# Unrolling¶

The first tool that Imandra makes available in our verification toolbox is recursive function unrolling, a form of bounded model checking backed by Satisfiability Modulo Theories (SMT) solving. This technique is completely automatic, and is in general not influenced by the presence of proved rules or enabled/disabled functions (except with used in conjunction with the [@@simp] attribute).

## Completeness¶

For many classes of problems, unrolling is "complete" in various senses. For example, for goals involving only non-recursive functions, algebraic datatypes and linear arithmetic, unrolling will always be able to prove a true goal or refute a false goal in a finite amount of time and space. Moreover, for an even wider class of problems involving recursive functions, datatypes and arithmetic, unrolling is "complete for counterexamples." This means that if a counterexample to a goal exists, unrolling will in principle always be able to synthesize one. This relies on Imandra's "fair" strategy for incrementally expanding the "interpretation call-graph" of a goal.

That said, part of the beauty of unrolling is that you don't need to understand it to apply it!

## Strategy¶

In general, it's recommended to apply unrolling to a goal before you attempt other methods such as the inductive waterfall ([@@auto]). It's amazing how often seemingly true goals are false due to subtle edge cases, and the ability of unrolling to construct concrete counterexamples can be an invaluable filter on your conjectures.

## Examples¶

To use unrolling, we simply use the verify or instance commands.

Let's use unrolling to find an instance of two lists of integers, whose sum equals the length of the two lists concatenated. We shall constrain the total length of the two lists to be positive (for fun, at least 10), so we obtain something more interesting than the simple x=[],y=[] solution!

In [1]:
instance
(fun x y -> List.length (x@y) > 10
&& List.fold_left (+) 0 (x@y) = List.length (x@y))

Out[1]:
- : Z.t list -> Z.t list -> bool = <fun>
module CX : sig val x : Z.t list val y : Z.t list end

Instance (after 29 steps, 0.035s):
let x : int list = []
let y : int list =
[590; 7719; (-16563); 8365; 41; 5920; 974; 1323; 2240; 9725; (-20323)]

Instance
proof attempt
ground_instances:29
definitions:0
inductions:0
search_time:
0.035s
details:
Expand
smt_stats:
 num checks: 59 arith assert lower: 119 arith tableau max rows: 36 arith tableau max columns: 64 arith pivots: 48 rlimit count: 30300 mk clause: 195 datatype occurs check: 231 mk bool var: 982 arith assert upper: 83 datatype splits: 48 decisions: 547 arith row summations: 389 propagations: 567 conflicts: 64 arith fixed eqs: 64 datatype accessor ax: 70 minimized lits: 3 arith conflicts: 22 arith num rows: 36 arith assert diseq: 39 datatype constructor ax: 225 num allocs: 5.91623e+06 final checks: 59 added eqs: 1788 del clause: 165 arith eq adapter: 123 memory: 15.77 max memory: 15.77
Expand
• start[0.035s]
let (_x_0 : int list) = List.append ( :var_0: ) ( :var_1: ) in
let (_x_1 : int) = List.length _x_0 in
(_x_1 > 10) && (List.fold_left ( + ) 0 _x_0 = _x_1)
• #### simplify

 into: let (_x_0 : int list) = List.append ( :var_0: ) ( :var_1: ) in let (_x_1 : int) = List.length _x_0 in not (_x_1 <= 10) && (List.fold_left ( + ) 0 _x_0 = _x_1) expansions: [] rewrite_steps: forward_chaining:
• unroll
 expr: (|List.fold_left_384/server| 0 (|List.append_375/server| x_1256/client y_1257/client)) expansions:
• unroll
 expr: (|List.length_380/server| (|List.append_375/server| x_1256/client y_1257/client)) expansions:
• unroll
 expr: (|List.append_375/server| x_1256/client y_1257/client) expansions:
• unroll
 expr: (|List.fold_left_384/server| (|get.::.0_373/server| (|List.append_375/server| x_1256/client y_1257… expansions:
• unroll
 expr: (|List.length_380/server| (|get.::.1_374/server| (|List.append_375/server| x_1256/client y_1257/cl… expansions:
• unroll
 expr: (let ((a!1 (+ (|get.::.0_373/server| (|List.append_375/server| x_1256/client y_1257/… expansions:
• unroll
 expr: (|List.length_380/server| (|get.::.1_374/server| (|get.::.1_374/server| (|List.append_37… expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (|List.append_375/server| (|get.::.1_374/server| x_1256/client) y_1257/client) expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (|List.append_375/server| (|get.::.1_374/server| (|get.::.1_374/server| x_1256/client)) y_1257/c… expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (|List.append_375/server| (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/server|… expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.0_373/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• unroll
 expr: (let ((a!1 (|get.::.1_374/server| (|get.::.1_374/server| (|get.::.1_374/… expansions:
• Sat (Some let x : int list = [] let y : int list = [(Z.of_nativeint (590n)); (Z.of_nativeint (7719n)); (Z.of_nativeint (-16563n)); (Z.of_nativeint (8365n)); (Z.of_nativeint (41n)); (Z.of_nativeint (5920n)); (Z.of_nativeint (974n)); (Z.of_nativeint (1323n)); (Z.of_nativeint (2240n)); (Z.of_nativeint (9725n)); (Z.of_nativeint (-20323n))] )

