Transition Invariants

Andreas Podelski

Andrey Rybalchenko

Max-Planck-Institut fur Informatik

Saarbrucken, Germany

Abstract
Proof rules for program verification rely on auxiliary
assertions. We propose a (sound and relatively complete)
proof rule whose auxiliary assertions are transition invariants. A transition invariant of a program is a binary relation over program states that contains the transitive closure
of the transition relation of the program. A relation is disjunctively well-founded if it is a finite union of well-founded
relations. We characterize the validity of termination or another liveness property by the existence of a disjunctively
well-founded transition invariant. The main contribution of
our proof rule lies in its potential for automation via abstract interpretation.

1. Introduction
Temporal verification of concurrent programs is an active research topic; for entry points to the literature see
e.g. [6, 9, 11, 13, 14, 15, 23]. In the unifying automatatheoretic framework of [23], a temporal proof is reduced to
the proof of fair termination, which again can be done using
deductive proof rules, e.g. [11]. The application of these
proof rules requires the construction of auxiliary assertions.
This construction is generally considered hard to automate,
especially when ranking functions and well-founded (lexicographic) orderings are involved.
We propose a proof rule whose auxiliary assertions are
transition invariants. We introduce the notion of a transition invariant as a binary relation over program states that
contains the transitive closure of the transition relation of
the program. We formulate an inductiveness principle for
transition invariants. This principle allows us to identify a
given relation as a transition invariant. We also introduce
 This work was partly supported by the German Research Foundation (DFG) as part of the Transregional Collaborative Research Center
Automatic Verification and Analysis of Complex Systems (SFB/TR 14
AVACS) and by the German Federal Ministry of Education and Research
(BMBF) in the framework of the Verisoft project under grant 01 IS C38.

the notion of disjunctive well-foundedness as a property of

relations. We characterize the validity of a liveness property
by the existence of a disjunctively well-founded transition
invariant. This is the basis of the soundness and relative
completeness of the proof rule.
Applying our proof rule for verifying termination or another liveness property of the program amounts to the following steps: the automata-theoretic construction of a new
program (the parallel composition of the original program
and a Buchi automaton as in [23]), the inductive proof of
the validity of the transition invariant for the new program,
and, finally, the test of its disjunctive well-foundedness.
Using transition invariants, we account for the Buchi acceptance condition (and hence, for fairness) in a direct way,
namely, by intersecting the transition invariant with a relation over the Buchi accepting states.
If the transition invariant is well-chosen, the test of
disjunctive well-foundedness amounts to testing wellfoundedness of transition relations of programs of a very
particular form: each program is one while loop whose
body is a simultaneous update statement. In the case of
concurrent programs with linear-arithmetic expressions we
obtain while loops for which efficient termination tests are
already known [17, 22].
The main contribution of our proof rule lies in its potential for automation. It is a starting point for the development
of automated verification methods for temporal properties
beyond safety of [concurrent] programs over infinite state
spaces. As detailed in Section 5, the inductiveness principle
allows one to compute the auxiliary assertions of the proof
rule. Namely, the transition invariants can be automatically
synthesized by computing abstractions of least fixed points
of an operator over the domain of relations. Methods to do
this correctly and efficiently are studied in the framework of
abstract interpretation [4]. Such methods have helped to realize the potential of the inductive proof rules for (state) invariants [14] for the automation of the verification of safety
properties [1, 2, 3, 4, 5, 7, 8]. The realization of the analogous potential for transition invariants is not in the scope of
this paper; see, however, [16].

Examples We write example programs in the programming language SPL (Simple Programming Language [14]).
To simplify the presentation, we ignore idling transitions for
the presented concurrent programs. The depicted controlflow graphs treat each straight-line code segment as a single
statement. For each of the example programs, we give a
(non-inductive) transition invariant, along with an informal
argument, in Sections 3 resp. 4; the corresponding formal
argument is based on a stronger inductive transition invariant, which we present in Section 5.
Usually the termination argument for the program
on Figure 1 is based on a lexicographic combination
of well-founded orderings.

: integer

lo al x; y

3
while
2 ax > 0 ^ y > 0 do
3
7
6
` : (x; y ) := (x 1; x)
7
6
5 5
4 4 or
`b : (x; y ) := (y 2; x + 1)
2

x > 0; y > 0,
x0 = x 1,
y0 = x

x > 0; y > 0,
x0 = y 2,
y0 = x + 1

LOOPS
LOOPS

in n
: integer where n > 0
lo al x; y
: integer where x = n
2
3
`0 :2while x  0 do
3
6
7
`1 : y := 1
6
7
6 6 `2 : while y < x do 7 7
6 6
7 7
4 4
5 5
`3 : y := 2y
`4 : x := x 1

x  0,
x0 = x; y 0 = 1
`0

`2

y  x,
x0 = x 1; y 0 = y

y < x,
x0 = x,
y 0 = 2y

Figure 2. Program CHOICE.

lo al x; y
: integer where x = 1; y = 0
2
3
`0 : while x = 1 do


6
`1 : y := y + 1 7
7 k P2 :: m0 : x := 0
P1 :: 6
4 `2 : while y > 0 do 5
m1 :
`3 : y := y 1

x = 1,
x0 = x; y 0 = y + 1

y > 0,
x0 = x; y 0 = y

`0

`2
x 6= 1,
x0 = x; y 0 = y

m0

m1

x0 = 0; y 0 = y

Figure 1. Program LOOPS.

