a@p --→ i ) ∧ (j ≥ β (i, p)) ∧ (µ = C ) ∧ (µ |θ C (a) = ) i µ (j -β (i, p)) (s ∪ {s post }) c i µ j s O (R f )                  (checkloc C (i, µ) = ) ∧ (µ = C ) ∧       ∃i a@p --→ i ,       (µ = a → C µ ) ∨   (j ≥ β (i, p)) ∧    (µ θ C (a) = ) ∨ (θ C (a) ∈ O)                  

Out

Similarly to the previous algorithms, the analysis explores a sub-graph of G that starts from a node (i 0 , µ 0 , β (i 0 ), ∅, ∅). This sub-graph is finite and:

• there exists at least one path from (i 0 , µ 0 , β (i 0 ), ∅, ∅) to one of either local verdicts • a local verdict is reachable from any node of the form (i, µ, j, s, O)

As a consequence, we can define a function ω * C : I Ω × T Ω|C → {P ass, W P short , W P muprf , W P slice , F ail} which returns the global verdict resulting from the analysis of a multi-trace µ 0 against an interaction i 0 .

Definition 11.6: Multi-trace analysis with discrimination

For any signature Ω = (L, M ) and any partition C ∈ Part(L) of lifelines, we define ω * C : I Ω × T Ω|C → {P ass, W P short , W P muprf , W P slice , F ail} such that for any i ∈ I Ω and µ ∈ T Ω|C we have:

• ω * C (i, µ) = P ass iff there exists a path (i, µ, β (i), ∅, ∅) * Cov • ω * C (i, µ) = W P short iff
(i), ∅, ∅) * v for any v ∈ {Cov, Short, M ultiP ref } • ω * C (i, µ) = F ail otherwise; i.e. for all path (i, µ, β (i), ∅, ∅) * v, if v ∈ {Cov, Short, M ultiP ref, Slice, Out}, then v = Out
In intention, this new algorithm characterizes the semantics of interactions and the various notions of prefixes as follows:

ω * C (i, µ) = P ass ⇔ µ ∈ σ |C (i) ω * C (i, µ) = W P short ⇔ µ ∈ σ † |C (i) \ σ |C (i) ω * C (i, µ) = W P muprf ⇔ µ ∈ σ |C (i) \ σ † |C (i) ω * C (i, µ) = W P slice ⇔ µ ∈ σ |C (i) \ σ |C (i)
This algorithm is implemented in the HIBOU tool, which we describe in Chap.12.

Co-regions

In addition to the three scheduling constructors strict, seq and par, we can consider a family of scheduling constructors called co-regions.Those constructors behave like par when considering some lifelines, and like seq when considering all others. As a result, only minor adaptations are needed so as to use the various results presented in this thesis on those constructors. A co-region must be configured by a subset of lifelines and there exists as many co-region operators as there exists subsets of the set of lifelines (i.e. P(L)). We use co-regions to schedule behaviors that must occur sequentially on some sub-systems but that can occur concurrently on some other sub-systems. lifeline l 1 and concurrently w.r.t. lifeline l 2 . As a result, the semantics of this interaction contains 3 accepted traces. Either the first message passing is completed before the second starts (first trace), or the message passings are interleaved (second and third traces). Given that the behaviors are scheduled sequentially w.r.t.

lifeline l 1 , this interleaving cannot concern the l 1 !m 1 and l 1 !m 2 actions, which keep the same relative ordering (i.e. l 1 !m 1 before l 1 !m 2 ). However, we can switch the order of l 2 ?m 1 and l 2 ?m 2 .

The use of co-regions constitute a syntactic sugar. Indeed, as exemplified on Fig. 11.1 it is always possible to express, using the core IL, an interaction that is semantically equivalent to an interaction that uses co-regions. However doing so is often impractical and inelegant.

Moreover, for modelling real-life DSs, the co-region constructs are particularly useful. Indeed, the nondeterminism of the support networks through which messages transit makes so that messages send in a certain order (that is enforced on the emitter sub-system / lifeline) may not be received in the same order (order not enforced on the receiver sub-systems / lifelines).

Let us remark that for a co-region coreg(x), with x ∈ P(L), if x = ∅ then coreg(x) behaves for all intent and purposes, exactly like the seq operator; and if x = L then coreg(x) behaves for all intent and purposes, exactly like the par operator.

that we have uncovered a path in the analysis graph in which we have consumed µ entirely and in which there remain i s.t. i ↓ constitutes a formal proof that µ ∈ σ |C (i) and we do not need to explore the graph any further. * in the other case, W P is returned, indicating that we have proven (by discovering a certain path in the analysis graph) that µ ∈ σ † |C (i) -if it is not the case, then we try to simultaneously consume an action at the head of multi-trace and execute a matching frontier action of the interaction model, as in rule R3 of the algorithm from Chap.9. In this "tooled" analysis algorithm, we compute a set of matches of the form (i, p, µ ) such that p is a frontier action and µ = i |p → C µ . We then insert all those matches in our queue q, with heuristics being able to modulate how those matches are inserted. Given that initially, the queue was empty, in the first pass of the algorithm, this inserts into the queue all of the matches found from the initial vertex (i, µ) of the analysis graph.

As a result, this first pass of the algorithm either yields a global verdict or results in the insertion of some matches in the queue. Let us then describe what happens in the latter case.

(i, µ)

(µ = C )? (i ↓)? P ass W P ⊥ (i, µ) i ⊥ frt frt(i) match (i, p, µ ) (p ∈ frt(i)) ∧ (µ = i |p → C µ ) enqueue q (queue) (q = )? F ail dequeue ⊥ (i, p) µ prn ≈ exe ≈ i (i , µ ) heuristics Figure 11
.2: Principle of a configurable implementation of an analysis algorithms like that of Chap.9

We start by checking if the queue indeed has some elements in it because it could be so that no matches were found during the first pass. On Fig. 11.2, this is indicated by (q = )?. Then:

• if the queue is empty then the algorithm immediately stops and returns a global verdict F ail. In the case of the first pass of the algorithm, this is explained by the fact that we have found no matches allowing transitioning out of the initial vertex (i, µ). In the case of later passes of the algorithm, this means that no further exploitation of matches found globally can be performed. We have explored every reachable vertex of the form (i, µ) without being able to consume µ and hence the global verdict F ail is justified.

• if the queue is not empty, then this means that there are some possible applications of rule R3 that would allow to reach some further vertices of the analysis graph that have not yet been visited. The decision of which element of the queue i.e. which match should be exploited first can be taken according to some heuristics. In any case, an element (i, p, µ ) of the queue is dequeued. Then, we execute action i |p at position p in i i.e. we compute i = exe ≈ (i, p). At this point we have therefore visited a new vertex (i , µ ) of the analysis graph and the process can be repeated.

With the example presented in this section, we have illustrated the ease of implementation permitted by the formulation of the theoretical results of the thesis. The definition of this type of process that is configurable via the use of heuristics can be applied to all previously defined multi-trace analysis algorithms.

Conclusion

In this chapter we have presented immediate extensions to the results of Part.I and Part.II. We have notably defined algorithms that make use of simulation steps so as to solve the membership problem for various multi-trace semantics. With those additional algorithms, we can now identify and discriminate between elements of all the projected multi-trace semantics which we have defined in Chap.7. The termination of those algorithms is guaranteed by a criterion on the number of loop instantiations during consecutive successions of simulation steps. We argue that a formal proof for the correctness of those algorithms is possible. It would rely on demonstrating that instantiating once each loop is sufficient so as to reveal all potential manners to further consume the multi-trace.

In this chapter we have also presented a small but practical extension to the language in the form of the coreg constructor which mixes weak sequencing and interleaving.

Finally, we have demonstrated, on an example analysis algorithm, the ease with which one can implement the various algorithms which we have previously defined. Such implementations can additionally be made configurable through the use of search heuristics for the traversal of analysis graphs. By setting a stopping criterion, the whole of the graph may not need to be visited.

In the next chapter we present the actual tool implementation HIBOU which implements almost everything that was presented in the previous chapters and including this one.

In this chapter we present the HIBOU tool which implements most of the theoretical results that were previously presented.

The plan of this chapter is the following:

• in Sec.12.1 we quickly present the software and relevant parts of its user interface,

• in Sec.12.2 we present the entry language for encoding interaction terms and multi-traces,

• in Sec.12.3 we present the feature for exploring the semantics (i.e. execution trees) of interactions and introduce possible configurations of heuristics for the traversal of execution trees and analysis graphs,

• in Sec.12.4 we present the feature for analysing multi-traces, which allows the use of any of the previously defined analysis algorithms.

12.1 Overview HIBOU (for Holistic Interaction Behavioral Oracle Utility) provides utilities for drawing and manipulating interaction models, computing their normal forms, exploring their semantics and analysing executions of DSs (collected and transposed in the form of traces or multi-traces) with regards to formal specifications written as interaction models. This enables, among other things, the incremental design of precise and complex behavioral models of DSs.

We have implemented HIBOU using the Rust programming language [7]. The use of this language which is reliable, fast and memory efficient and in which it is difficult to make runtime errors allowed us to concentrate on the faithful implementation of the theoretical results presented in the first two parts of the thesis. The full code of HIBOU is hosted on github and available in [START_REF] Mahe | Hibou tool[END_REF]. It contains (for version 0.5.6) 11526 lines in 96 files among which 8373 lines of code. The version of HIBOU which we describe in this chapter is version 0.5.6.

HIBOU takes the form of an executable which offers a user Command Line Interface (CLI). Precompiled binaries are available for Windows and Linux in [START_REF] Mahe | Hibou tool[END_REF].

The use of HIBOU is associated to two kinds of input files:

• "hibou specification files", in which interaction models are encoded and which correspond to the ".hsf" filename extension

• "hibou trace file", in which traces or multi-traces are encoded and which correspond to the ".htf" filename extension

Then, the hibou executable provides a CLI which includes (among others) the following commands:

• "hibou draw <.hsf file>" draws an interaction in the manner which we have seen throughout the thesis 12.2. ENTRY LANGUAGE FOR INTERACTION TERMS & MULTI-TRACES

Encoding multi-traces

In the example on Fig. 12.2, we have on the left the encoding of a multi-trace term in a ".htf" file. On the right we have a drawing of that multi-trace made by HIBOU (as part of an analysis). For the analysis of a multi-trace, the declaration of the sets M of messages and L of lifelines is made in the ".hsf" file specifying the interaction model. As a result, when parsing a ".htf" we presuppose the existence of L and M . We may use some additional keywords for ease of use:

• [#all] l1!m1.l3!m4 for instance signifies that all lifelines are in this co-localization and therefore we have a global trace. For instance if L = {l 1 , l 2 , l 3 , l 4 } then all of them are considered.

• by contrast, [#any] l1!m1.l3!m4 signifies that the lifelines appearing on the definition of the trace component are taken into account to define the co-localization. For instance here, if L = {l 1 , l 2 , l 3 , l 4 }, then the co-localization is {l 1 , l 3 } because only those two appear.

• if a lifeline from L is left without any co-localization that contains it, then an empty trace component is created for it

Semantic exploration and heuristics

We have mentioned in Chap.6 that the semantics that is implemented in HIBOU is the simplifying execution semantics σ≈ e . This enables us to compute and display the execution tree of any interaction term. We provide this option as a feature of HIBOU with the "hibou explore" command. On Fig. 12.4 is represented an exploration of the execution tree of the interaction specified on Fig. 12.3.

The graphical representation associated to this exploration and that is presented on Fig. 12.4 is generated by HIBOU.

On the top of Fig. 12.3, we can see that the exploration that is performed is configured in a certain manner which corresponds to that specified in the ".hsf" file from Fig. 12.3 via the @explore_option section. • "MaxLoop" correspond to frontier actions which were not executed due to having reached (in the path leading to that node) the limit concerning the number of loops that may be instantiated. On the example from Fig. 12.4 we can see that the first execution of l 1 !m 1 (first transition on the left of the topmost node) created a new instance of a loop. Given that our limit was fixed at 1, withtin that sub-tree, no loops can be instantiated anymore. Hence, on the left node in the second row, we cannot execute l 2 !m 2 which is the first frontier position in lexicographical order. As a result, we have a brown "MaxLoop" node on the leftmost of the second row.

• "MaxDepth" correspond to frontier actions which cannot be executed due to having reached the limit concerning the maximum depth of the explored part of the execution tree. We can see here that all frontier actions belonging to interactions from the third row cannot be executed and yield a brown "MaxDepth" node.

• "MaxNum" correspond to cases in which we have reached the maximum number of nodes in the overall tree. On Fig. 12.4 we can indeed see that we have exactly 7 nodes containing interactions. This limit is reached when the node on the bottom right is created (as expected due to having a Depth First Search strategy). Then, if we look at the node on the right of the second row, we can see that we have 4 frontier actions, which, by lexicographic order of their respective positions are:

l 3 ?m 2 which is executed and yield the node underneath l 1 !m 1 which is not executed due to it being underneath a loop and the exploration having reached the maximum loop depth l 2 !m 2 which is not executed for the same reasons and l 1 !m 3 which is not executed because at this point in the exploration, we have already created 7 nodes and no new nodes are allowed to be created In addition to the Depth First Search strategy, which we may select using "strategy = DepthFS;", HIBOU also implements Breadth First Search which can be selected with strategy = BreadthFS;".

Frontier priorities

We have seen that, with HIBOU, the order in which frontier actions are evaluated to compute child nodes is, by default, the lexicographic order of their respective positions. Hence, actions "at the top" of the sequence diagram representation will be evaluated before those "at the bottom". We have seen that this is the case for "exploration", which computes parts of execution trees but this also holds for "analysis" which computes parts of analysis graphs. This can be problematic in certain cases. In particular, let us consider the example from Fig. 12.5. We can see that in this exploration, we have set a maximum depth of 3 and a maximum number of nodes at 5. We then use a Depth First Search strategy to explore the execution tree of the interaction. At the first transition, we execute action l 2 !m 1 underneath the loop W . Given that in the followup interaction, we have the loop W (l 3 !m 3 ) that was put in front, due to the pruning of the initial loop, it is then action l 1 !m 3 that is at the first position in the lexicographic order of positions. Then, given that we have loop W (l 3 !m 3 ) l3!m3 ---→ loop W (l 3 !m 3 ) we can indefinitely execute l 3 !m 3 which may not necessarily be an interesting exploration.

The concept of frontier priorities is to change the order in which frontier actions are evaluated. In HIBOU, we can set integer priority levels that may change the order of actions depending on:

• whether they are emissions of receptions • whether or not they are underneath loops and at which depth (i.e. same search strategy and same filters) but with having set a priority of -1 to actions underneath loops. We can then observe that the action that is at the first position in the second node from the top is now l 1 ?m 1 instead of l 1 !m 3 (which was the case in Fig. 12.5). This is explained by the fact that l 1 !m 3 is underneath a loop while l 1 ?m 1 is not. In more details, l 1 ?m 1 is at loop level 0 while l 1 ?m 1 is at loop level 1.

Then their relative priorities are respectively 0 * (-1) = 0 and 1 * (-1) = -1 and hence l 1 ?m 1 is of higher priority for evaluation. We can then see that we manage to execute almost entirely the sub-behavior that was instantiated (not entirely due to the depth limit).

With this example, we have showcased the use of frontier priorities in the case of exploration i.e. the computation of parts of some execution trees. However, frontier priorities may be more particularly useful in context of multi-trace analysis.

Multi-trace analysis

In Chap.9, Chap.10 and Chap.11 we have defined various multi-trace analysis algorithms. All of those algorithms are implemented in a configurable manner in HIBOU.

We have seen in Sec.12.3 that the exploration of an execution tree could be configured via the declaration of options within a @explore_option section of the input ".hsf" file. Similarly, the analysis of a multi-trace against an interaction can be configured via a @analyze_option section. Those options includes those already available to @explore_option i.e.:

• we can use for instance loggers = [graphic[png,horizontal]]; to create a logger that will draw the process from left to right in a png file. This can notably be helpful for debugging e.g. understanding why a certain multi-trace is non-conform. However generating a "svg" image is most often a better choice. Also it is not recommended to use a graphical logger if the time required for the analysis is a limiting factor given that it reduces the overall performance of HIBOU.

• we can set a search strategy with for instance strategy = DepthFS;. Using a Depth First Search is most often recommended for multi-trace analysis given that it favors going deeper in some paths in which many actions from the multi-trace can be consumed instead of exploring bits of many different paths.

• we can impose limits on the exploration of the analysis graph, with for instance filters = [max_depth = 3]; However imposing such limitations in the case of multi-trace analysis is not recommended given that it removes the guarantees on the correctness of the returned verdict given by the formal proof. Indeed imposing such limits artificially restricts which parts of the analysis graphs can be reached and hence some local verdicts may be missed.

• we can set frontier priorities for the evaluation of frontier actions, with for instance frontier_priorities = [reception=1]; The analysis that is illustrated on Fig. 12.7 make use of the algorithm from Sec.11.1.3, with allows simulation steps both as a preamble and as a postamble to the consumption of actions. We can see that with a Depth First Search, the local verdict "Slice" is found quickly. And, given that we have set the goal to "WeakPass", the algorithm immediately returns.

Conclusion

In this chapter we quickly presented the HIBOU tool which implements most results from the first two parts of the thesis. We have seen that this tool allows for the configurable analysis of multi-traces against interaction models, which was one of our initial objectives.

Chapter 13

Extension to data Contents

In this chapter we discuss extending our Interaction Language to include interactions enriched with data, and extending multi-trace analysis to include multi-traces enriched with concrete message parameters.

The plan of this chapter is as follows:

• in Sec.13.1 we discuss a specific limitation caused by abstracting information that is exchanged within a DS with simple labelled messages. We then explain that taking into account the passing of concrete data (value passing) can be a solution to this limitation.

• in Sec.13.2 we discuss the manner in which data can be introduced into interaction models.

• in Sec.13.3 we discuss the formalisation of interactions enriched with data.

• and, in Sec.13.4 we provide some more details on the use of symbolic execution to explore the semantics of symbolic interactions and analyse multi-traces enriched with data.

An issue with abstracting exchanged information as messages

A working hypothesis that comes with using our IL and the framework for multi-trace analysis provided by HIBOU is that the information that transit at the interfaces of the DS's sub-systems can be abstracted as simple labelled messages m ∈ M from a set of messages M . Moreover, given that interaction terms are finite trees, within any i ∈ I Ω , there can be only a finite number of distinct messages that appear. As a result, within the context of the analysis of a multi-trace against an interaction, we might as well consider M to be a finite set.

Abstracting away typed data with an arbitrarily wide space of possible values into a finite set of labels obviously comes with its own set of limitations. In this section we present one such limitation (among many) and explain how value passing, and by extension, the consideration of interaction models enriched with data, can help mitigate this limitation. Let us then suppose that several instances of message m 1 are emitted consecutively. Then, there are no remaining instances of l 2 ?m 1 on the multi-trace could each be interpreted as either of the three instances of l 2 ?m 1 that are scheduled with par within the remaining interaction term.

We have already evoked this problem in our publication [START_REF] Mahe | Revisiting semantics of interactions for trace validity analysis[END_REF] where we used a partial high-level modelisation of the MQTT telecommunication protocol (version 3.1.1) [START_REF]MQTT version 3.1.1. Technical report[END_REF] as a use-case for global trace analysis.

The diagram representation of the corresponding interaction model is given on the left of Fig. 13.3. This model states that a communication session between a client and a broker starts with a sequential connection phase and ends with a disconnection phase. In between, at any time, any number of instances of one of the 5 proposed subinteractions can be run concurrently. The use of loop P reflects that sessions can be opened and run concurrently at any time. • The curve in blue (below) represent the time required for analyzing an accepted trace and all its prefixes.

