Abstract
Non-termination is the root cause of a variety of program bugs, such as hanging programs and denial-of-service vulnerabilities. This makes an automated analysis that can prove the absence of such bugs highly desirable. To scale termination checks to large systems, an interprocedural termination analysis seems essential. This is a largely unexplored area of research in termination analysis, where most effort has focussed on small but difficult single-procedure problems.
We present a modular termination analysis for C programs using template-based interprocedural summarisation. Our analysis combines a context-sensitive, over-approximating forward analysis with the inference of under-approximating preconditions for termination. Bit-precise termination arguments are synthesised over lexicographic linear ranking function templates. Our experimental results show the advantage of interprocedural reasoning over monolithic analysis in terms of efficiency, while retaining comparable precision.
- 2LS. 2016. 2LS: Static Analyzer and Verifier. Retrieved from http://www.cprover.org/2LS (version 0.4).Google Scholar
- Elvira Albert, Puri Arenas, Samir Genaim, Germán Puebla, and Guillermo Román-Díez. 2014. Conditional termination of loops over heap-allocated data. Science of Computer Programming 92 (2014), 2--24.Google Scholar
Cross Ref
- Elvira Albert, Puri Arenas, Samir Genaim, German Puebla, and Damiano Zanardini. 2007. COSTA: Design and implementation of a cost and termination analyzer for java bytecode. In Formal Methods for Components and Objects (LNCS), Vol. 5382. Springer, 113--132.Google Scholar
- Elvira Albert, Puri Arenas, Samir Genaim, German Puebla, and Damiano Zanardini. 2012. Cost analysis of object-oriented bytecode programs. Theoretical Computer Science 413, 1 (2012), 142--159. Google Scholar
Digital Library
- Elvira Albert, Antonio Flores-Montoya, Samir Genaim, and Enrique Martin-Martin. 2017. Rely-guarantee termination and cost analyses of loops with concurrent interleavings. Journal of Automated Reasoning 59, 1 (2017), 47--85. Google Scholar
Digital Library
- Christophe Alias, Alain Darte, Paul Feautrier, and Laure Gonnord. 2010. Multi-dimensional rankings, program termination, and complexity bounds of flowchart programs. In Static Analysis Symposium (LNCS), Vol. 6337. Springer, 117--133. Google Scholar
Digital Library
- Apache CVE-2009-1890. 2009. Apache Common Vulnerabilities and Exposures CVE-2009-1890. Retrieved from http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890.Google Scholar
- AProVE. 2016. Automated Program Verification Environment (AProVE). Retrieved from https://sv-comp.sosy-lab.org/2016/downloads/AProVE2016.zip (SV-COMP 2016).Google Scholar
- Amir M. Ben-Amram and Samir Genaim. 2013. On the linear ranking problem for integer linear-constraint loops. In Principles of Programming Languages. ACM, 51--62. Google Scholar
Digital Library
- Amir M. Ben-Amram and Samir Genaim. 2014. Ranking functions for linear-constraint loops. Journal of the ACM 61, 4 (2014), 26:1--26:55. Google Scholar
Digital Library
- Josh Berdine, Byron Cook, Dino Distefano, and Peter W. O’Hearn. 2006. Automatic termination proofs for programs with shape-shifting heaps. In Computer-Aided Verification (LNCS). Springer, 386--400. Google Scholar
Digital Library
- Dirk Beyer. 2016. Reliable and reproducible competition results with benchExec and witnesses (report on SV-COMP 2016). In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 9636. Springer. Google Scholar
Digital Library
