Terminator finds and checks termination arguments ... Termi

1
Terminator Automatically proving program termi
nation Byron Cook MSR-Cambridge http//r
esearch.microsoft.com/Terminator

2
Group members
MSR-Cambridge Byron Cook Josh Berdine
Freiburg Univ. Andreas Podelski
Queen Mary / London Peter OHearn Dino Dis
tefano

Max Planck Institute Andrey Rybalchenko
3
Achievements
Breakthrough algorithmic discovery
Remarkable research publication record at top co
nferences e.g. PLDI 2x, POPL 2x, CAV 2x, etc.
Invited lectures at top conferences and
universities e.g. CAV, QCon, Stanford, CMU, etc.
Articles in the popular press e.g.
Scientific American, Financial Times, etc.
Bugs and proofs found
4
Motivation

• In order to stay live, reactive systems must be
  constructed from terminating event-handling
  routines

5
Motivation
6
Motivation

• Research question
• Why not mathematically prove that these
  routines terminate?
  
• Classic answer
• Thats the halting problem
• and even if some tricks exist, theyll never
  work for real code
  

7
Terminator

• Terminator Termination/liveness prover for C
  programs
  
• 1st of its kind
• Proof procedure represents a new fundamental
  discovery
  
• Liveness properties
• Properties with positive use of eventually
• e.g. Every Acquire() must eventually be
  followed by a Release()
  
• Liveness reducible to termination fundamental
  problem is termination
  
• Terminator finds and checks termination
  arguments
  
• Termination arguments produced as
  certificates/explainations
  
• 2nd run less expensive

8
Simple example
9
Simple example
10
Simple example
11
Simple example
12
Simple example
13
Simple example
14
Simple example
15
Simple example
16
Proving liveness of real systems

• Examples drawn from 20 Windows device drivers
• Each driver between 2k and 30k LOC
• e.g. Firewire, serial, parallel port, etc.
• Termination and other liveness properties proved
  for each dispatch routine
  
• e.g. resource acquire/release
• Dispatch routines are concurrent
• Terminator infers and checks environment
  assumptions when proving thread
  termination/liveness
  
• Failed proof attempts result in potential bugs
• 10 termination/liveness bugs found thus far

17
Proving liveness of real systems

18
Proving liveness of real systems
19
Proving liveness of real systems
20
Proving liveness of real systems
21
Proving liveness of real systems
22
Conclusion
Terminator is a breakthrough discovery
We can now automatically prove termination and
other liveness properties of real industrial
systems Program verification frontiers Liv
eness, concurrency, heap Terminator supports all
three Future Technology transfer into Static
Driver Verifier? Termination and fine-grained co
ncurrency? New direction Liveness-guaranteeing r
untimes that produce hangdumps