Reachability in Pushdown Register Automata.

We investigate reachability in pushdown automata over inﬁnite alphabets. We show that, in terms of reachability/emptiness, these machines can be faithfully represented using only 3 r elements of the alphabet, where r is the number of registers. We settle the complexity of associated reachability/emptiness problems. In contrast to register automata, the emptiness problem for pushdown register automata is EXPTIME-complete, independent of the register storage policy used. We also solve the global reachability problem by representing pushdown conﬁgurations with a special register automaton. Finally, we examine extensions of pushdown storage to higher orders and show that reachability is undecidable at order 2.


Introduction
Recent years have seen lively interest in automata over infinite alphabets. This has largely been driven by applications which, although diverse, had a common thread in dealing with alphabets of potentially unbounded size for which finitedomain abstractions were deemed unsatisfactory. A case in point are markup languages [20,4], most notably XML. Here, documents contain data values whose range is potentially unbounded and queries are allowed to perform comparison tests on such data. A similar scenario occurs in reference-based programming languages, such as object-oriented [6,2,12,17] or ML-like languages [18,19]. In such languages, memory is managed with the help of reference names that can be created afresh and compared for equality but are otherwise abstract. Other examples include array-accessing programs [1], which are allowed to use the array to store and compare elements of an unbounded domain, as well as programs with restricted integer parameters [7].
Such applications call for a robust theory of automata over infinite alphabets which can lead to an understanding comparable to that of the finite-alphabet setting. Such a theory will expose the limits of this model of computation and establish a complexity-theoretic guide for applications. A lot of the groundwork, surveyed in [22,3], was already dedicated to uncovering a notion of "regularity" in the infinite-alphabet case. Very early in that work, a way was proposed to extend the concept of finite memory to infinite alphabets which consisted in introducing a fixed number of registers for storing elements of the alphabet [13]. The constructed automata, called Finite-Memory Automata [13] or Register Automata [20], would otherwise look just as finite-state automata where the transition labels would also involve indices referring to register addresses. Building on the success of this work, another strand aimed to identify the infinite-alphabet "context-free" languages. To this end, Table 1 Complexity of the emptiness problem.
Register discipline S F S# 0 M F RA NL-c NP-c PSPACE-c PDRA EXPTIME-c EXPTIME-c EXPTIME-c Cheng and Kaminski [8] introduced a notion of context-free grammars over infinite alphabets and defined a corresponding notion of pushdown automata. Later, Segoufin presented a similar definition in [22], albeit couched in a way suitable to process data words. Our paper is devoted to studying exactly such context-free computational scenarios through an investigation of pushdown register systems (PDRS), devices in which registers are integrated with a pushdown store. Although of foundational nature, the work is largely motivated by the pertinence of such machines to software model checking [6,2]. A particular such application is in game-semantics-based verification [19,16], whereby the semantics of programs is algorithmically given by means of variants of pushdown register systems, which in turn are used as models to be fed in procedures for checking program equivalence. We present several new results on the complexity of reachability testing, which altogether fill a gap in the theory of "context-free" languages over infinite alphabets. More specifically, we make the following contributions.
Alphabet distinguishability A finite-memory automaton [13] with r registers can store r elements of the infinite alphabet at any instant. In fact, such automata are only capable of remembering r elements of the infinite alphabet over the course of a run -for any accepting run one can construct another one involving only r elements of the alphabet. 1 Here we show that, even though pushdown register systems have no bound on the number of elements of the alphabet that they can store at any instant, over the course of a run they can really "remember" at most 3r of them. More precisely, we show that for any run of a PDRS with r registers there exists an equivalent run, i.e. with the same initial and final configurations, but in which every configuration contains register assignments drawn from only 3r elements. Moreover, no smaller number is enough: we exhibit a family of PDRS whose runs require remembering at least 3r elements.

Reachability testing
The above-mentioned result yields an obvious methodology for reductions to the finite-alphabet setting, which immediately implies decidability of associated reachability and language emptiness problems. While the decidability of emptiness has already been proved in [8] using context-free grammars, we provide exact complexity bounds for the problem, namely, EXPTIME-completeness.
In the pushdown-free setting, language nonemptiness was known to be NL-, NP-and PSPACE-complete, depending on the register discipline. Three register assignment disciplines have been studied in the literature, which we shall call single and full (S F ), single and initially empty (S# 0 ) and multiple and full (M F ). A single assignment discipline requires that the contents of all registers be distinct, whereas a multiple assignment discipline allows for duplicate register contents. A full assignment discipline, on the other hand, requires that at all times every register must contain some letter from the infinite alphabet, whereas an initially empty discipline allows registers to be empty at the start of a run. The complexity of emptiness for register automata according to the assumed register discipline is given in the first row of Table 1: in the S F case the problem is NL-complete, as it coincides with emptiness of the underlying finite-state automaton; in the S# 0 case it becomes NP-complete [21], as one is able to use the registers to encode boolean assignments; while in the M F case one is able to encode a linear-size tape with the registers, and therefore the problem is PSPACE-complete [10]. In contrast, in the pushdown case, we show that such distinctions do not affect the complexity: even if identical elements can be kept in different registers, the problem can still be solved in EXPTIME and it is EXPTIME-hard already in the case where only distinct elements are allowed. In the latter case, the hardness proof is technically involved since sequences of distinct names do not provide a supportive framework for representing memory content (as needed in reduction arguments using computation histories).
Global reachability We give a simple, exponential-time algorithm for global reachability analysis. This analysis asks for a representation of all configurations from which a specified set of target configurations can be reached. In the finite-alphabet case it is well known that, if the target set is regular, the set of configurations that reach it can be captured by a finite automaton [5]. We prove an analogous result in the infinite-alphabet setting: given a PDRS S and a register automaton defining a set of target configurations T of S, our algorithm constructs a new register automaton that represents exactly the set of configurations that can reach some configuration in T . To ensure the algorithm is a smooth analogy of the saturation algorithm of [5], it manipulates a particularly succinct variant of register automata which we call a register manipulating register automaton (RMRA), but we show that such machines can always be transformed to a machine of the usual kind for at most an exponential increase in size.
Higher-order Higher-order pushdown automata [15] take the idea of pushdown storage further by allowing for nesting.
Standard pushdown store is considered to be order 1, while the elements stored in an order-k (k > 1) pushdown store are (k − 1)-pushdown stores. In the finite alphabet setting this leads to an infinite hierarchy of decidable models of computation with a (k − 1)-EXPTIME-complete problem at order k. We examine how the model behaves in the infinite alphabet setting, after the addition of a fixed number of registers for storing elements of the infinite alphabet.
We first observe that one can no longer establish a uniform bound on the number of symbols of the infinite alphabet that suffice to represent arbitrary runs. The existence of such a bound would imply decidability of the associated reachability problems, but the lack of a bound is not sufficient for establishing undecidability: indeed, the decidable class of data automata from [4] contains an automaton that can recognise all words consisting of distinct letters. Still, we show that the reachability problem for higher-order register pushdown automata is undecidable, already at order 2 and with one register.

