Abstract
We introduce the notion of porous invariants for multipath (or branching/nondeterministic) affine loops over the integers; these invariants are not necessarily convex, and can in fact contain infinitely many ‘holes’. Nevertheless, we show that in many cases such invariants can be automatically synthesised, and moreover can be used to settle (non)reachability questions for various interesting classes of affine loops and target sets.
The full version of this paper is available at http://arxiv.org/abs/2106.00662.
You have full access to this open access chapter, Download conference paper PDF
Similar content being viewed by others
Keywords
1 Introduction
We consider the reachability problem for multipath (or branching) affine loops over the integers, or equivalently for nondeterministic integer linear dynamical systems. A (deterministic) integer linear dynamical system consists of an update matrix \(M \in \mathbb {Z}^{d\times d}\) together with an initial point \(x^{(0)} \in \mathbb {Z}^d\). We associate to such a system its infinite orbit \((x^{(i)})\) consisting of the sequence of reachable points defined by the rule \(x^{(i+1)} = Mx^{(i)}\). The reachability question then asks, given a target set Y, whether the orbit ever meets Y, i.e., whether there exists some time i such that \(x^{(i)} \in Y\). The nondeterministic reachability question allows the linear update map to be chosen at each step from a fixed finite collection of matrices.
When the orbit does eventually hit the target, one can easily substantiate this by exhibiting the relevant finite prefix. However, establishing nonreachability is intrinsically more difficult, since the orbit consists of an infinite sequence of points. One requires some sort of finitary certificate, which must be a relatively simple object that can be inspected and which provides a proof that the set Y is indeed unreachable. Typically, such a certificate will consist of an overapproximation I of the set R of reachable points, in such a manner that one can check both that \(Y \cap I=\emptyset \) and \(R\subseteq I\); such a set I is called an invariant.
Formally we study the following problem for inductive invariants:
Meta Problem 1
Consider a system with update functions \(f_1,\dots , f_n\). A set I is an inductive invariant if \(f_i(I)\subseteq I\) for all i. Given a reachability query (x, Y) we search for a separating inductive invariant I such that \(x\in I\) and \(Y\cap I = \emptyset \).
Meta Problem 1 is parametrised by the type of invariants and targets that are considered; that is, what are the classes of allowable invariant sets I and target sets Y, or equivalently how are such sets allowed to be expressed.
Fixing a particular invariant and target domain, a reachability query has three possible scenarios: (1) the instance is reachable, (2) the instance is unreachable and a separating invariant from the domain exists, or (3) the instance is unreachable but no separating invariant exists. Ideally, one would wish to provide a sufficiently expressive invariant domain so that the latter case does not occur, whilst keeping the resulting invariants as simple as possible and computable. For some classes of systems, it is known that distinguishing reachability (1) from unreachability (2, 3) is undecidable; it can also happen that determining whether a separating invariant exists (i.e., distinguishing (2) from (3)) is undecidable.
We note that the existence of strongest inductive invariants^{Footnote 1} is a desirable property for an invariant domain—when strongest invariants exist (and can be computed), separating (2) from (1, 3) is easy: compute the strongest invariant, and check whether it excludes the target state or not; if so, then you are done, and if not, no other invariant (from that class) can possibly do the trick either. However, unless (3) is excluded, computing the strongest invariant does not necessarily imply that reachability is decidable. Unfortunately, strongest invariants are not always guaranteed to exist for a particular invariant domain, although some separating inductive invariant may still exist for every target (or indeed may not).
In prior work from the literature, typical classes of invariants are usually convex, or finite unions of convex sets. In this paper we consider certain classes of invariants that can have infinitely many ‘holes’ (albeit in a structured and regular way); we call such sets porous invariants. These invariants can be represented via Presburger arithmetic^{Footnote 2}. We shall work instead with the equivalent formulation of semilinear sets, generalising ultimately periodic sets to higher dimensions, as finite unions of linear sets of the form \(\left\{ b + p_1\mathbb {N} + \dots + p_m\mathbb {N}\right\} \) (by which we mean \(\left\{ b + a_1p_1 + \dots + a_mp_m\mid a_1,\dots ,a_m\in \mathbb {N}\right\} \), see Definition 2).
Let us first consider a motivating example:
Example 1
(Hofstadter’s MU Puzzle [7]). Consider the following termrewriting puzzle over alphabet \(\{M,U,I\}\). Start with the word MI, and by applying the following grammar rules (where y and z stand for arbitrary words over our alphabet), we ask whether the word MU can ever be reached.
The answer is no. One way to establish this is to keep track of the number of occurrences of the letter ‘I’ in the words that can be produced, and observe that this number (call it x) will always be congruent to either 1 or 2 modulo 3. In other words, it is not possible to reach the set \(\{x \mid x \equiv 0 \mod 3\}\). Indeed, Rules 2 and 3 are the only rules that affect the number of I’s, and can be described by the system dynamics \(x \mapsto 2x\) and \(x \mapsto x 3\). Hence the MU Puzzle can be viewed as a onedimensional system with two affine updates,^{Footnote 3} or a twodimensional system with two linear updates.^{Footnote 4} The set \(\left\{ 1 + 3\mathbb {Z}\right\} \cup \left\{ 2 + 3\mathbb {Z}\right\} \) is an inductive invariant, and we wish to synthesise this. (The stability of this set under our two affine functions is easily checked: both components are invariant under \(x\mapsto x3\), and \(\left\{ 1 + 3\mathbb {Z}\right\} \mapsto \left\{ 2 + 6\mathbb {Z}\right\} \subseteq \left\{ 2+3\mathbb {Z}\right\} \) under \(x\mapsto 2x\), and similarly \(\left\{ 2 + 3\mathbb {Z}\right\} \mapsto \left\{ 4 + 6\mathbb {Z}\right\} \subseteq \left\{ 1+3\mathbb {Z}\right\} \).)
The problem can be rephrased as a safety property of the following multipath loop, verifying that the ‘bad’ state \(x= 0\) is never reached, or equivalently that the above loop can never halt, regardless of the nondeterministic choices made.
x \( = 1\)
while x \(\ne 0\)
x \( = 2\) x \(\mid \mid \) x \(=\) x\(3\) (where \(\mid \mid \) represents nondeterministic branching)
The MU Puzzle was presented as a challenge for algorithmic verification in [4]; the tools considered in that paper (and elsewhere, to the best of our knowledge) rely upon the manual provision of an abstract invariant template. Our approach is to find the invariant fully automatically (although one must still abstract from the MU Puzzle the correct formulation as the program \(x \mapsto 2x \mid \mid x \mapsto x3\)).
Main Contributions. Our focus is on the automatic generation of porous invariants for multipath affine loops over the integers, or equivalently nondeterministic integer linear dynamical systems.

We first consider targets consisting of a single vector (or ‘point targets’), and present the classes of invariants and systems for which invariants can and cannot be automatically computed for the reachability question. A summary of the results for linear and semilinear invariants for these targets is given in Table 1. For completeness we also consider \(\mathbb {R},\mathbb {R}_+\)(semi)linear sets, where we complete the picture from prior work by showing that strongest \(\mathbb {R}\)semilinear invariants are computable.

We establish the existence of strongest \(\mathbb {Z}\)linear invariants, and show that they can be found algorithmically (Theorem 2). These invariants may or may not separate the target under consideration.

If a \(\mathbb {Z}\)linear invariant is not separating, we may instead look for an \(\mathbb {N}{}\)semilinear invariant (which generalises both \(\mathbb {Z}\)semilinear and \(\mathbb {N}{}\)linear invariants), and we show that such an invariant can always be found for any unreachable point target when dealing with deterministic integer linear dynamical systems (Theorem 4).

However, for nondeterministic integer linear dynamical systems, computing an \(\mathbb {N}{}\)semilinear invariants is an undecidable problem in arbitrary dimension (Theorem 5). Nevertheless we show how such invariants can be constructed in a lowdimensional setting, in particular for affine updates in one dimension (Theorem 6). As an immediate consequence, this establishes that the multipath loop associated with the MU Puzzle belongs to a class of programs for which we can automatically synthesise \(\mathbb {N}{}\)semilinear invariants.


For fulldimensional^{Footnote 5} \(\mathbb {Z}\)linear targets we show that reachability is decidable, and, in the case of unreachability that a \(\mathbb {Z}\)semilinear invariant can always be exhibited as a certificate (Theorem 3). If the target is not fulldimensional then the reachability problem is Skolemhard and undecidable for deterministic and nondeterministic systems respectively.

