O-Minimal Invariants for Linear Loops

02/26/2018 ∙ by Shaull Almagor, et al. ∙ University of Oxford Max Planck Institute for Software Systems University of Warwick 0

The termination analysis of linear loops plays a key role in several areas of computer science, including program verification and abstract interpretation. Such deceptively simple questions also relate to a number of deep open problems, such as the decidability of the Skolem and Positivity Problems for linear recurrence sequences, or equivalently reachability questions for discrete-time linear dynamical systems. In this paper, we introduce the class of o-minimal invariants, which is broader than any previously considered, and study the decidability of the existence and algorithmic synthesis of such invariants as certificates of non-termination for linear loops equipped with a large class of halting conditions. We establish two main decidability results, one of them conditional on Schanuel's conjecture.



There are no comments yet.


page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

This paper is concerned with the existence and algorithmic synthesis of suitable invariants for linear loops, or equivalently for discrete-time linear dynamical systems. Invariants are one of the most fundamental and useful notions in the quantitative sciences, and within computer science play a central rôle in areas such as program analysis and verification, abstract interpretation, static analysis, and theorem proving. To this day, automated invariant synthesis remains a topic of active research; see, e.g., [17], and particularly Sec. 8 therein.

In program analysis, invariants are often invaluable tools enabling one to establish various properties of interest. Our focus here is on simple linear loops, of following form:


where is a

-dimensional column vector of variables,

is a -dimensional vector of integer, rational, or real numbers, is a square rational matrix of dimension , and represents the halting condition.

Much research has been devoted to the termination analysis of such loops (and variants thereof); see, e.g., [3, 2, 24]. For , we say that terminates on if it terminates for all initial vectors . One of the earliest and most famous results in this line of work is due to Kannan and Lipton, who showed polynomial-time decidability of termination in the case where and are both singleton vectors with rational entries [15, 16]. This work was subsequently extended to instances in which is a low-dimensional vector space [6, 8] or a low-dimensional polyhedron [7]. Still starting from a fixed initial vector, the case in which the halting set

is a hyperplane is equivalent to the famous Skolem Problem for linear recurrence sequences, whose decidability has been open for many decades 

[28, §3.9], although once again positive results are known in low dimensions [19, 31]. The case in which is a half-space corresponds to the Positivity Problem for linear recurrence sequences, likewise famously open in general but for which some partial results also exist [22, 21].

Cases in which the starting set is infinite have also been extensively studied, usually in conjunction with a halting set consisting of a half-space. For example, decidability of termination for and are known [30, 4]; see also [20]. In the vast majority of cases, however, termination is a hard problem (and often undecidable [33]

), which has led researchers to turn to semi-algorithms and heuristics. One of the most popular and successful approaches to establishing termination is the use of ranking functions, on which there is a substantial body of work; see, e.g., 

[2] which includes a broad survey on the subject.

Observe, for a loop such as that given in (1), that failure to terminate on a set corresponds to the existence of some vector from which loops forever. It is important to note, however, that the absence of a suitable ranking function does not necessarily entail non-termination, owing to the non-completeness of the method. Yet surprisingly, as pointed out in [14], there has been significantly less research in methods seeking to establish non-termination than in methods aimed at proving termination. Most existing efforts for the former have focused on the synthesis of appropriate invariants; see, e.g., [11, 9, 27, 25, 10, 26, 13].

In order to make this notion more precise, let us associate with our loop a discrete-time linear dynamical system . The orbit of this dynamical system is the set . It is clear that fails to terminate from iff is disjoint from . A possible method to establish the latter is therefore to exhibit a set such that:

  1. contains the initial vector , i.e., ;

  2. is invariant under , i.e., ; and

  3. is disjoint from , i.e., .

Indeed, the first two conditions ensure that contains the entire orbit , from which the desired claim follows thanks to the third condition.

In instances of non-termination, one notes that the orbit itself is always an invariant meeting the above conditions. However, since in general one does not know how to algorithmically check Condition (3), such an invariant is of little use. One therefore usually first fixes a suitable class of candidate sets for which the above conditions can be mechanically verified, and within that class, one seeks to determine if an invariant can be found. Examples of such classes include polyhedra [11], algebraic sets [26], and semi-algebraic sets [13].

