Professeur Laurent Muller

Nicolas Boulet

À mes Maîtres et membres du jury,

À Monsieur le Professeur Jean-Yves LEFRANT, Merci de me faire l'honneur de présider ce jury.

Merci pour tes conseils avisés, pour ta disponibilité à mon égard, et pour le temps que tu accordes à ma formation.

Merci de toujours me tirer vers le haut, et de me faire ainsi progresser.

Enfin, merci pour tes métaphores imagées, toujours pertinentes et drôles.

À Monsieur le

REMERCIEMENTS

À vous tous, qui avez croisé ma route, Je vous dédie ce travail.

Vous m'avez enrichi de votre expérience, de votre sagesse, et de votre amitié.

Merci.

À toute l'équipe de la réanimation du DAR B du CHU Saint Éloi, Merci de m'avoir intégré à votre équipe après une arrivée à mi-semestre, dans une si bonne ambiance de travail. J'ai apprécié de découvrir toute l'excellence de votre service, tant sur le plan médical que sur celui de la recherche clinique.

À toute l'équipe du bloc opératoire pédiatrique de l'HFME à Lyon,

Merci pour votre accueil au sein de la meilleure ville du monde ! Merci d'avoir démystifié l'anesthésie pédiatrique avec professionnalisme. Vous rendez votre spécialité accessible et passionnante avec beaucoup de pédagogie.

À toute l'équipe de la réanimation de la clinique Saint-Jean,

Merci pour votre dévouement durant toutes ces heures de travail. Merci aussi pour la déconne, le rire et la bonne ambiance. Vous êtes une super équipe et c'est une joie de venir trimer avec vous. À Yassir et Fanny, merci de m'avoir accueilli de manière aussi bienveillante au sein de l'équipe médicale, merci de me faire confiance et de m'intégrer au monde des grands.

À mes amis sudistes,

À la Coloc de l'Ambiance (et pièces rapportées :D),

Le quatuor infernal… ahahah, je vous aime très fort les filles <3 À Asma, merci pour ta bonne humeur, ta joie de vivre, d'être si souvent choquée que ça en devient drôle (« Rooooooooh »). Et pas merci pour Les Marseillais xD À Popo, depuis ce premier semestre, j'ai rencontré une fille incroyablement généreuse, travailleuse, gentille et drôle. Évoluer à tes côtés a été, et sera toujours, un immense plaisir. Merci pour tout ma soeur <3. Et merci pour tes sessions « bronzette » sur le canapé qui me faisaient tant marrer. À Vincent, merci pour ton humour piquant (Anne Roumanoff !), ta gentillesse masquée sous ta carapace de chintok, et pour tes talents de cuisinier. À Sabrina, merci pour ton énergie débordante, et ton goût de la chose bien (voire parfaitement) faite en toutes circonstances, merci pour les soirées déguisées aux thèmes inépuisables. À Bruno, merci pour ta gentillesse et ta bienveillance. Je vous souhaite beaucoup de bonheur pour la suite.

À la MIFA de Perpi, Ce semestre à vos côtés a été un de mes plus beaux souvenirs d'internat. Merci à tous pour votre amitié depuis toutes ces années. Je vous aime ! À Arni et Vivi, mes « cagoles du sud » préférées. Arni, merci d'être si stylé sur tous les points (n'en déplaise aux rageux), et merci pour tes conseils sportifs et musicaux (le J c'est le S !). Vivi, merci pour tes jeux de mots (souvent) incroyables et ton humour pince-sans-rire si attachant. À Camille et Etienne, les ch'tis déjantés. Camille, notre mamie pochpoch préférée, merci pour ta bonne humeur constante et ta joie de vivre (euuuuh, on parle de la même Camille ??? ;D), merci pour tes blagues pourries qui nous font tous (un peu) rire. Etienne, merci pour tes conseils de machine de running, et ta descente de bières incroyable (enfin… selon toi !). À Carole, merci pour ces longues parties de loup-garou (longues, ça dépend pour qui !), merci pour ton caractère si trempé et ta franchise, wesh ! T'as déjà vu un spectacle de ventriloque ? À Chloé, merci pour ton grain de folie et pour ton rire communicatif, que je reconnaitrais entre 1000. À Mathieu, merci de canaliser le grain de folie susnommé :D, et merci de nous ramener sur terre en tant que non-médecin. À Dune et Satcha, les grands voyageurs, merci pour votre esprit rêveur et pour votre sérénité permanente. À Guigui, merci pour ta générosité et ta bonne humeur, merci d'être les fondations de ce groupe, si important pour nous. À Juju, merci pour ta force tranquille, ton calme et ton esprit brillant. Je vous souhaite le meilleur à tous les 3. À Marion L, merci d'avoir été ma compagnonne de grimpe pendant toutes ces années, et pour le kiff des sorties à venir. Je n'ai malheureusement pas prévu de gin pour ce soir xD À Marion S, merci pour ta solidité, un exemple qui m'a permis de persévérer pour réussir ce défi-piscine (oui, malgré l'absence de témoin visuel !). À Nacim, merci pour cette intimité si gênante qu'il existe entre nous (tmtc), merci pour les fous rires, pour tes punchlines acerbes, et pour tous les bons moments passés et à venir. Merci pour ton intelligence que tu traduis autant dans ton éloquence que dans tes nombreuses connaissances médicales. À Esra, merci pour ton humour si percutant, pour ton caractère trempé, pour ton charisme fou et pour ton style infaillible (et on sait d'où tu pars, l'émo-girl).

Aux meilleurs de Mont(p)el,

À Benjamin, merci pour cette amitié si complice et pour nos longues discussions multithématiques. Merci pour tes partages musicaux, pour tes cocktails si raffinés, et pour ton corps de rêve d'athlète <3 À Florène, merci pour ton dévouement sans limite à la filière (RDF ou FDP ?), avec générosité et entrain. Tu fais partie de ces gens qui font l'unanimité. Merci pour cette amitié sincère, mais surtout, merci pour ton excentricité et tes fourrures (mais pas merci pour tes morsures !!!). À PB, merci pour toutes ces embrouilles (pour reprendre tes mots :D) si drôles avec du recul. Merci pour ta franchise, ta sensibilité et ta sincérité. Merci pour tes petites « mises au point » en anesthésie. À Thomas, merci d'avoir été mon camarade de DURPI, pour tous ces moments intimes où on a dormi dans le même lit (pour le coup, on ne parlait pas d'infections !), merci pour tes blagues, ton humour et pour ton côté râleur :D.

Aux « Régis »,

Petit poney, petit poney, tu es tout gris et tout petit, petit poney, petit poney. Petit poney, petit poney, tu es tout gris et tout petit, petit poney, petit poney. À (Dark) Antoine, merci pour ton humour (très !) piquant, si délicieux, quand on n'en est pas la cible, ahah ! À Eddine, merci pour ta bonhomie et pour ta joie de vivre si communicative. Merci d'être si bon public (« XD »), et pour ton esprit si vif. Sauf en ce qui concerne les ultrasons et les testicules, tu connais. À ce bon vieux Joris Pensier, mon compagnon, mon gars sûr… « On est quand même comme cul et chemise » disait un grand imitateur de Gaëtan Roussel. Merci pour ton intelligence hors norme (de « rival », je n'ai que le nom !), ton humour décalé, et ta bienveillance. Je suis très fier d'être ami avec quelqu'un que j'admire autant. Je chéris nos discussions sans fin devant les (très !) nombreuses bières qu'on a descendues ensemble. À Loïc, merci d'être celui qui me suit dans les blagues et les délires les plus débiles (la fontaine de Nîmes !). Te côtoyer est très rafraichissant, par ton côté adorable beauf, qui aime les guns, la chasse, les militaires, les pompiers, les avions, le rugby, la plongée, le parachute… Mais j'espère que tu as appris à intuber depuis le temps ! Tu sais Loïc, la banlieue c'est pas rose. À Emma et Estelle, merci d'avoir été des externes en or, c'est avec joie que je peux maintenant vous appeler « collègues » (avec l'accent marseillais).

Aux « G.E.R.A.R.D »,

À Geoffrey A., merci pour tes blagues, pour ton compagnonnage, et pour ton accent gardois qui met du baume au coeur. À Lulu, merci pour ta joie de vivre et pour tes imitations incroyables et hilarantes. Merci pour tes histoires folles (« les gars, nouveaux gate !!! ») qui savent nous tenir en haleine. À Mathieu Cap2, merci d'être un mentor, un ami, ainsi qu'un exemple de rigueur et de travail. Merci aussi de m'avoir fait découvrir et aimer le king, B2O.

Aux marseillaises À (Rh)Alice, merci pour ton calme, ton esprit posé et ta tranquillité, qui apportent beaucoup de sérénité aux gens qui te côtoient. Merci pour ta souplesse d'esprit -et de corps (Yogaaaa)-. À Pauline S, merci pour ton caractère enjoué, ton hyperactivité, ta bonne humeur folle et contagieuse. Merci pour ce que tu apportes à Aude depuis tant d'années. Votre amitié est source d'inspiration et d'admiration.

Aux copains de l'escalade, À Arnaud, merci pour tes analyses si perspicaces lors de nos nombreuses sessions grimpe (la 7a blanche !!!). À Baptiste, merci pour ta clairvoyance et ton humilité. Tu ne rentres dans aucune case, et c'est pour ça que ton amitié m'est très chère. À nos futures sorties (grimpe ou trail) et à nos bouffes d'antan ! J'espère que tu profites à fond ! À Zahir, nos points communs ne s'arrêtent pas à la passion des plannings et du noeud de 8 bien réalisé. Merci pour tous ces bons moments passés. Je te souhaite le meilleur.

À Jawad, Merci pour ta vivacité d'esprit, dans tes blagues mais aussi dans ta pratique médicale (m'enfin, pour la gestion de la natrémie plus que pour le bloc axillaire). Merci d'avoir fait le choix de rejoindre nos rangs de DESAR, qui s'en portent forcément mieux maintenant.

