Undecidability of Inferring Linear Integer Invariants

12/03/2018 ∙ by Sharon Shoham, et al. ∙ 0

We show that the problem of determining the existence of an inductive invariant in the language of quantifier free linear integer arithmetic (QFLIA) is undecidable, even for transition systems and safety properties expressed in QFLIA.

READ FULL TEXT VIEW PDF
POST COMMENT

Comments

There are no comments yet.

Authors

page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

We address the problem of inferring inductive invariants in the language of quantifier free linear integer arithmetic (QFLIA). Inductive invariants are the concept underlying most of the approaches for safety verification of infinite-state systems. Inductive invariants in QFLIA are inferred by SMT-based tools such as Spacer [1].

In this paper, we show that the problem of inferring such inductive invariants is undecidable even when the transition system at hand is expressed in the language of quantifier free linear integer arithmetic.

2 The Problem of Inferring QFLIA Invariants

We consider transition systems and properties expressed using quantifier free linear integer arithmetic (QFLIA). A transition system is represented by a tuple , where is a set of integer variables, Init is an initial states formula in QFLIA over , and Tr is a transition relation formula in QFLIA over where is a copy of the variables used to describe the target state of a transition. Each assignment to defines a state of TS, and each assignment that satisfies Init defines an initial state. The set of transitions is the set of all pairs of states satisfying Tr (where the interpretation of the unprimed variables is taken from and the interpretation of the primed variables is taken from ). A safety property of TS is expressed by a QFLIA formula over . We say that if all the reachable states of TS (defined in the usual way) satisfy .

An inductive invariant I for and is a formula over such that (i) (initiation), (ii) (consecution), and (iii) (safety). (where denotes the result of substituting with in I, for every , and denotes that is valid.) It is well known that if there exists an inductive invariant I as above, then , i.e., TS is safe.

In the sequel we are interested in the existence of inductive invariants expressed in QFLIA. We therefore consider the following decision problem:

Definition 1 (Inference of QFLIA invariants)

The problem of inferring QFLIA invariants is to determine whether a given transition system TS and a safety property , both expressed in QFLIA, have an inductive invariant I expressed in QFLIA.

We show that this problem is undecidable.

Remark 1

Determining the safety of a transition system expressed in QFLIA is trivially undecidable since a counter machine may be encoded via a transition system in QFLIA, and its nontermination is a safety property (expressible in QFLIA). That is, the complement of the halting problem of counter machines reduces to the safety problem of QFLIA transition systems in a straightforward manner. However, the problem of inferring QFLIA inductive invariants is different from the problem of safety verification since a transition system (and in particular one that is expressible in QFLIA) may be safe but not have an inductive invariant in QFLIA (Figure 1 provides such an example as we discuss in Section 3.1). Therefore, undecidability of the safety problem does not imply that the problem of inferring QFLIA inductive invariants is undecidable.

3 Undecidability of QFLIA Invariant Inference

We prove that the problem of inferring QFLIA inductive invariants is undecidable by a reduction from the halting problem of -counter machines. We start with an example of a simple program (transition system) that has no inductive invariant in QFLIA.

3.1 Warmup: Example of absence of inductive invariant in QFLIA.

Consider the program Prog depicted in Figure 1. We prove that Prog has no inductive invariant in QFLIA. We will later use Prog and a similar argument in the correctness proof of the reduction.

Prog(int x){
  assume (x > 0) ;
  int z1, z2, y1, y2;
  z1:=x; z2:=2*x; y1:=0; y2:=0;
  while (z1>0) {
    z1–; y1:=y1+x;
  }
  while (z2>0) {
    z2–; y2:=y2+x;
  }
  assert (y2 = 2*y1) ;
}
Figure 1: A program that computes and and asserts that . Verifying it requires a non-linear inductive invariant.

The program receives as input an integer , computes and in two loops, and asserts that . It is straightforward to encode Prog as a transition system by adding an explicit program counter variable, denoted pc. We consider the pc location start prior to the first loop, the pc locations and at the body of each of the loops, and the pc location end of the assertion. We define the initial states formula to be (i.e., after the initialization of the variables) and the transition relation formula encodes all the transitions as expected (the granularity of transitions is defined by the above pc locations). Since all the expressions and conditions in the program are linear, both Init and the transition relation formula of are in QFLIA. The assert statement induces the safety property , which is also in QFLIA.

