Pushdown Model Research Articles

Deciding Asynchronous Hyperproperties for Recursive Programs

We introduce a novel logic for asynchronous hyperproperties with a new mechanism to identify relevant positions on traces. While the new logic is more expressive than a related logic presented recently by Bozzelli et al., we obtain the same complexity of the model checking problem for finite state models. Beyond this, we study the model checking problem of our logic for pushdown models. We argue that the combination of asynchronicity and a non-regular model class studied in this paper constitutes the first suitable approach for hyperproperty model checking against recursive programs.

On the complexity of ω-pushdown automata

Finite automata over infinite words (called $\omega$-automata) play an important role in the automata-theoretic approach to system verification.Different types of $\omega$-automata differ in their succinctness and complexity of their emptiness problems, as a result, theory of $\omega$-automata hasreceived considerable research attention. Pushdown automata over infinite words (called $\omega$-PDAs), a generalization of $\omega$-automata, are a naturalmodel of recursive programs. Our goal in this paper is to conduct a relatively complete investigation on the complexity of the emptiness problems for variantsof $\omega$-PDAs. For this purpose, we consider $\omega$-PDAs of five standard acceptance types: Buchi, Parity, Rabin, Streett and Muller acceptances.Based on the transformation for $\omega$-automata and the efficient algorithm proposed by Esparza et al. in CAV00 for verifying the emptiness problem of $\omega$-PDAswith Buchi acceptance, it is trivial to check the emptiness problem of other $\omega$-PDAs. However, this naive approach is not optimal. In this paper,we propose novel algorithms for the emptiness problem of $\omega$-PDAs based on the observations of the structure of accepting runs. Our algorithms outperform algorithmsthat go through Buchi PDAs. In particular, the space complexity of the algorithm for Streett acceptance that goes through Buchi acceptance is exponential,while ours is polynomial. The algorithm for Parity acceptance that goes through Buchi acceptance is in ${\boldsymbol O}(k^3n^2m)$ time and ${\boldsymbol O}(k^2nm)$ space,while ours is in ${\boldsymbol O}(kn^2m)$ time and ${\boldsymbol O}(nm)$ space, where $n$ (resp. $m$ and $k$) is the number of control states (resp. transitions and index).Finally, we show that our algorithms yield a better solution for the pushdown model checking problem against linear temporal logic with fairness.

Visibly Linear Temporal Logic

We introduce Visibly Linear Temporal Logic (VLTL), a linear-time temporal logic that captures the full class of Visibly Pushdown Languages over infinite words. The novel logic avoids fix points and instead provides natural temporal operators with simple and intuitive semantics. We prove that the complexities of the satisfiability and visibly pushdown model checking problems are the same as for other well known logics, like CaRet and the nested word temporal logic NWTL, which in contrast are strictly more limited in expressive power than VLTL. Moreover, formulas of CaRet and NWTL can be translated inductively and in linear-time into VLTL.

A posteriori environment analysis with Pushdown Delta CFA

Flow-driven higher-order inlining is blocked by free variables, yet current theories of environment analysis cannot reliably cope with multiply-bound variables. One of these, Δ CFA , is a promising theory based on stack change but is undermined by its finite-state model of the stack. We present Pushdown Δ CFA which takes a Δ CFA -approach to pushdown models of control flow and can cope with multiply-bound variables, even in the face of recursion.

Pushdown module checking with imperfect information

The model checking problem for finite-state open systems (module checking) has been extensively studied in the literature, both in the context of environments with perfect and imperfect information about the system. Recently, the perfect information case has been extended to infinite-state systems (pushdown module checking). In this paper, we extend pushdown module checking to the imperfect information setting; i.e., to the case where the environment has only a partial view of the systemʼs control states and pushdown store content. We study the complexity of this problem with respect to the branching-time temporal logics CTL, CTL⁎ and the propositional μ-calculus. We show that pushdown module checking, which is by itself harder than pushdown model checking, becomes undecidable when the environment has imperfect information.We also show that undecidability relies on hiding information about the pushdown store. Indeed, we prove that with imperfect information about the control states, but a visible pushdown store, the problem is decidable and its complexity is 2Exptime-complete for CTL and the propositional μ-calculus, and 3Exptime-complete for CTL⁎.