Main contributions. We focus on loops of the form given in (1) above. We introduce the class of o-minimal invariants, which, to the best of our knowledge, is significantly broader than any of the classes previously considered. We also consider two large classes of halting sets, namely semi-algebraic sets, as well as sets definable in the first-order theory of the reals with exponentiation, denoted . Given , , and , our main results are the following: if is a semi-algebraic set, it is decidable whether there exists an o-minimal invariant containing and disjoint from , and moreover in positive instances such an invariant can be defined explicitly in ; for the more general case in which is -definable, the same holds assuming Schanuel’s conjecture.

We illustrate below some of the key ideas from our approach. Consider a linear dynamical system with whose orbit is depicted in Figure 4. In our example, spirals outward at some rate in the -plane, and increases along the -axis at some rate . Intuitively, and

are the moduli of the eigenvalues of


We now consider a ‘normalised’ version of , with both moduli set to . We then connect every point on the normalised orbit with a trajectory ray to its corresponding point on , while respecting the rates and (see Figure 4). One can observe that the normalised orbit is dense in the unit circle. We prove that any o-minimal invariant for must in fact eventually contain every trajectory ray for every point on the unit circle; we depict the union of these rays, referred to as the trajectory cone, in Figure 4. Finally, we show that any o-minimal invariant must in fact contain some truncation of the trajectory cone from below, starting from some height. That is, there is a uniform bound from which all the rays must belong to the invariant. Moreover, we can now synthesise an -definable o-minimal invariant by simply adjoining a finite number of orbit points to the truncated trajectory cone, as depicted in Figure 4.

Figure 1: The orbit of
Figure 2: Trajectory rays of .
Figure 3: Trajectory cone for .
Figure 4: Invariant for .

It is worth emphasising that, whilst in general there cannot exist a smallest o-minimal invariant, the family of truncated cones that we define plays the rôle of a ‘minimal class’, in the sense that any o-minimal invariant must necessarily contain some truncated cone. We make all of these notions precise in the main body of the paper.

The work that is closest to ours in the literature is [13], which considers the same kind of loops as we do here, but restricted to the case in which the halting set is always a rational singleton. The authors then exhibit a procedure for deciding the existence of semi-algebraic invariants. The present paper has a considerably broader scope, in that we deal with much wider classes both of invariants and halting sets. From a technical standpoint, the present paper correspondingly makes heavy use of model-theoretic and number-theoretic tools that are entirely absent from [13]. It is interesting to note, however, that the question of the existence of semi-algebraic (rather than o-minimal) invariants in the present setting appears to be a challenging open problem.

2 Preliminaries

The first-order theory of the reals, denoted , is the collection of true sentences in the first-order logic of the structure . Sentences in are quantified Boolean combinations of atomic propositions of the form where is a polynomial with integer coefficients, and are variables. Tarski famously showed that this theory admits quantifier elimination [29] and is therefore decidable. In addition to , we also consider the first-order theory of the reals with exponentiation, denoted , which augments with the exponentiation function .

A set is definable in a theory if there exists a formula in with free variables such that . A function with is definable in if its graph is an -definable set. For , the first-order theory of the reals, -definable sets (resp. functions) are known as semi-algebraic sets (resp. functions).

A theory is said to be o-minimal if every -definable subset of the reals is a finite union of points and (possibly unbounded) intervals.

A set is o-minimal if it is definable in some o-minimal theory that extends .

Tarski’s result on quantifier elimination [29] also implies that is o-minimal. The o-minimlity of , on the other hand, is due to Wilkie [32]. O-minimal theories enjoy many useful properties, some of which we list below, referring the reader to [12] for precise definitions and proofs. In what follows, is a fixed o-minimal theory.

  1. For an -definable set , its topological closure is also -definable.

  2. For an -definable function , the number is -definable (as a singleton set).

  3. O-minimal theories admit cell decomposition: every -definable set can be written as a finite union of connected components called cells. Moreover, each cell is -definable and homeomorphic to for some . The dimension of is defined as the maximal such occurring in the cell decomposition of .

