On Termination of Integer Linear Loops

02/20/2019 ∙ by Mehran Hosseini, et al. ∙ 0

We consider the problem of determining termination of single-path loops with integer variables and affine updates. The problem asks whether such a loop terminates on all integer initial values. This problem is known to be decidable for the subclass of loops whose update matrices are diagonalisable. In this paper we show decidability of determining termination for arbitrary update matrices, but with a single inequality as the loop guard. Our decision procedure relies on number-theoretic results concerning Diophantine approximation. For the class of loops considered in this paper, the question of deciding termination on a specific initial value is a longstanding open problem.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

Termination is a central problem in program verification. In this paper we study termination of single-path linear loops, i.e., programs of the form

where and are affine maps with integer coefficients. Here the loop body has a single control path that performs a simultaneous affine update of the program variables. Analysis of loops of this form, including acceleration and termination, is an important part of analysing more complex programs (see, e.g., [7, 14, 16]).

For a set , we say that the above loop terminates on

if it terminates on all initial vectors

. Despite the simplicity of single-path linear loops, the question of deciding termination has proven challenging (and termination already becomes undecidable if the loop body consists of a nondeterministic choice between two different linear updates). Tiwari [25] showed that termination of single-path linear loops is decidable over . Subsequently, Braverman [9], using a more refined analysis of the loop components, showed that termination is decidable over and noted that termination on can be reduced to termination on in the homogeneous case, i.e., when the update map and guards are linear. More recently, Ouaknine, Sousa-Pinto, and Worrell [18] have proven that termination over is decidable in the non-homogeneous case under the assumption that the update function has the form for a diagonalisable integer matrix. Decidability of termination for non-homogeneous linear loops over was conjectured by Tiwari [25, Conjecture 1], but has remained open until now.

In this paper we give a procedure for deciding termination of the general class of single-path linear loops over the integers, i.e., we generalise the result of [18] by lifting the assumption of diagonalisability. Note that for this class of programs, the question of termination on a given initial value in (as opposed to termination over all of ) is equivalent to the Positivity Problem for linear recurrence sequences, i.e., the problem of whether all terms in a given integer linear recurrence sequence are positive. Decidability of the Positivity Problem is a longstanding open problem (going back at least as far as the 1970s [22, 24]), and results in [19] suggest that a solution to the problem will require significant breakthroughs in number theory. However, in considering termination over one can benefit from the freedom to choose the initial values of the loop variables. In the present paper we exploit this freedom in order to circumvent the need to solve “hard instances” of the Positivity Problem when deciding termination of linear loops. In particular, we avoid the use of sophisticated Diophantine-approximation techniques, such as the -units theorem, that were employed in [19]. By eschewing such tools we lose all hope of obtaining an effective characterisation of the set of non-terminating points, as was done in the diagonalisable case in [19], but our methods nevertheless manage to solve the decision problem in the general case.

Among the tools we use are a circle of closely related results in the geometry of numbers, including Khinchine’s flatness theorem, Kronecker’s theorem on simultaneous Diophantine approximation, and the result of Khachiyan and Porkolab that it is decidable whether a convex semi-algebraic set contains an integer point. In tandem with these, from algebraic number theory, we use a result of Masser that allows to compute all algebraic relations among the eigenvalues of the update matrix of a given loop. Using this last result, we define a semi-algebraic subset of “non-termination candidates” such that the loop is non-terminating if and only if this set contains an integer point.

In this paper we focus on the foundational problem of providing complete methods to solve termination. Much effort has been devoted to scalable and pragmatic methods to prove termination for classes of programs that subsume linear loops. In particular, techniques to prove termination via synthesis of linear ranking functions [4, 5, 8, 10, 11, 20, 21] and their extension, multiphase linear ranking functions [6, 3], have been developed. Many of these techniques have been implemented in software verification tools, such as Microsoft’s Terminator [12]. Although these methods are capable of handling non-deterministic linear loops, they can only guarantee termination whenever ranking functions of a certain form exist.

2 Background

2.1 Convexity

The affine hull of is the smallest affine set that contains , where an affine set is the translation of a vector subspace of . The affine hull of can be characterised as follows:

The convex hull of is the smallest convex set that contains . The convex hull of can be characterised as follows:

Clearly . The relative interior of a convex set is its interior with respect to the restriction of the Euclidean topology to . We have the following easy proposition, characterising the relative interior.

