We consider the following postcondition problem: Given a program , discover a fact that holds at the end of regardless of the initial state. This paper focuses on a postcondition written as an algebraic condition , where are polynomials over program variables; this problem is a basis for static verification of functional correctness.
One approach to this problem is invariant synthesis, in which we are to compute a family of predicates indexed by program locations such that holds whenever the execution of reaches . The invariant associated with the end of is a solution to the postcondition problem.
Because of its importance in static program verification, algebraic invariant synthesis has been intensively studied [20, 16, 19, 4]. Among these proposed techniques, one successful approach is the constraint-based method in which invariant synthesis is reduced to a constraint-solving problem. During constraint generation, this method designates templates, which are polynomials over the program variables with unknown parameters at the coefficient positions . The algorithm generates constraints that ensure that the templates are invariants and obtains the invariants by solving the constraints111The constraint-based method by Cachera et al. , which is the basis of the current paper, uses a template also for other purposes. See Section 6 for details..
The program in Figure 1 models the behavior of a mass point with weight and with a constant acceleration rate; the program takes friction between the mass point and air into account222Although the guard condition should be in a real-world numerical program, we use the current example for presentation purposes.. For this program, the postcondition holds regardless of the initial state.
We describe how a template-based method computes the postcondition in Example 1. The method described here differs from the one we explore in this paper; this explanation is intended to suggest the flavor of a template method.
A template-based method generates a template polynomial
over the program variables that represent an invariant at Line 4. Suppose the generated polynomial is of degree 2 over the variables: , where is the coefficient parameter associated with the power product . The procedure then generates constraints such that is indeed an invariant at Line 4. The method proposed by Sankaranarayanan et al.  based on the Gröbner basis  generates the constraints as an equations over the parameters; in this case, a solution to the constraints gives , which is indeed an invariant at the end of .
One of the drawbacks of the template-based method is excessive growth of the size of a template. Blindly generating a template of degree for a degree parameter makes the invariant synthesis less scalable for higher-degree invariants. For example, the program in Example 1 has an invariant at Line 4. This invariant requires a degree- template, which has monomials in this case.
We propose a hack to alleviate this drawback in the template-based methods. Our method is inspired by a rule of thumb in physics called the principle of quantity dimension: A physical law should not add two quantities with different quantity dimensions . If we accept this principle, then, at least for a physically meaningful program such as , an invariant (and therefore a template) should consist of monomials with the same quantity dimensions.
Indeed, the polynomial in the invariant calculated in Example 1 consists only of quantities that represent velocities. (Notice that is a quantity that corresponds to the inverse of a time quantity.) The polynomial above consists only of quantities corresponding to the length. If we use the notation of quantity dimensions used in physics, the former polynomial consists only of monomials with the quantity dimension , whereas the latter consists only of , where and represent quantity dimensions for lengths and times, respectively.
By leveraging the quantity dimension principle in the template synthesis phase, we can reduce the size of a template. For example, we could use a template that consists only of monomials for, say, velocity quantities instead of the general degree- polynomial used above, which yields a smaller template.
The idea of the quantity dimension principle can be nicely captured by generalizing the notion of homogeneous polynomials. A polynomial is said to be homogeneous if it consists of monomials of the same degree; for example, the polynomial is a homogeneous polynomial of degree . We generalize this notion of homogeneity so that (1) a degree is an expression corresponding to a quantity dimension (e.g., ) and (2) each variable has its own degree in degree computation.
Let us describe our idea using an example, deferring formal definitions. Suppose we have the following degree assignment for each program variable: . This degree assignment intuitively corresponds to the assignment of the quantity dimension to each variable. With this degree assignment , all of the monomials in have the same degree; for example, the monomial has degree and monomial has degree , and so on. Hence, is a homogeneous polynomial in the generalized sense. Such a polynomial is called a generalized homogeneous (GH) polynomial. We call an algebraic invariant with a GH polynomial a generalized homogeneous algebraic (GHA) invariant.
The main result of this paper is a formalization of this idea: If there is an algebraic invariant of a given program , then there is a GHA invariant. This justifies the use of a template that corresponds to a GH polynomial in the template method. We demonstrate this result by using the abstract semantics of an imperative programming language proposed by Cachera et al. . We also empirically show that the algorithm by Cachera et al. can be made more efficient using this idea.
As we saw above, the definition of GH polynomials is parameterized over a degree assignment . The type inference algorithm for the dimension type system proposed by Kennedy [12, 13] can be used to find an appropriate degree assignment; above is inferred using this algorithm. The dimension type system was originally proposed for detecting a violation of the quantity-dimension principle in a numerical program. Our work gives an application of the dimension type system to invariant synthesis.