Figure 3. Program ANY-DOWN.
We observe that there are only two kinds of loops, those
that go through `0 at least once and decrease the nonnegative integer x, and those that go only through `2 (and
not through `0 ) and decrease the non-negative value x y .
Transition invariants allow one to use this observation for a
formal proof of termination.
For the termination of the program CHOICE on
Figure 2, we observe that the execution of any fixed sequence of statements `a or `b decreases either of: x, y or
x y . Sections 2 and 3 show that this observation translates
to a formal termination argument. Section 5 shows how one
can formally justify this observation by an inductive proof.
CHOICE

ANY-DOWN The program ANY-DOWN on Figure 3 consists

of two concurrent processes. Each of the processes can be
scheduled to be executed by an external scheduler.

The program is not terminating if we consider all possible scheduler behaviors. E.g., in the following infinite computation of ANY-DOWN the process P2 is never executed (a
program state is a tuple containing the location of P1 , the
location of P2 , the value of x, and the value of y ).

h`0 ; m0 ; 1; 0i; h`1 ; m0 ; 1; 0i; h`0 ; m0 ; 1; 1i;

:::

This computation is not fair because the process P2 is never

executed although it is continuously enabled. If we assume
that the scheduling for each process is fair (see [11, 14] for
a detailed treatment of fairness assumptions), then the program ANY-DOWN is terminating.
In Section 4 we show how we incorporate the fairness
assumption into a fairness proof.

CONC-WHILES

A termination proof for the program

CONC-WHILES on Figure 4 requires a more complicated fair-

ness assumption (each of the processes must be scheduled

infinitely often, hence it is not possible that a process waits
forever).

: integer where x > 0; y > 0

3
`0 : while x > 0 do
`1 : y := x 1 5
P1 :: 4
`2 : y := 0
2
3
m0 : while y > 0 do
m1 : x := y 1 5
k P2 :: 4
m2 : x := 0

lo al x; y

x > 0,
x0 = x; y 0 = x

x  0,
x 0 = x,
y0 = 0

y > 0,
x0 = y 1; y 0 = y

`0

m0

`2

m2

y  0,
x0 = 0,
y0 = y

Figure 4. Program CONC-WHILES.

Our formal proof in Section 4 will follow the intuition

that each infinite fair computation decreases the value of x
as well as the value of y infinitely often.

2. Transition Invariants
This section deals with properties of general binary relations. For concreteness we formulate the properties for the
transition relation of a program and its restriction to the set
of accessible states. We next formalize programs.
Program P





A program P

= hW; I; Ri consists of:

W : a set of states,

 W,
R: a transition relation, such that R  W  W .
I : a set of starting states, such that I

A computation is a maximal sequence of states s1 ; s2 ; : : :

such that:

 s1 is a starting state, i.e., s1 2 I ,

 (s ; s +1 ) 2 R for all i  1 (and i  n 1, if the
i

sequence is of the finite length n).

The set A of accessible states consists of all states that

appear in some computation.
A finite segment si ; si+1 ; : : : ; sj of a computation where
i < j is called a computation segment.
Definition 1 (Transition Invariant)
A transition invariant T is a superset of the transitive closure of the transition relation R restricted to the accessible
states A . Formally,

R+ \ (A  A )

T:

Thus, a transition invariant of the program is a relation T on

the program states such that for every computation segment
si ; si+1 ; : : : ; sj the pair of states si ; sj is an element of T .
Note that the Cartesian product of the set of states with
itself, i.e. the relation W  W , is a transition invariant of
the program. A superset of the transitive closure of the transition relation of the program is a transition invariant of the
program; the converse does not hold.
A state invariant is a superset of A . Given the transition invariant T and the set of starting states I , the set

I [ fs0 j s 2 I and (s; s0 ) 2 T g

is a state invariant. Conversely, a transition invariant can be
strengthened by restricting it to a given state invariant.
A program is terminating if it does not have infinite computations. This is equivalent to the fact that its transition
relation restricted to the accessible states, i.e., R \ A 
A , is well-founded. We investigate the well-foundedness
of a transition relation through a weaker property of its transition invariant, introduced next.

Definition 2 (Disjunctive Well-foundedness)

A relation T is disjunctively well-founded if it is a finite
union T T1 [


[ Tn of well-founded relations.

Every well-founded relation is disjunctively well-founded.

The converse does not hold in the general case. E.g., the
relation ACK-REQ defined by

f(a k; req)g [ f(req; a k)g

is disjunctively well-founded but not well-founded.
Given a disjunctively well-founded relation T , the
implication:

R is well-founded if R  T
does not hold (for a counterexample, take R and T to be the
relation ACK-REQ). However, the implication:

R is well-founded if R+  T
does hold, as we show below.