À la promo DESAR 2017, les meilleurs,

Merci à tous de faire en sorte que cette promo soit une si belle et grande famille. Aucune autre ne peut se targuer d'avoir une aussi bonne entente. Quel bonheur de vous fréquenter. Merci ! Le gala de la SFAR2018 restera un souvenir incroyable avec (quasi) vous tous <3 À mes anciens co-internes, Élodie, Adrien, Anaïs, Chirine, Laysa, Jade, Jules, Julie, Marc, Marwane, Vivien, Marion, Jacques, Alexandre T, Juliette, Kathlyn, Lorrain, Thomas S, Alexandre L, Aurélien, Chloé, Marie, Mathias, Nicolas D, Thomas L, Boris, Lili, Mathys, Mohamed, Yannis, Suheda, Elsa, Gauderic, Laurène, Loic C, Marine, Quentin, Auriane, Carole, Clémentine, Hermine, Jean-Baptiste, Julien, Justine, Lionel, Mathilde, les Maxime(s), Pierre-Jean, Quentin… Je ne fais que vous citer, mais travailler (un peu), échanger, et rigoler (surtout) à vos côtés a été un honneur et un plaisir pour moi. Merci à tous d'avoir partagé un bout de cette aventure avec moi.

À mes amis lyonnais,

Aux « lyonnais prout et prudes »,

À Amélie, merci pour ton sourire lumineux et ta joie communicative. Ton débit de parole élevé traduit à merveille ton enthousiasme débordant :D. À Anahit, l'arménienne fière ! Merci pour ta bonne humeur et ta naïveté si attendrissante (on se rappelle tes nombreuses phrases suggestives faites à ton insu) À Antoine, mon compagnon de toujours dans les aventures les plus folles (Tacos & Nug'). Un ami précieux, unique, et brillant. Merci de rester pourtant si simple et humble. Merci pour ta justesse et ta pertinence à toute épreuve. Merci pour le temps que tu as passé sur ce travail, je te le dédie tout particulièrement.

À Florent, l'un de mes plus vieux amis, merci d'être à mes côtés depuis tout ce temps. Je suis nostalgique de nos longues sessions Dofus, skate, et musique. Malgré la distance (St Thom-Descartes, c'est loin !) et les retrouvailles, rien n'a jamais changé entre nous.

À Florian, merci pour ton amitié sincère, pour ta gentillesse, ta générosité, et ton innocence (« zizi »). Te côtoyer depuis toutes ces années m'apporte énormément de joie. Merci aussi de m'avoir initié au monde de la course à pied (« j'ai créé un monstre ! »).

À Hugo, le plus déjanté de mes amis. Tu es un génie fou, bon vivant, qui a tout compris au bonheur et qui sait profiter de chaque instant. Te suivre n'est pas de tout repos, mais reste à chaque fois un moment simple de pur plaisir. Merci.

À Jeff, tu ne serais pas le batteur de The Arties ??? Toi et moi, on peut tout se dire, sans jamais se juger, mais toujours en se comprenant. Tu es doté d'une empathie sans égale, et d'une très grande sensibilité. Merci d'être un ami fidèle, fiable et sur qui l'on peut compter, malgré la distance. J'espère que tu es conscient que tu peux aussi compter sur moi à tout instant.

À Lucille, merci pour ta bonne humeur à toute épreuve. Ton caractère, fort et doux à la fois, fait de toi une amie sur qui l'on peut se reposer, et qui fait s'arrêter le temps.

À Léa, merci également pour ta bonne humeur et ton sourire rayonnant. La distance nous a éloignés, mais chaque retrouvaille (festive) est un véritable plaisir.

À Maëva, la reine des reines. Merci pour ton accent chantant, souvent moqué mais jamais égalé. Merci d'être la maman de ce groupe (!!!!!!!), sans qui bien des projets ne se seraient pas réalisés (spécialiste en réservations Airbnb). Merci pour ta passion et ta tendresse, qualités si rafraichissantes dans ce monde de brutes.

À Manon C, le passé a fait qu'à présent, notre amitié est simple et sincère, sans masque ni tabou. Merci pour ça.

À Manon F, comme le métal (c'est marrant parce que tu t'appelles Ferreux !), tu es tranchante et d'une solidité incomparable. Rien ne peut atteindre ton caractère en acier trempé. Tu es une personne admirable et fière. Sans se le dire, j'espère que tu sais que je suis là pour toi.

À Vincent, l'autre de mes plus vieux amis, merci pour ta personnalité si sincère. Tu es un ami fiable, sur qui l'on peut compter en tout temps. Merci d'être l'outsider de ce groupe de médecins, qui nous ramène parfois (souvent) sur terre. J'espère que tu as enfin pu faire l'amour.

À Antoine et Tiff-tiff,

Merci à tous les 2 pour cette longue amitié, faite de rebondissements, de passions et de délires alcoolisés. Vous retrouver lors de ce retour à Lyon a été une bouffée d'air frais, comme si nous ne nous étions jamais quittés. Je vous aime fort et je vous souhaite le meilleur ! À Geoffrey D., C'était une joie de te (re)découvrir à nouveau lors de notre semestre lyonnais. Merci pour les tranches de rire et les délires festifs à tes côtés.

À toute la promo de Lyon Sud,

À tous ces gens qui ont fait de ces longues études un réel plaisir, je pense très fort à vous. À toutes nos soirées folles, nos week-ends, nos délires… Malgré la distance, je ne vous oublierai jamais. Merci.

Aux nouveaux copains du Master 2,

Merci à tous pour cette année si peu banale pour un interne en médecine. Vous côtoyer a été source d'un enrichissement personnel (Tik Tok et tous les trucs de jeunots) et professionnel (les mecs imbattables en stress oxydatif). Merci pour ces grands dortoirs Airbnb et les soirées déconne/jeux/apéro à vos côtés.

À ma famille,

À ma mère, Le coeur… Comme lui, tu es régulière, fiable, et vitale. Dans les bons moments, c'est ta générosité, ta passion, ton rire et ta tendresse qui te caractérisent. Notre complicité ne connait pas d'égale, tu as toujours été une mère aimante et ma meilleure amie, à qui je peux tout confier. Dans les pires, c'est ton indéniable soutien, sans faille, sans concessions, sans jamais rien attendre en retour. Tu es là, et tu as toujours été là. Merci pour cette sécurité que tu m'as apporté qui fait qu'à tout moment, je te sais à mes côtés. Merci d'avoir fait de moi ce que je suis, et pour les valeurs que tu m'as transmises. Merci d'être une mère si formidable (n'en doute jamais), et le coeur de cette (plus si) nouvelle famille.

À mon père,

Le cerveau… Tu incarnes l'intelligence et la justesse. Drôle d'hommage me diras-tu. Mais après toutes les épreuves que nous avons traversées, il est d'autant plus vrai. Comme ton cerveau, tu es solide comme un roc, tu résistes, et tu ne te laisses jamais abattre. À ta place, beaucoup auraient plié sous le choc, mais tu n'as même pas fléchi. Merci d'être mon modèle, mon exemple à suivre. Merci de m'avoir transmis la réflexion, et l'esprit critique. Aujourd'hui, c'est grâce à toi que je vais devenir Docteur en médecine. Tu as toujours su ce qui était bon pour moi. Tu m'as poussé pour toujours faire mieux, constamment à mes côtés, à m'accompagner. Merci pour ton amour et ton soutien pendant ces longues études. Mon super héros… À ma soeur, Quasi-jumeaux, merci pour cette amitié et cette fraternité qui dure depuis toujours. Tu me connais mieux que personne, mes qualités et surtout mes défauts. Merci d'être malgré tout si attentive et si compréhensive. Merci pour tous ces souvenirs, que l'on se remémore parfois en un regard ! Merci pour ta personnalité singulière et lumineuse, qui met du baume au coeur de tous ceux qui te côtoient. J'espère que tu trouveras ta voie, et je te souhaite plein de bonheur.

