1. Introduction
1.1. Context
A wellstructured transition system (WSTS) is an infinite wellquasiordered set of states equipped with transition relations satisfying one of various possible monotonicity properties. WSTS were introduced in [Fin87] for the purpose of capturing properties common to a wide range of formal models used in verification. Since their inception, much of the work on WSTS has been dedicated to identifying generic classes of WSTS for which verification problems are decidable. Such problems include termination, boundedness [Fin87, Fin90, FPS01] and coverability [ACJT96, ACJT00, BFM17, BFM18]. In general, verifying safety and liveness properties corresponds respectively to deciding the coverability and the repeated controlstate reachability problems. Coverability can be decided for WSTS by two different algorithms: the backward algorithm [ACJT96, ACJT00] and by combining two forward semiprocedures, one of which enumerates all downwardsclosed invariants [GRB06, BFM17, BFM18]. Repeated controlstate reachability is undecidable for general WSTS, but decidable for Petri nets by use of the KarpMiller coverability tree [KM67] and the detection of increasing sequences. That technique fails on wellstructured extensions of Petri nets: generating the KarpMiller tree does not always terminate on Petri nets [RMdF11], on reset Petri nets [DFS98], on transfer Petri nets, on broadcast protocols, and on the depthbounded calculus [HMM14, RM12, ZWH12] which can simulate reset Petri nets. This is perhaps why little research has been conducted on coverability tree algorithms and model checking of liveness properties for general WSTS. Nonetheless, some recent Petri nets extensions, Petri nets [GHPR15] and unordered data Petri nets [HLL16], benefit from algorithms in the style of Karp and Miller. Hence, there is hope of finding a general framework of WSTS with KarpMillerlike algorithms.
1.2. The KarpMiller coverability procedure
In 1967, Karp and Miller [KM67] proposed what is now known as the KarpMiller coverability tree algorithm, which computes a finite representation (the clover) of the downward closure (the cover) of the reachability set of a Petri net. In 1978, Valk extended the KarpMiller algorithm to postselfmodifiying nets [Val78], a strict extension of Petri nets. In 1987, the second author proposed a generalization of the KarpMiller algorithm that applies to a class of finitely branching WSTS with strongstrict monotonicity, and having a WSTS completion in which least upper bounds replace the original Petri nets accelerations [Fin87, Fin90]. In 2004, Finkel, McKenzie and Picaronny [FMP04] applied the framework of [Fin90] to the construction of KarpMiller trees for strongly increasing recursive nets, a class generalizing postselfmodifiying nets. In 2005, Verma and the third author [VG05]
showed that the construction of KarpMiller trees can be extended to branching vector addition systems with states. In 2009, the second and the third authors
[FG12] proposed a nonterminating procedure that computes the clover of any complete WSTS; this procedure terminates exactly on socalled coverflattable systems. Recently, this framework has been used for defining computable accelerations in nonterminating KarpMiller algorithms for both the depthbounded calculus [HMM14] and for Petri nets; terminating KarpMiller trees are obtained for strict subclasses.1.3. Model checking WSTS
In 1994, Esparza [Esp94] showed that model checking the linear time calculus is decidable for Petri nets by using both the KarpMiller algorithm and a decidability result due to Valk and Jantzen [VJ85] on infinite continual sequences in Petri nets. LTL is undecidable for Petri net extensions such as lossy channel systems [AJ94] and lossy counter machines [Sch10]. In 1998, Emerson and Namjoshi [EN98] studied the model checking of liveness properties for complete WSTS, but their procedure is not guaranteed to terminate. In 2004, Kouzmin, Shilov and Sokolov [KSS04] gave a generic computability result for a fragment of the calculus; in 2006 and 2013, Bertrand and Schnoebelen [BBS06, BS13] studied fixed points in wellstructured regular model checking; both [KSS04] and [BS13] are concerned with formulas with upwardsclosed atomic propositions, and do not subsume LTL. In 2011, Chambart, Finkel and Schmitz [CFS11, CFS16] showed that LTL is decidable for the recursive class of tracebounded complete WSTS; a class which does not contain all Petri nets.
1.4. Our contributions

We define verywellstructured transition systems (veryWSTS); a class defined in terms of WSTS completions, and which encompasses models such as Petri nets, Petri nets, postselfmodifying nets and strongly increasing recursive nets. We show that coverability sets of veryWSTS are computable as finite sets of ideals.

