Partial Decidability Protocol

• Partial Decidability Protocol is a family of strategies that recover tractability in protocol verification for problems that are otherwise undecidable.
• It employs methods such as restricting protocol models, logical decomposition, and dovetailing complementary semi-procedures to isolate decidable fragments.
• These approaches enable efficient analysis, synthesis, and certificate-based verification by leveraging model constraints and asymmetries in complex protocols.

Searching arXiv for papers relevant to “partial decidability” in protocol verification and related decidable fragments. “Partial decidability protocol” is not a single standardized theorem or formalism. The literature instead uses the phrase, or closely related language, for a family of strategies that recover algorithmic tractability for protocol-analysis problems that are otherwise undecidable or intractable. These strategies include full decidability on sharply delimited protocol classes, decision procedures assembled from complementary semi-procedures, decompositions of one undecidable verification task into two decidable logics, and one-sided or certificate-based asymmetries in which positive instances can be recognized even though unrestricted verification remains out of reach (Farahat, 22 Mar 2026, Berkovits et al., 2019, Padon et al., 2017).

1. Conceptual scope

The surveyed literature suggests four recurring meanings of partial decidability. First, some works prove full decidability for a restricted model, while emphasizing that the result is not a general solution to parameterized verification. Second, some works derive total decision procedures by dovetailing complementary semi-procedures. Third, some isolate a decidable core inside a richer undecidable formalism, typically by translating or decomposing obligations into fragments such as EPR, BAPA, or a constrained monadic first-order fragment. Fourth, some formalize a verification asymmetry, where existence, synthesis, or certificate checking is decidable although arbitrary-instance verification is not (Horn et al., 2020, Teucke et al., 2017, Fraigniaud et al., 2010).

This variety matters because several papers explicitly warn against conflating “partial decidability” with semi-decidability. For parameterized self-disabling uni-rings, livelock detection is “full decidability, not merely semi-decidability,” but only for a narrow class defined by unidirectionality, symmetry or $(1,1)$-asymmetry, bounded domain, and self-disabling local transitions (Farahat, 22 Mar 2026). By contrast, in threshold-based distributed verification and DEL planning, the unrestricted problems remain undecidable, and only the decomposed or semantically restricted fragments are decidable (Berkovits et al., 2019, Burigana et al., 2023).

2. Restricted parameterized and distributed models

A prominent form of partial decidability is to fix a narrow parameterized architecture and then solve one verification problem exactly. For symmetric unidirectional rings of self-disabling processes over bounded domain $\mathbb Z_m$, livelock detection is decided by a greatest fixed point

$$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$

The main theorem is

$$L\neq \emptyset \iff \exists K\ge 2 \text{ such that a livelock exists,}$$

and Algorithm 1 runs in $O(|T|^3)$ time independent of ring size $K$ because it operates only on the finite local transition set $T$ (Farahat, 22 Mar 2026). The same paper extends the construction to the $(1,1)$-asymmetric case by a paired fixed-point iteration on $(L_0,L_{\mathit{other}})$, again with $O(|T|^3)$ complexity independent of $\mathbb Z_m$0 (Farahat, 22 Mar 2026).

The same architectural theme appears in leads-to synthesis on symmetric uni-rings. Verification of $\mathbb Z_m$1 is undecidable even for deterministic, constant-space, self-disabling processes and conjunctive state predicates. Yet synthesis is decidable, and the paper identifies a necessary-and-sufficient locality-graph criterion: there must exist distinct values $\mathbb Z_m$2 such that $\mathbb Z_m$3 and $\mathbb Z_m$4 hold. Under that condition, a sound and complete polynomial-time algorithm constructs a protocol whose action graph is essentially a tree directed toward a root $\mathbb Z_m$5 with a self-loop, thereby avoiding the nontrivial cyclic structure that would reintroduce livelock phenomena (Ebnenasir, 2019).

