Pushdown Specifications

Transcription

1 Orna Kupferman Hebrew University Pushdown Speifiations Nir Piterman Weizmann Institute of Siene une 9, 2002 Moshe Y Vardi Rie University Abstrat Traditionally, model heking is applied to finite-state systems and regular speifiations While researhers have suessfully extended the appliability of model heking to infinite-state systems, almost all existing work still onsider regular speifiation formalisms There are, however, many interesting non-regular properties one would like to model hek In this paper we study model heking of pushdown speifiations Our speifiation formalism is nondeterministi pushdown parity tree automata (PD-NPT) We show that the model-heking problem for regular systems and PD-NPT speifiations an be solved in time exponential in the system and the speifiation Our model-heking algorithm involves a new solution to the nonemptiness problem of nondeterministi pushdown tree automata, where we improve the best known upper bound from a tripleexponential to a single exponential We also onsider the model-heking problem for ontext-free systems and PD-NPT speifiations and show that it is undeidable Address: Shool of Computer Siene and Engineering, Hebrew University, erusalem 91904, Israel orna@shujiail Department of Computer Siene and Applied Mathematis, Weizmann institute, Rehovot 76100, Israel nirp@wisdomweizmannail Address: Department of Computer Siene, Rie University, Houston T , USA vardi@srieedu

2 1 Introdution One of the most signifiant developments in the area of formal design verifiation is the disovery of algorithmi methods for verifying on-going behaviors of reative systems [QS81, LP85, CES86, VW86] In model-heking, we verify the orretness of a system with respet to a desired behavior by heking whether a mathematial model of the system satisfies a formal speifiation of this behavior (for a survey, see [CP00]) Traditionally, model heking is applied to finite-state systems, typially modeled by labeled state-transition graphs, and to behaviors that are formally speified as temporal-logi formulas or automata on infinite objets Symboli methods that enable model-heking of very large state spaes, and the great ease of use of fully algorithmi methods, led to industrial aeptane of model-heking [BLM01, CFF 01] In reent years, researhers have tried to extend the appliability of model-heking to infinite-state systems An ative field of researh is model-heking of infinite-state sequential systems These are systems in whih eah state arries a finite, but unbounded, amount of information, eg, a pushdown store The origin of this researh is the result of Müller and Shupp that the monadi seond-order theory of ontext-free graphs is deidable [MS85] As the omplexity involved in that deidability result is nonelementary, researhers sought deidability results of elementary omplexity Various algorithms for simpler logis and more general systems have been proposed The most powerful result so far is an exponential-time algorithm by Burkart for model heking formulas of the -alulus with respet to prefix-reognizable graphs [Bur97b] also [BS95, Cau96, Wal96, BE96, BQ96, BEM97, Bur97a, FWW97, BS99, BCMS00, KV00] and a short summary in [Tho01] An orthogonal line of researh onsiders the appliability of model heking to infinite-state speifiations Almost all existing work on model heking onsiders speifiation formalisms that define regular sets of words, trees, or graphs: formulas of LTL, -alulus, and even monadi-seond order logi an all be translated to automata [Bü62, Rab69, E91], and in fat many model-heking algorithms (for both finitestate and infinite-state systems) first translate the given speifiation into an automaton and reason about the struture of this automaton (f, [VW86, BEM97, KV00]) Sometimes, however, the desired behavior is non-regular and annot be speified by a finite-state automaton Consider for example the property is inevitable, for a proposition That is, in every omputation of the system, eventually holds Clearly, this property is regular and is expressible as in both CTL [CES86] and LTL [Pnu77] On the other hand, the property is uniformly inevitable, namely, there is some time suh that in every omputation of the system, holds at time, is not expressible by a finite automaton on infinite trees [Eme87], and hene, it is non-regular As another example, onsider a system that handles requests and aknowledgments, and the property every aknowledgment is preeded by some request Again, this property is regular and is expressible in LTL as On the other hand, onsider the property of no redundant aknowledgments, namely the number of aknowledgments does not exeed the number of requests The tehnique of [Eme87] an be used in order to show that the property is non-regular More examples to useful non-regular properties are given in [SCF84], where the speifiation of unbounded message buffers is onsidered The need to speify non-regular behaviors led Bouajjani et al [BER94, BEH95] to onsider logis that are a ombination of CTL and LTL with Presburger Arithmeti The logis, alled PCTL and PLTL, use variables that range over natural numbers The variables are bound to the ourrenes of state formulas and omparison between suh variables is allowed The non-regular properties disussed above an be speified in PCTL and PLTL For example, we an speify uniform inevitability in PCTL as!#" $%('),+-!/ 1023, where the quantifier quantifies over natural numbers, the quantifier quantifies over omputations of the system, and the ombinator!4"$%('5)+ binds the variable! to ount the number of ourrenes of the state formula $6%7') Bouajjani et al onsider the model-heking problem for the logis PCTL and PLTL over finite-state (regular) systems and over infinite-state (non-regular) systems The logis turned 1 See