In Sect. 6 we present our tool porous which handles onedimensional affine systems for both point and \(\mathbb {Z}\)linear targets, solving both the reachability problem and producing invariants. Inter alia, this allows one to handle the multipath loop derived from the MU Puzzle in fully automated manner.
1.1 Related Work
The reachability problem (in arbitrary dimension) for loops with a single affine update, or equivalently for deterministic linear dynamical systems, is decidable in polynomial time for point targets (that is \(Y = \left\{ y\right\} \)), as shown by Kannan and Lipton [16]. However for nondeterministic systems (where the update matrix is chosen nondeterministically from a finite set at each time step), reachability is undecidable, by reduction from the matrix semigroup membership problem [22].
In particular this entails that for unreachable nondeterministic instances we cannot hope always to be able to compute a separating invariant. In some cases we may compute the strongest invariant (which may suffice if this invariant happens to be separating for the given reachability query), or we may compute an invariant in subcases for which reachability is decidable (for example in low dimensions). For some classes of invariants, it is also undecidable whether an invariant exists (e.g., polyhedral invariants [8]).
Various types of invariants have been studied for linear dynamical systems, including polyhedra [8, 23], algebraic [15], and ominimal [1] invariants. For certain classes of invariants (e.g., algebraic [15]), it is decidable whether a separating invariant exists, notwithstanding the reachability problem being undecidable. Other works (e.g., [5]) use heuristic approaches to generate invariants, without aiming for any sort of completeness.
Kincaid, Breck, Cyphert and Reps [18] study loops with linear updates, studying the closed forms for the variables to prove safety and termination properties. Such closed forms, when expressible in certain arithmetic theories, can be interpreted as another type of invariant and can be used to overapproximate the reachable sets. The work is restricted to a single update function (deterministic loops) and places additional constraints on the updates to bring the closed forms into appropriate theories.
Bozga, Iosif and Konecný’s FLATA tool [2] considers affine functions in arbitrary dimension. However, it is restricted to affine functions with finite monoids; in our onedimensional case this would correspond to limiting oneself to counterlike functions of the form \(f(x) = x+b\).
Finkel, Göller and Haase [9], extending Fremont [10], show that reachability in a single dimension is \(\mathbf {PSPACE}\)complete for polynomial update functions (and allowing states can be used to control the sequences of updates which can be applied). The affine functions (and singlestate restriction) we consider are a special case, but we focus on producing invariants to disprove reachability.
Other tools, e.g., AProVE [11] and Büchi Automizer [14] may (dis)prove termination/reachability on all branches, but may not be able to prove termination/reachability on some branch.
Inductive invariants specified in Presburger arithmetic have been used to disprove reachability in vector addition systems [20]. A generalisation, ‘almost semilinear sets’ [21] are also nonconvex and can capture exactly the reachable points of vector addition systems. Our nondeterministic linear dynamical systems can be seen as vector addition systems over \(\mathbb {Z}\) extended with affine updates (rather than only additive updates).
2 Preliminaries
We denote by \(\mathbb {Z}{}\) the integers and \(\mathbb {N}{}\) the nonnegative integers. We say that \(x,y \in \mathbb {Z}\) are congruent modulo \(d\in \mathbb {N}\), denoted \(x \equiv y \mod d\), if d divides \(xy\). Given an integer x and natural d we write \((x \mod d)\) for the number in \(\left\{ 0,\dots ,d1\right\} \) such that \((x\mod d) \equiv x \mod d \).
Definition 1
(Integer Linear Dynamical Systems). A ddimensional integer linear dynamical system (LDS) \((x^{(0)},\{M_1,\dots ,M_k\})\) is defined by an initial point \(x^{(0)}\in \mathbb {Z}{}^{d}\) and a set of integer matrices \(M_1, \dots , M_k\subseteq \mathbb {Z}^{d\times d}\). An LDS is deterministic if it comprises a single matrix (\(k=1\)) and is otherwise nondeterministic.
A point \(y\) is reachable if there exists \(m\in \mathbb {N}\) and \(B_1,\dots ,B_m\) such that \(B_1 \cdots B_m x^{(0)} = y\) and \(B_i\in \left\{ M_1,\dots , M_k\right\} \) for all \(1\le i \le m\).
The reachability set \(\mathcal {O}\subseteq \mathbb {Z}{}^{d}\) of an LDS is the set of reachable points.
Definition 2
(\(\mathbb {K}\)(semi)linear sets). A linear set L is defined by a base vector \(b\in \mathbb {Z}^d\) and period vectors \(p_1,\dots ,p_d\in \mathbb {Z}^d\) such that
For convenience we often write \(\left\{ b + p_1\mathbb {K}+\dots + p_d\mathbb {K}\right\} \) for L. A set is semilinear if it is the finite union of linear sets.
\(\mathbb {N}\)semilinear sets are precisely those definable in Presburger arithmetic(\({\text {FO}}(\mathbb {Z}, + , \le )\)) [12]. However, we can also consider \(\mathbb {Z}\)semilinear sets (corresponding to \({\text {FO}}(\mathbb {Z}, +)\) without order), and the real counterparts (\(\mathbb {R}\) and \(\mathbb {R}_+\)). Note that even if \(\mathbb {K}= \mathbb {N}\) we still allow \(p_i \in \mathbb {Z}^d\).
Definition 3
Given an integer linear dynamical system \((x^{(0)},\{M_1,\dots ,M_k\})\), a set I is an inductive invariant if

\(x^{(0)}\in I\), and

\(\{M_i x \mid x \in I\}\subseteq I\) for all \(i \in \left\{ 1,\dots ,k\right\} \).
Note in particular that every inductive invariant contains the reachability set (\(\mathcal {O}\subseteq I\)). We are interested in the following problem:
Definition 4 (Invariant Synthesis Problem)
Given an invariant domain \(\mathcal {D}\), an integer linear dynamical system \((x^{(0)},\{M_1,\dots ,M_k\})\), and a target Y, does there exist an inductive invariant I in \(\mathcal {D}\) disjoint from Y?
In our setting, we are interested in classes \(\mathcal {D}\) of invariants that are linear, or semilinear. When a separating inductive invariant I exists, we also wish to compute it. Since (semi)linear invariants are enumerable, the decision problem is, in theory, sufficient—although all of our proofs are constructive.
3 \(\mathbb {R}\) Invariants: \(\mathbb {R}\)linear and \(\mathbb {R}\)semilinear
Before delving into porous invariants, let us consider invariants over the real numbers, i.e., described as \(\mathbb {R}\)(semi)linear sets.
Strongest \(\mathbb {R}\)linear invariants are given precisely by the affine hull of the reachability set, and can be computed using Karr’s algorithm [17]. Moreover, we will show that strongest \(\mathbb {R}{}\)semilinear invariants also exist and can be computed by combining techniques for algebraic invariants [15] and \(\mathbb {R}{}\)linear invariants.
\(\mathbb {R}\)linear. Recall that a set L is \(\mathbb {R}\)linear if \(L = \left\{ v_{0} +v_{1}\mathbb {R}+\dots +v_{t}\mathbb {R}\right\} \) for some \(v_{0},\dots ,v_{t} \in \mathbb {Z}^d\) that can be assumed to be linearlyindependent^{Footnote 6} without loss of generality (and thus \(t\le d\)). Given two distinct points of L, every point on the infinite line connecting them must also be in L. Generalising this idea to higher dimensions, given a set \(S\subseteq \mathbb {R}^d\), let the affine hull be
Fix an LDS \((x^{(0)},\{M_1,\dots ,M_k\})\) and consider its reachability set \(\mathcal {O}=\) \(\left\{ M_{i_m}\cdots M_{i_1}x^{(0)} \mid m \in \mathbb {N}, i_1,\ldots ,i_m \in \left\{ 1,\ldots ,k\right\} \right\} \). Then \(\overline{\mathcal {O}{}}^a\) is precisely thestrongest \(\mathbb {R}\)linear invariant. Karr’s algorithm [17, 26] can be used to compute this strongest invariant in polynomial time. The next lemma follows from Theorem 3.1 of [26].
Lemma 1
Given an LDS \((x^{(0)}, \left\{ M_1,\dots , M_k\right\} )\) of dimension d, we can compute in time polynomial in d, k, and \(\log \mu \) (where \(\mu >0\) is an upper bound on the absolute values of the integers appearing in \(x^{(0)}\) and \(M_1,\ldots ,M_k\)), a \(\mathbb {Q}\)affinely independent set of integer vectors \(R_0 \subseteq \mathcal {O}{}\) such that:

1.
\(x^{(0)}\in R_0\),

2.
the affine span of \(R_0\) and the affine span of \(\mathcal {O}{}\) are the same (\(\overline{R_0}^a = \overline{\mathcal {O}{}}^a\)),

