Model-Checking of Ordered Multi-Pushdown Automata

We address the verification problem of ordered multi-pushdown automata: A multi-stack extension of pushdown automata that comes with a constraint on stack transitions such that a pop can only be performed on the first non-empty stack. First, we show that the emptiness problem for ordered multi-pushdown automata is in 2ETIME. Then, we prove that, for an ordered multi-pushdown automata, the set of all predecessors of a regular set of configurations is an effectively constructible regular set. We exploit this result to solve the global model-checking which consists in computing the set of all configurations of an ordered multi-pushdown automaton that satisfy a given w-regular property (expressible in linear-time temporal logics or the linear-time \mu-calculus). As an immediate consequence, we obtain an 2ETIME upper bound for the model-checking problem of w-regular properties for ordered multi-pushdown automata (matching its lower-bound).


Introduction
Automated verification of multi-threaded programs is an important and a highly challenging problem.In fact, even when such programs manipulate data ranging over finite domains, their control structure can be complex due to the handling of (recursive) procedure calls in the presence of concurrency and synchronization between threads.
In the last few years, a lot of effort has been devoted to the verification problem for models of concurrent programs (see, e.g., [BMOT05, TMP07, Kah09, ABT08, TMP08, AT09, HLMS10, LR08, GMM10, EQR11, BEP11, LN11]) where each thread corresponds to a sequential program with (recursive) procedure calls.In fact, it is well admitted that pushdown automata are adequate models for such kind of threads [EK99,RSJ03], and therefore, it is natural to model recursive concurrent programs as multi-stack automata.
In general, multi-stack automata are Turing powerful and hence come along with undecidability of basic decision problems [Ram00].A lot of efforts have been nevertheless devoted recently to the development of precise analysis algorithms of specific formal models of some classes of programs [LS98, EP00, BT03, SV06, JM07].
Context-bounding has been proposed in [QR05] as a suitable technique for the analysis of multi-stack automata.The idea is to consider only runs of the automaton that can be 2 M. F. ATIG divided into a given number of contexts, where in each context pop and push transitions are exclusive to one stack.The state space which may be explored is still unbounded in presence of recursive procedure calls, but the context-bounded reachability problem is NPcomplete even in this case.In fact, context-bounding provides a very useful tradeoff between computational complexity and verification coverage.
In [TMP07], La Torre et al. propose a more general definition of the notion of a context.For that, they define the class of bounded-phase visibly multi-stack pushdown automata (BVMPA) where only those runs are taken into consideration that can be split into a given number of phases, where each phase admits pop transitions of one particular stack only.In the above case, the emptiness problem is decidable in double exponential time by reducing it to the emptiness problem for tree automata.
Another way to regain decidability is to impose some order on stack transitions.In [BCCC96], Breveglieri et al. define ordered multi-pushdown automata (OMPA), which impose a linear ordering on stacks.Stack transitions are constrained in such a way that a pop transition is reserved to the first non-empty stack.In [ABH08], the emptiness problem for OMPA is shown to be 2ETIME-complete.(Recall that 2ETIME is the class of all decision problems solvable by a deterministic Turing machine in time 2 2 dn for some constant d.)The proof of this result lies in an encoding of OMPA into some class of grammars for which the emptiness problem is decidable.Moreover, the class of ordered multi-pushdown automata with 2k stacks is shown to be strictly more expressive than bounded-phase visibly multi-stack pushdown automata with k phases [ABH08].
In this paper, we consider the problem of verifying ordered multi-pushdown automata with respect to a given w-regular property (expressible in the linear-time temporal logics [Pnu77] or the linear-time µ-calculus [Var88]).In particular, we are interested in solving the global model checking for ordered multi-pushdown automata which consists in computing the set of all configurations that satisfy a given w-regular property.The basic ingredient for achieving this goal is to define a procedure for computing the set of backward reachable configurations from a given set of configurations.Therefore, our first task is to find a finite symbolic representation of the possibly infinite state-space of an ordered multi-pushdown automaton.For that, we consider the class of recognizable sets of configurations defined using finite state automata [QR05,ABT08,Set10].
We show that for an ordered multi-pushdown automaton M the set of all predecessors Pre * (C) of a recognizable set of configurations C is an effectively constructible recognizable set.For this, we introduce the class of effective generalized pushdown automata (EGPA) where transitions on stacks are (1) pop the top symbol of the stack, and (2) push a word in some effective language L over the stack alphabet.The language L is said to be effective if the problem consisting in checking whether L intersects a given regular language is decidable.Observe that L can be any finite union of languages defined by a class of automata closed under intersection with regular languages and for which the emptiness problem is decidable (e.g., pushdown automata, Petri nets, lossy channel machines, etc).Then, we show that the automata-based saturation procedure for computing the set of predecessors in standard pushdown automata [BEM97] can be extended to prove that for EGPA too the set of all predecessors of a regular set of configurations is a regular set and effectively constructible.As an immediate consequence of this result, we obtain similar decidability results of the decision problems for EGPA like the ones obtained for pushdown automata.
Then, we show that, given an OMPA M with n stacks, it is possible to construct an EGPA P, whose pushed languages are defined by OMPA with (n − 1) stacks, such that the following invariant is preserved: The state and the stack content of P are respectively the same as the state and the content of the n th stack of M when its first (n − 1) stacks are empty.Let C be a recognizable set of configurations of M, and Pre * (C) the set of predecessors of C.Then, we can apply the saturation procedure to P to show that the set of configurations C n , consisting of Pre * (C) restricted to the configurations in which the first (n − 1) empty stacks are empty, is recognizable and effectively constructible.To compute the intermediary configurations in Pre * (C) where the first (n − 1) stacks are not empty, we construct an ordered multi-pushdown automaton M ′ with (n − 1) stacks that: (1) performs the same transitions on its stacks as the ones performed by M on its first (n − 1) stacks, and (2) simulates a push transition of M over its n th stack by a transition of the finite-state automaton accepting the recognizable set of configurations C n .Now, we can apply the induction hypothesis to M ′ and construct a finite-state automaton accepting the set of all predecessors Pre * (C).
As an application of this result, we show that the set of configurations of an ordered multi-pushdown automaton satisfying a given w-regular property is recognizable and effectively constructible.Our approach also allows us to obtain an 2ETIME upper bound for the model checking problem of w-regular properties for ordered multi-pushdown automata (matching its lower-bound [ABH08]).