3 out to be too strong: the model-heking of both PCTL and PLTL over finite-state systems is undeidable They proeed to restrit the logis to fragments for whih model-heking over finite-state systems and ontext-free systems is deidable Uniform inevitability is learly expressible by a nondeterministi pushdown tree automaton Pushdown tree automata are finite-state automata augmented by a pushdown store Like a nondeterministi finite-state tree automaton, a nondeterministi pushdown tree automaton starts reading a tree from the root At eah node of the tree, the pushdown automaton onsults the transition relation and splits into independent opies of itself to eah of the node s suessors Eah opy has an independent pushdown store that diverges from the pushdown store of the parent We then hek what happens along every branh of the run tree and determine aeptane In order to express uniform inevitability, the automaton guesses the time, pushes elements into the pushdown store, and, along every omputation, pops one element with every move of the system When the pushdown store beomes empty, the automaton requires to hold Similarly, in order to express no redundant aknowledgments, a nondeterministi pushdown tree automaton an push an element into the pushdown store whenever the system sends a request, pop one element with every aknowledgment, and rejet the tree when an aknowledgment is issued when the pushdown store is empty In [PI95], Peng and Iyer study more properties that are non-regular and propose to use nondeterministi pushdown tree automata as a strong speifiation formalism The model studied by [PI95] is empty store: a run of the automaton is aepting if the automaton s pushdown store gets empty infinitely often along every branh in the run tree In this paper we study the model-heking problem for speifiations given by nondeterministi pushdown tree automata We onsider both finite-state (regular) and infinite-state (non-regular) systems We show that for finite-state systems, the model-heking problem is solvable in time exponential in both the system and the speifiation, even for nondeterministi pushdown parity tree automata a model that is muh stronger than the one studied in [PI95] On the other hand, the model-heking problem for ontextfree systems is undeidable already for a weak type of pushdown tree automata Note that by having tree automata as our speifiation formalism, we follow here the branhing-time paradigm, where the speifiation desribes allowed omputation trees and a system is orret if its omputation tree is allowed [CES86] In Remark 42, we disuss the undeidability of the linear-time paradigm, and the reasons that make the (seemingly more general) branhing-time framework deidable In order to solve the model-heking problem for nondeterministi pushdown tree automata and finitestate systems, we use the automata theoreti approah to branhing time model heking [KVW00] In [KVW00], model heking is redued to the emptiness problem for nondeterministi finite tree automata, here we redue the model heking problem to the emptiness problem for nondeterministi pushdown tree automata The first to show that this emptiness problem is deidable were Harel and Raz [HR94] The automata onsidered by Harel and Raz use the Bühi aeptane ondition, where some states are designated as aepting states and a run is aepting if it visits the aepting states infinitely often along every branh in the run tree It is shown in [HR94] that the problem an be solved in triple-exponential time Reall that Peng and Iyer [PI95] onsider a simpler aeptane ondition, where a run is aepting if the automaton s pushdown store gets empty infinitely often along every branh in the run tree For this aeptane ondition, it is shown in [PI95] that the nonemptiness problem an be solved in exponential time Nevertheless, empty store pushdown automata are stritly weaker than nondeterministi Bühi pushdown tree automata [PI95] and the algorithm in [PI95] annot be extended to handle the Bühi aeptane ondition The main result of this paper is an exponential algorithm for the emptiness problem of nondeterministi parity pushdown tree automata Thus, apart from improving the known triple-exponential upper bound to a single exponential, we handle a more general aeptane ondition Our algorithm is based on a redution 2

4 of the emptiness problem to the membership problem for two-way alternating parity tree automata with no pushdown store We note that our tehnique an be applied also to speifiations given by alternating pushdown parity tree automata Indeed, the automata-theoreti approah to branhing-time model heking involves some type of a produt between the system and the speifiation automaton, making alternation as easy as nondeterminism [KVW00] In Remark 43, we disuss this point further, and also show that, unlike the ase of regular automata, alternating pushdown automata are stritly more expressive than nondeterministi pushdown tree automata One one realizes that the diffiulties in handling the pushdown store of the tree automaton are similar to the diffiulties in handling the pushdown store of infinite-state sequential systems, it is possible to solve the nonemptiness problem for pushdown automata with various methods that have been suggested for the latter In partiular, it is possible to redue the nonemptiness problem for nondeterministi pushdown parity tree automata to the -alulus model-heking problem for pushdown systems [Wal01] The solution we suggest here is the first to suggest the appliation of methods developed for reasoning about infinite-state sequential systems to the solution of automata-theoreti problems for pushdown automata In partiular, we believe that methods based on two-way alternating tree automata [KV00, KPV02] are partiularly appropriate for this task, as the solution stays in the lean framework of automata Finally, in order to show the undeidability result, we redue the problem of deiding whether a twoounter mahine aepts the empty tape to the model-heking problem of a ontext-free system with respet to a nondeterministi pushdown tree automaton Intuitively, the pushdown store of the system an simulate one ounter, and the pushdown store of the speifiation an simulate the seond ounter The study of pushdown speifiations ompletes the piture desribed in the table in Figure 1 regarding model heking of regular and ontext-free systems with respet to regular and pushdown speifiations When both the system and the speifiation are regular, the setting is that of traditional model heking [CP00] When only one parameter has a pushdown store, the problem is still deidable Yet, when both the system and the speifiation have a pushdown store, model heking beomes undeidable The omplexities in the table refer to the ase where the speifiation is given by a nondeterministi or an alternating parity tree automaton of size and index The size of the system is Regular Speifiations Pushdown Speifiations Regular Systems deidable; ( [ES93] deidable; [Theorem 41] Pushdown Systems deidable; [KV00] undeidable [Theorem 51] Figure 1: Model heking regular and pushdown systems and speifiations!! "!! - 2 Definitions 21 Trees iven a finite set of diretions, an -tree is a set suh that if!, where and!, then also! The elements of are alled nodes, and the empty word is the root of For every and!, the node is the parent of! and! is a suessor of If!! " then is a desendant of Eah node!$# % of has a diretion in The diretion of the root is the symbol (we assume that '# ) The diretion of a node ( is We denote by ), + -! the diretion of the node An -tree is a full infinite tree if, A path of a tree is a set - suh that /- and for every 3