- Marius Bozga, Radu Iosif, and Filip Konecný. 2012. Deciding conditional termination. In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 7214. Springer, 252--266. Google Scholar
Digital Library
- Aaron R. Bradley, Zohar Manna, and Henny B. Sipma. 2005a. Linear ranking with reachability. In Computer-Aided Verification (LNCS). Springer, 491--504. Google Scholar
Digital Library
- Aaron R. Bradley, Zohar Manna, and Henny B. Sipma. 2005b. Termination of polynomial programs. In Verification, Model Checking, and Abstract Interpretation (LNCS), Vol. 3385. Springer, 113--129. Google Scholar
Digital Library
- Martin Brain, Saurabh Joshi, Daniel Kroening, and Peter Schrammel. 2015. Safety verification and refutation by -invariants and -induction. In Static Analysis Symposium (LNCS), Vol. 9291. Springer, 145--161.Google Scholar
Cross Ref
- Marc Brockschmidt, Fabian Emmes, Stephan Falke, Carsten Fuhs, and Jürgen Giesl. 2016. Analyzing runtime and size complexity of integer programs. ACM Transactions on Programming Languages and Systems 38, 4 (2016), 13:1--13:50. Google Scholar
Digital Library
- Hong-Yi Chen, Cristina David, Daniel Kroening, Peter Schrammel, and Björn Wachter. 2015. Synthesising interprocedural bit-precise termination proofs. In Automated Software Engineering. IEEE Computer Society, 53--64.Google Scholar
- Hong Yi Chen, Byron Cook, Carsten Fuhs, Kaustubh Nimkar, and Peter W. O’Hearn. 2014. Proving nontermination via safety. In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 8413. Springer, 156--171.Google Scholar
- Hong Yi Chen, Supratik Mukhopadhyay, and Zheng Lu. 2013. Control flow refinement and symbolic computation of average case bound. In Automated Technology for Verification and Analysis (LNCS), Vol. 8172. Springer, 334--348.Google Scholar
- CLAPACK 2014. (2014). CLAPACK Linear Algebra Library. Retrieved from http://www.netlib.org/clapack/cblas/sasum.c.Google Scholar
- Edmund M. Clarke, Orna Grumberg, Somesh Jha, Yuan Lu, and Helmut Veith. 2000. Counterexample-guided abstraction refinement. In Computer-Aided Verification (LNCS), Vol. 1855. Springer, 154--169. Google Scholar
Digital Library
- Byron Cook, Sumit Gulwani, Tal Lev-Ami, Andrey Rybalchenko, and Mooly Sagiv. 2008. Proving conditional termination. In Computer-Aided Verification (LNCS), Vol. 5123. Springer, 328--340. Google Scholar
Digital Library
- Byron Cook, Daniel Kroening, Philipp Rümmer, and Christoph M. Wintersteiger. 2010. Ranking function synthesis for bit-vector relations. In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 6015. Springer, 236--250. Google Scholar
Digital Library
- Byron Cook, Andreas Podelski, and Andrey Rybalchenko. 2006. Termination proofs for systems code. In Programming Language Design and Implementation. ACM, 415--426. Google Scholar
Digital Library
- Byron Cook, Andreas Podelski, and Andrey Rybalchenko. 2007. Proving thread termination. In Programming Language Design and Implementation. ACM, 320--330. Google Scholar
Digital Library
- Byron Cook, Abigail See, and Florian Zuleger. 2013. Ramsey vs. lexicographic termination proving. In Tools and Algorithms for the Construction and Analysis of Systems (LNCS). Springer, 47--61. Google Scholar
Digital Library
- Patrick Cousot and Radhia Cousot. 1977. Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Principles of Programming Languages. 238--252. Google Scholar
Digital Library
- CppInv. 2015. CppInv Termination Prover. Retrieved from http://www.lsi.upc.edu/ albert/cppinv-term-bin.tar.gz.Google Scholar
- Cristina David, Daniel Kroening, and Matt Lewis. 2015. Unrestricted termination and non-termination arguments for bit-vector programs. In European Symposium on Programming. Springer, 183--204.Google Scholar