Related works:
As mentioned earlier, context-bounding has been introduced by Qadeer and Rehof in [QR05] for detecting safety bugs in shared memory concurrent programs.Several extensions of context-bounding to other classes of programs and efficient procedures for context-bounded analysis have been proposed in [BESS05, BFQ07, LR08, ABQ09, TMP09, LMP09, LMP10].Other bounding concepts allowing for larger/incomparable coverage of the explored behaviors have been proposed in [TMP07, GMM10, EQR11, BEP11, LN11].
In [Set10], A. Seth shows that the set of predecessors of a recognizable set of configurations of a bounded-phase visibly multi-stack pushdown automaton is recognizable and effectively constructible.In fact, our results generalize the obtained result in [Set10] since any bounded-phase visibly multi-stack pushdown automaton with k phases can be simulated by an ordered multi-pushdown automaton with 2k stacks [ABH08].
In this line of work, the focus has been on checking safety properties.In [MP11], P. Madhusudan and G. Parlato propose a unified and generalized technique to show the decidability of the emptiness problem for several restricted classes of concurrent pushdown automata (including ordered multi-pushdown automata).The proof is done by showing that the graphs of each such computations (seen as a multi-nested words) have a bounded treewidth.This result implies that model checking MSO properties (over finite-computations) for these systems is decidable for OMPA.In the conclusion of [MP11], the authors claim that their approach can be used to show the decidability of the model checking of ω-regular properties over infinite computations of OMPA but no proof was provided.Moreover, the authors does not address the global model-checking problem for OMPA neither establish its complexity as we do.
To the best of our knowledge, this is the first work that addresses the global model checking for ordered multi-pushdown automata.In this paper, we extend [Ati10a,Ati10b] by adding details and missing proofs.

Preliminaries
In this section, we introduce some basic definitions and notations that will be used in the rest of the paper.
Integers: Let N be the set of natural numbers.For every i, j ∈ N such that i ≤ j, we use Words and languages: Let Σ be a finite alphabet.We denote by Σ * (resp.Σ + ) the set of all words (resp.non empty words) over Σ, and by ǫ the empty word.A language is a (possibly infinite) set of words.We use Σ ǫ and Lang (Σ) to denote respectively the set Σ ∪ {ǫ} and the set of all languages over Σ.Let u be a word over Σ.The length of u is denoted by |u|.For every j ∈ [1, |u|], we use u(j) to denote the j th letter of u.We denote by u R the mirror of u.
Transition systems: A transition system (TS for short) is a triplet T = (C, Σ, →) where: (1) C is a (possibly infinite) set of configurations, (2) Σ is a finite set of labels (or actions) such that C ∩ Σ = ∅, and (3) →⊆ C × Σ ǫ × C is a transition relation.We write c a − → T c ′ whenever c and c ′ are two configurations and a is an action such that (c, a, c ′ ) ∈→.
Given two configurations c, c In this case, we say that ρ has length n and is labelled by the word one of the following two cases holds: (1) n = 0, c = c ′ , and u = ǫ, and (2) there is a run ρ of length n from c to c ′ labelled by u.We also write c T c 2 } be the set of sequences of actions generated by the runs of T from a configuration in C 1 to a configuration in C 2 .
For every T be the reflexive-transitive closure of P re T , and let P re + T = P re T • P re * T where the operator • stands for the function composition.Finite state automata: A finite state automaton (FSA) is a tuple A = (Q, Σ, ∆, I, F ) where: (1) Q is the finite non-empty set of states, (2) Σ is the finite input alphabet, (3) ∆ ⊆ (Q × Σ ǫ × Q) is the transition relation, (4) I ⊆ Q is the set of initial states, and (5) F ⊆ Q is the set of final states.We represent a transition (q, a, q ′ ) in ∆ by q a − → A q ′ .Moreover, if I ′ and F ′ are two subsets of Q, then we use A(I ′ , F ′ ) to denote the finite state automaton defined by the tuple (Q, Σ, ∆, I ′ , F ′ ).
The size of A is defined by |A| = (|Q| + |Σ| + |∆|).We use T (A) = (Q, Σ, ∆) to denote the transition system associated with A. The language accepted (or recognized) by A is given by L(A) = Traces T (A) (I, F ).

Generalized pushdown automata
In this section, we introduce the class of generalized pushdown automata where transitions on stacks are (1) pop the top symbol of the stack, and (2) push a word in some (effectively) given set of words L over the stack alphabet.A transition t is of the form δ(p, γ, a, p ′ ) = L where L is a (possibly infinite) set of words.Being in a configuration (q, w) where q is a state and w is a stack content, t can be applied if both p = q and the content of the stack is of the form γw ′ for some w ′ .Taking the transition and reading the input letter a (which may be the empty word), the automaton moves to the successor configuration (p ′ , uw ′ ) where u ∈ L (i.e., the new state is p ′ , and γ is replaced with a word u belonging to the language L).Formally, we have: Definition 2.1 (Generalized pushdown automata).A generalized pushdown automaton (GPA for short) is a tuple P = (P, Σ, Γ, δ, p 0 , γ 0 , F ) where: (1) P is the finite non-empty set of states, (2) Σ is the input alphabet, (3) Γ is the stack alphabet, (4) δ : P × Γ × Σ ǫ × P → Lang (Γ) is the transition function, (5) p 0 ∈ P is the initial state, (6) γ 0 ∈ Γ is the initial stack symbol, and (7) F ⊆ P is the set of final states.
Next, we define the effectiveness property for generalized pushdown automata.Intuitively, the generalized pushdown automaton P is said to be effective if for any possible pushed language L by P (i.e., δ(p, γ, a, p ′ ) = L for some p, p ′ ∈ Q, γ ∈ Γ, and a ∈ Σ ǫ ), the problem of checking the non-emptiness of the intersection of L and any given regular language (i.e.accepted by a finite-state automaton) is decidable.
A configuration of a GPA P = (P, Σ, Γ, δ, p 0 , γ 0 , F ) is a pair (p, w) where p ∈ P and w ∈ Γ * .The set of all configurations of P is denoted by Conf (P).Similarly to the case of pushdown automata [BEM97], we use the class of P-automata as finite symbolic representation of a set of configurations of GPA.Formally, a P-automaton is a FSA A = (Q A , Γ, ∆ A , I A , F A ) such that I A = P .We say that a configuration (p, w) of P is accepted (or recognized) by A if w ∈ L(A({p}, F A )).The set of all configurations recognized by A is denoted by L P (A).A set of configurations of P is said to be recognizable if and only if it is accepted by some P-automaton.
Observe that pushdown automata can be seen as a particular class of effective GPA where δ(p, γ, a, p ′ ) is a finite set of words for all (p, γ, a, p ′ ).Table 1 shows an example of an effective generalized pushdown automaton where the pushed language {γ i 2 γ i 1 γ i 0 ⊥ | i ∈ N} can be accepted by a Petri net (with reachability as acceptance condition).