5 ] A ] A!$ - there exists a unique $ suh that 6! - Note that our definitions here reverse the standard definitions (eg, when, the suessors of the node are and, rather than and iven two finite sets and, a -labeled -tree is a pair where is an -tree and " 0 maps eah node of to a letter in When and are not important or lear from the ontext, we all a labeled tree A tree is regular if it is the unwinding of some finite labeled graph More formally, a transduer is a tuple +, where is a finite set of diretions, is a finite alphabet, is! a finite set of states, #" is an initial state, " 0 is a deterministi transition funtion, and " 0 is a labeling funtion We define " 0 $ in the standard way: 7 and for! and % we have %! -! % Intuitively, a transduer is a labeled finite graph with a designated start node, where the edges are labeled by and ( the nodes are labeled by A -labeled -tree + is regular if there exists a transduer '+, suh that for every!, we have -!3 -! We then say that the size of the regular tree +, denoted ) ), is, the number of states of 22 Alternating two-way tree automata Alternating automata on infinite trees generalize nondeterministi tree automata and were first introdued in [MS87] Here we desribe alternating two-way tree automata For a finite set +, let, -+ be the set of positive Boolean formulas over + (ie, boolean formulas built from elements in + using and / ), where we also allow the formulas $%('5) and ), and, as usual, has preedene over / For a set 5 6+ and a formula 7 8, -+, we say that 5 satisfies 7 iff assigning $%7') to elements in 5 and assigning ) BA to elements in +;:<5 makesba 7 true For a set of diretions, the extension of is the set >= + %@? (we assume K LM that DC FE ) An alternating two-way automaton over -labeled -trees is a tuple HI, where N" "Q is the input alphabet, is a finite set of states, " #0O, P=+ is the transition funtion, L is an initial state, and speifies the aeptane ondition A run of an alternating automaton over a labeled tree + is a labeled tree SR in whih every node is labeled by an "T element of A node in R, labeled by -!, desribes a opy of the automaton that is in the state and reads the node! of Note that many nodes of UR an orrespond to the same node of ; there is no one-to-one orrespondene between the nodes of the run and the nodes of the tree "Z is a satisfies the following: The labels of a node and its suessors have to satisfy the transition funtion Formally, a run VR WR -labeled -tree, for some set of diretions, where YR and [R 1 R and ( 2 Consider " SR with " -! \ "@ and -!3 P=+, suh that ] `a satisfies 7, and for all ^, there is suh that b " R and the following hold: If ^, then `b " ^! If ^, then `b " -! If ^, then!, for some and, and `b " 7 Then there is a (possibly empty) set Thus, A -transitions leave the automaton on the same node of the input tree, and -transitions take it up to the parent node Note that the automaton annot go up the root of the input tree, as whenever ^, we require that! # 4

6 L E # ' L % ' E ' E is aepting if all its infinite paths satisfy the aeptane ondition We onsider here Bühi and parity aeptane L onditions [Bü62, E91] A parity ondition over a state set is a finite sequene of subsets of, where L L The number of sets is alled and an infinite path - %R, let -5 be suh that A run [R L L the index of iven a run SR "@ -5 if and only if there are infinitely many "- for whih " That is, -5 ontains exatly all the states that appear infinitely often in - A path - L satisfies the parity ondition if there is an even suh that L -5 C 'E and for all, we have L -5 C 'E A Bühi aeptane ondition L onsists of a set L L M and it an be viewed as a speial ase of a parity ondition of index 3, where Thus, a run is aepting aording to the Bühi ondition L if every path in the run L visits infinitely often An automaton aepts a labeled tree if there exists a run that aepts it We denote by the set of all -labeled trees that aepts The automaton is nonempty iff # E An automaton is 1-way if it does not use A -transitions nor -transitions Formally, an automaton is 1- way if for every state and letter the transition 5 is restrited to formulas in An automaton is nondeterministi if in every transition exatly one opy of the automaton is sent in every diretion in Formally, an automaton is nondeterministi if for every state and letter there exists some set! #"%$!! ) $ suh that 5 (' Equivalently, we an desribe the transition " \ funtion of a nondeterministi 5 automaton 64 as " 0,+-0/ 1,/ 2 The tuple 5 is equivalent to the disjunt K! P " 87 " 89 " ;: We use aronyms in to denote the different types of automata The first symbol stands for the type of movement of the automaton: 1 stands for 1-way automata (we often omit the 1) and 2 stands for 2-way automata The seond symbol stands for the branhing mode of the automaton: % for alternating and 7 for nondeterministi The third symbol stands for the type of aeptane used by the automaton: for Bühi and 9 for parity, and the last symbol stands for the objet the automaton is reading: : for words (not used in this paper) and for trees For example, a 2APT is a 2-way alternating parity tree automaton and an NPT is a 1-way nondeterministi parity tree automaton Theorem 21 iven a 2APT with states and index, we an onstrut an equivalent NPT whose number of states is 8<+>= 2 and whose index is linear in [Var98], and we an hek the nonemptiness of in time <+ +?= 2A@82 [ES93] The membership problem of a 2APT and a regular tree + is to deide whether + B As desribed in Theorem 22 below, the membership problem an be redued to the emptiness problem Theorem 22 The membership problem of a regular tree + and a 2APT with states and index is solvable in time <C+A+?= 2 (K LM Proof: Aording to Theorem 21, we onstrut a 1NPT D HI that aepts the language of The number of states of D ] is exponential in and its index is linear in Let H+ be the transduer generating, with FE > " ] K L Consider the NPT D H \ 8! 3 where '7 'E! ('7 and 'IH (' H It is easy to see that D # E iff + B D As D K, we are done Note that the number of states of 7 is <+>= 2 and its index is linear in Thus, emptiness of 7 an be determined in time 8<+A+>= 2 One we translate to D, the redution above is similar the one desribed in [KVW00] The translation of to D, however, involves an exponential blow up In the full version of [KPV02] we show that the 5