À mon frère,

Le petit dernier J Tu as toujours eu un esprit très vif, tu analyses tout ce qui t'entoure, avec discrétion mais pertinence. Ne perd jamais cette qualité ! Merci d'avoir su me (re)transmettre de vieilles passions, les jeux vidéos, les mangas… Merci pour ta gentillesse, et d'être mon frère adoré <3 À Pierre, Merci pour ta perspicacité, ta justesse, et ta patience. Tu es le roc(k'n'roll !) de cette famille, la force tranquille, celui qui apporte l'équilibre et la sérénité. Merci de prendre soin des tiens comme tu le fais, avec amour et bienveillance. Merci de me transmettre ta passion de la musique, et de me permettre de jouer sur ta (super) Gibson Nighthawk, que j'adore ! Nous n'aurions pas pu rêver meilleur beau-père pour prendre soin de notre mère <3 À Achille, Solenne, Lulu, Loulou, Claudia, et Julie, Merci à tous pour ces instants de famille si précieux, ces jeux, ces balades, ces rires, ces sorties de ski, ces débats (endiablés). Je me rends compte de la chance que c'est d'avoir une famille recomposée comme celle-là. Merci à tous pour vos personnalités si différentes et pourtant si complémentaires. Primary and secondary objectives (Table 1 andFigure patients. [START_REF] Timsit | A multicentre analysis of catheter-related infection based on a hierarchical model[END_REF][START_REF] Timsit | A state of the art review on optimal practices to prevent, recognize, and manage complications associated with intravascular devices in the critically ill[END_REF] In the last two decades, ultrasound (US)-guided vascular access has been largely studied and is now recommended over landmark technique, especially for the internal jugular site. [START_REF] Bouaziz | Guidelines on the use of ultrasound guidance for vascular access[END_REF][START_REF] Timsit | Expert consensus-based clinical practice guidelines management of intravascular catheters in the intensive care unit[END_REF][START_REF] Schmidt | Ultrasound-guided vascular access in critical illness[END_REF][START_REF] Frankel | Guidelines for the Appropriate Use of Bedside General and Cardiac Ultrasonography in the Evaluation of Critically Ill Patients-Part I: General Ultrasonography[END_REF][START_REF] Lamperti | International evidence-based recommendations on ultrasound-guided vascular access[END_REF][START_REF] Wu | Real-time Two-dimensional Ultrasound Guidance for Central Venous Cannulation: A Meta-analysis[END_REF][START_REF] Brass | Ultrasound guidance versus anatomical landmarks for internal jugular vein catheterization[END_REF] Even if subclavian site is associated with a lower risk of catheter-related infection and thrombosis, [START_REF] Timsit | Expert consensus-based clinical practice guidelines management of intravascular catheters in the intensive care unit[END_REF][START_REF] Parienti | Intravascular Complications of Central Venous Catheterization by Insertion Site[END_REF][START_REF] Parienti | Catheter-Related Bloodstream Infection in Jugular Versus Subclavian Central Catheterization[END_REF] the use of US guidance for subclavian vein catheterization remains debated and less popular among ICU physicians due to technical difficulties such as a more complex needle visualization compared to the internal jugular site. 12-14 However, US guidance increases the success rate and reduces the risk of mechanical complications and procedure duration. [START_REF] Bouaziz | Guidelines on the use of ultrasound guidance for vascular access[END_REF][START_REF] Wu | Real-time Two-dimensional Ultrasound Guidance for Central Venous Cannulation: A Meta-analysis[END_REF][START_REF] Lalu | Ultrasound-Guided Subclavian Vein Catheterization: A Systematic Review and Meta-Analysis[END_REF][START_REF] Millington | Better With Ultrasound[END_REF][START_REF] Fragou | Real-time ultrasound-guided subclavian vein cannulation versus the landmark method in critical care patients: A prospective randomized study*[END_REF] From an anatomical point of view, the transition between the axillary and the subclavian vein is located at the external margin of the first rib, the subclavian vein is usually difficult to visualize in the infraclavicular area. [START_REF] Brescia | A novel ultrasoundguided approach to the axillary vein: Oblique-axis view combined with in-plane puncture[END_REF] Cannulation of the axillary vein as an alternative to the subclavian access gained popularity after the introduction of US guidance into clinical practice. In 2020, PERSEUS guidelines from the European Society of Anesthesiology state that most of the US-guided punctures in the infraclavicular area consist in axillary vein punctures. [START_REF] Lamperti | European Society of Anaesthesiology guidelines on peri-operative use of ultrasound-guided for vascular access (PERSEUS vascular access)[END_REF] Therefore, to be consistent with these international guidelines on vascular access, we decided to refer to "axillary vein catheterization" in our trial. However, most of the studies cited in this paper refer to the subclavian access despite the use of US guidance.

À Adi, Khanh, et

Until recently, US guidance for CVC remained poorly applied in ICUs : US guidance was used in 54% of cases for all CVC procedures, and only in 31% of cases for the subclavian (or, better, axillary) site. [START_REF] Soni | Use of ultrasound guidance for central venous catheterization: a national survey of intensivists and hospitalists[END_REF][START_REF] Zieleskiewicz | Point-of-care ultrasound in intensive care units: assessment of 1073 procedures in a multicentric, prospective, observational study[END_REF] Even if subclavian CVC with US real-time guidance (or, better, axillary site) is associated with rare complications (0.32%, pneumothorax, 0.13% arterial puncture, 0.07% hematoma, 4.55% malposition rate), [START_REF] Lalu | Ultrasound-Guided Subclavian Vein Catheterization: A Systematic Review and Meta-Analysis[END_REF] posterior wall puncture of the vein can reach an overall incidence of 34% in a simulated model. [START_REF] Moon | Incidence of Posterior Vessel Wall Puncture During Ultrasound-guided Vessel Cannulation in a Simulated Model: Posterior Vessel Wall Puncture[END_REF] New magnetic devices theoretically allow a better success rate and lower complication rate, by improving the real-time visualization of the needle and its location relative to the US beam.

Multiple simulation studies have shown the feasibility of these new techniques, in different simulations protocols. [START_REF] Menacé | Comparison of a GPS needletracking system, multiplanar imaging and 2D imaging for real-time ultrasound-guided epidural anaesthesia: A randomized, comparative, observer-blinded study on phantoms[END_REF][START_REF] Kopac | Comparison of a novel real-time SonixGPS needle-tracking ultrasound technique with traditional ultrasound for vascular access in a phantom gel model[END_REF][START_REF] Meiser | Comparison of in-plane and out-of-plane needle insertion with vs. without needle guidance[END_REF][START_REF] Sander | Novel Navigated Ultrasound Compared With Conventional Ultrasound for Vascular Access-a Prospective Study in a Gel Phantom Model[END_REF][START_REF] Mcvicar | Novice Performance of Ultrasound-Guided Needling Skills: Effect of a Needle Guidance System[END_REF][START_REF] Kim | The effect of electromagnetic guidance system on early learning curve of ultrasound for novices[END_REF][START_REF] Backhaus | Ultrasound-guided lumbar puncture with a needleguidance system: A prospective and controlled study to evaluate the learnability and feasibility of a newly developed approach[END_REF][START_REF] Tielens | Ultrasound-guided needle handling using a guidance positioning system in a phantom[END_REF][START_REF] Johnson | Ultrasound-Guided Needle Technique Accuracy: Prospective Comparison of Passive Magnetic Tracking Versus Unassisted Echogenic Needle Localization[END_REF] None of them performed an axillary venipuncture study on a torso model mannequin, which is the most realistic simulation available.

The efficacy and safety of needle-pilot system for US-guided axillary catheterization has not been studied yet. Therefore, we designed a prospective randomized cross-over controlled simulation trial on human torso mannequin comparing a new needle-pilot device (Samsung Healthcare, Saint Ouen, Ile-de-France, France) to standard US guidance for axillary vein catheterization. The main objective was to compare the procedure duration between standard real-time US guidance and real-time guidance with the needle-pilot device. The secondary objectives were: the proportion of procedure requiring multiples punctures, the occurrence of mechanical complications such as posterior wall puncture of axillary vein or arterial puncture, needle redirections, failure rate and operator comfort.

METHODS

Study Design and Setting

We designed a prospective, randomized controlled cross-over simulation trial involving ICU physicians and residents at the Nîmes University Hospital.

According to the French law, [START_REF] Toulouse | French legal approach to patient consent in clinical research[END_REF] ethical approval for this study (approval number 19.11.03) was provided by the local Ethical Committee, and registered at clinicaltrials.gov (NCT04463147).

Study Population

Inclusion criteria: all 51 physicians and residents of Nîmes Hospital ICUs were eligible for inclusion in the study, and all were invited to participate (oral request by N.B.). Participation to the study was voluntary and uncompensated.

Non-inclusion criteria were: physician's refusal, and being principal investigator.

All participants were blinded from study objectives and collected data. Before starting the procedure, a 5-minute standardized slideshow was performed by investigators (N.B.) in order to describe the way to use needle-pilot device. After the slideshow, the participant was allowed to use US probe to visualize the vessel but was not allowed to attempt vessel cannulation during the didactic session.

Needle-pilot device

This technology is a specific option (eZono, Jena, Germany) that can be activated or deactivated on a standard ultrasound machine (Samsung Healthcare, Saint Ouen, Ile-de-France, France). This software consists in improving the localization of the needle on 2D US images (Figure 1).

A rectangle indicates the correct position of the needle and its tip in relation to the US beam. The correct needle alignment is given according to the color of the rectangle (from green to red, Figure 1). Beside the US image (left of the screen, Figure 1), a second blue vertical rectangle indicates the position of the needle in relation to the US probe, in long axis view. The needle is visualized by a green line that also changes color according to its correct alignment with the axis of the US probe (from green to red). This is real time visualization, thus allowing instantaneous localization of the needle. Moreover, the needle must be magnetized before the procedure, by placing it for 2 seconds in a disposable device (eZMag NS, eZono, Jena, Germany), and then removing it with a brief movement.

Randomization

Randomization was stratified into 2 predefined groups: novice operators and experienced operators in CVC. Novice operators were defined as participants who had less than 6 months of experience in CVC and less than 10 CVC under US guidance. They were provided with another 5-minute standardized slideshow instruction on CVC ultrasound guidance and how to obtain a long-axis view of the axillary vein. Experienced operators were defined as participants who had more than 6 months of experience in CVC, more than 10 CVC insertions with US guidance, and no more than 1 year-period without practicing CVC.

This threshold was chosen based on a previous study performed by Lefrant et al. 31

Protocol

Participants were invited to cannulate the right axillary vein of a human torso mannequin (Blue Phantom, CAE Healthcare, Montreal, Canada) (Supplemental Figure 1) using an in-plane and long-axis view. As on a real patient, this view was obtained by placing the US probe under the clavicle and then pointing it upward. Each participant performed US-guided cannulation with and without needle-pilot software. To prevent the learning-effect, we randomized the order of utilization by computer-generated 4-size blocks (N.B.): standard US guidance before needle-pilot US guidance (Arm 0), or needle-pilot US guidance before standard US guidance (Arm 1).

The operators used a 6-mL syringe from a central venous catheterization kit (Arrow, Teleflex Incorporated, Reading, USA) to cannulate vein of the human torso mannequin and an 18-gauge 70-mm needle compatible with magnetic US linear probe 3-14 MHz (Seldisafe, Vygon, Ecouen, France). Before each procedure, the mannequin vein and artery were pre-filled with blue and red fluid, respectively. Successful cannulation of the axillary vein was defined as visualization of blue fluid in the syringe. In case of arterial puncture, a red fluid appeared in syringe. Study participants were blinded from the other participants performance.

Data Management and Statistical Analyses

All analyses were performed using R Version 3.6.1 (R Foundation, Vienna, Austria). Continuous data are reported as medians with interquartile ranges (IQR), and categorical data are reported as numbers and percentages.

In order to compare results with each method, we used the Wilcoxon signed-rank test for paired data for continuous variables, and the McNemar's exact test for categorical variables. Because of their low occurrence, some variables have been transformed into binary variables and analyzed as categorical: number of skin puncture (one or more), posterior wall puncture of axillary vein (none or at least one), arterial puncture (none or at least one). Failure was also analyzed as a categorical variable.

Finally, we performed 2 additional analyses in a priori subgroups for the main outcome (time to successful cannulation), using the same statistical tests: according to participant's experience, and according to randomization-arm.