2.1.Computing the set of predecessors for an GPA.In this section, we show that the set of predecessors of a recognizable set of configurations of an effective GPA is recognizable and effectively constructible.This is done by adapting the construction given in [BEM97, EHRS00,Sch02].On the other hand, it is easy to observe that the set of successors of a recognizable set of configurations of an effective GPA is not recognizable in general (see the example given in Table 1).
Theorem 2.3.For every effective generalized pushdown automaton P, and every Pautomaton A, it is possible to construct a P-automaton recognizing P re * T (P) (L P (A)).The rest of this section is devoted to the proof of Theorem 2.3.For that, let P = (P, Σ, Γ, δ, p 0 , γ 0 , F ) be an effective generalized pushdown automata and A = (Q A , Γ, ∆ A , I A , F A ) be an P-automaton.Without loss of generality, we assume that A has no transition leading to an initial state.We compute P re * T (P) (L P (A)) as the set of configurations recognized by an P-automaton A pre * = (Q A , Γ, ∆ pre * , I A , F A ) obtained from A by means of a saturation procedure.Initially, we have A pre * = A.Then, the procedure adds new transitions to A pre * , but no new states.New transitions are added according to the following saturation rule: For every p, p ′ ∈ P , γ ∈ Γ, and a ∈ Σ ǫ , if δ(p, γ, a, p ′ ) = ∅, then for every q ∈ Q A such that δ(p, γ, a, p ′ ) ∩ L(A pre * ({p ′ }, {q})) = ∅, add the transition (p, γ, q) to A pre * It is easy to see that the saturation procedure eventually reaches a fixed point because the number of possible new transitions is finite.Moreover, the saturation procedure is well defined since the emptiness problem of the language δ(p, γ, a, p ′ ) ∩ L(A pre * ({p ′ }, {q})) is decidable (P is an effective GPA).Then, the relation between the set of configurations recognized by A pre * and the set P re * T (P) (L P (A)) is established by Lemma 2.4.(Observe that Theorem 2.3 follows from Lemma 2.4.)Lemma 2.4.L P (A pre * ) = P re * T (P) (L P (A)).Lemma 2.4 is an immediate consequence of Lemma 2.5 and Lemma 2.6: Lemma 2.5 shows that P re * T (P) (L P (A)) ⊆ L P (A pre * ) while Lemma 2.6 establishes L P (A pre * ) ⊆ P re * T (P) (L P (A)).
Lemma 2.5.For every configuration We proceed by induction on n.
In the following, we establish that L P (A pre * ) ⊆ P re * T (P) (L P (A)).This is an an immediate corollary of the following lemma: be the P-automaton obtained after adding n transitions to A. In particular, we have A 0 = A.Then, it is easy to see that Let n be an index such that w ∈ L(A n (p, q)) holds.We shall prove the first part of Lemma 2.6 by induction on n.The second part follows immediately from the fact that initial states have no incoming transitions in A 0 .
Step. n > 0. Let t = (p ′′ , γ, q ′ ) be the n-th transition added to A pre * .Let m be the number of times that t is used in p w = =⇒ * T (An) q.The proof is by induction on m.If m = 0, then we have w ∈ L(A n−1 ({p}, {q})), and the property (1) follows from the induction hypothesis (induction on n).So, assume that m > 0. Then there exist u and v such that w = uγv and The application of the induction hypothesis to u ∈ L(A n−1 ({p}, {p ′′ })) yields to that: (p, u) Since the transition (p ′′ , γ, q ′ ) has been added by applying the saturation procedure, there exist p ′′′ , w 2 , and a ∈ Σ ǫ such that: From w 2 ∈ L(A n−1 ({p ′′′ }, {q ′ })) and v ∈ L(A n ({q ′ }, {q})), we get that there is a computation ρ = p ′′′ w 2 v ==⇒ * T (An) q such that the number of times transition t is used is strictly less than m.So, we can apply the induction hypothesis (induction on m) to ρ, and we obtain: ). Putting all previous equations together, we get w ′ ∈ L(A 0 ({p ′ }, {q})), and: This terminates the proof of Lemma 2.6.2.2.Emptiness problem and closure properties for GPA.In this section, we show that the emptiness problem is decidable for effective generalized pushdown automata.This is an immediate consequence of the fact that the set of predecessors of a recognizable set of configurations of an effective generalized pushdown automaton is also recognizable and effectively constructible.
Theorem 2.7.The emptiness problem is decidable for effective generalized pushdown automata.
Proof.Let P = (P, Σ, Γ, δ, p 0 , γ 0 , F ) be an effective generalized pushdown automaton.It is easy to see that L(P) = ∅ if and only if (p 0 , γ 0 ) ∈ P re * T (P) (F × {ǫ}).By Theorem 2.3, we can construct a P-automaton A pre * that recognizes exactly the set P re * T (P) (F × {ǫ}) since F × {ǫ} is a recognizable set of configurations.Hence, the emptiness problem for P is decidable since checking whether (p 0 , γ 0 ) is in L P (A pre * ) is decidable.
Next, we show some closure properties for effective generalized pushdown automata.
Theorem 2.8.The class of effective GPAs is closed under concatenation, union, Kleene star, projection, homomorphism, and intersection with a regular language.However, effective GPAs are not closed under intersection.
Proof.Showing the closure of the class of effective generalized pushdown automata under concatenation, union, Kleene star, projection, homomorphism, and intersection with a regular language is similar to the case of pushdown automata.The only issue to prove is the closure under intersection.For that, let us assume by contradiction that the class of effective GPAs is closed under the intersection operation.Let P 1 and P 2 two pushdown automata.Since the class of pushdown automata is a particular class of effective generalized pushdown automata and the class of effective generalized pushdown automata is closed under the intersection operation (from the contradiction's hypothesis), there is an effective generalized pushdown automaton P such that L(P) = L(P 1 ) ∩ L(P 2 ).Applying Theorem 2.7 to P, we obtain the decidability of the emptiness problem of the intersection of two context-free languages, which is a contradiction.

Ordered multi-pushdown automata
In this section, we first recall the definition of multi-pushdown automata.Then ordered multi-pushdown automata appear as a special case of multi-pushdown automata.
The language accepted (or recognized) by M is defined by the set for some final configuration c}.
