On the Power of Weaker Pairwise Interaction:Fault-Tolerant Simulation of Population Protocols

# On the Power of Weaker Pairwise Interaction: Fault-Tolerant Simulation of Population Protocols

G. Di Luna111 University of Ottawa, {gdiluna,flocchin}@site.uottawa.ca, viglietta@gmail.com , P. Flocchini, T. Izumi222Nagoya Institute of Technology, Gokiso-cho, Showa-ku, Nagoya, Aichi, 466-8555, Japan t-izumi@nitech.ac.jp , T. Izumi333 Ritsumeikan University izumi-t@fc.ritsumei.ac.jp , N. Santoro444School of Computer Science, Carleton University, santoro@scs.carleton.ca, G. Viglietta
###### Abstract

In this paper we investigate the computational power of Population Protocols (PP) under some unreliable and/or weaker interaction models. More precisely, we focus on two features related to the power of interactions: omission failures and one-way communications. An omission failure, a notion that this paper introduces for the first time in the context of PP, is the loss by one or both parties of the information transmitted in an interaction. The failure may or may not be detected by either party. On the other hand, in one-way models, communication happens only in one direction: only one of the two agents can change its state depending on both agents’ states, and the other agent may or may not be aware of the interaction. These notions can be combined, obtaining one-way protocols with (possibly detectable) omission failures.

A general question is what additional power is necessary and sufficient to completely overcome the weakness of one-way protocols and enable them to simulate two-way protocols, with and without omission failures. As a basic feature, a simulator needs to implement an atomic communication of states between two agents; this task is further complicated by the anonymity of the agents, their lack of knowledge of the system, and the limited amount of memory that they may have.

We provide the first answers to these questions by presenting and analyzing several simulators, i.e., wrapper protocols converting any protocol for the standard two-way model into one running on a weaker one.

## 1 Introduction

### 1.1 Framework

The Population Protocol (PP) model [3] is a mathematical model that describes systems of simple mobile computational entities, called agents. Two agents can interact (i.e., exchange information) only when their movement brings them into communication range of each other; however, the movements of the agents, and thus the occurrences of their interactions, are completely unpredictable, a condition called “passive mobility”. Such would be, for example, the case of a flock of birds, each provided with a sensor; the resulting passively mobile sensor network can then be used for monitoring the activities of the flock and for individual intervention, such as a sensor inoculating the bird with a drug, should a certain condition be detected.

In PP, when an interaction occurs, the states of the two agents involved change according to a set of deterministic rules, or “protocol”. The execution of the protocol, through the interactions originating from the movements of the entities, generates a non-deterministic sequence of changes in the states of the entities themselves and, thus in the global state of the system.

In an interaction, communication is generally assumed to be bidirectional or two-way: each agent of a pair receives the state of the other agent and applies the protocol’s transition function to update its own state, based on the received information and its current state. From an engineering standpoint, this round-trip communication between two interacting agents may be difficult to implement. Moreover, the standard PP model is not resilient to faults.

In this paper we investigate the computational power of PP under some unreliable and/or weaker interaction models. More precisely, we focus on two features related to the power of interactions: omission failures and one-way communications. An omission failure, a notion that this paper introduces for the first time in the context of PP, is the loss by one or both parties of the information transmitted in an interaction. The failure may or may not be detected by either party. On the other hand, in one-way models (originally introduced in [4]), communication occurs only in one direction: only one of the two agents can change its state depending on both states, and the other agent may or may not be aware of the interaction. These notions can be combined, obtaining one-way protocols with (possibly detectable) omission failures.

A general question is what additional power is necessary and sufficient to fill the gap between the standard two-way model and the weaker models stated above. In this paper we start to address this question, using as a main investigation tool the concept of a simulator: a wrapper protocol converting any protocol for the standard two-way model into one running on some weaker model. A simulator provides an interface between the simulated protocol and the physical communication layer, giving the system the illusion of being in a two-way environment. As a basic feature, a simulator has to implement an atomic communication of states between two agents, always guaranteeing both safety and liveness of any problem specification; this task is further complicated by the anonymity of the agents, their lack of knowledge of the system, and the limited amount of memory that they may have.

