home *** CD-ROM | disk | FTP | other *** search
- Path: sparky!uunet!ogicse!das-news.harvard.edu!cantaloupe.srv.cs.cmu.edu!deutsch
- From: deutsch+@cs.cmu.edu (Alain Deutsch)
- Newsgroups: comp.theory
- Subject: Re: Synthesizing loop invariants -- unsolvable?
- Message-ID: <BxB9xH.3ty.2@cs.cmu.edu>
- Date: 6 Nov 92 20:22:26 GMT
- Article-I.D.: cs.BxB9xH.3ty.2
- References: <1992Nov5.230648.23466@babbage.ece.uc.edu>
- Sender: news@cs.cmu.edu (Usenet News System)
- Organization: School of Computer Science, Carnegie Mellon
- Lines: 83
- Nntp-Posting-Host: proof.ergo.cs.cmu.edu
-
- Problem: explain why invariants are not computable in general.
-
- Sketch: Consider a program P and its operational semantics defined by a
- Kripke structure:
-
- (State, -->, V)
-
- where State is a set of states (usually infinite because of integers,
- recursion or dynamic allocation); --> is a transition relation on State and V
- is a valuation function which maps each state \gamma to the set V(\gamma) of
- atomic formulae true in this state.
-
- Now because of the obvious isomorphism between program predicates and sets of
- states (a predicate \Phi can be represented by the set of states in which it
- is true), the strongest global invariant is by definition the sets of states
- that can be reached from some set of initial I through the transitive closure
- of the transition relation -->, which by [Pa69,Cl79,Co81] can be computed as
- a fixpoint, using the notation post(-->)(X) = {y | x \in X ^ x --> y}:
-
- *
- SGI[P] = post(--> )(I)
-
- = lfp(\lambda X. I \cup post(-->)(X))
-
-
- This least fixpoint is well defined, as it is the fixpoint of a monotonic
- operator on the (obviously complete) lattice of sets of states.
-
- Now because the lattice of sets of states has ordinal height \omega whenever
- the sets of states is infinite, it follows that the computation of this least
- fixpoint can require up to \omega iterations. Hence SGI[P] is not computable
- this way.
-
- Another argument, less intuitive but probably stronger, based on Godel second
- incompleteness theorem, appears in section 7.4.2.3.3 of [Co90].
-
- References:
-
- @Article{Park69,
- author = "Park,D.M.R.",
- title = "Fixpoint induction and proof program properties",
- journal = "Machine {Intelligence}",
- year = 1969,
- volume = 5,
- pages = "59--78",
- note = "Edinburgh University Press"
- }
-
- @Article{Clarke79,
- author = "Clarke,E.M.",
- title = "Program Invariants as Fixedpoints",
- journal = "Computing",
- year = 1979,
- volume = 21,
- pages = "273--294"
- }
-
- @InProceedings{Cousot81,
- author = "Cousot,P.",
- booktitle = "Program Flow Analysis: Theory and Applications",
- title = "Semantic foundations of program analysis",
- publisher = "Prentice-Hall",
- year = 1981,
- pages = "303--342"
- }
-
- @InBook{Cousot90,
- author = "Cousot,P.",
- title = "Methods and Logics for Proving Programs",
- pages = "841--994",
- chapter = "15",
- editor = "van Leeuwen,J.",
- booktitle = "Formal Models and Semantics",
- publisher = "Elsevier Science Publisher \& The MIT Press",
- year = 1990,
- volume = "B",
- note = "ISBN 0-444-88074-7"
- }
- --
- ----
- Alain Deutsch, Research Associate
- Carnegie Mellon University -- School of Computer Science
- Pittsburgh, PA 15213-3891, USA.
-