The general clover algorithm of [FG12], based on the ideal completion studied in [FG09], does not necessarily terminate and uses an abstract acceleration enumeration. We give an algorithm, the Ideal KarpMiller algorithm, which organizes accelerations within a tree. We show that this algorithm terminates under natural ordertheoretic and effectiveness conditions, which we make explicit. This allows us to unify various versions of KarpMiller algorithms in particular classes of WSTS.

We identify the crucial notion of acceleration level of an ideal, and relate it to ordinal ranks of sets of reachable states in the completion. We show, notably, that termination is equivalent to the rank being strictly smaller than
. This classifies WSTS into those with high rank (the bad ones), among which those whose sets of states consist of words (, lossy channel systems) or multisets; and those with low rank (the good ones), among which Petri nets and postselfmodifying nets.

We show that the downward closure of the trace language of a veryWSTS is computable, again as a finite union of ideals. This shows that downward traces inclusion is decidable for veryWSTS.

Finally, we prove the decidability of model checking liveness properties for veryWSTS under some effectiveness hypotheses.
1.5. Differences between veryWSTS and WSTS of [Fin90]
The class of WSTS of [Fin90, Def. 4.17] is reminiscent of veryWSTS. It requires WSTS to be finitely branching and strictly monotone, whereas our definition allows infinite branching and requires the completion to be strictly monotone. Moreover, [Fin90, Thm. 4.18], which claims that its KarpMiller procedure terminates, is incorrect since it does not terminate on transfer Petri nets and broadcast protocols [EFM99], which are finitely branching and strictly monotone WSTS. Finally, some assumptions required to make the KarpMiller procedure of [Fin90] effective are missing.
2. Preliminaries
We write for set inclusion and for strict set inclusion. A relation over a set is a quasiordering if it is reflexive and transitive, and a partial ordering if it is antisymmetric as well. It is wellfounded if it has no infinite descending chain. A quasiordering is a wellquasiordering (resp. well partial order), wqo (resp. wpo) for short, if for every infinite sequence , there exist such that . This is strictly stronger than being wellfounded.
One example of wellquasiordering is the componentwise ordering of tuples over . More formally, is wellquasiordered by where, for every , if and only if for every . We extend to where for every . ordered componentwise is also wellquasiordered. Let be a finite alphabet. We denote the set of finite words and infinite words over respectively by and . For every , we write if is a subword of , can be obtained from by removing zero, one or multiple letters. is wellquasiordered by .
2.1. Transition systems
A (labeled and ordered) transition system is a triple such that is a set, is a finite alphabet, for every , and is a quasiordering on . Elements of are called the states of , each is a transition relation of , and is the ordering of . A class of transition systems is any set of transition systems. We extend transition relations to sequences over , for every , , and if there exists such that . We write (resp. ) if there exists (resp. ) such that . The finite and infinite traces of a transition system from a state are respectively defined as
We define the immediate successors and immediate predecessors of a state under some sequence as
The successors and predecessors of are
These notations are naturally extended to sets, .
We say that is deterministic if for every and . When is deterministic, each induces a partial function such that for each such that . For readability, we simply write for , . For every , we write for if .
2.2. Wellstructured transition systems
A (labeled and ordered) transition system is a wellstructured transition system (WSTS) if is a wellquasiordering and is monotone, for all and such that and , there exists such that and . Many other types of monotonicities were defined in the literature (see e.g. [FPS01]), but, for our purposes, we only need to introduce strong monotonicities. We say that has strong monotonicity if for all and , and implies for some . We say that has strongstrict monotonicity^{1}^{1}1Strongstrict monotonicity should not be confused with strong and strict monotonicities. Here strongness and strictness have to hold at the same time. if it has strong monotonicity and for all and , and implies for some .
2.3. Verification problems
We say that a target state is coverable from an initial state if there exists such that . The coverability problem asks whether a target state is coverable from an initial state . The repeated coverability problem asks whether a target state is coverable infinitely often from an initial state ; whether there exist such that and for every .
3. An investigation of the KarpMiller algorithm
In order to present our KarpMiller algorithm for WSTS, we first highlight the key components of the KarpMiller algorithm for vector addition systems. A dimensional vector addition system (VAS) is a WSTS induced by a finite set and the rules:
Vector addition systems are deterministic and have strongstrict monotonicity. Given a VAS and a vector , the KarpMiller algorithm initializes a rooted tree whose root is labeled by . For every such that , a child labeled by is added to the root. This process is repeated successively to the new nodes. If a newly added node has an ancestor such , then it is not explored furthermore. If a newly added node has an ancestor such , then is relabeled by the vector such that if and if . The latter operation is called an acceleration of .
A vector is coverable from if and only if the resulting tree contains a node such that . Similarly, is repeatedly coverable from if and only if contains a node that has an ancestor that was accelerated, and such that .
3.1. Ideals and completions
One feature of the KarpMiller algorithm is that it works over instead of . Intuitively, vectors containing some correspond to “limit” elements. For a generic WSTS , a similar extension of is not obvious. Let us present one, called the completion of in [FG12]. Instead of operating over , the completion of operates over the socalled ideals of . In particular, the ideals of are isomorphic to .
Let be a set quasiordered by . The downward closure of is defined as
A subset is downwardsclosed if . An ideal is a downwardsclosed subset that is additionally directed: is nonempty and for all , there exists such that and (equivalently, every finite subset of has an upper bound in ). We denote the set of ideals of by , .
It is known that
Therefore, every ideal of is naturally represented by some vector of , and vice versa. We write for this representation, for every . For example, the ideal is represented by .
Downwardsclosed subsets can often be represented by finitely many ideals: [[ET43, Bon75, Pou79, PZ85, Fra86, LMP87]] Let be a wellquasiordered set. For every downwardsclosed subset , there exist s.t. .
This theorem gives rise to a canonical decomposition of downwardsclosed sets. The ideal decomposition of a downwardsclosed subset is the set of maximal ideals contained in with respect to inclusion. We denote the ideal decomposition of by . By Theorem 3.1, is finite, and . In [FG12, BFM18], the notion of ideal decomposition is used to define the completion of unlabeled WSTS. We slightly extend this notion to labeled WSTS:
Let be a labeled WSTS. The completion of is the labeled transition system such that
The completion of a WSTS enjoys numerous properties. In particular, it has strong monotonicity, and it is finitely branching [BFM18], is finite for every and . Note that if has strongstrict monotonicity, then this property is not necessarily preserved by [BFM18]. Moreover, the completion of a WSTS may not be a WSTS since is not always wellquasiordered by . However, for the vast majority of models used in formal verification, is wellquasiordered, and hence completions remain wellstructured. Indeed, is wellquasiordered if and only if is a socalled wqo, and widespread wqos, except possibly graphs under minor embedding, are wqo, as discussed in [FG12]. The traces of a WSTS are closely related to those of its completion:
[[BFM18]] The following holds for every WSTS :