The curve is indeed obtained by linear regression on the data points (blue dots), each representing the time required for analyzing a prefix of that trace, with the right-most blue dot being the time required to analyze the trace in its entirety. For collecting this data, we have used an analysis with a Depth First Search strategy and we stopped whenever we obtained a Cov or T ooShort local verdict (i.e. P ass or W eakP ass global verdict). In this data (in blue) we cannot see any increase of the time that is required for the analysis w.r.t. the size of the trace because the time taken by the tool for parsing the input files is more significant at this scale.

• Each data point in red (that make up the curve in red (above)) corresponds to the time required for analyzing a mutant of a corresponding blue data point. This mutant is obtained by adding an unexpected action at the end which guarantees that the trace is not an accepted trace nor a prefix of one. As a result, each red data point corresponds to the analysis of a trace which returns F ail and hence requires the exploration of the whole analysis graph (instead of stopping at the first Cov or Short) as in Fig. 13.2. In order to obtain this curve we have chosen a particular "worst-case" scenario, with many overlapping instances of the passing of the pub_qos0 message. We can see, as could be imagined given the example from Fig. 13.2, that we have an exponential increase in the time required to terminate the analysis.

Mitigating the problem with value passing

The problem which we have described in the previous section is specifically related to the use of loop P and to the inability to distinguish between several instances of communications which are abstracted by the same message "label". This limitation of "labelled interactions" i.e. interactions in which exchanged information is abstracted as messages by labels can be mitigated by conserving more information when abstracting observed communication.

In the particular case of communication protocols, such as the MQTT protocol presented in the example from Fig. 13.3, individual sessions of communication (for instance the publication of a message, a subscription, etc.) are uniquely identified by an integer message identifier. By incorporating the information of those message identifiers into the abstracted trace and interaction model we can therefore mitigate the aforementioned effect.

Let us indeed consider the example analysis from Fig. 13.5, which reproduces the analysis from Fig. 13.2 but with the added information of unique message identifiers for instances of the message m 1 . We can see on the vertex before the split that we have in the remaining interaction term three sub-interactions with a reception of m 1 that are scheduled with par, as in the previous case. However, the three messages expected to be received can be distinguished from one another. In the top instance, m1 [START_REF]Jade tool[END_REF] with the unique identifier 12 is expected while in the second instance it is m1 [START_REF] Firley | Timed sequence diagrams and tool-based analysis -A case study[END_REF] and in the third m1 [START_REF] Korp | Tyrolean termination tool 2[END_REF]. Then, when analyzing the three reception events that remain to be analyzed, those can be uniquely matched to specific instances of the loop P . On Fig. 13.5 the cases in which the concrete data in the message parameters do not match are indicated by the "UNSAT" vertices.

As a result of having taken into account additional information for distinguishing instances of messages, we can see that the resulting analysis graph is significantly reduced in size (from 19 vertices to 7 vertices). This reduction in the size of the explored analysis graph is exponential with the size of the trace to analyze, provided that the message identifiers are indeed unique (or at least that the use of identical identifiers is sparse enough so as not to incur ambiguities). This then allows us to avoid the worst case depicted by the red curve on Fig. 13.3. prefixes and the other (in red) describing the analysis time of corresponding mutants (defined by adding an unexpected event at the end). we can observe that, by contrast to Fig. 13.3, there is no exponential explosion of the red curve. We have therefore successfully annulled the issue caused by the use of loop P .

Let us remark that the code for reproducing the results of this small experiment with a MQTT model is available in [START_REF] Mahe | Small experiment using hibou and hiboux on an example mqtt interaction[END_REF]. With this experiment we have seen that taking into account value passing can improve the quality of the analysis of multi-traces. However, we can go one step further by enriching the IL with variables, guards and message parameters, which is the object of the following section.

Introducing data

The Interaction Language which we have defined in Chap.4 can be canonically extended to include data.

Those interaction models enriched with data may involve (informally):

• "variables" that can be owned by specific lifelines and which values may vary during the execution of the interaction. Variables are strongly typed and local to specific lifelines.

• "message parameters" i.e. the messages which are exchanged between lifelines are not simple labels anymore but instead they can carry some values which can be computed on the fly (at the moment of the emission) and transmitted between lifelines • "assignments" which are basic operations that can accompany the observation of an event within the interaction model (emission or reception) and modify the value of a given "variable". An instance of this variable can be already owned by the lifeline on which the assignment occurs, and in this case, its value is simply modified. If, on the other hand, an instance of the variable do not exist on the lifeline, then it is created when evaluating the assignment. The value that is assigned to a variable by an assignment is computed from a term that can be constructed from raw values, variables, message parameters and typed operators.

• "guards", which are Boolean conditions on the expression of a certain events (emission or reception).

Those Boolean expressions constrain the variables (their current values) of the lifeline on which the event occurs so that the event can only occur if those constraints are satisfiable.

Figure 13.6: Refinement of a labelled interaction into a symbolic interaction with data On Fig. 13.6, we illustrate how one can use those new concepts so as to refine a "labelled" interaction model (on the left, without data), into a "symbolic" interaction model (on the right, with data). We can see that the overall structure of the interaction remains the same. However, parameters are attached to messages and statements accompany emission and reception events. Those blocks of statements are executed either before the execution of the communication action (if they are drawn above) or after it (if they are drawn below). Moreover, the interaction comes with the knowledge of which variables exist and which are their values (for instance the key variable on lifeline pub1 has the value #2 which is here an unknown value represented by an instantiated symbol) as well as constraints on those values (here there are no constraints as indicated by π = at the top). The reader should understand the use of the # sign as a call to the creation of a new symbol (of symbolic execution) i.e. a new unknown of the problem while the signs #1, #2 and any #j (with j an integer value) represent already created symbols.

We can then use symbolic execution to animate those enriched interaction models. Instead of assigning concrete values to variables, we assign terms build over data which may be abstracted as symbols. Those symbols correspond to input data that may enter the system through any means (user input, random values, etc.). The use of symbols in this manner reflects what is classically done in the symbolic execution of programs [START_REF] King | Symbolic execution and program testing[END_REF][START_REF] Baldoni | A survey of symbolic execution techniques[END_REF].

Using symbolic execution instead of concrete execution allows us to synthesize in a compact execution tree (or analysis graph) explorations that would otherwise be far larger. Indeed, a constraint on a symbol (for instance #1 > 0) might synthesize an arbitrarily large span of data (for instance positive 64 bits integers).

A discussion on formalizing interactions with data

In this section we discuss the formalisation of interactions with data. The contents of this sections do not constitute a formalisation of interaction with data and of their semantics. We simply mean to discuss the nature of those objects and to help the reader have a better understanding of their semantics.

As we have seen in the example from Fig. 13.6, sequences of assignments and guards can form a preamble or a postamble to the execution of specific communication actions. We can associate those sequences to simple programs. Then, each small-step of the execution of an interaction with data may be understood as the simultaneous execution of the interaction model and of those programs that share a global state.

Data signature and syntax of programs

Let us consider a data signature Σ = (S, Op) where S is a set of type names and Op is a set of typed operations i.e. for any g ∈ Op, there exists an arity n ≥ 0 and types s 1 , • • • , s n+1 from S such that the operation g is of profile s 1 × • • • × s n → s n+1 . Let us also remark that the definition of concrete values for each type is also included in this definition, given that each concrete value (for instance integer 1) may correspond to an operation of arity 0 (constant) of the corresponding type.

In the continuation of our concern for the distributed nature of behaviors, we also consider a set L of lifelines for defining programs. Let us then also consider a set V of variables which is indexed by L i.e. such that we have V = l∈L V l . Then:

• the set of typed terms T Σ (V l ) build over V l w.r.t. Σ can be defined as is classically done (as presented in Chap.4 but respecting the types signature of operators).

• and the set of sentences S Σ (V l ) can be defined as the set of all equations on terms of T Σ (V l ) using the rules of equational logic (as presented in Chap.4 but respecting types and with the rule for the negation)

We can then define a program (P ) as a (possibly empty) list of statements. Such a statement can either be an assignment (A), the creation of a new symbol (F for "fresh"), or a guard (G). Assignments l : v := t specify that the term t ∈ T Σ (V l ) must be assigned onto variable v ∈ V l . In the context of an action occurring on a lifeline l, we denote by v := # the creation of a new symbol and its assignment to variable v ∈ V l .

Guards l : s specify that the Boolean condition expressed by s ∈ S Σ (V l ) must be satisfied. The program language can therefore be defined as:

Symbolic state & execution of programs

An operational semantics associated to this program language can be defined as a transition relation between "states" which represent the state of the system.

By system we understand the set of lifelines from L, each of which may own variables which in turn are associated to values, etc. In addition, given that we have discussed using symbolic execution instead of concrete execution, those values are not concrete values but terms build over symbols. Let us therefore define a universe X of symbols.

Then, this notion of state can be described by a "symbolic state" which is a triplet (X, η, π) where:

• X ⊂ X keeps track of the symbols which have already been introduced as input data during the execution • η : V → T Σ (X) associates to each variable its current value as a term build over the already introduced symbols from X. η may be called the "interpretation".

• π ∈ S Σ (X) is an equation on the symbols from X which keeps track of the constraints on (the values of) those symbols that may be introduced during the execution. π may be called the "path condition".

A symbolic state (X, η, π) is a representation of the current state of the system, which contains all the information that we require. We can then define the semantics of the program language by relating the execution of individual statements to a transition between two symbolic states.

Such a transition relation between symbolic states is defined on Fig. 13.7. We indeed have that: • whenever an assignment l : v := t is carried-out then we update the value of variable v in the interpretation η with the current interpretation of the term t which is assigned to it. In other words, we change the interpretation η into η[v ← η(t)]

• whenever a symbol creation l : v := # is carried-out, we must create a new symbol, which is not in X.

This is always possible given that X is infinite and X is finite. Hence, in the next symbolic state, we have (X ∪ {x}, η[v ← x], π) because we keep track of x being introduced and of η being updated with the new value assigned to v.

• whenever a guard l : s is evaluated, the constraint specified by s must be satisfied. As a result, in the next step, we update the path condition π as π ∧η(s) to keep track of the newly introduced constraints.

• the empty program i.e. the empty list of statements can be executed and does not change the symbolic state

• we can then define the semantics of the program language as a transition relation such that for any program P we have a certain (X, η, π) P -→ (X , η , π ). This is described on Fig. 13.7.

Informal illustrative examples

Let us consider the three examples illustrated on Fig. 13.8. In the following we describe informally those three examples which serves the two purposes of (1) helping the understanding of assignment, symbol creation and guard and (2) introducing the concept of merging interaction models and programs of the program language.

Example on the left In the example displayed on the left of Fig. 13.8, we have a single lifeline l, which, initially (at the top) has a variable v of value #2 which is a symbol. Hence, the state of the system is a certain (X 0 , η 0 , π 0 ) in which #2 ∈ X 0 and η 0 (v) = #2.

Then, we consider the successive executions of two transformations. The first one consists in the assignment l : v := (1 + v). Given that η 0 (v) = #2, evaluating this assignment leads to (X 1 , η 1 , π 1 ) such that ----→ (X 0 , η 0 , π 0 ∧ (#2 > 4))

With the second transition, we receive a message carrying the concrete integer value "2" and immediately after we use this value to formulate the guard (v ≤ 4 + $1). Hence we have:

(X 0 , η 0 , π 0 ∧ (#2 > 4))

l:(v≤4+2)

------→ (X 0 , η 0 , π 0 ∧ (#2 > 4) ∧ (#2 ≤ 5))

Symbolic actions and symbolic interactions

We can then define symbolic actions as triplets (P -, a, P + ) such that P -and P + are programs of the simple program language and a is an action (enriched with message parameters). For instance, such a symbolic action is illustrated on Fig. 13.9, where we have P -being the empty program, a = l?message(4) and P + containing the three statements that are represented.

Figure 13.9: A symbolic action Then, we can define symbolic interactions in the same manner that we defined "labelled" interactions in Chap.4 i.e. by induction on those base symbolic actions and using some constructors. In addition to the previously described constructors, we may also add a scope constructor for defining unique instances of variables.

The semantics of those objects can be characterized by an execution relation (similarly as labelled interaction) which can be roughly understood as follows:

lab(i)
a@p --→ lab(i ) (X, η, π)

P-;P+ ----→ (X , η , π ) (i, X, η, π) P-aP +@p -------→ (i , X , η , π )

where lab(i) is the labeled counterpart of i Of course, in practice, this is more complicated, for two main reasons which are that: (1) we need to specify the context in which program P + is executed given that it might require taking values from parameters of an incoming message and (2) computing the follow-up symbolic interaction i is not immediate, and, in particular, we might need to update parameters of received messages to reflect their evaluation when the message has been send. • In the case of the third multi-trace, as per the message passing mechanisms previously mentioned, we have, in the second vertex of the analysis graph the reception of rq(4) that is expected to occur on cal. However, we have cal?rq(5) on the multi-trace. The constraint 4 = 5 not being satisfiable, the path yields UNSAT and hence the analysis yields F ail.

As exemplified in Fig. 13.13, non-conformities related to the use of data in models can be detected. If we had used labelled interactions in that case, all three concrete multi-traces would have been abstracted into the same labelled multi-trace and no non-conformities would have been detected.

Conclusion

In this section we have motivated and described an extension of the core Interaction Language to data. We define "symbolic" interactions i.e. interactions enriched with data, as a refinement of "labelled" interactions.

In such models, typed variables can be created and owned by individual lifelines. The execution of individual communication actions can then be preceded or followed by the execution of a small program, consisting of assignments and guards which may change the values of variables or constraints defined on their values while constraining the execution of actions to those that satisfy those added constraints. As a result, the execution

In this chapter we present an extension of the HIBOU tool which we have introduced in Chap.12. This extension HIBOUX (for HIBOU with symbolic eXecution) allows the exploration of execution trees associated to interaction models enriched with data as well as the analysis of multi-traces in which messages may carry concrete data against such models. To do so, we use symbolic execution to execute those enriched interaction models.

The plan of this chapter is as follows:

• in Sec.14.1 we quickly present the software and relevant parts of its user interface,

• in Sec.14.2 we describe the entry language of the tool,

• and in Sec.14.3, we quickly mention an industrial use case on which HIBOUX has been used, as part of the FUI DisTA project.

Overview

HIBOUX (for HIBOU with symbolic eXecution) provides utilities for drawing and manipulating symbolic interaction models, exploring their semantics and analysing multi-traces enriched with concrete data with regards to formal specifications written as symbolic interaction models.

HIBOUX is also implemented in Rust [7]. Its full code is available in [START_REF] Mahe | Hiboux tool[END_REF]. It contains (for version 0. HIBOUX takes the form of an executable which offers a user Command Line Interface (CLI). Precompiled binaries are available for Windows and Linux in [START_REF] Mahe | Hiboux tool[END_REF].

The use of HIBOUX is associated to two kinds of input files:

• "hiboux specification files", in which symbolic interaction models are encoded and which correspond to the ".hxsf" filename extension

• "hiboux trace file", in which traces or multi-traces with concrete data are encoded and which correspond to the ".hxtf" filename extension Then, the hiboux executable provides a CLI which includes (among others) the following commands:

• "hiboux draw <.hxsf file>" draws a symbolic interaction

• "hiboux explore <.hxsf file>" explores the semantics of a symbolic interaction

• "hiboux analyze <.hxsf file> <.hxtf file>" analyzes a multi-trace with data against a symbolic interaction @loopH ( @scope {gkey,gdat,mid}( @seq ( pub1 --publish(#,#,key) -> broker{mid:=$0;gdat:=$1;gkey:=$2} , @alt ( @seq ( [(gkey=mkey)]broker --puback(mid, ) -> pub1, broker --transmit(gdat) -> (sub1{data:=$0} , sub2{data:=$0}) ) , [(gkey!=mkey)]broker --puback(mid,⊥) -> pub1 ) ) ) ) The declaration of lifelines, messages and variables are all independent from one another. A declared lifeline may emit or receive any declared message and own an instance of any declared variable.

In addition, we can initialize variables on some lifelines and set values to them. This can be done under the dedicated @init section, as illustrated on Fig. 14.1.

Specifying symbolic interactions

Symbolic interactions are encoded in ".hxsf" files in the same manner than labelled interactions are encoded in ".hsf" files. We illustrate this encoding with the example interaction from Fig. We can remark that the overall structure of interaction terms is identical. The main difference comes with the definition of actions in which:

• the associated message may carry data and:

in the case of receptions this data may either be a raw value or a symbol # to signify random input data in the case of emissions this data may be a term formulated on variables carried by the lifeline • we may add some programs written in the language evoked in Chap.13 as either or both a preamble or postamble.

• there is an additional scope constructor which serves as making variables unique and have a local In this thesis we have defined an Interaction Language (IL) for modelling the behavior of Distributed Systems (DSs). This expressive language, formulated as a term algebra, includes operators for strict and weak sequencing, alternative and parallel composition and four kinds of loops so as to express nuances in the repetition of behaviors. The mathematical foundation of the meaning of that language is a trace semantics formulated in denotational style as a homomorphism between the term algebra of interactions and an algebra of sets of traces. Each interaction model is associated to a set of sequences of communication actions called a trace. This formulation of the semantics serves as a reference and allows for proving interesting properties.

It is notably used to justify the definition of normal forms of interaction terms (computed via term rewriting) which are unique, compact and minimal represent of classes of equivalence containing syntactically distinct but semantically equivalent interaction terms. However the denotational formulation of the semantics is cumbersome for use in some applications in Formal Verification (FV). As a consequence, we define a structural operational semantics for our IL which is inspired by that which can be found in the domain of process calculus. We then prove that this operational formulation is equivalent to the denotational formulation of the trace semantics of interactions, which constitutes, as mentioned before, a mathematical foundation.

The operational semantics then enables the definition of various algorithms for analyzing partial and distributed observations of the executions of DSs against formal specifications written as interaction models.

The distributed nature of the observation, with each sub-system producing their own logs, combined with the absence of synchronization mechanism (or e.g. global clock), which prevents the global reordering of events, makes so that the objects to analyze are sets of local traces that we call multi-traces. The partial nature of observation makes so that we may need to analyze prefixes or slices (i.e. "sub-words") of multi-traces in which, on each component traces, events may be missing at the beginning (due to the observation having started too late) or at the end (due to the observation having ended too early). The various algorithms which we have not explicitly touched upon this subject on the thesis. This can be explained by the absence of a notion of conformance relation associated with interaction models and multi-traces, which naturally calls for further work. Additionally, we have not yet discussed methods such as the automatic generation of test cases which are associated to partices of model-based testing.

The application of other Formal Verification techniques to our approach could also be investigated. This notably includes monitoring or online testing. In the context of this thesis, with multi-trace analysis, we have carried out a form of passive testing, in which a pre-existing finite multi-trace, that is collected after the execution of the DS, is analysed. With monitoring, the analysis occurs while the system is being executed, with the monitor listening for the occurrence of new events so as to feed the execution of the formal specification model which intends to reflect that of the concrete system implementation. This approach of monitoring aims at making sure of the smooth running of deployed implementations. With online-testing, the monitor is replaced by a tester, which also listens for the occurrence of events, but is also allowed to interact with the system and stimulate its execution, for instance, so as to force the expression of a certain behavior. Those two approaches of monitoring and online-testing could be the object of further work.