7 L " 9 9 " E membership problem for 2ABT is EPTIME-hard Thus, the membership problem for 2APT is EPTIMEomplete 23 Pushdown tree automata Pushdown tree automata are finite-state automata augmented by a pushdown store Like a nondeterministi finite-state tree automaton, a nondeterministi pushdown tree automaton starts reading a tree from the root At eah node of the tree, the pushdown automaton onsults the transition relation and sends independent opies of itself to eah of the node s suessors Eah opy has an independent pushdown store that diverges from the pushdown store of the parent We then hek what happens along every branh of the run tree and determine aeptane Let ) T and E Formally, a nondeterministi parity 89 pushdown L tree automaton (with -transitions) over infinite -trees (or PD-NPT for short) is, where is a finite input alphabet 9? 0? + % + %! is a finite set of pushdown symbols is a finite set of states is an initial state < is an initial pushdown store ontent 9;" Ï T? is a transition funtion suh that for every state 8 and symbol %,, we have, for, and Intuitively, when the automaton is in state, reading a node labeled by N, and the pushdown store ontains a word in %, it an apply one of the following two types of transitions An -transition in 9 " %, where the automaton stays in node! Aordingly, - eah -transition is a pair One the automaton hooses a pair, it moves to state, and updates the pushdown store by removing % and pushing 8 An advaning transition in %, where the automaton splits into ) opies, eah reading a different suessor of 9F" the node! Aordingly, eah advaning transition is a tuple E E7 One the automaton hooses a tuple, it splits into ) opies, the th opy moves to the node! in the input tree, hanges to state, and updates the pushdown store by removing % and pushing HI We assume that the bottom symbol on the pushdown store is This symbol annot be removed (so, when we say that the pushdown store is empty, we- mean that it ontains only ) Every transition that removes also pushes it bak Formally, if, then 8 Similarly, if E E7, then, for all ) The symbol is not used in another way The size of the transition funtion is the sum of all the lengths of the words used in the funtion ) ) ) ) ) ) ) ) # ) Formally,, E! + " + is a parity ondition over 9 6

8 L E 9 # We note that the automata defined above assume input trees with a fixed and known branhing degree, and an distinguish between the different suessors of the node (say, impose a requirement only on the leftmost suessor) In many ases, it is useful to onsider symmetri tree automata [W95], whih refer to the suessors of a node in a universal or an existential manner, and thus an handle trees with unknown and varying branhing degrees While symmetry is naturally defined for alternating automata, it an also be defined for nondeterministi automata [KV01], and for PD-NPT Example 23 In Setion 1, we mentioned the non-regular property is uniformly inevitable, namely there is some time suh that > hold at time > in all the KL omputations L We now desribe > a PD-NPT for the property We define'(, where! is suh that and has to be visited only finitely often, and the transition funtion is as follows 8, 8 8! 8,! >8 3 8!! H,! > H, and Intuitively, starts reading the tree in state with empty pushdown store It stays in state taking - transitions while pushing s into the pushdown store In some stage, takes a nondeterministi hoie to move to state 3, from whih it proeeds with advaning transitions while removing s from the pushdown store When the pushdown store beomes empty, takes an advaning transition to state while heking that the label it reads is indeed A run of the PD-NPT on an infinite tree + "[R labeled by -! represents a opy of! in + Formally, ( ( following holds There is a unique suessor ^! of! in R suh that ^! "9;" is an + -labeled IN-tree SR A node in state, with pushdown store ontent, reading node, and for all!% R suh that -!3 " %, one of the There are ) suessors! )! of! in UR suh that for all ^ H " H H for some E E6 " % SR, we define + -5 " iven a path - many L nodes $ " L - for whih " L " for some ), we have ^,!3 % + -5 if and only if there are infinitely (" to be suh that As with 2APTs, a path satisfies the parity ondition LC if there is an even suh that + -5 C E and for all, we have + -5C E A run is aepting if every path - $ is aepting A PD-NPT aepts a tree if there exists an aepting run of over The language of, denoted ontains all trees aepted by The PD-NPT is empty if 6E Harel and Raz onsider only the Bühi aeptane ondition (PD-NBT for short) They showed that the emptiness problem of PD-NBT an be redued to the emptiness problem of a PD-NBT with one-letter input alphabet [HR94] The parity aeptane ondition is more general than the Bühi aeptane ondition The following theorem generalizes the result of [HR94] to PD-NPT 7