Cross Ref
- Nurit Dor, Michael Rodeh, and Shmuel Sagiv. 2001. Cleanness checking of string manipulations in C programs via integer analysis. In Static Analysis Symposium (LNCS), Vol. 2126. Springer, 194--212. Google Scholar
Digital Library
- Stephan Falke, Deepak Kapur, and Carsten Sinz. 2012. Termination analysis of imperative programs using bitvector arithmetic. In Verified Software: Theories, Tools, Experiments (LNCS), Vol. 7152. Springer, 261--277. Google Scholar
Digital Library
- Antonio Flores-Montoya and Reiner Hähnle. 2014. Resource analysis of complex programs with cost equations. In Programming Languages and Systems -- 12th Asian Symposium. 275--295.Google Scholar
- FuncTion. 2015. FuncTion Termination Prover. Retrieved from http://www.di.ens.fr/ urban/sv-comp2015.zip (version SV-COMP-2015).Google Scholar
- Pierre Ganty and Samir Genaim. 2013. Proving termination starting from the end. In Computer-Aided Verification (LNCS), Vol. 8044. Springer, 397--412.Google Scholar
- Thomas M. Gawlitza and Helmut Seidl. 2007. Precise relational invariants through strategy iteration. In Computer Science Logic (LNCS), Vol. 4646. Springer, 23--40. Google Scholar
Digital Library
- Samir Genaim and Michael Codish. 2005. Inferring termination conditions for logic programs using backwards analysis. Theory and Practice of Logic Programming 5, 1--2 (2005), 75--91. Google Scholar
Digital Library
- Jürgen Giesl, Cornelius Aschermann, Marc Brockschmidt, Fabian Emmes, Florian Frohn, Carsten Fuhs, Jera Hensel, Carsten Otto, Martin Plücker, Peter Schneider-Kamp, Thomas Ströder, Stephanie Swiderski, and René Thiemann. 2017. Analyzing program termination and complexity automatically with AProVE. Journal of Automated Reasoning 58, 1 (2017), 3--31. Google Scholar
Digital Library
- Laure Gonnord, David Monniaux, and Gabriel Radanne. 2015. Synthesis of ranking functions using extremal counterexamples. In Programming Language Design and Implementation. ACM, 608--618. Google Scholar
Digital Library
- Sergey Grebenshchikov, Nuno P. Lopes, Corneliu Popeea, and Andrey Rybalchenko. 2012. Synthesizing software verifiers from proof rules. In Programming Language Design and Implementation. 405--416. Google Scholar
Digital Library
- Orna Grumberg and David E. Long. 1994. Model checking and modular verification. Transactions on Programming Languages and Systems 16, 3 (1994), 843--871. Google Scholar
Digital Library
- Sumit Gulwani, Sagar Jain, and Eric Koskinen. 2009. Control-flow refinement and progress invariants for bound analysis. In Programming Language Design and Implementation. ACM, 375--385. Google Scholar
Digital Library
- Sumit Gulwani, Saurabh Srivastava, and Ramarathnam Venkatesan. 2008. Program analysis as constraint solving. In Programming Language Design and Implementation. ACM, 281--292. Google Scholar
Digital Library
- Ashutosh Gupta, Thomas A. Henzinger, Rupak Majumdar, Andrey Rybalchenko, and Ru-Gang Xu. 2008. Proving non-termination. In Principles of Programming Languages. ACM, 147--158. Google Scholar
Digital Library
- Ashutosh Gupta, Corneliu Popeea, and Andrey Rybalchenko. 2011. Predicate abstraction and refinement for verifying multi-threaded programs. In Principles of Programming Languages. ACM, 331--344. Google Scholar
Digital Library
- William R. Harris, Akash Lal, Aditya V. Nori, and Sriram K. Rajamani. 2010. Alternation for termination. In Static Analysis Symposium (LNCS), Vol. 6337. Springer, 304--319. Google Scholar
Digital Library
