Ranking Functions for Size-Change Termination

Transcription

1 Ranking Functions for Size-Change Termination CHIN SOON LEE Ma-Planck-Institut für Informatik, Saarbrücken, German This article eplains how to construct a ranking function for an program that is proved terminating b size-change analsis. The principle of size-change termination for a first-order functional language with wellordered data is intuitive: A program terminates on all inputs, if ever infinite call sequence (following program control flow) would impl an infinite descent in some data values. Size-change analsis is based on information associated with the subject program s call-sites. This information indicates, for each call-site, strict or weak data decreases observed as a computation traverses the call-site. The set DESC of call-site sequences for which the size-changes impl infinite descent is ω-regular, as is the set FLOW of infinite call-site sequences following the program flowchart. If FLOW DESC (a decidable problem), ever infinite call sequence would impl infinite descent in a well-ordering an impossibilit so the program must terminate. This analsis accounts for the termination arguments applicable to different call-site sequences, without indicating a ranking function for the program s termination. In this article, it is eplained how one can be constructed whenever size-change analsis succeeds. The constructed function has an unepectedl simple form; it is epressed using onl min, ma, and leicographic tuples of parameters and constants. In principle, such functions can be tested to determine whether sizechange analsis will be successful. As a corollar, if a program verified as terminating performs onl multipl recursive operations, the function that it computes is multipl recursive. The ranking function construction is connected with the determinization of the Büchi automaton for DESC. While the result is not practical, it is of value in addressing the scope of size-change reasoning. This reasoning has been applied broadl, in the analsis of functional and logic programs, as well as term rewrite sstems. Categories and Subject Descriptors: D.2.4 [Software Engineering]: Software/Program Verification; F.3.1 [Logics and Meanings of Programs]: Specifing and Verifing and Reasoning about Programs General Terms: Theor Additional Ke Words and Phrases: ω-automaton, determinization, multiple recursion, ranking function, size-change termination, termination analsis 1. INTRODUCTION Size-change analsis was formulated as a termination analsis for first-order functional programs [Lee et al. 2001], but can be applied, with appropriate supporting techniques, to higher-order programs [Jones and Bohr 2004], logic programs [Codish et al. 2005], and term rewrite sstems [Thiemann and Giesl 2003]. The logical reasoning behind the analsis is best illustrated with an eample. Consider an call Permission to make digital/hard cop of all or part of this material without fee for personal or classroom use provided that the copies are not made or distributed for profit or commercial advantage, the ACM copright/server notice, the title of the publication, and its date appear, and notice is given that coping is b permission of the ACM, Inc. To cop otherwise, to republish, to post on servers, or to redistribute to lists requires prior specific permission and/or a fee. c 2005 ACM

2 2 C. S. Lee to the Ackermann function, shown below, with a pair (m, n) of natural number values. Observe that the parameters m and n assume onl natural number values during program eecution. Thus, these values are well-ordered under the standard ordering of the natural numbers. Eample 1.1. (Ackermann) a(m,n) = if m=0 then n+1 else if n=0 then 1 a(m-1,1) else 2 a(m-1, 3 a(m,n-1)) m n m n m n = m n G 1, G 2 G 3 There are three call-sites in the program, labeled 1, 2, and 3. Each call-site c is associated with a size-change graph G c, a bipartite graph 1 reflecting the data decreases observed as a computation traverses the call-site. Informall, each arc γ in G c represents a relation between the value of parameter before the call and the value passed for parameter of the called function; γ = indicates a strict decrease, while γ = = indicates that the prior value is not increased (i.e., it is weakl decreased). For eample, G 3 asserts that in an call due to call-site 3, the value of m before the call is greater than or equal to the value of m after the call, while the value of n before the call is strictl greater than the value of n after the call. Now consider a hpothetical infinite chain of (recursive) calls resulting from the initial call to function a. The corresponding sequence of call-sites cs = c 1 c 2... (where each c i {1, 2, 3}) induces a sequence of size-change graphs G c1 G c2.... If the call-site sequence ends in just 3 s, then the graph sequence ends in just G 3 s. The concatenation of these graphs, called the multipath for cs, is obtained b identifing the target nodes of each bipartite graph with the source nodes of the net one in the sequence, as depicted at the top of Figure 1. It ehibits infinite descent in a value of n, as reflected b a path from a node labeled n containing infinitel man arcs. If the call-site sequence does not end in just 3 s, it has to contain infinitel man occurrences of 1 or 2; in this case, the corresponding multipath ehibits infinite descent in the initial value of m (refer to the bottom of Figure 1). The principle of size-change termination for a first-order functional language with well-ordered data can be epressed as follows. Infinite program eecution is impossible, if ever infinite call sequence would give rise to an infinitel decreasing value sequence, according to the size-change graphs. It implies that the eample above is terminating. The noteworth features of size-change analsis can be eplained with reference to this eample. (1) Automation: It is well-suited for automation. Program analsis can be used to etract size-change graphs from the program, and it turns out to be decidable whether the information in the graphs implies that ever infinite call sequence would cause infinite descent in some data values [Lee et al. 2001]. 1 A bipartite graph is a directed graph with disjoint source and target nodes.