Basic definitions
Let us assume a countably infinite alphabet D of data values or names. We introduce a simple formalism for computations based on a finite number of D-valued registers and a pushdown store. Writing [r] for {1, · · · , r}, by an r-register assignment we mean an injective map from [r] to D. We write Reg r for the set of all such assignments. 2 Definition 1. A pushdown r-register system (r-PDRS) is a tuple S = Q , q I , τ I , δ , where: • Q is a finite set of states, with q I ∈ Q being initial, • τ I ∈ Reg r is the initial r-register assignment, The operations executed in each transition have the following meaning: the i • operation refreshes the content of the i-th register; push(i) pushes the symbol currently in the i-th register on the stack; pop(i) pops the stack if the top symbol is the same as that stored in the i-th register; pop • pops the stack if the top of the stack is currently not present in any of the registers. This semantics is given formally below.
A transition sequence of S is a sequence ρ = κ 0 , · · · , κ k of configurations with κ j κ j+1 , for all 0 ≤ j < k. We say that ρ ends in a state q if q k = q, where q k is the state in κ k . We call ρ a run if κ 0 = (q I , τ I , ). Example 3. In this example we will go a little way beyond our definition and consider a register pushdown automaton rather than a register pushdown system, so that we can motivate the definition of PDRS by looking at a particular language of words that is accepted. An r-PDRA is an r-PDRS equipped with an additional family of transitions {i} i∈ [r] and a distinguished subset of final states. A transition i can be taken only if the next letter of the input word matches the contents of register i and the action of taking the transition is to consume the letter. The following example is a 2-PDRA accepting the language {w w R | w ∈ D * } of words w followed by their own reverse.
2 Thus, register assignments here are single and full (S F ). 3 For technical reasons, it is convenient to have ε-transitions. However, to keep the definition minimal, we observe that they can be simulated with push(1) followed by pop(1).
We draw the machine's only final state circled. The initial register assignment is unimportant, but let us say that it is {1 → a, 2 → b}. The behaviour of the machine is as follows. Starting from state q 0 , the automaton first guesses a letter c from the infinite alphabet D to use as a 'bottom of stack' marker and stores it in register 2. To ensure that the guess is otherwise unconstrained, this is implemented by two consecutive 2 • transitions (a single 2 • transition would allow for guessing any letter of D under the constraint that it is different from a and b). The machine then pushes this 'bottom of stack' marker onto the stack and moves into the loop on state q 3 . During this loop, the word w is consumed from the input by first guessing the next input letter using two consecutive 1 • transitions and then reading it in using the 1 transition. The last part of the loop has the machine store each consumed letter on the stack. At the point at which the machine nondeterministically chooses to enter q 7 , the configuration has the form (q 7 , {1 → d, 2 → c}, wc) where d is the final letter of w. In the loop on q 7 the machine reads in w R and, as in the finite-alphabet case, the reversal of the word is ensured by popping w off the stack. Finally, when the stack has been exhausted except for the 'bottom of stack' symbol c, then the machine may take the transition to q 2 and thus accept. Remark 4. r-PDRS is meant to be a minimalistic model allowing us to study reachability in the infinite-alphabet setting with registers and pushdown storage. Existing related models [8,22] feature transitions of a more compound shape, which can be readily translated into sequences of PDRS transitions.
For instance, a transition of an infinite-alphabet pushdown automaton [8] typically involves a refreshment (i • ) followed by pop (pop( j)) and a sequence of pushes (push( j)). This decomposition leads to a linear blow-up in size for translations of reachability questions into the r-PDRS setting. For register pushdown automata [22], an additional complication is their use of non-injective register assignments. Observe, though, that transitions in the non-injective framework can be easily mimicked using injective register assignments provided we keep track of the partitions determined by duplicated values in the original automaton. The book-keeping can be implemented inside the control state, which leads to an exponential blow-up in the size of the system, because the number of all possible partitions is exponential. Note that the number of registers does not change during such a simulation. Another difference is that register pushdown automata [22] are tailored towards data languages, i.e. a stack symbol is an element of D paired up with a tag drawn from a finite set. From this perspective, r-PDRSs use a singleton set of tags. Still, richer tag sets could be encoded via sequences of elements of D (for example, to simulate the i-th out of k tags, we could push sequences of the form d i . This reduction is achievable in polynomial time. Following [13,8,20], we mostly use injective register assignments. This is done to allow us to explore whether the restriction still leads to asymptotically more efficient reachability testing, as in the pushdown-free case. On a foundational note, injectivity gives a more essential treatment of freshness with respect to a set of registers: non-injective assignments can be easily used to encode PSPACE computations that have little to do with the interaction between finite control (and pushdown) and freshness.
Proof. The proof is by induction on n. When n ≤ 1, the result is trivial. Otherwise, we distinguish two cases.
In the first case, the transition sequence is of the form: in which the first transition is by push(i) (so d = τ 1 (i)), the last transition is by pop( j) or pop • and the stack does not empty until the final transition. Since d is never popped from the stack during the middle segment, also (q 1 , τ 1 , ) n−2 (q n−1 , τ n−1 , ) is a valid transition sequence and hence, from the induction hypothesis, there is a transition sequence between the same two configurations using no more than 3r names. By adding d to the bottom of every stack in this sequence one obtains another valid transition sequence: (q 1 , τ 1 , d) n−2 (q n−1 , τ n−1 , d) with τ 1 = τ 1 and τ n−1 = τ n−1 , and the new sequence features ≤ 3r names. It follows that the latter can be extended to the required: Otherwise, the transition sequence is of the form: with 0 < k < n. It follows from the induction hypothesis that there are sequences: with τ 0 = τ 0 , τ n = τ n , τ k = τ k and which each, individually, use no more than 3r names. Let N ⊇ ν(τ 0 ) ∪ ν(τ k ) ∪ ν(τ n ) be a set of names of size 3r. We aim to map ν(ρ 1 ) and ν(ρ 2 ) into N by injections i and j respectively. For i we set i(a) = a for any a ∈ (ν(τ 0 ) ∪ ν(τ k )) and otherwise choose some distinct b ∈ N \ (ν(τ 0 ) ∪ ν(τ k )). Similarly, for j we set j(a) = a for any a ∈ (ν(τ k ) ∪ ν(τ n )) and otherwise choose some distinct b ∈ N \ (ν(τ k ) ∪ ν(τ n )). Note that these choices are always possible because |ν(ρ 1 )| ≤ |N| ≥ |ν(ρ 2 )|. Finally, we extend i and j to permutations π i and π j on D. Since transition sequences are closed under permutations (Fact 5): is a valid transition sequence with π i · τ 0 = τ 0 , π j · τ n = τ n and which is supported by a subset of N. 2 Corollary 7. Fix an r-PDRS S and a state q of S. If there is a run of S ending in q then there is a run of S ending in q that is supported by at most 3r distinct names.
The 3r bound given above is optimal in the sense that there exists an r-PDRS such that all runs to a certain state will have to rely on 3r elements of D.

Silently transition to state q.
Now observe that the conditions in steps 3 and 6 and the fact that register assignments are injective ensure that |ν(τ I ) ∪ ν(τ 1 ) ∪ ν(τ 2 )| = 3r. Hence, any run reaching q is supported by exactly 3r distinct names. 2 Remark 9. The 3r bound given above can be adapted to the automata presentations of [8,22] yielding bounds 3r + (1). An adaptation of Lemma 8 improves upon Example 6 of [8], where a language requiring 2r − 1 different symbols was presented.
Being able to bound the number of registers is useful for obtaining reachability algorithms as it allows us to remove the complications of the infinite alphabet and reduce problems to the well-studied finite alphabet setting (e.g. Theorem 10).

Reachability is EXPTIME-complete
We consider the following decision problem.
r-PDRS Reach: Given an r-PDRS S and q ∈ Q , is there a run of S ending in q?
We shall show that the problem (and its counterparts for all the other closely related machine models) is EXPTIME-complete. Note that reachability is equivalent to language non-emptiness in the automata case.

