Termination of Linear Programs

Transcription

1 Termnaton of Lnear Programs Ashsh Twar SRI Internatonal, 333 Ravenswood Ave, Menlo Park, CA, U.S.A Abstract. We show that termnaton of a class of lnear loop programs s decdable. Lnear loop programs are dscrete-tme lnear systems wth a loop condton governng termnaton, that s, a whle loop wth lnear assgnments. We relate the termnaton of such a smple loop, on all ntal values, to the egenvectors correspondng to only the postve real egenvalues of the matrx defnng the loop assgnments. Ths characterzaton of termnaton s remnscent of the famous stablty theorems n control theory that characterze stablty n terms of egenvalues. 1 Introducton Dynamcal systems have been studed by both computer scentsts and control theorsts, but both the models and the propertes studed have been dfferent. However there s one class of models, called dscrete-tme lnear systems n the control world, where there s a consderable overlap. In computer scence, these are uncondtonal whle loops wth lnear assgnments to a set of nteger or ratonal varables; for example, whle (true) { x := x y; y := y }. The two communtes are nterested n dfferent questons: stablty and controllablty ssues n control theory aganst reachablty, nvarants, and termnaton ssues n computer scence. In recent years, computer scentsts have begun to apply the rch mathematcal knowledge that has been developed n systems theory for analyzng such systems for safety propertes, see for nstance [17, 12, 11]. One of the most basc results n the theory of lnear systems, both dscretetme and contnuous-tme, s the characterzaton of the stablty of lnear systems n terms of the egenvalues of the correspondng matrx. In ths paper, we are nterested n termnaton of smple whle loop programs, such as the one descrbed above, but wth nontrval loop guards. We present results that relate the termnaton of such lnear programs to egenvalues of the correspondng matrx, analogous to the stablty characterzaton n control theory. Our characterzaton also yelds decdablty of the termnaton problem for such programs. Although Research supported n part by the Natonal Scence Foundaton under grant CCR and CCR

2 lnear programs are smlar to dscrete-tme lnear systems, the termnaton characterzaton of lnear programs s more complex than, though remnscent of, the stablty characterzaton for both contnuous- and dscrete-tme lnear systems. Lnear loop programs, as studed n ths paper, are specalzed pecewse affne systems, whch themselves are specal knds of nonlnear systems. Whle several propertes, such as reachablty, stablty, and controllablty, are decdable for lnear systems [10, 16], they soon become undecdable even when a lttle nonlnearty s ntroduced [16]. In partcular, ths s also true for pecewse affne systems [3, 4], see also Secton 6. In ths context, t s nterestng to note that termnaton s decdable for lnear loop programs. Technques to prove termnaton of programs have attracted renewed attenton lately [7, 5, 6, 13]. The popular approach to prove termnaton s through the synthess of a rankng functon, a mappng from the state space to a well-founded doman, whose value monotoncally decreases as the system moves forward. Ths lne of research has focused mostly on generatng lnear rankng functons some effectve heurstcs have been proposed [5, 6] and recently a complete method was presented n [13] for a model motvated by [14]. Ths paper nvestgates termnaton at a more basc theoretcal level. The man result establshes the decdablty of the termnaton problem for programs of the form (n matrx notaton) whle (Bx > b) { x := Ax + c } where Bx > b represents a conjuncton of lnear nequaltes over the state varables x and x := Ax+c represents the lnear assgnments to each of the varables. The varables are nterpreted over the reals R and hence the state space s R n. Ths class of programs s smpler than the ones consdered n [5, 6, 13]. Although a program may not be presented n ths form, termnaton