A p-value less than 0.05 was considered significant, without correction for multiple testing. 95% confidence interval for the median of the difference was calculated with bootstrap.

Since it was an exploratory study, it was not possible to calculate an a priori number of needed subjects. All available participants have been included. proportion of prolonged procedure durations is also confirmed in both subgroups. Therefore, the present results suggests that, by reducing prolonged time procedure, the number of complications can be reduced.

Primary and secondary objectives (Table 1 and

This hypothesis seems to be indirectly confirmed by the fact that the new needle-pilot technique was associated with a lower number of complications such as number of skin punctures, needle redirections, and posterior wall punctures. These advantages probably explain the greater comfort for the operator observed in the present study, as for novice or experienced. Interestingly, the lack of significant difference in the time to cannulation when the new needle-pilot system was firstly used (Arm 1) tends to suggest that this new technique has a learning effect of the needle-guidance system that facilitates a subsequent conventional puncture.

This discovery may have potential implications to increase the safety of a training program.

Indeed, this new technology allows better representation in space of the needle by novice trainees and thus facilitate future standard US-guided punctures. In addition, needle redirection assessment allows trainers to better guide trainees and to assess acquired skills and know-how before starting clinical training on real patients.

All these hypotheses must be confirmed by clinical studies.

One limitation of this study is the threshold that distinguished novice and experienced participants.

Experienced operators were defined as participants who had more than 6 months experience in CVC, more than 10 CVC insertions with US guidance, and not more than 1 year-period without practicing CVC. Historically, there was no consensus or evidence regarding training and certification standards for vascular ultrasound cannulation. [START_REF] Lamperti | International evidence-based recommendations on ultrasound-guided vascular access[END_REF] In 1994, Mansfield et al reported that residents with less than 1 year experience had more failures than more experienced operators (23 years and > 3 years). [START_REF] Mansfield | Complications and Failures of Subclavian-Vein Catheterization[END_REF] In a previous study of our group, we did not report any difference in complication and failure between new juniors (defined as operator with less than 6-month training) and seniors. [START_REF] Lefrant | Risk factors of failure and immediate complication of subclavian vein catheterization in critically ill patients[END_REF] However, recent criteria have defined that an expert in ultrasound-guided vascular access must be able to demonstrate 1 year of independent practice in US-guided vascular access

  Sylvie, Merci de m'avoir accueilli dès le premier jour comme l'un des vôtres, de prendre soin de moi comme vous prendriez soin d'un fils ou d'un frère. Merci pour tous ces merveilleux moments que je passe en votre compagnie. « Il faut prendre les choses en riant, Savoir saisir les sources du bonheur, Profiter du goût d'un petit blanc, Et admirer les jolis sites en faisant une balade. » À tous ceux qui voient où je veux en venir. TABLE OF CONTENTS ABSTRACT ................................................................................................................................. 37 GLOSSARY OF TERMS ........................................................................................................... 38 INTRODUCTION ....................................................................................................................... 39 METHODS .................................................................................................................................. 41 Study Design and Setting .......................................................................................................... 41 Study Population ....................................................................................................................... 41 Needle-pilot device ................................................................................................................... 41 Randomization .......................................................................................................................... 43 Protocol ..................................................................................................................................... 43 Measured parameters and Data collection ................................................................................ 44 Study objectives ........................................................................................................................ 44 Data Management and Statistical Analyses .............................................................................. 45 RESULTS ..................................................................................................................................... 46

  3a) ...................................................... 47 Pre-planned subgroups analysis according to the experience of the operator and to the first randomized technique (Table 2 and Figure 3b) ........................................................................ 48 DISCUSSION .............................................................................................................................. 51 CONCLUSIONS .......................................................................................................................... 54 REFERENCES ............................................................................................................................ 55 SUPPLEMENTARY MATERIAL ............................................................................................ 59 INTRODUCTION Central venous catheterization (CVC) is needed in up to two-thirds of intensive care unit (ICU)

Figure 1 .

 1 Figure 1. Display of the needle-pilot device on ultrasound machine screen.

Figure 3a )

 3a Time to successful cannulation was significantly shorter with needle-pilot US-guided technique (22 seconds (IQR = 16-42) versus 25 seconds (IQR = 19-128); median of difference (MOD) = -9 seconds (95%-confidence interval (CI) = -5 to -22), p < 0.001).

Figure 3 .

 3 Figure 3. Time to successful cannulation

Table 1 .

 1 Outcomes for standard and needle-pilot ultrasound guided techniques.The rates of skin punctures, posterior wall puncture of axillary vein, and needle redirections were significantly lower with needle-pilot US-guided technique. There were no arterial punctures with pilot US-guided technique and 1 (2.2%) with conventional US-guided technique (p = 1). There

	Variable	Pilot	Standard	Comparison (95%-CI)
	Time (s) a Median (IQR)	22 (16-42)	25 (19-128)	MOD = -9 (-5; -22) p value < 0.001
	Skin punctures a
	1 skin puncture (n (%))	42 (93.3)	30 (66.7)
	2 skin punctures (n (%))	2 (4.4)	10 (22.2)
	3 skin punctures (n (%))	1 (2.2)	3 (6.7)
	4 skin punctures (n (%))	0 (0)	2 (4.4)
	Median (IQR)	1 (1-1)	1 (1-2)	MOD = 0 (0; 0) p value < 0.008
	≥ 2 Skin punctures b n (%)	3 (6.7)	15 (33.3)	OR = 0.14 (0.02; 0.62) p value < 0.01
	Posterior wall puncture (PWP) a
	0 PWP (n (%))	45 (100)	35 (77.8)
	1 PWP (n (%))	0 (0)	8 (17.8)
	2 PWP (n (%))	0 (0)	1 (2.2)
	3 PWP (n (%))	0 (0)	1 (2.2)
	Median (IQR)	0 (0-0)	0 (0-0)	MOD = 0 (0; 0) p value = 0.003
	≥ 1 PWP b n (%)	0 (0.0)	10 (22.2)	OR = 0 (0.00; 0.45) p value < 0.01
	Arterial puncture a
	0 arterial puncture (n (%))	45 (100)	44 (97.8)
	1 arterial puncture (n (%))	0 (0)	1 (2.2)
	Median (IQR)	0 (0-0)	0 (0-0)	MOD = 0 (0; 0) p value = 1
	≥ 1 Arterial puncture b n (%)	0 (0.0)	1 (2.2)	OR = 0 (0.00; 39.0) p value = 1
	Needle redirections a Median (IQR)	2 (1-4)	4 (2-9)	MOD = -2 (-1; -3) p value < 0.001
	Failure b n (%)	0 (0.0)	4 (8.9)	OR = 0 (0.00; 1.51) p value = 0.13
	Comfort a Median (IQR)	8 (8-9)	6 (6-8)	MOD = 2 (2; 1) p value < 0.001

95%-CI = 95% confidence intervals; IQR = interquartile range; MOD = median of difference; OR = odds ratio; PWP = posterior wall puncture. a continuous variable (Wilcoxon signed-rank test); b categorical variable (McNemar's exact test).

subgroups analysis according to the experience of the operator and to the first randomized technique (Table 2 and Figure 3b) Time

to successful cannulation was significantly shorter with needle-pilot US-guided technique in both novice (p = 0.04) and experienced (p = 0.01) operators. Time to successful cannulation was significantly shorter with needle-pilot US-guided technique in Arm 0 (standard before needlepilot) (p < 0.01), with no significant difference in Arm 1 (needle-pilot before standard).

Table 2 .

 2 Time to successful cannulation according to participant's experience and to randomisation-arm.

		n	Pilot Median (IQR)	Standard Median (IQR)	Median of Difference (95%-CI)
	Novice	11	33 (27-46)	86 (23-232)	-58 (-128; -0,00) p value = 0.04
	Experienced	34	19 (13-39)	25 (18-104)	-9 (-15; -4) p value = 0.01
		n	Pilot Median (IQR)	Standard Median (IQR)	Median of Difference (95%-CI)
	Arm 0 (standard → needle-pilot)	24	20 (14-43)	(21-232)	-39 (-122; -6) p value < 0.01
	Arm 1 (needle-pilot → standard)	21	29 (17-42)	25 (19-60)	-6 (-11; 6) p value = 0.21

IQR = interquartile range; 95%-CI = 95% confidence intervals. Wilcoxon signed-rank test.

Axillary vein catheterization using ultrasound guidance: A prospective randomized cross-over controlled simulation comparing standard ultrasound and new needle-pilot device

Nicolas Boulet 1, * , Xavier Bobbia (PhD) 2 , Antoine Gavoille 3 , Benjamin Louart (MD) [START_REF] Timsit | A multicentre analysis of catheter-related infection based on a hierarchical model[END_REF] , Jean Yves Lefrant (PhD) [START_REF] Timsit | A multicentre analysis of catheter-related infection based on a hierarchical model[END_REF] , Claire Roger (PhD) [START_REF] Timsit | A multicentre analysis of catheter-related infection based on a hierarchical model[END_REF] , Laurent Muller (PhD) 1 ABSTRACT Background: Real-time ultrasound (US) guidance facilitates central venous catheterization in intensive care unit (ICU). New magnetic needle-pilot devices could improve efficiency and safety of central venous catheterization. This simulation trial was aimed at comparing venipuncture with a new needle-pilot device to conventional US technique.

Methods: In a prospective, randomized, simulation trial, 51 ICU physicians and residents cannulated the right axillary vein of a human torso mannequin with standard US guidance and with a needle-pilot system, in a randomized order. The primary outcome was the time from skin puncture to successful venous cannulation. The secondary outcomes were the number of skin punctures, the number of posterior wall puncture of the axillary vein, the number of arterial punctures, the number of needle redirections, the failure rate and the operator comfort.

Results

Study objectives

The primary outcome was the time (seconds) from skin puncture to venous cannulation.

The secondary outcomes were: number of skin punctures (allowing to separate cannulations at the first try and requiring ≥ 2 skin punctures, respectively), posterior wall puncture of the axillary vein, arterial punctures, number of needle redirections, failure rate and operator comfort.