M. F. ATIG 3.2.Symbolic representation of MPA configurations.We show in this section how we can symbolically represent infinite sets of multi-pushdown automaton configurations using special kind of finite automata which were introduced in [Set10].Let M = (n, Q, Σ, Γ, ∆, q 0 , γ 0 , F ) be a multi-pushdown automaton.An M-automaton for accepting configurations of M is a finite state automaton A = (Q M , Γ, ∆ M , I M , F M ) such that I M = Q.We say that a configuration (q, w 1 , . . ., w n ) of M is accepted (or recognized) by A if and only if the word w = w 1 w 2 • • • w n is in L(A({q}, F M )).(Notice that for every word w ∈ L(A({q}, F M )) there are unique words w 1 , . . ., The set of all configurations recognized by A is denoted by L M (A).
A set of configurations of M is said to be recognizable if and only if it is accepted by some M-automaton.Finally, it is easy to see that the class of M-automata is closed under all the boolean operations and that emptiness and membership problems are decidable in polynomial time.
3.3.Ordered multi-pushdown automata.An ordered multi-pushdown automaton is a multi-pushdown automaton in which one can pop only from the first non-empty stack (i.e., all preceding stacks are equal to ⊥).
In the following, we consider only ordered multi-pushdown automata in some normal form.This normal form is used only to simplify the presentation.(Observe that this form is slightly more general than the one considered in [ABH08].)In such normal form, any transition, that pops a symbol from the i th stack with i ∈ [2, n], is only allowed to push a symbol on the first stack.Furthermore, pushing symbols on the stacks from 1 to n is only allowed while popping a symbol from the first stack.Definition 3.3.An OMPA (n, Q, Σ, Γ, ∆, q 0 , γ 0 , F ) is in normal form if ∆ contains only the following types of transitions: This transition pops a symbol from the first stack while pushing at most two symbols on the first stack and at most one symbol on the stacks from 2 to n.
We can show the equivalence (with respect to language acceptance) between the class of OMPA and OMPA in the normal form.
Lemma 3.4.An n-OMPA M can be transformed into an n-OMPA M ′ in normal form with linear blowup in its size such that L(M) = L(M ′ ).
Proof.An easy generalization of the proof for the Chomsky normal form for context-free grammars.
In the rest of the paper, we assume that any OMPA is in the normal form.Next, we recall some properties of the class of languages recognized by n-OMPA.

Lemma 3.5 ([BCCC96]
).If M 1 and M 2 are two n-OMPAs over an alphabet Σ, then it is possible to construct an n-OMPA M over Σ such that: ).Let Σ be an alphabet.Given an n-OMPA M over Σ and a finite state automaton A over Σ, then it is possible to construct an n-OMPA M ′ such that:

The emptiness problem for a n-OMPA is in 2ETIME
In this section, we show that the emptiness problem for ordered pushdown automata is in 2ETIME.(We provide here a simpler proof of the 2ETIME upper bound than the one given in [ABH08].)To this aim, we show that, given an OMPA M with n > 1 stacks, it is possible to construct an effective generalized pushdown automaton P, whose pushed languages are defined by OMPA with (n − 1) stacks of size O(|M| 2 ), such that the following invariant is preserved: The state and the stack content of P are respectively the same as the state and the content of the n th stack of M when its first (n − 1) stacks are empty (and so, L(P) = ∅ if and only if L(M) = ∅).Let C be a recognizable set of configurations of M, and Pre * T (M) (C) the set of predecessors of C.Then, we can apply the saturation procedure to P to show that the set of configurations C n , consisting of Pre * T (M) (C) restricted to the configurations in which the first (n − 1) empty stacks are empty, is recognizable and effectively constructible.To compute the intermediary configurations in Pre * T (M) (C) where the first (n − 1) stacks are not empty, we construct an ordered multi-pushdown automaton M ′ with (n − 1) stacks that: (1) performs the same transitions on its stacks as the ones performed by M on its first (n − 1) stacks, and (2) simulates a push transition of M over its n th stack by a transition of the finite-state automaton accepting the recognizable set of configurations C n .Now, we can apply the induction hypothesis to M ′ and construct a finite-state automaton accepting the set of all predecessors Pre * T (M) (C).Then, we prove, by induction on n, that the emptiness problem for the n-OMPA M is in 2ETIME with respect to the number of stacks.For that, we assume that the emptiness problem for (n − 1)-OMPA can be solved in 2ETIME.This implies that the generalized pushdown automaton P (that simulates M) is effective (see Definition 2.2 and Lemma 3.6).Now, we can use Theorem 2.7 to prove the decidability of the emptiness problem of the effective generalized pushdown automaton P (and so, of the n-OMPA M).To show that the emptiness problem of P and M is in 2ETIME, we estimate the running time of our saturation procedure, given in section 2.1, under the assumption that the emptiness problem for (n − 1)-OMPA can be solved in 2ETIME.
Let us give in more details of the proof described above.
4.1.Simulation of an OMPA by an GPA.In the following, we prove that, given an OMPA M, we can construct a GPA P, with transition languages defined by (n−1)-OMPAs of size O(|M| 2 ), such that the emptiness problem for M is reducible to the emptiness problem for P. (Recall that any OMPA is assumed to be in normal form.) Theorem 4.1.Given an OMPA M = (n, Q, Σ, Γ, ∆, q 0 , γ 0 , F ) with n > 1, it is possible to construct an GPA P = (P, Σ ′ , Γ, δ, p 0 , ⊥, {p f }) such that P = Q ∪ {p 0 , p f }, Σ ′ = ∅, and we have: • L(M) = ∅ if and only if L(P) = ∅, and • For every p 1 , p 2 ∈ P and γ ∈ Γ, there is an The remaining part of this subsection is devoted to the proof of Theorem 4.1.Let us present the main steps of the construction of the generalized pushdown automaton P. For that, let us consider an accepting run ρ of M. This run can be seen as a sequence of runs of the form ς 1 σ 1 ς 2 σ 2 • • • ς m σ m such that the pop transitions operations are exclusive to the first (n − 1)-stacks (resp.the n th stack) of M along the sequence of runs ς 1 , ς 2 , . . ., ς m (resp.σ 1 , σ 2 , . . ., σ m ).Observe that, by definition, the first (n − 1)-stacks of M are empty along the runs σ 1 , σ 2 , . . ., σ m .Moreover, at the beginning of the runs ς 1 , ς 2 , . . ., ς m , the OMPA M is in some configuration c where the first stack of M contains just one symbol and the stacks from 2 to n − 1 are empty (i.e., c of the form (q, γ⊥, ⊥, . . ., ⊥, w)).Observe that this is an immediate consequence of the normal form that we have considered (since M is only allowed to push just one symbol on the first stack while popping a symbol from the stacks from 2 to n).In the case that M is not in the normal form, notice that the set of all possible contents of the first (n − 1)-stacks, at the beginning of the runs ς 1 , ς 2 , . . ., ς m , is still finite.Later, we will use this observation to show how we can adapt our construction to the general case (when M is not in the normal form).