Let . If lies in the relative interior of then there exist such that and .

Proof.

Since lies in the relative interior of , for sufficiently small we have that

For such an there exist such that and . But then . Defining for , the proposition is proved. ∎

A lattice of rank in is a set

where

are linearly independent vectors in

. Given a convex set , define the width of along a vector to be

Furthermore the lattice width of is the infimum over all non-zero vectors of the width of along .

The following result (see [2, Theorem 7.2.1]) captures the intuition that a convex set that contains no lattice point in its interior must be “thin” in some direction. [Flatness Theorem] Given a full-rank lattice in there exists such that any convex set of lattice width at least contains a lattice point.

Recall that is said to be semi-algebraic if it is definable by a boolean combination of polynomial constraints , where .

[Khachiyan and Porkolab [15]] It is decidable whether a given convex semi-algebraic set contains an integer point, that is, whether .

2.2 Groups of Multiplicative Relations

In this subsection we will introduce some concepts concerning groups of multiplicative relations among algebraic numbers.

Let . We define the -dimensional torus to be , considered as a group under component-wise multiplication. Given a tuple of algebraic numbers , the orbit is a subset of . In the following we characterise the topological closure of the orbit as an algebraic subset of .

The group of multiplicative relations of is defined as the following additive subgroup of :

where is defined to be for , that is, exponentiation acts coordinate-wise. Since is a subgroup of , it is a free Abelian group and hence has a finite basis. The following powerful theorem of Masser [17] gives bounds on the magnitude of the components of such a basis.

[Masser] The free Abelian group has a basis for which

where and bound respectively the heights and degrees of all the .

Membership of a tuple in can be computed in polynomial space, using a decision procedure for the existential theory of the reals. In combination with Theorem 2.2, it follows that we can compute a basis for in polynomial space by brute-force search.

Corresponding to , we consider the following multiplicative subgroup of :

If is a basis of , we can equivalently characterise as . Crucially, this finitary characterisation allows us to represent as an algebraic set in .

We will use the following classical lemma of Kronecker on simultaneous Diophantine approximation to show that the orbit is a dense subset of .

Let . Suppose that for all , if then also , i.e., all integer relations among the coordinates of also hold among those of (modulo ). Then, for each , there exist and a non-negative integer such that

We now arrive at the main result of the section: Let . Then the orbit is a dense subset of .

Proof.

Let be such that (with exponentiation operating coordinate-wise). Notice that if and only if . If , we can likewise define to be such that . Then the premises of Kronecker’s lemma apply to and . Thus, given , there exist a non-negative integer and such that . Whence

3 Termination Analysis via Spectral Theory

The general form of a simple linear loop in dimension is as follows:

where and are affine functions. We assume that and have integer coefficients, that is, for and , and for , and .

Note that

(1)

for all . We say that is non-degenerate if no quotient of two distinct eigenvalues of the update matrix is a root of unity.

The termination problem for simple linear loops on integers is reducible to the special case of the problem for non-degenerate update functions.

Proof.

Consider a simple linear loop, as described above, whose update matrix has distinct eigenvalues . Let be the least common multiple of the orders of the roots of unity appearing among the quotients for . It is known that  [13, Subsection 1.1.9]. The update matrix corresponding to the affine map has eigenvalues and hence is non-degenerate. Moreover the original loop terminates if and only if the following loop terminates:

This concludes the proof. ∎

In the rest of this section and in the next section we focus on the case of a loop

(2)

with a single guard function and with non-degenerate update function

, with both maps having integer coefficients. We show that a spectral analysis of the matrix underlying the loop update function suffices to classify almost all initial values of the loop as either terminating or eventually non-terminating. Towards the end of the section we isolate a class of so-called

critical initial values that are not amenable to this analysis. We show how to deal with such points in Section 4.

With respect to the loop P we say that is terminating if there exists such that . We say that is eventually non-terminating if the sequence is ultimately positive, i.e., there exists such that for all . Clearly there exists that is non-terminating if and only if there exists that is eventually non-terminating. Thus we can regard the problem of deciding termination on as that of searching for an eventually non-terminating point.