questons can often be reduced to ths basc form after sutable smplfcatons and transformatons. We approach the termnaton ssue of the above program as follows. We frst consder the homogeneous verson, whle (Bx > 0) { x := Ax }, and note that the condton Bx > 0 defnes a regon smaller than a half space of R n. Now f a state x = c s mapped by A (n one or more teratons) to somethng on the other sde of the half space, then the program wll termnate on ths state (snce the loop condton wll become false). In partcular, ths means that the program always termnates on states specfed by egenvectors c correspondng to negatve real egenvalue and complex egenvalues. The former ones are mapped by A to ther negatve mage, whle the latter ones are rotated gradually untl they reach the other half space (where Bx > 0 s false). Thus, our frst result s that, for purposes of termnaton, the egenspace correspondng to only the postve real egenvalues of A s relevant (Secton 2 and Secton 3). In the case when all egenvalues are postve, the egenvectors correspondng to larger egenvalues domnate the behavor of the program, that s, after suffcently many teratons, the values of the state varables wll be governed almost solely by the nfluence of the largest egenvalue. Based on ths, we can guess a wtness to nontermnaton and test f the guess s correct by checkng satsfabl-

3 ty of a set of constrants (Secton 4). Fnally, we show that the nonhomogeneous case can be reduced to the homogeneous case (Secton 5). 1.1 Notaton We use standard mathematcal notaton for representng vectors and matrces. We follow the conventon that upper case letters I, J,..., denote nteger constants and lower case letters, j,... denote ndces rangng over ntegers. In partcular, a (N 1) column matrx s called a vector, and t s denoted by c, d whenever the components of the vector are known constants; and by x, y whenever the components of the vector are all varables. A (N N)-matrx wth constant entres a j at the (, j)-poston s denoted by A = (a j ). A dagonal matrx A = (a j ) = dag(λ 1,..., λ N ) has a = λ and a j = 0 otherwse. The transpose of a matrx A = (a j ) s a matrx B = (b j ) such that b j = a j, and t s denoted by A T. Note that the transpose of a column vector c s a row vector c T. Usng juxtaposton for matrx multplcaton, we note that c T d denotes the nner product, c d, of the vectors c and d. We wll also denote matrces by specfyng the submatrces nsde t. So, for nstance, dag(j 1,..., J K ) would denote a matrx whch has matrces J 1,..., J K on ts dagonal and 0 elsewhere. If A s a (N N)-matrx and c s a vector such that Ac = λc, then c s called an egenvector of A correspondng to the egenvalue λ. The effect of repeated lnear assgnments (x := Ax) becomes much more explct when we do a change of varables and let the new varables y be the egenvectors of A. In partcular, we get transformed assgnments of the form y := λy. If there are N lnearly ndependent egenvectors, then A s sad to be dagonalzable and the assgnments on the new varables wll be of the form y := dag(λ 1,..., λ N )y. But ths s not possble always. However, nstead of a dagonal matrx, we can always get an almost dagonal, the so-called Jordan form, matrx [9]. 2 The Homogeneous Case The presentaton n ths paper s ncremental gong from syntactcally smple to more complex programs. In ths secton, we consder lnear programs of the followng form: P1: whle (c T x > 0) { x := Ax }. The varables n x are nterpreted over the set R of reals. The assgnment x := Ax s nterpreted as beng done smultaneously and not n any sequental order. A lst of sequental assgnments can be modfed and presented n the form x := Ax, see Example 1. We say that the Program P1 termnates f t termnates on all ntal values n R for the varables n x. Theorem 1. If the lnear loop program P1, defned by an (N N)-matrx A and a nonzero N 1-vector c, s nontermnatng then there exsts a real egenvector v of A, correspondng to postve egenvalue, such that c T v 0.