Reachability is EXPTIME-solvable
Theorem 10. r-PDRS Reach and language emptiness for infinite-alphabet pushdown automata [8] and register pushdown automata [22] are solvable in exponential time.
Proof. Lemma 6 yields an exponential-time reduction of r-PDRS Reach to the classic reachability problem for pushdown systems over finite alphabets [5]: one can replace the r D-valued registers with r [3r]-valued registers, and then incorporate them into the finite control (for a singly-exponential blow-up of the state space). Since the latter problem is solvable in polynomial time, it follows that r-PDRS Reach is in EXPTIME.
By Remark 4, the emptiness problem for infinite-alphabet pushdown automata [8] can be reduced to r-PDRS Reach in polynomial time, immediately yielding the EXPTIME upper bound. 4 For register pushdown automata [22] we have an exponential-time reduction to r-PDRS Reach, which does not yield the required bound. However, recall that the translation into r-PDRS preserves the number of registers, so Lemma 6 still implies a linear upper bound for the number of D-values needed for finding an accepting run. Consequently, we can reduce language emptiness of register pushdown automata to a reachability problem for pushdown systems at an exponential cost. Since the latter is in P, the former is in EXPTIME. 2

Reachability is EXPTIME-hard
The bound given above is tight: we simulate a polynomial-space Turing machine with a stack (i.e. a polynomial-space auxiliary pushdown automaton [9]), which has an EXPTIME-complete halting problem. A reduction from the more familiar alternating polynomial-space Turing machines would also be possible, but Cook's model is closer to r-PDRS, which allows us to concentrate on the main issue of encoding binary memory content without the need to model alternation.

Theorem 11. r-PDRS Reach is EXPTIME-hard.
We first give an outline of the argument before describing the proof in detail.

Argument outline
Let us assume an auxiliary pushdown automaton M working over a binary tape of size n and a stack alphabet of size k. We can assume WLOG that every transition of M performs a single push or pop (but not both) along with a read/write by the head followed by a head movement. Moreover, let us assume that the stack alphabet of M includes a distinguished symbol $ marking the bottom of the stack and that, additionally, M starts with $ on the stack and halts when it is popped ($ is not used otherwise). Finally, we let the tape of M initially contain only 0's.
We shall construct a (6n + k + 1)-PDRS S such that M terminates iff S reaches a designated "final" state. The registers of S will be divided into 4 groups: of sizes k+1, 2n, 2n and 2n respectively.
• τ 0 will contain D-values coding the k stack symbols and an auxiliary symbol # (we write # for the letter which encodes #, etc.). It will be left untouched throughout the simulation.
• τ 1 and τ 2 will be used to encode the n-bit tape of M during push-and pop-transitions respectively. • τ 3 will have an auxiliary role and in particular will ensure the integrity of the tape when changing from pop-to push-transitions.
The simulation must maintain a representation of the current tape and stack content of M (as well as the current state, head position etc.). Since S is itself equipped with a pushdown stack, we shall use its stack to represent the stack of M by putting some distinguished k-element subset of D in bijection with the stack alphabet. A natural candidate for representing the tape content of M is the registers of S. However, the requirement that the register assignment be an injective map whose range is D makes constructing an encoding difficult: in any given register assignment, there are no non-trivial relationships between the elements! Hence, to encode information we are forced to use the register assignment in conjunction with other data.
Let us consider two register assignments τ and τ of length 2n. We say that such a pair is compatible just if, for all Although any given register assignment cannot encode any meaningful information, a pair of compatible register assignments can be used together to represent a tape t by a generalised xor, written τ [τ ]: In other words, the tape content at position 1 ≤ j ≤ n is 0 if τ and τ agree on the order of the data values {τ (2 j − 1), τ (2 j)} and 1 if they are the transposition of each other. We can think of the notation τ [τ ] as a binary function of τ and τ , in which case it has the property that any equation: can be solved uniquely for τ , τ or t (given the other parameters). This fact becomes essential to ensuring the integrity of the tape encoding when changing from simulating a pop to simulating a push transition. Note that although this binary function is commutative, the asymmetric notation reflects the fact that, by convention, we will view the first argument as being primary, often writing that τ is an encoding of t with respect to the mask τ .
We construct S such that, when in a configuration with register assignment τ which is faithfully simulating a push transition of M with tape content t, we have τ 1 [τ I 1 ] = t. When simulating a pop transition in such a configuration, we have τ 2 [τ I 2 ] = t. In other words, the masks used are just the initial register assignments to groups 1 and 2 respectively. Consequently, we have the invariant that, in any faithful simulation of M reaching a configuration with assignment τ , τ 1 and τ I 1 are compatible and τ 2 and τ I 2 are compatible.
At each step of the simulation, S needs to query its representation of the tape in order to determine which transition of M to apply, which entails computing, e.g. τ 1 [τ I 1 ]. However, due to the injectivity constraint on register assignments, for S to be able to access a pair of compatible register assignments, at least one must be stored on the stack. Hence, S will use the stack not only to encode the stack content of M, but also as part of the encoding of its tape content by storing copies of the masks τ I 1 and τ I 2 so that they are always accessible when needed. This dual use for the stack requires a considerable amount of bookkeeping.
The key problem to overcome is to ensure that the masks τ I 1 and τ I 2 are always available at the top of the stack when they are needed for decoding. Let us first consider τ I 2 which is somewhat easier because it is used for pop transitions.
Since M halts only with an empty stack, we know that for every pop transition made, there must have already been made a corresponding push transition. Hence, we arrange for S, when simulating a push transition with a stack of height h, to additionally push an extra copy of τ I 2 (which it has stored in its registers) so that it is available at the top of the stack when the machine next returns to a stack of height h, should it be required to simulate the corresponding pop transition.
Ensuring the availability of τ I 1 for the purpose of simulating push transitions is much more difficult. It is not possible to "pre-load" the stack with copies of τ I 1 in the same way as for τ I 2 because (i) the length of sequences of consecutive push transitions is not known and (ii) the dual use of the stack requires that copies of τ I 1 must be interleaved with data values simulating the letters of the stack alphabet pushed by M. Matters are further complicated by the fact that looking up the value of τ I 1 in order to compute τ 1 [τ I 1 ] requires popping it off the top of the stack. Consider the simulation of two consecutive push transitions. As part of the simulation of the first transition, τ I 1 must be popped and hence lost. The injectivity constraint on the registers ensures that the only way that it could be preserved (by temporarily popping it into the registers) would be at the cost of losing τ 1 instead. However, by the time the second transition is simulated, another copy is required to be accessible (i.e. be at the top of the stack again). We cannot "pre-load" the stack with copies of τ I 1 , we cannot temporarily store it in the registers and accessing a copy consumes it. Hence we are forced to construct S in such a way that it computes τ 1 [τ I 1 ] without accessing τ I 1 at all. To achieve this, we arrange for S to guess a mask τ 1 , compute τ 1 [τ 1 ] with respect to this guess and place the guessed mask on the stack. During the later simulation of pop transitions, when S has some spare capacity in its registers because τ 1 is no longer used to encode tape content, it will be able to discharge the obligation of verifying that it guessed τ 1 = τ I 1 .
So far, we have discussed the need to store three kinds of entities on the stack, namely: representations of the stack letters of M, copies of the mask τ I 2 and unverified guesses of the mask τ I 1 . In fact, to be able to switch from tape encoding using register group 2 to tape encoding using register group 1 (which happens whenever S simulates M performing a pop followed by a push) without loss of information, we need to maintain additional entities.
More specifically, during its operation, the stack of S will have the form: with |s i 1 | = |τ I 2 | = |s i 3 | = 2n and |s i 0 | = 1 (and arbitrary i). The top stack symbol is in the top-left corner, the element below it on the stack is on its right, s i−1 0 is below s i 3 etc. Each s j 0 above corresponds to a non-# stack symbol (as specified by τ 0 ).
The guessed masks, to be verified later, will be stored as s j 1 . To represent the tape at pops, we will use the mask τ I 2 .
Our simulation will make sure that this is correctly stored on the stack during pushes. Finally, the elements s j 3 , τ I 2 , s j 3 will be used to support the simulation when it switches from pops to pushes. The element s j 3 will also be a mask. There will also be "exceptional" rows, which have the form: where # is the encoding of # in τ I 0 . These rows will be used to verify the correctness of s j 3 , as we discuss later. Thus, in each row we store a stack symbol and 5 masks. The purpose of the masks is to help us determine the tape content of M. On the other hand, the current stack of M can be recovered by projecting out the first column of s and erasing any occurrence of # .
We next define the different steps of the simulation. Initially, there is an initialisation step pushing a row s 0 on the stack; S reaches its final state precisely when it successfully pops s 0 . Recall that every transition of M includes a push or a pop action. Accordingly, the states of S have two modes: a push-mode and pop-mode. Each transition of S non-deterministically guesses the mode of the next state (of S). S simulates the push-transitions of M using τ 1 [s i consecutive pairs of elements of τ 1 , subject to the previous requirement and the constraint expressed by equation (1). It next performs the operations of M (as instructed by y and z) according to the tape τ 1 [s i+1 1 ]. Thus, after these operations, the register assignment and top of the stack read 1 ] is the new tape content (in particular, we have written y in bit j). Finally, S chooses the kind of the next transition. If it is a push, then Ĉ is pushed on the stack (the name corresponding to C ). Otherwise, before switching to pop-mode, it has to transfer its tape-encoding from τ 1 to τ 2 . We achieve this by simultaneously moving s i+1 1 from the stack into τ 1 and changing τ I 2 into τ 2 so that τ 2 . This can be executed by popping s i+1 1 (2 j) and comparing it with τ 1 (2 j) for each bit 1 ≤ j ≤ n and, then, depending on the outcome, swapping the contents of registers 2 j − 1 and 2 j in each of τ 1 and τ 2 in order to reflect the desired change. Finally, we push s i+1 1 back on the stack, followed by Ĉ to arrive at Pop-mode S now uses τ 2 as the tape. Let the current configuration of S have stack as in (2) and let Suppose that M's head scans position j and the next transition is to be q S will first pop Ĉ from the stack and then pop s i 1 , simultaneously checking that it equals τ 1 (otherwise it will block). Next we pop τ I 2 to determine τ 2 [τ I 2 ] and perform the instruction (x, y, z) by changing τ 2 to τ 2 (and updating the head position in the state). Thus, we obtain Now S guesses the kind of the next transition. If it is to be a pop, S pops the remainder of s i . Otherwise, S should switch to push-mode and in particular change its tape-storing routine from τ 2 to τ 1 . That is, τ 1 needs to be updated to τ 1 such that τ 1 [τ 1 ] = t, for an appropriate mask τ 1 , where t = τ 2 [τ I 2 ] is the current tape. Also, having now preserved its value according to the encoding, τ 2 should be changed back to τ I 2 .
We are now faced with the following obstacle. Updating τ 1 to τ 1 would make us lose the current τ 1 . This would break our simulation as, although S has verified τ 1 = s i 1 , it remains to check that τ 1 is the same as all those guessed masks still on the stack, i.e. s i−1 1 , . . . , s 1 1 . Since entering push-mode requires that we overwrite the contents of τ 1 , we would like to preserve its current assignment on the stack. However, doing this directly is impossible since we need to obtain τ I 2 from lower down the stack in order to decode the current tape contents τ 2 . We overcome this by storing in the stack a guess for τ 1 , along with auxiliary masks which will allow us to verify this guess when popping. Moreover, we shall pick τ 1 = τ 1 . Hence, S operates as follows.
• It first pops s i 3 and stores it in τ 3 . • Then, it pops τ I 2 and stores it in τ 2 and, at the same time, it copies t in τ 1 and τ 3 , that is, it updates them to τ 1 and τ 3 respectively, such that • It pushes τ I 2 back on the stack.
• It then makes a guess τ 1 of τ 1 and pushes it on the stack. While doing so, it updates τ 3 to the mask s i 3 satisfying Thus, we end up with and the automaton switches to push-mode. Note that τ 1 uses τ 1 as a mask, yet we have τ 1 on the stack instead.
Nevertheless, by construction: Thus, when popping the row s i # , the automaton will additionally check that s i 3 = s i 3 and thus verify that the correct mask τ 1 has been stored on the stack.
Finally, we discuss the case when S is in pop-mode and the top of the stack is as in (3). In such a case, the pop transition of S is taken independently of M. In particular, let τ = τ I 0 τ 1 τ 2 τ 3 .
• S starts by popping # and s i 3 , and stores the latter in τ 3 . • Next, it pops τ I 2 and s i 1 , and checks that the latter is equal to τ 1 . • Finally, it pops τ I 2 and s i 3 , and checks that the latter is equal to s i 3 (which is now stored in τ 3 ).
Thus, according to our discussion above, S correctly verifies the continuity of the masks s i 1 while consuming the row s i # .
Altogether, the above construction yields a (6n +k + 1)-PDRS S of polynomial size with respect to n. Moreover, S pops s 0 iff it makes consistent guesses for masks used in its first component and, therefore, faithfully simulates the operations of M leading to popping the terminating symbol from its stack.