3 Ranking Functions for Size-Change Termination 3 Multipath for 13 ω m n m n = m = m = m = m = m = n n n n n m n G 1 G 3 G 3 G 3 G 3 G 3 G 3 Multipath for (13) ω m n m n = m m = m m = n n n n m n m n G 1 G 3 G 1 G 3 G 1 G 3 G 1 Fig. 1. Multipaths for Eample 1.1 (Ackermann) (2) Efficienc: The size-change graphs seen above are stratifiable, and can be analzed efficientl (in quadratic time) [Ben-Amram and Lee 2005]. If one is restricted to the information contained in stratifiable graphs, it simpl does not make sense to search for leicographic descent b brute force. In practice, size-change graphs tend to be simple (even if not necessaril stratifiable), which leads to an efficient analsis [Thiemann and Giesl 2003]. (3) Generalit: Size-change analsis handles simple leicographic descent (as in the above eample) and simple multiset descent [Thiemann and Giesl 2003]. However, it is not immediatel clear what the scope of the analsis is. That is the subject matter of this article. One wa to assess the scope of the analsis is to describe a ranking function for the subject program s termination whenever the analsis is successful. In this article, a ranking function ρ maps program states to elements of a well-ordering (W, W ) such that if the evaluation of a program function f with parameter values v leads to a call of function g with parameters u, then ρ(g, u) < W ρ(f, v), where < W is the strict part of W. The well-ordering indicates an induction principle that can support the size-change reasoning. At the same time, the form of ρ makes it possible to compare size-change analsis with other termination analses. For the running eample, take W to be pairs of natural numbers, ordered leicographicall, and let ρ map (a, (m, n)) to the leicographic pair m, n. Size-change analsis accounts for an termination argument (based on the sizechange graphs) that is applicable to each call-site sequence. Consider the callsite sequence 13 ω (i.e., 1 followed b infinitel man 3 s) for Eample 1.1, which corresponds to the multipath at the top of Figure 1. The termination argument here is based on some value of n (but not the initial one). For the call-site sequence (13) ω (refer to the bottom of Figure 1), the termination argument is based on the initial value of m. It is conceptuall unclear how this tpe of reasoning can be reconciled with ranking-function based reasoning. Indeed, there are eamples of programs verified b size-change analsis, whose termination has so far seemed difficult to characterize with simple ranking functions, at least without recourse to some form of computation histor [Ben-Amram 2002].