- Matthias Heizmann, Daniel Dietsch, Marius Greitschus, Jan Leike, Betim Musa, Claus Schätzle, and Andreas Podelski. 2016. Ultimate automizer with two-track proofs (competition contribution). In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 9636. Springer, 950--953. http://ultimate.informatik.uni-freiburg.de/ (special build based on version SV-COMP-2016). Google Scholar
Digital Library
- Matthias Heizmann, Jochen Hoenicke, Jan Leike, and Andreas Podelski. 2013. Linear ranking for linear lasso programs. In Automated Technology for Verification and Analysis. Springer, 365--380.Google Scholar
- Matthias Heizmann, Jochen Hoenicke, and Andreas Podelski. 2014. Termination analysis by learning terminating programs. In Computer-Aided Verification (LNCS), Vol. 8559. Springer, 797--813. Google Scholar
Digital Library
- Jera Hensel, Jürgen Giesl, Florian Frohn, and Thomas Ströder. 2016. Proving termination of programs with bitvector arithmetic by symbolic execution. In Software Engineering and Formal Methods (LNCS), Vol. 9763. Springer, 234--252.Google Scholar
- Cliff B. Jones. 1983. Tentative steps toward a development method for interfering programs. ACM Transactions on Programming Languages and Systems 5, 4 (Oct. 1983), 596--619. Google Scholar
Digital Library
- Andy King and Lunjin Lu. 2002. A backward analysis for constraint logic programs. Theory and Practice of Logic Programming 2, 4--5 (2002), 517--547. Google Scholar
Digital Library
- KiTTeL/KoAT. 2016. KITTeL/KoAT Termination Prover. Retrieved from https://github.com/s-falke/kittel-koat (version 6ee36da).Google Scholar
- Jens Knoop, Laura Kovács, and Jakob Zwirchmayr. 2011. Symbolic loop bound computation for WCET analysis. In Perspectives of Systems Informatics, PSI (LNCS), Vol. 7162. Springer, 227--242. Google Scholar
Digital Library
- Jens Knoop, Laura Kovács, and Jakob Zwirchmayr. 2012. r-TuBound: Loop bounds for WCET analysis (tool paper). In Logic for Programming, Artificial Intelligence, and Reasoning, LPAR. 435--444. Google Scholar
Digital Library
- Daniel Kroening, Natasha Sharygina, Aliaksei Tsitovich, and Christoph M. Wintersteiger. 2010. Termination analysis with compositional transition invariants. In Computer-Aided Verification (LNCS), Vol. 6174. Springer, 89--103. Google Scholar
Digital Library
- Andrey Kupriyanov and Bernd Finkbeiner. 2014. Causal termination of multi-threaded programs. In Computer Aided Verification (CAV) (LNCS), Vol. 8559. Springer, 814--830. Google Scholar
Digital Library
- Ton Chanh Le, Cristian Gherghina, Aquinas Hobor, and Wei-Ngan Chin. 2014. A resource-based logic for termination and non-termination proofs. In Formal Methods and Software Engineering (LNCS), Vol. 8829. Springer, 267--283.Google Scholar
- Ton Chanh Le, Shengchao Qin, and Wei-Ngan Chin. 2015. Termination and non-termination specification inference. In Programming Language Design and Implementation. ACM, 489--498. Google Scholar
Digital Library
- Wonchan Lee, Bow-Yaw Wang, and Kwangkeun Yi. 2012. Termination analysis with algorithmic learning. In Computer-Aided Verification (LNCS). Springer, 88--104. Google Scholar
Digital Library
- Jan Leike and Matthias Heizmann. 2014. Ranking templates for linear loops. In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 8413. Springer, 172--186.Google Scholar
- Yi Li, Aws Albarghouthi, Zachary Kincaid, Arie Gurfinkel, and Marsha Chechik. 2014. Symbolic optimization with SMT solvers. In Principles of Programming Languages. ACM, 607--618. Google Scholar
Digital Library
- llvm2KITTeL. 2016. llvm2KITTeL Converter. Retrieved from https://github.com/hkhlaaf/llvm2kittel (version e37be65e).Google Scholar