Argument in detail
We now make the above sketch more precise.
Proof. Let M = Q , q I , T , δ be an auxiliary pushdown automaton operating over a binary tape of size n and stack alphabet {1, · · · , k}, with $ ∈ {1, · · · , k} being a distinguished bottom-of-stack symbol. M has initial state q I , and let us assume its transition relation is of the following type, δ ⊆ Q × Op k × Q , with That is, in every transition, M reads a bit x from its current head position, writes back y, moves the head (Left, Right, or No-move), and pushes or pops a symbol from the stack. Moreover, we assume that M has initial tape 0 · · · 0 and initial stack $, and M halts when it pops $ from the stack ($ is not used otherwise). We construct a (k + 1 + 6n)-PDRS S such that M pops $ from the stack iff S reaches a designated state q F . In particular, The index j indicates the position of the head on the tape of M. Thus, at its initial position, M reads the first bit of the tape and can only perform a push. Q is a set of auxiliary states of polynomial size in n, which we gradually specify below. The initial assignment τ I is arbitrary; we divide the registers into 4 groups (of sizes k + 1, 2n, 2n and 2n respectively) and write register assignments τ in the form: τ = τ 0 :: τ 1 :: τ 2 :: τ 3 .
We moreover stipulate that, throughout the operation of S, the values of its group-0 registers remain fixed and, for each i = 1, 2, 3 and 1 ≤ j ≤ n, The discipline imposed above is instrumented so as to encode an n-size tape in each of τ 1 , τ 2 , τ 3 . In particular, for each i = 1, 2, 3 and 2n-components τ i , τ i , we can define an n-tape τ i [τ i ] by setting, for all 1 ≤ j ≤ n. We call τ i the mask of the encoding. Our PDRS S will simulate the operations of M using just such an encoding. On the other hand, the stack is grouped into rows of two possible forms: where the first component has size 1, and the rest have size 2n. In rows of the form (5), we stipulate that s i 0 =#. Here # = τ I 0 (k + 1) is a symbol we use precisely for distinguishing stack rows like (6), which we call exceptional rows. Note that components with index 2 and 3 are repeated in (5); while components with index 2 are repeated in (6). The index i in s i , s i # denotes the i-th row of the stack. The i-th row is on top of the (i − 1)-th, etc. At the bottom of the stack we will store the row: s 0 = τ I 0 ($) :: τ I 1 :: τ I 2 :: τ I 3 :: τ I 2 :: τ I 3 (7) where recall that $ ∈ {1, · · · , k} is the empty stack symbol. We proceed to define δ . As explained in the main text, we divide the operations of S into operations performed in push-mode and pop-mode. In push mode, the automaton uses the 1 -component of its registers for encoding the tape, using a mask which it needs to push on the stack at every step. As different push-steps do not share their masks (the registers store the encoded tape, not the mask used), these may in general differ. S correctly simulates the operations of M if the same mask is used in every push-step. Thus, S stores on the stack the mask used for each such step and, when in pop-mode, it verifies the consistency of those chosen masks. In particular, we impose that in every correct computation of S, all masks used in push-mode coincide with τ I 1 . In pop-mode, the automaton verifies the consistency of the push-mode masks and uses instead the 2 -component of the registers for storing the tape. The mask used for that encoding is τ I 2 , which is guaranteed to be readily available on the stack as, by construction every s i 2 appearing on the stack (in rows (5) or (6)) will satisfy s i We next proceed to the formal definition of the transitions of S. We define δ as the least relation containing the following transitions. 6 Push-mode. The automaton starts its operation by storing s 0 on the stack. That is, we include in δ the transition sequences which simply push on the stack the contents of registers {$} ∪ {k + 2, · · · , 6n + k + 1} in the required fashion and guess whether the next state is going to be in push-or pop-mode.
(q, j, ↓) with j + z = j − 1 if z = L, etc. All primed states are taken from Q . Moreover, guess 1 (q , j, x, y, z) is the gadget: q n q n−1 · · · q j q j−1 · · · q 0 push 1 (2n, 2n−1) with each q i being some (q , j, x, y, z, i, ↓) g ∈ Q , for i = 1, · · · , n, and q 0 = (q , j + z, i, ↓) . The transition sequence x → j 1 y assumes that the j-th bit of the tape (as encoded in the 1 -component) is x, pushes the corresponding mask registers on the stack (according to the value of x), and changes the value of the j-th bit to y: The transition sequence flip i ( j) (i = 1, 2) simply flips the j-th bit of the tape in the i -component of the registers: 6 Some notation: we write push 0 (i) for push(i), push 1 (i) for push(k+1+i), etc. Similarly for pops, and for referring to registers in general: e.g. j • 2 = (k+1+2n+ j) • . We write q t1;t2 − −− → q for the sequence of transitions q t1 − → q t2 − → q , choosing some unique q ∈ Q . Finally, we push sequences from right to left, i.e. write push i (i 1 , · · · , i m ) for push i (i m ); · · · ; push i (i 1 ), and let push i abbreviate push i (1, · · · , 2n) (push the full i-th component), while e.g. push 1,2 stands for push 2 ; push 1 . Dually for pops (in particular, we pop sequences left-to-right).
Thus, the transition sequence starts by performing a push of the 2 3 2 3 -components on the stack. It then guesses a mask for τ 1 , say s i+1 , and pushes it on the stack, while at the same time it updates τ 1 to τ 1 according to the write instruction y. At that point, it guesses whether it needs to switch to pop-mode. If it guesses that it should remain in push-mode, then it simply pushes the stack symbol i (i.e. its representation in τ I 0 ). Otherwise, it performs a switch by using switch(q , j, i, ↑), which is the following gadget.
Here each q i is some (q , j, i, ↑) s ∈ Q (i = 1, · · · , n) and q 0 = (q , j+z, i, ↓) . The above allows us to switch our tape-storing Pop-mode. For each (q, x, y, z, pop(i), q ) ∈ δ and j ∈ {1, · · · , n}, include the following transition sequences, with j + z as above and all primed states taken from Q . Note that, be definition, pop 1 pops the 1 -component off the top of the stack and checks that it is the same as the 1 -component of the registers. On the other hand, read 2 (q , j, x, y, z) is the gadget: with q 0 , q 1 , · · · , q n ∈ Q . 7 The transition sequence x → j 2 y is given by: Thus, the transition sequence starts by popping the stack symbol i and checking that the last guessed mask for τ 1 stored in registers equals the one stored at the top of the stack. It then continues to pop the mask τ I 2 for τ 2 , focussing specifically on the values determining the value of its j-th bit. It verifies that τ 2 [τ I 2 ]( j) = x and updates the latter to y (yielding some τ 2 ). At this point, it guesses whether the next state is going to be in pop-mode. If it guesses so, it simply pops the remaining top-row from the stack (without looking at the popped values). The latter is accomplished by the clear i gadgets: for appropriately chosen q 0 , · · · , q n ∈ Q . We specifically stipulate that if i = $ (the symbol signifying termination) then S will necessarily guess to stay in pop-mode and, instead of reaching state (q , j + z, ↑), it will drive itself to a designated state q F ∈ Q . 7 From this point forward we generally refrain from giving explicit names to auxiliary states, for simplicity. Such names can be given, similarly as in the push-mode case, in order to show that Q has size polynomial in the size of M.
If, on the other hand, the automaton guesses that the next state is in push-mode, it makes a switch of modes, using the switch(q , j, ↓) gadget, and pushes the special symbol τ I 0 (k + 1) on the stack. The switch(q , j, ↓) gadget is decomposed as follows: Recall that at this point in the simulation, the register assignment and top of the stack of S are as follows: τ = τ I 0 :: τ 1 :: τ 2 :: τ 3 s i = s i 3 :: τ I 2 :: s i 3 .
As described in the main text, the utility of the above is to: The pop-in 3 gadget simply performs a pop-into place for component 3 : for designated q 0 , · · · , q n ∈ Q . Next, pop-in 2 &copy-in 1,3 is the following gadget, resembling the previously described switch(. . . , ↑).
That is, it makes a guess for the mask at component 1 and pushes it on the stack while updating component 3 .
In order to conclude the definition of δ , we need to add pop-transitions for consuming rows starting with the "exceptional" symbol k + 1. As explained in the main text, the purpose of these transitions is simply to verify the continuity of the masks used in the 1 -component of S, using also information stored in the two 3 -components of the given stack row. In particular, S must verify that those two 3 -components are equal. We therefore add the following transition sequences in S, for every q ∈ Q and j ∈ {1, · · · , n}.
We claim that S reaches q F iff M pops $ from its stack. Note first that, if M has a computation leading to a pop-$, then S can simulate it by making sure it makes all guesses right, and thus reach q F . Conversely, as argued above, S may only reach its final state if all its guesses on used masks are correct. But any such run would faithfully simulate a run of M leading to pop-$, by construction. Finally, observe that the M → S reduction is poly-time. In particular, S has 6n + k + 1 registers and a state space of size polynomial in the number of transitions in M. 2 The EXPTIME-hardness carries over to the language emptiness problem associated with infinite-alphabet pushdown automata [8] and register pushdown automata [22]. Since the latter allows for storage of identical values in different registers, their hardness can also be established more directly by encoding relative to two fixed data values for 0 and 1. These different policies for register management are known to lead to different complexity bounds for emptiness testing in the absence of pushdown store: NP-completeness [21] 8 (injective assignment) vs PSPACE-completeness (non-injective assignment) [10]. Perhaps surprisingly, we have shown the presence of pushdown store cushions these differences and there is no analogous complexity gap.