Then, we construct P such that the following invariant is preserved during the simulation of M: The state and the content of the stack of P are the same as the state and the content of the n th stack of M when its first (n−1)-stacks are empty (and so, L(P) = ∅ if and only if L(M) = ∅).To this aim, a pushdown transtion of M that pops a symbol γ from its n th stack is simply simulated by a pushdown transition of P that pops the same symbol γ.This implies that a run of the form σ i , with 1 ≤ i ≤ m, that pops the word u i from the n th stack of M is simulated by a run of P that pops the same word u i .Now, for every j ∈ [1, m], we need to compute the pushed word v j into the n-th stack of M during the run ς j in order to be pushed also by P. For that, let L (q,γ,q ′ ) be the set of all possible pushed words u into the n th stack of M by a run of the form (q, γ⊥, ⊥, . . ., ⊥, w) τ = =⇒ * T (M) (q ′ , ⊥, ⊥, . . ., ⊥, uw) where pop transitions are exclusive to the first (n − 1)-stacks of M. We show that this language L (q,γ,q ′ ) can be characterized by an (n − 1)-OMPA M ′ (q, γ, q ′ ) over the stack alphabet of M that: (1) performs the same transitions on its state and (n − 1)-stacks as the one performed by M on its state and its first (n − 1) stacks while discarding the pop transitions of M over the n th stack, and (2) makes visible as transition labels the pushed symbols over the n th stack of M. Now, to simulate the run ς j = (q, γ⊥, ⊥, . . ., ⊥, w) ⊥, ⊥, . . ., ⊥, uw) of M ( which is equivalent to say that ς j = (q, γ⊥, ⊥, . . ., ⊥, ⊥) P can push into its stack the word u such that u R ∈ L(M ′ (q, γ, q ′ )).If M is not in the normal form, the run ς j will be of the form (q, α 1 , . . ., α n−1 , w) ⊥, ⊥, . . ., ⊥, uw) (i.e., (q, α 1 , . . ., α n−1 , ⊥) In this case, we can construct an (n − 1)-OMPA M (q ′ ,α 1 ,...,α n−1 ,q ′ ) , which is precisely M ′ (q, γ, q ′ ) with (q, α 1 , . . ., α n−1 ) as initial configuration, characterizing the set of all possible pushed words u on the n th -stack.Thus, the (n − 1)-OMPA, occurring in Theorem 4.1, will be indexed by tuples of the form (p 1 , α 1 , . . ., α n−1 , p 2 ) where p 1 , p 2 ∈ P and α 1 , . . ., The proof of Theorem 4.1 will be structured as follows.First, we define an (n − 1)-OMPA M ′ over the alphabet Γ that: (1) performs the same transitions on its state and (n − 1)-stacks as the one performed by M on its state and its first (n − 1) stacks while discarding the pop transitions of M on the n th stack, and (2) makes visible as transition labels the pushed symbols over the n th stack of M. Intuitively, depending on the initial and final configurations of M ′ , the "language" of M ′ summarizes the effect of a sequence of pop transitions of M over the first (n − 1)-stacks on the n th stack of M. So, if we are interested only by the configurations of M where the first (n − 1) stacks are empty, a run of M can be seen as a sequence of alternations of a pop transition of M over the n th stack and a push operation over the n th stack of a word in the "language" of M ′ .
Then, we construct a generalized pushdown automaton P such that the state and the stack content of P are the same as the state and the n th -stack content of M when the first (n − 1) stacks of M are empty.In the definition of P, we use the (n − 1)-OMPA M ′ to characterize the pushed word on the n th stack of M due to a sequence of pop transitions of M on the (n − 1) first stacks of M. This implies that the emptiness problem for M is reducible to its corresponding problem for P.
Constructing the (n − 1)-OMPA M ′ : Let us introduce the following n-OMPA Intuitively, M [1,n[ is built up from M by discarding pop transitions of M over the n th stack.Then, let M ′ = (n − 1, Q, Γ, Γ, ∆ ′ , q 0 , γ 0 , F ) be the (n − 1)-OMPA, built out from M [1,n[ , which (1) performs the same transitions on the first (n − 1) stacks of M [1,n[ , and (2) makes visible as transition label the pushed stack symbol over the n th stack of M [1,n[ .Formally, ∆ ′ is defined as the smallest transition relation satisfying the following condition: Observe that the pushed word α n over the n th -stack consists in at most one symbol (i.e., α n ∈ Γ ǫ ).If M is not in the normal formal, α n can be of size two (say α n = γγ ′ ), and in this case we need to associate two transitions to M ′ which first read the symbol γ ′ and then the symbol γ.
Let us now give the relation between the effect of a sequence of operations of M [1,n[ on the n th -stack and the language of M ′ .Lemma 4.2.For every q, q ′ ∈ Q, and for some τ ∈ Σ * if and only if there is u ∈ Γ * such that (q, w 1 , . . ., w n−1 ) Proof.To prove Lemma 4.2, it suffices to observe that the following holds: For every q, q ′ ∈ Q, w 1 , . . ., w n ∈ Stack (M [1,n[ ), and w for some a ∈ Σ ǫ if and only if there is b ∈ Γ ǫ such that (q, w 1 , . . ., w n−1 ) b − → T (M ′ ) (q ′ , w ′ 1 , . . ., w ′ n−1 ) and w ′ n = bw n .This observation can be established easily using the definition of M ′ and M [1,n[ .Constructing the GPA P: We are ready now to define the generalized pushdown automaton P = (P, Σ ′ , Γ, δ, p 0 , ⊥, {p f }), with P = Q ∪ {p 0 , p f } and Σ ′ = ∅, that keeps track of the state and content of the n th stack of M when the first (n − 1) stacks are empty.Formally, P is built from M as follows: For every p, p ′ ∈ P and γ ∈ Γ, we have: Observe that for every p 1 , p 2 ∈ P , and γ ∈ Γ, we can construct an (n − 1)-OMPA This can be easily proved using Lemma 3.5.