### 1.2 Main Contributions

We consider the computationally distinct models that arise from the introduction of omission faults and/or one-way behavior in two-way protocols (see Figure 1). In particular, TW refers to two-way protocols without omissions; IT and IO refer to the one-way models Immediate Transmission and Immediate Observation, introduced in [4]; the T’s and I’s refer to the distinct two-way and one-way model with omissions, respectively.

We consider two main types of omission adversaries: a “malignant” one, called UO, who can insert omissions at any point in the execution, and a “benign” one, called NO, who must eventually stop inserting omissions. Interactions are otherwise “globally fair”. Interestingly, all our main simulators work even under the malignant UO adversary, while all our main impossibility results hold even under the benign NO adversary.

We start by analyzing the negative impact that omissions have on computability. We show that, in the absence of additional assumptions, the simulation of TW protocols in the presence of omissions is impossible even if the agents have infinite memory (Theorem 3.1). Among other results, we also show that, in the two weak omission models I and I, simulation is impossible even under an extremely limited omission adversary, called NO, which can only insert at most one omission in the entire execution.

On the other hand we prove that, in the weakest one-way model, IO, simulation is possible if the agents have unique IDs or the total number of agents, , is known (Theorems 4.5 and 4.6).

In the two strong omission models I and I, simulation is possible when an upper bound on the number of omissions is known (Theorem 4.1). This result in turn implies that, in the non-omissive IT model, TW simulation is possible with a memory overhead of bits for each state of the simulated protocol (Corollary 1). In light of the fact that with constant memory, in absence of additional capabilities, IT protocols are strictly less powerful than two-way protocols [4], our results show that this computational gap can be overcome by using additional memory.

Our main results are summarized in Figure 4, where green blobs represent possibilities, and red blobs impossibilities. As a consequence of these results, we have a complete characterization of the feasibility of simulation with respect to infinite memory and knowledge of the size of the system.

### 1.3 Related Work

Since their introduction, there have been extensive investigations on Population Protocols (e.g., see [5, 8, 11, 13, 18, 19, 20, 24]), and the basic assumptions of the original model have been expanded in several directions, typically to overcome inherent computability restrictions. For example, allowing each agent to have non-constant memory [1, 2, 14]; assuming the presence of a leader [7]; allowing a certain amount of information to be stored on the edges [15, 16, 17] of the interaction graph.

The issue of dependable computations in PP, first raised in [21], has been considered and studied only with respect to processors’ faults, and the basic model has necessarily been expanded. In [22] it has been shown how to compute functions tolerating crash-stops and transient failures, assuming that the number of failures is bounded and known. In [6] the specific majority problem under Byzantine failures, assuming a fair probabilistic scheduler, has been studied. In [25] unique IDs are assumed, and it is shown how to compute functions tolerating a bounded number of Byzantine faults, under the assumption that Byzantine agents cannot forge IDs. Self-stabilizing solutions have been devised for specific problems such as leader election (assuming knowledge of the system’s size and a non-constant number of states [12], or assuming a leader detection oracle [23]) and counting (assuming the presence of a leader [9]). Moreover, in [10] a self-stabilizing transformer for general protocols has been studied in a slightly different model and under the assumption of unbounded memory and a leader.

Finally, to the best of our knowledge, the one-way model without omissions, has been studied only in [4], where it is shown that IT and IO, when equipped with constant memory, can compute a set of functions that is strictly included in that of TW. Combined with our results in Figure 4, this implies that, without using extra resources (e.g., infinite memory, leader, etc.), simulations are impossible in all the one-way and omissive models.