Theorem 1 (Termination) The program P is terminating

if and only if there exists a disjunctively well-founded transition invariant for P .
Proof. if-direction: Assume, for a proof by contraposition,
that

=
def

( ) =
def

Ti such that (sk ; sl ) 2 Ti

( )

(k; l)  (k0; l0) = f (k; l) = f (k0; l0)

def

The equivalence relation  has finite index, since the range

of f is finite.
By Ramseys theorem [18], there exists an infinite sedef
quence of positive integers K
k1 ; k2 ; : : : such that all
pairs of elements in K belong to the same equivalence class,
say m; n  with m; n 2 K . That is, for all k; l 2 K such
that k < l we have k; l  m; n . We fix m and n.
Let Tmn denote the relation f m; n . Since ki ; ki+1 
m; n for all i  , the function f maps every pair
ki ; ki+1 to Tmn for all i  . Hence, the infinite sequence
sk1 ; sk2 ; : : : is induced by Tmn , i.e.,

[(

(
(

( ) ( )
( )
1
1

(s

ki

; ski+1 ) 2 Tmn ; for all i  1:

Hence, the sub-relation Tmn is not well-founded.

only if-direction: Assume that the program P is terminating. We define the relation T as the restriction of the transition relation to accessible states.

=
def

R+ \ (A  A )

Clearly, T is a transition invariant. Assume that 

s1 ; s2 ; : : : is an infinite sequence of states such that
si ; si+1 2 T for all i  . Since the state s1 is accessible,
def

The relation ACK-REQ shows that we cannot drop the requirement that not just the transition relation of a program,
but also its transitive closure must be contained in the disjunctively well-founded relation T .
The next example shows that we cannot drop the finiteness requirement in the definition of disjunctive wellfoundedness. The following transition relation

= f(i; i + 1) j i  1g
has a transition invariant T = T1 [ T2 [ : : : that is the union
R

def

def

The function f exists because T is a transition invariant, and

thus we can arbitrarily choose one relation from the (finite)
set fTi j sk ; sl 2 Ti g as the image of the pair k; l . Note
that the range of the function f is finite.
For the fixed computation  , the function f induces
an equivalence relation  on pairs of positive integers (in
this proof we always consider pairs whose first element is
smaller than the second one).

T1 [


[ T n

is a disjunctively well-founded transition invariant for the

program P , and that P is not terminating. We show that
at least one sub-relation Ti of the transition invariant is not
well-founded.
By the assumption that P is not terminating, there exists
def
an infinite computation  s1 ; s2 ; : : : .
We define a function f that maps an ordered pair of indices of the states in the computation  to one of the subrelations in the transition invariant T as follows.
For k < l; f k; l

and for all i  there is a non-empty computation segment leading from si to si+1 (i.e. si ; si+1 2 R+ ), there
exists an infinite computation s1 ; : : : ; s1 ; : : : ; s2 ; : : : . This
fact is a contradiction to our assumption that P is terminating. Hence, T is (disjunctively) well-founded.


of well-founded relations Ti , where

Ti

= f(i; i + j ) j j  1g;
def

for all i  :

However, the relation R is not well-founded.

3. Termination
Theorem 1 gives a (complete) characterization of program termination by disjunctively well-founded transition
invariants.
We next present disjunctively well-founded transition invariants for the first resp. second program shown in the introduction. Here, we only give informal arguments; in Section 5 we will show how one can formally prove that the
relations are indeed transition invariants, and give the formal argument in the form of (stronger) inductive transition
invariants.
LOOPS

The union of the relations T1 , T2 and Tij for

6= j 2 f0; : : : ; 4g denoted by the following assertions

over the unprimed and primed program variables is a transition invariant for the program LOOPS; here p is a variable
ranging over the set of location labels f`0 ; : : : ; `4 g.

T1
T2
Tij

x  0 ^ x0 < x
x y > 0 ^ x0 y 0 < x y
p = `i ^ p 0 = `j where i 6= j 2 f0; : : : ; 4g

The intuitive argument that the union of the relations above

indeed identifies a transition invariant may go as follows.
We can distinguish three kinds of computation segments
that lead a state s to a state s0 . All pairs of states s; s0
in R+ such that s goes to s0 via the location `0 (and in particular the loops at `0 ) are contained in the relation T1 . All

pairs of states s; s0 in R+ such that s goes to s0 via the

location `2 and not `0 (and in particular the loops at `2 ) are
contained in the relation T2 . Every pair of states in R+ that
has different location labels is contained in one of Tij s.
Obviously, the relations T1 and T2 as well as the relations
Tij s are well-founded.
The union the relations below is a transition invariant for the program CHOICE.
CHOICE

T1
T2
T3

x > 0 ^ x0 < x
x + y > 0 ^ x0 + y 0 < x + y
y > 0 ^ y0 < y

We follow the automata-theoretic framework for the

temporal verification of concurrent programs [23]. This
framework allows us to assume that the temporal correctness specification, viz. a liveness property and a fairness
assumption , are given by a (possibly infinite-state) automaton A; . The intuition is that the automaton A; accepts exactly the infinite -fair sequences of program states
that do not satisfy the property . We assume that the automaton A; is equipped with the Buchi acceptance condition.

Automaton A; We consider an alphabet consisting

of the program states W . The automaton A;
hQ; Q0; ; F i consists of:

 Q: a (possibly infinite) set of states,

 Q0 : the set of starting states, such that Q0  Q,

: the transition relation. It is a set of triples
(q; s; q0) 2 Q  W  Q.
 F : the set of accepting states, such that F  Q.

