A Temporal Logic of Nested Calls and Returns

Abstract

Abstract. Model checking of linear temporal logic (LTL) specifications with respect to pushdown systems has been shown to be a useful tool for analysis of programs with potentially recursive procedures. LTL, however, can specify only regular properties, and properties such as correctness of procedures with respect to pre and post conditions, that require matching of calls and returns, are not regular. We introduce a temporal logic of calls and returns (CaRet) for specification and algorithmic verification of correctness requirements of structured programs. The formulas of CaRet are interpreted over sequences of propositional valuations tagged with special symbols call and ret. Besides the standard global temporal modalities, CaRet admits the abstract-next operator that allows a path to jump from a call to the matching return. This operator can be used to specify a variety of non-regular properties such as partial and total correctness of program blocks with respect to pre and post conditions. The abstract versions of the other temporal modalities can be used to specify regular properties of local paths within a procedure that skip over calls to other procedures. CaRet also admits the caller modality that jumps to the most recent pending call, and such caller modalities allow specification of a variety of security properties that involve inspection of the call-stack. Even though verifying contextfree properties of pushdown systems is undecidable, we show that model checking CaRet formulas against a pushdown model is decidable. We present a tableau construction that reduces our model checking problem to the emptiness problem for a Büchi pushdown system. The complexity of model checking CaRet formulas is the same as that of checking LTL formulas, namely, polynomial in the model and singly exponential in the size of the specification.

Adding Nesting Structure to Words

“…Decision procedures for certain classes of non-regular properties already exist [JMT99, CW02, EKS03, CMM + 04]. The idea of making calls and returns in a recursive program visible to the specification language for writing properties appears implicitly in [JMT99] which proposes a logic over stack contents to specify security constraints, and in [EKS03] which augments linear temporal logic with regular valuations over stack contents, and in our recent work on the temporal logic Caret that allows modalities for matching calls and returns [AEM04]. Also, properties expressing boundedness of stack, and repeatedly boundedness, have received a lot of attention recently [CDT02,BSW03].…”

Alternation Elimination for Automata over Nested Words

“…In [2,4], the respective authors introduce the temporal logics CaRet and NWTL, which extend the classical linear-time temporal logic LTL. The extensions consist of new modalities that take the hierarchical structure of nested words into account.…”

“…As a matter of fact, the translation in [2] is flawed. 4 Instead of directly constructing the NWA from a CaRet or an NWTL formula, we utilize our alternation-elimination scheme. In more detail, we first translate the given formula into an alternating automaton with a Büchi acceptance condition.…”

“…However, it is open whether and which PSL-like extensions [15] of NWTL are capable of expressing all NWA-recognizable languages. 4 A counterexample is given by the NWTL formula ♦ a ff, where ♦ a is the "abstract" version of classical eventually modality ♦ in LTL. The constructed NWA accepts the nested word ∅ ∅ ∅ ω , which is not a model of the formula ♦ a ff since ♦ a ff is unsatisfiable.…”

“…Instead of word automata one uses nested-word automata (NWAs) [6] or equivalently visibly pushdown automata [5], a restricted class of pushdown automata, where the input symbols determine when the pushdown automaton can push or pop symbols from its stack. For instance, model checking regular nested-word properties of recursive state machines, which can model control flows of imperative programs [3,4], and of Boolean programs [7], which are widely used as abstractions in software model checking, can be carried out in an automata-theoretic setting, similar to finite-state model checking [23]. That is, the traces of a recursive state machine or a Boolean program are described by an NWA and the negation of the specification, which is given as a formula in a temporal logic over nested words like CaRet [4], NWTL [2], and μNWTL [10], is translated into a language-equivalent NWA.…”