## 2 Models and Terminology

### 2.1 Population Protocols

We consider a system consisting of a set of mobile agents. The mobility is passive, in the sense that it is decided by an external entity. When two agents meet, they interact with each other and perform some local computation. We always assume that interactions are instantaneous. Each interaction is asymmetric, that is, an interaction between and is indicated by the ordered pair , where and are called starter and reactor, respectively. A protocol is defined by the following three elements: a set of local states , a set of initial states , and a transition function . The function defines the states of the two interacting agents at the end of their local computation. With a small abuse of notation, and when no ambiguity arises, we will use the same literal (e.g., ) to indicate both an agent and its internal state. Since the static structure of the system is uniquely determined by and , we refer to it as the system . A configuration of a system is the -tuple of local states in (i.e., ).

Given an -tuple we denote the element by .

Initial Knowledge. To empower the agents, we sometimes assume that each agent has some additional knowledge, such as unique IDs and/or knowledge of . We model this information by encoding it as a set of initial states of the agents (i.e., in ).

Executions and Fairness. Whenever an interaction turns a configuration of the form into one of the form

 C′=(a1,…,δ(aj,ak)[0],…,δ(aj,ak)[1],…,an),

we use the notation . A run of is an infinite sequence of interactions . Given an initial configuration , each run induces an infinite sequence of configurations, such that for every , which is called an execution of .

We say that a set of configurations is closed if, for every , and for every configuration obtained by permuting the states of the agents of , also .

An execution is globally fair (GF) if it satisfies the following condition: for every two (possibly infinite) closed sets of configurations such that for every there exists an interaction and some such that , if infinitely many configurations of belong to , then infinitely many configurations of belong to (although not necessarily appearing in as immediate successors of configurations of ).

Note that our definition of global fairness extends the standard one, which only deals with single configurations, as opposed to sets (see [8]). The two definitions are equivalent when applied to protocols that use only finitely many states, but our extension also works with infinitely many states, while the standard one is ineffective.

### 2.2 Interaction Models

In this paper we consider three main models of interactions: the standard Two-Way one, and two one-way models presented in [4], i.e., the Immediate Transmission model and the Immediate Observation model.

Two-Way Model (TW). In this model, any protocol must have a state transition function consisting of two functions and satisfying .

Immediate Transmission Model (IT). Any protocol must have a state transition function consisting of two functions and satisfying for any .

Immediate Observation Model (IO). Any protocol must have a state transition function of the form .

Note that, in the IT model, the starter explicitly detects the interaction, as it applies function to its own state. In other terms, even if the starter cannot read the state of the reactor, it can still detect its “proximity”. In the IO model, on the other hand, there is no such detection of an interaction (or proximity) by the starter.

### 2.3 Omissive Models

An omission is a fault affecting a single interaction. In an omissive interaction an agent does not receive any information about the state of its counterpart. Omissions are introduced by an adversarial entity. We consider:

###### Definition 1 (Unfair Omissive (UO) Adversary).

The UO adversary takes a run and outputs a new sequence , which is obtained by inserting a (possibly empty) finite sequence of omissive interactions between each pair of consecutive interactions of .

###### Definition 2 (Eventually Non-Omissive (⋄No/⋄No1) Adversary).

The NO adversary takes a run and outputs a new sequence , which is obtained by inserting any finite sequence of omissive interactions between finitely many pairs of consecutive interactions of . The NO adversary is even weaker, and can only output interaction sequences with at most one omission.

If we incorporate omissions in our runs, then transition functions become more general relations.

TW Omissive Model. In the two-way omissive model, we have the transition relation

 δ(as,ar)={(fs(as,ar),fr(as,ar)),(o(as),fr(as,ar)), (fs(as,ar),h(ar)), (o(as),h(ar))}

(model T). The first pair is the outcome of an interaction when no omission is present; the other three pairs represent all possible outcomes when there is an omission: respectively, an omission on the starter’s side, on the reactor’s side, and on both sides. The functions and represent the detection capabilities of each agent: in TW, if one of these is the identity, then omissions are undetectable on the respective side.