A traversal-based algorithm for higher-order model checking

Higher-order model checking - the model checking of trees generated by higher-order recursion schemes (HORS) - is a natural generalisation of finite-state and pushdown model checking. Recent work has shown that it can serve as a basis for software model checking for functional languages such as ML and Haskell. In this paper, we introduce higher-order recursion schemes with cases (HORSC), which extend HORS with a definition-by-cases construct (to express program branching based on data) and non-determinism (to express abstractions of behaviours). This paper is a study of the universal HORSC model checking problem for deterministic trivial automata : does the automaton accept every tree in the tree language generated by the given HORSC? We first characterise the model checking problem by an intersection type system extended with a carefully restricted form of union types. We then present an algorithm for deciding the model checking problem, which is based on the notion of traversals induced by the fully abstract game semantics of these schemes, but presented as a goal-directed construction of derivations in the intersection and union type system. We view HORSC model checking as a suitable backend engine for an approach to verifying functional programs. We have implemented the algorithm in a tool called TravMC , and demonstrated its effectiveness on a test suite of programs, including abstract models of functional programs obtained via an abstraction-refinement procedure from pattern-matching recursion schemes.

Automated Adaptor Generation for Behavioral Mismatching Services Based on Pushdown Model Checking

Automated Adaptor Generation for Behavioral Mismatching Services Based on Pushdown Model Checking

Software model checking using languages of nested trees

While model checking of pushdown systems is by now an established technique in software verification, temporal logics and automata traditionally used in this area are unattractive on two counts. First, logics and automata traditionally used in model checking cannot express requirements such as pre/post-conditions that are basic to analysis of software. Second, unlike in the finite-state world, where the μ-calculus has a symbolic model-checking algorithm and serves as an “assembly language” to which temporal logics can be compiled, there is no common formalism—either fixpoint-based or automata-theoretic—to model-check requirements on pushdown models. In this article, we introduce a new theory of temporal logics and automata that addresses the above issues, and provides a unified foundation for the verification of pushdown systems. The key idea here is to view a program as a generator of structures known as nested trees as opposed to trees. A fixpoint logic (called N T -μ) and a class of automata (called nested tree automata ) interpreted on languages of these structures are now defined, and branching-time model-checking is phrased as language inclusion and membership problems for these languages. We show that N T -μ and nested tree automata allow the specification of a new frontier of requirements usable in software verification. At the same time, their model checking problem has the same worst-case complexity as their traditional analogs, and can be solved symbolically using a fixpoint computation that generalizes, and includes as a special case, “summary”-based computations traditionally used in interprocedural program analysis. We also show that our logics and automata define a robust class of languages—in particular, just as the μ-calculus is equivalent to alternating parity automata on trees, NT-μ is equivalent to alternating parity automata on nested trees.

Pushdown flow analysis of first-class control

Pushdown models are better than control-flow graphs for higher-order flow analysis. They faithfully model the call/return structure of a program, which results in fewer spurious flows and increased precision. However, pushdown models require that calls and returns in the analyzed program nest properly. As a result, they cannot be used to analyze language constructs that break call/return nesting such as generators, coroutines, call/cc, etc . In this paper, we extend the CFA2 flow analysis to create the first pushdown flow analysis for languages with first-class control. We modify the abstract semantics of CFA2 to allow continuations to escape to, and be restored from, the heap. We then present a summarization algorithm that handles escaping continuations via a new kind of summary edge. We prove that the algorithm is sound with respect to the abstract semantics.

An Ahead-of-time Yet Context-Sensitive Points-to Analysis for Java

Points-to analysis is a prerequisite of program verification and static analysis on Java programs. It is known that call graph is typically constructed on-the-fly when points-to analysis proceeds for a better precision. In this work, we propose an ahead-of-time yet context-sensitive points-to analysis for Java as all-in-one weighted pushdown model checking. The analysis is context-sensitive in the sense that, (i) method calls and returns match with each other (a.k.a., valid paths); and (ii) targets of dynamic dispatch are analyzed separately for different calling contexts (a.k.a., context-sensitive call graph). The insight of our approach is that, by encoding dataflow as weights, invalid control flows that violate Java semantics on dynamic dispatch are detected as those carrying conflicted dataflow. Our analysis is presented as field-sensitive and flow-sensitive. Flow-insensitivity is shown to be easily obtained as a hierarchy considering efficiency and concurrent behaviors. Due to the lack of control flow structure and the explicit stack-based design, program analysis on bytecode is not an easy matter. We implemented the analysis in the framework of Soot compiler, and utilized the Weighted PDS Library as the back-end analysis engine. The analysis works on Jimple, a typed three-address intermediate representation of bytecode supported by Soot. The results of the analysis can be encoded into the class file as attributes for the further analysis or verification on bytecode.

