Saturation algorithms for model-checking pushdown systems

Carayol, Arnaud; Hague, Matthew

doi:10.4204/eptcs.151.1

Cited by 14 publications

(11 citation statements)

References 51 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This result is best phrased in terms of Gale-Stewart games, abstract games without an arena [14], as we are interested in the influence of the winning condition on the decidability of solving games. 6 Formally, a Gale-Stewart game G(L) is given by an ω-language L ⊆ (Σ 1 × Σ 2 ) ω . It is played between Player 1 and Player 2 in rounds n = 0, 1, 2, .…”

Section: Theorem 1 ω-Dcfl ω-Gfg-cflmentioning

confidence: 99%

Good-for-games $ω$-Pushdown Automata

Lehtinen,

Zimmermann

2020

Preprint

View full text Add to dashboard Cite

We introduce good-for-games ω-pushdown automata (ω-GFG-PDA). These are automata whose nondeterminism can be resolved based on the run constructed thus far. Good-forgameness enables automata to be composed with games, trees, and other automata, applications which otherwise require deterministic automata. Our main results show that ω-GFG-PDA are more expressive than deterministic ω-pushdown automata and that solving infinite games with winning conditions specified by ω-GFG-PDA is EXPTIME-complete, i.e., we have identified a new class of ω-contextfree winning conditions for which solving games is decidable. This means in particular that the universality problem is in EXPTIME as well. Moreover, we study closure properties of the class of languages recognized by ω-GFG-PDA and decidability of good-for-gameness of ω-pushdown automata and languages.

show abstract

Section: Theorem 1 ω-Dcfl ω-Gfg-cflmentioning

confidence: 99%

Good-for-games $ω$-Pushdown Automata

Lehtinen,

Zimmermann

2020

Preprint

View full text Add to dashboard Cite

show abstract

“…add the transitions Definition D.5. Following Carayol and Hague [7], we call a sequence of transitions p 1 · · · p n productive if the corresponding element p 1 ⊗ · · · ⊗ p n in StackOp Σ is not 0. A sequence is productive if and only if it contains no adjacent terms of the form pop y, push x with x = y.…”

Section: D2 Constructing the Initial Graphmentioning

confidence: 99%

Polymorphic type inference for machine code

Noonan

Loginov

Cok

2016

Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

For many compiled languages, source-level types are erased very early in the compilation process. As a result, further compiler passes may convert type-safe source into type-unsafe machine code. Type-unsafe idioms in the original source and type-unsafe optimizations mean that type information in a stripped binary is essentially nonexistent. The problem of recovering high-level types by performing type inference over stripped machine code is called type reconstruction, and offers a useful capability in support of reverse engineering and decompilation.In this paper, we motivate and develop a novel type system and algorithm for machine-code type inference. The features of this type system were developed by surveying a wide collection of common source-and machine-code idioms, building a catalog of challenging cases for type reconstruction. We found that these idioms place a sophisticated set of requirements on the type system, inducing features such as recursively-constrained polymorphic types. Many of the features we identify are often seen only in expressive and powerful type systems used by high-level functional languages.Using these type-system features as a guideline, we have developed Retypd: a novel static type-inference algorithm for machine code that supports recursive types, polymorphism, and subtyping. Retypd yields more accurate inferred types than existing algorithms, while also enabling new capabilities * such as reconstruction of pointer const annotations with 98% recall. Retypd can operate on weaker program representations than the current state of the art, removing the need for highquality points-to information that may be impractical to compute.

show abstract

“…Remark 2. As pointed out by a reviewer of a previous version of this work, deciding the nilpotency of a unary flow is reminiscent of the problem of acyclicity for the configuration graph of a pushdown system (PDS) [13], a problem known to lie in Ptime [15]. However, our algorithm treats every state of the corresponding PDS as initial, and would detect cycles even in non-connected components: our problem is probably closer to the "uniform halting problem" [34], a problem known to be decidable [14, p. 10].…”

Section: Nilpotency In Stack and Ptime Soundnessmentioning

confidence: 99%

“…Soundness follows from a variation of the saturation algorithm for pushdown systems [13], inspired by S. Cook's memoization technique [17] for pushdown automata, that proves that any such unary logic program can be decided in polynomial time.…”

Section: Introductionmentioning

confidence: 99%

Unary Resolution: Characterizing Ptime

Aubert¹,

Bagnol²,

Seiller³

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We give a characterization of deterministic polynomial time computation based on an algebraic structure called the resolution semiring, whose elements can be understood as logic programs or sets of rewriting rules over first-order terms. This construction stems from an interactive interpretation of the cut-elimination procedure of linear logic known as the geometry of interaction. This framework is restricted to terms (logic programs, rewriting rules) using only unary symbols, and this restriction is shown to be complete for polynomial time computation by encoding pushdown automata. Soundness w.r.t. Ptime is proven thanks to a saturation method similar to the one used for pushdown systems and inspired by the memoization technique. A Ptime-completeness result for a class of logic programming queries that uses only unary function symbols comes as a direct consequence.

show abstract

Saturation algorithms for model-checking pushdown systems

Abstract: We present a survey of the saturation method for model-checking pushdown systems.Comment: In Proceedings AFL 2014, arXiv:1405.527

Cited by 14 publications

References 51 publications

Good-for-games $ω$-Pushdown Automata

Good-for-games $ω$-Pushdown Automata

Polymorphic type inference for machine code

Unary Resolution: Characterizing Ptime

Contact Info

Product

Resources

About