The paper shows how a large class of interprocedural dataflow-analysis problems can be solved precisely in polynomial time by transforming them into a special kind of graph-reachability problem.The only restrictions are that the set of dataflow facts must be a finite set, and that the dataflow functions must distribute over the confluence operator (either union or intersection).

This paper made two main contributions: it defined system dependence graphs (SDGs), which extended program dependence graphs (PDGs) [31,17] to incorporate collections of procedures (with procedure calls) rather than just monolithic programs. It then defined an interprocedural slicing algorithm that identifies the components of the SDG that might affect the values of the variables defined at or used at a given program point Ô, and/or how often Ô executes. The novelty of the algorithm was that it correctly accounts for the calling context of a called procedure, thereby improving on the technique for interprocedural slicing algorithm that had been presented in Mark Weiser's seminal papers on program slicing [47,48].

We present a family of abstract-interpretation algorithms that are capable of determining \shape invariants" of programs that perform destructive updating on dynamically allocated storage. The main idea is to represent the stores that can possibly arise during execution using three-valued logical structures.Questions about properties of stores can be answered by evaluating predicate-logic formulae using Kleene's semantics of three-valued logic:If a formula evaluates to true, then the formula holds in every store represented by the three-valued structure. If a formula evaluates to false, then the formula does not hold in any store represented by the three-valued structure.If a formula evaluates to unknown, then we do not know if this formula always holds, never holds, or sometimes holds and sometimes does not hold in the stores represented by the three-valued structure. Three-valued logical structures are thus a conservative representation of memory stores.The approach described is a parametric framework: It provides the basis for generating a family of shape-analysis algorithms by varying the vocabulary used in the three-valued logic.

We present a family of abstract-interpretation algorithms that are capable of determining "shape invariants" of programs that perform destructive updating on dynamically allocated storage. The main idea is to represent the stores that can passibly arise during execution using three-valued logical structures.Questions about properties of stores can be answered by evaluating predicate-logic formulae using Kleene's semantics of three-valued logic:l If a formula evaluates to true, then the formula holds in every store represented by the three-valued structure.l If a formula evaluates to false, then the formula does not hold in any store represented by the three-valued structure.l If a formula evaluates to unknown, then we do not know if this formula always holds, never holds, or sometimes holds and sometimes does not hold in the stores represented by the three-valued structure.Three-valued logical structures are thus a conservative representation of memory stores. The approach described is a parametric framework: It provides the basis for generating a family of shape-analysis algorithms by varying the vocabulary used in the three-valued logic.Permission to make digital or hard copies of all or parl ufthis work for personal or classroom me is granted withwt fee procided that copies are not made or distrihutcd for profit or cnrnmercinl advantage IIKI that copies bear this notice and the full citation on the first page. To copy otherwise. to republid~, to post on sewers or to redistribute tn lists, requires prior specific permission anJ!or a fee.

Recursive state machines (RSMs) enhance the power of ordinary state machines by allowing vertices to correspond either to ordinary states or to potentially recursive invocations of other state machines. RSMs can model the control flow in sequential imperative programs containing recursive procedure calls. They can be viewed as a visual notation extending Statecharts-like hierarchical state machines, where concurrency is disallowed but recursion is allowed. They are also related to various models of pushdown systems studied in the verification and program analysis communities.After introducing RSMs and comparing their expressiveness with other models, we focus on whether verification can be efficiently performed for RSMs. Our first goal is to examine the verification of linear time properties of RSMs. We begin this study by dealing with two key components for algorithmic analysis and model checking, namely, reachability (Is a target state reachable from initial states?) and cycle detection (Is there a reachable cycle containing an accepting state?). We show that both these problems can be solved in time O ( n θ 2 ) and space O ( n θ), where n is the size of the recursive machine and θ is the maximum, over all component state machines, of the minimum of the number of entries and the number of exits of each component. From this, we easily derive algorithms for linear time temporal logic model checking with the same complexity in the model. We then turn to properties in the branching time logic CTL*, and again demonstrate a bound linear in the size of the state machine, but only for the case of RSMs with a single exit node.