For all and , if , then for every ideal , there exists an ideal such that .

For all and , if , then for every , there exist and such that and . If has strong monotonicity, then .

if has strong monotonicity, then for all and .

if has strong monotonicity, then and for every .
Proof.

By induction on . When , the claim is obvious. Otherwise, write as where , , , and let , for some state . Certainly is in , hence in . Write the ideal decomposition of the latter as . For some , , is in , and by definition . By induction hypothesis, for some ideal containing , whence the result.

By induction of again. The case is obvious, too. Otherwise, write as , where , , . There is an ideal such that , and the induction hypothesis gives us elements and , and a word such that and . (Moreover, if has strong monotonicity, then .) By definition of , is included in , so there are elements and with such that . Since is monotonic, there is a further element and a further word such that . (If is strongly monotonic, , so .) This entails that , and if is strongly monotonic, .

Let and let . By (2), there exist and such that and . Thus, . Conversely, let . There exist and such that and . By (1), there exists an ideal such that . Thus, and .


For every , there is a state such that . Use (1) on : we obtain an ideal such that , showing that . Conversely, for every , there is an ideal such that , where . Ideals are nonempty, so pick . By (2), there are states and such that . The fact that is in , namely that , allows us to invoke strong monotonicity and obtain a state such that . In particular, is in .

