Polynomial Invariants for Affine Programs Ehud Hrushovski, Jol - PowerPoint PPT Presentation

Polynomial Invariants for Affine Programs Ehud Hrushovski, Joël Ouaknine, Amaury Pouly, James Worrell Max Planck Institute for Software Systems & Department of Computer Science, Oxford University & Mathematical Institute, Oxford University 1 / 17

Does this program halt? Affine program x := 2 − 10 y := 1 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 2 / 17

Does this program halt? Affine program x := 2 − 10 y := 1 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 y x 2 / 17

Does this program halt? Affine program x := 2 − 10 y := 1 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 y x 2 / 17

Does this program halt? Affine program x := 2 − 10 y := 1 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 y x 2 / 17

Does this program halt? Affine program x := 2 − 10 y := 1 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 y x 2 / 17

Does this program halt? Affine program x := 2 − 10 y := 1 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 y x 2 / 17

Does this program halt? Affine program Certificate of non-termination: x := 2 − 10 x 2 y − x 3 = 1023 y := 1 (1) 1073741824 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 y x 2 / 17

Does this program halt? Affine program Certificate of non-termination: x := 2 − 10 x 2 y − x 3 = 1023 y := 1 (1) 1073741824 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 y ◮ (1) is an invariant: it holds at every step x 2 / 17

Does this program halt? Affine program Certificate of non-termination: x := 2 − 10 x 2 y − x 3 = 1023 y := 1 (1) 1073741824 while y � x do � x � � 2 0 � � x � := 7 1 y y 4 4 y ◮ (1) is an invariant: it holds at every step ◮ (1) implies the guard is true x 2 / 17

Invariants invariant = overapproximation of the reachable states 3 / 17

Invariants invariant = overapproximation of the reachable states inductive invariant = invariant preserved by the transition relation transition 3 / 17

Inductive invariants: example f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q f 1 f 2 1 2 f 3 f 5 f 4 3 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q S 1 S 2 f 1 f 2 1 2 f 3 f 5 f 4 3 S 3 S 1 , S 2 , S 3 is an invariant 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q S 1 S 2 f 1 f 2 1 2 f 3 f 5 f 4 3 S 3 S 1 , S 2 , S 3 is an inductive invariant 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q S 1 I 1 S 2 I 2 f 1 f 2 1 2 f 3 f 5 f 4 3 I 3 S 3 I 1 , I 2 , I 3 is an invariant 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q I 1 I 2 f 1 f 2 1 2 f 3 f 5 f 4 3 I 3 I 1 , I 2 , I 3 is NOT an inductive invariant 4 / 17

Inductive invariants: example f i : R 3 → R 3 x , y , z range over Q I 1 I 2 f 1 f 2 1 2 f 3 f 5 f 4 3 I 3 I 1 , I 2 , I 3 is an inductive invariant 4 / 17

Why Invariants? S I BAD! The classical approach to the verification of temporal safety properties of programs requires the construction of inductive invariants [...]. Automation of this construction is the main challenge in program verification. D. Beyer, T. Henzinger, R. Majumdar, and A. Rybalchenko Invariant Synthesis for Combined Theories , 2007 5 / 17

Which invariants? 6 / 17

Which invariants? Intervals 6 / 17

Which invariants? Octagons � Intervals 6 / 17

Which invariants? Octagons � Intervals Affine/linear sets 6 / 17

Which invariants? � Octagons Polyhedrons � � Intervals Affine/linear sets 6 / 17

Which invariants? � Octagons Polyhedrons � � � Intervals Affine/linear sets Algebraic sets = polynomial equalities 6 / 17

Which invariants? � � Octagons Polyhedrons Semialgebraic sets � � � � Intervals Affine/linear sets Algebraic sets = polynomial equalities 6 / 17

Affine programs f 1 f 2 1 2 f 3 f 5 f 4 3 7 / 17

Affine programs ◮ Nondeterministic branching (no guards) f 1 f 2 1 2 f 3 f 5 f 4 3 7 / 17

Affine programs ◮ Nondeterministic branching (no guards) ◮ All assignments are affine x := 3 x − 7 y + 1 f 2 1 2 f 3 f 5 f 4 3 7 / 17

Affine programs ◮ Nondeterministic branching (no guards) ◮ All assignments are affine ◮ Allow nondeterministic assignments ( x := ∗ ) x := 3 x − 7 y + 1 f 2 1 2 f 3 y := ∗ f 5 3 7 / 17

Affine programs ◮ Nondeterministic branching (no guards) ◮ All assignments are affine ◮ Allow nondeterministic assignments ( x := ∗ ) x := 3 x − 7 y + 1 f 2 1 2 f 3 y := ∗ f 5 3 ◮ Can overapproximate complex programs 7 / 17

Affine programs ◮ Nondeterministic branching (no guards) ◮ All assignments are affine ◮ Allow nondeterministic assignments ( x := ∗ ) x := 3 x − 7 y + 1 f 2 1 2 f 3 y := ∗ f 5 3 ◮ Can overapproximate complex programs ◮ Covers existing formalisms: probabilistic, quantum, quantitative automata 7 / 17

Karr’s Algorithm Theorem (Karr 76) There is an algorithm which computes, for any given affine program over Q , its strongest affine inductive invariant. 8 / 17

Randomized Karr’s Algorithm @ POPL 2003 9 / 17

Some polynomial invariants Theorem (ICALP 2004) There is an algorithm which computes, for any given affine program over Q , all its polynomial inductive invariants up to any fixed degree d. 10 / 17

A challenge: finding all polynomial invariants 11 / 17

A challenge: finding all polynomial invariants 11 / 17

Why fixed degree is not enough 12 / 17

Why fixed degree is not enough z = x 2 + y 2 ◮ Paraboloid 12 / 17

Why fixed degree is not enough z = x 2 + y 2 ◮ Paraboloid 12 / 17

Why fixed degree is not enough z = x 2 + y 2 ◮ Paraboloid ◮ Union of 3 hyperplanes ( x − y )( 10 y + x )( y + 10 x ) = 0 12 / 17

Why fixed degree is not enough z = x 2 + y 2 ◮ Paraboloid ◮ Union of 3 hyperplanes ( x − y )( 10 y + x )( y + 10 x ) = 0 12 / 17

Why fixed degree is not enough z = x 2 + y 2 ◮ Paraboloid ◮ Union of 3 hyperplanes ( x − y )( 10 y + x )( y + 10 x ) = 0 12 / 17

Main result Theorem There is an algorithm which computes, for any given affine program over Q , its strongest polynomial inductive invariant. 13 / 17

Main result Theorem There is an algorithm which computes, for any given affine program over Q , its strongest polynomial inductive invariant. ◮ strongest polynomial invariant ⇐ ⇒ smallest algebraic set 13 / 17

Main result Theorem There is an algorithm which computes, for any given affine program over Q , its strongest polynomial inductive invariant. ◮ strongest polynomial invariant ⇐ ⇒ smallest algebraic set ◮ algebraic sets = finite � and � of polynomial equalities 13 / 17

Main result Theorem There is an algorithm which computes, for any given affine program over Q , its strongest polynomial inductive invariant. ◮ strongest polynomial invariant ⇐ ⇒ smallest algebraic set ◮ algebraic sets = finite � and � of polynomial equalities ◮ Thus our algorithm computes all polynomial relations that always hold among program variables at each program location, in all possible executions of the program 13 / 17