4 4 C. S. Lee So how far does size-change termination (i.e., termination established b sizechange analsis) etend beond leicographic descent? The answer is: Not ver far! For an instance of size-change termination based on graphs with onl strict decreases, a corresponding ranking function can be constructed using onl min, ma, and the function parameters. Generall, for an instance of size-change termination, a corresponding ranking function can be constructed using min, ma, and leicographic tuples of function parameters and constants. In principle, such functions can be tested to determine whether size-change analsis will succeed. The ranking functions corresponding to size-change termination are of a particularl simple form; the are just not ones that are usuall considered b other termination analses. Well-ordering of data values. The assumption of a well-ordering of the program s data values ma seem artificial to the reader. For first-order functional programs that manipulate structured data, it is often some notion of size of a value, e.g., the number of cons in a list, which is relevant to the termination of a recursion. In practice, a norm function is used to assign each data value a size (some natural number). The arcs of a size-change graph are interpreted as relations between the sizes of parameter values. Thus, signifies that the value in has a greater size than the value passed for, while = signifies that the value in has a greater size or is the same size as the value passed for. Size-change analsis remains sound under this interpretation. Of greater relevance to this article, the ranking function construction here remains valid b interpreting an reference to a function parameter as a reference to its size. More generall, a node in size-change graph can be used to denote an mapping of parameter values into a well-ordered set. Then an reference to the node in the ranking function construction should be interpreted as a reference to the denoted value. The assumption of well-ordered data is made for the sake of simplicit. 1.1 Motivating Eamples This subsection contains eamples of size-change termination. For each eample, the size-change argument is jutaposed with an argument based on ranking functions. While the presentation here is necessaril informal, hopefull it will be clear wh a call to an function in each of the programs must terminate. The reader ma like to review these eamples after the formalization of size-change analsis. Each eample consists of a partiall specified program. The ellipsis... is used to indicate omitted code not containing an function calls. The omission is deliberate, to emphasize that the termination of the program follows alread from the code that is shown. The challenge in each case is to provide a ranking function for the program s termination. The semantics of a program (to be formalized) is based on the standard leftto-right call-b-value evaluation of a first-order functional language. The eample programs operate on data values D built recursivel from the natural numbers, the empt list [ ] and the cons operator : for lists. The data values are well-ordered b D in a wa that respects the standard ordering of the natural numbers and such that v D (v : v ) and v D (v : v ). As usual, < D denotes the strict part of D. There are man possible definitions for D ; its precise definition is not

5 Ranking Functions for Size-Change Termination 5 critical. The standard unar operators hd, tl, and - 1 are destructive, in the sense that appling an of them to a value v results in a value v < D v. This implies that an unbounded number of applications of such operations to an value is impossible. Thus, attempting to take the head or tail of an empt list, or compute the predecessor of 0 should result in an error condition, preventing further program eecution. Finall, program eecution is assumed to be free from tpe errors. Each call-site c in a program is associated with a size-change graph G c. For a call-site c occurring in the definition of function f and representing a call to function g, write G c : f g. Informall, G c refers to a bipartite graph with source and target nodes labeled b the parameters of f and g respectivel. An arc γ in the graph signifies that in an function call via call-site c, if v is the value in before the call and u is the value passed for, then u D v. Moreover, if γ =, then u v, thus u < D v. In diagrams, -labeled arcs are drawn with heav lines, but the labels themselves are omitted to avoid clutter. Eample 1.2. (List reverse) The onl eample of size-change termination seen so far (Eample 1.1) is for a program with a single function. When multiple functions are involved, onl call-site sequences respecting the program flowchart are considered in the sizechange reasoning. The following program fragment (based on a standard algorithm for computing the reverse of a list), has two functions, r1 and r0, and two callsites, labeled 1 and 2. The size-change graphs corresponding to these call-sites, G 1 : r1 r0 and G 2 : r0 r0 are shown on the right. Clearl, the onl infinite call-site sequence respecting program control flow is 12 ω. The arc zs zs in G 2 shows that following this call-site sequence would cause infinite descent. r1(s) = 1 r0(s,[]) r0(zs,a) = if... else 2 r0(tl zs,(hd zs):a) s zs a zs a zs a G 1 : r1 r0 G 2 : r0 r0 An obvious ranking function for this program s termination maps an program state of the form (r1, (s)) to 1, s and an program state of the form (r0, (zs, a)) to 0, zs. The co-domain of this ranking function is D 2, ordered leicographicall. For convenience, such ranking functions will be defined function-wise. For the eample, let ρ r1 (s) = 1, s and ρ r0 (zs, a) = 0, zs. Eample 1.3. (Mutual recursion) The eample below shows that a descent is not required at ever function call for size-change termination. An infinite call-site sequence respecting the program flowchart has to end with (12) ω. The graphs G 1 and G 2 show that following the call-site sequence would cause infinite descent in n. f0(n) = if... else 1 f1(n-1) f1(n) = if... else 2 f0(n) n n n n G 1 : f0 f1 G 2 : f1 f0