Enriching the interaction language

It is always possible to increase the expressivity of a language. This is therefore also the case for our Interaction Language. As many different and sometimes incompatible extensions can be investigated, further work related to the enrichment of the language with new constructs may be various and heterogeneous in nature, maturity and potential interest. In the following we present some such extensions.

We have seen in Chap.11, with the co-region constructs, that other operators could be added to the language for a gain in expressivity. In the particular case of co-regions, it would be interesting to explore their inclusion into the core language. Moreover, the nature of co-regions as configurable scheduling operators makes so that we could define an entirely new family of loops based around co-regions. In addition, given that co-regions may coincide with both weak sequencing and interleaving, we could define a formalism in which there are only co-regions. In this formalism, the two aforementioned operators would be included as edge cases of the co-region operators.

In the language presented in this thesis, we have define loops as Kleene closures, which allow repetitions up to any arbitrary high number of times. We could extend the IL so as to enable the restriction of loops in several manners:

• either by specifying a maximum number of repetitions, a minimum number of repetitions or both • or by defining "break" and "continue" constructs attached to the evaluation of actions and which would destroy the current instance and (in the case of break) the initial loop when evaluated.

Another interesting extension to the IL would be the addition of modality. In UML-SD, modality takes the form of the assert and negate combined fragments which allow the specification of valid and invalid traces. However, as explained in [START_REF] Harel | Assert and negate revisited: Modal semantics for UML sequence diagrams[END_REF][START_REF] Micskei | The many meanings of uml 2 sequence diagrams: a survey[END_REF], this manner of defining modality comes with many issues. In . Title: An operational semantics of interactions for verifying partially observed executions of distributed systems Keywords: distributed and concurrent systems, denotational and operational semantics, term rewriting, distributed log analysis, partial observation, symbolic execution Interactions represent asynchronous communications in a distributed context and can be represented graphically in an intuitive manner while allowing the specification of precise scheduling policies for ordering events. In this thesis, we formalize such models as an Interaction Language (IL) taking the form of a term algebra which includes strict and weak sequencing, alternative and parallel composition and four semantically distinct loops to express nuances when repeating behaviors.

concatenation
This IL is equipped with a semantics associating a set of traces (sequences of events) to each interaction. A denotational formulation as a homomorphism allows the use of rewriting to define equivalence classes and normal forms. An operational formulation, proven equivalent to the first, allows further applications in formal verification.

During the execution of a distributed system, communication logs might be collected locally. Without a global clock, events cannot be reordered globally. Hence analyzing an execution comes back to analyzing a set of local traces that we call a multi-trace. In addition one might start the observation too late or end it too early on any local component. As a result, a multi-trace might correspond to a partially observed execution. Taking advantage of the operational semantics we define algorithms for identifying multi-traces as being observations of behaviors specified by an interaction model.

We have implemented our approach in a formal verification tool: HIBOU, which allows the specification and drawing of interactions, the exploration of their semantics, the computation of normal forms or the analysis of multi-traces. The IL can be extended to include data in the form of locally defined variables. Guards, formulated as Boolean expressions on variables can condition the execution of individual actions, while messages can carry data. This extension has also been implemented and we use symbolic execution to animate models and perform the analyses. An industrial case study has been carried out in the context of the DisTA FUI project.

Maison du doctorat de l'Université Paris-Saclay 2 ème étage aile ouest, Ecole normale supérieure Paris-Saclay 4 avenue des Sciences, 91190 Gif sur Yvette, France

Figure 2 . 1 :

 21 Figure 2.1: The structure of a language

chain x 1 > x 2 >Definition 2 . 12 :Definition 2 . 13 : 0 → the identity relation on A and 1 →=→→→

 1221221301 • • • of elements of A. In other words this equates to having the existence (but not necessarily the unicity) of a minimal element for any non-empty subset B of A i.e. ∀ B ⊆ A, (B = ∅) ⇒ (∃ m ∈ B, ∀ x ∈ B, x < m). We may use the notation ∼ to designate an equivalence relation. An equivalence relation ∼ on a set A defines a partition of A into disjoint equivalences classes. For any x ∈ A, x belongs to a certain class which may be denoted by [x] ∼ and defined as {y ∈ A | x ∼ y}. The set of all equivalence classes thus defined is called the quotient set of A by ∼ which we may denote by A/ ∼= {[x] ∼ | x ∈ A}. Equivalence classes Given ∼ an equivalence relation on A we denote by: • [x] ∼ = {y ∈ A | x ∼ y} the equivalence class of an element x ∈ A • A/ ∼= {[x] ∼ | x ∈ A} the set of equivalence classes thus defined Binary relations can be canonically extended into larger relations which may satisfy the properties from Def.2.10. We define those larger relations, called closures, in Def.2.13. Closures of binary relations Let us consider a binary relation → on a set A. We may then denote by: • ← its inverse relation i.e. ←= {(y, x) | (x, y) ∈→} • ↔ its symmetric closure i.e. the smallest symmetric relation s.t. →⊆↔ which exactly is → ∪ ← • and, for any n > 0, its transitive closure i.e. the smallest transitive relation s.t. →⊆ its reflexive and transitive closure i.e. the smallest reflexive and transitive relation s.t. →⊆ *

Figure 2 . 3 :

 23 Figure 2.3: A sequence of transformations making use of associativity and commutativity

Figure 2 . 4 :

 24 Figure 2.4: Reduction of associative and commutative expressions using an ORS

  the two sequences of transformations by → E> represented on the two rows of Fig.2.4 hold. Furthermore, supposing that t 1 , t 2 and t 3 are irreducible, the last term that is reached (at the right-most of each row) is irreducible.

2 . 3 .

 23 Fig.2.3).

Figure 2 . 5 :

 25 Figure 2.5: Solution of the problem of Fig.2.3 using ordered rewriting and rewriting modulo theories

Figure 2 . 6 :

 26 Figure 2.6: Examples of Basic Message Sequence Charts

2 . 6 .

 26 Also, in some formalisations of BMSCs, the definition of some other local actions, which are neither emission nor reception events are possible, as illustrated on the bottom-right of Fig.2.6.

Figure 2 . 7 :

 27 Figure 2.7: Two cases of forbidden constructions in BMSCs

Figure 2 . 8 :

 28 Figure 2.8: Example of High-Level-MSC

Figure 2 . 9 :

 29 Figure 2.9: Example of High-Level-MSC with repetitions and connector nodes

  It has been developed since 1993 (for its first version) by the International Telecommunications Union (ITU). The official documentation of the standard [22], the latest version of which dates from 2011, presents MSCs via a proposed textual (syntax) and graphical denotation.

Figure 2 . 10 :

 210 Figure 2.10: Example showcasing the expressivity of the MSC standard

Figure 2 .

 2 Figure 2.11: Example UML-SD

Figure 2 . 12 :

 212 Figure 2.12: Inference rules for our toy process algebra

2 . 4 .

 24 Let us start by encoding the definition of the process algebra terms (the syntax) and of sequences of events (the data type of the semantic domain). The corresponding Gallina code is given on Fig.2.13. Parameter E : Set. Definition Sequence : Type := list E. Inductive PATerm : Set := empty_pa : PATerm | event_pa : E → PATerm | seq_pa:PATerm→ PATerm→ PATerm | alt_pa:PATerm→ PATerm→ PATerm.

Figure 2 . 13 :

 213 Figure 2.13: Definitions of the data types for the syntax and semantics of our toy process algebra in Gallina

Fixpoint

  sem_de (p : PATerm) : (Sequence → Prop) := match p with | empty_pa ⇒ fun s:Sequence ⇒ s = nil | (event_pa e) ⇒ fun s:Sequence ⇒ s = e :: nil | (seq_pa p1 p2) ⇒ fun s:Sequence ⇒ exists (s1 s2 : Sequence), (sem_de p1 s1) ∧ (sem_de p2 s2) ∧ (s = s1 ++s2) | (alt_pa p1 p2) ⇒ fun s:Sequence ⇒ (sem_de p1 s) ∨ (sem_de p2 s) end.

Figure 2 . 15 :

 215 Figure 2.15: Formalization of the semantics proposed for the toy process algebra in Gallina

  It is immediately implied by the two sub-theorems (blue nodes underneath) which correspond to the two directions of the inclusion.

Figure 2 . 17 :

 217 Figure 2.17: Proof of ∀ p ∈ P (E), p ↓⇒ ∈ σ d (p) with Coq

3 . 1 A

 31 discussion on a selection of papers . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.1 An algebraic semantics of BMSCs . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 High-level message sequence charts . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.3 Operational Semantics for MSC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.4 UML Interactions Meet State Machines -An Institutional Approach . . . . . . . . 3.1.5 Global and Local Testing from Message Sequence Charts . . . . . . . . . . . . . . 3.2 A broader and shallower survey . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3. 3

 3 Conclusion and position of the thesis . . . . . . . . . . . . . . . . . . . . . . . .

  T ; * ⊂ T ; × × * and T ; × × * ⊂ T || * Proof. The two first points are immediately implied by Lem.4.18 and by the definition of the restriction of scheduling operators (Def.4.11). The two last points are implied by the first two points, by the definition of the Head-First closures (Def.4.12) and by Lem.4.21.

Figure 4 . 1 :

 41 Figure 4.1: Basic building blocks of interactions

Fig. 4 .

 4 Fig.4.2 illustrates the use of those constructors on some examples:

  !m1, l!m2) seq(l!m1, l!m2) par(l!m1, l!m2) traces {l!m1.l!m2} {l!m1.l!m2} {l!m1.l!m2 , l!m2.l!m1} diagram syntax strict(l1!m1, l2!m2) seq(l1!m1, l2!m2) par(l1!m1, l2!m2) traces {l1!m1.l2!m2} {l1!m1.l2!m2 , l2!m2.l1!m1} {l1!m1.l2!m2 , l2!m2.l1!m1}

Figure 4 . 2 :

 42 Figure 4.2: Scheduling constructors

  4.3. message passing broadcast diagram syntax strict(l1!m, l2?m) strict(l1!m, seq(l2?m, l3?m)) traces {l1!m.l2?m} {l1!m.l2?m.l3?m , l1!m.l3?m.l2?m}

Figure 4 . 3 :

 43 Figure 4.3: Message passing & broadcast

Fig. 4 .

 4 Fig.4.3, on the same alignment horizontally, a number of small arrows with recognizable heads, one for each of the involved lifelines. The emitter lifeline has an arrow which head goes outwards (i.e. towards the environment) while all receiver lifelines have their arrowheads going inwards (i.e. towards the lifeline).

Figure 4 . 5 :

 45 Figure 4.5: Comparing the loop S , loop W & loop P repetition constructors

Figure 4 . 6 :

 46 Figure 4.6: Illustrating the difference between the loop W & loop H constructors

1 Figure 4 . 7 :

 147 Figure 4.7: Describing interactions as trees

1

 1 Fig.4.8 illustrates the use of the i |p notation by highlighting three different sub-interactions both in the syntactic term on the right and on the diagram representation on the left. Those three sub-interactions are: !m 1 l 2 ?m 1 seq alt strict

Figure 4 .

 4 Figure 4.8: Illustrating sub-interactions within an interaction

  the union ∪ the strict K-closure ; * the strict sequencing ; the weak HF-closure ; × × * the weak sequencing ;× × the weak K-closure ;× × * the interleaving || the interleaving K-closure || *

  The 6 equations related to those transformations are sound because { } is a neutral element for ;, ;× × and || as per Lem.4.10, Lem.4.16 and Lem.4.5 and because ∅ A = { } • "Flush" describes transformations related the associativity of the ; (Lem.4.10), ;× × (Lem.4.16), || (Lem.4.5),

  The 6 equations related to those transformation are sound because they correspond to the left and right distributivity of the ; (Lem.4.10), ;× × (Lem.4.16) and || (Lem.4.5) operators w.r.t. ∪.

Figure 4 . 11 :

 411 Figure 4.11: Simplification using distributivity in a particular case that is not covered by a single equation

Figure 4 . 13 :

 413 Figure 4.13: Phase 2/2 for normalizing interactions

Fig. 4 .

 4 Fig.4.10. Let us also remark that, on Fig.4.15, we have displayed all transformation sequences found by the implementation to transform the initial interaction into its normal form.

Figure 4 . 14 :

 414 Figure 4.14: Applying our process to normalize interactions on some examples (1/2)

Figure 4 . 15 :

 415 Figure 4.15: Normalizing example interactions (2/2) and displaying all transformation sequences

Figure 5 . 2 :

 52 Figure 5.2: Formulation of the operational semantics "à la" process algebra

Figure 5 . 3 :

 53 Figure 5.3: Examples for the execution of atomic actions

Figure 5 . 4 :FigFigure 5 . 5 :

 5455 Figure 5.4: Example for executing an action on the left of a strict constructors

Figure 5 . 6 :

 56 Figure 5.6: Example for executing an action on the right of a par constructor

  5.6). It implies that l 1 !m 2 can be executed and that what remains to be executed is the parallelization of the original left sub-interaction on the left, and of l 2 ?m 2 on the right (which remains to be executed w.r.t. the right sub-behavior).

Figure 5 . 7 :

 57 Figure 5.7: Example for executing an action on the right of a alt constructor

  us consider the example from Fig.5.8. On the right of Fig.5.8 is represented the syntaxic structure of an interaction i, and, on the left of Fig.5.8 the corresponding drawing as a sequence diagram.

1 !m 2 l 2 ?m 2 strict l 2 !m 3 l 1 ?m 3 Figure 5 . 8 :

 122358 Figure 5.8: Illustration of the termination predicate

Fig. 5 . 1

 51 Fig.5.9 illustrates, using two examples, both the application of the ↓ predicate and that of the rule for the execution of actions on the right of strict constructors. To illustrate the application of ↓, we use the same and notations as we did in the previous section. Example 1 Example 2

Figure 5 . 9 :

 59 Figure 5.9: Two examples for executing an action on the right of a strict constructor

Figure 5 . 10 :

 510 Figure 5.10: Illustration of the evasion predicate (here w.r.t. lifeline l 2 )

2 !m 2 l 3 ?m 2 ∅ l 2 Figure 5 . 11 :Fig. 5 .

 2225115 Figure 5.11: Illustration of pruning in the case where a branch of alternative is cut-out

2 !m 2 l 3 ?m 2 ∅ l 2 !m 3 ∅∅Figure 5 . 12 : 5 . 1 . 9

 2223512519 Figure 5.12: Illustration of pruning in the case where the repetition of a loop is forbidden

Figure 5 . 13 :

 513 Figure 5.13: Example for executing an action on the right of a seq constructor without pruning

Figure 5 . 14 :

 514 Figure 5.14: Example for executing an action on the right of a seq constructor with pruning

Figure 5 . 15 :Fig. 5 .

 5155 Figure 5.15: Example for executing an action underneath a loop S constructor

Figure 5 . 16 :

 516 Figure 5.16: Example for executing an action underneath a loop P constructor

Figure 5 . 18 :Fig. 5 .

 5185 Figure 5.18: Example for executing an action underneath a loop H constructor

Figure 5 . 19 :

 519 Figure 5.19: Showcasing several consecutive instantiations of the loop H from the example of Fig.5.18

Fig. 5 .

 5 Fig.5.20 on an example, which is the same example that we have used:

Figure 5 . 20 :

 520 Figure 5.20: Executing at first an action from the second instance of a behavior

Figure 5 . 21 :

 521 Figure 5.21: Illustrating the restriction associated to the loop H "Head-First" loop

Figure 5 .

 5 Figure 5.22: Reproducing trace t using the loop W constructor

H, W, P } Lemma 6 . 2 :Definition 6 . 3 :

 6263 Correctness of "vad" w.r.t. "↓ × × "For any i ∈ I Ω and any l ∈ L, (vad(i, l) = ) ⇔ (i ↓ × × l)Proof. By induction on the term structure of interactions. Pruning in functional style prn : I Ω × L → I Ω is s.t. for any (i, l) ∈ I Ω × L verifying ↓ × × (i, l):

Figure 6 . 1 :

 61 Figure 6.1: Description of the principles of the execution semantics

2 !m 2 l 3 ?m 2 ∅ l 2 !m 3 par l 1 4 Figure 6 . 2 :

 22231462 Figure 6.2: Frontier actions highlighted on an example interaction

2 !m 2 l 3 ?m 2 ∅ l 2 !m 3 par l 1 !m 1 strict l 3 !m 4 l 1 1 !m 1 l 2 ?m 1 seq∅ l 2 !m 3 par l 1 !m 1 strict ∅ l 1 ?m 4 Figure 6 . 3 :

 222313111311463 Figure 6.3: Illustration of the execution of an action at a specific position

6 . 3

 63 by crossing-out in red the node at position 221. In practice, this consists in replacing l 3 !m 4 at position 221 by the empty interaction ∅.

Definition 6 . 6 :

 66 Interaction Execution exe : I Ω × {1, 2} * → I Ω is the function s.t. for any i ∈ I Ω and p ∈ frt(i):

l 1 ?m 4

 14

Figure 6 . 4 :

 64 Figure 6.4: Description of the process for the execution semantics

Lemma 6 . 5 :

 65 Characterization (right side) of exe w.r.t. →

Figure 6 . 5 :

 65 Figure 6.5: Example of a succession of small-step executions without (left) and with (right) simplifications

Fig. 6 . 3 .

 63 Fig.6.3. Both figures represent the execution of the same action at the same position in the same interaction term. However, while Fig.6.3 illustrates the process without term simplification, Fig.6.6 illustrates a version with term simplification. We can see that the simplification steps illustrated on Fig.6.6 yield a simpler and more compact interaction term.

↓ l 3 2 !m 2 l 3 ?m 2 ∅ l 2 !m 3 par l 1 !m 1 strict l 3 !m 4 l 1 1 !m 1 l 2 ?m 1 l 2 !m 3 par l 1 !m 1 l 1 ?m 4 Figure 6 . 6 : 6 . 9 :

 322231311123146669 Figure 6.6: Illustration of the execution of an action at a specific position with simplifications

Figure 7 . 1 :

 71 Figure 7.1: Explicitation of various notions of traces and multi-traces

CC

  of the trace component µ |θ C (a) corresponding to the co-localization on which a occurs. Let us remark that we then have |µ← C a| = |a → C µ| = |µ| + 1.Also, display some interesting properties which are similar (although weaker) than the ones of the classical "." concatenation. to sets of multi-traces such that for any action a ∈ A Ω and any set T of multi-traces in P(T Ω|C ) we have:

  the unique element of C such that θ(a) ∈ c, we have proj C (a.t) = µ[a.µ |c ] c Let us consider the examples from Fig.7.1. For instance, let us consider the global trace on the left of Fig.7.1. In this example, we have L = {l 1 , l 2 , l 3 }. If we project it on the discrete partition C = ({l 1 }, {l 2 }, {l 3 }), we obtain the multi-trace in the middle of Fig.7.1. If we project it on the partition C = ({l 1 }, {l 2 , l 3 }), we obtain the multi-trace in the right of Fig.7.1.

Figure 7 . 2 :

 72 Figure 7.2: Counter example demonstrating that projection do not preserve weak sequencing

Figure 7 . 4 :

 74 Figure 7.4: Algebraic multi-trace semantics

Figure 7 . 5 :

 75 Figure 7.5: Algebraic and projective multi-trace semantics: the diagram commutes if C = {L} or C = Ľ

Figure 7 . 6 :

 76 Figure 7.6: Recording multi-traces in different conditions of observability

Figure 8 . 1 :

 81 Figure 8.1: Analysing an observation of a DS execution against an interaction

  serves as a formal specification of that DS. Then, on the top right of Fig.8.2, we have a multi-trace µ which corresponds to a certain observation of the execution characterized by ς.