Imandra was able to find a solution instantly, and reflected it into our runtime in the CX module. Let's compute with it to better understand it:

In [2]:
List.length (CX.x@CX.y);;
List.fold_left (+) 0 (CX.x@CX.y);;

Out[2]:
- : Z.t = 11
- : Z.t = 11


## Unrolling limits¶

Unrolling works by creating a symbolic call graph for the negation of the goal we've asked Imandra to verify (or dually the positive version of the goal in the case of instance), and by iteratively extending this graph with incremental interpretations of recursive functions, up to a given unrolling bound, checking at each step for satisfiability.

The unrolling bound defaults to 100 and can be controlled globally using the #unroll <n> directive, or local to a given verify or instance call using the ~upto:<n> parameter.

If at any step of the unrolling process the negation of our original goal is satisfiable w.r.t. the interpreted approximations of the recursive functions, then Imandra has found a counterexample for our original goal, which has thus been refuted. In this case, Imandra will report Counterexample (after m steps) and install the found counterexample in the CX module.

If, on the other hand, Imandra is able to prove that there is no counterexample in a manner that is independent of the bound on the approximations, then our original goal is indeed a theorem valid for all possible inputs, and Imandra will report Theorem Proved. This can always be done for a wide class of theorems on catamorphisms (e.g., List.fold_right), for example.

Otherwise, if Imandra failed to find a counterexample or proof and stopped unrolling at the unrolling bound, we obtain a weaker result of the form Unknown (verified up to depth k), which effectively means: this may or may not be a theorem, but there are no counterexamples up to depth k. Such bounded results can nevertheless be very useful.

Let's try to understand in practice how the unrolling bound plays into unrolling. Consider this simple function that recursively decreases an integer until it reaches 0, then returns 1:

In [3]:
let rec f x =
if x <= 0 then
1
else
f (x - 1)

Out[3]:
val f : Z.t -> Z.t = <fun>

termination proof

### Termination proof

call f (x - 1) from f x
original:f x
sub:f (x - 1)
original ordinal:Ordinal.Int (_cnt x)
sub ordinal:Ordinal.Int (_cnt (x - 1))
path:[not (x <= 0)]
proof:
detailed proof
ground_instances:1
definitions:0
inductions:0
search_time:
0.010s
details:
Expand
smt_stats:
 num checks: 3 arith assert lower: 6 arith tableau max rows: 4 arith tableau max columns: 9 arith pivots: 2 rlimit count: 1099 mk clause: 5 datatype occurs check: 2 mk bool var: 17 arith assert upper: 3 decisions: 2 arith row summations: 3 propagations: 2 conflicts: 2 arith fixed eqs: 2 datatype accessor ax: 2 arith conflicts: 1 arith num rows: 4 num allocs: 1.30149e+07 final checks: 1 added eqs: 4 del clause: 5 arith eq adapter: 2 memory: 15.85 max memory: 15.85
Expand
• start[0.010s]
let (_x_0 : int) = if x >= 0 then x else 0 in
let (_x_1 : int) = x - 1 in
let (_x_2 : int) = if _x_1 >= 0 then _x_1 else 0 in
not (x <= 0) && ((_x_0 >= 0) && (_x_2 >= 0))
==> (_x_1 <= 0) || Ordinal.( << ) (Ordinal.Int _x_2) (Ordinal.Int _x_0)
• ###### simplify
 into: (x <= 0) || (x <= 1) || Ordinal.( << ) (Ordinal.Int (if x >= 1 then (-1) + x else 0)) (Ordinal.Int (if x >= 0 then x else 0)) expansions: [] rewrite_steps: forward_chaining:
• unroll
 expr: (|Ordinal.<<| (|Ordinal.Int_79/boot| (ite (>= x_654/server 1) (+ (- 1) x_654/server)… expansions:
• Unsat