Although the method is inspired by the principle of quantity dimensions, it can be applied to a program that does not model a physical phenomenon because we abstract the notion of a quantity dimension using that of generalized homogeneity. All the programs used in our experiments (Section 7) are indeed physically nonsensical programs.
The rest of this paper is organized as follows. Section 2 sets up the basic mathematical definitions used in this paper; Section 3 defines the syntax and semantics of the target language and its abstract semantics; Section 4 defines GH polynomials; Section 5 defines the revised abstract semantics as the restriction of the original one to the set of GH polynomials and shows that the revised semantics is sound and complete; Section 6 gives a template-based invariant-synthesis algorithm and shows its soundness; Section 7 reports the experimental results; Section 8 discusses related work; and Section 9 presents the conclusions. Several proofs are given in the appendices .
is the set of real numbers and is the set of natural numbers. We write for the cardinality of if is a finite set. We designate an infinite set of variables . is a field ranged over by metavariable ; we use the standard notation for the operations on . For , we write , ranged over by and , for the set of polynomials in over .
A subset is called an ideal if (1) is an additive subgroup and (2) for any and . A set is said to generate the ideal , written , if is the smallest ideal that contains .
We call an expression of the form , where and , a power product over ; is a metavariable for power products. We call the degree of this power product. A monomial is a term of the form ; the degree of this monomial is that of . We write , the degree of the polynomial , for the maximum degree of the monomials in .
A state, ranged over by , is a finite map from to . We write for the set of states. We use the metavariable for a subset of . We write for the evaluated value of under . Concretely, . The set constitutes a complete lattice with respect to the set-inclusion order.
This section defines the target language, its concrete semantics, and its abstract semantics. We essentially follow the development by Cachera et al. ; we refer the interested reader to this paper.
The syntax of the target language is as follows:
where is a polynomial over the program variables. We restrict the guard to a single-polynomial algebraic condition (i.e., ) or its negation.
The semantics of this language is given by the following denotation function, which is essentially the same as that by Cachera et al.
where and is the greatest fixed point of . Intuitively, means that executing from results in a state in if the execution terminates; notice that should be in if does not terminate. The semantics uses the greatest fixed point instead of the least fixed point in the statement so that contains the states from which the execution of does not terminate. If we used the least fixed point in the semantics of a while loop, then only the initial states from which the program terminates would be in the denotation of the loop. For example, consider the following program that does not terminate for any initial state: . Then, should be . However, if the denotation of a loop were given by the least fixed point, then would be .
Recall the program in Figure 1. Let be , be , be , and be . We show that . We write for , and for . We have where . It is easy to check that , so it suffices to show that . This holds because is a fixed point of . Indeed, as desired. Note that because does not change the value of .
The abstract semantics is essentially the same as that given by Cachera et al.  with a small adjustment. The preorder is defined by 333The original abstract semantics of Cachera et al.  is defined as a transformer on ideals of polynomials; however, we formulate it here so that it operates on sets of polynomials because their invariant-synthesis algorithm depends on the choice of a generator of an ideal.. Then is a complete lattice, and the meet is given as the set unions: Given and , for all if and only if .
The abstraction is defined by , the polynomials evaluated to under all the states of . The concretization is defined by , the states that evaluate all the polynomials in to . The pair of and constitutes a Galois connection; indeed, both and are by definition equivalent to the following: . For example, the set of a state is abstracted by the set ; this set is equivalently , the ideal generated by and .
The definition of the abstract semantics is parameterized over a remainder-like operation that satisfies for some ; we allow any that satisfies this condition to be used. Note that this differs from the standard remainder operation where we require — the greatest monomial in with respect to a monomial order — not to divide any monomial in . We write , where is a set of polynomials, for the set .
The abstract semantics is defined as follows.
In this definition, and is the polynomial obtained by replacing with in . exists for an arbitrary monotone because we are working in the complete lattice ; concretely, we have .
transfers backward a set of polynomials whose values are . Cachera et al. [4, Theorem 3] showed the soundness of this abstract semantics: For any program and a set of polynomials , we have . Although our abstract values are sets rather than ideals, we can prove this theorem in the same way (i.e., induction on the structure of ) as the original proof.
The highlight of the abstract semantics is the definition of . In order to explain this case, let us describe a part of the soundness proof: We show assuming and . Suppose . Our goal is to show . Therefore, it suffices to show that (1) implies , and (2) implies .