RESULTS

From November 13th, 2019, to February 21st, 2020, 49 (96%) participants were randomized and 45 (92%) were analyzed (Figure 2). Given the exceptional circumstances related to COVID-19 pandemic, the last four (8%) randomized participants were unable to complete the procedure during the study period and were excluded from the analysis. Among the participants, 11 (24%) and 34 (76%) were novice and experienced operators, respectively. Six (55%) novice and 18 (53%) experienced operators were randomized in Arm 0, while 5 (45%) novice and 16 (47%) experienced operators were randomized in Arm 1.

DISCUSSION

In this prospective randomized simulation study, the use of needle-pilot system was associated with a significant shorter time to successful cannulation, fewer number of skin punctures, fewer posterior wall punctures of the axillary vein, fewer needle redirections, and a better operator comfort during puncture. These differences were reported regardless of the operator experience.

Even if subclavian CVC reduces infectious and thromboembolic complications, [START_REF] Timsit | Expert consensus-based clinical practice guidelines management of intravascular catheters in the intensive care unit[END_REF][START_REF] Parienti | Intravascular Complications of Central Venous Catheterization by Insertion Site[END_REF][START_REF] Parienti | Catheter-Related Bloodstream Infection in Jugular Versus Subclavian Central Catheterization[END_REF] a large crosssectional electronic survey study reported that US guided subclavian (or, better, axillary) approach is used in 31% of CVC procedure in ICUs (203/661 of intensivists and hospital physicians), [START_REF] Soni | Use of ultrasound guidance for central venous catheterization: a national survey of intensivists and hospitalists[END_REF] probably explained by potential severe complications and/or a perceived difficulty or discomfort to perform this procedure. [START_REF] Soni | Use of ultrasound guidance for central venous catheterization: a national survey of intensivists and hospitalists[END_REF] This new needle-pilot system for US-guided axillary catheterization has not been studied yet in clinical conditions. Its potential interest has been reported in peri-medullary locoregional anesthesia on a phantom gel [START_REF] Menacé | Comparison of a GPS needletracking system, multiplanar imaging and 2D imaging for real-time ultrasound-guided epidural anaesthesia: A randomized, comparative, observer-blinded study on phantoms[END_REF][START_REF] Backhaus | Ultrasound-guided lumbar puncture with a needleguidance system: A prospective and controlled study to evaluate the learnability and feasibility of a newly developed approach[END_REF] or targeted needle placements on a phantom gel [START_REF] Kim | The effect of electromagnetic guidance system on early learning curve of ultrasound for novices[END_REF] or ex-vivo model. [START_REF] Mcvicar | Novice Performance of Ultrasound-Guided Needling Skills: Effect of a Needle Guidance System[END_REF] The present study is the first to compare this new needle-pilot system and standard US technique for US-guided axillary catheterization in a torso model mannequin.

In this study, the needle-pilot system led to a significant shorter time of successful cannulation, a lower number of skin punctures and less complications. The number of skin punctures has been shown to be associated with higher rate of mechanical complications. [START_REF] Lefrant | Risk factors of failure and immediate complication of subclavian vein catheterization in critically ill patients[END_REF][START_REF] Mansfield | Complications and Failures of Subclavian-Vein Catheterization[END_REF] In the present study, 42 axillary canulations were performed in one skin puncture with the new technique (93%) and 30 with the standard one (67%) (OR = 0.14 (0.02 to 0.62); p value < 0.01). It can be objected that the difference in time to canulation (median difference = -9 seconds) does not seem to be clinically relevant. The difference seems mainly related to the decreased in the proportion of prolonged procedure durations with the needle-pilot. Indeed, the table 1 and figure 3a show that 11 canulations (25%) required more than 128 seconds with standard US technique versus 1 (0.02%) with the new needle-pilot system. The table 2 and figure 3b show that this decreased in the following completion of competency-based training. They also have to prove regular continuing professional development activities relevant to US-guided vascular access and training. [START_REF] Lamperti | European Society of Anaesthesiology guidelines on peri-operative use of ultrasound-guided for vascular access (PERSEUS vascular access)[END_REF] This bias is limited in our study because all experienced operators met this criterion as none had been performing US-guided CVC for less than 1 year.

Even if the simulation design is the main limitation that cannot allow to extrapolate the present results to clinical practice, the present study was performed with the most robust methodology in a simulation trial. The main objectives (time to canulation, number of skin punctures, complications, and operator comfort) are probably independent of the unblinded investigator.

Therefore, the different findings of the present study plea for investigating clinical performance of this new device in ICU patients.

CONCLUSIONS

In this randomized cross-over controlled simulation trial, the use of a new needle-pilot device during US-guided axillary vein catheterization was associated with a time reduction of successful cannulation duration, and decreased numbers of skin punctures, posterior wall puncture and needle redirections. The potential interest of such device needs to be confirmed by clinical studies.

SUPPLEMENTARY MATERIAL

Supplemental Figure 1. Human torso mannequin.

Pictures obtained from the website www.bluephantom.com.

1A. View for puncture.

1B. Transparent view of the vessels.

Veins in blue, arteries in red.

SERMENT D'HIPPOCRATE

« En présence des Maîtres de cette école, de mes chers condisciples et devant l'effigie d'Hippocrate, je promets et je jure, au nom de l'Être suprême, d'être fidèle aux lois de l'honneur et de la probité dans l'exercice de la médecine.

Je donnerai mes soins gratuits à l'indigent et n'exigerai jamais un salaire au-dessus de mon travail.

Admis dans l'intérieur des maisons, mes yeux ne verront pas ce qui s'y passe, ma langue taira les secrets qui me seront confiés, et mon état ne servira pas à corrompre les moeurs, ni à favoriser le crime.

Respectueux et reconnaissant envers mes Maîtres, je rendrai à leurs enfants l'instruction que j'ai reçue de leurs pères.

Que les hommes m'accordent leur estime si je suis fidèle à mes promesses. Que je sois couvert d'opprobre et méprisé de mes confrères si j'y manque. »


Francesco Belardinelli
email: belardinelli@ibisc.fr

Andreas Herzig
email: herzig@irit.fr

Dynamic Logic for Data-aware Systems: Decidability Results

We introduce a first-order extension of dynamic logic (FO-DL), suitable to represent and reason about the behaviour of Data-aware Systems (DaS), which are systems whose data content is explicitly exhibited in their description. We illustrate the expressivity of the formal framework by modelling English auctions as DaS and by specifying relevant properties in FO-DL. Most importantly, we develop an abstraction-based verification procedure, thus proving that the model checking problem for DaS against FO-DL is decidable, provided some mild assumptions on the interpretation domain.

Introduction

In recent years data-aware and data-driven systems acquired pre-eminence as a formal framework to represent and reason about systems in which data play a key role in the system's execution [Bhattacharya et al., 2007;Deutsch et al., 2007;2009]. Initially, data-aware systems (DaS) appeared as a novel paradigm for the design of business processes in service-oriented computing [START_REF] Singh | [END_REF]. The originality of this approach consists in "combin [ing] data and processes in a holistic manner as the basic building block[s]" of the system's description [START_REF] Cohn | [END_REF]. Normally a DaS is comprised of a data model accounting for the relational structure of data, as well as the business processes manipulating data. Both the data model and business processes are equally important components of the system specification. Due to that, DaS differ profoundly from most of the tradition on service architectures and composition, in which data are typically abstracted away to reduce the complexity of the system description, thus making the verification task amenable to standard model checking techniques [START_REF] Singh | [END_REF].

Recently, the data-driven paradigm has found applications beyond service-oriented computing. Notably, a wealth of contributions have put forward data-driven approaches to knowledge representation and reasoning (KR&R) as well as to the modelling of multi-agent system (MAS). More specifically, [START_REF] Bagheri | [END_REF][START_REF] Bagheri | [END_REF] introduced knowledge and action bases (KAB) to describe distributed systems comprising a relational database, over which agent-services oper-ate. KAB were then extended to include a number of different features relevant for modelling MAS, including commitments [START_REF] Montali | [END_REF], plans [Calvanese et al., 2016b], and norms [START_REF] Baldoni | [END_REF]. More directly related to the present contribution, [START_REF] Belardinelli | [END_REF]2014] tackled the verification problem for artifact-centric multiagent systems-a particular class of data-aware systemsand proved it to be decidable under specific assumptions.

Here we extend the state of the art by considering an expressive dynamic modal language. Indeed, in the line including [Deutsch et al., 2009;[START_REF] Bagheri | [END_REF][START_REF] Bagheri | [END_REF][START_REF] Belardinelli | [END_REF]2014], the specification language for data-aware systems is typically a first-order extension of either branching-time temporal logic CTL or of the µcalculus [START_REF][END_REF]. In such languages one can express properties holding in some or all executions of the system. However, the structure of such executions is not exhibited transparently in the specification language, and actions do not appear explicitly in the temporal operators of CTL nor in those of the µ-calculus. To overcome these issues, here we consider a dynamic modal language [Pratt, 1976;[START_REF] Harel | [END_REF] in which actions are explicitly named in the modal operators. This syntactic choice allows us to express complex behaviours in a precise and concise way. However, the application of dynamic logic to the specification of dataaware systems calls for novel verification techniques w.r.t. the state of the art. Contribution. We introduce a novel interpretation of firstorder dynamic logic that suits the formal description of relevant aspects of DaS. The language has assignments v := t and v :=? as atomic actions, which are intuitively interpreted as assigning to variable v the value t, or, respectively, any value. More complex actions are built by using the operators of Propositional Dynamic Logic (PDL). Most importantly, by using finite abstractions we prove that the model checking problem for a significant class of data-aware systems is decidable. We illustrate the importance of the technical result through an application to the verification of English auctions. Related work. Dynamic logic is one of the success stories of formal methods applied to computer science. However, its first-order extensions are comparatively less studied than its standard propositional version. The language we consider appears in [START_REF] Harel | [END_REF] with some key differences. First, we do not include function symbols and the only re-lation symbols are the identity '=' and less or equal than '≤'. More importantly, we interpret this language on structures with a finite active domain. We will show that this key difference, motivated by the literature on databases, allows us to obtain a decidable verification problem.

