Efficient Algorithms for Model Checking Pushdown Systems

We study model checking problems for pushdown systems and linear time logics. We show that the global model checking problem (computing the set of configurations, reachable or not, that violate the formula) can be solved in $O({g_{\cal P}}{g_{\cal P}}^3{g_{\cal B}}{g_{\cal B}}^3)$ time and $O({g_{\cal P}}{g_{\cal P}}^2{g_{\cal B}}{g_{\cal B}}^2)$ space, where ${g_{\cal P}}{g_{\cal P}}$ and ${g_{\cal B}}{g_{\cal B}}$ are the size of the pushdown system and the size of a Büchi automaton for the negation of the formula. The global model checking problem for reachable configurations can be solved in $O({g_{\cal P}}{g_{\cal P}}^4{g_{\cal B}}{g_{\cal B}}^3)$ time and $O({g_{\cal P}}{g_{\cal P}}^4{g_{\cal B}}{g_{\cal B}}^2)$ space. In the case of pushdown systems with constant number of control states (relevant for our application), the complexity becomes $O({g_{\cal P}}{g_{\cal P}}{g_{\cal B}}{g_{\cal B}}^3)$ time and $O({g_{\cal P}}{g_{\cal P}}{g_{\cal B}}{g_{\cal B}}^2)$ space and $O({g_{\cal P}}{g_{\cal P}}^2{g_{\cal B}}{g_{\cal B}}^3)$ time and $O({g_{\cal P}}{g_{\cal P}}^2{g_{\cal B}}{g_{\cal B}}^2)$ space, respectively. We show applications of these results in the area of program analysis and present some experimental results.