Figure 8 . 2 :

 82 Figure 8.2: Analysing a multi-trace obtained from a full observation of an accepted behavior

o b s e r v e dFigure 8 . 3 :

 83 Figure 8.3: Analysis when the observation of an accepted behavior has ceased too early globally

Figure 8 . 4 :

 84 Figure 8.4: Analysis when the observation of an accepted behavior has ceased too early locally

Figure 8 . 5 :

 85 Figure 8.5: Analysis when observation has both started too late and ceased too early

Contents 9 . 1 9 . 2 9 . 3

 919293 Definition of the algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1.1 Presentation of the rules for exploring the analysis graph . . . . . . . . . . . . . . 9.1.2 Formal Definition of the analysis process . . . . . . . . . . . . . . . . . . . . . . . . Proof of correctness of the multi-trace analysis algorithm . . . . . . . . . . . . Complexity class of the multi-trace analysis problem . . . . . . . . . . . . . . . 9.3.1 The 1-in-3-SAT problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3.2 Reduction on a particular instance of the 1-in-3-SAT problem . . . . . . . . . . . . 9.3.3 Generalization for any 1-in-3-SAT problem . . . . . . . . . . . . . . . . . . . . . .

Figure 9 . 1 :

 91 Figure 9.1: Principle of multi-trace analysis

Fig. 9 . 2 .

 92 Fig.9.2. For this example, we consider a signature Ω = (L, M ) with L = {l 1 , l 2 , l 3 }, M = {m 1 , m 2 , m 3 , m 4 } and the discrete partition Ľ = ({l}) l∈L .We start the analysis on a vertex (the left-most vertex) that contains both an initial interaction i 0 = seq(loopH (• • • ), par(• • • )) and an initial multi-trace µ 0 such that µ |{l1} = l 1 !m 1 , µ |{l2} = l 2 ?m 1 .l 2 !m 2 and

Figure 9 . 2 :

 92 Figure 9.2: Example of application for rule R3

  R1 & R2 when the multi-trace has been emptiedFinally, the two last rules, rules R1 and R2 dictate what happens once the multi-trace has been emptied. Let us consider the example on Fig.9.4 in which a previous application of rule R3 has yielded two new vertices in which the multi-trace has been emptied.In this example, we have L = {l 1 , l 2 } and C is the discrete partition of L. As can be seen on Fig.9.4, in both vertices on the right, the multi-trace, defined over two components {l 1 } and {l 2 }, is empty.

Figure 9 . 3 :

 93 Figure 9.3: Example of application for rule R4

Figure 9 . 4 :

 94 Figure 9.4: Example of application for rules R1 and R2

  t. i a -→ i • at the head of a component of µ i.e. such that the component on the co-localization θ C (a) starts by a (meaning we have µ |θ C (a) = a.t), which also translates into having µ of the form a → C µ

Figure 9 . 5 :

 95 Figure 9.5: Multi-trace analysis on two examples respectively yielding a global P ass and a global F ail

Theorem 9 . 1 :

 91 Accepted implies P assFor any interaction i ∈ I Ω and any global trace ς ∈ T Ω :ς ∈ σ(i) ⇒ ω C (i, proj C (ς)) = P assProof. Let us reason by induction on (the size of) the global trace ς.

Figure 9 . 7 :

 97 Figure 9.7: Principle of reducing 1-in-3-SAT instances into multi-trace analysis problems

10. 1 and elimination 10 . 1 . 1 1 !m 2 l 2 ?m 2 alt strict l 2 !m 3 l 3 ?m 3 strict l 2 !m 4 l 3 2 !m 3 l 3 ?m 3 strict l 2 !m 4 l 3 ?m 4 seq strict l 3 !m 1 l 1 ?m 1 loop H seq l 1 !m 2 alt l 3 ?m 3 l 3 ?m 4 Figure 10 . 1 :

 110111232323231134101 Figure 10.1: Hiding a single lifeline on an example

3 !m 4 l 4 ?m 4 alt strict l 4 !m 5 l 5 ?m 5 strict l 4 !m 6 l 5 ?m 6 ∅ 5 ?m 5 alt l 5 ?m 6 ∅Figure 10 . 2 :

 34546556102 Figure 10.2: Hiding a co-localization on an example

define it in Def. 10 . 2 . 10 . 2 :

 102102 Definition Elimination as a projection operatorFor any set L, any partition C ∈ Part(L) and any h ∈ C we define: elim h : T L|C → I L\h|C\{h} the function s.t. for any µ ∈ I L|C :

Figure 10 . 3 :

 103 Figure 10.3: Duality of hiding & elimination and relation w.r.t. the algebraic multi-trace semantics

  Let us consider the example given on Fig.10.4. In this example, we consider Ω = (L, M ) with L = {l 1 , l 2 , l 3 } and M = {m 1 , m 2 , m 3 } and we analyze a multi-trace µ such that µ |{l1} = l 1 !m 1 .l 1 ?m 3 , µ |{l2} = and µ |{l3} = l 3 ?m 2 against an interaction i = seq(loop H (• • • ), • • • ).

Figure 10 . 4 :

 104 Figure 10.4: Illustrating the use of the multi-prefix analysis algorithm with hiding

Figure 10 . 5 :

 105 Figure 10.5: Analysis without checking local frontiers

Definition 10 . 6 :Figure 10 . 6 :

 106106 Figure 10.6: Example showcasing the local frontier on c = {l 2 , l 3 }

Theorem 10 . 3 :

 103 Fig.10.3) that a

and reach the Out local verdict Definition 11 . 5 :

 115 Rules for discriminating multi-traces from the various semantics

1 !m 1 l 2 ?m 1 strict l 1 Figure 11 . 1 :

 111111 Figure 11.1: Example using a co-region constructor

Figure 12 . 2 :

 122 Figure 12.2: Example of a multi-trace encoded in HIBOU

Figure 12 . 4 :

 124 Figure 12.4: An exploration of the execution tree of the interaction specified in Fig.12.3 by HIBOU

Figure 12 . 6 :

 126 Figure 12.6: Example exploration with setting a -1 priority to frontier actions underneath loops

Figure 12 . 7 :

 127 Figure 12.7: Showcasing the algorithm with simulation steps as preamble and postamble

13. 1 . 1 A

 11 limitation on examples with loop P Let us consider the example from Fig.13.1. In this example, we have a simple loop P which specifies the parallel repetition of instances of the passing of message m 1 from lifeline l 1 to lifeline l 2 .

Figure 13 . 1 :

 131 Figure 13.1: Example interaction with a loop P

Figure 13 . 3 :

 133 Figure 13.3: Abstract model of the MQTT protocol (v.3.1.1) and analysis time on particular edge cases

Figure 13 . 4 :

 134 Figure 13.4: Model of MQTT with value passing for message identifiers and analysis time on edge cases

Figure 13 . 5 :

 135 Figure 13.5: Analysis with added information of unique message identifiers

P

  ::= (A | F | G) * A ::= l : v := t F ::= l : v := # G ::= l : s Now that we have defined the syntax of the language which represents what can be executed as a preamble or postamble to communication actions, let us discuss the associated operational semantics.

Figure 13 . 7 :

 137 Figure 13.7: Symbolic execution of the program language

Figure 13 . 8 :

 138 Figure 13.8: Illustrating the notions of assignment, symbol creation and guard

Figure 13 . 13 : 12 •

 131312 Figure 13.13: Analysis of the three multi-traces from Fig.13.12

1 . 1 )

 11 13657 lines in 120 files among which 10532 lines of code. The version of HIBOUX which we describe in this chapter is version 0.1.1.

Figure 14 . 2 :

 142 Figure 14.2: Encoding of a symbolic interaction (continuation of Fig.14.1)

  14.3 which encoding is presented in Fig.14.1 and on Fig.14.2.

  scope w.r.t. a certain sub-behavior.

Notations

  Trace Semantic Domain (basics) L a set of lifelines l a lifeline l element of L i.e. l ∈ L M a set of messages m a message m element of M i.e. m ∈ M Ω a signature Ω = (L, M ) actions A Ω = L × {!, ?} × M up to signature Ω a an action a element of A Ω i.e. a ∈ A Ω θ(a) lifeline (in L) on which action a occurs i.e. a of the form θ(a)∆m empty word (in general) or empty trace (empty word of T Ω ) or empty position (empty word of {1, 2} * ), etc.

T 1 ; 2 T

 12 × × T 2 the restricted weak sequencing of traces T 1 and T ; × × * the weak Head-First closure of set of traces T Interaction syntax & Denotational Semantics I Ω set of all interactions up to a signature Ω i an interaction i element of I Ω i.e. i ∈ I Ω σ d (i) set of traces accepted by interaction i according to the denotational semantics σ d Equational Logic F = n∈N F n a set of operation symbols of arities 0 (constants) or more (n > 0) in particular it may refer to operation symbols of our interaction language f ∈ F n an operation symbol of arity n X a set of variables T F (X ) the free term algebra associated to F and X T F the ground term algebra associated to F t ∈ T F (X ) a term of the term algebra pos(t) set of positions of the nodes of term t seen as a tree p ∈ pos(t) the position of a node in the tree associated to t t |p the sub-term of t at position p t[s] p replacing the sub-term at position p in t by s A = (A, F A ) a F-algebra of carrier A in particular it may refer to A = (P(T Ω ), F A ) the F-algebra of sets of traces f A ∈ F A the interpretation of a symbol f ∈ F in the F-algebra A ρ a mapping ρ : X → A ρ an environment, extending a mapping ρ to terms as a homomorphism between T F (X ) and A φ a substitution φ : T F (X ) → T F (X ), replacing within a term all occurrences of some variables by some corresponding terms x ≈ y an equation, relating two terms of a term algebra E a set of equations on terms, called an axiom system ≈ E congruence relation on terms induced by E through the rules of equational logic = A congruence relation on terms induced by A through semantic equivalence System i.e. a set of rewrite rules → R the one-step rewrite relation induced by R E > an Ordered Rewriting System i.e. an axiom system E and a rewrite ordering > → E> the one-step rewrite relation induced by E > T an equational theory i.e. another name (in this context) for an axiom system R/T a Class Rewriting System i.e. a TRS R and an equational theory T → R/T the one-step rewrite relation induced by R/T ≺ I a total rewrite ordering on (ground) interaction terms R 1 (i) normal form modulo AC of interaction i w.r.t. phase 1 of the process R 2 (i) normal form modulo AC of interaction i w.r.t. phase 2 of the process R ≺ (i) normal form of interaction i w.r.t. the total order ≺ and rules of AC R(i) normal form of interaction i with R(i) = R ≺ (R

weak

  set of all partitions of set L Ľ the discrete partition of set L i.e. Ľ = {{l} | l ∈ L} C a partition of set L i.e. C ∈ Part(L) c a co-localization c element of a partition C i.e. c ∈ C θ C (a) co-localization (in C) on which a occurs i.e. unique c ∈ C s.t. θ(a) ∈ c A Ω|c subset of A Ω containing actions a occurring on c i.e. such that θ C (a) = c T Ω|c trace components on co-localization c i.e. T Ω|c = A * Ω|c T Ω|C set of all multi-traces T Ω|C = c∈C T Ω|c up to signature Ω and partition C µ a multi-trace µ element of T Ω|C i.e µ ∈ T Ω|C µ |c the trace component µ |c of multi-trace µ on co-localization c i.e. µ = (µ |c ) c∈C µ[t] c substitution of the component µ |c of µ by t ∈ T Ω|c C empty multi-trace in T Ω|C i.e. C = ( ) c∈C Multi-traces (algebraic operators) → C left concatenation law so that a → C µ = µ[a.µ |θ C (a) ] θ C (a) ← C right concatenation law so that µ → C a = µ[µ |θ C (a) .a] θ C (a) C concatenation law on multi-traces up to C ; C strict sequencing operator on multi-traces Kleene closure on multi-traces C * interleaving Kleene closure on multi-traces T prefix-closure of a set of traces or multi-traces T T slice-closure of a set of multi-traces T Morphisms between types proj C projection operator from traces to multi-traces up to C hide c (i) interaction where (actions occurring on) lifelines from c have been removed from i by the hiding operator hide c elim c elimination operator on multi-traces erases the trace component on co-localization c Multi-trace semantics σ |C (i) multi-traces exactly accepted by i (projections of accepted traces) σ † |C (i) multi-traces that are projections of prefixes of traces accepted by i σ |C (i) multi-traces that are prefixes (in the sense of multi-traces) of multi-traces accepted by i σ |C (i) multi-traces that are slices (in the sense of multi-traces) of multi-traces accepted by i σ C (i) algebraic multi-trace semantics of i σ C (i) algebraic multi-prefix semantics of i Analysis algorithms G analysis graph, of which traversals constitute the analysis algorithm V vertices of the analysis graph v ∈ V a vertex of the analysis graph v v a transition between two vertices in graph G |v| measure of vertex v ω C basic algorithm to recognize σ |C ω L algorithm with hiding steps to recognize σ | Ľ = σ Ľ ω C algorithm with simulation steps to recognize σ |C Titre: Sémantique opérationnelle des interactions pour la vérification d'exécutions partiellement observées de systèmes distribués Mots clés: systèmes concurrents et distribués, sémantique dénotationnelle et opérationnelle, réécriture de terme, analyse de logs distribués, observation partielle, exécution symbolique Les interactions représentent des communications asynchrones dans un contexte distribué et sont associées à des diagrammes qui sont faciles à prendre en main tout en pouvant spécifier des comportements précis. Dans cette thèse nous formalisons ce type de modèles avec un Langage d'Interactions (LI) se présentant sous la forme d'une algèbre de termes incluant des opérateurs pour le séquencement strict et faible, la composition alternative et parallèle ainsi que quatre boucles distinctes. Notre LI est équipé d'une sémantique associant à chaque interaction un ensemble de traces (séquences d'évènements) pouvant être exprimées. Nous proposons deux sémantiques dont nous avons prouvé l'équivalence. La première formulation dénotationnelle est donnée sous la forme d'un homomorphisme d'algèbres, donnant accès aux techniques de réécriture afin de définir des classes d'équivalence et des formes normales. Une seconde formulation, opérationnelle, permet diverses applications en vérification formelle. Les exécutions d'un système distribué peuvent être observées au travers de logs des évènements de communication collectés localement. Sans horloge globale il n'est pas possible de réordonner ces évènements globalement. Analyser une exécution revient donc à analyser un ensemble de traces qu'on appelle une multi-trace. De plus, sur chaque composante locale, il se peut que l'observation ait commencé trop tard ou ait cessé trop tôt. Ainsi, une multi-trace peut correspondre à une observation partielle d'une exécution. Tirant parti de la sémantique opérationnelle nous proposons des algorithmes d'analyse permettant d'identifier une multi-trace comme étant une observation d'un comportement spécifié par une interaction. Notre approche a été implémentée au sein d'un outil appelé HIBOU qui permet de spécifier et dessiner des interactions, d'explorer leur sémantiques, de calculer des formes normales ou d'analyser des multi-traces. Nous avons étendu notre LI pour inclure des données sous la forme de variables définies localement. Des gardes, expressions booléennes sur les variables, peuvent conditionner l'exécution d'actions et les messages peuvent porter des données exprimées à l'aide des variables. L'extension aux données a été implémentée en utilisant les techniques d'exécution symbolique. Cet outil étendu a été utilisé pour un cas d'usage industriel dans le cadre du projet FUI DisTA.

Definition 2.24: Confluence of a TRS

2.2. In this diagram, plain arrows correspond to the hypothesis while dashed arrows correspond to conclusions. A relation is confluent if for any three terms x, y and z such that we have x * → R y and x * → R z i.e. such that y and z have a common ancestor x then it implies that y and z have a common descendant x such that y * → R x and z * → R x .

the Gallina definition that we propose uses the Inductive keyword to define a predicate is_next_of of type PATerm

	Fixpoint terminates (p : PATerm) : Prop :=
	match p with
	| empty_pa	⇒ True
	| (event_pa e) ⇒ False
	| (seq_pa p1 p2) ⇒ (terminates p1) ∧ (terminates p2)
	| (alt_pa p1 p2) ⇒ (terminates p1) ∨ (terminates p2)
	end.
	Inductive is_next_of : PATerm → E → PATerm → Prop :=
	| next_event : forall (e:E),
		(is_next_of (event_pa e) e empty_pa)
	| next_seq_left : forall (e:E) (p1 p2 p1' : PATerm),
		(is_next_of p1 e p1')
		→ (is_next_of (seq_pa p1 p2) e (seq_pa p1' p2))
	| next_seq_right : forall (e:E) (p1 p2 p2' : PATerm),
		( (is_next_of p2 e p2') ∧ (terminates p1) )
		→ (is_next_of (seq_pa p1 p2) e p2')
	| next_alt_left : forall (e:E) (p1 p2 p1' : PATerm),
		(is_next_of p1 e p1')
		→ (is_next_of (alt_pa p1 p2) e p1')
	| next_alt_right : forall (e:E) (p1 p2 p2' : PATerm),
		(is_next_of p2 e p2')
		→ (is_next_of (alt_pa p1 p2) e p2').
	Figure 2.14: The ↓ (terminates) and → (is_next_of) predicates of the toy process algebra in Gallina
	The → predicate of the process algebra can be understood as an inductive predicate i.a. a predicate that
	can be inferred inductively. A certain x	e → y is a proposition that can be obtained from an object of type

PATerm → E → PATerm → Prop. As a result, → E → PATerm → Prop.

Lemma 2.1: p directly terminates implies σ d (p) accepts

  s ∈ σ d (p) Figure 2.16: Plan of the proof for the equivalence of the semantics of the toy PA • the fact that if a process p can immediately terminate (the predicate p ↓) then σ d (p) includes the empty trace • the fact that if a process p can execute event e, which turns it into process p , and, that there is a certain trace s ∈ σ d (p ) then e.s ∈ σ d (p)Let us remark that those two lemmas correspond to the inductive definition of the operational semantics σ o . In the following, we detail the proof of the first lemma, which is given as Lem.2.1.

	For any process p ∈ P (E):
	p ↓⇒ ∈ σ d (p)
	Proof. Let

us reason by induction on the term structure of p. • if p = then by definition p ↓ and ∈ σ d (p) • if p = e for a certain e ∈ E then we cannot have p ↓

  • if p = p 1 .p 2 for given (p 1 , p 2 ) ∈ P (E) then p ↓ iff p 1 ↓ and p 2 ↓ and by the induction hypothesis we have ∈ σ d (p 1 ) and ∈ σ d (p 2 ). Then, given that σ d

  3.2.1 Translational approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 Denotational approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.3 Operational approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.4 On the analysis of logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  • • • , (η n , π n ). As a result, if we had added delayed choice this would have required to treat more complex states.

	•	delayed choice can be used to minimize the exploration of different paths of executions
		in the model. Indeed, roughly speaking, instead of exploring alt(a 1 , seq(a 1 , a 2 ))	a1 -→ ∅ and
		alt(a 1 , seq(a 1 , a 2 ))	a1 -→ a 2 , we simply explore alt(a 1 , seq(a 1 , a 2 ))	a1

Lemma 4.28: Idempotence properties of the weak Head-First closure

  the results from Lem.4.23 and Lem.4.21 there only remains to prove that T ;As an extension to the properties listed in Lem.4.22 we propose some additional idempotence properties related to the ; * operator in Lem.4.28

* ⊂ T ; × × * .