It is easy to be convinced that for every possible initial value of (satisfying the precondition ), the assertion holds. Therefore, . However, as we prove next, there is no inductive invariant in QFLIA for and , i.e., no inductive invariant in QFLIA is capable of verifying the program.

Proof

Consider the set of reachable states encountered when the first loop terminates. This set consists of all states of the following form (we omit the value of the program counter), for :

Recall that, due to the initiation and consecution properties, an inductive invariant must overapproximate the set of reachable states. Therefore, any inductive invariant formula must be satisfied by these states. In order to show that no such formula exists in QFLIA, we show that any QFLIA formula that is satisfied by all of these states is also satisfied by a state that reaches a bad state in a finite number of steps (i.e., a state for which, after executing the second loop, ). However, the safety and consecution properties imply that such a state must not exist (by induction on the length of the execution leading to a bad state). Therefore, we conclude that no QFLIA inductive invariant exists in this case.

By way of contradiction, let be a QFLIA formula, written in disjunctive normal form (DNF), where each is a cube (conjunction of literals), such that is satisfied by all the states in . Define such that includes all states in that satisfy . We show that there exists such that (and hence ) is satisfied by a state that reaches a bad state.

includes in particular all the states of the form where is an even number. Clearly, this is an infinite set of states. Therefore, since there are finitely many ’s that together cover , there exists such that

also includes infinitely many such states. We view these states as vectors in a

-dimensional space. Take two such vectors and in where . Then their linear combination is in the convex hull of . Therefore, it must satisfy ( is a cube in QFLIA that is satisfied by all states in , hence it is also satisfied by all states in its convex hull). Furthermore, the vector defines a valid state (all values are integers).

However, when executing the second while loop starting from the state , the outcome is the state , and since (recall that ), the resulting state violates the assertion. Therefore, the state that satisfies (and hence ) reaches a bad state in a finite number of steps. This completes the proof. ∎

3.2 The reduction

We establish undecidability of inferring QFLIA invariants by a reduction from the halting problem of Minsky (2-counter) machines. The general scheme of the reduction resembles the one used in [2] to prove the undecidability of inferring universally quantified inductive invariants in uninterpreted first order logic for EPR transition systems.

The input of the reduction is an arbitrary Minsky machine, , where , are counters, both initially , and is a finite sequence of instructions, where is the first instruction, and is the halting instruction. The possible instructions are:

  • : increment counter ,

  • : decrement counter ,

  • : if counter is go to instruction .

where in each case, control is passed to the next instruction except when the tested counter is and thus the branch is taken.

The reduction constructs a transition system and safety property, both expressed in QFLIA, such that the transition system has an inductive invariant in QFLIA if and only if halts.

To do so, the reduction constructs a program that, on input , runs (which ignores ) in parallel to running Prog from Figure 1 on . If terminates then terminates. If Prog terminates, continues to run (unless has also terminated, in which case it terminates). Clearly, the corresponding transition system is expressible in QFLIA over the variables , where are the variables of and are variables for the counters and control location of . We denote the resulting transition system by . The safety property is inherited from Prog, and is also expressible in QFLIA. (In particular, if terminates before Prog terminates on , then terminates before reaching the assertion.)

While the product transition system is safe for every , we show that if terminates, has an inductive invariant in QFLIA, whereas if does not terminate, it does not.

Proposition 1

Let be a Minsky machine and be defined as above. Then has a QFLIA inductive invariant if and only if terminates.

Proof.

:

Suppose terminates, say after steps. Then the set of reachable states of can be expressed by a finite disjunction of “cases”, as we explain next.

First, consider the reachable states that correspond to input values of that are smaller or equal than . Since there are finitely many such values, and since we consider only a finite number of steps () on them, this set is finite. Each state in the set corresponds to the values of variables, counters and the control location, and can be characterized by a QFLIA cube. Hence the entire finite set can be encoded precisely by a QFLIA formula that comprises of a finite disjunction of the aforementioned cubes over all the reachable states. The set of states satisfying is precisely the set of reachable states for .

