A Resource-based Logic for Termination and Non-Termination Proofs Ton Chanh Le Cristian Gherghina Aquinas Hobor Wei-Ngan Chin National University of Singapore 1ICFEM 2014

A Resource-based Logic for Termination and Non-Termination Proofs ICFEM 20142

Hoare Logic for Partial Correctness Proving Partial Correctness ICFEM 20143

Hoare Logic for Total Correctness Proving Termination ICFEM 20144

Hoare Logic for Total Correctness Proving Non-Termination ICFEM 20145

(Non-)Termination Specification “So-called partial correctness is inadequate: if a program is intended to terminate, that fact must be part of its specification.” – Cliff Jones Non-termination specification is also important for More comprehensive specifications to understand program better A clearer distinction between expected non-termination and failure of termination proofs ICFEM 20146

Research Questions requires x ≥ 0  y < 0 variance x ensures true; requires x ≥ 0  y ≥ 0 ensures false; ICFEM Is the separation between termination and non- termination specifications good? while (x ≥ 0) { x = x + y; }

Research Questions requires x ≥ 0  y < 0 variance x ensures true; requires x ≥ 0  y ≥ 0 ensures false; ICFEM How can the termination and non-termination specifications be unified? while (x ≥ 0) { x = x + y; }

A Unified Specification Logic A unified logical foundation for both termination and non-termination reasoning Integration of termination and non-termination specifications into expressive logics for functional correctness and safety verification ICFEM 20149

Temporal Predicates Term M : termination Loop : definite non-termination MayLoop : possible non-termination ICFEM

Example while (x ≥ 0) { x = x + y; } requires (x ≥ 0  y < 0  Term[x])  (x ≥ 0  y ≥ 0  Loop) ensures (x ≥ 0  y ≥ 0  false); ICFEM

Example while (x ≥ 0) { x = x + y; } case { x requires Term ensures true; x ≥ 0 -> case { y ≥ 0 -> requires Loop ensures false; y requires Term[x] ensures true; } ICFEM

A Resource-based Logic for Termination and Non-Termination Proofs ICFEM

Foundation for Specification Logic Solution: Consider non-termination and termination as resources. Our proposal: A new logic for consumable resources which captures the concept of resource capacity; tracking both minimum and maximum of resource usage ICFEM

Resource Assertions ICFEM

Temporal Entailment ICFEM

Flow-Insensitive Temporal Entailment ICFEM

HipTNT: A Termination Verification System ICFEM

HipTNT+: A Termination Inference System void loop (int x, int y) { if (x < 0) return; else loop(x + y, y); } ICFEM

HipTNT+: A Termination Inference System void loop (int x, int y) { if (x < 0) return; else loop(x + y, y - 1); } ICFEM

HipTNT+: A Termination Inference System int Ack(int m, int n) { if (m == 0) return n + 1; else if (n == 0) return Ack(m-1, 1); else return Ack(m-1, Ack(m, n-1)); } ICFEM

HipTNT+: A Termination Inference System int Ack(int m, int n) case { m requires Loop ensures false; m = 0 -> requires Term ensures res = n + 1; m > 0  n requires Loop ensures false; m > 0  n ≥ 0 -> requires Term[m, n] ensures res ≥ n + 1; } ICFEM

Conclusions “Termination and Non-Termination as Resources” provides a unified framework to combine both partial correctness and (non-)termination verification The termination inference can benefit from mechanisms developed for safety verification, such as shape inference ICFEM