Model Checking Recursive Programs with Numeric Data Types

Abstract

Abstract. Pushdown systems (PDS) naturally model sequential recursive programs. Numeric data types also often arise in real-world programs. We study the extension of PDS with unbounded counters, which naturally model numeric data types. Although this extension is Turingpowerful, reachability is known to be decidable when the number of reversals between incrementing and decrementing modes is bounded. In this paper, we (1) pinpoint the decidability/complexity of reachability and linear/branching time model checking over PDS with reversal-bounded counters (PCo), and (2) experimentally demonstrate the effectiveness of our approach in analysing software. We show reachability over PCo is NP-complete, while LTL is coNEXP-complete (coNP-complete for fixed formulas). In contrast, we prove that EF-logic over PCo is undecidable. Our NP upper bounds are by a direct poly-time reduction to satisfaction over existential Presburger formulas, allowing us to tap into highly optimized solvers like Z3. Although reversal-bounded analysis is incomplete for PDS with unbounded counters in general, our experiments suggest that some intricate bugs (e.g. from Linux device drivers) can be discovered with a small number of reversals. We also pinpoint the decidability/complexity of various extensions of PCo, e.g., with discrete clocks.

The Complexity of Reversal-Bounded Model-Checking

“…The recent work [16] is also closely related to our paper. We are grateful to an anonymous referee for pointing it to us.…”

“…We are grateful to an anonymous referee for pointing it to us. Our work and [16] have been done independently but most of our results can be reproved by extending [16]. In [16], operational models extending pushdown systems with counters and clocks are considered; a version of reversal-bounded LTL model-checking is shown to be coNExpTime [16, Theorem 2].…”

“…In [16], operational models extending pushdown systems with counters and clocks are considered; a version of reversal-bounded LTL model-checking is shown to be coNExpTime [16, Theorem 2]. A prototypical implementation and experimental results are also presented in [16]. LTL dialect contains only control states and guards are Boolean combinations of constraints of the form x ∼ k. By contrast, models are more general than ours.…”

Witness Runs for Counter Machines

“…Results about model-checking reversal-bounded counter systems with LTL equipped with arithmetical constraints can be found in [BD11,HL11]. Below, we recall the definition for the reversal-bounded model-checking problem (RBMC).…”

“…Examples include reversal-bounded counter machines (which have a bound on the number of reversals) [HR87,BD11,HL11], context-bounded model-checking (where there is a bound on the number of context switches) [QR05], and of course bounded model-checking (BMC) (where there is a bound on the distance of the reached positions), see e.g. [BCC + 03].…”