Let us consider t ∈ T ; * . As per Lem.4.26, t ∈ T ; * is equivalent to having t ∈ T ; * . Then, as per Lem.4.24, this implies that t ∈ T ; × × *

  which is the same as what we would have obtained if we used the seq constructor here, because both actions occur on different lifelines.

With the examples from Fig.

4

.2, we can see that for both examples, we can have either the left action being executed at first and then the right action being executed afterwards, or the opposite. The par constructors represents, in facts, the parallel execution of two distinct and independent sub-interactions.

  and the operational semantics σ o from Sec.5.1 will be presented. Given that we want to characterize σ o w.r.t. σ d , a first step is to characterize the intermediate notions that enter into the definition of σ o w.r.t. σ d : • in Sec.5.2.1 we characterize the notions of termination and evasion w.r.t. σ d , • in Sec.5.2.2 we characterize the notion of pruning w.r.t. σ d .

  Reciprocally, if ∃ t ∈ σ d (strict(i 1 , i 2 )) s.t. ¬(t × × l), then, by definition of σ d , this means that there exist two traces t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ) s.t. t ∈ (t 1 ; t 2 ). Then, per Lem.4.14, we have ¬(t 1 × × l)

and ¬(t 2 × × l). By definition of σ d , we have (t 1 ; t2) ⊂ σ d (i). Then, by Lem.4.14, we have that ∃ t ∈ (t 1 ; t2) s.t. ¬(t × × l) and this trace is in σ d (i).

⇐

  1 , i 2 ), with i 1 and i 2 two sub-interactions that satisfy the

	induction hypotheses.
	⇒ Let us suppose that i ↓	× × l. By definition of ↓	× × , we have either or both i 1 ↓ × × l and i 2 ↓ × × l. Let
	us suppose we have i 1 ↓

× × l (the other cases are similar). By the induction hypothesis, we have

∃ t 1 ∈ σ d (i 1 ) s.t. ¬(t 1 × × l). We then simply observe that σ d (i 1 ) ⊂ σ d (i). ⇐ Reciprocally, if ∃ t ∈ σ d (alt(i 1 , i 2 )) s.t. ¬(t × × l),

then, by definition of σ d , this means that this trace t must be found in either σ d (i 1 ) or σ d (i 2 ). Let us suppose the first case (the other is similar). We can therefore apply the induction hypothesis which implies that i 1 ↓ × × l. Then, by the definition of ↓ × × , this implies that i ↓ × × l.

  by definition of pruning, we have i × × l -→ strict(i 1 , i 2 ) and let us denote it by i = strict(i 1 , i 2 ) for short.⊂ Let us then consider t ∈ σ d (i ). By definition there exist t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ) such that t ∈ (t 1 ; t 2 ). By the induction hypothesis, we have t 1 ∈ σ d (i 1 ) and ¬(t 1 × × )l and t 2 ∈ σ d (i 2 ) and ¬(t 2 × × )l. Therefore we have t ∈ σ d (i 1 ); σ d (i 2 ) = σ d (i), and, as per Lem.4.14, ¬(t × × l).

⊃ Let us consider t ∈ σ d (i) such that ¬(t × × l). By definition of σ d on the strict constructor this implies the existence of t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ) s.t. t ∈ (t 1 ; t 2 ). Then, as per Lem.4.14, the fact that ¬(t × × l) implies that both ¬(t 1 × × l) and ¬(t 2 × × l). According to the induction hypothesis, this means that t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ). Therefore (t 1 ; t 2 ) ⊂ σ d (i ) and hence t ∈ σ d (i ).

  induction hypothesis on sub-interaction i 2 , which implies that a.t 2 ∈ σ d (i 2 ). Given that σ d (par(i 1 , i 2 )) is the union of all the (t α ||t β ) with t α and t β traces from i 1 and i 2 , we have that (t 1 ||a.t 2 ) ⊂ σ d (i). In particular, we know that t ∈ (t 1 ||a.t 2 ), so, by definition of the || operator, we have that a.t ∈ (t 1 ||a.t 2 ). Therefore the property holds.6. when executing an action on the left of a strict, we have i of the form strict(i 1 , i 2 ), and i = strict(i 1 , i 2 ) 1 and t 1 ∈ σ d (i 1 ). Hence we can apply the induction hypothesis on sub-interaction i 1 , which implies that a.t 1 ∈ σ d (i 1 ). Given thatσ d (strict(i 1 , i 2 )) is the union of all the (t α ; t β ) with t α and t β traces from i 1 and i 2 , we have that(a.t 1 ; t 2 ) ⊂ σ d (i).In particular, we know that t ∈ (t 1 ; t 2 ), so, by definition of the ; operator, we have that a.t ∈ (a.t 1 ; t 2 ). Therefore the property holds. Hence we can apply the induction hypothesis on sub-interaction i 1 , which implies that a.t 1 ∈ σ d (i 1 ).• As a result, given that t 2 ∈ σ d (loop S (i 1 )) = σ d (i 1 ) ; * , and a.t 1 ∈ σ d (i 1 ), we have, (a.t1 ; t 2 ) ⊂ σ d (i 1 ) ; * i.e. (a.t 1 ; t 2 ) ⊂ σ d (i)• Also, given that t ∈ (t 1 ; t 2 ), we have immediately that a.t ∈ (a.t 1 ; t 2 ) because it is always possible to add actions from the left.• Therefore a.t ∈ σ d (i), so the property holds.11. when executing an action underneath a loop H , we have i of the form loop H (i 1 ) and i = seq(i 1 , loop H (i 1 )) . We have that t ∈ σ d (i ). Therefore there exists t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i) s.t.

	such that i 1
	such that i 1	a -→ i 1

1 , i 2 ), and i = i 2 such that i 2 a -→ i 2 . By construction of σ d , we have that t ∈ σ d (i 2 ). By the induction hypothesis on the sub-interaction i 2 , we have that a.t ∈ σ d (i 2 ). Given that σ d (i 2 ) ⊂ σ d (i), the property holds.

4

. when executing an action on the left of a par, we have i of the form par(i 1 , i 2 ), and i = par(i 1 , i 2 )

such that i 1 a -→ i 1 . We have that t ∈ σ d (par(i 1 , i 2 ))

. By definition of σ d , we have that there exist

(t 1 , t 2 ) ∈ σ d (i 1 ) × σ d (i 2 ) s.t. t ∈ (t 1 ||t 2 ). Therefore we have i 1 a -→ i 1 and t 1 ∈ σ d (i 1

). Hence we can apply the induction hypothesis on sub-interaction i 1 , which implies that a.t 1 ∈ σ d (i 1 ). Given that σ d (par(i 1 , i 2 )) is the union of all the (t α ||t β ) with t α and t β traces from i 1 and i 2 , we have that (a.t 1 ||t 2 ) ⊂ σ d (i). In particular, we know that t ∈ (t 1 ||t 2 ), so, by definition of the || operator, we have that a.t ∈ (a.t 1 ||t 2 ). Therefore the property holds.

5. when executing an action on the left of a par, we have i of the form par(i 1 , i 2 ), and i = par(i

1 , i 2 ) such that i 2 a -→ i 2 . We have that t ∈ σ d (par(i 1 , i 2 ))

. By definition of σ d , we have that there exist

(t 1 , t 2 ) ∈ σ d (i 1 ) × σ d (i 2 ) s.t. t ∈ (t 1 ||t 2 ). Therefore we have i 2 a -→ i 2 and t 2 ∈ σ d (i 2 ). Hence we can apply the a -→ i 1 . We have that t ∈ σ d (strict(i 1 , i 2 ))

. By definition of σ d , we have that there exist

(t 1 , t 2 ) ∈ σ d (i 1 ) × σ d (i 2 ) s.t. t ∈ (t 1 ; t 2 ). Therefore we have i 1 a -→ i 7.

when executing an action on the right of a strict, we have i of the form strict(i 1 , i 2 ), and i = i 2 such that i 2 a -→ i 2 with the added hypothesis that i 1 ↓. We have that t ∈ σ d (i 2 ). Therefore we have i 2 a -→ i 2 and t ∈ σ d (i 2 ). Hence we can apply the induction hypothesis on sub-interaction i 2 , which implies that

a.t ∈ σ d (i 2 ). Given that σ d (strict(i 1 , i 2 )) includes σ d (i 2 ) when i 1 ↓

, and given that we know i 1 ↓ to be true, the property holds.

8. when executing an action on the left of a seq, we have i of the form seq(i 1 , i 2 ), and i = seq(i 1 , i 2 )

such that i 1 a -→ i 1 . We have that t ∈ σ d (seq(i 1 , i 2 ))

. By definition of σ d , we have that there exist

(t 1 , t 2 ) ∈ σ d (i 1 ) × σ d (i 2 ) s.t. t ∈ (t 1 ;× × t 2 )

. Therefore we have i 1 a -→ i 1 and t 1 ∈ σ d (i 1 ). Hence we can apply the induction hypothesis on sub-interaction i 1 , which implies that a.t 1 ∈ σ d (i 1 ). Given that σ d (seq(i 1 , i 2 )) is the union of all the (t α ;× × t β ) with t α and t β traces from i 1 and i 2 , we have that (a.t 1 ;× × t 2 ) ⊂ σ d (i). In particular, we know that t ∈ (t 1 ;× × t 2 ), so, by definition of the ;× × operator, we have that a.t ∈ (a.t 1 ;× × t 2 ). Therefore the property holds. 9. when executing an action on the right of a seq, we have i of the form seq(i 1 , i 2 ), and i = seq(i 1 , i 2 )

such that i 1 × × θ(a)

--→ i 1 and i 2 a -→ i 2 with the added hypothesis that i 1 ↓ × × θ(a) implied by the fact that i 1 prunes into i 1 . We have that t ∈ σ d (i ). Hence there exists t 1 ∈ σ d (i 1 ) and

t 2 ∈ σ d (i 2 ) s.t. t ∈ (t 1 ;× × t 2 ). • We have i 2 a -→ i 2 and t 2 ∈ σ d (i 2 )

. Hence we can apply the induction hypothesis on sub-interaction i 2 , which implies that a.t 2 ∈ σ d (i 2 ).

• the fact that t 1 ∈ σ d (i 1 ) implies, as per Lem.5.6 that ¬(t 1 × × θ(a)). As a result, by definition of the weak sequencing operator, (t 1 ;× × a.t 2 ) includes a; (t 1 ;× × t 2 ) and therefore a.t. • Given that σ d (i) includes all (t α ;× × t β ) s.t. t α ∈ σ d (i 1 ) and t β ∈ σ d (i 2 ), we have, in particular (t 1 ;× × a.t 2 ) ⊂ σ d (i). Hence the property holds. 10. when executing an action underneath a loop S , we have i of the form loop S (i 1 ) and i = strict(i 1 , loop S (i 1 )) such that i 1 a -→ i 1 . We have that t ∈ σ d (i ). Therefore there exists t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i) s.t. t ∈ (t 1 ; t 2 ). • We have i 1 a -→ i 1 and t 1 ∈ σ d (i 1 ). t ∈ (t 1 ;× × t 2 ). • We have i 1 a -→ i 1 and t 1 ∈ σ d (i 1 ). Hence we can apply the induction hypothesis on sub-interaction i 1 , which implies that a.t 1 ∈ σ d (i 1 ). • As a result, given that t 2 ∈ σ d (loop H (i 1 )) = σ d (i 1 ) ; × × * , and a.t 1 ∈ σ d (i 1 ), we have, (a.t 1 ; × × t 2 ) ⊂ σ d (i 1 ) ; * i.e. (a.t 1

  [START_REF]Official coq website[END_REF] and t 1 ∈ σ d (i 1 ). Hence we can apply the induction hypothesis on sub-interaction i 1 , which implies that a.t 1 ∈ σ d (i 1 ).• As a result, given that t 2 ∈ σ d (loopP (i 1 )) = σ d (i 1 ) || * ,and a.t 1 ∈ σ d (i 1 ), we have, (a.t 1 ||t 2 ) ⊂ σ d (i 1 ) || * i.e. (a.t 1 ||t 2 ) ⊂ σ d (i) • Also, given that t ∈ (t 1 ||t 2 ), we have immediately that a.t ∈ (a.t 1 ||t 2 ) because it is always possible to add actions from the left.

Therefore, for any t β and any t α ∈ (t 0 ;× × t β ) we have a.t α ∈ (t 0 ;× × a.t β ) given that we can take action a, which have no conflict w.r.t t 0 , on the right side

• We have i 1 a -→ i 1 and t 1 ∈ σ d (i 1 )

. Hence we can apply the induction hypothesis on sub-interaction

i 1 , which implies that a.t 1 ∈ σ d (i 1 ) • Given that t 2 ∈ σ d (loop W (i 1 )) = σ d (i 1 ) ;× × * , and a.t 1 ∈ σ d (i 1 ), we have, (a.t 1 ;× × t 2 ) ⊂ σ d (i 1 ) ;× × * i.e. (a.t 1 ;× × t 2 ) ⊂ σ d (i) • Hence we have (t 0 ;× × a.t 1 ;× × t 2 ) ⊂ (σ d (i 0 );× × σ d (i)) ⊂ σ d (i) • Finally, given that a.t ∈ (t 0 ;× × a.t 1 ;× × t 2 )

, the property holds.

13. when executing an action underneath a loop P , we have i of the form loop P (i 1 ) and i = par(i 1 , loop P (i 1 )) such that i 1 a -→ i 1 . We have that t ∈ σ d (i ). Therefore there exists t 1 ∈ σ d (i 1 ) and

t 2 ∈ σ d (i) s.t. t ∈ (t 1 ||t 2 ). • We have i 1 a -→ i • Therefore a.t ∈ σ d (i)

, so the property holds.

Thanks to the previous Lemma (Lem.5.7) as well as the characterization from Lem.5.4 we can conclude on the inclusion of the σ o semantics into the σ d semantics. Indeed, those two Lemmas state that the σ d semantics accepts the same two construction rules (that for the empty trace and that for non empty traces of the form a.t) as those that define σ o inductively. As a result any trace that might be accepted according to σ o must also be accepted according to σ d . However it does not imply the reciprocate (i.e. whether or not σ d is included in σ o

  Let us consider i ∈ I Ω , a ∈ A Ω and t ∈ T Ω . Let us suppose that a.t ∈ σ d (i) and let us reason by induction on the term structure of i. , i 2 ). By definition of σ d , given that t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ), we have (t 1 ; t 2) ⊂ σ d (strict(i 1 , i 2 )). Then, given that t ∈ (t 1 ; t 2 ) this implies that t ∈ σ d (strict(i 1 , i 2 )). We therefore have identified i = strict(i 1 , i 2 )which satisfies the property.or that t 1 = and t 2 = a.t. On the one hand, the fact that t 1 = ∈ σ d (i 1 ) implies, as per Lem.5.4, that i 1 ↓. On the other hand, with t 2 = a.t ∈ σ d (i 2 ), we can apply the induction hypothesis on sub-interaction i 2 , which reveals the existence of i 2 s.t. i 2 2 . As a result, we have identified i = i 2 which satisfies the property.• if i is of the form seq(i 1 , i 2 ) then a.t ∈ σ d (i) implies the existence of traces t 1 and t 2 such that t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ) and a.t ∈ (t 1 ;× × t 2 ). Then, as per Lem.4.12, this implies:

	a -→ i 2 and t ∈ σ d (i 2 ). By definition
	of the execution relation "→", and because the precondition i 1 ↓ is verified, this implies that
	strict(i 1 , i 2 )

• we cannot have i = ∅ because it contradicts a.t ∈ σ d (i)

• if i ∈ A Ω then a.t ∈ σ d (i) implies that i = a and t = . We then have the existence of i = ∅ which indeed satisfies that a a -→ ∅ and ∈ σ d (∅)

• if i is of the form alt(i 1 , i 2 ) then a.t ∈ σ d (i) implies either a.t ∈ σ d (i 1 ) or a.t ∈ σ d (i 2 ). Let us suppose it is the first case (the second is identical). Then, we can apply the induction hypothesis on subinteraction i 1 , which reveals the existence of i 1 such that i 1 a -→ i 1 and t ∈ σ d (i 1 ). By definition of the execution relation "→", this implies that alt(i 1 , i 2 ) a -→ i 1 . As a result, we have identified i = i 1 which satisfies the property.

• if i is of the form par(i 1 , i 2 ) then a.t ∈ σ d (i) implies the existence of traces t 1 and t 2 such that t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ) and a.t ∈ (t 1 ||t 2 ). Then, as per Lem.4.2, this implies: -either that t 1 is of the form a.t 1 and t ∈ (t 1 ||t 2 ) -or t 2 is of the form a.t 2 and t ∈ (t 1 ||t 2 )

As both case can be treated identically, let us suppose it is the first case. Given that we have a.t 1 ∈ σ d (i 1 ), we can apply the induction hypothesis on sub-interaction i 1 , which reveals the existence of

i 1 such that i 1 a -→ i 1 and t 1 ∈ σ d (i 1 )

. By definition of the execution relation "→", this implies

that par(i 1 , i 2 ) a -→ par(i 1 , i 2 ). By definition of σ d , given that t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ), we have (t 1 ||t 2 ) ⊂ σ d (par(i 1 , i 2 )). Then, given that t ∈ (t 1 ||t 2 ), this implies that t ∈ σ d (par(i 1 , i 2 )

). We therefore have identified i = par(i 1 , i 2 ) which satisfies the property.