9 9 Theorem 24 The emptiness problem for a PD-NPT with states, index, and input alphabet, is reduible to the emptiness problem for a PD-NPT with states and index that has a one-letter input alphabet Note that sine our automata have -transitions, we annot use the 89 lassial L redution to one-letter input alphabet [Rab69] >89 For a nondeterministi PP-L tree automaton D I, Rabin onstruts the automaton D suh that for every state 8 we have 5 Thus, guesses whih of the input letters labels the node and hooses a state in 5 For automata with -transitions, we have to make sure that suessor states that read the same node guess the same label for the node, and we augment the automaton with a mehanism that remembers the guessed input letter 3 The Emptiness Problem of PD-NPT In this setion we give an algorithm to deide the emptiness of a PD-NPT Aording to Theorem 24, we an restrit attention to PD-NPT with one-letter input alphabet We redue the emptiness of a PD-NPT with one-letter input alphabet to the membership of a regular tree in the language of a 2APT The idea behind the onstrution is that sine the one-letter tree is homogeneous, the loation of a opy of in the input tree is not important Aordingly, when a opy of simulates a opy of, it does not are about the loation on the input tree, and it has to remember only the state of the opy and the ontent of the pushdown store It is easy for a opy of to remember a state of How an remember the ontent of the pushdown store? Let denote the pushdown alphabet of Note that the ontent of the pushdown store of orresponds to a node in the full infinite -tree So, if reads the tree, it an refer to the loation of its reading head in as the ontent of the pushdown store We would like to know the loation of its reading head in A straightforward way to do so is to label a node! by! This, however, involves an infinite! # E ) ' alphabet, and results in trees that are not regular Sine does not read the entire pushdown store s ontent and (in eah transition) it only reads the top symbol on the pushdown store, it is enough to label by its diretion P Let be the labeled -tree suh that for every!, we have -! ), + -!3 Note that is a regular tree of size We redue the emptiness of a one-letter PD-NPT to the membership problem of in the language of a 2APT iven a PD-NPT we onstrut a 2APT suh that # E iff The 2APT memorizes a ontrol state of the PD-NPT as part of its finite ontrol When it has to apply some transition of, it onsults its finite ontrol and the label of the tree Knowing the state of and the top symbol of the pushdown store, the 2APT an deide whih transition of to apply Moving to a new state of is done by hanging the P state of the 2APT Adjusting the pushdown store s ontent is done by navigating to a new loation in > 89 P L Theorem 31 iven a one-letter PD-NPT O with states and index, there exists a 2APT with states and index suh that iff B > 89 K L As before, let and $ L E Formally, given the PD-NPT H, we onstrut the 2APT H, where 9;" (' where is the set of all suffixes of words!8 for whih one of the following holds 8

10 2 9 2 b 9 " "! 2 E There are states E There are states! < E7 E, words 8 E%, and a letter b suh that and! for some ) and a letter b suh that!3 b Intuitively, when visits a node!% in state, it heks that with initial onfiguration "!3 aepts the one-letter -tree In partiular, when ", then with initial onfiguration!3 needs to aept the one-letter -tree States of the form are P alled ation states From these states onsults in order to impose States of the form, for " 1, are alled navigation states new requirements on From these states only navigates downward " to reah new ation states < one-letter -tree Thus, in its initial state heks that with initial onfiguration The transition funtion is defined for every state ) + 9 " (' and %, < aepts the as follows A A B, % ) # ) / ) ) ) ) ) ) + +A , % Thus, in ation states, reads the diretion of the urrent node and applies a transition from In navigation states, needs to go downward to, so it ontinues in diretion L L " Note that only ation states an be aepting states P $ We show that aepts iff aepts the one letter -tree Let + denote the labeled tree suh that for all!, we have -! Claim 32 # E iff P B Proof: We have to work with four different trees We have a PD-NPT and a 2APT, eah has an input tree and a run tree We introdue a speial notation as follows 1 Let 2 Let 3 Let 4 Let H+ P denote the input tree read by denote the input tree read by denote the run tree of and its labeling denote the run tree of and its labeling Assume first that Then, there exists an aepting run of on and, we have to onstrut an aepting run tree of on! labeled by -!3 " b Reall that! stands for a opy of store ontent b, reading node " We assoiate with! a node! labeled by `b `b iven Consider a node in state with pushdown 9

11 Reall that! stands for a opy of is in state, reading node b state of The pushdown store ontent of is the loation of in We prove by indution that we an build < labeled by ( 2( The root / Both nodes are labeled by the in suh a way We start from the root is labeled by ( 2( The behavior of the 2APT is deterministi until it reahes the next ation state Thus, there is some! labeled by -! whih serves as the base ase for the indution iven a node! labeled by -!3 " %, by the indution assumption it is assoiated V with a node! labeled by -! % Suppose! has one suessor ^! labeled by ^!3 ", that resulted from the transition - A % Then there is a disjunt % We add ^! to, the unique suessor of!, and label it ^ (! Obviously, this satisfies Again the behavior below ^ 7! is V deterministi until reahing a node (! labeled by (! B, Suppose! has ) suessors ^,! ^ E! labeled by ^!3 ", that 8 resulted from the transition E E6 % Then there is a disjunt " E A - in % We add ^! ^ E! to as the suessors of!, and label them ^! `b Obviously, this satisfies The behavior, of eah B path below ^! is deterministi until reahing some node! labeled by! We have to show now that is aepting Take an infinite path - Clearly, - visits infinitely many ation states Every ation state and the node it labels, is assoiated by the onstrution with a node in It is quite lear that this sequene of nodes in forms a path - Hene if - L satisfies, it is also the ase that - LK satisfies Assume now that aepts There exists an aepting run of on We onstrut an aepting run of on We onvert the set of nodes in labeled by ation states of to the tree We update the loation of in aording to the number of suessors of eah ation state One suessor mathes an -move and ) suessors math a forward move Formally, we assume by indution that every node! labeled by -! is assoiated with some node! labeled by -!3 " for some node " As before the root of < < is labeled by ( ( It has some desendant! labeled by -! We label the root by ( ( This serves as the indution base iven some node! labeled by -! %, by indution assumption there is a node! labeled by -! " % A Suppose! has one suessor ^! labeled by ^!, that resulted from the disjunt that appears in % Again, there is some desendant /! of ^! that is an ation state V labeled by /! We know that %, we add ^! to, a unique suessor of!, and label it ^! " Note that ^! and! read the same node " ` V Suppose! has ) suessors ^! ^ E! labeled by ^!, that resulted from the disjunt " E A in % V Eah B one of the nodes ^ 6! has a desendant!, 8 that is labeled by the ation state 7! We know that E E7 % 9, We add ^ (! as the suessors of!, and label them ^ 7!3 2 " ^ E 7! to Obviously, this satisfies 10