Let be the non-zero eigenvalues of and let be the maximum multiplicity over all these eigenvalues.

Define a linear preorder on by if either (i)  or (ii)  and . Write if and . Then we have

that is, the preorder characterises the asymptotic order of growth in absolute value of the terms for . This preorder moreover induces an equivalence relation on where iff and .

The following closed-form expression for will be the focus of the subsequent development. There is a set of affine functions such that for all and all we have

Proof.

By the Jordan-Chevalley decomposition we can write , where is diagonal, is nilpotent, is invertible, and commute, and all matrices have algebraic coefficients. Moreover we can write for appropriate idempotent diagonal matrices . Then for all with we have

where for the affine function is defined in Line (3). Clearly each function is a complex-valued affine function on with algebraic coefficients. ∎

Define for , that is, we obtain the by normalising the eigenvalues to have length . Recall from Section 2.2 the definition of the group of multiplicative relations that hold among , viz.,

Recall also that we have , given by

Given an -equivalence class , note that for all we have and . Thus is determines a common multiplicity, which we denote , and a set of eigenvalues that all have the same absolute value, which we denote .

Given an -equivalence class , define by111That the function is real-valued follows from the fact that if eigenvalues and are complex conjugates then and are also complex conjugates, as are and (see the proof of Proposition 3).

(4)

From the above definition of we have

(5)

for all and all .

We say that an equivalence class of is dominant for if is the equivalence class of the maximal indices for which is non-zero. Equivalently, is dominant for if is the maximal equivalence class such that is not identically zero on . (The equivalence of these two characterisations follows from the linear independence of the functions for .)

The following proposition shows how information about termination of the loop P on an initial value can be derived from properties of .

Consider the loop P in (2). Let and let be an -equivalence class that is dominant for . Then

  1. If then is eventually non-terminating for P.

  2. If then is terminating for P.

Proof.

By Proposition 3 and Equation (5) we have that for all ,

(6)

Moreover by the dominance of we have that

(7)

for all such that .

We first prove Item 1. By assumption, in this case there exists such that for all . Together with Equation (7), this shows that the asymptotically dominant term in Equation (6) has positive sign. It follows that is positive for sufficiently large and hence is eventually non-terminating.

We turn now to Item 2. By assumption there exists and an open subset of such that for all . Moreover by density of in there exist infinitely many such that . Exactly as in Case 1 we can now use the dominance of to conclude that for sufficiently large such that and hence is terminating. ∎

Given , since is an algebraic subset of , the number is algebraic and its sign can be decided. Note however that Proposition 3 does not completely resolve the question of termination with respect to guard from a given initial value . Indeed, let us define to be critical if , where is the dominant equivalence class for . Then neither clause in the above proposition suffices to resolve termination of the loop P in (2) on such a . Indeed the question of whether such a point is eventually non-terminating is equivalent to the Ultimate Positivity Problem for linear recurrence sequences: a longstanding and notoriously difficult open problem in number theory, only known to be decidable up to order 4 [1, 19]. Fortunately in the setting of deciding loop termination we can sidestep such difficult questions. The following section is devoted to handling critical points. The idea is to show that if there is a critical initial value then there is another initial value that is eventually non-terminating and moreover whose eventual non-termination can be established by Proposition 3.

4 Analysis of Critical Points

In this section we continue to analyse termination of the loop P, as given in (2) in the previous section, and refer to the notation established therein.

4.1 Transition Invariance of Critical Points

Intuitively critical points are those for which it is difficult to determine eventual non-termination. One should therefore expect that if is critical then should also be critical. This, and more, follows from the following proposition.

Let and let be an equivalence class that is dominant for . Then is also dominant for and for all we have , where the product is defined pointwise.

Proof.

By definition we have , where the satisfy

(8)

for all . Likewise we have , where the satisfy

(9)

Combining Equations (8) and (9) we have the for all ,

Now the collection of functions for is linearly independent in the vector space (see, e.g., [23, Lemma 9.6]). Equating the coefficients of the functions for in the above equation we have for all ; likewise we have that is dominant for . The proposition follows. ∎

The next lemma shows that the existence of a critical point entails the existence of an eventually non-terminating point.