One-Way Omissive Models. In the case of one-way interactions, we have the transition relation The first pair is the outcome of an interaction when no omission is present, and the second pair when there is an omission. (Note that the IO model corresponds to the case in which is the identity function.) Once again, omissions are undetectable starter-side (respectively, reactor-side) if (respectively, ) is the identity function.

Hierarchy of Models. The previous models can be weakened by removing the omission detection, either on the starter’s side, or on the reactor’s side. After identifying all possible combinations of omissions and detections, and pruning out the equivalent ones, the significant models and their relationships have been reported in Figure 1. For TW omissive models, in T we have the models where there is no detection of omission either on the starter’s or the reactor’s side. Since these two models are symmetric, only the one without reactor-side detection is reported, i.e., function is forced to be the identity. In T we have the weaker model where no detection is available, i.e., both and are the identity. In one-way models, function is applied when an agent detects the proximity of another agent. However, this does not imply the detection of an omission: in I, no agent detects an omission, but both detect the proximity of the other agent.

Each arrow in Figure 1 indicates either the obvious inclusion, that is, the transition relation of the source is a special case of the transition relation of the destination, or that the adversary can force the inclusion by avoiding omissions (this is the case with T and TW, for instance). Thus, arrows also indicate inclusions of the sets of problems that are solvable in the various models.

### 2.4 Simulation of Two-Way Protocols

In this section we define the two-way protocol simulator (or “simulator” for short) and other related concepts. Given a two-way protocol , consider a protocol , whose set of local states is , where is the set of local states of (the “simulated states”), and is additional memory space used in the simulation. Let be the projection function onto the set of local states of . By extension, if is a configuration of , we write to indicate the configuration of consisting of the projections of the states of the agents of .

Given an execution of , where , we say that is a sequence of events for if it is a weakly increasing sequence of indices of interactions of , such that no three indices are the same, and containing at least the indices of the interactions that determine the update of the simulated state of some agent in the execution (if an interaction updates the simulated states of two agents, then its index must appear twice in ). So, with each event in , we can associate a unique agent involved in the interaction ; preferably, this agent is one that effectively changes simulated state as a result of . We also allow extra events in , associated with agents that do not change simulated state, because we want to take into account simulations of two-way protocols that occasionally leave the state of an agent unchanged.

If , we let and . In other words, and are the configurations before and after the -th update of the simulated state, respectively.

###### Definition 3 (Perfect matching of events).

Given an execution of of a run and a sequence of events , a perfect matching is a partition of into ordered pairs (viewed as indices of events of ) such that, if , where is associated with agent and with agent , then and

 δP(πP(C−j[x]),πP(C−k[y]))=(πP(C+j[x]),πP(C+k[y])).

Intuitively, a pair in a perfect matching is the pair of events representing the two state changes given by a two-way interaction of agents under the simulated protocol . The events and correspond to the updates of the simulated states of the starter and the reactor, respectively. A matching induces a derived run of as follows. Sort the pairs of by increasing , and let be the sorted sequence. Now, if is the -th element of , agent is associated with event and agent is associated with event , then the -th element of is . Now, the derived execution induced by is simply the execution of induced by , i.e., .

###### Definition 4 (Simulation).

A protocol simulates if, for any initial configuration of agents of , and any run whose execution satisfies the GF condition, there exists a sequence of events with a perfect matching whose derived execution is an execution of agents of starting from the initial configuration and satisfying the GF condition. We further require that, for each initial configuration , every finite initial sequence of interactions of (possibly with omissions) can be extended to an infinite one , having no additional omissions, whose execution satisfies the GF condition.

The last clause of the definition has been added because, with infinite-memory protocols, the existence of GF executions cannot be taken for granted.

## 3 Impossibilities for Simulation in Presence of Omissions

In this section, we derive several impossibility results in the presence of omissions. All our impossibility proofs rely on the existence of a two-way protocol that cannot be simulated.

###### Definition 5 (Pairing Problem).

A set of agents is given, partitioned into consumer agents , starting in state , and producer agents , starting in state . We say that a protocol solves the Pairing Problem (Pair) if it enforces the following properties:

• Irrevocability. has a state that only agents in state can get; once an agent has state , its state cannot change any more.