Global reachability
We now move on to investigate global reachability for r-PDRS. We show that, given an r-PDRS S and a representation C of a set of configurations of S, one can construct, in exponential time, a representation of the set of configurations Pre * S (C) from which S can reach a configuration in C. To that end we extend the methodology of Bouajjani, Esparza and Maler [5] to the infinite alphabet setting.
The developments in this section rely on an auxiliary variant of (stack-free) register automata which feature symbolic transitions representing multiple rearrangements of registers. In order to describe them, let us introduce r-register manipulations, which are partial functions R ∈ [r] × [r] → {0, 1} such that R −1 {1} is a partial injection. We denote the set of all such partial functions by RegMan r and use R b to refer to R −1 {b}, for b ∈ {0, 1}. Given R, S ∈ RegMan r , we define R ; S as follows.
The operations of RMRAs generalise the stack-free operations of PDRSs: i ∈ [r] specifies reading a name already present in the i-th register, • reads a locally fresh name and R ∈ RegMan r is an internal action such that if q R − → q then any configuration (q, τ ) may transition to any configuration (q, τ ) satisfying τ R τ . In what follows, we will start RMRAs from various initial configurations, so we do not include an initial state or register assignment in their specifications.
Moreover, given an r-PDRS S = P , q I , τ I , δ such that P ⊆ Q , we say that A represents the S-configuration (p, τ , s) whenever s ∈ L(A)(p, τ ). We write C(A) for the set of S-configurations represented by A.
Given an r-RMRA characterising a set of configurations of an r-PDRS S, our aim is to construct another RMRA that represents exactly those configurations of S that can reach configurations in C(A), i.e. we aim to construct a representation of Pre *

