An Automata-Theoretic Approach to Interprocedural Data-Flow Analysis

Esparza, Javier; Knoop, Jens

doi:10.1007/3-540-49019-1_2

Cited by 66 publications

(54 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In fact, it is well admitted that pushdown automata are adequate models for such kind of threads [EK99,RSJ03], and therefore, it is natural to model recursive concurrent programs as multi-stack automata.…”

Section: Introductionmentioning

confidence: 99%

Model-Checking of Ordered Multi-Pushdown Automata

Atig¹

2012

Logical Methods in Computer Science

View full text Add to dashboard Cite

Abstract. We address the verification problem of ordered multi-pushdown automata: A multi-stack extension of pushdown automata that comes with a constraint on stack transitions such that a pop can only be performed on the first non-empty stack. First, we show that the emptiness problem for ordered multi-pushdown automata is in 2ETIME. Then, we prove that, for an ordered multi-pushdown automata, the set of all predecessors of a regular set of configurations is an effectively constructible regular set. We exploit this result to solve the global model-checking which consists in computing the set of all configurations of an ordered multi-pushdown automaton that satisfy a given w-regular property (expressible in linear-time temporal logics or the linear-time µ-calculus). As an immediate consequence, we obtain an 2ETIME upper bound for the model-checking problem of w-regular properties for ordered multi-pushdown automata (matching its lowerbound).

show abstract

Section: Introductionmentioning

confidence: 99%

Model-Checking of Ordered Multi-Pushdown Automata

Atig¹

2012

Logical Methods in Computer Science

View full text Add to dashboard Cite

show abstract

“…Pushown systems have been proposed as an adequate formalism to describe pure sequential recursive programs [2,3]. They are able to represent the potentially infinite configurations of recursive programs in a symbolic manner using regular languages [4,5].…”

Section: Introductionmentioning

confidence: 99%

“…(3) If the counterexample corresponds to an execution of the program, we conclude that the program does not satisfy the property. (4) Otherwise, we compute a new set of predicates that eliminate future exploration of the spurious trace, and go back to step (2).…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Verifying Concurrent Message-Passing C Programs with Recursive Calls

Chaki

Clarke

Kidd

et al. 2006

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

Abstract. We consider the model-checking problem for C programs with (1) data ranging over very large domains, (2) (recursive) procedure calls, and (3) concurrent parallel components that communicate via synchronizing actions. We model such programs using communicating pushdown systems, and reduce the reachability problem for this model to deciding the emptiness of the intersection of two context-free languages L 1 and L 2 . We tackle this undecidable problem using a CounterExample Guided Abstraction Refinement (CEGAR) scheme. We implemented our technique in the model checker MAGIC and found a previously unknown bug in a version of a Windows NT Bluetooth driver.

show abstract

“…Various connections between dataflow analysis and model checking have been established in past work, e.g., [6,9,23,27,28]; however, with one exception ( [9]), past work has shed light only on the relationship between model checking and bit-vector dataflow-analysis problems, such as live-variable analysis and partial-redundancy elimination. In contrast, the results presented in this paper apply to (i) bit-vector problems, (ii) the one non-bit-vector problem addressed in [9], as well as (iii) certain dataflow-analysis problems that cannot be expressed as bit-vector problems, such as linear constant propagation. In general, the approach can be applied to any distributive dataflow-analysis problem for which the domain of transfer functions has no infinite descending chains.…”

Section: Introductionmentioning

confidence: 99%