Termination proofs for systems code

Abstract

Program termination is central to the process of ensuring that systems code can always react. We describe a new program termination prover that performs a path-sensitive and context-sensitive program analysis and provides capacity for large program fragments (i.e. more than 20,000 lines of code) together with support for programming language features such as arbitrarily nested loops, pointers, function-pointers, side-effects, etc. We also present experimental results on device driver dispatch routines from the Windows operating system. The most distinguishing aspect of our tool is how it shifts the balance between the two tasks of constructing and respectively checking the termination argument. Checking becomes the hard step. In this paper we show how we solve the corresponding challenge of checking with binary reachability analysis.

Model Checking Büchi Pushdown Systems

“…However, one challenge to this approach is to support the efficient abstraction/refinement, since most loops need to be fully unrolled in liveness property checking. There are two options for future work: (1) implement an aggressive abstraction/refinement algorithm for loop computation in tools such as SLAM [7] (may be insufficient when a ranking function is required); or (2) utilize termination checking tools such as Terminator [9] which analyzes loops by checking termination arguments (i.e., ranking functions).…”

“…Cook, et al [9] presented an approach to termination checking of system code through proofs. The approach has two phases: first constructing the termination argument which is a set of ranking functions and then proving that one of the ranking functions decreases between the pre-and post-states of all finite transition sequences in the program.…”

Proving Termination of Integer Term Rewriting

“…Nevertheless, we ignore these symbols when building DPs, since these DPs would never be the reason for non-termination. 8 Definition 2 (DP). For all f ∈ D \ F int , we introduce a fresh tuple symbol f ♯ with the same arity, where we often write F instead of f ♯ .…”

“…Handling non-deterministic algorithms is often necessary for termination proofs of imperative programs when abstracting away "irrelevant" parts of the computation, cf. [4,8,24].…”

“…Footnote 7). Our data base contains all 19 examples from the collection of [17] and all 29 examples from the collection 23 of [9] converted to integers, all 19 examples from the papers [2][3][4][5][6][7][8]24, 25] 24 on imperative programs converted to term rewriting, and several other "typical" algorithms on integers (including also some nonterminating ones). With a timeout of 1 minute for each example, the new version of AProVE with the contributions of this paper can prove termination of 104 examples (i.e., of 88.9 %).…”