Analysis of recursive state machines

Abstract

Recursive state machines (RSMs) enhance the power of ordinary state machines by allowing vertices to correspond either to ordinary states or to potentially recursive invocations of other state machines. RSMs can model the control flow in sequential imperative programs containing recursive procedure calls. They can be viewed as a visual notation extending Statecharts-like hierarchical state machines, where concurrency is disallowed but recursion is allowed. They are also related to various models of pushdown systems studied in the verification and program analysis communities.After introducing RSMs and comparing their expressiveness with other models, we focus on whether verification can be efficiently performed for RSMs. Our first goal is to examine the verification of linear time properties of RSMs. We begin this study by dealing with two key components for algorithmic analysis and model checking, namely, reachability (Is a target state reachable from initial states?) and cycle detection (Is there a reachable cycle containing an accepting state?). We show that both these problems can be solved in time O ( n θ 2 ) and space O ( n θ), where n is the size of the recursive machine and θ is the maximum, over all component state machines, of the minimum of the number of entries and the number of exits of each component. From this, we easily derive algorithms for linear time temporal logic model checking with the same complexity in the model. We then turn to properties in the branching time logic CTL*, and again demonstrate a bound linear in the size of the state machine, but only for the case of RSMs with a single exit node.

Reducing Behavioural to Structural Properties of Programs with Procedures

“…Our research is also related to previous work on tableau systems for the verification of infinite-state systems [6,20], model checking based on pushdown systems [5,7,8] or recursive state machines [2], temporal logics for nested calls and returns [3,1], interprocedural dataflow analysis [18], and abstract interpretation (cf. e.g., the completeness result of [17]).…”

“…In particular, we derived an algorithmic solution to problem (1) stated above (see [11, p. 855]). Here, we give a precise solution to the (considerably more complex) problem (2), showing that every disjunction-free behavioural formula can be characterised by a finite set of structural formulae: a program satisfies the behavioural formula if and only if it satisfies some structural formula from the set. For example, the results of this paper allow to derive that the behavioural property "method a never calls method b" is characterised by the (set of) structural properties "there is no call-to-b instruction in (the text of) method a" and "in (the text of) method a, every call-to-b instruction and every return instruction is preceded by some call-to-a instruction" (and hence, due to recursion, control can never reach a call-to-b instruction).…”

“…We handle recursion by means of a tableau construction that maintains (during the symbolic execution) a symbolic "call stack" indicating which subformulae have been explored for which method. We use this stack to (1) identify when a (sub)formula has been sufficiently explored, so that a branch of the tableau can be finished, and (2) to identify recursion in the collected structural constraints and capture this by fixed-point formulae. We prove that the construction terminates.…”

Alternation Elimination for Automata over Nested Words

“…Instead of word automata one uses nested-word automata (NWAs) [6] or equivalently visibly pushdown automata [5], a restricted class of pushdown automata, where the input symbols determine when the pushdown automaton can push or pop symbols from its stack. For instance, model checking regular nested-word properties of recursive state machines, which can model control flows of imperative programs [3,4], and of Boolean programs [7], which are widely used as abstractions in software model checking, can be carried out in an automata-theoretic setting, similar to finite-state model checking [23]. That is, the traces of a recursive state machine or a Boolean program are described by an NWA and the negation of the specification, which is given as a formula in a temporal logic over nested words like CaRet [4], NWTL [2], and μNWTL [10], is translated into a language-equivalent NWA.…”

Incremental Algorithms for Inter-procedural Analysis of Safety Properties

“…Static analysis tools such as MC/Coverity [1] and Uno [2], and model checking tools such as SLAM [3] are based on inter-procedural algorithms for propagating dataflow information [4,5,6,7]. These algorithms perform a reachability analysis that always starts from scratch.…”