A run of the automaton A; on the word s1 ; s2 ; : : :

is a sequence of the automaton states q1 ; q2 ; : : : such that
q1 2 Q0 and qi ; si ; qi+1 2 for all i  . The automaton
accepts a word w if it has a run q1 ; q2 ; : : : on w such that
for infinitely many is we have qi 2 F .

)

Program P; The program P satisfies the liveness

property
under the fairness assumption
if there exists no infinite computation of P that satisfies the fairness
condition and falsifies the property , i.e., all computations of the program P are rejected by the automaton A;

def

 Q:

The set of starting states is I  Q0 . The transition relation of

P; consists of pairs s; q ; s0 ; q 0 such that s; s0 2 R
and q; s; q 0 2 . The set of accepting states is the product

)

(( ) (

))

 F:

WF

4. Liveness

WQ

Again, the relations T1 , T2 , and T3 are obviously wellfounded.

(computations are infinite words over the alphabet W ; finite computations are added an idling transition for the last
state). We export the program computations to the automaton by the parallel composition P; of the program and the
automaton, which we introduce next.
The program P; , which in fact is equipped with the
Buchi acceptance condition, is obtained by the synchronous
parallel composition of P and A; . The set of states of
P; is the Cartesian product

def

)(

A computation s1 ; q1 ; s2 ; q2 ; : : : of P; is fair if for

infinitely many is we have si ; qi 2 WF . The program
P is correct with respect to the property under the fairness condition if and only if all (infinite) computations
of P; are not fair (see Theorem 4.1 in [23]). The terminology P; is fair terminating is short for all (infinite)
computations of P; are not fair.

The following theorem characterizes the validity of the

(under the fairness assumption )
temporal property
through the existence of a disjunctively well-founded transition invariant for the program P; (with the set WF of
Buchi accepting states).

Theorem 2 (Liveness) The program P satisfies the liveness property

under the fairness assumption
if and
only if there exists a transition invariant T for P; such
that T \ WF  WF is disjunctively well-founded.

Proof. if-direction (sketch): Assume, for a proof by contraposition, that the finite union

=
def

T1 [


[ T n ;

such that T \ (W  W ) is well-founded for all i 2

f1; : : : ; ng, is a transition invariant for the program P .
i

Furthermore, we assume that P; has an (infinite) fair

computation (i.e., is not fair terminating). We prove that
at least one relation Ti \ WF  WF is not well-founded.
By the assumption that P; is not fair terminating, there
def
def
exists an infinite fair computation  s1 ; s2 ; : : : . Let 
s1 ; s2 ; : : : be an infinite subsequence of  such that si 2
WF for all i  .
Now we can follow the lines of the if-part of the proof
of Theorem 1. We show that there exists an infinite subsequence of  and an index i 2 f ; : : : ; ng such that each

pair of consecutive states in the subsequence is an element

of the very same relation Ti \ WF  WF . Thus we obtain
a contradiction to the assumption that Ti \ WF  WF is
well-founded for all i 2 f ; : : : ; ng.

only if-direction: Assume that the program P; is fair terminating (i.e., has no (infinite) fair computation). Let A
denote the set of accessible states of P; . We define the
following relations on the accessible states of P; .

T1
T2

= R+ \ (A \ W  A )
= R+ \ (A n W  A )
def

def

Clearly, the relation

T 1 [ T2

def

=
(

is a transition invariant. Assume that 

s1 ; s2 ; : : : is
i
an infinite sequence of states such that s ; si+1 2 T1
for all i  . Since the state s1 is accessible, and for
all i  there is a non-empty computation segment leading from si to si+1 (i.e. si ; si+1 2 R+ ) there exists an
infinite fair computation s1 ; : : : ; s1 ; : : : ; s2 ; : : : . This fact
is a contradiction to our assumption that P is fair terminating. Hence, T1 is well-founded. Clearly, the intersection
T2 \ WF  WF is empty. We conclude that the only-if

direction holds.
def

Here, the Buchi automaton A; encodes the

fairness assumption eventually the process P2 leaves the
location m0 which is expressed by the temporal logic fordef
mula
F p 2 6 m0 . The union of the relations below forms a transition invariant for P; . The two variables
p 1 and p 2 range over the location labels of the first resp.
second process. The variable p Q ranges over the states q0
and qF of the Buchi automaton A; (where the state qF is
accepting).
ANY-DOWN

 = ( = )

= q ^ y > 0 ^ y0 < y
p 6= q
p = q0 ^ p 0 = q
p 2 = m0 ^ p 02 = m1
p 1 = ` ^ p 01 = `
where i 6= j 2 f0; : : : ; 3g
p Q

))

We encode the fairness assumption that no

process can wait forever (except in the final location) by the
temporal formula below.
CONC-WHILES

GF (p 1 6= 0) ^ GF (p 1 6= 1) ^
GF (p 2 6= 0) ^ GF (p 2 6= 1)

Examples We give a transition invariant for each of the

programs P; obtained by the parallel composition of
the program ANY-DOWN resp. CONC-WHILES with the Buchi
automaton A; that encodes the appropriate fairness assumption (the liveness property is termination; the automaton A; accepts exactly the infinite -fair computations). We do not explicitely present A; and P; since
they can be easily derived.

