Cyclic proofs of program termination in separation logic

Abstract

We propose a novel approach to proving the termination of heapmanipulating programs, which combines separation logic with cyclic proof within a Hoare-style proof system. Judgements in this system express (guaranteed) termination of the program when started from a given line in the program and in a state satisfying a given precondition, which is expressed as a formula of separation logic. The proof rules of our system are of two types: logical rules that operate on preconditions; and symbolic execution rules that capture the effect of executing program commands.Our logical preconditions employ inductively defined predicates to describe heap properties, and proofs in our system are cyclic proofs: cyclic derivations in which some inductive predicate is unfolded infinitely often along every infinite path, thus allowing us to discard all infinite paths in the proof by an infinite descent argument. Moreover, the use of this soundness condition enables us to avoid the explicit construction and use of ranking functions for termination. We also give a completeness result for our system, which is relative in that it relies upon completeness of a proof system for logical implications in separation logic. We give examples illustrating our approach, including one example for which the corresponding ranking function is non-obvious: termination of the classical algorithm for in-place reversal of a (possibly cyclic) linked list.

Automatic cyclic termination proofs for recursive procedures in separation logic

“…The following soundness result follows similarly to [12]. Now Φ {φ} C {ψ} has a cyclic proof P, so suppose for contradiction that {φ} C {ψ} is not valid.…”

“…Our global soundness condition, required to qualify such pre-proofs as genuine cyclic proofs, is formulated in terms of the following concept of a trace through the pre-proof (cf. [11,12,31]). hand premise of the rule instance, then α is free in both φ and φ .…”

“…The core of our approach is a cyclic Hoare-style proof system for total correctness, with pre-and postconditions written in the well-known symbolic heap fragment of separation logic [27], where user-defined inductive predicates are used to describe data structures in memory (see [5,15]). Our cyclic proof system extends an earlier cyclic proof system for simple while programs [12] in which termination measures are always obtained from (combinations of) semantic approximations of the inductive predicates in the proof. The addition of procedures, however, requires non-trivial extensions to the proof system in order to track how these approximations are affected by procedure calls.…”

A termination analyzer for Java bytecode based on path-length

“…Note that we prove termination of the program in Figure 5, which uses trees rather than flavors of lists, and that we support functions. Nevertheless, the results in Loginov et al [2006], Berdine et al [2006], Bouajjani et al [2006], and Brotherston et al [2008] show that termination analysis, tied to a specific data structure, leads to more precise results than does a general approach such as ours. For instance, it proves the termination of the panhandle list reversal, where our analysis fails.…”

“…In Definition 44 we use such information to approximate method calls. In Brotherston et al [2008], termination is proved by looking for cyclicity in the Hoare-like proof tree of the program, constructed by suitable execution rules over separation logic [Reynolds 2000;Ishtiaq and O'Hearn 2001]. The only considered data structures are lists.…”