We first show that if then . By the induction hypothesis, we have , so it suffices to show that . Take . Then there exists and such that . Because and and , we have . Since is an arbitrary element of , by definition of we conclude that .
Next we show that implies . By the induction hypothesis, we have , so it suffices to show that . Take . Then , thus . From the assumption , this implies . Since is arbitrary, we conclude that 444The soundness would still hold even if we defined by instead of . The multiplier makes the abstract semantics more precise..
The abstract semantics is related to the postcondition problem as follows:
If , then (hence is a solution of the postcondition problem for any ).
From the soundness above, ; therefore follows because is the top element in the concrete domain.
We exemplify how the abstract semantics works using the program in Figure 1. Set , , and as in Example 2. Define in this example by . First, let , , , and . Then . Indeed, by definition of , we have , and it is easy to check that . Therefore we have , because is the greatest lower bound of . By simple computation, we can see that is a fixed point of , so we also have ; hence, . Therefore, : .
By Theorem 3.1, a set of polynomials such that for some constitutes a solution of the postcondition problem. The choice of indeed matters in solving the postcondition problem: There are and such that holds for some but not for others. The reader is referred to [4, Section 4.1] for a concrete example.
4 Generalized homogeneous polynomials
We first generalize the notion of the degree of a polynomial.
The group of generalized degrees (g-degrees) , ranged over by , is an Abelian group freely generated by the finite set ; that is, . We call the set of the base degrees. We often omit in if the set of the base degrees is clear from the context.
For example, if we set to , then , and are all generalized degrees. By definition, has the multiplication on these g-degrees (e.g., and ).
In the analogy of quantity dimensions, the set corresponds to the base quantity dimensions (e.g., for lengths and for times); the set corresponds to the derived quantity dimensions (e.g., for velocities and for acceleration rates.); multiplication expresses the relationship among quantity dimensions (e.g., for .)
A g-degree assignment is a finite mapping from to . A metavariable ranges over the set of g-degree assignments. For a power product , we write for and call it the g-degree of under (or simply g-degree of if is not important); , the g-degree of a monomial under , is defined by .
For example, set to ; then . In terms of the analogy with quantity dimensions, this means that the expression represents a length.
We say is a generalized homogeneous (GH) polynomial of g-degree under if every monomial in has the g-degree under . We write for the g-degree of if it is a GH polynomial under ; if it is not, then is not defined. We write for the set of the GH polynomials with g-degree under . We write for .
The polynomial (the polynomial in Example 2) is a GH-polynomial under
because all the monomials in have the same g-degree in common; for example, ; ; ; and . Therefore, . We also have .
It is easy to see that any can be uniquely written as the finite sum of GH polynomials as , where is the summand of g-degree under in this representation. For example, the polynomial in Example 2, can be written as where and from the previous example. We call the homogeneous component of with g-degree under , or simply a homogeneous component of ; we often omit part if it is clear from the context.
The definitions above are parameterized over a g-degree assignment . It is determined from the usage of variables in a given program, which is captured by the following type judgment.
The judgment is the smallest relation that satisfies the rules in Figure 2. We say is consistent with the program if holds.
4.2 Automated inference of the g-degree assignment
Kennedy also proposed a constraint-based automated type inference algorithm of his type system [12, 13]. We adapt his algorithm so that, given a command , it infers a g-degree assignment such that . The algorithm is in three steps: (1) designating a template of the g-degree assignment, (2) generating constraints over g-degrees, and (3) solving the constraints. In order to make the current paper self-contained, we explain each step below.
Step 1: Designating a template of the g-degree assignment
Let be the set of the variables occurring in the given program . Then, the algorithm first designates a template g-degree assignment where are fresh unknowns taken from the set for the g-degrees of . For example, given the program in Figure 1, the algorithm designates
where are distinct unknowns for the g-degrees of the variables that are to be inferred.
Step 2: Generating constraints over g-degrees
The algorithm then generates the constraints over the g-degrees. We first define the set of constraints. Let be in the rest of this section, where are the unknowns generated in the previous step. (Recall that is the set of g-degrees generated by . Therefore, is the set of products of the form for .) The generated in the previous step can be seen as a map from to .
A g-degree constraint is an equation where . We use a metavariable for maps from to . This map can be naturally extended to take the elements of . We say that is a solution of a constraint set if it satisfies all the equations in . For example, the map is a solution of the constraint set since .
For a polynomial , we write for the pair where is if and otherwise. The intuition of is that, for any solution of , the polynomial is generalized homogeneous and its g-degree is .
For example, let be and be ; then, is the pair where is