Let's verify that for all x < 100, the function will return 1:

In [4]:
verify (fun x -> x < 100 ==> f x = 1)

Out[4]:
- : Z.t -> bool = <fun>

Proved
proof
ground_instances:100
definitions:0
inductions:0
search_time:
0.163s
details:
Expand
smt_stats:
 num checks: 201 arith assert lower: 99 arith tableau max rows: 100 arith tableau max columns: 202 rlimit count: 28985 mk clause: 300 mk bool var: 503 arith assert upper: 1 propagations: 297 conflicts: 101 arith fixed eqs: 2 arith num rows: 100 num allocs: 2.63216e+07 final checks: 100 added eqs: 300 del clause: 297 time: 0.002 memory: 18.04 max memory: 18.04
Expand
• start[0.163s] ( :var_0: ) < 100 ==> f ( :var_0: ) = 1
• #### simplify

 into: (100 <= ( :var_0: )) || (f ( :var_0: ) = 1) expansions: [] rewrite_steps: forward_chaining:
• unroll
 expr: (f_1259/client x_1261/client) expansions:
• unroll
 expr: (f_1259/client (+ (- 1) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 2) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 3) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 4) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 5) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 6) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 7) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 8) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 9) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 10) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 11) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 12) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 13) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 14) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 15) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 16) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 17) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 18) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 19) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 20) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 21) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 22) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 23) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 24) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 25) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 26) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 27) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 28) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 29) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 30) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 31) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 32) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 33) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 34) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 35) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 36) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 37) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 38) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 39) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 40) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 41) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 42) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 43) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 44) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 45) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 46) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 47) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 48) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 49) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 50) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 51) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 52) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 53) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 54) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 55) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 56) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 57) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 58) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 59) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 60) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 61) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 62) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 63) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 64) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 65) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 66) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 67) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 68) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 69) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 70) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 71) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 72) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 73) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 74) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 75) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 76) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 77) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 78) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 79) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 80) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 81) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 82) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 83) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 84) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 85) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 86) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 87) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 88) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 89) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 90) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 91) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 92) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 93) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 94) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 95) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 96) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 97) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 98) x_1261/client)) expansions:
• unroll
 expr: (f_1259/client (+ (- 99) x_1261/client)) expansions:
• Unsat

But watch what happens if we ask Imandra to verify this for x < 101, thus exceding the number of recursive calls that Imandra unrolls by default:

In [5]:
verify (fun x -> x < 101 ==> f x = 1)