4 Proof. (Sketch) Suppose the lnear loop program s nontermnatng. Defne the set NT of all ponts on whch the program does not termnate. NT = {x R N : c T x > 0, c T Ax > 0, c T A 2 x > 0,..., c T A x > 0,...}. By assumpton, NT. The set NT s also A-nvarant, that s, f v NT, then Av NT. Note that NT s an affne subspace of R N, that s, t s closed under addton and scalar multplcaton by postve reals. Hence, t s convex 1. Defne T = R N NT to be the set of all ponts where the program termnates. Defne the boundary, NT, of NT and T as the set of all v such that (for all ɛ) there exsts a pont n the ɛ-neghborhood of v that belongs to T and another that belongs to NT. Let NT be the completon of NT, that s, NT = NT NT. Snce NT s A-nvarant, t means that A maps NT nto NT. By contnuty we have that A also maps NT nto NT. Now, NT s convex, and f we dentfy ponts x and y, wrtten as x y, that are nonzero scalar multples of each other (x = λy), then the resultng set (NT / ) s closed and bounded (as a subset of R n 1 ). By Brouwer s fxed pont theorem [15], t follows that there s an egenvector v (wth postve egenvalue) of A n NT. For all ponts u NT, we know c T u > 0. By contnuty, for all ponts u NT, we have c T u 0. If, n fact, t s the case that c T v > 0, then v s a wtness to nontermnaton of the loop. Thus, Theorem 1 can be used to get the followng condtonal characterzaton of nontermnaton. Corollary 1. If there s no real egenvector v of A such that c T v = 0, then the lnear loop program defned by A and c s nontermnatng ff there exsts an egenvector v on whch the loop s nontermnatng. Example 1. The effect of two sequental assgnments x := x y; y := x + 2y s captured by the smultaneous assgnment ( ) ( ) ( ) x 1 1 x = y 1 1 y The matrx A has no real egenvalues. Let c 0 be any (nonzero) vector. The condton of Corollary 1 s trvally satsfed. And snce there s no real egenvalue, we mmedately conclude that the lnear loop program specfed by A and (any nonzero vector) c s termnatng. Example 2. Let θ be a fxed number. Consder the followng program: whle (z y > 0) { x := Ax }, where A = [cos θ, sn θ, 0; sn θ, cos θ, 0; 0, 0, 1]. Thus, A smply rotates the 3-D space by an angle θ about the z-axs. The set of ponts where ths program s nontermnatng s NT = {(x, y, z) : z > x sn φ + y cos φ : φ = nθ, n = 0, 1, 2,...}. For θ that s not a factor of π, NT = {(x, y, z) : z 2 = x 2 + y 2 } (elmnate φ from above). Note that there s the egenvector (0, 0, 1) n NT correspondng to postve egenvalue 1. As another example of the boundary, note that f θ = π/4, then NT contans 8 hyperplanes, each one s mapped by A to the next adjacent one. 1 A set NT s convex f αu + (1 α)v NT whenever u, v NT and 0 α 1.

5 2.1 Generalzng the Loop Condton The loop condton can be generalzed to allow for a conjuncton of multple lnear nequaltes. We contnue to assume that all lnear nequaltes and lnear assgnments consst only of homogeneous expressons. Let B be a (M N)-matrx (wth ratonal entres) and A be a (N N)-matrx. We consder programs of the followng form: P2: whle (Bx > 0) { x := Ax }. Theorem 1 and Corollary 1 mmedately generalze to programs of the form P2. Theorem 2. If Program P2, specfed by matrces A and B, s nontermnatng, then there s a real egenvector v of A, correspondng to a postve real egenvalue, such that Bv 0. Corollary 2. Assume that for every real egenvector v of A, correspondng to a postve egenvalue, whenever Bv 0, then t s actually the case that Bv > 0. Then, the Program P2, defned by A and B, s nontermnatng ff there exsts an egenvector v on whch the loop s nontermnatng. Example 3. Consder the program: whle (x y > 0) { x := x + y; y := y }. The matrx A = [ 1, 1; 0, 1] has two egenvalues, 1 and 1. The egenvector correspondng to the egenvalue 1 s [1; 2] and we note that Hence, t follows from Corollary 2 that the above loop s termnatng. 2.2 Two Varable Case Theorem 1 and Theorem 2 show that nontermnatng lnear loops almost always have a wtness that s an egenvector of the matrx A. The only problematc case s when the egenvector s on the boundary, NT, so that t s not clear f ndeed there are ponts where the program s nontermnatng. However, n the 2-dmensonal case, that s, when there are only two varables, the regon NT wll be a sector and t can be specfed by ts two boundary rays. Thus, f NT, then there exsts an A-nvarant sector, gven by a T x 0 b T x 0 x 0 where {>, }, on whch the loop condton always evaluates to true. Ths can be expressed as a quantfed formula over the theory of (lnear) arthmetc nterpreted over the reals, whch s a decdable theory. Theorem 3. A two varable lnear loop program, whle (Bx > 0) { x := Ax }, s non-termnatng ff the followng sentence n true n the theory of reals a, b.[ x.φ(a, b, x) x.(φ(a, b, x) (Bx > 0 φ(a, b, Ax)))] where φ(a, b, x) denotes a T x 0 b T x 0 x 0 and {>, }. Ths theorem gves a decson procedure for termnaton of two varable loops snce the formula n Theorem 3 can be tested for satsfablty. Theorem 3 cannot be generalzed to hgher dmensons snce there may not be fntely many hyperplane boundares, as Example 2 llustrates.