As regards DaS, besides the contributions discussed above, a further line of research works within the situation calculus [START_REF] De | [END_REF][START_REF] De | [END_REF][START_REF] De | [END_REF]. By assuming that the underlying theories are bounded, the model checking problem is proved decidable. Here we do not need to assume boundedness as a separate hypothesis. More closely related to the present contribution, [START_REF][END_REF] shows that GOLOG programs in the situation calculus are naturally bounded, and therefore their verification is decidable [Calvanese et al., 2016a]. Differently from these works (including [START_REF] Bagheri | [END_REF][START_REF] Bagheri | [END_REF][START_REF] Belardinelli | [END_REF]2014]) here we consider a rich first-order dynamic modal language where actions are explicit.

Data-aware Systems and Dynamic Logic

In this section we introduce formally DaS as well as all notions to be used in the rest of the paper. Hereafter we assume:

1. a finite, non-empty set V of individual variables v 1 , . . . , v n ; 2. a finite, possibly empty set C of individual constants c 1 , . . . , c m ; 3. a possibly infinite set U ⊇ C of individuals u 1 , u 2 , . . .
for the interpretation of variables, together with a total order ≤ defined on U .

Definition 1 (DaS) A Data-aware System is a tuple M = V, C, U , where V , C, and U are defined as above.

Intuitively, given a program written in some programming language (e.g., Fortran, Java, C), a DaS M is the collection of all variables and constants appearing in the program, together with the range of values for the variables. Notice that, while most programming languages are typed, here we consider an untyped formalism. We do so to keep the presentation more easily accessible to the general audience. The present formalism can be extended quite seamlessly to typed languages, even though the exercise is time-and spaceconsuming. Hereafter we distinguish between general dataaware systems and DaS in the technical sense of Def. 1.

Given a DaS M, a state s : V → U is an interpretation of the variables in V . States can be thought of as a representation of the registers of the program associated with M at a given time. Given a state s, its active domain adom(s

) = {u ∈ U | u = s(v) for some v ∈ V } ∪ C ⊆ U is the co-domain of s (the set
of all values for the variables in V at s), together with constant values. This (standard) notion of active domain is taken from the literature on database systems [Abiteboul et al., 1995]. Observe that adom(s) is finite as V and C are.

Finally, since the domain U of interpretation is possibly infinite, we have an infinite number of states in general, and therefore DaS are infinite-state systems.

Syntax. In order to write formulas that describe the dynamics of DaS, we consider an infinite set P of parameters

x 1 , x 2 , . . .. Then, a term t ∈ T is any element in V ∪ C ∪ P , that is, t can be either a variable, or a constant, or a parameter. We introduce assignments v := t and v :=? as atomic actions, as well as atomic formulas t = t ′ and t ≤ t ′ , for v ∈ V and t, t ′ ∈ T . Definition 2 (FO-DL) Formulas φ and actions α in Firstorder Dynamic Logic are defined by mutual recursion as follows:

φ ::= t = t | t ≤ t | ¬φ | φ → φ | [α]φ | ∀xφ α ::= v := t | v :=? | α; α | α ∪ α | α * | φ?
where v ∈ V is a variable, t ∈ T is a term, and x ∈ P is a parameter.

Definition 2 is inspired by the language for first-order dynamic logic appearing in [START_REF] Harel | [END_REF]. Atomic actions are assignments v := t, that assign the value of term t to variable v, and "wildcard" assignments v :=?, that assign to v some arbitrary value from domain U . Complex actions are obtained by composition ;, non-deterministic choice ∪, iteration * , and test ?.

Differently from [START_REF] Harel | [END_REF], we here restrict the first-order component: FO-DL contains no function symbol and only two relation symbols, the identity '=' and less or equal than '≤'. Indeed, first-order dynamic logic with two function symbols (and identity) has the same expressive power as elementary arithmetic [Harel et al., 2000, Proposition 12.1], and therefore it is undecidable. Notwithstanding these restrictions, we will see that our FO-DL is expressive enough for many cases of interest; notably, we will see in in Section 2.1 that we can express auctions.

As a note on syntax, observe that parameters x ∈ P are used to write formulas and are infinite in number, while variables v ∈ V are really constituents of the Data-aware System and are finitely many. The two must be kept distinct. Hereafter, propositional connectives are introduced as standard and formula α φ is shorthand for [α]φ.

Given a term t ∈ T , we introduce the function P (t) that returns set {t} if t = x ∈ P is a parameter, and the empty set otherwise. Then, given a formula φ and an action α in FO-DL, we define sets fr(φ) and fr(α) of free parameters, and P (φ) and P (α) of all parameters as follows:

fr(t ⋆ t ′ ) = P (t ⋆ t ′ ) = P (t) ∪ P (t ′ ) fr(¬ψ) = fr(ψ) and P (¬ψ) = P (ψ) fr(ψ → ψ ′ ) = fr(ψ) ∪ fr(ψ ′ ) and P (ψ → ψ ′ ) = P (ψ) ∪ P (ψ ′ ) fr([α]ψ) = fr(α) ∪ fr(ψ) and P ([α]ψ) = P (α) ∪ P (ψ) fr(∀xψ) = fr(ψ) \ {x} and P (∀xψ) = P (ψ) fr(v := t) = P (v := t) = P (t) fr(v :=?) = P (v :=?) = ∅ fr(α♯α ′ ) = fr(α) ∪ fr(α ′ ) and P (α♯α ′ ) = P (α) ∪ P (α ′ ) fr(α * ) = fr(α) and P (α * ) = P (α) fr(ψ?) = fr(ψ) and P (ψ?) = P (ψ)
for ⋆ ∈ {=, ≤} and ♯ ∈ {; , ∪}.

Observe that the definitions of fr and P differ only as to the clause for quantified formulas. Also, wildcard assignments v :=? mention parameters implicitly. This remark motivates the following definition of #P (φ) ∈ N:

#P (t ⋆ t ′ ) = |P (t) ∪ P (t ′ )| = |P (t ⋆ t ′ )| #P (¬ψ) = #P (ψ) #P (ψ → ψ ′ ) = #P (ψ) + #P (ψ ′ ) -|P (ψ) ∩ P (ψ ′ )| #P ([α]ψ) = #P (α) + #P (ψ) -|P (ψ) ∩ P (ψ ′ )| #P (∀xψ) = #P (ψ) #P (v := t) = |P (t)| = |P (v := t)| #P (v :=?) = 1 #P (α♯α ′ ) = #P (α) + #P (α ′ ) -|P (α) ∩ P (α ′ )| #P (α * ) = #P (α) #P (ψ?) = #P (ψ)
Because of the base case #P (v :=?) = 1 we have that |P (φ)| ≤ #P (φ) and |P (α)| ≤ #P (α). In particular, differently from P , #P keeps track of the occurrences of wildcard assignments as well. We use this fact in the construction of finite abstractions in Section 3. Notice that symbol P has been overloaded as it is used to denote functions on terms, formulas, and program expressions.

We now illustrate the expressive power of FO-DL by means of some toy examples.

Example 1 We consider a simple program that takes as input two integers, assign these as values to variables a and b, and then swaps their values by using a temporary variable tmp. Such a program can be specified in pseudo-code as follows: (1)

Intuitively, formula (1) corresponds to the specification above. In particular, parameters x and y are used to compare the values of variables a and b before and after the swap, that is, parameters are meant to store the value of variables throughout the computation.

As a further example, we consider an action α in FO-DL whose intended meaning is to compute the maximum among variables in V = {a 0 , . . . , a n }:

α = max := a 0 ; if max < a 1 then max := a 1 ; . . . if max < a n then max := a n ;
where < is defined in the standard way (viz. u < u ′ iff u ≤ u ′ and u = u ′ ) and if φ then α is defined as usual in dynamic logic as (φ?; α) ∪ ¬φ?.

Then, we might want to check that action α actually returns the maximum. To this end, consider formula (2) in FO-DL that intuitively specifies that α is correct, as it actually computes the maximum, no matter what values for a 0 , . . . , a n are provided as input:

[a 0 :=?; . . . ; a n :=?]∀x[α](x ≤ max) (2)
As a result, FO-DL can be used as a specification language to express correct termination of programs involving variables for individuals, among other properties.

Semantics. To assign a meaning to the formulas and actions in FO-DL, we introduce interpretations σ : P → U of parameters into the domain U . In a state s, interpretations can be extended to any term t ∈ T as follows: for

t = v ∈ V , (s • σ)(t) = s(v); for t = c ∈ C, (s • σ)(t) = c; while for t = x ∈ P , (s • σ)(t) = σ(x)
. Hence, variables are interpreted according to s, parameters according to σ, while we adopt a Herbrandian interpretation of constants: they are interpreted as themselves. Given u ∈ U , σ x u is the interpretation that assigns u to x ∈ P and coincides with σ on all other parameters.

Given a state s, we define the meaning of formula φ according to interpretation σ. Definition 3 (Satisfaction) The satisfaction relation |= for DaS M, state s, interpretation σ, and formula φ is given as:

(M, s, σ) |= t = t ′ iff (s • σ)(t) = (s • σ)(t ′ ) (M, s, σ) |= t ≤ t ′ iff (s • σ)(t) ≤ (s • σ)(t ′ ) (M, s, σ) |= ¬φ iff (M, s, σ) |= φ (M, s, σ) |= φ → φ ′ iff (M, s, σ) |= φ or (M, s, σ) |= φ ′ (M, s, σ) |= [α]φ iff for all s ′ , Rα(s, s ′ ) implies (M, s ′ , σ) |= φ (M, s, σ) |= ∀xφ iff for all u ∈ adom(s), (M, s, σ x u ) |= φ
where the relation R α is defined by mutual recursion as

R v:=t (s, s ′ ) iff s ′ (v) = (s • σ)(t) and for every v ′ = v, s ′ (v ′ ) = s(v ′ ) R v:=? (s, s ′ ) iff s ′ (v) ∈ U and for every v ′ = v, s ′ (v ′ ) = s(v ′ ) R α;β (s, s ′ ) iff for some s ′′ , R α (s, s ′′ ) and R β (s ′′ , s ′ ) R α∪β (s, s ′ ) iff either R α (s, s ′ ) or R β (s, s ′ ) R α * (s, s ′ ) iff R * α (s, s ′ ), where R * α is the reflexive and transitive closure of R α R φ? (s, s ′ )
iff (M, s, σ) |= φ and s ′ = s We remark that the interpretation of actions is as standard in first-order dynamic logic. In particular, atomic assignments v := t and v :=? update variable v with the value of term t, or, respectively, of any value in U .