  4. For an -definable function , the dimension of its graph is the same as the dimension of .

As mentioned above, is decidable thanks to its effective quantifier elimination procedure. Equivalently, given a semi-algberaic set, we can effectively compute its cell decomposition. Unfortunately, few more expressive theories are known to be decidable. The theory is decidable provided that Schanuel’s conjecture, an assertion in transcendental number theory, holds [18]. Our decidability result in Theorem 6 is subject to Schanuel’s conjecture; somewhat surprisingly, however, we exhibit in Theorem 6 an unconditional decidability result.

While all our -definable sets live in , it is often convenient or necessary to consider sets in . To this end, by identifying with , we define a set to be -definable if the set in is -definable.

A discrete-time linear dynamical system (LDS) consists of a pair , where and . Its orbit is the set . An invariant for is a set that contains and is stable under applications of , i.e., . Given a set , we say that the invariant avoids if the two sets are disjoint.

3 From the Orbit to Trajectory Cones and Rays

Let be an LDS with and . We consider the orbit . Write in Jordan form as where

is an invertible matrix, and

is a diagonal block matrix of the form , where for every , is a Jordan block corresponding to an eigenvalue :

Here , are of modulus 1, and . To reflect the block structure of , we often range over via a pair , with and , which denotes the index corresponding to row in block ; we refer to this notation as block-row indexing.

Henceforth, we assume that for all we have that (i.e., that the matrices and are invertible). Indeed, if , then is a nilpotent block and therefore, for the purpose of invariant synthesis, we can ignore finitely many points of the orbit under until is the block. We can then restrict our attention to the image of , by identifying it with .

Observe that now, for every set , we have that iff where .

For every , with

Every coordinate of is of the form for some and , where is a polynomial (possibly with complex coefficients) that depends on and .

Let and . We define to be the subgroup of the torus in generated by the multiplicative relations of the normalised eigenvalues . That is, consider the subgroup of , and let

Using Kronecker’s theorem on inhomogeneous simultaneous Diophantine approximation [5] it is shown in [23] that is a dense subset of .

Thus, for every , we have

We now define a continuous over-approximation of the expressions . To this end, if there exists some modulus larger than  (in which case, without loss of generality, assume that ), then for every let , and observe that . We then replace the expression with a continuous variable , so that becomes , and is replaced by . If all moduli are at most and some are strictly smaller than (in which case, without loss of generality, ), then replace the expression with . Note that in both cases, grows unboundedly large as tends to infinity. In Appendix A.1 we handle the special (and simpler) case in which all eigenvalues have modulus exactly 1. Henceforth, we assume that . If the proofs are carried out mutatis mutandis.

This over-approximation leads to the following definition, which is central to our approach. For every , we define the trajectory cone222These sets are, of course, not really cones. Nevertheless, if for all we have and the polynomials are constant, then the set is a conical surface formed by the union of rays going from the origin through all points of . The initial segments of the rays, of length determined by the parameter , are removed. for the orbit as

In particular, we have that .

In order to analyse invariants, we require a finer-grained notion than the entire trajectory cone. To this end, we introduce the following. For every and every , we define the ray333Likewise, this set is not strictly speaking a straight half-line. Observe that we have .

4 Constructing Invariants from Trajectory Cones

We now proceed to show that the trajectory cones defined in Section 3 can be used to characterise o-minimal invariants. More precisely, we show that for an LDS with , the image under of every trajectory cone , augmented with finitely many points from , is an invariant. Moreover, we show that such invariants are -definable, and hence o-minimal. Complementing this, we show in Section 5 that any o-minimal invariant must contain some trajectory cone.

In what follows, let , , as well as the real numbers be defined as in Section 3.

For every , the set is an -definable invariant for the LDS .

The intuition behind Theorem 4 is as follows. Clearly, the orbit itself is always an invariant for . However, it is generally not definable in any o-minimal theory (in particular, since it has infinitely many connected components). In order to recover definability in while maintaining stability under , the invariants constructed in Theorem 4 over-approximate the orbit by the image of the trajectory cone

under the linear transformation

. Finally, a finite set of points from is added to this image of the trajectory cone, to fill in the missing points in case is too large.

The proof of Theorem 4 has several parts. First, recall that the trajectory cone itself, , is an over-approximation of the set . As such, clearly . In comparison, the orbit can be written as . We prove in Appendix A.2 the following lemma, from which it follows that the entire set is also a subset of .