T1
T2
T3
T4
Tij

(( ) (

The relation T1 contains the pairs of states s; q ; s0 ; q 0

from the transitive closure R+ of the program P; that
are the initial and the final states of the loops starting in
the Buchi accepting state. These loops are induced by the
execution of the while-statement at the location `2 . For the
while-statement at the location `0 the initial-final state pairs
are elements of T2 . The relations T3 , T4 , and Tij where
i 6 j 2 f ; : : : ; g contain pairs of states that have different
location labels wrt. either the Buchi automaton or one of the
processes.
The relations T1 , T3 , T4 , and Tij s are well-founded.
According to the formal argument of this section, the relation T2 is not considered; the restriction of T2 to the Buchi
accepting states is empty.

The corresponding Buchi automaton has the four states

fq0 ; q1 ; q2 ; qF g, where the state qF is accepting.
The union of the following relations is a transition invariant for P; .

T1
T2
T3
Tij4
Tij5
Tij6

= q ^ x > 0 ^ x0 < x
p = q ^ y > 0 ^ y 0 < y
p =
6 q
where i 6= j 2 f0; 1; 2g
p = q ^ p 0 = q
0
p 1 = ` ^ p 1 = `
where i 6= j 2 f0; 1; 2g
0
p 2 = m ^ p 2 = m
where i 6= j 2 f0; 1; 2g
p Q

The relations T1 and T2 capture loops that start in the Buchi

accepting state and contain execution steps of both processes P1 and P2 . The loops that contain the executions
of only P1 or only P2 are captured by the relation T3 . The
relations Tij4 , Tij5 , and Tij6 with i 6 j 2 f ; ; g capture
computation segments that are not loops wrt. the location
labels of either the Buchi automaton or one of the processes.
The well-foundedness of the relations T1 ; T2 , Tij4 , Tij5 ,
and Tij6 for i 6 j 2 f ; ; g is sufficient for proving the
fair termination property; the restriction of T3 to the Buchi
accepting state is empty.

012

012

5. Inductiveness

In this section, we formulate a proof rule for verifying

liveness properties of concurrent programs. The proof rule
is based on inductive transition invariants.

Definition 3 (Inductive Relation) Given a program with

the transition relation R, a binary relation T on program
states is inductive if it contains the transition relation R
and it is closed under the relational composition with R.
Formally,

[ T R 

T:

As usual, the composition operator denotes the relational

composition, i.e., for P; Q  W  W we have

P Q

= f(s; s0) j (s; s00 ) 2 P and (s00; s0) 2 Qg:

def

Replacing the inductiveness criterion above by R [ R T 

T yields an equivalent criterion. Replacing it by R \ A 
A [ T R \ A  A  T yields a slightly weaker
criterion. This may be useful in some situations.

premises P1 and P2 (i.e., one identifies T as as transition invariant by strengthening T with the inductive relation T 0 ).
The two formulations are equivalent since the disjunctive
well-foundedness of a relation is inherited by its subset.
Program P ,
liveness property ,
fairness assumption ,
Buchi automaton A; ,
parallel composition of P and A; is program P;
with:
transition relation R,
states WQ ,
accepting states WF ,
relation T  WQ  WQ

Remark 1 An inductive relation for the program P is a

transition invariant for P .

P1:
P2:
P3:

Inductive relations are called inductive transition invariants.

Note that a transition invariant T , even if it is inductive,
is in general not closed under the composition with itself,
i.e., in general

T T

Corollary 1 (Compositionality) A finite union of wellfounded relations is well-founded if it is closed under relational composition with itself.
Proof. Let the relation T be the finite union of the wellfounded relations that is closed under the composition with
itself, i.e. T T  T .
By Remark 1, T is an inductive transition invariant for
itself. Since T is disjunctively well-founded, we have that
T is well-founded by Theorem 1.

Proof Rule Theorem 2 and Remark 1 give rise to a proof
rule for the verification of liveness properties; see Figure 5.
Again, the formulation uses the automata-based framework
for verification of concurrent programs [23]. We obtain a
proof rule for termination by taking R as the transition relation of the program P , a relation T  W  W and replacing
T \ WF  WF by T in the premise P3.
In our examples we split the reasoning on disjunctive
well-foundedness and inductiveness. This can be seen as
using an alternative, equivalent formulation of the proof
rule: one takes two relations T and T 0 such that T satisfies the premise P3 and T 0 is a subset of T that satisfies the

R
T R
T \ (WF



W )
F

T
T
disjunctively
well-founded

P satisfies under 

6 T:

In other words, a transition invariant, even if it is inductive,

need not be transitive.
We note in passing a simple but perhaps curious consequence of Theorem 1 and Remark 1.

Figure 5. Rule LIVENESS.

As already mentioned, a transition invariant can be
strengthened by restricting it to a given state invariant S .
I.e., if T is a transition invariant and S is a state invariant,
then

T0

= T \ (S  S )
def

is a (stronger) transition invariant.

