Decidability of inferring inductive invariants

Abstract

Induction is a successful approach for verification of hardware and software systems. A common practice is to model a system using logical formulas, and then use a decision procedure to verify that some logical formula is an inductive safety invariant for the system. A key ingredient in this approach is coming up with the inductive invariant, which is known as invariant inference. This is a major difficulty, and it is often left for humans or addressed by sound but incomplete abstract interpretation. This paper is motivated by the problem of inductive invariants in shape analysis and in distributed protocols. This paper approaches the general problem of inferring firstorder inductive invariants by restricting the language L of candidate invariants. Notice that the problem of invariant inference in a restricted language L differs from the safety problem, since a system may be safe and still not have any inductive invariant in L that proves safety. Clearly, if L is finite (and if testing an inductive invariant is decidable), then inferring invariants in L is decidable. This paper presents some interesting cases when inferring inductive invariants in L is decidable even when L is an infinite language of universal formulas. Decidability is obtained by restricting L and defining a suitable well-quasi-order on the state space. We also present some undecidability results that show that our restrictions are necessary. We further present a framework for systematically constructing infinite languages while keeping the invariant inference problem decidable. We illustrate our approach by showing the decidability of inferring invariants for programs manipulating linked-lists, and for distributed protocols.

Stratified Guarded First-Order Transition Systems

“…Only for rare cases, so far, decidability could be shown. In [21], Sagiv et al show that inferring universal inductive invariants is decidable when the transition relation is expressed by formulas with unary predicates and a single binary predicate restricted by the background theory of singly-linked-lists. The same problem becomes undecidable when the binary symbol is not restricted by a background theory.…”

On Inductive Verification and Synthesis

“…Our results can be seen as extensions of the results in [4] and [2], since we consider more complex theories. Although there are similarities to the method in [9], our approach is different: The theories we analyze do not typically have the finite model…”

“…Finding suitable inductive invariants is nontrivial -the problem is undecidable in general; solutions have been proposed for specific cases e.g. in [4,1,3,8,9]. In this extended abstract we continue our work on automated verification and synthesis in parametric systems [6,11,12].…”

“…Assume that T 0 allows quantifier elimination. For every finite set of ground Π C -clauses G, and every finite set T of terms over the signature Π 0 ∪Σ∪Σ P ∪C with est(G) ⊆ T , steps 1-5 of Algorithm 1 yield a universally quantified Π 0 ∪ Σ P -formula ∀xΓ T (x) with the property -which is required in [8,9], and we do not use diagrams associated to finite models for strengthening the invariants. While our method is not guaranteed to terminate in general, we identified situations in which termination is guaranteed.…”

“…We present an incremental method which starts with a given property and successively strengthens it to obtain an inductive invariant. The theories of data types and of updates in the systems we analyze are complex (typically extensions or combinations of theories) and not required to have the finite model propertywhich is required for instance in [8,9]. While we rely on methods similar up to a certain extent with the ones used in IC3 [2], we here exploit efficient methods for symbol elimination in theory extensions established in [13] which allow to devise a correct algorithm for finding invariants in a certain language.…”