• if i is of the form strict(i 1 , i 2 ) then a.t ∈ σ d (i) implies the existence of traces t 1 and t 2 such that t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ) and a.t ∈ (t 1 ; t 2 ). Then, as per Lem.4.7, this implies:

either that t 1 is of the form a.t 1 and t ∈ (t 1 ; t 2 ). In that case we can apply the induction hypothesis on sub-interaction i 1 , which reveals the existence of

i 1 s.t. i 1 a -→ i 1 and t 1 ∈ σ d (i 1 )

. By definition of the execution relation "→", this implies that strict(i

1 , i 2 ) a -→ strict(i 1 a -→ ieither that t 1 = a.t 1 and t ∈ (t 1 ;× × t 2 )

. In that case we can apply the induction hypothesis on sub-interaction i 1 , which reveals the existence of i 1 s.t. i 1 a -→ i 1 and t 1 ∈ σ d (i 1 ). By definition of the execution relation "→", this implies that seq(i

1 , i 2 ) a -→ seq(i 1 , i 2 ). By definition of σ d , given that t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ), we have (t 1 ;× × t 2 ) ⊂ σ d (seq(i 1 , i 2 )). Then, given that t ∈ (t 1 ;× × t 2 ),

this implies that t ∈ σ d (seq(i 1 , i 2 )). We therefore have identified i = seq(i 1 , i 2 ) which satisfies the property.

or that ¬(t 1 × × θ(a)) and that t 2 is of the form a.t 2 with t ∈ (t 1 ;× × t 2 ). On the one hand, the fact that t 1 ∈ σ d (i 1 ) is such that ¬(t 1 × × θ(a)), ensures, as per Lem.5.5, that i 1 ↓ × × θ(a) and therefore, as per Lem.5.3, that there exists a unique i 1 such that i 1 × × θ(a) --→ i 1 . On the other hand, with

t 2 = a.t 2 ∈ σ d (i 2 )

, we can apply the induction hypothesis on sub-interaction i 2 , which reveals the

existence of i 2 s.t. i 2 a -→ i 2 and t 2 ∈ σ d (i 2 )

. By definition of the execution relation "→", this implies

that seq(i 1 , i 2 ) a -→ seq(i 1 , i 2 ). Given that t 1 ∈ σ d (i 1 ) is such that ¬(t 1 × × θ(a)),

as per Lem.5.6, this implies that t 1 ∈ σ d (i 1 ). By definition of σ d , given that t 1 ∈ σ d (i 1 ) and t 2 ∈ σ d (i 2 ), we have (t 1 ;× × t 2 ) ⊂ σ d (seq(i 1 , i 2 )). Then, given that t ∈ (t 1 ;× × t 2 ), this implies that t ∈ σ d (seq(i 1 , i 2 )). We therefore have identified i = seq(i 1 , i 2 ) which satisfies the property. • if i is of the form loop S (i 1 ) then a.t ∈ σ d (i) means that a.t ∈ σ d (i 1 ) ; * and hence, as per Lem.4.25, this implies the existence of a trace t such that a.t ∈ σ d (i 1 ) and t ∈ {t }; σ d (i 1 ) ; * . Then, the fact that a.t ∈ σ d (i 1 ) allows us to apply the induction hypothesis on sub-interaction i 1 to reveal the existence of i 1 such that i 1 a -→ i 1 and t ∈ σ d (i 1 ). By definition of the execution relation "→", this implies that loop S (i 1 ) a -→ strict(i 1 , loop S (i 1 )). By definition of σ d , given that t ∈ σ d (i 1 ) and that t ∈ {t }; σ d (i 1 ) ; * , we have that t ∈ σ d (strict(i 1 , loop S (i 1 ))). We therefore have identified i = strict(i 1 , loop S (i 1 )) which satisfies the property. • if i is of the form loop H (i 1 ) then a.t ∈ σ d (i) means that a.t ∈ σ d (i 1 ) ; × × * . By definition this means that there exists a j > 0 such that a.t ∈ σ d (i 1 )

  1) ⊂ σ d (i 1 ) ; × × * we can identify a trace t ∈ σ d (i 1 ) such that a.t ∈ {t }; × × σ d (i 1 ) ; × × * . Because the restricted operator ; × × only allows to take the first action of recomposed traces from the left hand side, the fact that a.t ∈ {t }; × × σ d (i 1 ) ; × × * implies that action a is taken from {t } and therefore t is of the form a.t and t ∈ {t }; × × σ d (i 1 ) ; × × * ⊂ {t };× × σ d (i 1 ) ; × × * . Then, the fact that t = a.t ∈ σ d (i 1 ) allows us to apply the induction hypothesis on sub-interaction i 1 to reveal the existence of i 1 such that i 1 , given that t ∈ σ d (i 1 ) and that t ∈ {t };× × σ d (i 1 ) ; × × * , we have that t ∈ σ d (seq(i 1 , loop H (i 1 ))). We therefore have identified i = seq(i 1 , loop H (i 1 )) which satisfies the property.• if i is of the form loop W (i 1 ) then a.t ∈ σ d (i) means that a.t ∈ σ d (i 1 ) ;× × * . By definition this means that there exists a n > 0 such that a.t ∈ σ d (i 1 ) ;× × n = σ d (i 1 );× × • • • ;× × σ d (i 1 ) (n times).As a result, we can identify traces t 1 through t n such that for any j ∈ [1, n], t j ∈ σ d (i 1 ) and a.t ∈ {t 1 };× × • • • ;× × {t n }. Then,

a

-→ i 1 and t ∈ σ d (i 1 ). By definition of the execution relation "→", this implies that loop H (i 1 ) a -→ seq(i 1 , loop H (i 1 )). By definition of σ d by definition of the weak sequencing operator, action a is taken from a certain t j with j ∈ [1, n] which is therefore of the form t j = a.t j and we have, for any k < j, ¬(t k × × θ(a)) (otherwise we could not take a from t j and t ∈ {t 1

  Let us consider i ∈ I Ω and t ∈ σ d (i) and let us reason by induction on the trace t.• If t = , the fact that t = ∈ σ d (i) implies, as per Lem.5.4, that i ↓. Then, by definition of σ o , this means that ∈ σ o (i).• If t = a.t then, the fact that a.t ∈ σ d (i) implies, as per Lem.5.8, that there exists an interaction i

	such that i

a

-→ i and t ∈ σ d (i ). Let us therefore consider such an interaction i . By the induction hypothesis on trace t , we have (t ∈ σ d (i )) ⇒ (t ∈ σ o (i )). As a result we have i a -→ i and t ∈ σ o (i ).

  • When a strict is reached exe(i |d1...dj , d j+1 ...d n ) is:either strict(exe(i |d1...dj .1 , d j+2 ...d n ), i |d1...dj .2 ) if d j+1 = 1 -or exe(i |d1...dj .2 , d j+2 ...d n )) if d j+1 = 2Indeed, the strict operator won't allow any action from the left branch to occur after an action on the right has occurred. As a result, when executing an action on its right (i.e. d j+1 = 2) we can simply ignore the whole left branch i |d1...dj .1

• When a seq is reached exe(i |d1...dj , d j+1 ...d n ) is: -either seq(exe(i |d1...dj .1 , d j+2 ...d n ), i |d1...dj .2 ) if d j+1 = 1 -or seq(prn(i |d1...dj .1 , θ(i |p )), exe(i |d1...dj .2 , d j+2

  ∈ σ e (i ) we have by definition that a.t ∈ σ e (R ≺ (i)) * finally, as per Th.6.3 and because R ≺ (i) ≈ E I i this means that a.t ∈ σ

and ∈ σ e (i) respectively equate R ≺ (i) ↓ and i ↓. By Lem.5.4 those predicates then respectively equate that ∈ σ d (R ≺ (i)) and ∈ σ d (i). Then, given that i and R ≺ (i) are in the same equivalence class, we have that σ d (R ≺ (i)) = σ d (i). Hence both predicates are equivalent.

• if t = a.t then: ⊂ if a.t ∈ σ n (i) there exists i s.t. R ≺ (i) a

-→ i and t ∈ σ n (i ) then: * at first we can apply the induction hypothesis so that t ∈ σ e (i ) * then, given that R ≺ (i) a -→ i and t e (i) ⊃ if a.t ∈ σ e (i) there exists i s.t. i a -→ i and t ∈ σ e (i ) then: * at first we can apply the induction hypothesis so that t ∈ σ n (i ) * the fact that i a

  Then, we have: * as per Th.6.3, t ∈ σ d (exe ≈ (i, p)) * as per Lem.6.7, exe ≈ (i, p) ≈ E I exe(i, p) * as per Lem.4.30, σ d (exe ≈ (i, p)) = σ d (exe(i, p)) * as per Th.6.3, t ∈ σ

implies that i ↓, which implies that t = ∈ σ≈ e (i) -if t = a.t then t ∈ σ e (i) implies the existence of p ∈ f ront(i) such that i |p = a and t ∈ σ e (exe(i, p)). Then, we have: * as per Th.6.3, t ∈ σ d (exe(i, p)) * as per Lem.6.7, exe(i, p)

≈ E I exe ≈ (i, p) * as per Lem.4.30, σ d (exe(i, p)) = σ d (exe ≈ (i, p)) * as per Th.6.3, t ∈ σ e (exe ≈ (i, p))

We can apply the induction hypothesis on t , which implies that t ∈ σ≈ e (exe ≈ (i, p)) and therefore t = a.t ∈ σ≈ e (i) ⊇ Let us consider t ∈ σ≈ e (i) and let us reason by induction on the trace t:

if t = then t ∈ σ≈ e (i) implies that i ↓, which implies that t = ∈ σ e (i) -if t = a.t then t ∈ σ≈ e (i)

implies the existence of p ∈ f ront(i) such that i |p = a and t ∈ σ≈ e (exe ≈ (i, p)). We can apply the induction hypothesis on t which implies that t ∈ σ e (exe ≈ (i, p)) e (exe(i, p)) Therefore t = a.t ∈ σ e (i)

  a result, for a vertex (i, µ), there are at most |frt(i)| possible applications of the rule R3 with |frt(i)| bounded by the number of occurrences of actions in i. Let us then consider |µ| the number of actions occurring in a multi-trace µ, i.e. the sum of lengths of its component traces. Let us extend this notation to vertices, that is, |(i, µ)| defined as |µ|, and |Cov| and |U nCov| defined as -1. For any edge v v of G, we have |v | < |v| with |v | ≥ -1. Consequently, the successive application of the rules strictly decrements the size of vertices and from any vertex (i, µ), any maximal outgoing path is finite, and terminates in a local verdict in {Cov, U nCov} (since (i, µ) are not sinks of G). Thus, G is an acyclic graph. With the notation v * v to indicate that there is a path from v to v

  given the smallest L such that i ∈ I L and µ ∈ T L| Ľ, we have |v| = (|µ|, |L|)

	with |µ| being the length (in number of actions) of the multi-trace µ (as in Chap.9) and |L| being
	the cardinal of L
	For any transition (i, µ)	(i , µ ) in the graph G, we have that |(i , µ )| < |(i, µ)| (in lexicographic order).
	Indeed, given |(i, µ)| = (x, y) we have:
	• either |(i , µ )| = (x -1, y) if R e applies for the transition (i, µ)	(i , µ )

• or |(i , µ )| = (x, y -1) if R h applies for the transition (i, µ) (i , µ )

Using those notations, each application of R e decreases x by 1. If x reaches 0, there are no more actions in the multi-trace and hence µ = Ľ and rule R p applies. Likewise, each application of R h decreases y by 1. y cannot reach 0 because once it reaches 1 rule R h cannot be applied anymore (by definition).

As a result, any outgoing path from a node (i, µ) is finite because there can only be a finite number of applications of R e and R h before ultimately reaching either of Obs or Out, both of which are sinks.

Moreover, for any vertex (i, µ) there exists a finite number of outgoing transitions that is bound by |frt(i)| + |L| given that:

2: Correctness of multi-prefix analysis via hiding

  Then: * on the one hand we can apply the induction hypothesis on (i , µ ) because we have that or an application of R h . Given that there are only two lifelines l and l we have either that: * it is l that is hidden and hence we have (i, µ) (hide {l} (i), elim {l} (µ))* Obs and we can immediately conclude * or it is l that is hidden. Then we can remark that the fact that we have both (i, µ) (hide {l } (i), elim {l } (µ)) and (i, µ) (hide {l} (i), elim {l} (µ)) imply that µ = Ľ and hence we can apply R p from (hide {l} (i), elim {l} (µ)) so that the conclusion holds• If x > 1 and y > 2 and we have (i, µ) * Obs then we may have as a first transition in the path:either an application of R e and in that case we can reason in the same way as previously or an application of R h and in that case there exists a lifeline l ∈ L such that we have (i, µ)For any interaction i ∈ I L and any multi-trace µ ∈ T L| Ľ:

	(i , µ )	(hide {l} (i ), elim {l} (µ )) trivially still holds. Then we can conclude that we have
	(hide {l} (i ), elim {l} (µ ))

• If y = 1 the premise do not hold • If y = 2, let us note L = {l, l }. Then, if (i, µ)

* Obs, we may have as a first transition in the path:

either an application of R e and in that case there exists a, i and µ s.t. µ = a → Ľ µ and i a -→ i and we have (i, µ) (i , µ ) * Obs. * Obs * on the other hand, given µ = a → Ľ µ , we must have l = θ(a) for the hypothesis (i, µ) (hide {l} (i), elim {l} (µ)) to hold. Therefore if a is executable in i then it is also executable in hide {l} (i) and we have hide {l} (i) a -→ hide {l} (i ) because hide {l} is a homomorphism and hence preserves the algebraic structures of the Interaction Language. Also, we have that elim {l} (µ) = elim {l} (a → Ľ µ ) = a → Ľ elim {l} (µ ). This then implies that we can apply R e from (hide {l} (i), elim {l} (µ)) so that (hide {l} (i), elim {l} (µ)) (hide {l} (i ), elim {l} (µ )) The two points above allow to conclude that (hide {l} (i), elim {l} (µ)) * Obs -(hide {l } (i), elim {l } (µ)) * Obs and then: * if l = l we can immediately conclude * if l = l then we can remark that: • firstly (hide {l } (i), elim {l } (µ)) (hide {l} (hide {l } (i)), elim {l} (elim {l } (µ))) and, given that we have decremented the measure by applying a first time R h , we can apply the induction hypothesis so that (hide {l} (hide {l } (i)), elim {l} (elim {l } (µ))) * Obs • secondly we can remark that hide {l} (hide {l } (i)) = hide {l } (hide {l} (i)) and elim {l} (elim {l } (µ)) = elim {l } (elim {l} (µ)) • finally we have: (hide {l} (i), elim {l} (µ)) (hide {l } (hide {l} (i)), elim {l } (elim {l} (µ))) = (hide {l} (hide {l } (i)), elim {l} (elim {l } (µ))) * Obs and hence the property holds Theorem 10.

  Let us then use notations from Chap.5 and use t instead of µ. t = implies that there exists an action a s.t. t = a.t . Then: ⇒ if a.t ∈ σ(i) it is a prefix of an accepted trace. Let us then consider t + such that a.t .t + ∈ σ(i).

	This implies that there exists i s.t. i	a -→ i and t .t + ∈ σ(i ) and hence t ∈ σ(i ) by prefix-
	closure. Given that |(i , t )| < |(i, t)| we can apply the induction hypothesis. We then obtain
	that (i , t )

* Obs which implies (i, t) (i , t ) * Obs and therefore ω L (i, µ) = P ass ⇐ if ω L (i, µ) = P ass then there exists a path (i, a.t ) * Obs. Given that we cannot apply R h because there is only a single co-localization, we must be able to apply R e . Hence there exists i s.t. i a -→ i and (i, a.t ) (i , t ) * Obs. Then, given that |(i , t )| < |(i, t)| we can apply the induction hypothesis. We then obtain that t ∈ σ(i ). This implies the existence of t + s.t. t .t + ∈ σ(i ), then, given that i a -→ i this implies that a.t .t + ∈ σ(i) and hence, by prefix-closure that a.t ∈ σ(i)

  |L (hide {l} (i)) = σ L (hide {l} (i)) = elim {l} ( σ L (i)). Then, given that µ |{l} = , we can apply Lem.10.3 to conclude that µ ∈ σ L (i) = σ L (i) = σ |L (i)

then, as per Fig.

10

.3 we have elim {l} (µ) ∈ σ |L (hide {l} (i)) (with L = L\{l}). Given that we have decremented the measure, we can apply the induction hypothesis which implies that (hide {l} (i), elim {l} (µ))

* Obs. Then, by transitivity (i, µ) * Obs and hence ω L (i, µ) = P ass

⇐ if ω C (i, µ) = P

ass we have a path (i, µ) * Obs then we can apply Lem.10.4 to obtain that (hide {l} (i), elim {l} (µ)) * Obs and we can then apply the induction hypothesis so that elim {l} (µ) ∈ σ -If there are no lifeline l s.t. µ |{l} = then: ⇒ if µ ∈ σ |L (i), then there exists µ + s.t. µ Ľ µ + ∈ σ | Ľ(i). Then, because µ Ľ µ + = Ľ, as per Lem.7.8 there exists a, i and µ s.t. µ Ľ µ + = a → Ľ µ * and i a -→ i and µ * ∈ σ | Ľ(i ). Then, because, there is no empty trace component on µ action a must be taken from µ and not from µ + . Therefore there exists µ and µ + such that µ = a → Ľ µ and µ

  Obs given that we cannot apply rule R h , the only possible first transition in this path is an application of rule R e i.e. there must exists a, i and µ s.t. i

		→ Ľ µ allows us to apply rule R e so
	that we have (i, µ)	(i , µ )
	From the two last points we conclude by transitivity that (i, µ) → Ľ µ and (i, µ) (i , µ )

(i , µ )

* Obs

• on the other hand, the fact that i a -→ i and µ = a * Obs and hence the property holds.

⇐ if ω L (i, µ) = P ass we have a path (i, µ) * a -→ i and µ = a * Obs. Then:

  Doing so may serve as replacing an event which has not been observed due to a late start of the observation on θ C (i |p ). In the new node, following the application of rule R - s , we then update s with s ∪ {s pre } given that we have made a preamble simulation step. * if no action can be executed either via consumption or simulation then we can apply rule R f

It is the set O ∈ P(C) which keeps track of which trace components have been consumed. As a result, we may check the local frontiers of the components that are in O but not of the components that are in C \ O.

if j ≥ β (i, p).

  there exists a path (i, µ, β (i), ∅, ∅)

* Short and there are no paths (i, µ, β (i), ∅, ∅) * Cov • ω * C (i, µ) = W P muprf iff there exists a path (i, µ, β (i), ∅, ∅) * M ultiP ref and there are no paths (i, µ, β (i), ∅, ∅) * v for any v ∈ {Cov, Short} • ω * C (i, µ) = W P slice iff there exists a path (i, µ, β (i), ∅, ∅) * Slice and there are no paths (i, µ, β

  law on words T Ω set of all (global) traces T Ω = A * Ω up to signature Ω t or ς we may denote by t or ς traces i.e. elements of T Ω predicate stating that a trace t has some conflict w.r.t. a lifeline l i.e. contains actions occurring on l t 1 ; t 2 strict sequencing of two traces t 1 and t 2 T 1 ; T 2 strict sequencing of two sets of traces T 1 and T 2 t 1 ;× × t 2 weak sequencing of two traces t 1 and t 2 T 1 ;× × T 2 weak sequencing of two sets of traces T 1 and T 2 339 t 1 ||t 2 interleaving of two traces t 1 and t 2 T 1 ||T 2 interleaving of two sets of traces T 1 and T 2 any scheduling operator i.e. any of either ; or ;× × or || T ; * the strict Kleene closure of set of traces T T ;× × * the weak Kleene closure of set of traces T T || * the interleaving Kleene closure of set of traces T t 1 ; × × t 2 the restricted weak sequencing of two traces t 1 and t 2

	|t|	length of a trace t
		Trace Semantic Domain (algebraic operators)
	t × × l

  predicate stating that an interaction i evades a lifeline l i.e. accepts a trace t with no conflict w.r.t. l i.e. such that¬(t × × l) i × × l -→ ipredicate stating that i is the unique interaction that exactly accepts traces t ∈ σ d (i) s.t. ¬(t × × l) of which there is at least one predicate stating that action a ∈ A Ω found at a certain leaf of i ∈ I Ω is immediately executable and that what remains to be executed is specified by interaction i σ o (i) set of traces accepted by interaction i according to the operational semantics σ set of the positions of the nodes of interaction i seen as a binary tree i |p sub-interaction of i at position p ∈ pos(i)prn(i, l) unique interaction such that i × × l -→ prn(i,l) frt(i) positions of all immediately executable actions in i (frontier of execution) exe(i, p) follow-up interaction that specifies what remains to be executed after the execution of action i |p at position p ∈ frt(i) ∈ frt(i) and i |p = a and exe(i, p) = i empty(i) is the set { } if i ↓ and is the set ∅ if i ↓ σ e (i) set of traces accepted by interaction i according to the execution semantics σ e σ n (i) normalizing execution semantics i.e. variant of σ e in which we normalize intermediate terms using rewriting prn ≈ (i, l) variant of "prn" with on-the-fly term simplification s.t. prn ≈ (i, l) ≈ E I prn(i, l) exe ≈ (i, p) variant of "exe" with on-the-fly term simplification s.t. exe ≈ (i, p) ≈ E I exe(i, p) σ≈

	i	a@p --→ i		short notation for p
				Operational Semantics
		i ↓	predicate stating that an interaction i terminates i.e. accepts the empty trace
		i ↓ × × l
		i	a -→ i

2 (R 1 (i))) o Execution Semantics p position i.e. word of {1, 2} * with the empty position pos(i) e (i) simplifying execution semantics i.e. variant of σ e in which we simplify intermediate terms on the fly when computing them σ(i) trace semantics of interaction i according to any of σ d , σ o , σ e , σ n or σ≈

http://termination-portal.org/wiki/WST

of course mechanisms put in place to reduce this span may also incur some costs w.r.t. time and memory

14.3. PROOF OF CONCEPT USE CASE

Remerciements

personnel administratif; Suzanne Thuron qui a été d'une grande aide pour les ré-inscriptions et l'organisation de la soutenance, Sylvie Dervin, Fabienne

Chapter 5

A small-step operational semantics

Contents

In this chapter we define multi-traces, which are sets of local traces, each defined on a subset of lifelines.