6 3 Reducng the Homogeneous Case Corollary 2 falls short of yeldng decdablty of termnaton of homogeneous lnear programs. But t hnts that the real egenvalues and the correspondng egenvectors are relevant for termnaton characterstcs of such programs. In ths secton, we wll formally show that the nonpostve egenvalues (and the correspondng egenspace) can be gnored and the termnaton problem can be reduced to only the egenspace correspondng to postve real egenvalues of the matrx A. We frst note that the Program P2 from Secton 2.1 can be transformed by an nvertble (bjectve) transformaton, preservng ts termnaton propertes. Proposton 1. Let P be an nvertble lnear transformaton. The program P2: whle (Bx > 0) { x := Ax } s termnatng ff the program P3: whle (BP y > 0) { y := P 1 AP y } s termnatng. Proof. If Program P2 does not termnate on nput x := c, then Program P3 wll not termnate on nput y := P 1 c. Conversely, f Program P3 does not termnate on nput y := d, then Program P2 wll not termnate on nput x := P d. Thus, Proposton 1 s just about dong a change of varables. It s a well known result n lnear algebra [9, 1] that usng a sutable change of varables, a real matrx A can be transformed nto the form, dag(j 1, J 2,..., J K ), called the real Jordan form, where each J s ether of the two forms: λ D I λ D I I λ D ( α β where λ R s a real whereas D s a (2 2)-matrx of the form β α ). For unformty, the second Jordan block wll denote both the forms. When t denotes the frst form, then D and I are both (1 1)-matrces and we wll say D R and treat t as a real. We defne D = λ n the frst case and D = α 2 + β2 n the second case. Let P be the real (N N)-matrx such that P 1 AP = dag(j 1,..., J K ). Thus, Program P2, specfed by matrces A and B, P2: whle (Bx > 0) { x := Ax }, can be transformed nto the new Program P3, P3: whle (BP y > 0) { y := dag(j 1,..., J K )y }. Proposton 1 means that we can focus on termnaton of Program P3. Partton the varables n y nto y 1, y 2,..., y K and rewrte the Program P3 as P3: whle (B 1 y 1 + +B K y K > 0) { y 1 := J 1 y 1 ;... ; y K := J K y K }, where B s are obtaned by parttonng the matrx BP. Let S = {1, 2,..., K} be the set of ndces. Defne the set S + = { S : D R, D > 0}. The followng

7 techncal lemma shows that we can gnore the state space correspondng to negatve and complex egenvalues, whle stll preservng the termnaton behavor of the Program P3. Lemma 1. The Program P3, as defned above, s termnatng ff the program P4: whle ( j S + B j y j > 0) { y j := J j y j ; for j S + } s termnatng. Proof. (Sketch) If the Program P4 does not termnate on nput y j := c j, where j S +, then the Program P3 does not termnate on nput y j := c j for j S + and y j := 0 for j S +. For the converse, assume that Program P3 does not termnate on nput y j := c j, j S. Consder the m-th loop condton, j S B jmy j > 0, where B jm denotes the m-th row of B j. Assume that y j has N j components, y j 0, y j 1,..., y j, Nj 1 where each y j k s ether a 2 1 or a 1 1 matrx (dependng on whether D j s 2 2 or 1 1.) The value of y j, at the -th teraton, s gven by y j () =. D j D 1 j ( 2 ) D 2 j... 0 D j D 1 j... ( ) ( N j 1 ) N j Dj D 1 j Dj D (Nj 1) j D (Nj 2) j c j (1) Defne f m () to be the value of the expresson of the m-th condton at - th teraton, that s, f m () = j S B jmy j (). Let J be an ndex such that N J = max{n j : D j = max{ D ( : ) S}}. We clam, wthout further proof, N that for large, the term D J +1 N J 1 J y J N J 1(0) wll domnate the value of f m (). If J S +, then the sgn of ths domnatng term, and consequently the sgn of f m (), wll fluctuate (between postve and negatve) as ncreases. By assumpton, ths does not happen. Hence, J S + and hence, for a large enough, say I m, we have j S + B jm y j () > 0. For each condton m, we get an ndex I m. Set I to be the maxmum of all I m s. For I, t s the case that j S + B jm y j () > 0 for all m. Defne new ntal condtons for Program P3 and Program P4 as follows: y (0) := y (I) for all S + and y (0) := 0 for all S +. Program P3 does not termnate on ths new ntal condtons. Hence, Program P4 also does not termnate on t. Ths completes the proof. Example 4. We borrow the followng example from [13], Q1: whle (x > 0 y > 0) { x := 2x + 10y; y := y }. The matrx A has two egenvalues 2 and 1, and t s clearly dagonalzable. In fact, consder the transformaton matrx P, ( ) ( ) ( ) A = P = P AP = BP = P 0 1

8 Transformng Program Q1 by P, we get Q2: whle (x x 2 > 0 3x 2 > 0) { x 1 := 2x 1 ; x 2 := x 2 }. Lemma 1 says that the termnaton of Program Q1 and Program Q2 can be decded by just consderng the termnaton characterstcs of: Q3: whle (10x 2 > 0 3x 2 > 0) { x 2 := x 2 }. In fact, the pont x 1 = 0, x 2 = 1 makes Program Q3 nontermnatng, and correspondngly, the pont x = 10, y = 3 makes Program Q1 nontermnatng. 4 All Postve Egenvalues Lemma 1 reduces the termnaton of Program P2 of Secton 2.1 to testng termnaton of Program P4, whch s gven as: P4: whle (B 1 y B r y r > 0) { y 1 := J 1 y 1 ;... ; y r := J r y r } where each of the Jordan blocks J corresponds to a postve real egenvalue λ. The value of varables n y j, after the -th teraton, are gven by Equaton 1, where D j = λ j s a postve real now. As before, assume that the k-th loop condton s wrtten as B 1k y 1 + B 2k y B rk y r > 0. We can express the requrement that the k-th loop condton be true after the -th teraton as B 1k y 1 () + B 2k y 2 () + + B rk y r () > 0. Expand ths usng Equaton 1 and let C klj denote the result of collectng all coeffcents of the term ( ) (j 1) j 1 λ l. Now, the k-th loop condton after -th teraton can be wrtten as ( ) λ 1C k11 y(0) + λ 1 1 C k12 y(0) + + λ (n1 1) n C k1n1 y(0) + + ( ) λ rc kr1 y(0) + λ 1 r C kr2 y(0) + + λ (nr 1) n r 1 r C krnr y(0) > 0, whch we wll denote by Cond k (y()). If two egenvalues λ l and λ m are the same, then we assume that the correspondng coeffcents (of ( ) j λ j l and ( ) j λ j m ) have been merged n the above expresson, so that wthout loss of generalty, we can assume that each λ l s dstnct and such that 0 < λ 1 < λ 2 < < λ r. Defne the set Ind = {11, 12,..., 1n 1, 21, 22,..., 2n 2,..., r1, r2,..., rn r } and an orderng on ths set so that elements on the rght are greater-than elements on the left n the above set. The dea here s that nonzero terms n Cond k that have larger ndces grow faster asymptotcally (as ncreases). We decde the termnaton of Program P4 usng the followng three step nondetermnstc algorthm: (1) For each of the m loop condtons, we guess an element from the set Ind. Formally, we guess a mappng ndex : {1, 2,..., m} Ind. Intutvely f y(0) s a wtness to nontermnaton, then ndex(k) s chosen so that C k,ndex(k) y(0) > 0 (and ths s the domnant summand) and C k,nd y(0) = 0 for all nd ndex(k).