If is critical then there exists a positive integer such that for all , all points in the relative interior of are eventually non-terminating.

Proof.

Given an arbitrary we claim that there exists for which we have . If this were not the case then for all we would have . But by Theorem 2.2, the set is dense in and hence we would have that is identically on , contradicting the dominance of .

For each , the set is an open subset of . Moreover, by the analysis above, the collection is an open cover of . Thus by compactness of there exists such that is a finite cover of .

By Proposition 2.1, for all and all points lying in the relative interior of , there exist such that and . Since is an affine map in its first variable, it follows that is strictly positive on . Hence is eventually non-terminating by Proposition 3. ∎

4.2 Integer Non-Terminating Points from Critical Points

Lemma 4.1 shows how to derive the existence of non-terminating points from the existence of a critical point. In this subsection we refine this analysis to derive the existence of integer non-terminating points. In particular, fixing an initial value , we show that for sufficiently large, the set

contains an integer point in its relative interior.

Define and let the vector subspace be the unique translate of containing the origin. Write for the dimension of (equivalently the dimension of ).

For all non-zero integer vectors the set is unbounded.

Proof.

Consider the sequence . If this sequence were constant then would be orthogonal to , contradicting the fact that is non-zero. Since the sequence is non-constant, integer-valued, and satisfies a non-degenerate linear recurrence of order at most (see, e.g., [13, Subsection 1.1.12]), by the Skolem-Mahler-Lech Theorem we have that is unbounded (see the discussion of growth of linear recurrence in [13, Section 2.2]).222The above argument actually establishes that diverges to infinity in absolute value. We briefly sketch a more elementary proof of mere unboundedness. If the sequence were bounded then by van der Waerden’s Theorem, for all it would contain a constant subsequence of the form for some . In particular, if then since every infinite subsequence satisfies a linear recurrence of order at most , would have an infinite constant subsequence . If then is constant and if then by [23, Lemma 9.11] is degenerate.

There exists such that for all the set

contains an integer point in its relative interior.

Proof.

Since is spanned by integer vectors, is a lattice of rank in . Define and .

Let be a linear map that takes bijectively onto and whose kernel is the orthogonal complement of . Then is a lattice in of full rank. We claim that the lattice width of with respect to is infinite. Indeed for any non-zero vector we have

(10)

where is the adjoint map of . But is a non-zero rational vector in and hence Proposition 4.2 entails that the absolute value of (10) is unbounded as runs over . This proves the claim.

By Theorem 2.1 we have that contains a point of in its relative interior and hence contains a point of (necessarily an integer point) in its relative interior. We conclude that also contains an integer point in its relative interior. ∎

We summarise Sections 3 and 4 with a theorem characterising when a loop with a single guard is terminating.

The loop P, given in (2), is non-terminating on if and only if there exists and an -equivalence class such that (i)  is dominating for and (ii) .

Proof.

If no such exists then the loop is terminating by Proposition 3(2). Conversely, if such a exists then by Lemma 4.1 and Proposition 4.2 there exists such that (and with still dominating for .) Such a point is eventually non-terminating by Proposition 3(1). ∎

We postpone the question of the effectiveness of the above characterisation until we handle loops with multiple guards, in Section 5.

5 Multiple Guards

Now we are ready to present our decision procedure for a general linear loop program

(11)

with multiple guards. Associated to the loop we consider single-guard loops with a common update function:

for . Clearly Q is non-terminating if and only if there exists such that each loop is non-terminating on . As we now explain, we can decide the existence of such a point following the proof of Theorem 4.2.

Let be the distinct non-zero eigenvalues of the matrix corresponding to the update function in the loop Q. As before, write for . For , denote by the function associated to loop and -equivalence class as defined by (4). Given -equivalence classes , we define to be the set of such that the following hold for :

  • is dominant for x in loop , that is, and for all .

  • .

Loop is non-terminating if and only if there exist -equivalence classes such that contains an integer point.

Proof.

Suppose that fails to terminate on . Then each loop also fails to terminate on . Thus if is the dominant equivalence class for in program , for , applying Proposition 3(2) we get that .