To complete the proof of Theorem 4.1, it remains to show that the emptiness problem for M is reducible to its corresponding problem for P.This is stated by Lemma 4.3.Proof.To prove that L(M) = ∅ iff L(P) = ∅, we will show that the following invariant is preserved: The state and content of P are the same as the state and content of the last stack of M when its first (n − 1)-stacks are empty.Thus, we will split the run of M at the transitions that pop some symbol from the last stack.This implies that a run of M can be decomposed as follows: (1) First a run from the initial configuration to the first reachable configuration where the first (n − 1)-stacks are empty, and (2) a sequence of runs that are starting from a configuration where the first (n − 1)-stacks are empty to the first reachable configuration with empty first (n − 1)-stacks.Lemma 4.4 and Lemma 4.5 establish the relation between these two kind of runs of M and the runs of P. Lemma 4.4 shows that M can move from a configuration of the form (q, ⊥, . . ., ⊥, w) to a configuration of the form (q ′ , ⊥, . . ., ⊥, w ′ ) if and only if P can move from the configuration (q, w) to the configuration (q ′ , w ′ ).Lemma 4.5 proves that P can move, in one step, from the initial configuration (p 0 , ⊥) to the configuration (q, w) if and only if M [1,n[ can move from the initial configuration (q 0 , γ 0 ⊥, ⊥, . . ., ⊥) to the configuration (q, ⊥, ⊥, . . ., ⊥, w).As an immediate consequence of Lemma 4.4 and Lemma 4.5, we obtain that L(M) = ∅ if and only if L(P) = ∅.Lemma 4.4.For every q, q ′ ∈ Q and w, w ′ ∈ Stack (M), (q, w) ǫ = =⇒ * T (P) (q ′ , w ′ ) if and only if (q, ⊥, . . ., ⊥, w) τ = =⇒ * T (M) (q ′ , ⊥, . . ., ⊥, w ′ ) for some τ ∈ Σ * .
(The Only if direction) Assume that (p 0 , ⊥) ǫ − → T (P) (q, w).Then, from the definition of P, there is an u ∈ Γ * such that: From the definition of L(M ′ (q 0 , γ 0 , q)), we have ρ = (q 0 , γ 0 ⊥, ⊥, . . ., ⊥) (q, ⊥, ⊥, . . ., ⊥).We can apply Lemma 4.2 to the run ρ, and we obtain that there is τ ∈ Σ * such that: ⊥, w) This terminates the Only if direction and the proof of Lemma 4.5.Now, we are ready to prove that the emptiness problem for M is reducible to the emptiness problem for P.
(The If direction) Assume that L(P) = ∅.This implies that: ) This means that there is a state q ∈ F such that: From the definition of the transition function of P, there are q ′ ∈ Q and w ∈ Stack (M) such that: We can apply Lemma 4.5 to the run ρ 1 , and we obtain that there is τ ′ ∈ Σ * such that: (q 0 , γ 0 ⊥, . . ., ⊥) We can also apply Lemma 4.4 to the run ρ 2 , and we obtain that there is τ ′′ ∈ Σ * such that: (q ′ , ⊥, . . ., ⊥, w) = =⇒ * T (M) (q, ⊥, . . ., ⊥) (4.21) Putting together Equations 4.20 and 4.21, we get: This shows that L(M) = ∅ since q ∈ F , and this terminates the proof of the If direction.

4.2.
Emptiness of a n-OMPA is in 2ETIME.In the following, we show that the emptiness problem for a n-OMPA is in 2ETIME with respect to the number of stacks.The proof is done by induction on the number of stacks.First, we use the induction hypothesis, that the emptiness problem for OMPA with (n − 1)-stacks is decidable, to show that the generalized pushdown automaton P is effective (and so the emptiness problem for P is decidable).Once the effectiveness property of P has been established, we estimate the running time of our saturation procedure for P, given in section 2.1, under the assumption that the emptiness problem.for (n − 1)-OMPA can be solved in 2ETIME.We show that the emptiness problem of P (and so . Putting together all these equations, we obtain that the problem of checking whether (p 0 , ⊥) ∈ Pre * T (P) ({p f } × {ǫ}) can be solved in time . By taking a constant d as big as needed, we can show that the problem of checking whether L(M) = ∅ can be solved in time O(|M| 2 dn ).

Computing the set of predecessors for OMPA
In this section, we show that the set of predecessors of a recognizable set C of configurations of an OMPA is recognizable and effectively constructible (see Theorem 5.6).To simplify the presentation, we can assume without loss of generality that the set C contains only one configuration of the form (q f , ⊥, . . ., ⊥) where all the stacks are empty.This result is established by Lemma 5.1.
Lemma 5.1.Let M = (n, Q, Σ, Γ, ∆, q 0 , γ 0 , F ) be an OMPA and A be an M-automaton.Then, it is possible to construct, in time and space polynomial in The proof is similar to the case of standard pushdown automata.Technically, this can be done by adding to the OMPA M some pop transitions that check, in nondeterministic way, if the current configuration belongs to L M (A) by simulating the M-automaton A. Let A = (Q M , Γ, ∆ M , I M , F M ) be the M-automaton.We assume w.l.o.g that A has no transition leading to its initial states and that there is no transition of A labeled by the empty word.
We construct the OMPA M ′ = (n, Q ′ ∪ {q f }, Σ, Γ ′ , ∆ ′ , q 0 , γ 0 , F ) as follows: ).The set of states Q ′ is precisely the union of the set of states of M and the set of states of A indexed by the stack identities.(The index n + 1 is used to mark the end of the simulation of A by M ′ ).Moreover, we assume that M ′ has a fresh state q f / ∈ Q ′ .
• Γ ′ = Γ ∪ {♯} such that ♯ / ∈ Γ.The fresh stack symbol ♯ is used to ensure that M ′ respects the constraints imposed by the normal formal.Intuitively, this symbol will be pushed on the first stack whenever a symbol is popped from a stack with an index from 2 to n, during the simulation of the M-automaton A, and then this symbol will be popped from the first stack.
• ∆ ′ is the smallest transition relation such that the following conditions are satisfied: − First Phase: In this phase the OMPA M ′ behaves exactly as the OMPA M ′ .This corresponds to ∆ ⊆ ∆ ′ .