9 (2) Buld a set of lnear equalty and nequalty constrants as follows: from the k-th loop condton, generate the followng constrants, C k,nd z = 0, C k,nd z > 0, Cond k (z()) > 0, f nd ndex(k) f nd = ndex(k) f 0 Π 2 (ndex(k)) where Π 1 and Π 2 denote the projecton onto the frst and second components respectvely. Note that the unknowns are just z (the ntal values for y). (3) Return nontermnatng f the new set of lnear nequaltes and lnear equatons s satsfable (n R n ), return termnatng otherwse. We state the correctness of the algorthm, wthout proof, n Lemma 2 and follow t up by a summary of the complete decson procedure n the proof of Theorem 4. Lemma 2. The nondetermnstc procedure returns nontermnatng ff the Program P4 P4: whle (B 1 y B r y r > 0) { y 1 := J 1 y 1 ;... ; y r := J r y r } s nontermnatng. Theorem 4. The termnaton of a homogeneous lnear program of the form P2: whle (Bx > 0) { x := Ax } s decdable. Proof. We decde termnaton of the Program P2 as follows: If A has no postve real egenvalues, then return termnatng (Corollary 2). If every real egenvector v correspondng to a postve real egenvalue of A satsfes Bv < 0, then return termnatng (Theorem 2). If there s a real egenvector v correspondng to a postve real egenvalue of A such that Bv > 0, then return nontermnatng (Corollary 2). If none of the above cases s true, then clearly A has postve real egenvalues. Compute the Jordan blocks and the generalzed egenvectors only correspondng to the postve real egenvalues of A. Generate a transformaton P by extendng the computed set of generalzed egenvectors wth any set of vectors n space orthogonal to that of the generated egenvectors. Transform Program P2 by P as n Proposton 1. It s an easy exercse 2 to note that we can apply Lemma 1 and reduce the termnaton problem to that for Program P4 of Lemma 1. Fnally, we decde termnaton of Program P4 usng the nondetermnstc procedure of Secton 4 (Lemma 2). Example 5. Consder the program Q4: whle (x > 0 y > 0) { x := x - y; y := y } Ths contans only two varables, and hence we can use Theorem 3, but for purposes of llustraton, we apply Theorem 4 here. The matrx A = [1, 1; 0, 1] has a postve real egenvalue 1. The vector gven by x = 1, y = 0 s an egenvector correspondng to ths egenvalue. Hence, we cannot apply Theorem 2 or 2 We cannot apply Lemma 1 drectly snce we dd not compute the real Jordan form of the full matrx A, but only of a part of t. But we do not need to compute the full real Jordan form to get Program P4.

10 Corollary 2. The real Jordan form of A s A = [1, 1; 0, 1] and the correspondng transformaton matrx s P = [ 1, 0; 0, 1]. The new program s: Q5: whle ( x > 0 y > 0) { x := x + y; y := y } The general solutons are gven by x() = 1 x(0) + y(0) = x(0) + y(0) y() = 1 y(0) = y(0) The condton Cond 1 correspondng to the loop condton x > 0 s x(0) y(0) > 0 and smlarly Cond 2 s y(0) > 0. There s no choce for ndex(2), but there s a choce for ndex(1): t can be ether 11 or 12. In the frst case, we generate the followng constrants from the frst loop condton: { y = 0, x > 0, x 0y > 0}. From the second loop condton, we only generate the constrant y > 0. Together, we detect an nconsstency. In the second case, we generate the followng constrants from the frst loop condton: { y > 0, x 0y > 0, x 1y > 0}. Agan, from the second loop condton, we generate the constrant y > 0, whch s nconsstent wth the above constrants. Hence, we conclude that the Program Q4 s termnatng. 5 Nonhomogeneous Programs Now we consder lnear programs of the followng form: P5: whle (Bx > b) { x := Ax + c } We can homogenze ths program and add an addtonal constrant on the homogenzng varable to get the followng P6: whle (Bx bz > 0 z > 0) { x := Ax + cz; z := z } where z s a new varable. The homogeneous program reduces to the orgnal program f we substtute 1 for z. Proposton 2. The nonhomogeneous Program P5 does not termnate ff the homogeneous Program P6 does not termnate. Proof. If Program P5 does not termnate, say on nput x = d, = 1, 2,..., n, then Program P6 does not termnate on nput z = 1, x = d, = 1, 2,..., n. For the converse, assume that Program P6 does not termnate on nput x 0 = d 0, x = d, = 1, 2,..., n. If d 0 > 0, then we can scale ths nput to get a new state x 0 = 1, x = d /d 0, = 1, 2,..., n. The behavor of Program P6 wll be the same on the scaled nput, and hence Program P5 would not termnate on ths nput ether. Thus we can reduce the decdablty of termnaton of nonhomogeneous programs to that of homogeneous programs. Together wth Theorem 4, we get the followng result. Theorem 5. The termnaton of a nonhomogeneous lnear program of the form P5: whle (Bx > b) { x := Ax + c } s decdable.