Let . Let , and let be such that . Let . By (1), there exists an ideal such that . This process can be repeated using (1) to obtain with for every . ∎

It is worth noting that if is infinitely branching, then an infinite trace of from is not necessarily an infinite trace of from (e.g. see [BFM18]).
Whenever the completion of a WSTS is deterministic, we will often write for if the latter is nonempty and if there is no ambiguity with .
3.2. Levels of ideals
The KarpMiller algorithm terminates for the following reasons: is wellquasiordered and ’s can only be added to vectors along a branch at most times. Loosely speaking, the latter property means that has “levels”. Here, we generalize this notion. We say that an infinite sequence of ideals is an acceleration candidate if . An acceleration candidate is below if for every , and it goes through a set if for some .
The level of is defined as
When is clear from the context, we will simply write instead of . For the specific case of , it can be shown that:
Hence, for all :
Therefore, we have which corresponds to the fact that has different levels. In particular, if we identify with , the set of its representations, then is equivalent to for every . More formally:
is the set of tuples with less than components equal to .
Proof.
Using the fact that grows as grows, it suffices to show the claim for . This is shown by induction on . The case is obvious.
Let . If has at least components equal to , we obtain an acceleration candidate by picking an index such that , and forming the tuples for . By induction hypothesis, these tuples have at least components equal to and therefore cannot be in . This entails that cannot be in .
Conversely, assume that has less than components equal to , say at positions (the general case is obtained by applying a permutation of the indices). There are only finitely many tuples that have their first components equal to . Therefore any acceleration candidate below , being infinite, must contain a tuple with at most components equal to . Since , by induction hypothesis it must go through , showing that . ∎
In general, we observe that ideal levels are monotonic and downwardsclosed with respect to ideal inclusion: The following holds for every :

for every , if and , then ,

.
Proof.
Let . If , then both claims follow immediately. Therefore, let us assume that .

Let and let be such that . We must show that . Let be an acceleration candidate below . We have for every . Therefore, is also below . Since , we conclude that goes through , and hence that .

Let . For the sake of contradiction, suppose . By assumption, there exists an acceleration candidate below that does not go through . Note that for every . By (1), this implies that for every . Therefore, we conclude that goes through , which is a contradiction. ∎
We have seen that has only levels, i.e. . We generalize this notion as follows:
has finitely many levels if there exists such that .
In the forthcoming sections, we will be interested in sets of ideals that have finitely many levels. It is however worth mentioning that there are natural sets whose ideals do not have finitely many levels of ideals, even if is assumed to be countable and wellquasiordered. We postpone this discussion to Section 5 where we will study ideal levels in more details and in a more abstract setting.
3.3. Accelerations
The last key aspect of the KarpMiller algorithm is the possibility to accelerate nodes. In order to generalize this notion, let us briefly develop some intuition. Recall that a newly added node is accelerated if it has an ancestor such that . Consider the nonempty sequence labeling the path from to . Since VAS have strongstrict monotonicity, both over and , is defined for every . For example, if is encountered, is replaced by . This represents the fact that for every , there exists some reachable marking . Note that an acceleration increases the number of occurrences of . In our example, the ideal , which is of level , is replaced by , which is of level . Based on these observations, we extend the notion of acceleration to completions:
Let be a WSTS such that is deterministic, let , and let be such that . The acceleration of under is defined as:
In other words, if can be accelerated by repeatedly applying , then its acceleration is the least upper bound of . This least upper bound is also an ideal: Let be a WSTS such that is deterministic. We have for every and such that .
Proof.
If , then the claim trivially holds. Thus, we may assume that is an acceleration candidate. Since is a union of downwardsclosed sets, it is readily seen to be downwardsclosed. Let us show that it is also directed. Let . There exist such that and . Therefore, both and are elements of . Since is an ideal, there exists such that and . ∎
Recall that in the KarpMiller algorithm for vector addition systems, the level of an ideal remains unchanged when applying a transition, and increases when accelerated. This holds because the completion of a vector addition system has strongstrict monotonicity. We introduce a more general (weaker) type of monotonicity that essentially yields the same behaviour.
Let be a WSTS. We define the level of an ideal as follows. If for some , then is the smallest such , and otherwise . We say that the completion of has leveledstrongstrict monotonicity if for every and such that , the following holds:
In other words, leveledstrongstrict monotonicity only requires strongstrict monotonicity to hold between ideals of the same level. Let us remark that completions of Petri nets have strongstrict monotonicity, but Petri nets only have leveledstrongstrict monotonicity.
Let us recall the model of postselfmodifying nets [Val78] for which there is a KarpMiller algorithm. In a postselfmodifying nets, transitions consume tokens as in Petri nets but they may add the result of applying a (different) positive affine function in each place. It has been shown [FMP04] that postselfmodifying nets are WSTS with strongstrict monotonicity on and their completions are still WSTS with strong monotonicity on , but they are not strictly monotone on (contrary to Figure 3 in [FMP04]). Let us show here that completions of postselfmodifying nets are not strictly monotone. Let us consider a postselfmodifying net with two places and an unique transition that adds the content of into . Consider the two markings in and fire transition , extended on , from both markings; we obtain and transition is not strictly increasing on , even if is strictly increasing on ; hence the completion of does not satisfy strict monotonicity.
We may now show the following: Let be a WSTS such that is deterministic and has leveledstrongstrict monotonicity. Let and be such that and . The following holds:

,

if , then ,
Proof.