3.
the entries of the vectors in \(R_0\) have absolute value at most \(\mu _0:=(d\mu )^d\).
Let \(R_0 = \left\{ x^{(0)}, r_1,\dots ,r_{d'}\right\} \) be obtained as per Lemma 1, with \(d' \le d\). The \(\mathbb {R}\)linear invariant of the LDS is the affine span \(\overline{R_0}^a\), which can be written as the \(\mathbb {R}\)linear set \(L_0 = \left\{ x^{(0)} + (r_1  x^{(0)})\mathbb {R}+ \dots + (r_{d'}  x^{(0)})\mathbb {R}\right\} \).
\(\mathbb {R}\)semilinear. Let us now generalise this approach to \(\mathbb {R}\)semilinear sets. The collection of \(\mathbb {R}\)semilinear sets, \(\left\{ \bigcup _{i = 1}^m L_i \mid m\in \mathbb {N}, L_1,\dots , L_m \text { are } \mathbb {R}\text {linear sets} \right\} \), is closed under finite unions and arbitrary intersections^{Footnote 7}. Thus for any given set X, the smallest \(\mathbb {R}\)semilinear set containing X is simply the intersection of all \(\mathbb {R}\)semilinear sets containing X. Let us denote by \(\overline{X}^\mathbb {R}\) this smallest \(\mathbb {R}\)semilinear set. We are interested in \(\overline{\mathcal {O}}^\mathbb {R}\).
Theorem 1
The strongest \(\mathbb {R}\)semilinear invariant \(\overline{\mathcal {O}}^\mathbb {R}\) of \(\mathcal {O}{}\) is computable.
Algebraic sets are those that are definable by finite unions and intersections of zeros of polynomials. For example, \(\{(x,y)\mid xy=0\}\) describes the lines \(x= 0\) and \(y=0\). The (real) Zariski closure \(\overline{X}^z\) of a set X is the smallest algebraic subset of \(\mathbb {R}^d\) containing the set X. The Zariski closure of the set of reachable points, \(\overline{\mathcal {O}{}}^z\), can be computed algorithmically [15].
An algebraic set A is irreducible if whenever \(A\subseteq B \cup C\), where B and C are algebraic sets, then we have \(A\subseteq B\) or \(A\subseteq C\). Any algebraic set (and in particular a Zariski closure) can be written effectively as a finite union of irreducible sets [3].
Proposition 1
Let \(\overline{X}^z = A_1\cup \dots \cup A_k\), with \(A_i\)’s irreducible. Then \(\overline{X}^\mathbb {R} = \overline{\overline{X}^z}^\mathbb {R} = \overline{A_1}^\mathbb {R} \cup \dots \cup \overline{A_k}^\mathbb {R} = \overline{A_1}^a \cup \dots \cup \overline{A_k}^a\).
Proof
Since \(A_i \subseteq \overline{X}^\mathbb {R} = \cup _j L_j\), and \(A_i\) is irreducible, we have \(A_i \subseteq L_j\) for some j (as the \(L_j\)’s are algebraic sets). Since \(L_j\) is \(\mathbb {R}\)linear, and \(\overline{A_i}^a\) is the smallest \(\mathbb {R}\)linear set covering \(A_i\), we have \(\overline{A_i}^a \subseteq L_j\). Taking \(\overline{X}^\mathbb {R} = \overline{A_1}^a \cup \dots \cup \overline{A_k}^a\) is thus optimal. \(\square \)
Thus \(\overline{\mathcal {O}}^\mathbb {R}\) can be obtained by computing \(\overline{A_i}^a\) for each irreducible \(A_i\), where \(\overline{\mathcal {O}}^z = A_1\cup \dots \cup A_k\). To complete the proof of Theorem 1 it remains to confirm that affine hulls of algebraic sets can be computed algorithmically. Let us fix an algebraic set A, and let W denote a set variable. Proceed as follows. Start with \(W \leftarrow \left\{ x\right\} \) for some point \(x\in A\), and repeatedly let \(W \leftarrow \overline{W \cup \left\{ y\right\} }^a\), where \(y \in A \setminus W\). Such a point y can always be found using quantifier elimination in the theory of the reals. Each step necessarily increases the dimension, which can occur at most d times, ensuring termination, at which point one has \(\overline{A}^a = W\).
4 Strongest \(\mathbb {Z}\)linear Invariants
Recall that a \(\mathbb {Z}\)linear set \(\left\{ q + p_1\mathbb {Z}+ \dots + p_n \mathbb {Z}\right\} \) is defined by a base vector \(q\in \mathbb {Z}^d\) and period vectors \(p_1,\dots ,p_n \in \mathbb {Z}^d\). Equivalently, a \(\mathbb {Z}\)linear set describes a lattice, i.e., \(\left\{ p_1\mathbb {Z}+ \dots + p_n \mathbb {Z}\right\} \), in ddimensional space, translated to start from q rather than \(\boldsymbol{0}\).
Theorem 2
Given a ddimensional dynamical system \((x^{(0)}, \left\{ M_1,\dots ,M_k\right\} )\), the strongest \(\mathbb {Z}\)linear inductive invariant containing the reachability set \(\mathcal {O}{}\) exists and can be computed algorithmically.
The image of a \(\mathbb {Z}\)linear set \(L = \left\{ q + p_1\mathbb {Z}+ \dots + p_n\mathbb {Z}\right\} \) by a matrix M is the \(\mathbb {Z}\)linear set: \(M(L) = \left\{ Mq + (Mp_1)\mathbb {Z}+ \dots + (Mp_n)\mathbb {Z}\right\} \). The following lemma asserts that when two points are in a \(\mathbb {Z}\)linear set, the direction between these two points can be applied from any reachable point, and hence this direction can be included as a period without altering the set.
Proposition 2
Let \(L = \left\{ q + a_1p_1+\dots +a_np_n\mid a_1,\dots ,a_n\in \mathbb {Z}\right\} \) be a \(\mathbb {Z}\)linear set. If \(x,y\in L\) then for all \(z\in L\) and all \(a'\in \mathbb {Z}\) we have \(z + (yx)a'\in L\). In particular, we have \(L = \left\{ q + a_1p_1+\dots +a_np_n + a'(yx)\mid a_1,\dots ,a_n,a'\in \mathbb {Z}\right\} \).
Proof
If \(x = q + a_1p_1+\dots +a_np_n\) and \(y= q + b_1p_1+\dots +b_np_n\) then \(yx = q + b_1p_1+\dots +b_np_n  (q + a_1p_1+\dots +a_np_n)= (b_1a_1)p_1+\dots +(b_na_n)p_n\).
Then for any \(z = q + c_1p_1+\dots +c_np_n\), we have \(z + a'(yx) = q + c_1p_1+\dots +c_np_n + a'((b_1a_1)p_1+\dots +(b_na_n)p_n) = q + (c_1 + a'(b_1a_1))p_1+\dots +(c_n+ a'(b_na_n))p_n)\) where \( (c_i + a'(b_ia_i))\in \mathbb {Z}\), so \(z + a'(yx) \in L\). \(\square \)
Proposition 3
Given two \(\mathbb {Z}\)linear sets \(L_1=\left\{ q +p_1\mathbb {Z}+ \dots +p_n \mathbb {Z}\right\} \) and \(L_2= \left\{ s + t_1\mathbb {Z}+ \dots +t_m \mathbb {Z}\right\} \), there exists a smallest \(\mathbb {Z}\)linear set L containing \(L_1\cup L_2\): the set \(L = \left\{ q + (sq)\mathbb {Z}+ p_1\mathbb {Z}+ \dots + p_n \mathbb {Z}+ t_1\mathbb {Z}+ \dots + t_m \mathbb {Z}\right\} \).
Proof
First we show \(L_1\cup L_2\subseteq L\):

If \(x = q + a_1p_1+\dots +a_np_n \in L_1\), then \( x= q + (sq) 0+ a_1p_1+\dots +a_np_n + 0t_1+\dots +0t_m \in L\).

If \(x = s + b_1t_1+\dots +b_mt_m \in L_2\), then \(x = q + (sq)1 + 0p_1+\dots +0p_n + b_1t_1+\dots +b_mt_m \in L\).
Next we show minimality as a straightforward consequence of Proposition 2.
Clearly the vectors \(p_1,\dots , p_n\) can be added by Proposition 2 because any two points of \(L_1\) differing by \(p_i\) guarantees that adding \(p_i\) does not alter the resulting set. Similarly, \(t_1,\dots , t_m\) can also be included. Finally, by Proposition 2, the vector \(sq\) can be included because q and s both belong to \(L_1\cup L_2\). \(\square \)
A ddimensional lattice can always be defined by at most d vectors; and thus if d is the dimension of the matrices, no more than d period vectors are needed in total. However, Proposition 3 induces a representation which may overspecify the lattice by producing more than d vectors to define the lattice.
Example 2
Consider the lattice \(\left\{ (2,2)\mathbb {Z}+ (0,6)\mathbb {Z}+(2,6)\mathbb {Z}\right\} \), specified with three vectors, which is equivalent to the lattice \(\left\{ (2,0)\mathbb {Z}+ (0,2)\mathbb {Z}\right\} \). Note that one may not simply pick an independent subset of the periods, as none of the following sets are equal: \(\left\{ (2,2)\mathbb {Z}+ (0,6)\mathbb {Z}\right\} \), \(\left\{ (2,2)\mathbb {Z}+ (2,6)\mathbb {Z}\right\} \), \(\left\{ (0,6)\mathbb {Z}+ (2,6)\mathbb {Z}\right\} \), and \(\left\{ (2,2)\mathbb {Z}+ (0,6)\mathbb {Z}+(2,6)\mathbb {Z}\right\} \).
The Hermite normal form can be used to obtain a basis of the vectors that define the lattice. Consider a lattice \(L_i = \left\{ p_1\mathbb {Z}+\dots +p_d\mathbb {Z}\right\} \). The lattice remains the same if \(p_i\) is swapped with \(p_j\), if \(p_i\) is replaced by \(p_i\), or if \(p_i\) is replaced by \(p_i + \alpha p_j\) where \(\alpha \) is any fixed integer^{Footnote 8}.
These are the unimodular operations. The Hermite normal form of a matrix M is a matrix H such that \(M = UH\), where U is a unimodular matrix (formed by unimodular column operations) and H is lower triangular, nonnegative and each row has a unique maximum entry which is on the main diagonal. Such a form always exists, and the columns of H form a basis of the same lattice as the columns of M, because they differ up to unimodular (latticepreserving) operations. There are many texts on the subject; we refer the reader to the lecture notes of Shmonin [25] for more detailed explanations.
The columns of a matrix in Hermite normal form constitute a unique basis for the lattice (up to additional redundant zero columns). Hence a basis of minimal dimension can be obtained by computing the Hermite normal form of the matrix formed by placing the period vectors into columns.
We now prove the main theorem:
Proof
(Proof of Theorem 2). We claim that Algorithm 1 returns the strongest \(\mathbb {Z}\)linear invariant I.
Algorithm 1 proceeds in two phases:

First find a necessary subset \(L_0\subseteq I\) of the invariant having already the same dimension as I.