For every and , we have .

Let us simply remark here that by analysing the structure of the matrices involved in defining , and using the facts that the columns of

are generalised eigenvectors of

, and that conjugate pairs of eigenvalues correspond to conjugate pairs of generalised eigenvectors, it is not hard to see that the above product does indeed yield only real values. However, a formal proof of this involves fairly tedious calculations. We invoke instead an analytic argument in Appendix A.2.

In the second part of the proof of Theorem 4, we show that is stable under . The key ingredient is the following lemma, which characterises the action of on rays, and is proved in Section 4.1.

For every and , we have .

The next lemma then lifts Lemma 4 to the entire trajectory cone.

For every , we have .


Recall that . By Lemma 4 we have that . Since , it follows that . In addition, iff . Hence we have that , from which we conclude that . ∎

The proof of Theorem 4 combines all these ingredients together and is given in subsection 4.2.

4.1 Proof of Lemma 4

Let . We claim that . Note that since , the above suffices to conclude the proof.

Consider a coordinate of in block-row index, with . The case of is similar and simpler. To simplify notation, we write and instead of and , respectively. Then we have

Recall that

with in block-row index. We can then write


We now compare this to coordinate of our claim, namely


We compare the right-hand sides of Equations (2) and (3) by comparing the coefficients of for (these being the only ones that appear in the expressions). For we see that in (2) the number occurs in the first summand only, and its coefficient is thus , while in (3) it is , since . Thus, the coefficients are equal.

For , write with ; the coefficient at in (2) is then

where the last equality follows from a continuous version of Pascal’s identity. Finally, by noticing that , it is easy to see that this is the same coefficient as in (3).

4.2 Proof of Theorem 4

Let . By applying Lemma 4 to every , we conclude that . It is then easy to see that is definable in (note that the only reason the set might fail to be -definable is that the underlying domain should be and not ).

Next, by Lemma 4 we have that . Applying from the left, we get . Thus, we have .

Finally, observe that . Since any finite subset of can be described in , we conclude that the set is an -definable invariant for .

5 O-Minimal Invariants Must Contain Trajectory Cones

In this section we consider invariants definable in o-minimal extensions of . Fix such an extension for the remainder of this section.

Consider an -definable invariant for the LDS . Then there exists such that .

To prove Theorem 5, we begin by making following claims of increasing strength:

Claim 1.

For every there exists such that or .

Claim 2.

For every there exists such that .

Claim 3.

There exists such that for every we have .

  • Fix . Observe that by Lemma 4, is -definable. Further note that is of dimension 1 (as it is homeomorphic to ). Thus, the dimension of is at most , so its cell decomposition contains finitely many connected components of dimensions 0 or 1. In particular, either one component is unbounded, in which case there exists a such that , or all the components are bounded, in which case there exists a such that . ∎

Before proceeding to Claim 2, we prove an auxiliary lemma, which is an adaptation of a similar result from [13]. For a set , we write to refer to the topological closure of . We use the usual topology on , , and the (usual) subspace topology on their subsets.

Let be -definable444Recall that in order to reason about in we identify with . sets such that . Then .


We start by stating two properties of the dimension of a definable set in an o-minimal theory . First, for any -definable set we have [12, Chapter 4, Theorem 1.8]. Secondly, if are -definable subsets of that have the same dimension, then has non-empty interior in [12, Chapter 4, Corollary 1.9]. In the situation at hand, since , it follows that has non-empty interior with respect to the subspace topology on = . But then is dense in while has non-empty interior in , and thus . ∎

  • We strengthen Claim 1. Assume by way of contradiction that there exist and such that , and consider . Let be and let . Then and and, by Lemma 4, . Since is invertible, we conclude that .

    We now claim that . Recall that . Applying , we have by the above that . Since , then , so we have .

    Recall that, following the discussion in section 3, we have . This implies and , so in particular . Thus, assuming , we have just proved that ; repeating this argument, we get that for every , the point satisfies .

    Let . Then is dense in , since the group of multiplicative relations defined by the eigenvalues of is the same as the one defined by those of . Define . Then is -definable, and we have . Moreover, , so .