As regards formulas, differently from [START_REF] Harel | [END_REF], quantification is restricted to the active domain adom(s) in a given state s. This is a typical assumption in the theory of databases [Abiteboul et al., 1995], which we will show to be sufficient for our expressivity purposes, as it is the case in formulas (1) and (2).

We say that formula φ is true at state s of DaS M, or (M, s) |= φ, iff for every interpretation σ, (M, s, σ) |= φ; while φ is true in M, or M |= φ, iff for all s ∈ M, (M, s) |= φ. As an example, the formula

[a :=?][b :=?](a < b → c :=? (a < c ∧ c < b))
is true for every dense linear order <, in particular for the structure Q, ≤ of the rational numbers seen as a DaS M = {a, b, c}, ∅, Q . On the other hand, the formula

[a :=?][b :=?](a < b → ∃x(a < x ∧ x < b))
is not true in general on dense orders, as parameter x ranges over the finite set adom(s) = {s(a), s(b), s(c)} of active el-ements. As a consequence, wildcard assignments and firstorder quantification express different notions in our semantics for FO-DL.

To investigate their relationship further, notice that if formula φ does not exhaust the finite set V of variables, then standard universal quantification, ranging on U rather than adom(s), is captured by formula [v :=?]∀x(x = v → φ), with the proviso that variable v does not occur in φ. However, since set V is finite, the translation scheme above is not applicable in general. In particular, first-order quantification is always restricted to the active domain.

In Example 1 we informally discussed the verification of programs against specifications (1) and (2). More precisely, we now state the model checking problem for this setting.

Definition 4 (Model Checking Problem) Given a DaS M and formula φ in FO-DL, determine whether M |= φ.

Since M is an infinite-state system in general, Def. 4 assumes some finitary representation of M, in particular of the interpretation domain U . This can be achieved in standard ways [START_REF] Bagheri | [END_REF][START_REF] Belardinelli | [END_REF].

Then, verifying the correctness of the swap and max programs in Example 1 when the variables are assigned real values is tantamount to model checking formulas ( 1) and ( 2) on all states interpreting the variables on the reals R. Notice that in this case M has infinitely many states: it is therefore not obvious whether the model checking problem is decidable.

Example: Auctions

In this section we model a toy example of an English (ascending bid) auction as a DaS. We assume familiarity with English auctions, in which a number of bidders bid for one or more items put on offer by an auctioneer. Bidders are assumed to be rational, in particular they have a true value up to which they are ready to bid. The auctioneer keeps track of the bids and, at the end of the bidding phase, she assigns the item to the bidder with the highest offer. We refer to [START_REF] Easley | [END_REF] for a detailed presentation of English auctions.

To represent the scenario above as a DaS with n bidders, we assume that the set V contains variables bid i and t value i for every bidder i ≤ n, respectively representing the current bid and the true value of bidder i; moreover, we suppose that V contains a variable high for the highest offer so far. All these variables range over the rationals Q. Also, we consider a variable time out to terminate the bidding phase, taking values 0 and 1. We then model an English auction for n bidders as a DaS M = V, {0, 1}, Q .

Then, we can specify the bidding cycle by means of the following action α: time out := 0; while (time out = 0) do { i≤n (bid i :=?;

if (bid i ≤ t value i ) ∧ (high < bid i ) then high := bid i ) ∪ time out := 1 } Action α consists in an initial assignment of false (0) to time out, and then a while ψ do β loop (expressible in dynamic logic as (ψ?; β) * ; ¬ψ?), whose exit condition is that the bidding process has timed out (by means of the nondeterministic assignment time out := 1). Within the loop, a bidder is chosen non-deterministically to pass a bid via a wildcard assignment bid i :=?. If the bid is comprised between bidder i's true value and the highest bid so far, then it becomes the new high.

By means of action α we can specify in FO-DL a number of properties of auctions. For instance, we might want to say that throughout the auction, for every bidder, the values of bids are comprised between the highest offer so far and her true value:

i≤n [α]((bid i ≤ t value i ) ∧ (high < bid i )) (3)
Moreover, in FO-DL we can also compare values for the same variable at different points in the bidding process. As an example, we can express that true values do not change during the auction:

i≤n ∀x((x = t value i ) → [α](x = t value i )) (4)
In ( 4) parameter x allows us to compare the value of t value i before and after the execution of α.

Finally, in FO-DL we can specify that the value of the highest bid does not decrease throughout the auction:

∀x((x = high) → [α](x ≤ high)) (5)
Formulas ( 3)-( 5) are simple specifications that nonetheless allow us to make comparisons between the values of variables at different points of the system's execution, which are typically not expressible in propositional languages. However, to verify properties such as (3)-( 5), we cannot rely on standard model checking techniques because we are working with data-aware systems, for which the model checking problem is known to be undecidable in general [Deutsch et al., 2009]. In the next section we will develop a verification method adapted to the present framework and language.

Decidability via Finite Abstractions

In this section we introduce an abstraction-based technique to prove that the model checking problem in Def. 4 is indeed decidable. Then, we apply this result to the particular scenario of English auctions of Section 2.1. In the rest of the section we assume a (possibly finite) abstract domain U A ⊇ C. Definition 5 (Abstract State) Given a (possibly finite) abstract domain U A ⊇ C, an abstract state is a function s : V → U A together with a total order ≤ s defined on U A that extends the restriction ≤ | C of ≤ on C.

Notice that, differently from the standard states in Section 2, the total order ≤ s depends on the particular abstract state s. In particular, for different s and s ′ , ≤ s may be different from ≤ s ′ . Nonetheless, each ≤ s is an extension of restriction ≤ | C , that is, the order ≤ on C is preserved. Hence, for every c, c ′ ∈ C, c ≤ s c ′ iff c ≤ s ′ c ′ . Total extensions (for a finite U A ) can be found constructively, using topological sorting algorithms [Cormen et al., 1990]. Hereafter, we do not discuss this matter further, and assume that suitable total extensions are always at hand.

Further, given a DaS M = V, C, U and U A ⊇ C, let the abstraction of M be the DaS M A = V, C, U A . Next, we introduce a notion of isomorphism between states and their abstractions. Definition 6 (Isomorphism) A state s ∈ M and an abstract state s ′ ∈ M A are isomorphic, or s ≃ s ′ , iff for some bijection ι : adom(s) → adom(s

′ ) ∪ C, (i) s ′ = ι • s; (ii) ι is the identity on C; (iii) ι preserves ≤, that is, for every u, u ′ ∈ adom(s), u ≤ u ′ iff ι(u) ≤ s ′ ι(u ′ ).
Any bijection ι as above is a witness for s ≃ s ′ , or s ι ≃ s ′ for short.

Intuitively, isomorphic states share the same relational structure. Observe that, as regards order ≤ s ′ , witness ι preserves the interpretation of individuals in the active domain s ′ (V ) only (as well as the constant in C). This feature of isomorphisms is key to obtain finite abstractions. Now we show that isomorphic states satisfy the same firstorder formulas φ as defined by the following BNF:

φ ::= t = t ′ | t ≤ t ′ | ¬φ | φ → φ | ∀xφ
However, φ might contain free parameters interpreted outside the active domain. This remark motivates the following definition. Definition 7 (Equivalent Interpretations) Given a state s ∈ M, an isomorphic abstract state s ′ ∈ M A , and a formula φ, the interpretations σ : P → U and σ ′ : P → U A are equivalent for φ w.r.t. s and s ′ iff for some bijection θ : adom(s) ∪ σ(fr(φ)) → adom(s ′ ) ∪ σ ′ (fr(φ)),

(i) the restriction θ| adom(s) is a witness for s ≃ s ′ ; (ii) σ ′ = θ • σ; (iii) for every u, u ′ ∈ adom(s) ∪ σ(fr(φ)), u ≤ u ′ iff θ(u) ≤ s ′ θ(u ′ ).
Again, as regards ≤ s ′ , a witness θ preserves only the order of individuals in s ′ (V ) ∪ C ∪ σ ′ (fr(φ)), which is a finite set. As customary in first-order logic, we can prove that equivalent interpretations on isomorphic states preserve first-order formulas [Abiteboul et al., 1995]. We report this result for our particular setting. Lemma 1 Given a state s ∈ M, an isomorphic abstract state s ′ ∈ M A , and an FO-formula φ, if interpretations σ and σ ′ are equivalent for φ w.r.t. s and s ′ , then

(M, s, σ) |= φ iff (M A , s ′ , σ ′ ) |= φ.
We now prove that Lemma 1 can be lifted to the full language FO-DL. To do so, we need one more assumption. Given total order ≤, the corresponding strict linear order < is dense with no endpoints iff (i) for every u, u ′ ∈ U , u < u ′ implies that for some u ′′ ∈ U , u < u ′′ and u ′′ < u ′ ; and (ii) for every u ∈ U ′ , u < u ′ and u ′′ < u for some u ′ , u ′′ ∈ U . It is well-known that every non-empty countable dense linear order without endpoints is order-isomorphic to Q [Roitman, 1990, Theorem 27]. Hence, hereafter we assume U = Q as interpretation domain.

We can now prove the main preservation result of this paper. Hereafter we write R α

(s) = {s ′ | R α (s, s ′ )}.
Theorem 2 Let M = V, C, Q be a DaS with abstraction M A = V, C, U A . Then, consider a state s ∈ M, an isomorphic abstract state s ′ ∈ M A , and an FO-DL formula φ.