Then compute a growing sequence \(L_0\subsetneq L_1\subsetneq \dots \subsetneq L_{m1} = L_{m}= I\), where at each step the algorithm merely increases the density of the attendant sets in order to ‘fill in’ missing points of the invariant.
Recall the set \(R_0 = \left\{ x^{(0)}, r_1,\dots ,r_{d'}\right\} \subseteq \mathcal {O}{}\), with \(d' \le d\), from Lemma 1. The resulting \(\mathbb {Z}\)linear set \(L_0 = \left\{ x^{(0)} + (r_1  x^{(0)})\mathbb {Z}+ \dots + (r_{d'}  x^{(0)})\mathbb {Z}\right\} \) is then a \(d'\)dimensional porous subset of the \(d'\)dimensional affine hull of the orbit (\(L_0 \subseteq \overline{\mathcal {O}{}}^a\)). Applying \(M_1,\dots , M_k\) can only increase the density, but not the dimension. As each \(r_i\) and \(x^{(0)}\) are in \(\mathcal {O}{}\), by Proposition 2 we can assume that each of the directions \((r_i  x^{(0)})\) must be represented in any \(\mathbb {Z}\)linear set containing \(\mathcal {O}{}\), and we therefore have that \(L_0 \subseteq I\).
In the second phase, we ‘fill in’ the lattice as required to cover the whole of \(\mathcal {O}\). To do this we repeatedly apply the covering procedure of Proposition 3. That is, \(L_{i+1}\) is the smallest \(\mathbb {Z}\)linear set covering \(L_i \cup M_1(L_i)\cup \dots \cup M_k(L_i)\). To keep the number of vectors small, we keep the period vectors of the \(\mathbb {Z}\)linear set in Hermite normal form.
The vectors \(p_1 = (r_1  x^{(0)}), \dots ,p_{d'} = (r_{d'}  x^{(0)})\) form a parallelepiped (hyperparallelogram) that repeats regularly. There are a finite number of integral points inside this parallelepiped. If new points are added in some step, they are added to every parallelepiped. Thus we can add new points finitely many times before saturating or becoming fixed. The volume of the parallelepiped is bounded above by \(p_1 \cdots p_{d'}\).
At each step, the volume of the parallelepiped must at least halve, thus the volume at step t is \(vol_t \le p_1 \cdots p_{d'} / 2^t\). The procedure must saturate at or before the volume becomes 1, which occurs after at most \(\log (p_1 \cdots p_{d'}) = \sum _i \log (p_i)\) steps. At each step, for efficiency considerations, we convert the \(\mathbb {Z}\)linear set into Hermite normal form to retain exactly \(d'\) period vectors.
Claim
(I is the strongest invariant). For every invariant J, we have \(I\subseteq J\).
By induction, let us prove that every invariant J must contain \(L_i\). Clearly this is the case for \(L_0\) because all points of \(R_0 \subseteq \mathcal {O}{}\) must be in J and every period vectors in \(L_0\) can be present, without loss of generality, thanks to Proposition 2. Assume \(L_i\subseteq J\). Then it must be the case that J contains every \(M_j(L_i)\), as otherwise it would not be an invariant. It therefore follows that J must contain \(L_{i+1}\), since the latter is the minimal \(\mathbb {Z}\)linear set containing \(L_i\) and \(M_j(L_i)\) for all \(j\le k\). Finally, since I is itself one of the \(L_i\)’s, we have \(I \subseteq J\) as required. \(\square \)
Remark 1
Note that a \(\mathbb {Z}\)linear set is not sufficient for the MU puzzle: both 1 and 2 are in the reachability set, thus \(\left\{ 1 + 1\mathbb {Z}\right\} = \mathbb {Z}\) is the strongest \(\mathbb {Z}\)linear invariant.
4.1 Extensions of \(\mathbb {Z}\)linear Sets Without Strongest Invariants
In this section we show that several generalisations of \(\mathbb {Z}\)linear domains fail to admit strongest invariants.
\(\mathbb {Z}\)semilinear sets are unions of \(\mathbb {Z}\)linear sets, and therefore can include singletons. Consider the deterministic dynamical system starting from point 1 and doubling at each step \(\mathcal {M} = (1,(x\mapsto 2x))\). This system has reachability set \(\mathcal {O}= \left\{ 2^k \mid k\in \mathbb {N}\right\} \), which is not even \(\mathbb {N}{}\)semilinear (our most general class). For this LDS we can construct the invariant \(\left\{ 2,4,8,..., 2^k\right\} \cup \left\{ 2^{k+1} p_1 \mid p_1\in \mathbb {Z}\right\} \) for each k. For any proposed strongest \(\mathbb {Z}\)semilinear invariant, one can find a k for which the corresponding invariant is an improvement.
\(\mathbb {N}{}\)linear sets generalise \(\mathbb {Z}\)linear sets (observe that \(\mathbb {Z}\)linear sets are a proper subclass, since \(\left\{ x+ p_i\mathbb {Z}\right\} \) can be expressed as \(\left\{ x+ (p_i)\mathbb {N}{} + p_i\mathbb {N}\right\} \), but \(\left\{ x+ p_i\mathbb {N}\right\} \) is clearly not \(\mathbb {Z}\)linear). Consider the LDS \(((x_1,x_2),\left( {\begin{matrix}0&{}1\\ 1&{}0\end{matrix}}\right) )\), with a reachability set consisting of just two points \(x= (x_1,x_2)\) and \(y=(x_2,x_1)\). There are two incomparable candidates for the minimal \(\mathbb {N}{}\)linear invariant: \(\left\{ x + (yx)\mathbb {N}\right\} \) and \(\left\{ y + (xy)\mathbb {N}\right\} \). Similarly for \(\mathbb {R}_+\)linear invariants, the sets \(\left\{ y + (xy)\mathbb {R}_+\right\} \) and \(\left\{ x + (yx)\mathbb {R}_+\right\} \) are incomparable halflines.
4.2 \(\mathbb {Z}\)linear Targets
We have so far only considered invariants for point targets. We now turn to latticelike targets, in particular targets specified as fulldimensional \(\mathbb {Z}\)linear sets.
Theorem 3
It is decidable whether a given LDS \((x^{(0)},\left\{ M_1,\dots ,M_k\right\} )\) reaches a fulldimensional \(\mathbb {Z}\)linear target \(Y = \left\{ x + p_1\mathbb {Z}+\dots + p_d\mathbb {Z}\right\} \), with \(x,p_i\in \mathbb {Z}^d\).
Furthermore, for unreachable instances, a \(\mathbb {Z}\)semilinear inductive invariant can be provided.
Theorem 3 requires the targets to be fulldimensional. For nondeterministic systems reachability is undecidable for nonfulldimensional targets (in particular point targets) [22]. However, even for deterministic systems, when \(\mathbb {Z}\)linear targets fail to be fulldimensional the reachability problem becomes as hard as the Skolem problem (see, e.g. [24]), for example by choosing as target the set \(\left\{ (0,x_2,\dots ,x_d) \mid x_2,\dots ,x_d \in \mathbb {Z}\right\} = \left\{ \boldsymbol{0} +e_2\mathbb {Z}+\dots + e_d\mathbb {Z}\right\} \), where \(e_i \in \left\{ 0,1\right\} ^d\) is the standard basis vector, with \((e_i)_i = 1\) and \((e_i)_j= 0\) for \(i\ne j\).
Towards proving Theorem 3, we first show that fulldimensional linear sets can be expressed as ‘square’ hybridlinear sets. Hybridlinear sets are semilinear sets in which all the components share the same period vectors, and thus differ only in starting position (whereas semilinear sets allow each component to have distinct period vectors). By square, we mean that all period vectors are the same multiple of standard basis vectors.
Lemma 2
Let \(Y = \left\{ x + p_1\mathbb {Z}+ \dots + p_d\mathbb {Z}\right\} \) be a fulldimensional \(\mathbb {Z}\)linear set. Then there exists \(m\in \mathbb {N}{}\) and a finite set \(B\subseteq [0,m1]^d\) such that \(Y =\) \(\bigcup _{b\in B} \left\{ b + me_1\mathbb {Z}+\dots +me_d\mathbb {Z}\right\} \).
Proof
Suppose \(p_1,\dots ,p_d\) span a ddimensional vector space. Let \(P = \left( {\begin{matrix} p_1\\ \vdots \\ p_d\end{matrix}}\right) \) be the matrix with rows \(p_1,\dots ,p_d\). Since P is full row rank it is invertible, hence there exists a rational matrix \(P^{1}\) such that \(e_i = P^{1}_{i,1}p_1+\dots +P^{1}_{i,d}p_d\). In particular let \(m_i\) be such that \(P^{1}_{i,j}m_i\) is integral for all j. Then there is an integral combination of \(p_1,\dots ,p_d\) such that \(m_ie_i\) is an admissible direction in Y.
Let \(m = {\text {lcm}}\left\{ m_1,\dots ,m_d\right\} \). Then \(me_i\) is an admissible direction in Y. Hence by Proposition 2, Y is equivalent to \(\big \{x + p_1\mathbb {Z}+ \dots + p_d\mathbb {Z}+ me_1\mathbb {Z}+\dots +\)\(me_d\mathbb {Z}\big \}\). By the presence of \(me_1\mathbb {Z}+\dots +me_d\mathbb {Z}\) we have that \(x\in Y\) if and only \(x' \in Y\) where \(x'_i = (x_i \mod m)\).
And therefore Y can be written as \(\bigcup _{b\in B}\left\{ b + me_1\mathbb {Z}+\dots +me_d\mathbb {Z}\right\} \), where \(B = [0,m1]^d \cap Y\). \(\square \)
We now prove Theorem 3.
Proof
(Proof of Theorem 3). Choose m and B as in Lemma 2, so that Y is of the form \(\bigcup _{b\in B} \left\{ b + me_1\mathbb {Z}+\dots +me_d\mathbb {Z}\right\} \). We build an invariant I of the form \(\bigcup _{b\in B'} \left\{ b + me_1\mathbb {Z}+\dots +me_d\mathbb {Z}\right\} \) for some \(B'\subseteq [0,m1]^d\).