• Safety. At any time, the number of agents in state is at most .

• Liveness. In all GF executions of , eventually the number of agents in state is stably equal to .

It is easy to see that Pair can be solved by the simple protocol below in the standard two-way model.

Pairing Protocol . . The only non-trivial transition rules are and .

Let us now define a property on the behavior of a generic simulator over a sequence of interactions . We will later show how this property is related to the omission resilience of .

###### Definition 6 (Transition Time (Tt)).

Given a TW protocol , a simulator , and an execution of on a system of two agents, the Transition Time (TT) of the triplet is the smallest such that and (or , if no such exists).

Let be the number of omissions in a sequence of interactions .

###### Definition 7 (Fastest Transition Time (Ftt)).

Given a TW protocol , a simulator , and a configuration for a system of two agents of , the Fastest Transition Time (FTT) of the triplet is the smallest TT of all the triplets of the form , where ranges over all runs with and .

Intuitively, FTT is the minimum number of (non-omissive) interactions needed by a specific simulator to simulate one step of protocol in a system of two agents. Thus it can be seen as the “maximum speed” of a simulator. We will show in the following that such a metric is intrinsically related with the omission resilience of .

### 3.1 Impossibilities in Spite of Infinite Memory

In this section we show that simulations of TW models are impossible when omissions are present, even if the system is endowed with infinite memory. We start presenting a key indistinguishability argument.

###### Lemma 1 ().

Let be a simulator working in the omission model T. Let be the FTT of the triplet , where one agent in has simulated state , the other agent has with , and and . Let be a system of agents of , and let be an initial configuration of in which agents have simulated state and agents have . Then, there exists a sequence of interactions of such that is GF and , with a sequence of events in which at least events represent a transition of some agent from simulated state to .

###### Proof.

Intuitively, we construct a system with pairs of agents which, thanks to omissive interactions, we “fool” into believing that they are operating in a system of only two agents, until one agent per pair transitions from simulated state to . Then we have an extra agent that interacts once with one member of each of the pairs, also “believing” that the system consists of only two agents, which finally transitions from simulated state to . One last auxiliary agent serves as a “generator” of omissive interactions.

Let be any run of a system of two agents achieving FTT for ; let be the agent whose initial state is and let be the other one. For every , we construct a sequence of interactions for two agents as follows: copy the first interactions from ; append an omissive interaction with the same starter as , and with omission (and detection) on ’s side; extend the resulting sequence to an infinite one whose execution from satisfies the GF condition, without adding extra omissions (such an extension exists by Definition 4, since is a simulator). Note that has exactly one omissive interaction.

Because the execution of is GF, the derived execution must also be GF by definition of simulator, and in particular it makes the simulated states of the two agents transition according to infinitely many times. Hence, the agent whose initial simulated state is will eventually transition to , say after the execution of the first interactions of . Note that this happens regardless of which agent is the starter of the two-way simulated interaction, because by assumption is symmetric on .

Now name the agents of as in , in such a way that, for all , the agents of the form have simulated state in , while all other agents of have . For every , we construct a sequence , consisting of interactions, involving only agents , , , and . We make and interact with each other as in , but we “redirect” the omissive interaction to and . Specifically, we replicate the first interactions of (where becomes and becomes ); then we add an interaction between and , where the role of (i.e., starter or reactor) is the same as that of in ; then we insert an omissive interaction between and , where the role of is the same as that of in , and the omission (and detection) is on ’s side; finally, we replicate the interactions of from to . Observe that contains exactly one omissive interaction, .

The final sequence is now simply the concatenation of all the sequences (where goes from to , in increasing order), extended to an infinite sequence of interactions whose execution is GF, and having exactly omissions in total (again, this extension exists by Definition 4).