− Second phase: In the second phase, M ′ checks if the current configuration is accepted by A. This is done by allowing M ′ to start, in non-deterministically way, the simulation of A while popping the read symbols from their corresponding stacks.Formally, we have: * For every transition q γ − → A p with q ∈ Q and γ ∈ (Γ \ {⊥}), we have q, γ, ǫ, . . ., ǫ ǫ − → M ′ (p, 1), ǫ, ǫ, . . ., ǫ .This means that, in non-deterministically way, the checking of whether the current configuration is accepted by A can be started by the simulation of a transition of A from the current state q.This transition of M ′ corresponds to the case where the first stack is not empty * For every q and q ∈ Q, we have q, ⊥, ǫ, . . ., ǫ ǫ − → M ′ (p, i + 1), ⊥, ǫ, . . ., ǫ .This means that the simulation of A by M can be started and the first i stacks are empty.Observe that the state (p, i + 1) of M ′ corresponds to the fact that the current state of A is p and that we are currently checking the stack i + 1. * For every i ∈ [1, n] and p . ., ǫ .This corresponds to the simulation of a sequence of transitions of A that checks if the stacks from i to (i + j − 1) are empty.In this case, we move the current state from p to p ′ and we start checking the stack of index (i + j).* For every i ∈ [1, n] and The simulation of a transition of A, that reads the symbol γ from the i th -stack, is performed by M ′ by a transition that pops γ form the i th -stack and pushes the fresh symbol ♯ into the first stack.* For every index i ∈ [1, n + 1] and state p ∈ Q A , we have (p, i), ♯, ǫ, . . ., ǫ ǫ − → M ′ (p, i), ǫ, . . ., ǫ .This transition pops the fresh symbol ♯ from the first stack.Recall that this fresh symbol is introduced in the only aim of ensuring the normal form of M ′ .* For every p ∈ F , we have (p, n+1), ⊥, ǫ, . . ., ǫ ǫ − → M ′ q f , ⊥, ǫ, . . ., ǫ .This transition ends the simulation of A by M ′ after verifying that the current configuration of M is accepted by A.
Then it is easy to see that for every In the following, we show that the set of configurations C ′ of the form (q ′ , ⊥, . . ., ⊥, w ′ ) from which the OMPA M can reach a configuration of the form (q, ⊥, . . ., ⊥), where all the stacks are empty, is recognizable and effectively constructible.
Proof.Lemma 4.4 shows that, given an OMPA M with n stacks, it is possible to construct an effective generalized pushdown automaton P, whose pushed languages are defined by OMPA with (n − 1) stacks, such that the following invariant is preserved: The state and the stack's content of P are the same as the state and the content of the n th stack of M when its first (n − 1) stacks are empty.Then, we can make use of Theorem 2.3, which shows the set of all predecessors of a recognizable set of configurations is an effectively constructible recognizable set for effective generalized pushdown automata, to show that Lemma 5.2 holds.
Next, we state our main theorem which is a generalization of the result obtained in for bounded-phase visibly multi-stack pushdown automata [Set10].
Theorem 5.3.Let M = (n, Q, Σ, Γ, ∆, q 0 , γ 0 , F ) be an OMPA and q ∈ Q be a state.Then, it is possible to construct, in time O(|M| 2 dn ) where d is a constant, a M-automaton A such that |A| = O(|M| 2 dn ) and L M (A) = Pre * T (M) ({(q, ⊥, . . ., ⊥)}).Proof.From Lemma 5.2, we know that the set of configurations C n , consisting of Pre * T (M) ({(q, ⊥, . . ., ⊥)}) restricted to the configurations in which the first (n − 1) empty stacks are empty, is recognizable and effectively constructible.To compute the intermediary configurations in Pre * T (M) ({(q, ⊥, . . ., ⊥)}) where the first (n − 1) stacks are not empty, we construct an ordered multi-pushdown automaton M ′ with (n − 1) stacks that: (1) performs the same transitions on its stacks as the ones performed by M on its first (n − 1) stacks, and (2) simulates a push transition of M over its n th stack by a transition of the finite-state automaton accepting the recognizable set of configurations C n .Now, we can apply the induction hypothesis to M ′ and construct a finite-state automaton accepting the set of all predecessors Pre * T (M) ({(q, ⊥, . . ., ⊥)}).We proceed by induction on the number of stacks of the OMPA M.
Basis.n = 1.Then, M is a pushdown automaton.From [BEM97], we know that such an M-automaton A for M can be constructed in polynomial time in |M|.
This terminates the proof of Theorem 5.3.
. We can extend the previous result to show that the operator Pre + preserves also recognizability.
Theorem 5.7.Let M = (n, Q, Σ, Γ, ∆, q 0 , γ 0 , F ) be an OMPA and A ′ be an M-automaton.Intuitively, the OMPA has the same stack and input alphabets as the ones of M. Corresponding to each state q of M, M ′ has q and q copy as two states where q copy is a fresh symbol which was not used neither in the definition of M nor in the definition of A. For any transition of the form q, γ 1 , . . ., γ n a − → M q ′ , α 1 , . . ., α n , M ′ has two transitions q, γ 1 , . . ., γ n a − → M ′ q ′ , α 1 , . . ., α n and q, γ 1 , . . ., γ n a − → M ′ q ′ copy , α 1 , . . ., α n .Any computation of M ′ can be divided in two phases.In the first phase M ′ mimics the behavior of the OMPA M ′ by performing the same sequence of transitions.In the second phase, the OMPA M ′ performs a transition from a state q ∈ Q of M to a state q ′ copy with q ′ ∈ Q and halts.Formally, M ′ is defined by the tuple (n, Q ∪ Q copy , Σ, Γ, ∆ ∪ ∆ ′ , q 0 , γ 0 , F ) where Q copy = {q copy | q ∈ Q} and ∆ be the M-automaton.We assume here that A has no transition leading to an initial state.Now, we can construct the M ′ -automaton A ′′ = (Q M ′ , Γ, ∆ M ′ , I M ′ , F M ′ ) from the M-automaton A ′ as follows: The set of states of A ′′ is the union of the set of states of A ′ and the set of states of M ′ (i.e., Q M The set of transitions of A ′′ contains any transition of A that does not involve a state of Moreover, corresponding to any transition of the form q a − → A ′ p where q ∈ Q, the automaton A ′′ has a transition of the form q copy a − → A ′′ p.That is, the automaton A ′′ is precisely A ′ where any initial state q ∈ Q is relabeled by its M. F. ATIG to the content of the i th -stack, along the sequence of configurations c 1 c 2 • • • , as the one for standard pushdown automata [BEM97], we can deduce that the i th -stack is increasing.This means that there are indices j 1 < j 2 , a stack symbol γ ∈ Γ, and a state q ∈ Q such that the configurations c j 1 and c j 2 are in C (q,γ) i and the symbol γ at the top of the i th -stack in c j 1 and c j 2 will never be popped.Furthermore, along the sub-computation ρ 2 from c j 1 and c j 2 the state q f is visited.Observe that if we remove from the configuration c j 1 all the stack symbols that will never be popped we obtain the configuration c (q,γ) i .Then, the computation ρ 2 can be simplified, by dropping all the (useless) stack symbols that will never be popped from the configuration c j 1 , as follows : c . This computation ρ 2 represents our lasso computation since from the configuration c ′ 2 we can repeat the sequence of transitions τ 1 τ 2 while visiting the same states (and in particular the state q f ).