S (C(A)).
We shall do this in the "saturation" style of the classical construction of [5] but we need more notation in order to deal with the infinite alphabet. Given R ∈ RegMan r , we say that: So, the meaning of R || i • , is that i in the situation before R may be locally fresh with respect to the situation after R.
We write q R − → * q just if there is some finite, possibly empty, sequence q i i∈ [n] such that q 1 = q and q n = q and, for all

Definition 14.
Given an r-PDRS S over states P , and given an r-RMRA A over states Q and transitions , such that P ⊆ Q and contains no transitions to states in P , we construct another r-RMRA SAT(A) by induction (note that op ranges over OP r ): where we additionally require R || i= j in rule (ii), and R || i • in rule (iii).
The above construction can be carried out in exponential time: consider that there are at most |Q × OP r × Q | many transitions added, which is at most exponential in the size of the input. For each transition, computation is either trivial or, in (ii) and (iii), involves computing exponentially many graph reachability queries.
Proof. Let the witness to the first premise be k, the proof is by induction on k. When k = 0 the result follows from rule (N). When k = n + 1, the transition sequence has the form: It follows from the induction hypothesis that w ∈ L(SAT(A))(p , τ ) (*). We continue by analysing the initial transition.
• If the initial transition is by p i • − → p then τ = τ [i → a] and w = w for some a fresh for τ . By part (i) of the construction also (p, τ ) (p , τ ) and hence w ∈ L(SAT(A))(p, τ ).
• If the initial transition is by p push(i) −−−−→ p then τ = τ and w = τ (i)w. By (*) there must be some transition sequence (p , τ ) * (q, σ ) (q , σ ) in SAT(A) with the final transition being the only transition to read an input: τ (i), and w ∈ L(SAT(A))(q , σ ). This final transition must be justified either by (1) q j − → q or (2) q • − → q . In both cases, the initial part of the sequence must be justified by some register manipulations p R −−−−→ SAT(A) * q. We distinguish between the two cases: (1) In the first case, necessarily τ (i) = σ ( j) and, therefore, R || i = j. It follows from part (ii) of the construction that (p, τ ) (q , σ ) and hence w ∈ L(SAT(A))(p, τ ).
• If the initial transition is by p pop(i) − −−− → p then τ = τ and w = τ (i)w and it follows from part (iv) of the construction that w ∈ L(SAT(A))(p, τ ).
• If the initial transition is by p pop • − −− → p then τ = τ and w = aw for some a fresh for τ . It follows from part (v) of the construction that w ∈ L(SAT(A))(p, τ ). 2 (SAT(A)).
For completeness, i.e. to see that SAT(A) does not accept any word which is not the stack component of some configuration reaching the target set, we first generalise the quantity Pre * S (C(A)). Define P * S (A) as follows: (C(A))} q ∈ P (recall that P is the set of states of the PDRS S). Observe that, if q ∈ P and w ∈ L(A)(q, τ ) then (q, τ , w) ∈ C(A), which implies w ∈ {s | (q, τ , s) ∈ Pre * S (C(A))}.

Proof. By induction on the construction of SAT(A) and case analysis on the last rule used in it:
(N) Note that, by our initial assumption, A contains no incoming transitions to states in P . Thus, in every case, q / ∈ P .
(i) If the construction is concluded by (i) then assume p i • − → S p and let w ∈ P * S (A)(p , τ ) and τ R i • τ , with p = q. It follows from the assumption that (p, τ , w) (p , τ , w) whenever τ = τ [i → a] for some fresh a. Since this is true of any τ such that τ R i • τ the result follows. q , with p = q. Let w ∈ P * S (A)(q , τ ) and let τ R[i = j] τ . It follows from the induction hypothesis that τ ( j)w ∈ P * S (A)(q , τ ) and, since R[i = j] is stronger than R, that τ ( j)w ∈ P * S (A)(p , τ ). Since τ (i) = τ ( j), it follows from the first assumption that w ∈ P * S (A)(p, τ ). (A)(p , τ ). Finally, it follows from the first assumption that w ∈ P * S (A)(p, τ ). (A)(p , τ ) and let a be fresh for τ . Then by definition aw ∈ P * S (A)(p, τ ). 2

Corollary 19. C(SAT(A)) ⊆ Pre * S (C(A)).
Proof. Let (p, τ ) · · · (q, τ ) with p ∈ P be a transition sequence of SAT(A) accepting some word w. Since q is necessarily a final state, ∈ L(A)(q, τ ) and then it follows from Lemma 18 that w ∈ Pre *

S (C(A)). 2
We can thus verify whether one can reach a configuration represented by A from a given configuration: construct the corresponding SAT(A) and check membership. To implement the latter in nondeterministic space, given a source configuration (q, τ , w), we need O (log |Q SAT(A) | + p(r) + log |w|) bits to track the state, register assignment and position in w respectively. This is polynomial space in S, A, w which, along with the construction of SAT(A), yields an exponential-time reachability testing routine.
Finally, let us observe that RMRAs are no more expressive than register automata with nondeterministic reassignment [14]. An r-RMRA A = Q , F , can be seen as an r-register automaton with nondeterministic reassignment (r-RA nr ) if The proof of this result is contained in Appendix A.

Higher-order pushdown systems
We now consider reachability at higher orders, defining pushdown register automata as a register-equipped analogue of the classical definition of [15]. We show that the reachability problem is undecidable.
A 1-stack is just a finite sequence of elements of D. For n > 1, an n-stack is a finite sequence of n − 1-stacks. We consider the following operations on 1-stacks: • push a   1 a l , . . . , a 1 = a, a l . . . , a 1 for any a ∈ D,   • pop 1 a l , a l−1 , . . . , a 1 = a l−1 , . . . , a 1 ,  • top 1 a l , a l−1 , . . . , a 1 = a l , and, in connection with n-stacks for n > 1: noting that every operation except push a 1 is undefined when applied to an empty stack. Finally, we write k for the k-stack defined as when k = 1 and k−1 otherwise.

Definition 21.
An order-n pushdown r-register system (r-nPDRS) is an r-PDRS with the vocabulary of operations Op r extended in the following way: Op n r = Op r ∪ { push k , pop k | 2 ≤ k ≤ n }. A configuration of an r-nPDRS is a triple (q, τ , s) with q and τ as before and s now an n-stack. The initial configuration is (q I , τ I , n ). A configuration (q 2 , τ 2 , s 2 ) is said to be a successor of a configuration (q 1 , τ 1 , s 1 ) just if there is some op ∈ Op n r such that (q 1 , op, q 2 ) ∈ δ and one of the following is true: • op = push(i), τ 2 = τ 1 and s 2 = push τ 1 (i) 1 s 1 , We show that, for all r and n > 1, r-nPDRS have undecidable reachability problems by showing undecidability for r = 1 and n = 2. For 1-2PDRS, we will write a configuration (q, {1 → a}, s) generally as (q, a, s). The following example shows how data held on a 1-stack of a 1-2PDRS can be copied and interrogated.