Let us examine the execution of from the initial configuration . Each of the pairs of the form , with , has an initial execution that is the same as that of interacting for turns as in . Hence, the execution of is that of interacting as in for the first turns. It follows that transitions from simulated state to by the end of the sub-run . Also, for each pair , the execution is as in for the first turns; hence, transitions from simulated state to at the end of the sub-run . Thus, in total, we have at least agents that transition from to . ∎

###### Theorem 3.1 ().

Given an infinite amount of memory on each agent, it is impossible to simulate every TW protocol in the T model (hence in all the omissive models of Figure 1), even under the NO adversary.

###### Proof.

We show that the protocol for Pair cannot be simulated if any type of omissive interaction is allowed. Assume by contradiction that there is a simulator for , i.e., tsolves Pair under some omissive model. Let us now apply Lemma 1 to and , where is the initial state of the providers (hence there are providers), is the initial state of the consumers (hence there are consumers), and is the irrevocable state.

Because is symmetric with respect to starter and reactor, the hypotheses of Lemma 1 are satisfied, and hence there is a sequence of interactions whose execution is GF, which causes transitions into the critical state. Since the execution is GF, the derived execution of must be an execution of , due to Definition 4. In particular, it satisfies the irrevocability property of Pair. Therefore, no agent entering a critical state can ever change it. It follows that, eventually, there are at least agents in the critical state, which contradicts the safety property of Pair.

Since contains just finitely many omissive interactions, it can be generated by the NO adversary. ∎

Theorem 3.1 uses as counterexample the construction of Lemma 1, implying that a simulator S fails to simulate protocol in a run where the number of failures is exactly the FTT of . This is even more interesting if we consider simulators that are unaware of the protocol they are simulating, where by “unaware” we mean that the sequence of simulated two-way interactions is not influenced by the protocol that is being simulated or by the initial configuration (i.e., general-purpose and not ad-hoc simulators). We have shown that each of these simulators fails as soon as the number of omissions is above some constant threshold, which is independent of the simulated protocol and the initial configuration. Such a threshold is precisely the minimum number of non-omissive interactions needed to simulate a single two-way transition.

For models I and I, we can strengthen Theorem 3.1.

###### Theorem 3.2 ().

Given an infinite amount of memory on each agent, it is impossible to simulate every TW protocol in the interaction models T, I, and I, even under the NO adversary.

###### Proof.

The proof uses a construction analogous to the one used in Lemma 1. We consider a system of agents, and we build sequences of interactions between two agents and , exactly as in Lemma 1. Recall that the run contains only one omission. Hence, if a simulator is resilient to the NO adversary, it eventually succeeds in making and simulate a full two-way interaction, say after one-way interactions. Since is well defined, we can go on and construct the sequence . However, the that we will use in this proof differs from its counterpart used in Lemma 1 by two elements: and . In particular, our new ’s will contain no omissions.

If the model is T, we replace the old interactions and by a single non-omissive interaction between and (in which is the starter if and only if is the starter in ).

Let the model be I. If the interaction is , then we replace the old interactions and by the single interaction . Otherwise, if , we set and .

Consider now model I. If the interaction is , then we set and . Otherwise, if , we replace the old interactions and by the three interactions , , and .

Finally, we concatenate the finite sequences to obtain the new run , which contains no omissions. Let us now examine the execution of from the initial configuration defined in Lemma 1. Once again, each of the pairs , with , has an initial execution that is the same as that of interacting for turns as in . Then, the new interactions that we added in lieu of and make and change state in the same way as in the omissive interaction . But as a side effect, also changes state as it would in a non-omissive interaction with . As a consequence, by the end of , all the agents of the form with , as well as , have transitioned from simulated state to . Thus, in total, at least agents transition from to .

Now the proof can be completed exactly as in Theorem 3.1, by showing that the protocol cannot be simulated. ∎

One may wonder what would happen if we wanted to construct simulators that “gracefully degrade” when omissions reach a certain threshold . More precisely, for a sequence of interactions with , the simulator has to perform a full simulation of ; if , the simulator has to start a simulation, but then it is allowed to stop forever in a “consistent” simulated state. Essentially, in the second case, we allow the sequence of events defined in Section 2.4 to be finite (in other terms, we drop the simulator’s “liveness” requirement).