The existence of a such lasso is expressed by the second item of Theorem 6.1 while the existence of a stem computation from the starting configuration c to the configuration c j 1 ∈ C (q,γ) i is stated by the first item of Theorem 6.1.Then, the solution of the repeated state reachability problem is formally based on the following fact: Theorem 6.1.Let c be a configuration of M and q f be a state of M.There is an infinite run starting from c that visits infinitely often the state q f if and only if there are i ∈ [1, n], q ∈ Q, and γ ∈ Γ such that: (1) c ∈ Pre * T (M) (C (q,γ) i ), and (2) c Proof.(⇒) : Let ρ = c 0 t 0 c 1 t 1 c 2 t 2 • • • be an infinite computation of T (M) starting from the configuration c 0 = c of M. For every j ∈ N, c j is a configuration of M and t j is a transition of M such that c j t j − − → T (M) c j+1 (recall that Σ = ∆).Let i ∈ [1, n] be the maximal index such that for every j ∈ N, there is k j ≥ j such that t k j is a pop transition over the i th stack of M. This implies that c , the first (i − 1)-stacks are empty) since t k j is a pop transition from the i th stack of M.
From the definition of i, there is r ∈ N such that for every h ≥ r, there is d h ∈ [1, i] such that the transition t h is a pop transition over the stack d h of M (i.e., the transition t h is not a pop transition from the stack from (n − i + 1) to n).This implies that for every h ≥ r, we have c h Then, we construct a sequence π = c j 0 c j 1 c j 2 • • • of configurations of M as follows: c j 0 is the first configuration of ρ such that j 0 ≥ r and t j 0 is a pop transition over the i th -stack of M, for every ℓ > 0, c j ℓ is the first configuration of ρ such that j ℓ > j ℓ−1 and t j ℓ is a pop transition over the i-stack of M. Recall that, by definition, we have for every l ∈ N, c j l is in Q × ({⊥}) i−1 × ((Γ \ {⊥}) * • Stack (M)) × (Stack (M)) n−i (i.e., the first (i − 1) stacks are empty).Now, for every l ≥ 0, let π (l) be the suffix of π starting at c j l , and let m (l) be the minimal length of the configurations of π (l) , where the length of a configuration is defined as the length of its i th stack.Construct a subsequence π ′ = c z 0 c z 1 c z 2 • • • of π as follows: c z 0 is the first configuration of π of length m (0) ; for every l > 0, c z l is the first configuration of π (z l−1 +1) of length m (z l−1 +1) .
(⇐) : We can use (1) and (2) of Theorem 6.1 to construct a run starting from c that visits infinitely often the state q f .Since the sets of configurations C (q,γ) i and ({q f }×(Stack (M)) n ) are recognizable, we can use Theorem 5.6 and Theorem 5.7 to construct M-automata recognizing Pre * T (M) (C (q,γ) i ) and ) ∩ ({q} × (Stack (M)) n ) .Hence, we can construct a M-automaton that recognizes the set of all configurations c of M such that there is an infinite run of T (M) starting from c that visits infinitely often the state q f .Theorem 6.2.Let M = (n, Q, Σ, Γ, ∆, q 0 , γ 0 , F ) be an OMPA and q f ∈ Q be a state.Then, it is possible to construct, in time O((|M|) 2 dn ) where d is a constant, an M-automaton A such that |A| = O((|M|) 2 dn ) and for every configuration c ∈ Conf (M), c ∈ L M (A) if and only if there is an infinite run of T (M) starting from c that visits q f infinitely often.
Proof.We know from Theorem 6.1 that there is an infinite run of T (M) starting from c that visits q f infinitely often if and only if c ∈ Pre * T (M) (C (q,γ) i ), and c Observe that we can also construct an M-automaton A ′ such that for every configuration c ∈ Conf (M), c ∈ L M (A) if and only if every infinite run of T (M) starting from c that satisfies ϕ since the class of M-automata is closed under boolean operations.
We are now ready to establish our result about the model checking problem for wregular properties which consists in checking whether, for a given configuration c of the OMPS, every infinite run starting from c satisfies the formula ϕ.
Theorem 6.4.The model checking problem for the linear-time temporal logics or the lineartime µ-calculus and OMPA is 2ETIME-complete.
Proof.The 2ETIME upper bound is established by Theorem 6.3.To prove hardness, we use the fact that the emptiness problem for ordered multi-pushdown automata is 2ETIMEcomplete [ABH08].

Conclusion
We have shown that the set of all predecessors of a recognizable set of configurations of an ordered multi-pushdown automaton is an effectively constructible recognizable set.We have also proved that the set of all configurations of an ordered multi-pushdown automaton that satisfy a given w-regular property is effectively recognizable.From these results we have derived an 2ETIME upper bound for the model checking problem of w-regular properties.
It may be interesting to see if our approach can be extended to solve the global modelchecking problem for branching time properties expressed in CTL or CTL * by adapting the constructions given in [BEM97,FWW97] for standard pushdown automata.
) c x b Since c 0 = c and c x 0 ∈ C (q,γ) i , we have c ∈ Pre * T (M) (C (q,γ) i (q,γ) i ∈ Pre + T (M [1,i] ) Pre * T (M [1,i] ) (C (q,γ) i ) ∩ ({q f } × (Stack (M)) n ) .(Observe that it is possible to Theorem 6.3.Let M = (n, Q, Σ, Γ, ∆, q 0 , γ 0 , F ) bean OMPA with a labeling function Λ, and let ϕ be a linear time µ-calculus formula or linear time temporal formula.Then, it is possible to construct, in time O((2 |ϕ| • |M|) 2 dn ) where d is a constant, an M-automaton A such that |A| = O((2 |ϕ| • |M|) 2 dn ) and for every configuration c ∈ Conf (M), c ∈ L M (A) if and only if there is an infinite run of T (M) starting from c does not satisfy ϕ.Proof.It is well known that it is possible to construct, in time exponential in |ϕ|, a Büchi automaton B ¬ϕ for the negation of ϕ having exponential size in |ϕ| [VW86, Var88].Therefore, the product of M and B ¬ϕ has polynomial size in |M| and exponential size in |ϕ|.Applying Theorem 6.2 to the n-OMPA M ¬ϕ (the product of M and B ¬ϕ ) of size O(2 |ϕ| • |M|) we obtain our complexity result.