Proving non-termination

Abstract

The search for proof and the search for counterexamples (bugs) are complementary activities that need to be pursued concurrently in order to maximize the practical success rate of verification tools. While this is well-understood in safety verification, the current focus of liveness verification has been almost exclusively on the search for termination proofs. A counterexample to termination is an infinite program execution. In this paper, we propose a method to search for such counterexamples. The search proceeds in two phases. We first dynamically enumerate lasso-shaped candidate paths for counterexamples, and then statically prove their feasibility. We illustrate the utility of our nontermination prover, called TNT, on several nontrivial examples, some of which require bitlevel reasoning about integer representations.

Better Termination Proving through Cooperation

“…Plot (b) contains the results from non-terminating benchmarks. Here both configurations of T2 use an approach similar to the approach used in TNT [24]. Our method from Fig.…”

From Invariant Checking to Invariant Inference Using Randomized Search

“…Indeed, we observe that the time measurements of the c2i searches in Table 1 are competitive with previous techniques. We consider the benchmarks for proving non-termination from TnT [27] and Looper in Table 2. Since these papers do not include performance results, we compare randomized search with Z3-Horn.…”

“…Consider the following problem: prove that the loop while B do S od fails to terminate if executed with input i. One can obtain such a proof by demonstrating a recurrent set [9,27] I which makes the following VCs valid.…”

“…-We empirically demonstrate the generality of our search algorithm. We use randomized search for finding numerical invariants, recurrent sets [27], universally quantified invariants over arrays, invariants over string operators, and invariants involving reachability predicates for linked list manipulating programs. These studies show that invariant inference is amenable to randomized search.…”

Solving Existentially Quantified Horn Clauses

“…Nevertheless, important first steps were made in proving existence of infinite program computations, see e.g. [16,20,29], even in proving existential (as well as universal) CTL properties [11]. Moreover, bounded model checking tools like CBMC [8] or Klee [7] can be very effective in proving existential reachability properties.…”