12 : : : : : Again every path in L has to satisfy is assoiated with the ation states along a path in We onlude that Combining Theorem 31 with Theorems 22 and 24, we get the following Corollary 33 The emptiness problem for a PD-NPT with be solved in time exponential in states, index, and transition funtion an Remark 34 Harel and Raz [HR94] show that the emptiness of stak automata on infinite trees is also deidable Stak automata an read the entire ontents of the stak but an hange the ontent only when standing on the top of the stak They give a doubly exponential redution from the emptiness problem of stak automata to the emptiness problem of pushdown automata As their emptiness of pushdown automata is triple exponential, it indues a five fold exponential algorithm for the emptiness of stak automata on infinite trees that use the Bühi aeptane ondition Thus, our emptiness algorithm indues a triple exponential algorithm for the emptiness of Bühi stak automata We believe that the redution used in [HR94] for Bühi stak automata an be extended to parity stak automata and furthermore that using our tehniques, the emptiness of parity stak automata an be solved in less than triple exponential time 4 Model-Cheking Pushdown Speifiations of Finite-State Systems The model-heking problem is to deide whether a given system satisfies a speifiation In this setion we onsider the ase where the system is finite state and the speifiation is a PD-NPT In order to solve the model-heking problem we ombine the system with the PD-NPT and get a PD-NPT whose language is empty iff the system satisfies the speifiation We use : labeled transition graphs to represent finite-state systems A labeled transition graph is a quadru- : " = " : is a labeled transition relation, and is an initial state We assume that the ple, where : is a (possibly infinite) set of states, = is a finite set of ations, = transition relation is total (ie for every state there exists some ation Q8 and some state suh that ) When 8, we say that is an -suessor of, and is an -predeessor of For a state :, we denote by H =, the system with as its initial state A finite-state system is given as a labeled transition graph with a finite set of states The unwinding of from state indues an infinite tree Every node of the tree is assoiated with some state, the root of is assoiated with state A node! assoiated with Y has 7 = st Y8 suessors, eah assoiated with a suessor of and labeled by the ation suh that 8 The root of is labeled by = As is total, is infinite We say that a system satisfies a tree automaton over the alphabet = if is aepted by 1 The unwinding of a finite labeled transition graph results in a regular tree In order to determine whether satisfies, we have to solve the membership problem of regular trees in the language of a PD- NPT We redue the membership problem to the emptiness problem by a onstrution similar to the one in the proof of Theorem 22 Thus, we onstrut a PD-NPT that either aepts or is empty, and then hek its emptiness 1 There is a slight tehnial diffiulty as in our formalism PD-NPT run on trees with a uniform branhing degrees, while labeled transition graphs are not required to have a uniform outdegree This diffiulty an be finessed by allowing automata on non-uniform trees, as, for example, in [KVW00] 11

13 L E E E E Theorem 41 iven a finite labeled transition graph with states and a PD-NPT with states, index, and transition funtion, the model-heking problem of with respet to is solvable in time exponential in \ 89 L :@ iven a PD-NPT H( and a finite labeled transition graph =, > 896" " : < L we onstrut the PD-NPT H = that is the produt of the two The L states L#" of onsists of triplets of states of, ations of, and states of The aeptane ondition is " : =, where we replae eah set LC by the set L " " : P 8 = The transition funtion maps a triplet to all the -suessors of tagged again by and and to all the -suessors of tagged by suessors of and the ations taken to get to them For tehnial onveniene, we assume that the branhing degree of is uniform and equivalent to the branhing degree of the trees that reads Modifying the algorithm to systems with nonuniform branhing degree is not too ompliated Formally, we have the following 8 8 % % 8 8 $ , E Q8 % E E6 E6 is the set of transitions from It is not hard to see that aepts some tree iff aepts, the unwinding of % and Remark 42 By having PD-NPT as our speifiation formalism, we follow here the branhing-time paradigm to speifiation and verifiation, where the speifiation desribes allowed omputation trees and a system is orret if its (single) omputation tree is allowed Alternatively, in the linear-time paradigm, the speifiation desribes the allowed linear omputations, and the system is orret if all its omputations are allowed When the system is nondeterministi, it may have many omputations, and we have to hek them all Thus, while model heking in the branhing-time paradigm orresponds to membership heking, model heking in the linear-time paradigm orresponds to heking language ontainment Pushdown speifiation formalisms are helpful also in the linear-time paradigm [SCF84] For example, one an use pushdown word automata to speify unbounded LIFO buffers Nevertheless, sine the ontainment problem of regular languages in ontext-free languages is undeidable [HMU00], using pushdown word automata as a speifiation formalism leads to an undeidable model-heking problem even for finite-state systems The branhing-time paradigm is more general than the linear-time paradigm [Lam80, Pnu85] in the sense that we an view a (universally quantified) linear-time speifiation as a branhing-time speifiation This does not ontradit the fat that model heking of pushdown speifiation is deidable in the branhingtime paradigm Indeed, a translation of a nondeterministi pushdown word automaton that reognizes a language into a nondeterministi pushdown tree automata that reognizes the language of all the trees derived by (that is, trees all of whose paths are in ) is not always possible For ases where suh a translation is possible (in partiular, when the pushdown word automaton is deterministi), linear model heking is deidable This is reminisent of the situation with dense-time temporal logi, where model heking with respet to linear-time speifiations is undeidable, while model heking with respet to branhing-time speifiations is deidable, f [ACD93] Remark 43 Unlike the ase of regular tree automata, it an be proved that alternating pushdown automata are stritly more expressive than nondeterministi pushdown automaton For example, it is easy to define a 12