Validation of the Premises of the Proof Rule We assume
that the transition relation R is given as a union of relations,
say R R1 [


[ Rm . This is usually the case for concurrent programs, where each program statement denotes a
transition Ri (an assertion over unprimed and primed program variables, as seen in the examples).
T1 [


[ Tn , then the
If T is given as the union T
composition T R is the union of the relations Ti Rj for
i 2 f ; : : : ; ng and j 2 f ; : : : ; mg. Each relation Ti Rj is
again represented by an assertion over unprimed and primed
program variables.
Thus, the premises P1 and P2 can be established by entailment checks between assertions.
The premise P3 can be established using traditional
methods for proving termination. In the extreme case, when
n
, i.e., the transition invariant or its partitioning are illchosen, the reduction to the disjunctive well-foundedness

=1

has not brought any simplification and is as hard as before the reduction. In the other cases, with a well-chosen
transition invariant and partitioning, the premise P3 can be
established by a number of pairwise independent simple
well-foundedness tests.
Note that all relations Ti in the transition invariants of
the programs presented in this paper correspond to simple while programs that consist of a single while loop with
only update statements in its body.
~ ^eX
~ 0; X
~ is wellMore generally, the relation g X
founded if and only if the while loop

( )

~ ) do
while g (X
0
~
~
e(X ; X )

is terminating.
In the case of concurrent programs with linear-arithmetic
expressions, the well-foundedness test in the premise P3
amounts to the termination test of simple while programs,
for which an efficient test exists; see [17, 22].
In the special case of finite-state systems (a case that we
do not target), each small termination problem is to check
whether a transition is a self-loop.
Inductive Transition Invariants for Examples Each of
the relations T shown in Section 3 and 4 is not inductive
(i.e., the composition of one of the relations Ti and one of
the program transitions Rj is not a subset of T ). We formally identify each T as a transition invariant by presenting
an inductive one that strengthens T (i.e., is a subset of T ).
We thus complete the termination resp. liveness proof according to the proof rule.
The union of the following relations is an inductive transition invariant for the program LOOPS (in the version according to the depicted control-flow graph).
LOOPS

= `0 ^ x  0 ^ x0  x ^ p 0 = `2
p = `2 ^ x0 < x ^ p 0 = `0
p = `2 ^ x y > 0 ^ x0  x ^ y 0 > y ^ p 0 = `2
p = `0 ^ x  0 ^ x0 < x ^ p 0 = `0
p = `2 ^ x  0 ^ x0 < x ^ p 0 = `2
p

The inductiveness can be easily verified. E.g., the composition of the relation below (which is the transition for the
straight-line code from the location `2 to `0 ; it is obtained
by composing the transition between the locations `2 and `4
and the transition from `4 to `0 ),
p

= `2 ^ y  x ^ x0 = x 1 ^ y0 = y ^ p 0 = `0

with the first of the five relations above yields the relation
below, a relation that entails the fourth.
p

= `0 ^ x  0 ^ x0  x 1 ^ p 0 = `0

The union of the relations below is an inductive

transition invariant for the program CHOICE.
CHOICE

x > 0 ^ y > 0 ^ x0 < x ^ y 0  x

x > 0 ^ y > 0 ^ x0 < y 1 ^ y 0  x + 1
x > 0 ^ y > 0 ^ x0 < y 1 ^ y 0 < y
x > 0 ^ y > 0 ^ x0 < x ^ y 0 < y
We next present (the interesting part of) an
inductive transition invariant for the parallel composition
P; of the program ANY-DOWN with the Buchi automaton
A; that accepts exactly the infinite sequences of program
states that are fair, i.e., where the second process does not
wait forever. We do not present the relations where the values of one of the program counters are different before and
after the transition; we only present the relations that are
loops in the control flow graph for the program P; . Each
p 01 and
of the relations satisfy the conjunction of p 1
0
0
p 2 p 2 and p Q p Q ; we omit that conjunction in each
of the assertions below.
ANY-DOWN

p Q
p Q
p Q
p Q
p Q
p Q

=q
=q
=6 q
=6 q
=6 q
=6 q

F
F

^ p 1 = `2 ^ p 2 = m1 ^ y > 0 ^ x0 = x ^ y0 < y
^ p 1 = `3 ^ p 2 = m1 ^ y > 0 ^ x0 = x ^ y0 < y
^ p 1 = `0 ^ p 2 = m0 ^ x0 = x
^ p 1 = `1 ^ p 2 = m0 ^ x0 = x
^ p 1 = `2 ^ p 2 = m1 ^ y > 0 ^ x0 = x ^ y0 < y
^ p 1 = `3 ^ p 2 = m1 ^ y > 0 ^ x0 = x ^ y0 < y

The transition invariant for P; contains

the following relations. We show only those that are loops
wrt. the location labels; again, we omitted the conjunction
p 1 p 01 ^ p 2 p 02 ^ p Q p 0Q in each assertion below.
CONC-WHILES

p Q
p Q
p Q
p Q

=
=q
=q
=6 q
=6 q

F
F
F

=
^ x > 0 ^ x0 < x ^ y 0 < x
^ y > 0 ^ x0 < y ^ y 0 < y
^ x > 0 ^ x0  x ^ y 0 < x
^ y > 0 ^ x0  y ^ y 0  y

Soundness and Completeness The separation of the temporal reasoning from the reasoning about the auxiliary assertions in the relative completeness statement below is
common practice; see e.g. [13, 14].
Theorem 3 (Proof Rule LIVENESS) The rule LIVENESS is
sound, and complete relative to the first-order assertional
validity and the well-foundedness validity of the relations
that constitute the transition invariant.
Proof. The soundness of the rule follows directly from
Remark 1 and Theorem 2.