    We now prove that, in fact, . Assuming (again by way of contradiction) that there exists , then by the definition of we have . It follows that for every , the point also satisfies . Define , then is dense in . But then the set satisfies and . Now the sets and are both definable in , and the topological closure of each of them is . It follows from Lemma 5 that , which is clearly a contradiction. Therefore, there is no ; that is, .

    From this, however, it follows that , which is again a contradiction, since and , so we are done. ∎

  • Consider the function defined by . By Claim 2 this function is well-defined. Since is -definable, then so is . Moreover, its graph has finitely many connected components, and the same dimension as . Thus, there exists an open set (in the induced topology on ) such that is continuous on . Furthermore, is homeomorphic to for some , and thus we can find sets such that is open, and is closed555In case , the proof actually follows immediately from Claim 2, since is finite.. Since is continuous on , it attains a maximum on . Consider the set . By the density of in , this is an open cover of , and hence there is a finite subcover . Since , it follows that is a finite closed cover of .

    We now show that, for all , we have . Indeed, consider any and such that . Applying , we get . By Lemma 4, , so we can conclude that . This means that implies ; therefore, .

    Now denote . Then for every we have ; so is indeed bounded on . ∎

Finally, we conclude from Claim 3 that there exists such that . This completes the proof of Theorem 5.

6 Deciding the Existence of O-Minimal Invariants

We now turn to the algorithmic aspects of invariants and present our two main results, Theorems 6 and 6.

Let be either or . We consider the following problem: given an LDS , with and , and given an -definable halting set , we wish to decide whether there exists an o-minimal invariant for that avoids . We term this question the O-Minimal Invariant Synthesis Problem for -Definable Halting Sets.

The following is a consequence of Theorems 4 and 5.

Let and be as above, and let be -definable. Then there exists an o-minimal invariant for that avoids iff there is some such that and such that for every .


By Theorem 5, if an o-minimal invariant for exists, then there exists such that . Moreover, implies , so that for every , and in particular for .

Conversely, let there be such that and, for every , it holds that . Let be such that . By Theorem 4, the set is an -definable invariant that avoids . ∎

Observe that the formula is a sentence in , and by Lemma 6, deciding the existence of an invariant amounts to determining the truth value of this sentence.

Decidability for -definable halting sets assuming Schanuel’s conjecture.

Applying Theorem 4, we note that an invariant for that avoids —if one exists—can always be defined in .

The O-Minimal Invariant Synthesis Problem for -Definable Halting Sets is decidable, assuming Schanuel’s conjecture.


Assume Schanuel’s conjecture. Then by [18], we have that is decidable. Thus we can decide whether there exists such that . If the sentence is false, then by Lemma 6 there is no invariant, and we are done. If the sentence is true, however, it still remains to check whether for every . While we can decide whether for a fixed , observe that we do not have an a priori bound on . Hence we proceed as follows: For every , check both whether and, for , whether . In case , then clearly there is no invariant, since , and we are done. On the other hand, if , then return the semi-algebraic invariant as per Lemma 6.

We claim that the above procedure always halts. Indeed, we know that there exists for which . Thus, either for some , it holds that , in which case there is no invariant and we halt when we reach , or we proceed until we reach , in which case we halt and return the invariant. ∎

It is interesting to note that, should Schanuel’s conjecture turn out to be false, the above procedure could still never return a ‘wrong’ invariant. The worse that could happen is that decidability of fails in that the putative algorithm of [18] simply never halts, so no verdict is ever returned.

Unconditional decidability for semi-algebraic halting sets.

The O-Minimal Invariant Synthesis Problem for Semi-Algebraic Halting Sets is decidable. Moreover, in positive instances, we can explicitly define such an invariant in .

By Lemma 6, in order to prove Theorem 6 it is enough to decide the truth value of the sentence . Indeed, as , one can always check unconditionally whether for a given the vector belongs to the semi-algebraic set . The algorithm is then otherwise the same as that presented in the proof of Theorem 6. The proof of Theorem 6 therefore boils down to the following lemma.

For a semi-algebraic set, it is decidable whether there exists such that .

Our key tool is the following celebrated result from transcendental number theory: [Baker’s theorem [1]] Let