If |U A | ≥ |V | + |C| + #P (φ)
, then for all interpretations σ and σ ′ equivalent for φ w.r.t. s and s ′ , 1. if φ is of the form [α]ψ, then (a) for every state w ∈ R α (s), there exists an abstract state w ′ ∈ R ′ α (s ′ ), isomorphic to w, such that σ and σ ′ are equivalent for ψ w.r.t. w and w ′ ; (b) for every abstract w ′ ∈ R ′ α (s ′ ), there exists a state w ∈ R α (s), isomorphic to w ′ , such that σ and σ ′ are equivalent for ψ w.r.t. w and w ′ .

2. Further, (M, s, σ) |= φ iff (M A , s ′ , σ ′ ) |= φ.
Sketch of Proof. We prove both item 1 and 2 by mutual induction on the structure of φ. We start by proving item 1, specifically by induction on the structure of α. As for the base case, let α ≡ v := t and consider interpretations σ and σ ′ equivalent for φ w.r.t. s and s ′ . If R α (s, w) then w(v) = (s • σ)(t), while the interpretation of the other variables remains the same. Then consider abstract state w ′ such that w ′ (v) = (s ′ • σ ′ )(t) and w ′ coincides with s ′ on all other variables. Clearly w and w ′ are isomorphic, as s and s ′ are and σ and σ ′ are equivalent. In particular, w ′ can be chosen so that the total order ≤ w ′ preserves order ≤ on w ′ (V ) ∪ C ∪ σ(fr(ψ)): if t is either a variable or a constant, then the result follows by condition (iii) in Def. 6; if t is a parameter, then it follows by (iii) in Def. 7. Finally, R ′ α (s ′ , w ′ ) and by construction σ and σ ′ are equivalent for ψ w.r.t. w and w ′ .

Let α ≡ v :=? and again consider interpretations σ and σ ′ equivalent for φ w.r.t. s and s ′ . Let θ be a witness for s ≃ s ′ . If R α (s, w) then w(v) ∈ U . Since |U A | ≥ |V | + |C| + #P (φ), we can find a 'fresh' element u ′ ∈ U A \ (s ′ (V \ {v}) ∪ C ∪ σ ′ (fr(φ))) and set w ′ (v) = u ′ , while w ′ coincides with s ′ on all other variables. Then define θ ′ as θ but θ ′ (w(v)) = u ′ . Clearly, θ ′ is a witness for w ≃ w ′ and σ ′ = θ ′ • σ. Moreover, the total order ≤ w ′ can be completed so that item (iii) in Def. 7 is satisfied. Thus, R ′ α (s ′ , w ′ ) and σ and σ ′ are equivalent for ψ w.r.t. w and w ′ .

The inductive steps for α ≡ β ′ ; β ′′ and α ≡ β ′ ∪ β ′′ are immediate. The case for α ≡ β * can be proved by induction on the length of the path connecting states s and w such that R * β (s, w), by using the induction hypothesis. Finally, let α ≡ χ?. Then, R α (s, w) implies that (M, s, σ) |= χ and w = s. Since σ and σ ′ are equivalent for φ w.r.t. s and s ′ , and

|U A | ≥ |V | + |C| + #P (φ) ≥ |V | + |C| + #P (χ),
we have in particular that σ and σ ′ are equivalent for χ (w.r.t. s and s ′ ). By item 2 and the induction hypothesis we obtain that (M, s, σ) |= χ iff (M A , s ′ , σ ′ ) |= χ, that is, R ′ α (s ′ , w ′ ) for w ′ = s ′ . The proof of item 1.(b) is similar, we only notice that in the base case for α ≡ v :=? we use the fact that the linear order < on Q is dense and without endpoints, to find u ∈ Q that simulates w ′ (v) ∈ U A . We now move to prove item 2.

The base case for first-order formulas follows by Lemma 1; the inductive cases for propositional connectives are immediate. In particular, notice that, since Hence, the induction hypothesis holds and it follows that (M A , s ′ , σ ′x θ(u) ) |= φ. As u is arbitrary and θ is a bijection between adom(s) and adom(s ′ ), we obtain (M A , s ′ , σ ′ ) |= φ.

Suppose that φ ≡ [α]ψ. As regards the ⇐ direction, (M, s, σ) |= φ iff for some w ∈ R α (s), (M, w, σ) |= ψ. By item 1.a there exists w ′ ∈ R ′ α (s ′ ) such that w ′ is isomorphic to w, and σ and σ ′ are equivalent for ψ w.r.t. w and w ′ . Since

|U A | ≥ |V | + |C| + #P (φ) ≥ |V | + |C| + #P (ψ), by induc- tion hypothesis (M A , w ′ , σ ′ ) |= ψ, that is, (M A , s ′ , σ ′ ) |= φ.
The ⇒ direction is proved similarly, by using item 1.b.

By Theorem 2 a state s and its abstraction s ′ satisfy the same formulas in FO-DL, whenever the abstract domain U A contains enough elements to mimick transitions from s. Most importantly, U A can be assumed to be finite. However, the linear order < on Q has to be dense, with no endpoints.

Furthermore, we say that DaS M and abstraction M A are bisimilar iff (i) for every s ∈ M, there is an isomorphic s ′ ∈ M A , and (ii) for every s ′ ∈ M A , there is an isomorphic s ∈ M. As a consequence of Theorem 2 we obtain the following result.

Corollary 3 Let M = V, C, Q be a DaS with bisimilar abstraction M A = V, C, U A . For every FO-DL formula φ, if |U A | ≥ |V | + |C| + #P (φ) then M |= φ iff M A |= φ.
In particular, whenever U A is finite, the number of states in M A is finite as well. Therefore, by Corollary 3 we can verify an FO-DL formula φ on the infinite-state DaS M by model checking the finite abstraction M A (e.g. by translating to propositional DL).

Discussion. We briefly discuss the application of our results to the auction DaS M for n bidders in Section 2.1. Observe that for M = V, {1, 2}, Q , we have V = i≤n {bid i , t value i } ∪ {high, time out}, and therefore |V | = 2(n+1), |C| = 2. Further, for formula (3), we have #P (3) = n 2 . Hence, in order to verify (3) it is sufficient to consider an abstract domain U A of finite cardinality |U A | ≥ |V |+|C|+#P (3) = n(n+2)+4. Then, formula (3) can be verified on such abstraction M A , and finally the result can be transfered to M in virtue of Corollary 3.

Furthermore, Corollary 3 gives us some useful insight on a problem related to model checking. Given a class C of DaS and an FO-DL formula φ, the satisfiability problem consists in determining whether φ is satisfied in C, that is, true in some DaS belonging to C. We remarked earlier that every non-empty countable dense linear order without endpoints is order-isomorphic to Q. As a consequence, the satisfiability problem for the class of non-empty countable dense linear orders without endpoints can be reduced to the model checking problem for the rationals Q. In particular, we obtain the following result.

Corollary 4

The satisfiability problem of FO-DL formulas for the class of DaS whose interpretation domain U is a nonempty countable dense linear order without endpoints is decidable.

In future work we plan to extend these results to other classes of DaS and to determine the exact complexity of the model checking and satisfiability problems.

Conclusions

In this paper we introduced a formal framework for Dataaware Systems inspired by (first-order) dynamic logic. The data content of a DaS is modelled by a finite set of variables (and constants) that can range over a possibly infinite interpretation domain. As a result, DaS are infinite-state systems in general (Section 2). We showed that DaS are rich enough to express elaborate multi-agent scenarios, including auction-based mechanisms (Section 2.1), and then we considered the verification problem w.r.t. the first-order extension FO-DL of dynamic logic. The main theoretical result of the paper consists in showing that, under specific conditions, the model checking problem for DaS w.r.t. FO-DL is decidable. The decidability result is obtained by defining finite, bisimilar abstractions that preserve the interpretation of FO-DL (Section 3). Hence, to verify an FO-DL formula φ in a concrete, infinite-state DaS M, we build the finite abstraction M A , then model check φ on M A , and finally transfer the verification result to M by virtue of Corollary 3.

We envisage a number of extensions for the present contribution. Propositional Dynamic Logic is one of the success stories of formal methods applied to computer science, with a steady stream of fundamental contributions [Harel, 1984;[START_REF] Harel | [END_REF]. On the other hand, its first-order extensions are much less investigated. In particular, the well-known undecidability results in first-order logic have spawned a wealth of contributions in mathematical logic and theoretical computer science [START_REF] Börger | [END_REF]. For firstorder dynamic logic the situation is even more complex, as many well-known results that hold for first-order logic, fail for its dynamic counterpart, e.g., Löwenheim-Skolem theorem, completeness, compactness. However, in first-order dynamic logic there has not been a comparable push aimed at singling out decidable and tractable fragments. In future work we plan to individuate further classes of DaS and fragments of FO-DL that have a decidable model checking and satisfiability problems, and study their exact complexity. We deem results along this line valuable to improve the understanding of (first-order) dynamic logics, data-aware systems, and auction-based mechanisms.

  Even for such a simple program we might want to check that the new values for variables a and b are equal to the old values for b and a respectively, and this is indeed the case for every possible value of a and b. To do so, consider the following formula in FO-DL: [a :=?; b :=?]∀x, y((a = x ∧ b = y) → [tmp := a; a := b; b := tmp] (a = y ∧ b = x))

  |U A | ≥ |V | + |C| + #P (¬ψ) = |V | + |C| + #P (ψ) and |U A | ≥ |V | + |C| + #P (ψ 1 ∧ ψ 2 ) ≥ |V | + |C| + #P (φ i ), for i = 1, 2, the induction hypothesis holds. For φ ≡ ∀xψ, (M, s, σ) |= ψ iff for all u ∈ adom(s), (M, s, σ x u ) |= φ. If θ is a witness to the fact that σ and σ ′ are equivalent for φ w.r.t. s and s ′ , then interpretations σ x u and σ ′x θ(u) are equivalent for ψ (also w.r.t. s and s ′ ). Moreover, |U A | ≥ |V | + |C| + #P (φ) = |V | + |C| + #P (ψ).

Acknowledgments

F. Belardinelli acknowledges the support of the ANR JCJC Project SVeDaS (ANR-16-CE40-0021).