For proving the relative completeness, we observe that

the transition invariant constructed in the proof of Theorem 2 is in fact inductive. In order to establish the completeness relative to assertional provability, we need to show that
this inductive transition invariant is expressible by a firstorder assertion.
We need to construct the assertion T over unprimed and
primed program variables that denotes a transition invariant satisfying the premises of the rule LIVENESS. We omit
the construction, which follows the lines of the method for
constructing the assertion A that denotes the set of all accessible states [14].

Automated Liveness Proofs Given a program with the
transition relation R, we are interested in the subclass of its
inductive transition invariants.
We define the operator F over relations by

F (T )

= T R:
def

We write F #  F and say that F # is an approximation of

F , if F # S  F S holds for all relations S .
The inductive transition invariants are (exactly the) least
fixed points above R of operators F # such that F #  F .
There are many techniques based e.g. on widening or
predicate abstraction that have been applied with great success to the automated construction of least fixed points of
approximation of the post operator [1, 2, 3, 4, 5, 7, 8]. Now
we can start to carry over the abstract interpretation techniques in order to construct least fixed points of approximations of the operator F . Thus, relations T that satisfy the
premises P1 and P2 can be constructed automatically.
As already mentioned, the validation of the premise
P3 can be automated for interesting classes of concurrent programs over linear-arithmetic expressions (see [17]
and [22]). Automated checks for other classes of programs
are an open topic of research.

( )

( )

6. Related Work
There is a large body of work on proof rules for liveness
properties of concurrent programs, see [6, 11, 13, 15]. They
all rely on auxiliary well-founded (lexicographic) orderings
for the transition relation, and not on independent orderings
for sub-relations, as in our approach.
The automata-theoretic approach for verification of concurrent programs [23] reduces the verification problem to
proving termination. It leaves open how to prove termination. We indicate one possible way.
A rank predicate [24] (a notion directly related to
progress measures [9]) proves fair termination of a program
if the rank does not increase in every computation step and

decreases in the accepting states. In a disjunctively wellfounded transition invariant a rank need not decrease in all
sub-relations if an accepting state is visited, i.e., the rank
of one sub-relation must decrease and all other ranks may
increase.
In [12], an axiomatic approach to prove total correctness (safety property + termination) of sequential programs
uses assertions connecting the initial and final values of the
program variables. This must not be confused with transition invariants that capture all pairs of intermediate values
in computations of arbitrary length, possibly going through
loops.
It is interesting to compare our use of Ramseys theorem
in the proofs of Theorems 1 and 2 with its use in the theory
of (finite) Buchi automata (see e.g. [19, 21]). The equivalence classes over computation segments in our proofs are
related to the state transformers in the transition monoid of
the Buchi automaton. In both uses of Ramseys theorem,
the sets of transformers are finite and thus induce an equivalence relation of finite index (which is why Ramseys theorem can be applied). However, our proofs consider finite
sets of transformers over an infinite state space, as opposed
to transformers over a finite state space.
The termination analysis for functional programs in [10]
has been the starting point of our work. The analysis is
based on the comparison of infinite paths in the control flow
graph and in size-change graphs; that comparison can be
reduced to the inclusion test for Buchi automata. The transitive closure of a (finite) set of size-change graphs can be
seen as a graph representation of a special case of a transition invariant.

7. Conclusion
We have presented a (sound and relatively complete)
proof rule for the temporal verification of concurrent programs. In a well-chosen instantiation, this proof rule allows
one to decompose the verification problem into a number of
independent smaller verification problems: one for establishing a transition invariant, and the others for establishing
the disjunctive well-foundedness. The former is done in a
way that is reminiscent of establishing state invariants, using a familiar inductive reasoning. The other ones amount
to testing the termination of simple while loops.
Our conceptual contribution is the notion of a transition
invariant, and its usefulness in temporal proofs. This notion
is at the basis of our proof rule. In particular, it allows one
to account for Buchi accepting conditions (and hence for
fairness) in a direct way, namely by intersecting relations.
Our technical contribution is the characterization of the
validity of termination or another liveness property by the
existence of a disjunctively well-founded transition invariant. The application of Ramseys theorem allows us to re-

place the argument that the transition relation R is contained

in the (transitive) well-founded relation rf induced by a
ranking function f (i.e., s; s0 2 rf if f s > f s0 ) by
the argument that the transitive closure of R is contained in
a union of well-founded relations. I.e., we have

rf

vs.