6 6 C. S. Lee Call-site sequence: z z z z z z z z G 1 G 2 G 1 G 1 G 2 G 1 G Fig. 2. A multipath for Eample 1.4 (permuted arguments) For a ranking function to show the program s termination, let ρ f0 (n) = n, 0 and ρ f1 (n) = n, 1. The ranking function has co-domain D 2. The program flowchart turns out not to be a real hurdle for constructing ranking functions corresponding to size-change termination, so the remaining eamples focus on different forms of parameter-descent behavior over a single function. Eample 1.4. (Permuted arguments) The parameters of program function p in the eample below are moved around on each call. Consider an infinite call-site sequence cs = c 1 c 2..., where each c i {1, 2}. The claim is that the corresponding multipath (the concatenated sequence of size-change graphs G c1 G c2...) ehibits infinite descent. Figure 2 shows an initial segment of such a multipath. Observe that it contains eactl three maimal paths, representing three distinct dataflows. Since each G ci contributes a -labeled arc to some path, one of the paths has infinitel man -labeled arcs. p(,,z) = if... 1 p(,z-1,) else 2 p(z,-1,) z z z z A simple ranking function for this program s termination is ρ p (,, z) = ++z, with co-domain N. However, allowing the use of sums in the definition of a ranking function does not seem helpful with the general problem of corresponding ranking functions to size-change termination. On deeper reflection, the size-change argument is related to leicographic descent. Let M and M be the multisets of parameter values before and after a call respectivel. Then both graphs impl that M is obtained from M b replacing an element of M with a smaller one. Thus, M < M under the standard multiset ordering [Dershowitz and Manna 1979]. For well-ordered data, multiset descent is equivalent to sorting M and M in descending order and comparing the resulting tuples leicographicall. A possibilit for ρ p is therefore given b ρ p (,, z) = sortdown,, z, where sortdown rearranges the components of,, z in descending order. The co-domain of this ranking function is D 3. Eample 1.5. (Maimum descending) Consider an infinite call-site sequence for the eample below. If it ends in just 1 s (resp. 2 s), then G 1 (resp. G 2 ) shows that following this call-site sequence would G 1 G 2