CaRet With Forgettable Past

We study the extension of the full logic CaRet with the unary regular modality N (which reads “from now on”) which allows to model forgettable past. For such an extension, denoted NCaRet, we show the following: (1) NCaRet is expressively complete for the first-order fragment of MSOμ, which extend MSO over words with a binary matching predicate, (2) satisfiability and pushdown model checking are 2Exptime-complete, and (3) pushdown model checking against the regular fragment of NCaRet remains 2Exptime-hard.

Regularly annotated set constraints

A general class of program analyses area combination of context-free and regular language reachability. We define regularly annotated set constraints , a constraint formalism that captures this class. Our results extend the class of reachability problems expressible naturally in a single constraint formalism, including such diverse applications as interprocedural dataflow analysis, precise type-based flow analysis, and pushdown model checking.

Complexity results on branching-time pushdown model checking

The model checking problem of pushdown systems (PMC problem, for short) against standard branching temporal logics has been intensively studied in the literature. In particular, for the modal μ -calculus, the most powerful branching temporal logic used for verification, the problem is known to be Exptime-complete (even for a fixed formula). The problem remains Exptime-complete also for the logic CTL, which corresponds to a fragment of the alternation-free modal μ -calculus. For the logic CTL ∗ , the problem is known to be in 2Exptime. In this paper, we show that the complexity of the PMC problem for CTL ∗ is in fact 2Exptime-complete. Moreover, we give a new optimal algorithm to solve this problem based on automata theoretic techniques. Finally, we prove that the program complexity of the PMC problem against CTL (i.e., the complexity of the problem in terms of the size of the system) is Exptime-complete.

A fixpoint calculus for local and global program flows

We define a new fixpoint modal logic, the visibly pushdown μ-calculus (VP-μ), as an extension of the modal μ-calculus. The models of this logic are execution trees of structured programs where the procedure calls and returns are made visible. This new logic can express pushdown specifications on the model that its classical counterpart cannot, and is motivated by recent work on visibly pushdown languages [4]. We show that our logic naturally captures several interesting program specifications in program verification and dataflow analysis. This includes a variety of program specifications such as computing combinations of local and global program flows, pre/post conditions of procedures, security properties involving the context stack, and interprocedural dataflow analysis properties. The logic can capture flow-sensitive and inter-procedural analysis, and it has constructs that allow skipping procedure calls so that local flows in a procedure can also be tracked. The logic generalizes the semantics of the modal μ-calculus by considering summaries instead of nodes as first-class objects, with appropriate constructs for concatenating summaries, and naturally captures the way in which pushdown models are model-checked. The main result of the paper is that the model-checking problem for VP-μ is effectively solvable against pushdown models with no more effort than that required for weaker logics such as CTL. We also investigate the expressive power of the logic VP-μ: we show that it encompasses all properties expressed by a corresponding pushdown temporal logic on linear structures ( caret [2]) as well as by the classical μ-calculus. This makes VP-μ the most expressive known program logic for which algorithmic software model checking is feasible. In fact, the decidability of most known program logics (μ-calculus, temporal logics LTL and CTL, caret , etc.) can be understood by their interpretation in the monadic second-order logic over trees. This is not true for the logic VP-μ, making it a new powerful tractable program logic.

Aggregation in memory of episodic influences on rule-guided decisions.

The authors confirmed E. Z. Rothkopf and M. L. Dashen's (1995) finding that specific problem context, such as thematic surface features, forms associative connections with deep problem features and thus speeds particular decisions (particularization). In 5 experiments, using a 3-bit decision task and pre-memorized decision rules, the authors found that the ability of a situational context to reinstate was decreased by its replacement by another modal surface context. Context reinstatement, as measured by decision speed, depended on both global and recent local densities of specific problem features linked to a particular decision. The authors' results are consistent with J. R. Anderson and L. J. Schooler's (1991) needs/odds analysis and suggest a push-down file model for diverse context influences as a mechanism for responding to changing situational demands.