Now, consider the reachable states that correspond to input values of that are greater than . For such inputs, only the first loop in Prog will get to run (since will terminate after steps where is smaller than the value of which is also the number of iterations of the first loop), and will produce the following reachable states, for every and number of steps ,

Each such state is augmented with the values of the counters and control location of after steps. For every , the states reachable in steps over inputs can therefore be characterized by the following QFLIA cube:

and the states reachable in steps over inputs can be characterized by the following QFLIA cube:

where is the QFLIA cube representing ’s state after steps. (Note that is a fixed value hence the constraints are linear.) Since is bounded by , the entire set can be expressed by a finite disjunction, enumerating all possibilities of :

Finally, the formula is a QFLIA inductive invariant for . Consecution follows from the properties of the set of reachable states.

:

Suppose does not terminate. In this case, we use an argument similar to the one used in Section 3.1 to show that Prog has no inductive invariant in QFLIA to show that the product system also does not.

As before, let be a QFLIA formula, written in DNF form, where each is a cube (conjunction of literals). We show that if is satisfied by all the reachable states of , then there exists such that (and hence ) is satisfied by a state that reaches a bad state. As before, this implies that is not an inductive invariant for , and hence no inductive invariant in QFLIA exists.

For each , consider the set of reachable states encountered after running exactly steps. The states in the set have the following form:

for
for
for

where denote functions that map a number to the values of , respectively, obtained after steps of .

If is satisfied by all the reachable states of , then it is satisfied by all the states in (in particular). Define such that includes all states in that satisfy .

Next, choose (arbitrarily) some such that . Then the open interval contains integer values, and in particular even integer values. Each of these values satisfies , and therefore corresponds to a state of the form in . Since there are more than such states but only sets , by the pigeonhole principle, there exists such that there are at least two such states in . We view these states as -dimensional vectors. Say that these vectors are:

where , both are even and both of them are in the interval . Then their linear combination

(1)

is in the convex hull of . Therefore, it must satisfy ( is a cube in LIA that is satisfied by all states in , hence it is also satisfied by all states in its convex hull). Furthermore, the vector in Equation 1 defines a valid state (all values are integers since are even).

To conclude the proof, we show that when executing the program from the aforementioned state that satisfies (and hence ), a bad state is reached. To this end, we first observe that the state of corresponds to a real reachable state , hence, we are guaranteed that does not terminate when considering executions from this state (no matter how many steps are performed). Now consider the execution of Prog starting from the state

Since , we get that . This is the value of , the iterator of the second loop, hence the loop continues to iterate iterations, where in each iteration it increments by (the value of ), before it terminates and the outcome is the state

where

is the value of . To show that this is a bad state (violating the assertion ), it suffices to show that . I.e., we require that . Simplifying the expressions, we see that this holds iff , which is indeed the case since . This completes the proof.

Remark 2

Consider again the proof that non-termination of implies that there is no QFLIA inductive invariant for . In the proof we showed that if an inductive invariant I exists, then there are two certain points and whose linear combination defines a state that also satisfies I (by convexity) but also reaches a bad state, in contradiction to the properties of I. One may wonder why we did not select and as points encountered when the first loop terminates its execution (as is done in Section 3.1). The problem is that these points would correspond to different states of (as they are encountered after different number of steps). Hence, the linear combination might result in a state of that is not reachable and that terminates from. This would mean that may terminate its execution before reaching the assertion violation. Therefore, we cannot guarantee that the state defined by the linear combination reaches a bad state of , and the proof fails.

Since the termination problem of Minsky machines is undecidable, we conclude:

Theorem 3.1

The problem of inferring QFLIA invariants is undecidable (even for transition systems expressed in QFLIA).

References

  • [1] Anvesh Komuravelli, Arie Gurfinkel, and Sagar Chaki. SMT-Based Model Checking for Recursive Programs. In Computer Aided Verification - 26th International Conference, CAV 2014, Held as Part of the Vienna Summer of Logic, VSL 2014, Vienna, Austria, July 18-22, 2014. Proceedings, pages 17–34, 2014.
  • [2] Oded Padon, Neil Immerman, Sharon Shoham, Aleksandr Karbyshev, and Mooly Sagiv. Decidability of inferring inductive invariants. In Proceedings of the 43rd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2016, St. Petersburg, FL, USA, January 20 - 22, 2016, pages 217–231, 2016.