We initialise the set \(I_0=\left\{ x + me_1\mathbb {Z}+\dots +me_d\mathbb {Z}\right\} \), where \(x\in [0,m1]^d\) such that \(x_j = (x^{(0)}_j \mod m)\). We then build the set \(I_1\) by adding to \(I_0\) the sets \(\left\{ y + me_1\mathbb {Z}+\dots +me_d\mathbb {Z}\right\} \) where for each choice of \(M_i\), \(y\in [0,m1]^d\) is formed by \(y_j =( (M_ix)_j \mod m)\) for some \(x\in I_0\). We iterate this construction until it stabilises in an inductive invariant I. Termination follows from the finiteness of \([0,m1]^d\) (noting in particular that if termination occurs with \(B' = [0,m1]^d\), then \(I = \mathbb {Z}^d\) which is indeed an inductive invariant).
If there exists \(y\in B\cap I\) then return Reachable. This is because the same sequence of matrices applied to \(x^{(0)}\) to produce \(y\in I\) would, thanks to the modulo step, wind up inside the set \(\left\{ y + me_1\mathbb {Z}+\dots +me_d\mathbb {Z}\right\} \), which is a part of the target.
Otherwise, return Unreachable and I as invariant. By construction, I is indeed an inductive invariant disjoint from the target set. \(\square \)
Remark 2
By the same argument, Theorem 3 extends to a restricted class of \(\mathbb {Z}\)semilinear targets: the finite union of fulldimensional \(\mathbb {Z}\)linear sets.
5 \(\mathbb {N}\)Semilinear Invariants
We now consider \(\mathbb {N}{}\)semilinear invariants, our most general class. \(\mathbb {N}\)semilinear invariants gain expressivity thanks to the ‘directions’ provided by the period vectors. For example, the only possible \(\mathbb {Z}\)semilinear invariant for the LDS \((0,(x\mapsto x+1))\) is \(\mathbb {Z}\), yet the reachability set, \(\mathbb {N}\), is captured exactly by an \(\mathbb {N}\)linear invariant. We show that a separating \(\mathbb {N}\)semilinear invariant can always be found for unreachable instances of deterministic integer LDS, although the computed invariant will depend on the target. However, finding invariants is undecidable for nondeterministic systems, at least in high dimension. Nevertheless, we show decidability for the lowdimensional setting of the MU Puzzle—one dimension with affine updates.
5.1 Existence of Sufficient (but Nonminimal) \(\mathbb {N}\)semilinear Invariants for Point Reachability in Deterministic LDS
Kannan and Lipton showed decidability of reachability of a point target for deterministic LDS [16]. In this subsection, we establish the following result to provide a separating invariant in unreachability instances.
Theorem 4
Given a deterministic LDS \((x^{(0)},M)\) together with a point target y, if the target is unreachable then a separating \(\mathbb {N}\)semilinear inductive invariant can be provided.
To do so, we will invoke the results from [8] to compute an \(\mathbb {R}_+\)semilinear inductive invariant, and then extract from it an \(\mathbb {N}\)semilinear inductive invariant. More precisely, the authors of [8] show how to build polytopic inductive invariants for certain deterministic LDS. Such polytopes are either bounded or are \(\mathbb {R}_+\)semilinear sets. In the first case, the polytope contains only finitely many integral points, which can directly be represented via an \(\mathbb {N}\)semilinear set. In the second case, we build an \(\mathbb {N}\)semilinear set containing exactly the set of integral points included in the \(\mathbb {R}_+\)semilinear invariant, thanks to the following lemma.
Lemma 3
Given an \(\mathbb {R}_+\)linear set \(S= \left\{ x + \sum _{i} p_i\mathbb {R}_+\right\} \), where the vectors \(p_i\) have rational coefficients and x is an integer vector, one can build an \(\mathbb {N}\)semilinear set N comprising precisely all of the integral points of S.
Proof
(Proof of Theorem 4). We note that every invariant produced in [8] has rational period vectors, as the vectors are given by the difference of successive point in the orbit of the system, and thus Lemma 3 can be applied. The authors of [8] build an inductive invariant in all cases except those for which every eigenvalue of the matrix governing the evolution of the LDS is either 0 or of modulus 1 and at least one of the latter is not a root of unity. This situation however cannot occur in our setting. Indeed, the eigenvalues of an integer matrix are algebraic integers, and an old result of Kronecker [19] asserts that unless all of the eigenvalues are roots of unity, one of them must have modulus strictly greater than 1 (the case in which all eigenvalues are 0 being of course trivial).
This concludes the proof of Theorem 4. \(\square \)
5.2 Undecidability of \(\mathbb {N}\)semilinear Invariants for Nondeterministic LDS
If the enhanced expressivity of \(\mathbb {N}\)semilinear sets allows us always to find an invariant for deterministic LDS, it contributes in turn to making the invariantsynthesis problem undecidable when the LDS is not deterministic. We establish this through a reduction from the infinite Post correspondence problem (\(\omega \)PCP) that can be defined in the following way: given m pairs of nonempty words \(\{(u^{1},v^{1}),\dots , (u^{m},v^{m})\}\) over alphabet \(\{0,2\}\), does there exist an infinite word \(w=w_1w_2\dots \) over alphabet \(\{1,\dots ,m\}\) such that \(u^{w_1}u^{w_2}\ldots = v^{w_1}v^{w_2}\ldots \). This problem is known to be undecidable when m is at least 8 [6, 13].
Theorem 5
The invariant synthesis problem for \(\mathbb {N}\)semilinear sets and linear dynamical systems with at least two matrices of size 91 is undecidable.
Proof (Sketch)
We first establish the result in the case of several matrices in low dimension; this can then be transformed in a standard way to two larger matrices (of size 91).
The proof is by reduction from the infinite Post correspondence problem. Given an instance of this problem the pair of words corresponding to each sequence of tiles has an integer representation, using base4 encoding. An important property of our encoding is that the operation of appending a new tile to an existing pair of words can be encoded by matrix multiplication.
Recall that if the instance of \(\omega \)PCP is negative, then every generated pair of words will differ at some point. Our encoding is such that this difference of letters creates a difference in their numerical encodings that can be identified with an \(\mathbb {N}\)semilinear invariant. On the other hand, when there is a positive answer to the \(\omega \)PCP instance, there can be no \(\mathbb {N}\)semilinear invariant. \(\square \)
5.3 Nondeterministic OneDimensional Affine Updates
The previous section shows that point reachability for nondeterministic LDS is undecidable once there sufficiently many dimensions, motivating an analysis at lower dimensions. The MU Puzzle requires a single dimension with affine updates (or equivalently two dimensions in matrix representation, with the coordinate along the second dimension kept constant). We consider this onedimensional affineupdate case, and therefore, rather than taking matrices as input, we directly work with affine functions of the form \(f_i(x) = a_i x + b_i\).
Theorem 6
Given \(x^{(0)},y{}\in \mathbb {Z}\), along with a finite set of functions \(\left\{ f_1,\dots ,f_k\right\} \) where \(f_i(x) = a_ix+b_i\), \(a_i,b_i \in \mathbb {Z}\) for \(1 \le i \le k\), it is decidable whether \(y\) is reachable from \(x^{(0)}\).
Moreover, when y is unreachable, an \(\mathbb {N}\)semilinear separating inductive invariant can be algorithmically computed.
We note that decidability of reachability is already known [9, 10]. We refine this result by exhibiting an invariant which can be used to disprove reachability. In fact our procedure will produce an \(\mathbb {N}\)semilinear set which can be used to decide reachability, and which, in instances of nonreachability, will be a separating inductive invariant. We have implemented this algorithm into our tool porous, enabling us to efficiently tackle the MU Puzzle as well as its generalisation to arbitrary collections of onedimensional affine functions. We report on our experiments in Sect. 6.
We build a case distinction depending on the type of functions that appear:
Definition 5
A function \(f(x) = ax + b\)...