11 Remarks on Computablty and Complexty. The three step nondetermnstc algorthm descrbed n Secton 4 s clearly n class NP. However, the nondetermnsm can be elmnated by a careful enumeraton of choces. The dea s that we always start wth the guess ndex(k) = rn r for each loop condton k and f the resultng formula s unsatsfable, then we readjust the guess and gradually set ndex(k) to smaller elements n the set Ind. We do not formalze ths detal n ths paper because t s not central to the decdablty result. The reducton descrbed n Secton 3 requres computaton of a real egenvector. Computng wth real numbers s not easy, but f the nput matrces are over the ratonals, then all the real numbers that arse n the computaton are algebrac. Computng wth algebrac numbers s theoretcally possble, but t can be expensve (snce the theory of real-closed felds has a double exponental lower bound). But ths should not be a serous problem for two reasons. Frst, for most problems arsng n practce, we expect the egenvalues to be ratonal, and computaton wth ratonals can be done very effcently. Second, even f the egenvalues are rratonal, the dmenson of the problem s unlkely to be so hgh that computng wth algebrac numbers wll become a bottleneck. However, these ssues have to be expermented wth and that s left as future work. We beleve that the Jordan form computaton step n the decson procedure outlned n ths paper can be elmnated n most cases n practce. Ths can be acheved by perturbng the system by a lttle (for example, replacng condtons c > 0 by c > ɛ for some small constant ɛ) and studyng the termnaton property of the perturned system. We conjecture that Corollary 2 can be strengthened for the case when the homogenzaton varable volates the condton. Ths would allow us to avod the Jordan decomposton step n many cases. The decson procedure for termnaton of lnear loop programs can be adapted to the case when the varables are nterpreted over the ntegers and ratonals. If there are a lot of wtnesses to nontermnaton, then there wll be a ratonal wtness too, snce the ratonals are dense n reals. If not, then we can detect ths case usng a specalzed wrapper. Ths leads us to conjecture the followng. Conjecture 1. The termnaton of Program P5, as defned n Theorem 5, when all varables are nterpreted over the set of ntegers, s decdable. 6 The General Case We consder the termnaton of a set of nondetermnstc lnear condtonal assgnments, wrtten n a guarded command language [8] as, P7 : [ B 1 x > b 1 x := A 1 x + c 1 [] B 2 x > b 2 x := A 2 x + c 2... [] B k x > b k x := A k x + c k ] whch we wll wrte n shorthand as P7: [] k =1 (B x > b x := A x + c )

12 Counter machnes can be naturally encoded as Program P7. We ntroduce one varable x for each counter and one varable x for the fnte control (program counter). Encodngs of condtonal branches, counter ncrements, and counter decrements are straghtforward. The problem of decdng f a counter machne halts on all nputs s undecdable, see [3], where ths problem s called the mortalty problem. Therefore, the problem of decdng f a program of the above form halts on all nteger nputs s also undecdable. Note however that for the restrcted forms of assgnments (x := x ± 1) generated by the translaton, termnaton over reals s equvalent to termnaton over ntegers. Thus, we conclude that the termnaton problem for Program P7 s undecdable. Theorem 5 can be used to get an ncomplete test for nontermnaton for Program P7 If Program P7 s termnatng, then for each, the program whle (B x > b ) { x := A x + c } s termnatng. The converse s also true under addtonal commutaton propertes [2] amongst the k bnary relatons, say R 1,..., R k, nduced by the k guarded commands. In partcular, one mmedate consequence of a result n [2] s the followng. Proposton 3. Let Program P7 and relatons R 1,..., R k be as defned above. Let R = R 1 R k. Assume that whenever < j, t s the case that R j R R R. Then, the Program P7 termnates f and only f each R do. Note that the condton above s dependent on the order R 1,..., R k, whch we are free to choose. Testng for the quas-commutaton property [2] R j R R R s possble f we restrct the search to R j R R R l, for some fnte l. In the specal case when the -th guarded command cannot be enabled after executon of the j-th guarded command (that s, R j R = ), then the above ncluson s trvally true. In the case when the quas-commutaton property cannot be establshed, the test for nontermnaton can be made more complete by ncludng new guarded transtons obtaned by composng two or more of the orgnal guarded commands. It s easy to see that the composton results n a lnear guarded command. These new guarded commands can be tested for nontermnaton usng Theorem 5 agan. 7 Future Work and Concluson We have presented decdablty results for termnaton of smple loop programs. The loops are consdered termnatng f they termnate on all ntal real values of the varables. The decson procedure s based on the observaton that only the egenvectors (and the generalzed egenspace) correspondng to postve real egenvalues of the assgnment matrx are relevant for termnaton. The generalzaton to multple lnear nondetermnstc guarded commands makes the problem undecdable. Under certan restrctve commutaton condtons, termnaton of multple lnear guarded commands can be reduced to termnaton of each ndvdual smple lnear loops.