14 ' " '!! '!! ^ " pushdown alternating automaton over words that reognizes the non-ontext-free language ", Indeed, the automaton an send two opies, one for omparing the number of s with s, and one for omparing the number of s with ^ s A similar argument shows that alternating pushdown tree automata are stronger than nondeterministi pushdown tree automata On the other hand, as studied in [KVW00], the membership problem for alternating automata is not harder than the one for nondeterministi automata This observation does not hange when pushdown automata are involved In partiular, it is easy to extend Theorem 31 to alternating automata (without hanging the blow up), and to extend the model-heking algorithm desribed above to the stronger framework of alternating pushdown automata 5 Model-Cheking Pushdown Speifiations of Context-Free Systems In this setion we show that the deidability results of Setion 4 annot be extended to ontext-free systems We show that the model heking problem for ontext-free systems is undeidable already for pushdown path automata, whih are a speial ase of pushdown tree automata We first define ontext-free systems and pushdown path automata Again we use labeled transition graphs This time with an infinite number of states V A rewrite system is a quadruple =, where is a finite alphabet, = is a finite set of ations, maps eah ation to a finite set of rewrite rules, to be defined below, and! is an initial word Intuitively, desribes the possible rules that an be applied #" by taking the ation We onsider here ontext-free rewrite systems Eah rewrite rule is a pair % We refer to rewrite rules in as -rules 8 The rewrite system indues the labeled transition graph =, where -! if there is a rewrite rule in whose appliation on! results in " In partiular, when is a ontextfree rewrite system, then 8 % "! " if % A labeled transition graph that is indued by a ontext-free rewrite system is alled a ontext-free graph ] Consider a labeled transition graph H = 89 K A<L nondeterministi pushdown path automaton on labeled transition graphs is a tuple =, where, 9, <, and are as in nondeterministi pushdown automata on trees, = 9 " is a set of ations (the automaton s alphabet), and " = 0 L is the transition funtion We onsider the simpler ase where is a Bühi aeptane ondition Intuitively, when is in state with % on the pushdown store and it reads a state ' of - 8, the automaton hooses an atom % and moves to some -suessor of ' in state with pushdown store Again we assume that the first symbol in is, and that annot be removed from the pushdown store Like a run of a nondeterministi pushdown automaton on words, a run of a path automaton over a labeled ] ] " 9 " = is an infinite word in A letter (', desribes that transition graph the automaton is in state of with pushdown store ontent reading state ' of Formally, a run is an ] "B9 " infinite sequene (' (' as follows is the initial state of, is the initial state of, and is the initial pushdown store ontent For every there exists some = suh that ' is an -suessor of ' and if 8 % then % and # 13

15 ) ) ^ ^ ] ] ) = H 0 ) = H ) ) A run is aepting if it satisfies the aeptane ondition The graph is aepted by if there is an aepting run on it We denote by the set of all graphs that aepts We use PD-NBP (pushdown nondeterministi Bühi path automata) as our speifiation language We say that a labeled transition graph satisfies a PD-NBP, denoted, if aepts Theorem 51 The model-heking problem for ontext-free systems and pushdown path automata is undeidable Proof: It is well known that the termination problem of a two-ounter mahine is undeidable [Min67] We show that we an redue the problem of whether a two-ounter mahine terminates to the problem of whether a ontext-free graph satisfies a PD-NBP We first define L ] L L $ two-ounter mahines A two ounter mahine is H H H ] R, where is a set of states, and H H L and R are disjoint sets of aepting and rejeting states, respetively We assume that$ one reahes an aepting or rejeting state, it loops there forever A onfiguration of is ] " a triple (' " IN IN, indiating the state of the mahine and the values of the two ounters The transition funtion ] " "@ ) ) 0 " 0 E H E E H E maps a representation of a onfiguration (where the values of the ounters are replaed by flags indiating whether they are equal to zero) into possible transitions of the mahine, where an ation involves a move to a new 3 state ` and possible updates (inrease or derease) to the ounters We write (' 0 (' for 3 (' 0 (' In order to simulate the two-ounter mahine by the ontext-free system and the PD-NBP, we use the state of the ontext-free system (a word in ) to maintain the value of the first ounter, and we use the pushdown store of the PD-NBP to maintain the value of the seond ounter In order to simulate the two ounters, we have to be able to hek whether eah ounter is zero or not, inrease eah ounter, and derease eah ounter Handling of the seond ounter (maintained by the pushdown store of the path automaton) is straightforward: the path automaton an hek whether its pushdown store is empty or not, an push one letter into the pushdown store, and an pop one letter from the pushdown store Handling of the first ounter (maintained by the state of the ontext-free system) is a bit more ompliated The ontext-free system has, and its initial state is The rewrite rules of are suh that all the reahable states of are in The system has five possible ations (whih are also read by the PD-NBP ): ' ) " ', and " ) From the state, the system may apply the ations " ' and " ), thus signaling to the speifiation that its ounter is zero From a state in, the system may apply the ations ',, or ) The value of the first ounter is simulated by the (number of s in the) loation of the PD-NBP on the ontext-free graph In order to apply a transition of from a onfiguration in whih the first ounter equals zero, tries to read the ations " ' or " ) In order to inrease the first ounter, reads the ation ' (or " ' ) Dereasing the ounter and leaving it unhanged is similar The path automaton memorizes the state of in its finite ontrol It aepts if it gets to an aepting state of More formally, the ontext-free system is the following rewrite rules " ' H+ " ) 7 H+ 8 ' 8 > Signal that the ounter is zero and add to the state =, with = as desribed above, and Signal that the ounter is zero and leave the state unhanged Signal that the ounter is not zero and add to the state 14