Example 22.
We demonstrate the lack of a uniform bound on the number of distinct data values needed to reach a designated state (for r-PDRS that bound is 3r). For every k ∈ N, there is an 1-2PDRS needing more than k names in order to reach state p k .
The idea is as follows, let the initial register assignment be the single element #. Whenever the machine is in state q 2 , its 2-stack is of the form a m , . . . , a 1 , #, # , for m ≥ 0, with a i = a j = # for all i = j. The use of ## serves to mark out the bottom of the stack. On each iteration of the cycle starting in q 2 , an additional data value is pushed onto the singleton 1-stack (upon leaving state q 3 ) which is then verified to be different from all the others. This verification is implemented by first taking a copy of the 1-stack using push 2 , then checking that the data value in the register is different from all other values on the stack using pop • . Now, the top copy of the 1-stack will be exhausted and the machine simply discards it with pop 2 , restoring the invariant and returning to state q 2 . Finally, note that the automaton can transition from q 2 to p k only if it has gathered at least k non-# values in its stack.
To show the undecidability of the reachability problem for higher-order PDRS, we reduce from the emptiness problem for weak pebble automata, which is known to be undecidable [20,23]. We find it convenient to use pebbles, because the push and pop instructions have a direct analogue in placing and lifting a pebble. Theorem 23. The reachability problem for r-nPDRS is undecidable for any n > 0.
Proof. For the full definition of pebble automata we direct the reader to [20]; we here recall only an outline. A weak k-pebble automaton (k-PA) is a tuple (Q , q 0 , F , T ) where Q is a finite set of states of which q 0 is initial and F ⊆ Q are final, and T is a finite set of transitions. Each transition is of the form α → β. In general α has shape (i, d, P , V , q) or (i, P , V , q) specifying: the index of the head pebble; (possibly) the data value under the head; the set of pebbles whose position coincides with the head; the set of pebbles on the same data as the head; and the state respectively. The shape of β is (q, A) with q the state to be moved to and A ∈ {stay, right, place, lift} the pebbling action to perform. Given a word w, a configuration of such a machine on w is a tuple (i, q, θ) where θ : {1, . . . , i} → {1, · · · , |w|} specifies the locations of the currently placed pebbles. WLOG we assume that |w| > 0. The initial configuration is (1, q 0 , θ 0 ) with θ 0 (1) = 1. 9 We now consider a particular kind of data structure which will be very useful for the undecidability argument.
Indexed stacks. We say that a 1-stack is in m-padded index form just if it has the following shape: c m · · · c 1 a n b n · · · a 1 b 1 ## in which #, a j , b j , c j ∈ D for all j. Furthermore, for all j and k: a j = #, a j = b k , and a j = a k =⇒ j = k. Also, for all j there is j such that c j = a j . Such 1-stacks are composed of three segments. The first segment ## is a 'bottom of stack' marker (such as in Example 22). The second segment a n b n · · · a 1 b 1 represents the indexed word (a 1 , b 1 ) · · · (a n , b n ), where the names a 1 , · · · , a n are called the indices and b 1 , · · · , b n are the values of the word. Finally, the third segment is a sequence of m indices.
Stacks in padded index form support a kind of dereferencing operation which allows a 1-2PDRS to retrieve the data value stored at some constant offset k from one of the indices. For m-padded index stacks the operation is implemented by the following gadget, which we call deref (m, k).
Starting from state p 0 with a j in its register, the machine first saves a copy of the working 1-stack. In the current copy, it discards the top segment and then the segment a n b n · · · a j+1 b j+1 . It then transitions to state p 2+m (consuming a j ) and then discards the next k-elements of the stack. Having traversed the constant offset it then refreshes the contents of its register and verifies that the new assignment is exactly the element on top of its 1-stack. Finally, it restores the original 1-stack. The following result is easily verified by inspecting the construction.
Lemma 24. Let (p 0 , a, s ) be a configuration of an 1-2PDRS containing deref (m, k) and in which s is an m-padded index with s(i) = a an index, for some i. 10 Then (p 0 , a, s ) * (p 5+m+k , b, s ) iff b = s(i + k + 1) and s = s .
Using deref it is possible to implement useful operations associated with the index structure. In particular, with index a assigned to the register, lookup(m) = deref (m, 0) looks up the value associated with index a and pred(m) = deref (m, 1) finds the preceding index of a.

Simulation of k-PA without constants
Given a k-PA A = (Q , q 0 , F , T ), we construct a 1-2PDRS S = Q , q I , τ I , δ that first guesses a non-empty 11 word w and then checks that w ∈ L(A) by simulating an accepting run of A on w.
For clarity of exposition, we shall assume that A does not recognise constants: i.e. there are no transitions of the form (i, d, P , V , q) → β. As we demonstrate in the following section, the proof can be extended to account for such transitions by modelling constants as sequences of identical data values of a fixed length.
The state space Q of S consists of the set as well as a number of auxiliary states which will be specified implicitly in the description to follow.
We say that a configuration κ of S is proper just if it is of the form: with w = b n · · · b 1 . We map proper configurations κ of S to configurations of A on w by the following surjection: Initialisation. Starting from its initial configuration, S begins in the same way as the system from Example 22 by pushing its initial register assignment twice to form a 'bottom of stack' marker. Then, starting from state q 2 , it loops nondeterministically building an indexed representation of the word w on its top 1-stack. On each iteration, when the system is in state q 2 , its 2-stack has shape a l , b l , · · · , a 1 , b 1 , #, # with singleton 1-stack in 0-padded index form. From state q 2 , S can either choose a new data value b l+1 followed by a new index a l+1 and return to state q 2 , or it can transition to state (q 0 , 1) as described below. In the first case, the machine uses two gadgets to ensure that the choices respect the desired invariant. We describe the gadget that ensures that the choice of b l+1 is different from any index below; the gadget to ensure that a l+1 is different from all other stack elements is exactly as in Example 22.
The path from q 2 to q 4 guesses the next data value x l+1 and places it at the top of the 1-stack. The remainder of the gadget is used to ensure that the guess does not coincide with one of the indices. The machine first takes a copy of the current 1-stack and then checks that every other data value on the stack is different from x l+1 . Finally, it restores the original 1-stack.
After with s = c m , . . . , c 1 , a n , b n , . . . , a 1 , b 1 , #, # . It guesses an applicable transition t = (m, P , V , q) → (q , A) and moves to state q t (P ,V ) . To verify the applicability of the transition S must check the applicability of the P and V components. To check applicability with respect to the V -component, S needs to check that V contains precisely those pebbles in positions which contain the same data value as that of the m-th pebble. Put otherwise, assuming c m = a m , we must have Thus, for each 1 ≤ j < m, S will find the j such that c j = a j , and then check the condition: b j = b m ⇐⇒ j ∈ V . Thus, S first copies the head position (currently at the top of the stack) into its register by executing two 1 • operations followed by pop (1) and push (1). Note that, because 1 • will always choose a data value that is fresh with respect to the current register contents, two occurrences of this operation are used sequentially to ensure that the correct data value can be guessed, even if it is already stored in the register. It then uses a copy of the lookup( j) gadget to retrieve the data value indexed by the head pebble and performs push (1) to put the data at the top of the stack. Then, for each 1 ≤ j < m in sequence, S uses a copy of the following gadget to check that the value indexed by c j (the data value under pebble j) is the same as that at the top of the stack just if j ∈ V .
This gadget copies the current 1-stack and then guesses and checks the position c j of pebble j. It then uses a copy of the lookup( j − 1) gadget to store the data value indexed by pebble j in its register. Next it restores the old 1-stack (which has the data value under the head pebble at the top of the stack) and: if j ∈ V then it verifies that the data value at the top and the data value in its register are the same (dotted arrow); if j / ∈ V then it verifies that these data values are different (dashed arrows). At the end of the sequence of m copies of the gadget, S discards the redundant data value from the top of the stack.
Checking applicability with respect to the P component is much simpler: S needs to check that, for each 1 ≤ j < m, c j = c m ⇐⇒ j ∈ P . This is achieved by the gadget: At the end of both sequences of gadgets, S transitions to state q t (q ,A) . By construction, we have κ * (q τ In state q t (q , A) , S simulates the action of A executing A and then moves to simulating state q . If A is stay, then S simply transitions to state (q , m). If A is lift-pebble, then S discards the top of the stack and transitions to (q , m−1). If A is place-pebble then S pushes an extra copy of the top of the current 1-stack on to the top of the current 1-stack and transitions to (q , m + 1). Finally, if A is move right, S pops the current pebble position (top of the stack) into its register and then copies the current 1-stack using push 2 . It then uses a copy of the pred(m − 1) gadget to reassign to its register the next index in the sequence and then restores the saved 1-stack, pushes the assignment and transitions to state (q , m).