13 We beleve that results and tools from systems theory, such as Lyapunov functons and control Lyapunov functons, can yeld powerful tools for analyzng software, especally for termnaton analyss and nvarant generaton. Ths avenue should be explored further n the future. Acknowledgments. We wsh to thank Andreas Podelsk, Andrey Rybalchenko, and ther colleagues at MPI for motvaton and ntal dscussons and the revewers for nsghtful comments and references. References [1] D. K. Arrowsmth and C. M. Place. An ntroducton to dynamcal systems. Cambrdge, [2] L. Bachmar and N. Dershowtz. Commutaton, transformaton, and termnaton. In J. H. Sekmann, edtor, Proc. 8th Int. Conf. on Automated Deducton, volume 230 of LNCS, pages 5 20, Berln, Sprnger-Verlag. [3] V. D. Blondel, O. Bournez, P. Koran, C. H. Papadmtrou, and J. N. Tstskls. Decdng stablty and mortalty of pecewse affne dynamcal system. Theoretcal Computer Scence, 255(1 2): , [4] V. D. Blondel and J. N. Tstskls. A survey of computatonal complexty results n systems and control. Automatca, 36: , [5] M. Colon and H. Spma. Synthess of lnear rankng functons. In T. Margara and W. Y, edtors, Tools and Algorthms for the Constructon and Analyss of Systems, 7th Intl. Conf. TACAS 2001, volume 2031 of LNCS, pages Sprnger, [6] M. Colon and H. Spma. Practcal methods for provng program termnaton. In E. Brnksma and K. G. Larsen, edtors, Computer Aded Verfcaton, 14th Intl. Conf. CAV 2002, volume 2034 of LNCS, pages Sprnger, [7] D. Dams, R. Gerth, and O. Grumberg. A heurstc for the automatc generaton of rankng functon. In Workshop on Advances n Verfcaton WAVe 2000, pages 1 8, [8] E. W. Djkstra. A Dscplne of Programmng. Prentce Hall PTR, [9] K. Hoffman and R. Kunze. Lnear Algebra. Prentce-Hall, second edton, [10] R. Kannan and R. J. Lpton. Polynomal-tme algorthm for the orbt problem. J. of the ACM, 33(4): , [11] G. Lafferrere, G. J. Pappas, and S. Yovne. Symbolc reachablty computatons for famles of lnear vector felds. J. Symbolc Computaton, 32(3): , [12] J. Musset and M. Rusnowtch. Computng metatranstons for lnear transton systems. In 12th Intl. FME symposum, [13] A. Podelsk and A. Rybalchenko. A complete method for synthess of lnear rankng functons. In VMCAI 2004: Verfcaton, Model Checkng, and Abstract Interpretaton, LNCS. Sprnger-Verlag, [14] A. Podelsk and A. Rybalchenko. Transton nvarants. In Logc n Computer Scence, LICS. IEEE Computer Socety, [15] D. R. Smart. Fxed Pont Theorems. Cambrdge Unversty Press, [16] E. Sontag. From lnear to nonlnear: Some complexty comparsons. In 34th IEEE Conf. on Decson and Control, CDC, [17] A. Twar. Approxmate reachablty for lnear systems. In O. Maler and A. Pnuel, edtors, Hybrd Systems: Computaton and Control HSCC, volume 2623 of LNCS, pages Sprnger, Aprl 2003.