- Loopus. 2014. Loopus Termination Prover. Retrieved from http://forsyte.at/software/loopus/ with http://sourceforge.net/projects/virtualboximage/files/Ubuntu&percent;20Linux/11.10/ubuntu_11.10-x86.7z/download.Google Scholar
- Stephen Magill, Ming-Hsien Tsai, Peter Lee, and Yih-Kuen Tsay. 2010. Automatic numeric abstractions for heap-manipulating programs. In Principles of Programming Languages. ACM, 211--222. Google Scholar
Digital Library
- Roman Manevich, Boris Dogadov, and Noam Rinetzky. 2016. From shape analysis to termination analysis in linear time. In Computer-Aided Verification (LNCS), Vol. 9779. Springer, 426--446.Google Scholar
- Damien Massé. 2012. Proving termination by policy iteration. Electronic Notes in Theoretical Computer Science 287 (2012), 77--88. Google Scholar
Digital Library
- Damien Massé. 2014. Policy iteration-based conditional termination and ranking functions. In Verification, Model Checking, and Abstract Interpretation (LNCS), Vol. 8318. Springer, 453--471. Google Scholar
Digital Library
- Fonenantsoa Maurica, Frédéric Mesnard, and Étienne Payet. 2016. Termination analysis of floating-point programs using parameterizable rational approximations. In Proceedings of the Symposium on Applied Computing. ACM, 1674--1679. Google Scholar
Digital Library
- Kenneth L. McMillan. 2008. Quantified invariant generation using an interpolating saturation prover. In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 4963. Springer, 413--427. Google Scholar
Digital Library
- Frédéric Mesnard. 1996. Inferring left-terminating classes of queries for constraint logic programs. In Proceedings of the 1996 Joint International Conference and Symposium on Logic Programming. 7--21.Google Scholar
- Daniel Le Métayer. 1988. ACE: An automatic complexity evaluator. Transactions on Programming Languages and Systems 10, 2 (1988), 248--266. Google Scholar
Digital Library
- Antoine Miné. 2006. The octagon abstract domain. Higher-Order and Symbolic Computation 19, 1 (2006), 31--100. Google Scholar
Digital Library
- Andreas Podelski and Andrey Rybalchenko. 2004. Transition invariants. In Logic in Computer Science. IEEE Computer Society, 32--41. Google Scholar
Digital Library
- Andreas Podelski and Andrey Rybalchenko. 2007. ARMC: The logical choice for software model checking with abstraction refinement. In Practical Aspects of Declarative Languages (LNCS), Vol. 4354. Springer. https://www7.in.tum.de//rybal/armc/ (version August 2011). Google Scholar
Digital Library
- Andreas Podelski, Ina Schaefer, and Silke Wagner. 2005. Summaries for while programs with recursion. In European Symposium on Programming (LNCS), Vol. 3444. Springer, 94--107. Google Scholar
Digital Library
- Corneliu Popeea and Andrey Rybalchenko. 2012. Compositional termination proofs for multi-threaded programs. In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 7214. Springer, 237--251. Google Scholar
Digital Library
- Francesco Ranzato, Olivia Rossi-Doria, and Francesco Tapparo. 2008. A forward-backward abstraction refinement algorithm. In Verification, Model Checking, and Abstract Interpretation (LNCS), Vol. 4905. Springer, 248--262. Google Scholar
Digital Library
- Mads Rosendahl. 1989. Automatic complexity analysis. In Functional Programming Languages and Computer Architecture. ACM, 144--156. Google Scholar
Digital Library
- Olivier Roussel. 2011. Controlling a solver execution with the runsolver tool. Journal on Satisfiability, Boolean Modeling and Computation 7, 4 (2011), 139--144.Google Scholar
Cross Ref
- Sriram Sankaranarayanan, Henny B. Sipma, and Zohar Manna. 2005. Scalable analysis of linear systems using mathematical programming. In Verification, Model Checking, and Abstract Interpretation (LNCS), Vol. 3385. Springer, 25--41. Google Scholar