16 L ) ) ' 0 3 Signal that the ounter is not zero and remove from the state 8 - ) 6 H Signal that the ounter is not zero and leave the state unhanged > ] K L $ The path automaton mimis the two-ounter mahine Formally, = H H? R, where the transition funtion is indued by the transition relation of as follows If (' (' then (' (' %, where If If 3 ", then If ) +U^ then " ) ) If ) +U^, then " ' ", then % Otherwise % 8 " ', if ) ' " ) Otherwise, ' ), if ) ) ^ then, and if ) ) then ) ^, then K, and if ) It is not too diffiult to see that iff terminates ), then We note that path automata are indeed weaker than tree automata Indeed, a PD-NBT an simulate a PD- NBP by sending opies in aepting sinks to all diretions but the diretion to whih the PD-NBP hooses to go It follows that the model heking problem for ontext-free systems and PD-NPT is also undeidable 6 Conlusions We onsider the model-heking problem for speifiations given by pushdown tree automata We desribe an exponential-time algorithm for model heking a finite-state system with respet to a PD-NPT The algorithm onsists of a redution to the emptiness problem of PD-NPT The best upper bound known for the emptiness problem is triple exponential, and we improved it to a single exponential We also show that model heking a ontext-free system with respet to a PD-NPT speifiation is undeidable Referenes [ACD93] R Alur, C Couroubetis, and D Dill Model-heking in dense real-time Information and Computation, 104(1):2 34, May 1993 [BCMS00] O Burkart, D Caual, F Moller, and B Steffen Verifiation on infinite strutures Unpublished manusript, 2000 [BE96] O Burkart and Esparza More infinite results Eletroni Notes in Theoretial Computer Siene, 6, 1996 [BEH95] [BEM97] A Bouajjani, R Ehahed, and P Habermehl On the verifiation problem of nonregular properties for nonregular proesses In Pro 10th annual IEEE Symposium on Logi in Computer Siene, pages , San Diego, CA, USA, une 1995 IEEE omputer soiety press A Bouajjani, Esparza, and O Maler Reahability analysis of pushdown automata: Appliation to model-heking In Pro 8th Conferene on Conurreny Theory, volume 1243 of Leture Notes in Computer Siene, pages , Warsaw, uly 1997 Springer-Verlag 15

17 [BER94] [BLM01] [BQ96] [BS95] A Bouajjani, R Ehahed, and R Robbana Verifiation of nonregular temporal properties for ontext-free proesses In Pro 5th International Conferene on Conurreny Theory, volume 836 of Leture Notes in Computer Siene, pages 81 97, Uppsala, Sweden, 1994 Springer-Verlag P Biesse, T Leonard, and A Mokkedem Finding bugs in an alpha miroproessors using satisfiability solvers In Computer Aided Verifiation, Pro 13th International Conferene, volume 2102 of Leture Notes in Computer Siene, pages Springer-Verlag, 2001 O Burkart and Y-M Quemener Model heking of infinite graphs defined by graph grammers In Pro 1st International workshop on verifiation of infinite states systems, volume 6 of ENTCS, page 15 Elsevier, 1996 O Burkart and B Steffen Composition, deomposition and model heking of pushdown proesses Nordi Comut, 2:89 125, 1995 [BS99] O Burkart and B Steffen Model heking the full modal -alulus for infinite sequential proesses Theoretial Computer Siene, 221: , 1999 [B ü62] R B ühi On a deision method in restrited seond order arithmeti In Pro Internat Congr Logi, Method and Philos Si 1960, pages 1 12, Stanford, 1962 Stanford University Press [Bur97a] [Bur97b] [Cau96] [CES86] O Burkart Automati verifiation of sequential infinite-state proesses In oos, Hartmanis, and van Leeuwen, editors, Leture Notes in Computer Siene, volume 1354 Springer-Verlag, 1997 O Burkart Model heking rationally restrited right losures of reognizable graphs In F Moller, editor, Pro 2nd International workshop on verifiation of infinite states systems, 1997 D Caual On infinite transition graphs having a deidable monadi theory In Automata, Languages, and Programming, Pro 23st ICALP, volume 1099 of Leture Notes in Computer Siene, pages Springer-Verlag, 1996 EM Clarke, EA Emerson, and AP Sistla Automati verifiation of finite-state onurrent systems using temporal logi speifiations ACM Transations on Programming Languages and Systems, 8(2): , anuary 1986 [CFF 01] F Copty, L Fix, R Fraer, E iunhiglia, Kamhi, A Tahella, and MY Vardi Benefits of bounded model heking at an industrial setting In Computer Aided Verifiation, Pro 13th International Conferene, volume 2102 of Leture Notes in Computer Siene, pages Springer-Verlag, 2001 [CP00] EM Clarke, O rumberg, and D Peled Model Cheking MIT Press, 2000 [E91] EA Emerson and C utla Tree automata, -alulus and determinay In Pro 32nd IEEE Symp on Foundations of Computer Siene, pages , San uan, Otober 1991 [ES93] EA Emerson, C utla, and AP Sistla On model-heking for fragments of -alulus In Computer Aided Verifiation, Pro 5th International Conferene, volume 697, pages , Elounda, Crete, une 1993 Leture Notes in Computer Siene, Springer-Verlag [Eme87] EA Emerson Uniform inevitability is tree automaton ineffable Information Proessing Letters, 24(2):77 79, anuary 1987 [FWW97] [HMU00] [HR94] A Finkel, B Willems, and P Wolper A diret symboli approah to model heking pushdown automata In F Moller, editor, Pro 2nd International Workshop on Verifiation of Infinite States Systems, 1997 E Hoproft, R Motwani, and D Ullman Introdution to Automata Theory, Languages, and Computation (2nd Edition) Addison-Wesley, 2000 D Harel and D Raz Deiding emptiness for stak automata on infinite trees Information and Computation, 113(2): , September