###### Theorem 3.3 ().

Given an infinite amount of memory on each agent, in the T model (and hence in all the omissive models of Figure 1), any gracefully degrading simulator that simulates all TW protocols must have a threshold .

###### Proof.

Recall that in Lemma 1 we constructed a sequence of interactions for a set of agents , which was then applied to the protocol in order to prove Theorem 3.1. Suppose now that a simulator has threshold . If such a simulator executes a run with at most one omission, it must effectively simulate infinitely many two-way interactions. In particular, it is able to simulate the first two-way interaction in a system of two agents, and therefore the sequence mentioned in Lemma 1 is well defined for this simulator, as well as the sequences and the numbers . But then, as the agents of execute the same simulator according to the sequence , they violate the safety property of Pair, because of them change their simulated state from to . Since they reach a non-consistent simulated state, this means that a gracefully decaying simulator with threshold cannot simulate . ∎

## 4 Simulation in Omissive Models

In this section we focus on designing simulators of two-way protocols. In light of the impossibilities presented in the previous section, additional assumptions are necessary. Section 4.1 assumes some knowledge on the maximum number of omissions, Section 4.2 assumes the presence of unique IDs, and finally in Section 4.3 we assume to know the number of agents.

### 4.1 Knowledge on Omissions: Simulator SKnO

Here we assume to know an upper bound on the number of omissions, i.e., for any sequence of interactions on which the simulator runs we have . We will show that under this assumption there exists a simulator for models I and I. This contrasts with models I and I, in which it is impossible to simulate even when (see Theorem 3.2).

We explain the simulator under model I; the version for model I is only slightly different, and its correctness follows from symmetry considerations. The simulator is based on the exchange of “tokens”. Each simulated state is represented as a sequence of numbered tokens: . Intuitively, an agent tries to transmit its state to others by sending one token at a time, for consecutive interactions, each time incrementing the counter. When a reactor detects an omission, it generates a joker token , which will also be sent in successive interactions. Note that there are never more than jokers circulating. Every time an agent gets a new token, it checks if it owns the complete set of tokens representing some state and, if so, it simulates (part of) an interaction with a hypothetical partner in state . If the complete set of tokens is not available, the agent is allowed to replace the missing tokens with the jokers that it currently owns. After the tokens have been used, they are discarded and withdrawn from circulation. However, if an agent uses some joker tokens, it “takes note” of what tokens these jokers are replacing. If later on the same agent obtains one of the tokens in this list, say , it turns into a joker and removes from the list. (This is reminiscent of the card game Rummy.)

Simulator Variables. Each agent has a queue of tokens to be sent, called , initially empty. It also has a variable for the state of the simulator protocol, a variable for the state of the simulated protocol (initialized according to its initial simulated state), and a multi-set of tokens called , initially empty.

Simulator Protocol. Suppose that an agent interacts as a starter. If and is empty, the agent switches to and inserts the complete set of tokens into . In any case, and regardless of , the starter removes the first token from the queue, and the reactor reads it.

Suppose now that an agent interacts as a reactor. To begin with, it reads the first token from the queue of the starter, and enqueues it into its own queue. If it detects an omission, it enqueues a joker token instead. Then it performs a preliminary check: if , and the agent can find a complete set of tokens for its own state (i.e., ) in its own queue (possibly using some joker tokens as wildcards), it switches to and removes the set of used tokens from the queue. After this preliminary check, the core protocol starts: if , and the agent has a complete set of tokens for some state in its own queue (possibly using some joker tokens), it removes the set of used tokens from the queue, it simulates its part of the two-way transition with an agent in state (i.e., it updates ), and it enqueues into a complete set of “state change” tokens, i.e., . On the other hand, if , and the agent has a complete set of state change tokens of the form in its own queue (possibly using some joker tokens), it removes the set of used tokens from the queue, it updates , and switches to .