7 Ranking Functions for Size-Change Termination 7 cause infinite descent in (resp. ). Otherwise, the call-site sequence has infinitel man 1 s and 2 s. Drop an initial occurrences of 2 and divide the remaining sequence into segments of the form (1 1)(2 2). Consider the multipath for an such segment. A sequence of arcs connecting the first and final in the multipath can be obtained this wa: Follow an arcs from to across 1, then take the arc from to. Net, follow an arcs from to across 2, then take the arc from to. Following the entire call-site sequence would cause infinite descent in. m(,) = if... 1 m(hd(tl ),tl(tl )) else 2 m(hd(tl ),tl(tl )) A simple ranking function for the program s termination is ρ m (, ) = ma{, } with co-domain D. Eample 1.6. (Minimum descending) The size-change graphs seen so far are fan-in free; there is at most one arc ending at each target node. The eample below shows graphs with fan-in. Observe that an infinite multipath contains an infinite path, since both source nodes in each size-change graph are connected to some target node. As ever arc is labeled with, this path has infinitel man -labeled arcs. G 1 G 2 mn(,) = if... if < then 1 mn(-1,...) else 2 mn(...,-1) A simple ranking function for the program s termination is ρ mn (, ) = min{, } with co-domain D. Eample 1.7. (Mster descent 2001) The eample below was presented in [Lee et al. 2001] and [Thiemann and Giesl 2003] as interesting (perhaps because its ranking function confounded the authors). Consider an infinite call-site sequence. If it ends in just 2 s, then G 2 shows that following this call-site sequence would cause infinite descent in or (this is the same descent as in Eample 1.4, seen earlier). Otherwise, the call-site sequence contains infinitel man 1 s. Drop an initial occurrences of 2 and divide the remaining sequence into segments of the form 1(22) or 12(22). The size-change graphs show that the value of is strictl decreased on following 1 or 12 and weakl decreased on following (22). G 1 G 2 m(,) = if... 1 m(,-1) else 2 m(,-1) A possible (but awkward) ranking function for this program s termination is ρ m (, ) = ma{2 1, 2} with co-domain N. The reader ma like to verif that G 1 G 2

8 8 C. S. Lee for an,,, 0, ( and < ) or ( and < ) implies that ma{2 1, 2 } < ma{2 1, 2}. The ranking function does not directl reflect the size-change argument, as it is predicated on and holding natural number values. Eample 1.8. (Mster descent 2003) The final eample below demonstrates how size-change analsis applies different termination arguments across regular subsets of call-site sequences. Consider an infinite call-site sequence. If it ends in just 1 s (resp. 2 s), the size-change graph G 1 (resp. G 2 ) shows that following this call-site sequence would cause infinite descent in z (resp. w). Otherwise, the call-site sequence contains infinitel man 1 s and 2 s. Drop an initial occurrences of 2, and divide the remaining sequence into segments of the form (1 1)(2 2). Argue as in Eample 1.5 that following an such segment would cause a descent in. What is a ranking function for this program s termination? m(,,z,w) = if... 1 m(,-1,z-1,...) else 2 m(-1,,...,w-1) z w z w z w z w It has been pointed out to the author that for Eample 1.8 and similar programs, an leicographic tuple of linear functions over the parameters will not be suitable; even a tuple of functions constructed from linear operations, minimums, and maimums will not do the job. If forming leicographic tuples of minimums and maimums does not produce suitable ranking functions, how about taking minimum and maimum over leicographic tuples? Claim: ρ m (,, z, w) = ma{, z,, w }, with co-domain D 2 is a ranking function to show the termination of Eample 1.8, where the maimum is based on leicographic comparison. Proof. In a call from program state (m, (,, z, w)) to (m, (,, z, w )), either: (1) and < and z < z (if the call is due to call-site 1), or (2) < and and w < w (if the call is due to call-site 2). In the first case,, z <, z since and z < z, and, w <, z since <. It follows that ρ m (,, z, w ) = ma{, z,, w } <, z. But, z ma{, z,, w } = ρ m (,, z, w). Therefore, the value of ρ m after the call is strictl smaller than its value before the call. The same claim holds for the second case b smmetr. This article will prove, b construction, that an instance of size-change termination corresponds to a ranking function of a similar form. In general, each ρ f will be a (single) minimum over maimums of leicographic tuples containing parameters and constants. G 1 G 2