Out[5]:
- : Z.t -> bool = <fun>

Unknown (Verified up to bound 100)
Expand
 expanded: f ((-46) + x)f ((-37) + x)f ((-31) + x)f ((-99) + x)f ((-34) + x)f ((-27) + x)f ((-80) + x)f ((-66) + x)f ((-89) + x)f ((-3) + x)f ((-63) + x)f ((-41) + x)f ((-13) + x)f ((-54) + x)f ((-92) + x)f ((-5) + x)f ((-79) + x)f ((-1) + x)f ((-97) + x)f ((-84) + x)f ((-93) + x)f ((-71) + x)f ((-94) + x)f ((-85) + x)f ((-60) + x)f ((-43) + x)f ((-78) + x)f ((-47) + x)f ((-51) + x)f ((-53) + x)f ((-8) + x)f ((-59) + x)f ((-30) + x)f ((-6) + x)f ((-15) + x)f ((-40) + x)f ((-29) + x)f ((-22) + x)f ((-10) + x)f ((-4) + x)f ((-75) + x)f ((-38) + x)f ((-24) + x)f xf ((-45) + x)f ((-19) + x)f ((-73) + x)f ((-83) + x)f ((-82) + x)f ((-48) + x)f ((-68) + x)f ((-67) + x)f ((-21) + x)f ((-98) + x)f ((-50) + x)f ((-14) + x)f ((-69) + x)f ((-81) + x)f ((-58) + x)f ((-17) + x)f ((-64) + x)f ((-44) + x)f ((-96) + x)f ((-32) + x)f ((-23) + x)f ((-2) + x)f ((-52) + x)f ((-28) + x)f ((-70) + x)f ((-49) + x)f ((-72) + x)f ((-74) + x)f ((-36) + x)f ((-87) + x)f ((-56) + x)f ((-55) + x)f ((-33) + x)f ((-11) + x)f ((-95) + x)f ((-20) + x)f ((-12) + x)f ((-88) + x)f ((-65) + x)f ((-39) + x)f ((-25) + x)f ((-91) + x)f ((-35) + x)f ((-7) + x)f ((-90) + x)f ((-77) + x)f ((-57) + x)f ((-26) + x)f ((-86) + x)f ((-62) + x)f ((-42) + x)f ((-9) + x)f ((-16) + x)f ((-76) + x)f ((-61) + x)f ((-18) + x) blocked: f ((-100) + x)
proof attempt
 ground_instances: 100 definitions: 0 inductions: 0 search_time: 0.160s
Expand
• start[0.160s] ( :var_0: ) < 101 ==> f ( :var_0: ) = 1
• #### simplify

 into: (101 <= ( :var_0: )) || (f ( :var_0: ) = 1) expansions: [] rewrite_steps: forward_chaining:
• unroll
 expr: (f_1259/client x_370/server) expansions:
• unroll
 expr: (f_1259/client (+ (- 1) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 2) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 3) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 4) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 5) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 6) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 7) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 8) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 9) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 10) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 11) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 12) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 13) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 14) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 15) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 16) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 17) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 18) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 19) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 20) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 21) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 22) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 23) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 24) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 25) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 26) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 27) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 28) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 29) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 30) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 31) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 32) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 33) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 34) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 35) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 36) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 37) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 38) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 39) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 40) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 41) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 42) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 43) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 44) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 45) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 46) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 47) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 48) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 49) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 50) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 51) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 52) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 53) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 54) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 55) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 56) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 57) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 58) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 59) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 60) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 61) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 62) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 63) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 64) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 65) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 66) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 67) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 68) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 69) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 70) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 71) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 72) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 73) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 74) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 75) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 76) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 77) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 78) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 79) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 80) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 81) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 82) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 83) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 84) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 85) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 86) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 87) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 88) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 89) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 90) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 91) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 92) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 93) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 94) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 95) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 96) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 97) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 98) x_370/server)) expansions:
• unroll
 expr: (f_1259/client (+ (- 99) x_370/server)) expansions:

As expected, since the recursion depth needed to prove this exceeds the unrolling bound we set, Imandra could only prove this property up to bound k. This goal is in fact a property that is better suited for verification by induction (indeed, you might try adding the [@@auto] annotation to the above goal to invoke the Imandra's inductive waterfall and prove it).

As a minor note, if we reach a local unrolling depth instead of hitting the global one, Imandra will be a bit more positive in its message, telling us that the conjecture has been proved up to the number of steps we've specified instead of a weaker "Unknown":

In [6]:
verify ~upto:100 (fun x -> x < 101 ==> f x = 1)

Out[6]:
- : Z.t -> bool = <fun>

Proved up to 100 steps

### Datatype bounds¶

Imandra offers an orthogonal, more advanced form of bounding for unrolling, using ~upto_bound:<n>. This bound works in a fundamentally different way than the "normal" unrolling limit: instead of acting as a limit on the number of recursive steps that Imandra unrolls, this limit instructs Imandra to synthesize a recursive depth function for the datatypes involved in the goal and to transform the goal such that it will include this bound check as part of the hypotheses.

This means that Imandra will be actually proving a bounded theorem involving the depth of datatypes.

In [7]:
verify ~upto_bound:5 (fun x -> List.rev (List.rev x) = x)

Out[7]:
- : 'a list -> bool = <fun>

Proved up to bound 5

When using unrolling with ~upto_bound, one should remember that the global unrolling limit still applies and may cause Imandra to abort solving before reaching the datatype bound.

This datatype bound limit can also be used with the blast strategy, while the unrolling limit can't, as blast doesn't work by recursive unrolling.