Parameterized rendez-vous networks provide a different pattern. The cut-off problem asks whether

$\mathbb Z_m$6

In the general asymmetric model with a leader, the problem is decidable but non-elementary hard; under symmetry it drops to PSPACE; without a leader it is in EXPSPACE; and in the symmetric no-leader fragment it is in NP (Horn et al., 2020). The general decision procedure is assembled from two complementary semi-procedures over Petri-net reductions, so total decidability is obtained even though the proof method is intrinsically one-sided in each direction (Horn et al., 2020).

Population protocols with unordered data show the opposite boundary. For PPUD, well-specification is undecidable in general, but for the immediate-observation subclass IOPPUD the emptiness problem for generalized reachability expressions is in EXPSPACE and coNEXPTIME-hard. The proof relies on a symbolic abstraction by $\mathbb Z_m$7-boxes and $\mathbb Z_m$8-containers together with a reachability-transfer lemma that holds specifically because one agent remains passive in every interaction (Bergerem et al., 2024). This is a canonical decidable island result: unrestricted infinite-data verification is lost, but a large natural subclass remains algorithmically analyzable.

3. Decidable cores by logical decomposition

A second major pattern is to keep the protocol model expressive, but move the proof obligations into decidable logical fragments. Threshold-based distributed algorithms are verified by splitting the task between EPR and BAPA. The paper isolates a restricted language of Threshold Intersection Properties (TIP), translates protocol reasoning plus TIP assumptions into EPR or an acyclic extension of EPR, and translates TIP validity under resilience assumptions into BAPA. Under feasibility, non-degeneracy, sanity, and acyclicity assumptions, the Aip algorithm is sound and complete for the TIP fragment, but the paper is explicit that general verification of threshold protocols remains undecidable and that the set of all first-order truths of threshold-faithful structures is not recursively enumerable (Berkovits et al., 2019).

The same decomposition philosophy underlies the EPR verification of Paxos and its variants. Protocols are first modeled in general many-sorted first-order logic; then derived relations such as $\mathbb Z_m$9 and $$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$0 are introduced, transitions are rewritten under mechanically checked side conditions, and the final verification conditions are brought into stratified EPR. The method is sound but incomplete: once the transformed model and inductive invariant have acyclic quantifier alternation graphs, inductive checking is decidable and finite countermodels are available, but the methodology does not decide whether an appropriate transformation exists for an arbitrary protocol (Padon et al., 2017).

A more syntactic decidable core appears in the fragment MSL(SDC): the monadic shallow linear first-order fragment with straight dismatching constraints. Its satisfiability is decidable via ordered SDC-resolution with selection and finite saturation up to redundancy. The same paper then embeds MSL(SDC) into an approximation-refinement framework, FO-AR, that over-approximates arbitrary first-order clause sets by this decidable fragment. This yields a sound but not globally terminating outer loop, which is precisely a partial-decidability architecture rather than a complete decision procedure for full first-order logic (Teucke et al., 2017).

Epistemic planning supplies a semantic variant of the same idea. By extending $$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$1 with the commutativity axiom

$$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$2

the logic $$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$3 collapses common knowledge to a finitary form: $$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$4 for $$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$5. This yields bounded epistemic diameter, bounded bisimulation depth, and ultimately decidable DEL plan existence (Burigana et al., 2023). Here the decidable fragment is defined semantically, not syntactically.

4. Symbolic cryptographic protocols

In symbolic cryptography, partial decidability usually arises from bounding sessions, constraining message structure, or requiring effective saturation conditions. For a bounded number of sessions, deducibility constraints can be simplified to solved forms that represent all solutions, not merely satisfiability witnesses. This yields NP procedures for several properties, and in particular deciding the existence of key cycles is NP-complete for bounded sessions (0708.3564).

For richer equational theories, the decisive criterion becomes saturation. Ground reachability is decidable provided the saturation/transformation procedure terminates and the equational theory has the finite variant property. For non-ground reachability, saturation termination alone is not sufficient; the paper introduces the additional criterion of a contracting saturated deduction system, under which general reachability becomes decidable (0906.1199). This is a sharp boundary result: ground decidability, non-ground undecidability in general, and restored decidability under an extra structural condition.