We then explain how one can extend the semantics of interactions to those objects.

The plan of this chapter is as follows:

• in Sec.7.1 we define multi-traces and algebraic operators on multi-traces,

• in Sec.7.2 we explain how we can relate traces to multi-traces via projection,

• in Sec.7.3 we define several semantics of "accepted" multi-traces,

• in Sec.7.4 we define various notions of prefixes of multi-traces and extend the multi-trace semantics to those notions of prefixes.

Multi-traces up to a partition

Defining multi-traces

Preliminaries

For any set X, we will note Part(X) the set of its partitions. A partition C ∈ Part(X) is defined as a collection C = (c k ) k∈ [1,n] of cardinal n ∈ N + such that:

• we have k∈ [1,n] c k = X

• and for any k and j in [1, n] with k = j, we have c k ∩ c j = ∅ We may denote by X the discrete partition X = ({x}) x∈X .

In the following, let us consider a given signature Ω = (L, M ). In Sec.4.1, we have defined T Ω as the set of "traces" which are as sequences of actions from A Ω . Those traces are therefore global traces [START_REF] Mahe | Revisiting semantics of interactions for trace validity analysis[END_REF], which order events occurring on every lifeline globally.

Generalized multi-traces

For the sake of practicity, in the following, for any subset of lifelines c ∈ P(L), we will denote by A Ω|c the set of actions occurring on c i.e. we have A Ω|c = {a ∈ A Ω | θ(a) ∈ c}. We can then denote by T Ω|c the set A * Ω|c of sequences of such actions.

We can then define multi-traces up to a partition C for any partition C ∈ Part(L), as collections of component traces (t c ) c∈C such that for any c ∈ C, we have t c ∈ T Ω|c . Such a multi-trace can be understood as a set of component traces, each defined on a "co-localization" of several lifelines. Within each such colocalization, events can be reordered even though they may occur on different lifelines. We can hence assume, for instance, that sub-systems within the same co-localization share a common clock.

Prefixes of global traces

The notion of prefix is tied to the existence of a concatenation law. In the case of global traces, the concatenation law is "." and we define prefixes as is classically done in Def.7.14.

Definition 7.14: Prefixes of traces

For any traces t, t 1 and t 2 from T Ω such that t = t 1 .t 2 we may say that:

• t 1 is a prefix of µ

Given a set T ⊆ T Ω of traces, we may denote by T the prefix-closure of T i.e. the set:

We can remark that for any trace t both and t are simultaneously prefixes and suffixes of t. Also, for any set T of traces, we may say that T is prefix-closed if T = T

Prefixes and slices of multi-traces

In the same manner we can define prefixes in the case of multi-traces given that we have defined a concatenation law C on multi-traces of T Ω|C defined up to a certain partition C of lifelines.

By analogy with Def.7.14, we define in Def.7.15 the notions of prefixes and slices of multi-traces.

Definition 7.15: Prefixes and slices of multi-traces

For any multi-traces µ, µ 1 , µ 2 and µ 3 such that µ = µ 1 µ 2 µ 3 we may say that:

We can remark that, for any multi-trace µ:

• C is simultaneously a prefix, a slice and a suffix of µ

• µ is simultaneously a prefix, a slice and a suffix of µ

We then define in Def.7.16 the notions of the prefix-closure and slice-closure of sets of multi-traces. For any set T of multi-traces, the prefix-closure of T , denoted by T is the minimal set of multi-traces that contains all the prefixes of all the multi-traces from T . Likewise, the slice-closure of T , denoted by T is the minimal set of multi-traces that contains all the slices of all the multi-traces from T .

Definition 7.16: Prefix and slice closure

Given a set T ⊂ T Ω|C of multi-traces, we may denote by:

• T the prefix-closure of T i.e. the set

• T the slice-closure of T i.e. the set

For any set T of multi-traces, we may then say that:

Some interesting properties of the previously defined notions of prefix-closure and slice-closure are given in Lem.7.10. Those properties are the idempotency of both closures, the fact that prefix-closure, when applied on a slice-closed set, is the identity, and, the fact that for any set of trace T , T is included in its prefix-closure which is itself a subset of its slice-closure.

Semantics of prefixes and slices of accepted multi-traces

Now that we have defined prefixes and slices of multi-traces, we can expand the semantics of interaction terms to include prefixes and/or slices of accepted multi-traces. We will also define an intermediate semantics which is that of the projections of prefixes of accepted global traces.

Chapter 8

On observing and analyzing executions of distributed systems

During the execution of a Distributed System (DS), information may enter or exit any given sub-system when it communicates either with some other sub-systems or with an external actor. We may assume that we can observe this exchange of information on the interfaces of sub-systems. We may also assume that this exchange of information, on each such interface, takes the form of a sequence of discrete communication events. Any sub-system then yields a sequence of such events that were successively observed during the execution of the system. As a result, each sub-system yields a locally defined sequence of events, and, after having collected those:

• if it is possible to reorder events globally, for instance, if a global clock is shared within the DS, then all the observed events can be recomposed as a global sequence in which events appear in the order in which they occurred globally during the execution.

• in the case where no two sub-system share a common clock, we cannot reorder events at all.

• a third possibility is that some (at least two) of the sub-systems of the DS share a common clock. In that case those sub-systems form a co-localization and we can partially reorder events.

Let us then assume that we may transpose those communications events into actions, as defined in Chap.4. This entails abstracting sub-systems into lifelines and abstracting exchanged information into messages. Then, in all three of the cases described above, we can synthesize the observation of the execution of the DS as a multi-trace that is defined up to a certain partition of lifelines. In the first case, it is the trivial partition, in the second, the discrete partition, and in the third, any other partition.

As we have seen in the first part of the thesis, interaction models can be used to specify the behaviors of DSs in terms of which scenarios of communications may be expressed during an execution. More precisely, any such individual behavior corresponds to a multi-trace in the projected multi-trace semantics of the interaction model.

In this chapter we are interested in solving the membership problem for the σ |C semantics of accepted multi-traces. We define an algorithm which includes and extends those that we have proposed in our published papers [START_REF] Mahe | Revisiting semantics of interactions for trace validity analysis[END_REF][START_REF] Mahe | A small-step approach to multi-trace checking against interactions[END_REF].

In [START_REF] Mahe | Revisiting semantics of interactions for trace validity analysis[END_REF] and [START_REF] Mahe | A small-step approach to multi-trace checking against interactions[END_REF], we respectively addressed global trace analysis and multi-trace analysis on the discrete partition.

In this chapter, we generalize the solutions from [START_REF] Mahe | Revisiting semantics of interactions for trace validity analysis[END_REF][START_REF] Mahe | A small-step approach to multi-trace checking against interactions[END_REF] by providing an algorithm for recognizing accepted multi-traces defined up to any partition C ∈ Part(L). For any multi-trace µ ∈ T Ω|C and for any interaction i ∈ I Ω , this algorithm is able to determine (in NP time at worst) whether or not µ ∈ σ |C (i).

The plan of this chapter is as follows:

• in Sec.9.1 we define the algorithm,

• in Sec.9.2 we prove the correctness of the algorithm i.e. that it solves the membership problem for the

• in Sec.9.3 we discuss the complexity class of the underlying problem.

Definition of the algorithm

We define a process able to decide whether or not a multi-trace µ (defined up to a partition C) is accepted by an interaction i. We have seen in Chap.8 that such a process can be defined through the use of transitions (i, µ) (i , µ ) which correspond to consuming an action at the head of a component of the multi-trace while executing it in the interaction model.

Starting from an initial vertex (i 0 , µ 0 ), this allows us to navigate in a graph that is quite similar to the execution tree of i 0 (as seen in Chap.6) but, instead of having nodes that host interaction terms, the vertices of this graph host tuples that are composed of both an interaction term and a multi-trace i.e. objects of the form (i, µ). This graph is called the analysis graph. We propose an abstract illustration of such a graph Fig. 9.1. An analysis graph that contains a vertex (i 0 , µ 0 ) then contains a refinement of the execution tree of i 0 . Indeed, we only allow a subset of the transitions i a -→ i enabled by the execution relation → which are those in which the executed action a matches a certain head of a certain component of the multi-trace µ.

Via the exploration of this analysis graph, we will uncover paths that lead towards one of two local verdicts which are Cov (for "covered") and U nCov (for "uncovered"), as illustrated on Fig. Local verdicts are eventually reached by repeating steps of the form (i, µ) (i , µ ) which we have described. Indeed, by doing so, we will eventually:

• either empty-out the multi-trace µ, by having removed all of its events one by one. In this case we will have identified a path of execution within the execution tree of the original interaction which allows

Polynomial reduction towards multi-trace analysis: signature Ω = (L, M ) with:

Then ω C (i, µ) = P ass iff there is a solution ρ to the 1-in-3-SAT problem. function by building on-the-fly the sub-graph originating from (i, µ) thanks to queues and usual search heuristics. Moreover, in practice, graph traversals can be interrupted as soon as a Cov verdict is reached. This resulted in the implementation of ω C (among other features) in the HIBOU tool which we describe in Chap.12.

In this chapter, we have also proven that the problem of analysing multi-traces (for the discrete partition) is NP-Hard. However this level of complexity only concerns some worst case scenarios and is not prohibitive in most cases all the more so that various techniques can be implemented so as to make the process of analysing multi-traces more efficient. Those techniques include (1) the implementation of some heuristics to guide the exploration of the analysis tree, (2) the introduction of stopping criteria on the exploration (once a certain local verdict is reached), (3) the computation of local frontiers to assess whether or not a certain branch of the analysis tree is worth exploring (and if not then it is not explored), etc. Point (3) will be addressed in Chap.10 and implementation details will be described in Chap.12.

In the next chapter we introduce the concept of hiding interaction models and some applications of this hiding operator for the analysis of multi-traces. Proof. This in fact the contraposition of Lem.10.6 when applied to a multi-trace from σ |C (i).

It suffices to remark, as per Lem.7.9 that σ |C (i) ⊂ σ C (i).

We then define a predicate for "checking local frontiers" in Def.10.7. This predicate can then be used in the formulation of multi-trace analysis algorithms.

Definition 10.7: Checking of local frontiers

For any C ∈ Part(L), checkloc C : I Ω × T Ω|C → { , ⊥} is s.t. for any i ∈ I Ω and µ ∈ T Ω|C :

Checking the local frontiers is not however a replacement for checking the frontier. Indeed, we must still have a rule in the algorithm for indicating failure to consume the multi-trace even in the case where checkloc C (i, µ) = . This can be illustrated by the example from Fig. 10.7 in which we have checkloc C (i, µ) = because we indeed have that l 1 ?m 2 is in the local frontier w.r.t. l 1 and l 2 ?m 1 is in the local frontier w.r.t. l 2 . However, from that vertex (i, µ), it is not possible to consume any action. And the multi-trace is indeed not accepted and not even a prefix of an accepted multi-trace.

Application to improve multi-trace analysis

Following on the last example analysis from Fig. 10.5, we introduce in Fig. 10.8 the same analysis but with an algorithm which includes the checking of local frontiers. We can see that, by contrast to the algorithm from Fig. 10.5 which explored the branch on the left until the Out verdict, the new algorithm, which checks local frontier, stops as soon as the first vertex of the left branch. Indeed, in that vertex we have that µ |{l2} = l 2 !m 2 which would imply, if the multi-trace was acceptable, that l 2 !m 2 would be in the local frontier w.r.t. {l 2 }. However, we only have l 2 ?m 1 in that local frontier. Therefore the vertex does not satisfies the condition related to Th.10.3. Consequently, we can stop the analysis of that branch at this point because we know that is cannot yield to a positive result. Hence we decorate this path with a Dead local verdict on Fig. 10.8.

Part III

Extensions & tools

In this third and final part of the thesis, we discuss extending and implementing the proven theoretical results presented in the first two parts. We notably introduce two Formal Verification tools that were implemented as part of this thesis.

In this chapter we present some additional unproven (by contrast to all that was defined beforehand) theoretical results and discuss the ease of implementation of tools derived from the results of this thesis.

The plan of this chapter is as follows:

• in Sec.11.1 we present multi-trace analysis algorithms based on the use of simulation steps,

• in Sec.11.2 we present an additional scheduling operator, which, although it can be considered to be some form of syntactic sugar, is often found in informal Interaction Languages and proves quite useful in practice,

• finally, in Sec.11.3, we discuss the implementation of theoretical results.

Algorithms with simulation steps

In Chap.9 we defined an algorithm for recognizing accepted multi-traces and in Chap.10 another for identifying prefixes (in the sense of multi-traces) of accepted multi-traces defined up to the discrete partition.

However, in Chap.7, we have defined a wide variety of different semantics and we have not yet presented algorithms to recognize all of those. In Chap.8 we have informally discussed the use of simulation steps as a useful mechanism to define such algorithms. In the beginning of Chap.10, we have dismissed those algorithms based on simulation steps due to their potential high overhead costs. However, with techniques such as the checking of local frontiers (introduced at the end of Chap.10) and some heuristics, simulating unobserved behavior seems once again practicable.

In this section we expand upon the results from the previous chapters by adapting the multi-trace analysis algorithm from Chap.9 for the analysis of multi-traces that are collected under contexts of degraded observability. In particular we define algorithms which use simulation steps so as to recognize prefixes and slices of accepted multi-traces defined up to any partition of lifelines.

The plan of this section is as follows:

• in Sec.11.1.1 we discuss the issue of the termination of analysis algorithms that rely on simulation steps,

• in Sec.11.1.2 we define an analysis algorithm which may use simulation steps for identifying prefixes of accepted multi-traces i.e. elements of σ |C defined up to any partition C,

• in Sec.11.1.3 we present a generalized algorithm that allows one to identify and discriminate between exactly accepted multi-traces and the three different kinds of partially observed multi-traces which we have described in Chap.7.

Definition 11.1: Loop depth and maximum loop depth

We define β : I Ω × {1, 2} * → N such that for any interaction i ∈ I Ω and any position p ∈ pos(i):

We can then define β : I Ω → N such that for any interaction i:

This notion of maximum loop depth can be explained on some examples. For instance:

Identifying prefixes of accepted multi-traces with simulation

In Chap.9, we have presented an analysis algorithm which allows for the identification of accepted multitraces. This algorithm can, for any given interaction i ∈ I Ω , and any multi-trace µ ∈ T Ω|C determine whether

In this section, we present a modified version of that previous algorithm, that instead allows one to determine whether or not µ ∈ σ |C (i). This means that this algorithm allows one to identify prefixes (in the sens of multi-traces) of accepted multi-traces. At the same time we will introduce the use of the checking of local frontier from Chap.10.

By analogy with the results from Chap.9, we introduce the analysis algorithm via the definition of a directed graph G in which vertices are either a tuple (i, µ, j) ∈ I Ω ×T Ω|C ×N or a local verdict v ∈ {Obs, Out}.

We then note V = {Obs, Out} ∪ (I Ω × T Ω|C × N) the set of all vertices.

The algorithm then relies on the exploration of some paths within G that start from a specific node and in which edges are characterized by the relation defined in Def.11.2 via the formulation of four rules.

For analysing a multi-trace µ 0 against an interaction i 0 , the analysis starts from the node (i 0 , µ 0 , β (i 0 )).

Here β (i 0 ) acts as the maximum number of loops that can be instantiated in a consecutive succession of simulation steps.

From any node of the form (i, µ, j, s, O) we can apply one of nine rules:

• if µ = C then:

Towards an implementation

The manner in which we have defined all the theoretical tools from Chap.6, Chap.9, Chap.10 and Sec.11.1 related to the analysis of multi-traces allows for an immediate transcription into code.

We have indeed defined in Chap.6 the simplifying execution semantics σ≈ e which relies on (1) the frontier function frt to compute, for an input interaction i, all the positions of actions in i that are immediately executable, and (2) an execution function exe ≈ which, for any interaction i and frontier position p ∈ frt(i) computes a follow-up interaction which exactly specifies what remains to be executed after the execution of the action a = i |p at position p. This simplifying execution function offers the additional guarantee that the follow-up term is simplified so that we keep intermediate terms compact and simple.

We have also mentioned in Chap.6 that all those functions and all the predicates and functions on which they depend i.e. the termination "↓" predicate, the evasion "↓ × × " predicate, and the pruning function with simplifications prn ≈ can be express in the style of functional programming languages.

Additionally, the types on which our theory is based i.e. that of interactions, positions and multi-traces can all be encoded using classic data types of functional programming languages. With for instance, actions being tuples of integers (with a 1-to-1 mapping to a set of lifeline names, message names, etc.) interactions being inductive types, positions being lists of integers and multi-trace lists of actions.

We can therefore easily implement the basis for animating i.e. executing and displaying interaction models. From this basis we can then implement features to (1) explore the semantics of interactions i.e. perform traversals of their execution trees and (2) analyze multi-traces against interactions i.e. perform traversals of a corresponding analysis graph (which nature depends on the kind of algorithm we choose to use among those defined in Chap.9, Chap.10 and Sec.11.1).

As is the case whenever traversals of trees or graphs are involved, we can use a queue and heuristics to guide the process of exploration. On Fig. 11.2 we illustrate the use of such a configurable process for performing the analysis of a multi-trace µ against an interaction i using an algorithm similar to that of Chap.9. This tooled and configurable algorithm returns P ass whenever µ ∈ σ |C (i), W P (for "WeakPass")

and F ail otherwise. The two • correspond to the initialization, with the queue q being initialized as an empty queue, and the information of the initial vertex (i, µ) being provided as entry data. Then, starting from (i, µ):

• we check if µ is the empty multi-trace (as indicated by (µ = C )? on Fig. 11.2) and:

if it is the case then we check if i terminates (as indicated by (i ↓)? on Fig. 11.2) and: * if it is the case then the algorithm stops and returns the global verdict P ass. We can see that, by contrast to the more theoretical algorithms presented before, this consists in defining a stopping criterion on the exploration of the analysis graph. Indeed, we stop exploring the graph as soon as we find a path in which µ can be entirely consumed. In this case, the fact

287

• "hibou canonize [-s] <.hsf file>" computes and displays the computation of the unique normal form (as per the results from Chap.4) of an interaction. By default, only one sequence of transformations is computed to reach the normal form. However, with the "-s" optional flag we can choose to compute and display all possible sequences of transformations (for example so as to make sure of the confluence of the implemented rewrite system).

• "hibou explore <.hsf file>" explores the semantics of an interaction i.e. it computes and may display parts of the execution tree of that interaction.

• "hibou analyze <.hsf file> <.htf file>" analyzes a multi-trace against an interaction i.e. it computes and may display parts of an analysis graph related to that analysis and returns a global verdict.

Entry language for interaction terms & multi-traces

In order to encode interaction terms and multi-traces (as well as other things such as the configuration of analysis algorithms, etc.), we have used a Parsing Expression Grammar [START_REF] Ford | Parsing expression grammars: A recognition-based syntactic foundation[END_REF]. Instead of detailing the inner workings of the parser, let us simply introduce the input language via some examples. As mentioned previously, HIBOU accepts two kinds of input files: ".hsf" and ".htf" which we quickly cover respectively in Sec.12.2.1 and Sec.12.2.2.