Conversely, suppose for some -equivalence classes . Then, by Lemma 4.1 and Proposition 4.2, there is an integer point such that for . By Proposition 3(1), each loop fails to terminate on and hence also is non-terminating on . ∎

Proposition 5 leads to the following procedure for deciding termination of a given linear loop , as shown in (11).

  1. Compute the eigenvalues of the matrix corresponding to the loop update function, as given in (1).

  2. Compute the dominance preorder among eigenvalues.

  3. Compute a basis of the group of multiplicative relations .

  4. Return “non-terminating” if some set contains an integer point and otherwise return “terminating”.

In terms of effectiveness, Steps 1 and 2 can be accomplished via standard symbolic computations with algebraic numbers. (We refer to [18] for a detailed treatment in a very similar setting.) By Theorem 2.2, computing a basis of reduces to checking a finite collection of multiplicative relations among algebraic numbers. Given a basis of we can directly obtain representations of each set as semi-algebraic subsets of . Finally, since is convex, we can decide the existence of an integer point in each set using Theorem 2.1.

We have thus established the main result of the paper: There is a procedure to decide termination of single-path linear loops (of the form specified in (11)) over the integers.

References

  • [1] Shaull Almagor, Brynmor Chapman, Mehran Hosseini, Joël Ouaknine, and James Worrell. Effective divergence analysis for linear recurrence sequences. In 29th International Conference on Concurrency Theory, CONCUR 2018, September 4-7, 2018, Beijing, China, pages 42:1–42:15, 2018.
  • [2] Alexander I. Barvinok. Lattice points and lattice polytopes. In Handbook of Discrete and Computational Geometry, Second Edition., pages 153–176. Chapman and Hall/CRC, 2004.
  • [3] Amir M. Ben-Amram, Jesús Doménech, and Samir Genaim. Multiphase-linear ranking functions and their relation to recurrent sets. CoRR, abs/1811.07340, 2018.
  • [4] Amir M. Ben-Amram and Samir Genaim. On the linear ranking problem for integer linear-constraint loops. In The 40th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’13, Rome, Italy - January 23 - 25, 2013, pages 51–62, 2013.
  • [5] Amir M. Ben-Amram and Samir Genaim. Ranking functions for linear-constraint loops. J. ACM, 61(4):26:1–26:55, 2014.
  • [6] Amir M. Ben-Amram and Samir Genaim. On multiphase-linear ranking functions. In Computer Aided Verification - 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings, Part II, pages 601–620, 2017.
  • [7] Bernard Boigelot.

    On iterating linear transformations over recognizable sets of integers.

    Theor. Comput. Sci., 309(1-3):413–468, 2003.
  • [8] Aaron R. Bradley, Zohar Manna, and Henny B. Sipma. Termination analysis of integer linear loops. In CONCUR 2005 - Concurrency Theory, 16th International Conference, CONCUR 2005, San Francisco, CA, USA, August 23-26, 2005, Proceedings, pages 488–502, 2005.
  • [9] Mark Braverman.

    Termination of integer linear programs.

    In Computer Aided Verification, 18th International Conference, CAV 2006, Seattle, WA, USA, August 17-20, 2006, Proceedings, pages 372–385, 2006.
  • [10] Hong Yi Chen, Shaked Flur, and Supratik Mukhopadhyay. Termination proofs for linear simple loops. STTT, 17(1):47–57, 2015.
  • [11] Michael Colón and Henny Sipma. Synthesis of linear ranking functions. In Tools and Algorithms for the Construction and Analysis of Systems, 7th International Conference, TACAS 2001 Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2001 Genova, Italy, April 2-6, 2001, Proceedings, pages 67–81, 2001.
  • [12] Byron Cook, Andreas Podelski, and Andrey Rybalchenko. Termination proofs for systems code. In Proceedings of the ACM SIGPLAN 2006 Conference on Programming Language Design and Implementation, Ottawa, Ontario, Canada, June 11-14, 2006, pages 415–426, 2006.
  • [13] Graham Everest, Alfred J. van der Poorten, Igor E. Shparlinski, and Thomas Ward. Recurrence Sequences, volume 104 of Mathematical surveys and monographs. American Mathematical Society, 2003.
  • [14] Bertrand Jeannet, Peter Schrammel, and Sriram Sankaranarayanan. Abstract acceleration of general linear loops. In