... is redundant if \(f(x)= b\), (including possibly \(b = 0\)), or if \(f(x) = x\).

... is counterlike if \(f(x) = x + b\), \(b\ne 0\). Two counterlike functions, \(f(x) = x + b\) and \(g(x) = x + c\) are opposing if \(b > 0\) and \(c < 0\) (or viceversa).

... is growing if \(f(x) = ax + b\) and \(a \ge 2\). We say a growing function is inverting if \(a \le 2\).

... is pure inverting if \(f(x) = x + b\).
Simplifying Assumptions
Lemma 4
Without loss of generality, redundant functions are redundant; more precisely, we can reduce the computation of an invariant for a system having redundant functions to finitely many invariant computations for systems devoid of such functions.
Proof
Clearly the identity function has no impact on the reachability set, and so can be removed outright. For any other redundant function, its impact on the reachability set does not depend on when the function is used, and we may therefore assume that it was used in the first step, or equivalently, using an alternative starting point. Hence the invariantcomputation problem can be reduced to finitely many instances of the problem over different starting points, with redundant functions removed. Finally, taking the union of the resulting invariants yields an invariant for the original system. \(\square \)
Lemma 5
Without loss of generality, \(x^{(0)} \ge 0\).
Proof
We construct a new system, where each transition \(f(x) = ax +b\) is replaced by \(\overline{f}(x) = ax  b\). Then \(x^{(0)}\) reaches \(y{}\) in the original system if and only if \(x^{(0)}\) reaches \(y\) in the new system. To see this, observe that if \(f(x) = ax + b\), then \(\overline{f}(x) = axb =  f(x)\). \(\square \)
Lemma 6
Suppose there are at least two distinct pure inverting functions (and possibly other types of functions). Then without loss of generality there are two opposing counters.
Proof
Consider \(f(x) = x + b\), and \(g(x) = x + c\). Then \(f(g(x)) = (x+c)+b = x +bc\) and \(g(f(x)) = (x+b)+c = x+cb\). Since \(bc = (cb)\) and \(b\ne c\) (as \(f\ne g\)) these two functions are opposing. \(\square \)
Two Opposing Counters. Let us first observe that when there are two opposing counters, we essentially move in either direction by some fixed amount. This will entail that only \(\mathbb {Z}\)(semi)linear invariants can be produced, rather than proper \(\mathbb {N}{}\)(semi)linear invariants.
Lemma 7
Suppose there are two opposing counters, \(f(x) = x + b\), and \(g(x) = x  c\). Then for any reachable x we have \(\left\{ x + d\mathbb {Z}\right\} \subseteq I\) for \(d = \gcd (b,c)\).
Therefore, starting with \(\left\{ x^{(0)} + d\mathbb {Z}\right\} \in I\) we can ‘saturate’ the invariant under construction using the following lemma:
Lemma 8
Let \(h(x) = x + d\) be chosen as a reference counter amongst the counters. If \(\left\{ x + d\mathbb {Z}\right\} \in I\), then \(\left\{ f(x) + d\mathbb {Z}\right\} \in I\) for every function f.
Proof
(Proof of Lemma 8). Consider the function \(f(x) = ax + b\). If \(x = y+dk \in I\), then \(f(x)=ax+b = ay + adk + b = f(y) + adk \in I\).
Now thanks to the presence of counter \(h(x) = x+d\), by choosing the initial \(k \in \mathbb {Z}\) appropriately and applying h(x) sufficiently many times (say \(m \in \mathbb {N}\) times), one can reach \(f(x) + adk + dm = f(x) + dn\) for any desired \(n\in \mathbb {Z}\). \(\square \)
Without loss of generality if \(\left\{ x +d\mathbb {Z}\right\} \) is in the invariant, then \(0\le x < d\). We then repeatedly use Lemma 8 to find the required elements of the invariant. Since there are only finitely many residue classes (modulo d), every reachable residue class \(\left\{ c_1,\dots ,c_n\right\} \) can be found by saturation (in at most d steps), yielding invariant \(\left\{ c_1+d\mathbb {Z}\right\} \cup \dots \cup \left\{ c_n+d\mathbb {Z}\right\} \).
Thanks to Lemma 6, in all remaining cases there is without loss of generality at most one pure inverter.
Only Pure Inverters. If there is exactly one pure inverter \(f(x) = x + b\) (and no other types of functions), then \(f(x^{(0)}) = x^{(0)} + b\) and \(f(x^{(0)} + b)= x^{(0)}b + b = x^{(0)}\), thus the reachability set is finite, with exact invariant \(\left\{ x^{(0)}, x^{(0)}+b \right\} \).
No Counters. If we are not in the preceding case and there are no counters, then there must be growing functions and by Lemma 6, without loss of generality at most one pure inverter. We show that all growing functions increase the modulus outside of some bounded region.
Lemma 9
For every \(M \ge 0\) and every growing function \(f(x) = ax + b\), \(a \ge 2\), there exists \(C^M_f \ge 0\) such that if \(x \ge C^M_f\) then \(f(x) \ge x + M\).
Proof
By the triangle inequality we have: \(f(x) = ax+b \ge ax  b\). Thus \(x \ge \frac{b+M}{a 1} \implies ax  b \ge x + M \implies f(x)\ge x +M\). \(\square \)
This is the only situation in which the invariant is not exactly the reachability set, and requires us to take an overapproximation.
Let \(C = \max \left\{ C^0_{f_1},\dots ,C^0_{f_k}, y+1\right\} \), for \(f_1,\dots ,f_k\) growing functions. If there are no pure inverters then \(\left\{ C  \mathbb {N}\right\} \cup \left\{ C + \mathbb {N}\right\} \) is invariant (although may not yet contain the whole of \(\mathcal {O}\)). However, we can return the inductive invariant \(\left\{ C  \mathbb {N}\right\} \cup \left\{ C + \mathbb {N}\right\} \cup (\mathcal {O}{} \cap (C, C))\). The set \(\mathcal {O}{} \cap (C, C)\) is finite and can elicited by exhaustive search, noting that once an element of the orbit reaches absolute value at least C, the remainder of the corresponding trajectory remains forever outside of \((C,C)\).
If there is one pure inverter \(g(x) = x + d\) then observe that \(C\) is mapped to \(C +d\) and \(C+d\) is mapped to \(C\). Thus intuitively we want to use the interval \((C, C+d)\). However two problems may occur: (a) since d could be less than 0 then \(C+d\) may no longer be growing (under the application of the growing functions), and (b) an inverting growing function only ensures that \(C\) is mapped to a value greater than or equal to C, rather than \(C+d\). Hence, we choose \(C'\) to ensure that \(C'\pm d\) is still growing by at least d (under the application of our growing functions). Let \(C' = \max \left\{ C^{d}_{f_1},\dots ,C^{d}_{f_k}, y+1\right\} +d\). Then the invariant is \(\left\{ C'  \mathbb {N}\right\} \cup \left\{ C'+d + \mathbb {N}\right\} \cup (\mathcal {O}{} \cap (C', C'+d))\).
Nonopposing Counters. The only remaining possibility (if there do not exist two opposing counters, and not all functions are growing or pure inverters), is that there are counterlike functions, but they are all counting in the same direction. There may also be a single pure inverter, and possibly some growing functions.
Pick a counter \(h(x) = x + d\) to be the reference counter; the choice is arbitrary, but it is convenient to pick a counter with minimal d. As a starting point, we have \(\left\{ x^{(0)} + d\mathbb {N}\right\} \subseteq I\).
Lemma 10
If there is an inverter \(g(x) = ax + b\), with \(a> 0,b\in \mathbb {Z}\), and we have \(\left\{ x + d\mathbb {N}\right\} \subseteq I\) then \(\left\{ g(x) + d\mathbb {Z}\right\} \subseteq I\).
The crucial difference with Lemma 8 is the observation that now an \(\mathbb {N}\)linear set has induced a \(\mathbb {Z}\)linear set.
Proof
Let \(r =g(x) + dm\) for \(m \in \mathbb {Z}\). We show \(r \in I\). Consider \(x + dn\) for \(n\in \mathbb {N}\), then \(g(x+dn) = a(x+dn) + b = ax+badn = g(x) adn\). Hence \(g(x) adn + dk\), \(n,k\in \mathbb {N}\), is reachable by applying k times the function h(x). Hence for any \(m\in \mathbb {Z}\) there exists \(k,n\in \mathbb {N}\) such that \(k  na = m\), so that r is indeed reachable. \(\square \)
Similarly to the situation with two opposing counters, whenever the invariant contains some \(\mathbb {Z}\)linear set, Lemma 8 allows us to saturate amongst the finitely many reachable residue classes.
However, the invariant may contain subsets that are not \(\mathbb {Z}\)linear. Consider \(\left\{ x + d\mathbb {N}\right\} \subseteq I\), which is not yet invariant. We repeatedly apply noninverting functions to \(\left\{ x + d\mathbb {N}\right\} \) to obtain new \(\mathbb {N}\)linear sets (not \(\mathbb {Z}\)linear sets). When the function applied ‘moves’ in the direction of the counters this will ultimately saturate (in particular when applying other counter functions). However, in the opposite direction, we may generate infinitely many such classes.
Example 3
