Compositional Inductive Invariant Inference via Assume-Guarantee Reasoning

2025-09-07

AI Summary

Inferring global inductive invariants for complex systems remains challenging due to state-space explosion and lack of modularity. This paper proposes a compositional invariant inference method based on assume-guarantee reasoning: the system is decomposed into components, each assigned a local contract specifying assumptions and guarantees; local invariants satisfying these contracts are then inferred independently, thereby avoiding reasoning over the full global transition relation. Key technical contributions include local transition relation closure analysis and contract-driven inductive inference. Compared to monolithic invariant inference, our approach substantially reduces computational complexity and yields modular, human-interpretable invariant specifications. We evaluate the method on two case studies, demonstrating both efficiency gains—accelerating verification—and enhanced insight—explicitly revealing responsibility boundaries among components. The results establish a scalable, understandable paradigm for safety verification of complex systems.

Technology Category

• Knowledge Representation and Reasoning: Computational Complexity of Reasoning
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Cognitive Modeling & Cognitive Systems: Conceptual Inference and Reasoning

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Economics, Online Markets and Human Computation: Incentives in network design for Web infrastructures and ecosystems

Abstract

A common technique for verifying the safety of complex systems is the inductive invariant method. Inductive invariants are inductive formulas that overapproximate the reachable states of a system and imply a desired safety property. However, inductive invariants are notoriously complex, which makes inductive invariant inference a challenging problem. In this work, we observe that inductive invariant formulas are complex primarily because they must be closed over the transition relation of an entire system. Therefore, we propose a new approach in which we decompose a system into components, assign an assume-guarantee contract to each component, and prove that each component fulfills its contract by inferring a local inductive invariant. The key advantage of local inductive invariant inference is that the local invariant need only be closed under the transition relation for the component, which is simpler than the transition relation for the entire system. Once local invariant inference is complete, system-wide safety follows by construction because the conjunction of all local invariants becomes an inductive invariant for the entire system. We apply our compositional inductive invariant inference technique to two case studies, in which we provide evidence that our framework can infer invariants more efficiently than the global technique. Our case studies also show that local inductive invariants provide modular insights about a specification that are not offered by global invariants.

Problem

• Decomposing systems into components for simpler invariant inference
• Inferring local inductive invariants via assume-guarantee contracts
• Proving system-wide safety through compositional verification approach

Innovation

• Decompose system into components with contracts
• Infer local inductive invariants per component
• Conjoin local invariants for system-wide safety