Digital Library
- Peter Schrammel. 2016. Challenges in decomposing encodings of verification problems. In [email protected] 2016 (EPTCS), Vol. 219. 29--32.Google Scholar
- Peter Schrammel and Daniel Kroening. 2016. 2LS for program analysis (competition contribution). In Tools and Algorithms for the Construction and Analysis of Systems (LNCS), Vol. 9636. Springer, 905--907. Google Scholar
Digital Library
- SeaHorn. 2016. SeaHorn, A Verification Framework. Retrieved from https://sv-comp.sosy-lab.org/2016/downloads/SeaHorn-0.1.0-Linux-x86_64.tar.gz.Google Scholar
- Moritz Sinn, Florian Zuleger, and Helmut Veith. 2014. A simple and scalable static analysis for bound analysis and amortized complexity analysis. In Computer-Aided Verification (LNCS), Vol. 8559. Springer, 745--761. Google Scholar
Digital Library
- Fausto Spoto, Fred Mesnard, and Étienne Payet. 2010. A termination analyzer for java bytecode based on path-length. ACM Transactions on Programming Languages and Systems 32, 3 (2010). Google Scholar
Digital Library
- SV-COMP. 2016. Competition on Software Verification (SV-COMP). Retrieved from https://github.com/sosy-lab/sv-benchmarks/releases/tag/svcomp16.Google Scholar
- T2. 2016. T2 Temporal Logic Prover. Retrieved from https://github.com/mmjb/T2 (version 90c5d0e).Google Scholar
- TAN. 2014. TAN Termination Prover. Retrieved from http://www.cprover.org/termination/ (version SV-COMP-2014).Google Scholar
- Caterina Urban and Antoine Miné. 2014. A decision tree abstract domain for proving conditional termination. In Static Analysis Symposium (LNCS), Vol. 8723. Springer, 302--318.Google Scholar
Cross Ref
- Caterina Urban and Antoine Miné. 2017. Inference of ranking functions for proving temporal properties by abstract interpretation. Computer Languages, Systems 8 Structures 47 (2017), 77--103.Google Scholar
- Ben Wegbreit. 1975. Mechanical program analysis. Communications of the ACM 18, 9 (1975), 528--539. Google Scholar
Digital Library
- Reinhard Wilhelm, Jakob Engblom, Andreas Ermedahl, Niklas Holsti, Stephan Thesing, David Whalley, Guillem Bernat, Christian Ferdinand, Reinhold Heckmann, Tulika Mitra, Frank Mueller, Isabelle Puaut, Peter Puschner, Jan Staschulat, and Per Stenström. 2008. The worst-case execution time problem—Overview of methods and survey of tools. Transactions on Embedded Computing Systems 7, 3, Article 36 (2008). Google Scholar
Digital Library
Index Terms
Bit-Precise Procedure-Modular Termination Analysis
Recommendations
Synthesising interprocedural bit-precise termination proofs
ASE '15: Proceedings of the 30th IEEE/ACM International Conference on Automated Software EngineeringProving program termination is key to guaranteeing absence of undesirable behaviour, such as hanging programs and even security vulnerabilities such as denial-of-service attacks. To make termination checks scale to large systems, interprocedural ...
Precise and efficient integration of interprocedural alias information into data-flow analysis
Data-flow analysis is a basis for program optimization and parallelizing transformations. The mechanism of passing reference parameters at call sites generates interprocedural aliases which complicate this analysis. Solutions have been developed for ...
Interprocedural pointer alias analysis
We present practical approximation methods for computing and representing interprocedural aliases for a program written in a language that includes pointers, reference parameters, and recursion. We present the following contributions: (1) a framework ...






Comments