Consider the reference counter \(h(x) = x +4\), with initial point 5. This yields an initial set \(\left\{ 5 + 4 \mathbb {N}\right\} \subseteq \mathcal {O}\), where 5 is the initial point and \(4\mathbb {N}{}\) is derived from the counter increment. Now when applying \(x \mapsto 2x +6\) to \(\left\{ 5 + 4 \mathbb {N}\right\} \) we obtain \(\left\{ 10+ 6 + 8 \mathbb {N}+ 4\mathbb {N}\right\} =\left\{ 16+4\mathbb {N}\right\} \), then \(\left\{ 38+4\mathbb {N}\right\} \), and then \(\left\{ 82 + 4\mathbb {N}\right\} \). However \(\left\{ 82+4\mathbb {N}\right\} \subseteq \left\{ 38+4\mathbb {N}\right\} \) and we can therefore stop with the invariant \(\left\{ 5+4\mathbb {N}\right\} \cup \left\{ 16+4\mathbb {N}\right\} \cup \left\{ 38+4\mathbb {N}\right\} \).
However, if the initial sequence is not moving in the direction of the reference counter, this saturation does not occur. Consider \(\left\{ 5 + 4 \mathbb {N}\right\} \) with the function \(x\mapsto 2x  6\). Then \(\left\{ 5 + 4 \mathbb {N}\right\} \) maps to \(\left\{ 106 + 8\mathbb {N}+ 4 \mathbb {N}\right\} = \left\{ 4+4\mathbb {N}\right\} \), which maps to \(\left\{ 2 + 4 \mathbb {N}\right\} \), \(\left\{ 2 + 4 \mathbb {N}\right\} \), \(\left\{ 10 + 4 \mathbb {N}\right\} \), \(\left\{ 26 + 4 \mathbb {N}\right\} \), and so on. However \(2\) and \(10\) are both 2 modulo 4 (and so is \(26\) as well). This means in the negative direction we can obtain arbitrarily large negative values congruent to 2 modulo 4 and then use the reference counter \(h(x) = x + 4\) to obtain any value of \(\left\{ 2 + 4\mathbb {Z}\right\} \). \(\square \)
Clearly we can examine all reachable residue classes defined by our reference counter. Any residue class reachable after an inverting function induces a \(\mathbb {Z}\)linear set. So it remains to consider those \(\mathbb {N}{}\)linear sets reachable without inverting functions. The remaining case to handle occurs when we repeatedly induce \(\mathbb {N}{}\)linear sets until they repeat a residue class in the direction opposite to that of the reference counter.
We consider the case for \(h(x) = x+ d\) with \(d\ge 0\). The case with \(h(x) =xd\) is symmetric. It remains to detect when a set \(\left\{ x+d\mathbb {N}\right\} \) leads to \(\left\{ y+d\mathbb {N}\right\} \) by a sequence of noninverting functions with \(x\equiv y\mod d\). Then by repeated application of these functions one can reach sets \(\left\{ z+d\mathbb {N}\right\} \) with z arbitrarily small, hence we can replace \(\left\{ x+d\mathbb {N}\right\} \) by \(\left\{ x+d\mathbb {Z}\right\} \). We give further details in the full version.
Reachability. The above procedure is sufficient to decide reachability. In all cases apart from that in which there are no counters, the invariants produced coincide precisely with the reachability sets. A reachability query therefore reduces to asking whether the target belongs to the invariant.
In the remaining case, the invariant obtained is parametrised by the target via the bound \(C'\). The target lies within the region \((C',C' + d)\), within which we can compute all reachable points. Thus once again, the target is reachable precisely if it belongs to the invariant. However, for a new target of larger modulus, a different invariant would need to be built.
Complexity
Lemma 11
Assume that all functions, starting point, and target point are given in unary. Then the invariant can be computed in polynomial time.
Without the unary assumption, the invariant could have exponential size, and hence require at least exponential time to compute. That is because the invariant we construct could include every value in an interval, for example, \((C,C)\), where C is of size polynomial in the largest value.
As shown in [10], the reachability problem is at least \(\mathbf {NP}\)hard in binary, because one can encode the integer Knapsack problem (which allows an object to be picked multiple times rather at most once). Moreover the Knapsack problem is efficiently solvable in pseudopolynomial time via dynamic programming; that is, polynomial time assuming the input is in unary, matching the complexity of our procedure.
6 The POROUS Tool
Our invariantsynthesis tool porous^{Footnote 9} computes \(\mathbb {N}{}\)semilinear invariants for point and \(\mathbb {Z}\)linear targets on systems defined by onedimensional affine functions. porous includes implementations of the procedures of Theorem 3 (restricted to onedimensional affine systems) and Theorem 6. porous is built in Python and can be used by commandline file input, a web interface, or by directly invoking the Python packages.
porous takes as input an instance (a start point, a target, and a collection of functions) and returns the generated invariant. Additionally it provides a proof that this set is indeed an inductive invariant: the invariant is a union of \(\mathbb {N}{}\)linear sets, so for each linear set and each function, porous illustrates the application of that function to the linear set and shows for which other linear set in the invariant this is a subset. Using this invariant, porous can decide reachability; if the specific target is reachable the invariant is not in itself a proof of reachability (since the invariant will often be an overapproximation of the global reachability set). Rather, equipped with the guarantee of reachability, porous searches for a direct proof of reachability: a sequence of functions from start to target (a process which would not otherwise be guaranteed to terminate).
Experimentation. porous was tested on all \(2^71\) possible combinations of the following function types, with \(a\ge 2, b\ge 1\): positive counters (\(x\mapsto x+b\)), negative counters (\(x\mapsto xb\)), growing (\(x\mapsto ax\pm b\)), inverting and growing (\(x\mapsto ax\pm b\)), inverters with positive counters (\(x\mapsto x+b\)), inverters with negative counters (\(x\mapsto xb\)) and the pure inverter (\(x\mapsto x\)). For each such combination a random instance was generated, with a size parameter to control the maximum modulus of a and b, ranging between 8 and 1024. The starting point was between 1 and the size parameter and the target was between 1 and 4 times the size parameter. Ten instances were tested for each size parameter and each of the \(2^71\) combinations, with between 1 and 9 functions of each type (with a bias for one of each function type).
Our analysis, summarised in Table 2, illustrates the effect of the size parameter. The time to produce the proof of invariant is separated from the process of building the invariant, since producing the proof of invariant can become slower as I becomes larger; it requires finding \(L_k\in I\) such that \(f_i(L_j) \subseteq L_k\) for every linear set \(L_j\in I\) and every affine function \(f_i\). In every case porous successfully built the invariant, and hence decided reachability very quickly (on average well below 1 s) and also produced the proof of invariance in around half a second on average. To demonstrate correctness in instances for which the target is reachable porous also attempts to produce a proof of reachability (a sequence of functions from start to target). Since our paper is focused on invariants as certificates of nonreachability, our proofofreachability procedure was implemented crudely as a simple breadthfirst search without any heuristics, and hence a timeout of 30 s was used for this part of the experiment only.
Our experimental methodology was partially limited due to the high prevalence of reachable instances. A random instance will likely exhibit a large (often universal) reachability set. When two random counters are included, the chance that \(\gcd (b_1,b_2) = 1\) (whence the whole space is covered) is around \(60.8\%\) and higher if more counters are chosen.
Overall around 86% of instances were reachable (of which 84% produced a proof within 30 s). Of the 14% of unreachable instances, all produced a proof, with the invariant taking around 0.2 s to build and 0.6 s to produce the proof. The 30s timeout when demonstrating reachability directly is several orders of magnitudes longer than answering the reachability query via our invariantbuilding method.
A typical academic/consumer laptop was used to conduct the timing and analysis (a fouryearold, fourcore MacBook Pro).
7 Conclusions and Open Directions