9 Ranking Functions for Size-Change Termination 9 This means that Eample 1.4 (permuted arguments) and 1.7 (mster descent 2001) can be shown to terminate b such ranking functions. In fact, for these eamples, the ranking functions can be of the same form as Eample 1.8, comprising of just a maimum over leicographic tuples. The reader is invited to work them out at this point. The solutions will be given in Section 5. Implications of the result. The ranking function corresponding to an instance of size-change termination has co-domain D k, ordered leicographicall. The value of k determines the induction principle able to support the size-change reasoning. An eas corollar attesting to the limits of size-change analsis: If a program is verified as terminating b size-change analsis and performs onl multipl recursive operations, then the function computed is multipl recursive. Given the size-change graphs for a program, the space of potential ranking functions corresponding to size-change termination is easil described. The onl variables are the length of the tuples and the constants the ma contain. Suitable values for these variables can be worked out from the number of size-change graphs and the maimum number of nodes in an graph. In principle, this space of functions can be tested to determine whether size-change analsis will succeed, although doing so is not sensible from a practical viewpoint. 1.2 Structure of the Paper The net section formalizes size-change termination analsis for a prototpical functional subject language. Sections 3 and 4 work towards a procedure which constructs, for a given instance of size-change termination, a corresponding ranking function. Section 3 considers the problem restricted to subject programs with a single function. It contains the main technical developments. The following section then accounts for the flowchart. Section 5 contains some concluding remarks. 2. SIZE-CHANGE TERMINATION ANALYSIS This section introduces the subject language, eplains the role of ranking functions in proving program termination, and formalizes size-change termination analsis. 2.1 The Subject Language The subject language is a standard minimal first-order functional language. Programs in this language are generated b the following grammar. Prg p ::= d 1... d N Dfn d ::= f( 1,..., K ) = e f Ep e ::= if e 1 then e 2 else e 3 op(e 1,..., e K ) c f(e 1,..., e K ) Par ::= parameter identifier Fun f ::= function identifier Op op ::= primitive operator A subject program p consists of a non-empt set of function definitions. A definition has the form f( 1,..., K ) = e f, where e f is called the bod of f. The number ar(f), called the arit of f, is K, which is assumed to be positive. Let Param(f) denote the set { 1,..., K }, the formal parameters of f. Operators that

10 10 C. S. Lee take no arguments are called constants. It is assumed that the operators, parameter identifiers, and function identifiers are pair-wise disjoint. Refer to the superscript c labeling the epression c f(e 1,..., e K ) as a call-site, and write c : g f if c occurs in the bod of g. For an subject program, the finite set of call-sites is denoted Sites. Let Par, Fun, and Op be respectivel the parameters, functions, and operators occurring in the program. Without loss of generalit, assume that the following hold. Each member of Fun is defined eactl once. Each member of Par is introduced eactl once (on the left-hand side of a definition). An use of a variable is in scope, i.e., an variable occurring on the right-hand side of a definition also occurs on the left. Finall, there are no arit problems, i.e., the number of formal and actual arguments for a function f is consistent throughout the program. Program semantics. A semantics for the subject program provides a means to evaluate an program function f given an assignment of values to its parameters. This is taken to mean evaluating the bod of f. Epression evaluation is based on a ver standard left-to-right call-b-value strateg, with eplicit error handling. Formall, let D be the set of data values, let D = D {, Err}, and use the flat lattice (D, ) as the semantic domain 2. Note that the semantic ordering is distinct from the ordering D on D discussed previousl; the two orderings should not be confused. The precise definition of D is not important for the result in this article, but it is supposed that D is infinite and forms a well-ordering with D. The strict part of D is denoted < D. For n N, write (n) D for the n-th smallest value of D under D. The evaluation of a subepression e in the bod of f with respect to value assignment v D ar(f) is obtained b appling the least fied point of a functional F, defined shortl, to e and v. A few auiliar functions are needed to define F. The injection lift : D D embeds D into D. Function O : Op D D, used for interpreting operations on D values, is not defined, but it is assumed that O[[op]] v, i.e., an primitive operation must terminate. The subject language is untped, so 0 and 1 are convenientl used to represent the boolean values of false and true. With such an encoding in mind, the semantic function cnd, used for interpreting if-epressions, is defined as follows. w 1 if w 1 =, w cnd w 1 w 2 w 3 = 2 if w 1 = lift 1 (signifing true), w 3 if w 1 = lift 0 (signifing false), Err otherwise. The function strictapp : (D D ) (D D ) below is for handling nonterminating or erroneous subcomputations in operations and function calls. For an tuple v = (v 1,..., v K ), write ( v) i for v i. { ψ v, if ( w)i = lift ( v) strictapp ψ w = i for each i, else ( w) i, where i is the least inde with ( w) i {, Err}. Finall, the functional F is defined. Its least fied point E : Ep D D eists since F is monotonic in the etension of to the domain of E. 2 This means for all w D, w w just when w = w or w =.