R+

()

( )

T1 [


[ T n :

As outlined in Section 5, our proof rule is a starting

point for the development of automated verification methods for liveness properties of concurrent programs. This
development is not in the scope of this paper. In [16], we
have started one line of research based on predicate abstraction as used in the already existing tools for safety properties [1, 3, 8]; many different other ways are envisageable.
Another line of research are methods to reduce the size of
the transition invariants by encoding relevant specific kinds
of fairness, such as weak and strong fairness, in a more direct way than encoding them in Buchi automata.
Acknowledgments This work started with discussions
with Neil Jones and Chin Soon Lee during their visit in
Saarbrucken in September 2002. We thank Patrick Cousot,
Kedar Namjoshi and Amir Pnueli for their remarks on ranking functions and finite-state abstraction during VMCAI in
January 2003. We thank Amir Pnueli for comments and
suggestions, and for coining the term disjunctive wellfoundedness. We thank Bernd Finkbeiner and Konstantin
Korovin for comments and suggestions.

References
[1] T. Ball, R. Majumdar, T. Millstein, and S. Rajamani. Automatic predicate abstraction of C programs. In Proc. of
PLDI2001: Programming Language Design and Implementation, volume 36 of ACM SIGPLAN Notices, pages
203213. ACM Press, 2001.
[2] B. Blanchet, P. Cousot, R. Cousot, J. Feret, L. Mauborgne,
A. Mine, D. Monniaux, and X. Rival. A static analyzer
for large safety-critical software. In Proc. of PLDI2003:
Programming Language Design and Implementation, pages
196207. ACM Press, June 714 2003.
[3] S. Chaki, E. Clarke, A. Groce, S. Jha, and H. Veith. Modular verification of software components in C. In Proc. of
ICSE2003: Int. Conf. on Software Engineering, pages 385
395, 2003.
[4] P. Cousot and R. Cousot. Abstract interpretation: a unified
lattice model for static analysis of programs by construction
or approximation of fixpoints. In Proc. of POPL1977: Principles of Programming Languages, pages 238252. ACM
Press, 1977.
[5] P. Cousot and R. Cousot. Systematic design of program
analysis frameworks. In Proc. of POPL1979: Principles
of Programming Languages, pages 269282. ACM Press,
1979.

[6] Y. Fang, N. Piterman, A. Pnueli, and L. D. Zuck. Liveness

with invisible ranking. In Steffen and Levi [20], pages 223
238.
[7] S. Graf and H. Sadi. Construction of abstract state graphs
with PVS. In Proc. of CAV1997: Computer Aided Verification, volume 1254 of LNCS, pages 7283. Springer, 1997.
[8] T. Henzinger, R. Jhala, R. Majumdar, and G. Sutre. Lazy
Abstraction. In Proc. of POPL2002: Principles of Programming Languages, pages 5870. ACM Press, 2002.
[9] N. Klarlund. Progress measures and stack assertions for fair
termination. In Proc. of PODC1992: Principles of Distributed Computing, pages 229240. ACM Press, 1992.
[10] C. S. Lee, N. D. Jones, and A. M. Ben-Amram. The
size-change principle for program termination. In Proc. of
POPL2001: Principles of Programming Languages, volume 36, 3 of ACM SIGPLAN Notices, pages 8192. ACM
Press, 2001.
[11] D. Lehmann, A. Pnueli, and J. Stavi. Impartiality, justice and fairness: The ethics of concurrent termination. In
Proc. of ICALP1981: Int. Colloq. on Automata, Languages
and Programming, volume 115 of LNCS, pages 264277.
Springer, 1981.
[12] Z. Manna and A. Pnueli. Axiomatic approach to total correctness of programs. Acta Informatica, (3):243263, 1974.
[13] Z. Manna and A. Pnueli. Completing the temporal picture.
Theoretical Computer Science, 83(1):91130, 1991.
[14] Z. Manna and A. Pnueli. Temporal verification of reactive
systems: Safety. Springer, 1995.
[15] Z. Manna and A. Pnueli. Temporal verification of reactive
systems: Progress. Draft, 1996.
[16] A. Podelski and A. Rybalchenko. Transition predicate abstraction. Draft. Available from the authors.
[17] A. Podelski and A. Rybalchenko. A complete method for
the synthesis of linear ranking functions. In Steffen and Levi
[20], pages 239251.
[18] F. P. Ramsey. On a problem of formal logic. In Proc. London
Math. Soc., volume 30, pages 264285, 1930.
[19] P. A. Sistla, M. Y. Vardi, and P. Wolper. The complementation problem for Buchi automata with applications to temporal logic. Theoretical Computer Science, 49(23):217237,
1987.
[20] B. Steffen and G. Levi, editors. Proc. of VMCAI2004: Verification, Model Checking, and Abstract Interpretation, volume 2937 of LNCS. Springer, 2004.
[21] W. Thomas. Automata on infinite objects. In J. van
Leeuwen, editor, Handbook of Theoretical Computer Science, Volume B: Formal Models and Sematics, pages 133
192. Elsevier and MIT Press, 1990.
[22] A. Tiwari. Termination of linear programs. In Proc. of
CAV2004: Computer Aided Verification, 2004. To appear.
[23] M. Y. Vardi. Verification of concurrent programs the
automata-theoretic framework. Annals of Pure and Applied
Logic, 51:7998, 1991.
[24] M. Y. Vardi. Rank predicates vs. progress measures in
concurrent-program verification. Chicago Journal of Theoretical Computer Science, 1996.