We introduced the notion of porous invariants, which are not necessarily convex and can in fact exhibit infinitely many ‘holes’, and studied these in the context of multipath (or branching/nondeterministic) affine loops over the integers, or equivalently nondeterministic integer linear dynamical systems. We have in particular focused on reachability questions. Clearly, the potential applicability of porous invariants to larger classes of systems (such as programs involving nested loops) or more complex specifications remains largely unexplored.
Our focus is on the boundary between decidability and undecidability, leaving precise complexity questions open. Indeed, the complexity of synthesising invariants could conceivably be quite high, except where we have highlighted polynomialtime results. On the other hand, the invariants produced should be easy to understand and manipulate, from both a human and machine perspective.
On a more technical level, in our setting the most general class of invariants that we consider are \(\mathbb {N}{}\)semilinear. There remains at present a large gap between decidability for onedimensional affine functions, and undecidability for linear updates in dimension 91 and above. It would be interesting to investigate whether decidability can be extended further, for example to dimensions 2 and 3.
Notes
 1.
Given two invariants I and \(I'\), we say that I is stronger than \(I'\) iff \(I \subseteq I'\); thus strongest invariants correspond to smallest invariant sets.
 2.
Presburger arithmetic is a decidable theory over the natural numbers, comprising Boolean operations, firstorder quantification, and addition (but not multiplication).
 3.
Onedimensional affine updates are functions of the form \(f(x) = ax + b\).
 4.
\(\begin{pmatrix} a &{} b\\ 0 &{} 1 \end{pmatrix}\begin{pmatrix}x \\ 1\end{pmatrix} = \begin{pmatrix}ax + b \\ 1\end{pmatrix}\) models affine functions using a matrix representation, holding one of the entries fixed to 1.
 5.
The affine span covers the entire space.
 6.
\(v_0,\dots ,v_m\) are linearly independent if there does not exist \(a_0,\dots ,a_m\in \mathbb {R}\), not all 0, such that \(a_0v_0+\dots +a_mv_m = 0\).
 7.
When intersecting a linear set with a semilinear set, either the latter does not change, or one obtains a finite union of elements of smaller dimension. Thus, in an infinite intersection, only a finite number of intersections affects the original set.
 8.
The last replacement is valid, since if \(x = y + \beta p_i \in L\) then \(x= y + \beta (p_i+\alpha p_j) \beta \alpha p_j\) is in the new lattice.
 9.
References
Almagor, S., Chistikov, D., Ouaknine, J., Worrell, J.: Ominimal invariants for discretetime dynamical systems (2019, preprint, submitted). https://arxiv.org/abs/1802.09263
Bozga, M., Iosif, R., Konecný, F.: Fast acceleration of ultimately periodic relations. In: Touili, T., Cook, B., Jackson, P.B. (eds.) Computer Aided Verification, 22nd International Conference, CAV 2010, Edinburgh, UK, 15–19 July 2010. Proceedings. Lecture Notes in Computer Science, vol. 6174, pp. 227–242. Springer, Heidelberg (2010). https://doi.org/10.1007/9783642142956_23. Extended VERIMAG technical report, TR201210, 2012: http://wwwverimag.imag.fr/TR/TR201210.pdf
Chistov, A.: Algorithm of polynomial complexity for factoring polynomials and finding the components of varieties in subexponential time. J. Soviet Math. 34(4), 1838–1882 (1986). https://doi.org/10.1007/BF01095643
Clarke, E.M., et al.: Abstraction and counterexampleguided refinement in model checking of hybrid systems. Int. J. Found. Comput. Sci. 14(4), 583–604 (2003). https://doi.org/10.1142/S012905410300190X
Cousot, P., Halbwachs, N.: Automatic discovery of linear restraints among variables of a program. In: Aho, A.V., Zilles, S.N., Szymanski, T.G. (eds.) Conference Record of the Fifth Annual ACM Symposium on Principles of Programming Languages, Tucson, Arizona, USA, January 1978, pp. 84–96. ACM Press (1978). https://doi.org/10.1145/512760.512770
Dong, J., Liu, Q.: Undecidability of infinite post correspondence problem for instances of size 8. RAIRO Theor. Informatics Appl. 46(3), 451–457 (2012). https://doi.org/10.1051/ita/2012015
Douglas, R.H.: Gödel, Escher, Bach: An Eternal Golden Braid. Basic Books, New York (1979)
Fijalkow, N., Lefaucheux, E., Ohlmann, P., Ouaknine, J., Pouly, A., Worrell, J.: On the Monniaux problem in abstract interpretation. In: Chang, B.Y.E. (ed.) SAS 2019. LNCS, vol. 11822, pp. 162–180. Springer, Cham (2019). https://doi.org/10.1007/9783030323042_9
Finkel, A., Göller, S., Haase, C.: Reachability in register machines with polynomial updates. In: Chatterjee, K., Sgall, J. (eds.) MFCS 2013. LNCS, vol. 8087, pp. 409–420. Springer, Heidelberg (2013). https://doi.org/10.1007/9783642403132_37
Fremont, D.: The reachability problem for affine functions on the integers. CoRR abs/1304.2639 (2013). http://arxiv.org/abs/1304.2639
Giesl, J., et al.: Analyzing program termination and complexity automatically with AProVE. J. Autom. Reason. 58(1), 3–31 (2016). https://doi.org/10.1007/s108170169388y
Ginsburg, S., Spanier, E.H.: Bounded ALGOLlike languages. Trans. Am. Math. Soc. 113(2), 333–368 (1964). https://doi.org/10.1090/S00029947196401815001
Halava, V., Harju, T.: Undecidability of infinite post correspondence problem for instances of size 9. RAIRO Theor. Informatics Appl. 40(4), 551–557 (2006). https://doi.org/10.1051/ita:2006039
Heizmann, M., Hoenicke, J., Podelski, A.: Termination analysis by learning terminating programs. In: Biere, A., Bloem, R. (eds.) CAV 2014. LNCS, vol. 8559, pp. 797–813. Springer, Cham (2014). https://doi.org/10.1007/9783319088679_53
Hrushovski, E., Ouaknine, J., Pouly, A., Worrell, J.: Polynomial invariants for affine programs. In: Dawar, A., Grädel, E. (eds.) Proceedings of the 33rd Annual ACM/IEEE Symposium on Logic in Computer Science, LICS 2018, Oxford, UK, 09–12 July 2018, pp. 530–539. ACM (2018). https://doi.org/10.1145/3209108.3209142
Kannan, R., Lipton, R.J.: Polynomialtime algorithm for the orbit problem. J. ACM 33(4), 808–821 (1986). https://doi.org/10.1145/6490.6496
Karr, M.: Affine relationships among variables of a program. Acta Informatica 6, 133–151 (1976). https://doi.org/10.1007/BF00268497
Kincaid, Z., Breck, J., Cyphert, J., Reps, T.W.: Closed forms for numerical loops. Proc. ACM Program. Lang. 3(POPL), 55:1–55:29 (2019). https://doi.org/10.1145/3290368
Kronecker, L.: Zwei Sätze über Gleichungen mit ganzzahligen Coefficienten. Journal für die reine und angewandte Mathematik 57(53), 173–175 (1857)
Leroux, J.: The general vector addition system reachability problem by presburger inductive invariants. Log. Methods Comput. Sci. 6(3) (2010). https://doi.org/10.2168/LMCS6(3:22)2010
Leroux, J.: Vector addition system reachability problem: a short selfcontained proof. In: Ball, T., Sagiv, M. (eds.) Proceedings of the 38th ACM SIGPLANSIGACT Symposium on Principles of Programming Languages, POPL 2011, Austin, TX, USA, 26–28 January 2011, pp. 307–316. ACM (2011). https://doi.org/10.1145/1926385.1926421
Markov, A.: On certain insoluble problems concerning matrices. Doklady Akad. Nauk SSSR. 57, 539–542 (1947)
Monniaux, D.: On the decidability of the existence of polyhedral invariants in transition systems. Acta Informatica 56(4), 385–389 (2018). https://doi.org/10.1007/s002360180324y
Ouaknine, J., Worrell, J.: Decision problems for linear recurrence sequences. In: Finkel, A., Leroux, J., Potapov, I. (eds.) RP 2012. LNCS, vol. 7550, pp. 21–28. Springer, Heidelberg (2012). https://doi.org/10.1007/9783642335129_3
Shmonin, G.: Lattices and Hermite normal form, February 2009. Lecture notes for the course Integer Points in Polyhedra at the Swiss Federal Institute of Technology Lausanne (EPFL)
Tzeng, W.: A polynomialtime algorithm for the equivalence of probabilistic automata. SIAM J. Comput. 21(2), 216–227 (1992). https://doi.org/10.1137/0221017
Acknowledgements
This work was funded by DFG grant 389792660 as part of TRR 248 (see perspicuouscomputing.science). Joël Ouaknine was supported by ERC grant AVSISS (648701), and is also affiliated with Keble College, Oxford as emmy.network Fellow. James Worrell was supported by EPSRC Fellowship EP/N008197/1.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.
Copyright information
© 2021 The Author(s)
About this paper
Cite this paper
Lefaucheux, E., Ouaknine, J., Purser, D., Worrell, J. (2021). Porous Invariants. In: Silva, A., Leino, K.R.M. (eds) Computer Aided Verification. CAV 2021. Lecture Notes in Computer Science(), vol 12760. Springer, Cham. https://doi.org/10.1007/9783030816889_8
Download citation
DOI: https://doi.org/10.1007/9783030816889_8
Published:
Publisher Name: Springer, Cham
Print ISBN: 9783030816872
Online ISBN: 9783030816889
eBook Packages: Computer ScienceComputer Science (R0)