A different route is protocol compilation. Dynamic tags turn some unbounded-session verification problems into bounded-session ones. For transformed protocols equipped with collaborative session-dependent tags, any attack against secrecy, aliveness, or weak agreement can be witnessed using only finitely many sessions, with the bound determined by the attack formula; for those classical properties, one honest session per role suffices (Arapinis et al., 2014). This is not full decidability for arbitrary protocols, but it is a genuine reduction from unbounded to bounded verification for a transformed class.

The most semantic restriction in this group is depth-boundedness. For stateful applied-$$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$6-style protocols with unbounded sessions and fresh nonces, verification is undecidable in general. But for protocols whose bounded-size semantics lies in some $$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$7, downward-closed properties become decidable. The proof uses a well-quasi-order, ideal representations by limits, decidable inclusion between limits, and an effective symbolic successor operator $$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$8 (D'Osualdo et al., 2019). The result is sound and complete on that restricted class, while leaving unrestricted verification undecidable.

5. Verification–synthesis asymmetry and certificate models

Several papers show that partial decidability is not always about restricting the protocol class; sometimes it is about changing the task. The clearest case is symmetric uni-rings for leads-to properties: verification of a given protocol against $$L=\nu S.\,\Phi(S), \qquad \Phi(S)=PL(Filter(S,Shad(PL(S)))).$$9 is undecidable, while synthesis of some protocol satisfying the same requirement is decidable and polynomial-time under the paper’s criterion (Ebnenasir, 2019). This reversal occurs because existence collapses to a graph-theoretic normal form, whereas verification must analyze arbitrary cyclic behavior and hence arbitrary livelocks.

A closely related asymmetry appears in mobile-agent computation on anonymous graphs. The class $$L\neq \emptyset \iff \exists K\ge 2 \text{ such that a livelock exists,}$$0 of mobile agents verifiable problems strictly contains the class $$L\neq \emptyset \iff \exists K\ge 2 \text{ such that a livelock exists,}$$1 of mobile agents decidable problems, because positive instances may admit certificates even when total distributed decision is impossible. For one agent,

$$L\neq \emptyset \iff \exists K\ge 2 \text{ such that a livelock exists,}$$2

so verification on both sides collapses back to full decidability (Fraigniaud et al., 2010). Although this is not a protocol-verification paper in the usual sense, it formalizes the same asymmetry between global decision and certificate-based recognition.

The Petri-net route to cut-off existence in rendez-vous systems belongs in the same family. The paper’s own description emphasizes that “the general procedure is assembled from semidecision procedures,” even though the final theorem is full decidability (Horn et al., 2020). This illustrates a common methodological pattern: the protocol problem itself is not merely semi-decidable, but the proof of decidability factors through two one-sided searches.

6. Boundaries, misconceptions, and significance

A recurring misconception is to treat any such result as a solution to “parameterized protocol verification” or “security protocol verification” in general. The cited papers repeatedly reject that interpretation. Livelock decidability for self-disabling uni-rings is “a complete polynomial-time decision procedure for a sharply delimited class,” not a general theorem for arbitrary parameterized protocols (Farahat, 22 Mar 2026). Threshold-based verification in EPR and BAPA is complete only for the TIP fragment, not for unrestricted threshold reasoning (Berkovits et al., 2019). Paxos-to-EPR is sound but incomplete (Padon et al., 2017). Depth-bounded protocol verification, dynamic tagging, and bounded-session solved forms all recover decidability only under precise structural restrictions (D'Osualdo et al., 2019, Arapinis et al., 2014, 0708.3564).

The literature therefore supports a precise encyclopedic understanding of partial decidability protocol: a protocol-analysis methodology in which decidability is recovered by topology restrictions, bounded domains, semantic collapse of higher-order structure, logical decomposition, transformed protocol design, or task asymmetry. This suggests that the enduring research problem is not simply to extend decision procedures outward, but to identify the structural invariants—self-disabling locality, immediate observation, threshold-intersection regularity, commutative knowledge, depth-boundedness, or tree-shaped correction dynamics—that carve out decidable regions inside otherwise undecidable verification landscapes.