Encoding interaction terms

In the example on Fig. 12.1, we have on the left the encoding of an interaction term in a ".hsf" file. On the right we have a drawing of that interaction made by HIBOU.

We can see that we have some headers at the top of the ".hsf" file. In those headers, we declare the names of the lifelines and messages that will be used:

• in @lifeline we declare lifelines separated by ;

• in @message we declare messages separated by ; Then, the interaction term is written in a similar fashion as it would be done using the previous mathematical notations. We have the strict, seq, par, alt, loop S , loop H , loop W , loop P and coreg constructors and we use parenthesis to enclose sub-interactions. Notable differences with mathematical notations are that:

• for any associative operator, we allow n-ary notations. For instance, seq(i 1 , i 2 , i 3 ) will then be interpreted as seq(i 1 , seq(i 2 , i 3 ))

• for ease of use, we use a dedicated notation for the empty interaction, with "o" (lowercase letter o) instead of ∅

• and we also use notations inspired by WebSequenceDiagrams [START_REF]Websequencediagrams tool for drawing diagrams[END_REF] / PlantUML [5] instead of strict(l 1 !m, l 2 ?m) we may write "l1 --m -> l2" -instead of strict(l 1 !m, seq(l 2 ?m, l 3 ?m)) we may write "l1 --m -> (l2,l3)"

Let us remark that we can also configure explorations and multi-trace analysis in the header of ".hsf" files. However, this will be covered in Sec.12.3 and Sec.12.4.

Notably, the generation of the image from Fig. 12.4 is enabled by the loggers = [graphic [svg,vertical]] line. This line signifies that a graphical logger is created and listens to what happens during the exploration. This logger being a graphical logger, it draws the exploration. We can configure its output format (svg or png) and we can decide whether the drawing is drawn from top to bottom (vertical) or left to right (horizontal).

Search strategies and filters

Continuing on our example, given that the interaction contains a loop, an exploration without constraints would not terminate. With HIBOU, via the @explore_option section, we can set some limits on the exploration. We can see here, with the "filters" that we have set the maximum depth of the explored tree at 2 (depth 0 being that of the root), that we only authorize loops to be instantiated once in each path, and that we authorize the final tree to contain a maximum of 7 nodes.

Moreover, we specified that the strategy for the exploration of the tree corresponds to a Depth First Search. From any interaction i, its frontier frt(i) contains a set of position which we may order lexicographically. Then, the sub-trees starting from the execution of any such frontier action can be explored in that order. With a Depth First Search, given frt(i) = [p 1 , p 2 ], the sub-tree starting from i 1 s.t. i a@p1 ---→ i 1 is entirely explored before starting the exploration of the other one. As a result, we can see on Fig. 12.4, that some frontier actions of the initial interaction (at the top) have not been executed at all. Indeed, the nodes in brown on Fig. 12.4 correspond to frontier actions that have not been exploited due to constraints on the In addition, some other options are available for the @analyze_option section. Those are specifically related to the analysis process and include:

• the "use_locfront" option which specifies whether or not the checking of local frontiers (as defined in Chap.10) should be used with:

-"use_locfront = false" specifying that local frontiers should not be checked -"use_locfront = true" specifying that local frontiers should be checked, and in case of failure, a local verdict Dead is reached rather than pursuing the analysis • the "goal" option which specifies a criterion for stopping the analysis before the whole of the reachable parts of the analysis graph is explored:

with "goal = None" the analysis explore the whole of the graph with "goal = Pass" the analysis stops and returns P ass once a Cov local verdict is reached with "goal = WeakPass" the analysis stops and returns P ass once a Cov local verdict is reached and also stops and returns W eakP ass once (depending on which algorithm is selected using "analysis_kind") either of a T ooShort, M ultiP ref or Slice local verdict is reached • the "analysis_kind" option which can be set to specify which analysis algorithm should be used:

-"analysis_kind = accept" specifies that the algorithm from Chap.9, for identifying exactly accepted multi-traces should be used. This algorithm returns P ass if µ ∈ σ |C (i) and F ail otherwise -"analysis_kind = prefix" specifies that a variant of that algorithm, which may discriminate between σ |C and σ † |C should be used. This algorithm returns P ass if µ ∈ σ |C (i), W eakP ass if µ ∈ σ † |C (i) and either Inconc or F ail otherwise. The use of Inconc here is related to the uncertainty of whether or not a multi-trace µ is in σ |C (i). This uncertainty cannot be solved without using either hiding or simulation.

-"analysis_kind = hide" specifies that a generalized version of the algorithm with hiding steps from Chap.10 should be used. This algorithm behaves exactly the same as the one from Chap.10 whenever the multi-trace is defined up to the discrete partition. However, if the partition is not discrete, then a local verdict Inconc might be produced rather than a M ultiP ref .

-"analysis_kind = simulate[multi-prefix]" corresponds to the algorithm with simulation steps only as a postamble to the consumption of trace components (as in Sec.11.1.2) -"analysis_kind = simulate[multi-slice]" corresponds to the algorithm with simulation steps both as a preamble and as a postamble to the consumption of trace components (as in Sec.11.1.3) On Fig. 12.7 we illustrate the analysis of a multi-trace defined on a partition C = {{l 1 , l 2 }, {l 3 }} of lifelines. This multi-trace is a slice of a multi-trace that is accepted by the interaction i = coreg({l 2 })(seq

Indeed, the actions that are missing i.e. have not been observed are: means to distinguish between the receptions events l 2 ?m 1 that might correspond to the various instances of the emission events l 1 !m 1 .

On Fig. 13.2 we illustrate the analysis of the global trace t = l 1 !m 1 .l 1 !m 1 .l 1 !m 1 .l 2 ?m 1 .l 2 ?m 1 .l 2 ?m 1 .l 2 !m 1 against the interaction from Fig. 13.1. We can see that this trace is not an accepted trace (nor a prefix of one). However, as illustrated on Fig. 13.2, proving that this is the case is relatively costly given that we need to explore all paths in the analysis graph. Here, even an extended version of the checking of local frontiers (which would project the remaining trace components on the discrete partition) would not help at all given that all that remains to analyze occurs on the same lifeline which is l 2 . The reason why there are so many paths that open-up in this analysis is the use of the loop P constructor and the inability to distinguish between the 3 instances of the passing of m 1 . Indeed, starting from the vertex in the middle of Fig. 13.2 (before the split), the three CHAPTER 13. EXTENSION TO DATA Indeed, in this section, we have simply discussed the nature of symbolic interactions. A full formalisation and definition of a sound semantics may be the object of further work.

Exploration and analysis

In this section we discuss some more on the animation of symbolic interaction models in relation with the exploration of their execution trees and analysis graphs.

Unsatisfiable paths

The execution tree of a symbolic interaction i is a refinement of the execution tree of the corresponding labelled interaction lab(i). Indeed, some paths that would be allowed in lab(i) may correspond to unsatisfiable path conditions in the execution tree of i.

315

#5 < #6 to the path condition π. Then, two possible paths are explored depending on which branch of the alternative is taken. On the one on the left the additional condition #5 > 0 is added to π whereas on the one on the right, it is #5 < 0 which is added. Then, on both path we execute an action which adds the condition #6 < 0. We can then see that from the left branch we have π = (#5 < #6) ∧ (#5 > 0) ∧ (#6 < 0) which is an unsatisfiable formula. As a result, we add an UNSAT node to that path signifying that it is not feasible. On the path on the right however, we can see that the resulting path condition is satisfiable.

With this example, we have seen that unsatisfiable paths could be detected in the execution tree of a symbolic interaction i and therefore reduce its span with regards to the execution tree of the corresponding labelled interaction lab(i). However, this notion of having unsatisfiable paths is particularly more useful when considering the analysis of multi-traces given that we may detect incoherent data in the concrete values provided as arguments of the analyzed multi-trace.

Message passing

As mentioned in Sec.13.3, whenever a message that is intended to carry data is send, we need to update the carried values according to the current interpretation of variables on the emitting lifeline at the moment of the emission. Let us consider for instance the example from Fig. 13.11. We can see that initially, variable x on lifeline l2 has a value set at #5. It is then this value #5 that is send with message m while the value of x on l2 independently evolves to #5 -1. Then, it is the carried value #5 in message m that is used when the message is received by l1 to assign its value to the new variable x on l1. Afterwards, we have two distinct instances of variable x: the one on l2 of value #5 -1 and the one on l1 of value 2 * #5. Likewise, in the following step, when l1 broadcasts the m message to l2 and l3, the value that is carried is then (2 * #5) -3. This mechanism of value passing ensures that, when a message is passed or broadcasted between lifelines, the values of message parameters that are originally send by the emitter are indeed the same values that are received by the receivers. With multi-trace analysis in mind, this allows the detection of foreign data being introduced, for instance, in the case of a man-in-the-middle attack, where an attacker alters information that is exchanged between parties.

Multi-trace analysis

Let us consider the example given on Fig. 13.12. On the left is represented a symbolic interaction which serves as a formal specification. On the right are represented three multi-traces that might be expressed by the distributed system that is modelled.

The system is composed of two lifelines bob who is a user and cal which is a calculator. bob can request, via the sending of a rq request message, that the cal calculator multiplies an integer value by 2 and returns the result to him via a rp response message.

As a result, the first multi-trace at the top right of Fig. 13.12 corresponds to an accepted behavior. Indeed, here bob request having 4 being multiplied by 2. The cal indeed receives the value 4 and answers with the value 8. However, in the second multi-trace, cal also receives the value 4 but answers with the value 2, having divided 4 by 2 instead of multiplying it. Hence, this multi-trace should yield a F ail verdict.

In the third multi-trace, even though bob sends the value 4, the value that is received by cal is 5. As a result, even though the computation is correct, given that cal sends 10 back, this behavior should also yield a F ail verdict. In practice, this could correspond to a man-in-the-middle attack, the transmitted data having been tempered with.

Accepted behavior

Wrong computation

Man-in-the-middle

[bob] bob!rq(4); [cal] cal?rq(4).cal!rp(8)

[bob] bob!rq(4); [cal] cal?rq(4).cal!rp (2) [bob] bob!rq(4); [cal] cal?rq (5).cal!rp(10) Those three multi-traces can be analyzed against the symbolic interaction of Fig. 13.12 so as to detect the non-conformities that we mentioned for the second and third multi-traces, as illustrated on Fig. 13.13.

When analyzing a concrete multi-trace, additional constraints are introduced in the path condition π so as to take into account the values of the concrete data:

• In the case of the first multi-trace, all the additional constraints are satisfiable and the path in the execution tree yields a T ooShort verdict and hence the analysis yields W eakP ass. tree of a symbolic interaction is a refinement of that of the corresponding labelled interaction in so far as it has the shape of one of its sub-trees. Likewise, the analysis of a multi-trace with data against a symbolic interaction is a refinement of the analysis of the counterpart labelled multi-trace against the counterpart labelled interaction, the symbolic analysis graph having the shape of a sub-graph of the labelled analysis graph.

Chapter 14

The HIBOUX tool

Entry language

HIBOUX accepts ".hxsf" and ".hxtf" files for respectively specifying symbolic interactions and multi-traces with concrete data. Those two file types are similar to the ".hsf" and ".htf" which we have seen in Chap.12.

In the following we provide some more details on the entry language of HIBOUX.

Header options & declarations

The option sections @explore_option and @analyze_option that can be defined in the headers of ".hxsf" files are similar to those that we have seen in Chap.14 for the ".hsf" files of HIBOU.

Similarly to ".hsf" files, we declare in the headers of ".hxsf" files various components that participate in the definition of the interaction term. On Fig. 14.1 we provide an example. As in Chap.12, we declare lifelines under a @lifeline section and messages under a @message section.

However, given that messages can have typed parameters, we declare the types (and hence number) of those parameters in between parentheses as illustrated on Fig. 14.1. The types supported by HIBOUX include Bool and Integer as illustrated on Fig. 14.1. The parameters of a message constitute an ordered list, and, individual parameters can be referred to by their index on that list. For instance $0 may refer to the parameter of index 0.

Profiles of variables can be declares under a dedicated @variable section, as illustrated in Fig. 14.1. A variable profile declares the type of variables that may be instantiated on some lifelines during execution or before the start of the execution, in a dedicated initialization stage. A variable profile may correspond to instances of variables that may exist on any lifeline. Let us recall that in HIBOUX there are no global variables. All variables are locally defined and we may create new instances of variables during execution. The sending of new information by pub1 can be repeated; in the model we use a loopH constructor.

@message

Concretely, pub1 sends a publish message to broker with three integer arguments which are a random message identifier ($0), random data ($1) and its authentication key which serves as identifying it as an certified published or information.

When the broker receives the message, it creates new temporary variables mid, gdat and gkey to store the received message identifier, data ("got data") and key ("got key"). Those variables are uniquely defined for each instantiation of the loopH thanks to the use of the scope constructor. For instance, if the pub1 sends two different publish messages and the broker receives them, it will create a mid_1 variable for the message id of the first message and a mid_2 variable for the second.

In a given instance of the loop, after having received the publish message, the broker compares the key that it received and stored in its temporary gkey variable to its master key mkey. Then:

• If they are equal then the publication is authenticated and the broker confirms it to pub1 by sending puback with the corresponding message identifier mid and a Boolean to signify success. Then, the received data, stored in the temporary gdat variable is transmit to the subscribers sub1 and sub2 via the transmit message.

• If they are different then the broker refuses to transmit the data and informs the publisher pub1 by answering with a puback message that carries the corresponding message identifier mid and a Boolean ⊥ to signify failure.

Specifying multi-traces with concrete data

Multi-traces with concrete data are encoded in ".hxtf" files for use with HIBOUX. This encoding is similar to the one used to encode labelled multi-traces in ".htf" files presented in Chap.12.

We provide an example on Fig. 14 Finally, those multi-traces were analyzed against the interaction model from Fig. 14.7. In total we have analyzed several multi-traces both accepted and with non-conformities (introduced willfully) and which sizes (in total number of actions) varied between 408 and 572. As for the time required for the analysis, it ranged from 16.67 seconds to 91.05 seconds on a Dell Latitude 7480 with a 2 cores 2.00GHz Intel i5-6360U processor.

Let us however remark, that more recent works on HIBOU such as the checking of local frontiers have not been ported to HIBOUX at the time of those experiments.

Conclusion

In this chapter we have presented the HIBOUX tool, which extends HIBOU by handling data in interaction models thanks to symbolic execution. We have notably used this tool as part of a prototype use case with an industrial partner.

we have defined for identifying and discriminating between those diverse cases of partial observation either rely on simulation steps to complete missing events corresponding to unobserved behavior or on hiding steps.

Hiding steps consist in restricting the analysis of the multi-trace to a smaller interaction model. Instead of continuing using the whole interaction specification, once a sub-system stops from being observed, we rather use a sub-specification that only concerns the sub-systems that are still observed.

Using an algorithmization of the operational semantics called the "execution semantics", which we have proven to be correct, we implemented the HIBOU tool which features most if not all the theoretical results developed during the thesis. This includes the ability to specify, manipulate and draw interaction models, compute their normal forms, explore their semantics and analyze multi-traces against them using any of the multi-trace analysis algorithms which we defined.

In addition, in order to meet challenges presented by an industrial use-case, we have enriched our IL with data via the implementation of the HIBOUX (HIBOU with symbolic eXecution) which allows the execution of interaction models enriched with data in the form of variables, message parameters, guards and so on.

HIBOUX uses symbolic execution so as to treat in an efficient manner the analysis of multi-traces that contains typed data as parameters of send and received messages. We have used this tool in order to test outputs (sets of logs) of a prototype implementation provided by an industrial partner as part of the FUI DisTA project.

Perspectives

The work presented in this thesis could be extended in various ways. It can also be related to more distant research. In this section, we discuss research directions that could extend or benefit from our work.

Formalizing value passing & symbolic interactions

With the presentation of HIBOUX we have touched upon the notion of value passing because the data in a message that is send must be the same when that message is received. In HIBOUX this is taken care of by rewriting the symbolic interaction model so as to write the values computed when the message is send onto the message arguments of the corresponding receptions. However we have not formalized those mechanisms of value passing. Value passing can be defined and formalized independently of the addition of data or the use of symbolic execution. As a result, a first step towards the formalization of the theory behind HIBOUX could be to formalize an Interaction Language with value passing.

Then, of course, a follow-up research would be to propose a full formalisation of a symbolic interaction language and its semantics.

Towards testing & extended formal verification

In this thesis, we have presented various algorithms as solutions to the membership problems associated with specific semantics. Although the analysis of a multi-trace shares similarities with the notion of a test, 15.2. PERSPECTIVES [START_REF] Harel | Assert and negate revisited: Modal semantics for UML sequence diagrams[END_REF] the notion of hot (universal) and cold (existential) modalities associated to individual actions is rather proposed.

The language which we have presented has a static structure by nature. Indeed, any term is defined up to a signature (L, M ) which determines which messages and lifelines are defined. A possible extension to the language would be to allow the creation and destruction of lifelines associated to the evaluation of some actions. Lifeline "templates" could be defined so as to create new lifelines during execution, that are expected to express specific behaviors.

Another possible extension to the IL would be that of considering groups of lifelines which contents could vary in time. This can be linked to the previous point, with, for instance, newly created lifelines becoming members of a certain group. Then, we could for instance define broadcasts that target members of these groups. Instead of having an alternative to cover all cases of which lifelines may or may not receive the broadcast, this would then be covered by the membership of the lifeline to a certain group.

Finally, in our IL we have only considered non-deterministic choice for the taking of alternative branches or the instantiation of loops. This non-determinism however is in fact rather linked to the choice of which action is fired rather than to the specific alt or loop k constructors. A possible extension to the language would then be to consider probabilistic interactions (by analogy to probabilistic automata) in which the execution of specific actions can be associated with probabilities.

Towards leaning interaction models

In this thesis, we have seen that we could analyse multi-traces collected from executions of a Distributed System against a specification of that DS written as an interaction model. However, in practice, it might be so that, on the one hand, we have no such interaction model, and, on the other hand, we might have a large dataset of collected multi-traces. Then, reconstructing an interaction model from this set of multi-traces would consists in a sort of reverse analysis. Doing so would then allow the automatic generation of models which could, for instance, help the understanding of complex systems which were not designed but rather emerged from the cooperation of various sub-systems.

An ideal tool for this kind of endeavour would be machine learning as it has already been used in the literature for learning automata-like models from traces [START_REF] Pferscher | Learning abstracted non-deterministic finite state machines[END_REF]. The works presented in this thesis would help two aspects of learning interaction models:

• the multi-trace analysis algorithms that we have defined would constitute a criteria for whether or not a generated model is valid

• with the normalization of interaction terms, a machine learning algorihtm would only need to search for terms in the space of normal forms instead of the space of all interaction terms On the first point, we could notably define a dedicated multi-trace analysis algorithm that is able to analyse several multi-traces at once and stops if any one of them is not accepted.

Appendices

Appendix A

Synthèse en français

Le caractère distribué de certains systèmes complexifie les problématiques liées à leur modélisation et à la vérification de leurs comportements. Dans le cadre de cette thèse nous nous intéressons à un type de formalisme particulier: les interactions, afin de modéliser le comportement de systèmes distribués. On y spécifie les échanges asynchrones de messages pouvant être observés aux interfaces des différents sous-systèmes d'un