Also, whenever a reactor uses a joker token as a substitute for some token , it adds to the multi-set . Symmetrically, when it receives a new token from a starter and that token is in , it removes one copy of from , removes the last copy of from , and enqueues a new joker token into .

###### Lemma 2 ().

The derived execution of simulator is GF.

###### Proof.

Let and be closed sets of configurations of , such that every configuration of can become one of after a two-way interaction, and suppose that the derived execution passes through infinitely many times. Let be the set of configurations of the simulator protocol whose simulated states are in , and let be constructed similarly from . By assumption, the simulation passes through infinitely often; we claim that it must go through infinitely many times, as well. By definition of , for every , there is an interaction in between and that maps into , where is obtained from by changing the simulated states of and according to (and possibly some simulator variables). Since in there are no “pending” transactions, has a possible continuation where agents and are available, such that , and from this configuration the final configuration is reachable. The proof is done by case analysis on the number of agents:

• Case : In this case a simple counting arguments shows that it is always possible to find a finite sequence of interactions such that: agents and are available and have an empty buffer and no agent sets . Let be the state of , respectively. Having at most tokens, distributing this tokens among agents, such that each agent obtains at most tokens. No agent can set if it does not receives at least tokens, please note that by assumption we started by a configuration where agents were either or and no run was present. Starting from this configuration, we first show how to ”unlock” agent (or if it is pending). If agent is pending there is an agent containing the first token of the run , this token can be in position in the buffer of with . If the token is sent to by doing an interaction otherwise we do first a sequence of interactions , note that this could at most trigger the exit of from the state since receives strictly less then tokens, if this is the case we have done. In any case we append another sequence of interactions until the buffer of is empty. Now either is available, or the token in position in the buffer of is the first token of the run of , in this case moves this token to the buffer of . This procedure is iterated until all tokens but one are in the buffer of , the last token is in position of agent and the buffer of is empty, when this happens a trivial sequence of interactions followed by bring in state with an empty buffer and it empties the buffer of . The same procedure can be used to unlock if it is pending. Once and are both available and with an empty buffer a sequence of interactions followed by a sequence of interactions brings the system in configuration .

• Case : Let us first examine the case of three agents, and let with state be the third agent. Let us assume that does not have in the buffer a complete run for otherwise it sends its tokens to until the first token of the run for is sent to . Then we send all tokens for the run to : if agent has some token for or in position of the buffer we have an interaction , the same is done for agent this procedure stop when both agents have a token for in position . When this happen we let agents have interactions and , this allows the agent to remove the tokens for , note that during this procedure agent does not increases its number of tokens for contained in buffer. Iterating this procedure agent obtains a complete run and . At this points it exits from pending being available and it executes the first portion of the simulated two interactions. A series of successive interactions brings the system in configuration . The case for agents is analogous.

• Case : In this case after at most interactions and after other interactions we have that the agents changes simulated state bringing the system in configuration .

###### Theorem 4.1 ().

Assuming I or I and bits of memory on each agent, there exists a protocol that simulates every TW protocol.

###### Proof.

The proof uses model I, the correctness for model I follows from symmetry consideration. We first show that an agents sets infinitely many times. Let us first consider the case where an agent with exists, if there exists an agent with state it is easy to see that after interactions , despite the presence of omissions, agent will have a run for the state of in , therefore it executes . In case is in and there is no token , we show that there exists a run for a state scattered among agents.

We claim that once a run is created it disappears from the system only if it is consumed by an agent. Suppose that there is no token this implies that each time an agent was trying to transmit a toke for state an omission occurred, but there are such tokens and at most omissions, therefore this is impossible. Now let us suppose that the number of jokers and tokens is less than : each time an omission occurred when a token of a specific run was sent the receiver generated a joker, let be the set of these jokers, we have that and the number of tokens is at least . Note that if one token in was used by an agent then there exists an agent with a token and either: (1) there exists a token on agent , therefore after a finite number of interactions we have that agent will put a joker in ; or (2) if token