Bounded Underapproximations

TL;DR

This paper introduces a constructive method to find bounded context-free subsets with the same Parikh image as any given language, enabling decidable underapproximations for complex program state spaces in model checking.

Contribution

It provides a new proof and construction for bounded underapproximations of context-free languages with applications in model checking of multithreaded and recursive programs.

Findings

Constructs bounded context-free subsets with same Parikh image as original language.

Enables decidable underapproximations for program state reachability.

Subsumes context-bounded reachability in multithreaded programs.

Abstract

We show a new and constructive proof of the following language-theoretic result: for every context-free language L, there is a bounded context-free language L' included in L which has the same Parikh (commutative) image as L. Bounded languages, introduced by Ginsburg and Spanier, are subsets of regular languages of the form w1*w2*...wk* for some finite words w1,...,wk. In particular bounded subsets of context-free languages have nice structural and decidability properties. Our proof proceeds in two parts. First, using Newton's iterations on the language semiring, we construct a context-free subset Ls of L that can be represented as a sequence of substitutions on a linear language and has the same Parikh image as L. Second, we inductively construct a Parikh-equivalent bounded context-free subset of Ls. We show two applications of this result in model checking: to underapproximate the reachable state space of multithreaded procedural programs and to underapproximate the reachable state space of recursive counter programs. The bounded language constructed above provides a decidable underapproximation for the original problems. By iterating the construction, we get a semi-algorithm for the original problems that constructs a sequence of underapproximations such that no two underapproximations of the sequence can be compared. This provides a progress guarantee: every word w in L is in some underapproximation of the sequence. In addition, we show that our approach subsumes context-bounded reachability for multithreaded programs.