We prove the claim by induction on . If , then the claim trivially holds since and hence for every ideal . Suppose that and that the claim holds for levels smaller than . For the sake of contradiction, assume that . Since and is the smallest such that , there exists an acceleration candidate below such that for every .
For the sake of contradiction, suppose that for some . The sequence is an acceleration candidate below . Therefore, there exists such that , which is a contradiction. Therefore, there exist infinitely many indices such that . Let be these indices. We have
(1) Moreover, by induction hypothesis, for every . Thus, by (1), leveledstrongstrict monotonicity and determinism of , we have
By definition of levels, there exists such that . Thus, we derive
which is a contradiction since by induction hypothesis.

Assume . For the sake of contradiction, suppose that . Since , the sequence is an acceleration candidate. By definition of , this acceleration candidate is below . Moreover, it goes through , and hence there exists such that . This contradicts (1). ∎
4. The Ideal KarpMiller algorithm
We have now introduced all the concepts necessary to present our generalization of the KarpMiller algorithm. This algorithm applies to a new class^{2}^{2}2Note that the definition of veryWSTS given here is slightly more general than the one that appeared in the preliminary version of this paper [BFGL17]. More precisely, strongstrict monotonicity is replaced here with leveledstrongstrict monotonicity, which allows to encompass models such as Petri nets. of WSTS that enjoy all of the generalized properties of vector addition systems:
A veryWSTS is a labeled WSTS such that:

has strong monotonicity,

is a deterministic WSTS with leveledstrongstrict monotonicity,

has finitely many levels.
We claim that the class of veryWSTS includes vector addition systems, vector addition systems with states, Petri nets, Petri nets [GHPR15], postselfmodifying nets [Val78] and strongly increasing recursive nets [FMP04] for which KarpMiller algorithms were known.
Recall that a strongly increasing function is a nondecreasing function defined on an upward closed set of that satisfies the following strongly increasing property:
where the ordering is defined by
A strongly increasing recursive net is a finite set of strongly increasing recursive functions. A strongly increasing recursive net is a strongly increasing recursive net such that the continuous extensions of the functions satisfy the previous strongly increasing property but over instead (see, , [FG12] for a definition of continuous extension). Let us write for the transition system naturally associated with a net . We may observe that .
Since nondecreasing functions of postselfmodifying nets and of strongly increasing recursive nets are incomparable, we define another class of nondecreasing functions that subsumes the two previous ones. Let us identify the nondecreasing functions over that are strictly increasing, but only on the subset of such that and have the same number of ’s.
A leveledincreasing partial function is a nondecreasing partial function such that its continuous extension satisfies the following property: for every such that and contain the same number of (in terms of ideals, and have the same level), the following holds:
A leveledincreasing recursive net is a finite set of leveledincreasing recursive partial functions.
Let us remark that the composition of two leveledincreasing partial functions is still a leveledincreasing partial function, hence the associated transition system is a WSTS with leveledstrongstrict monotonicity.
Leveledincreasing recursive nets are veryWSTS.
Proof.
Let be a leveledincreasing recursive net. By hypothesis, has strong monotonicity since the partial functions of are nondecreasing. Moreover, can be shown to be a deterministic WSTS, and is a deterministic WSTS with leveledstrongstrict monotonicity because finite composition of partial functions in is leveledincreasing. Finally, the set of states is and we know that has finitely many levels. Therefore, is a veryWSTS. ∎
Since vector addition systems, vector addition systems with states, Petri nets and strongly increasing recursive nets are leveledincreasing recursive nets by definition, to prove our claim it is sufficient to prove that postselfmodifying nets and Petri nets are leveled increasing recursive nets.
Postselfmodifying nets are leveled increasing recursive nets.
Proof.
Let be a postselfmodifying net. Let us prove that each partial function occurring on a transition of is leveledincreasing. Recall that where
is greater or equal to the identity matrix componentwise, and
.Recall that we want to show that for every
Comments
There are no comments yet.