The simulation loop then begins again.
It follows from the definition of the simulation loop that, for each proper configuration κ, and each configuration κ in a primary state, κ * κ iff κ is also proper and [ [κ] ] * [ [κ ] ]. Hence, L(A) is non-empty iff there is a final state q ∈ F and a pebble index m such that S has a run ending in state (q, m). Furthermore, the words accepted by a pebble automaton are delimited by markers , . Both of these aspects, which were omitted from the treatment in the main text, are addressed here through an encoding of constants. Since 1-2PDRS has only one register, it does not have a native ability to recognise all such constants and so this must be encoded. However, it is straightforward to do so using fixed length sequences of identical data values.

Simulation of k-PA with constants
To extend the construction from Theorem 23, we simulate constants appearing in the guessed word w. To this end, we consider an extended definition of m-padded index form stacks which have the following shape: c m · · · c 1 a n u n · · · a 1 u 1 # · · · # l + 2 times .
Here, the individual data values b j are replaced by words u j of length l + 1. We require that each index a j is distinct from every other as before and also that each a j is distinct from any data value in any u k . Each word u j encodes either a particular constant or an anonymous data value. The encoding is as follows. We require each u ∈ {u n , . . . , u 1 } to be composed of two segments u = b i · · · b 1 a l+1−i · · ·a 1 with i > 0, and a 1 = · · · = a l+1−i = b 1 = · · · = b i . The quantity i determines the value represented by the word: . and all that remains is to choose some b, push l + 1 − i copies of b onto the stack and check that a = b and that also b is different from any existing index. This is accomplished by the remaining part of the gadget.
In order to ensure that the word is properly delimited by the endmarkers, S is modified to always choose u 1 such that [ [u 1 ] ] = and to add an extra step of choosing a final encoded data value u n+1 and index a n+1 such that [ [u n+1 ] ] = .
When started from a configuration whose top 1-stack is in extended m-padded index form, the check(m) gadget ensures that the data value in the machine's register is different from any index in the stack.
The gadget first preserves the working 1-stack and then discards the m-padding values. It then cycles, alternating between checking that an index is fresh for the value in its register and discarding a length l + 1 word u j encoding a data value or constant. At some point it guesses that it has met the bottom of the stack and verifies the guess. Finally it restores the preserved stack. 2

Conclusion
We have studied reachability problems for pushdown register automata, adding new results to the literature on automata over infinite alphabets [22]. Although the automata are equipped with unbounded stack storage, we have shown that their discriminating power with respect to the infinite alphabet is quite restricted and only 3r elements suffice to answer reachability questions. Unlike in the pushdown-free case, variations in register disciplines no longer affect the complexity of reachability, which is EXPTIME-complete in every case. We have also shown that global reachability analysis can be carried out in exponential time. Finally, in contrast to the finite-alphabet case, the extension of pushdown storage to higher-order pushdown storage leads to undecidability.

Appendix A. From register-manipulating RAs to RAs with non-deterministic reassignment
We show the equivalence by a series of reductions, starting from RMRAs and reducing to more restricted machines until we reach RA nr s.
Definition 25. An r-RA of type X, for X ∈ {I, II, III}, is a triple A = Q , F , , ⊆ Q × OP X r × Q , with: where R α • is the partial function given by, for all i ∈ [r] and j ∈ α, R α • (i, j) = 0, and RAs of types I and II are special cases of RMRAs. Type-III RAs are variants in which the semantics of transitions q identical to that of sequences of RMRA-transitions: q Let A = Q , F , be an r-RMRA. We construct an r-RA A = Q , F , of type I as follows. We take and include in precisely the transitions given below. 12 12 Here we view the bijection π as an r-manipulation with component π 0 empty and π 1 = π . Moreover, we write R || (π ; R α • ) for the condition The idea is that the second component f of a given state (q, f ) of A maps register locations of configurations in A in state q to register locations of configurations of A in state (q, f ). For example, the first clause of the construction above says that, if there is an R transition in A from q to q and R can be decomposed as some permutation of locations π followed by some refreshes R α • then, in A , (q, f ) can transition to (q , f ) on R α • . Since R may refresh those locations in α which are themselves given by permuting locations according to π , it follows that the corresponding register locations are given in A by starting from α, undoing π and then consulting f . Now, let A 1 and A 2 be register automata (of any denomination). We say that a relation R between configurations of A 1 and A 2 is a simulation if, whenever κ 1 Rκ 2 , We say that R is a bisimulation if both R and R −1 are simulations.
Lemma 26. Let A be an r-RMRA and A be the type-I r-RA A constructed as above. Then, the relation Proof. Note first that both R and R −1 relate final configurations to final ones. Now, let (q, τ )R(q, f , τ ).
The cases of the other transitions are straightforward. 2 Now, let A = Q , F , be an r-RA of type I. We construct a 2r-RA A = Q , F , of type II accepting the same languages as A by simply decomposing the R α • -labelled transitions of A into constituent R i • -labelled ones. Note that, because of possible name-reuses in the composition R i • 1 ; · · · ; R i • m , the latter is not equivalent to R {i 1 ,··· ,i m } • . To avoid unintentional name-reuse, we add an additional r registers to record old names that should not be reused in a transition. In particular, we take q , m > 0, and (t, m − 1, f ) ∈ Q , add: 2r-assignments τ , τ such that τ = f ; τ , if (q, τ ) (q , τ ) then (q, f , τ ) * (q , f , τ ), for τ , f such that τ = f ; τ . Also, conversely, if (q, f , τ ) * (q , f , τ ) then (q, τ ) (q , f ; τ ). Our statement then follows from these two observations. 2 Finally, let A = Q , F , be an r-RA of type II. We construct a type-III (r+1)-RA A = Q , F , Lemma 28. Let A be a type-II r-RA and A be the type-III (r+1)-RA constructed as above. Then, the relation R = { ((q, τ ), (q, f ,τ )) | τ = f ;τ } is a bisimulation.
The cases of the other transitions are straightforward. 2 Summing up, we have the following.
Proof. By consecutively applying the three previous lemmas, and using the fact that bisimilarity implies language equivalence, we obtain the statement for Â a type-III (2r+1)-RA of exponential size. From the latter we obtain a (2r+1)-RA nr by simply breaking each transition of the form q