11 Ranking Functions for Size-Change Termination 11 λ E e u case e of Param(f) if e 1 then e 2 else e 3 op(e 1,..., e K ) c f(e 1,..., e K ) : lift ( u) i, where is the i-th parameter of f : cnd (E[[e 1 ]] u) (E[[e 2 ]] u) (E[[e 3 ]] u) : strictapp (O[[op]]) (E[[e 1 ]] u,..., E[[e K ]] u) : strictapp (E[[e f ]]) (E[[e 1 ]] u,..., E[[e K ]] u) Definition 2.1. (Termination) Let f Fun and v D ar(f). Refer to (f, v) as a program state of p. It is divergent if E[[e f ]] v =. Let St denote the set of all program states of p. Program p is terminating if St contains no divergent states. State transitions. The termination arguments considered in this article are based on function calls, so it makes sense to the formalize the possible function calls of the subject program as a transition sstem on the program states St and epress the termination problem in terms of the transition sstem. More terminolog: A program state s St has the form (f, v). If Param(f) is the i-th parameter of f, then the value of in s is ( v) i. Definition 2.2. Let Calls = St Sites St. (1) A transition relation is an subset of Calls. Refer to an element of as a state transition, and write s c s (read: s transits via c to s ) for (s, c, s ). (2) An infinite -chain is an infinite sequence of the form s 0 c 1 s 1 c 2 s 2..., also c 1 c 2 written as s 0 s 1 s 2..., such that s t 1 s t for t > 0. (3) The relation is well-founded if there does not eist an infinite -chain. The operator T below is used to derive the transition relation of the subject program. It maps a program epression e and a tuple of values u to a subset of Calls. This subset captures what are intuitivel the local function calls observed during evaluation of e with respect to u. In the following auiliar functions, w, ( w) i D and C i, ( C) i Calls. C 1 C 2, if w = lift 1 (signifing true), select w (C 1, C 2, C 3 ) = C 1 C 3, if w = lift 0 (signifing false), C 1, otherwise. strictarg w C = {( C) i j < i ( w) j = lift v for some v} For call-site c : g f and u, v D, let call( u, c, v) = ((g, u), c, (f, v)). The value of T [[e]] u is defined recursivel. First let w and C be such that ( w) i = E[[e i ]] u and ( C) i = T [[e i ]] u for each i. Then perform case analsis on the form of e. If e = Par, T [[e]] u = { }. If e = if e 1 then e 2 else e 3, T [[e]] u = select ( w) 1 C. If e = op(e 1,..., e K ), T [[e]] u = strictarg w C. If e = c f(e 1,..., e K ), T [[e]] u = strictarg w C {call( u, c, v) i lift ( v) i = ( w) i }. Definition 2.3. For the subject program p, let p = {T [[e f ]] v (f, v) St}. This relation is called the transition relation of p. Refer to an (s, c, s ) in p as a state transition of p, and write s c p s (read: s transits via c to s in p). c t

12 12 C. S. Lee The following claims formalize the intuition that the subject program s eecution is finite just when no infinite chain of function calls is possible. Their proofs are uninteresting and are deferred to the appendi. LEMMA 2.4. Let s = (f, v) St and e be a subepression in the bod of f. Evaluation E[[e]] v = just when T [[e]] v contains some (s, c, s ) with s divergent. Intuitivel, the evaluation of an epression diverges just when it makes a call that diverges. The lemma supports the following. LEMMA 2.5. If a program state is divergent, there eists an infinite p -chain that starts with it. COROLLARY 2.6. If p is well-founded, then p is terminating. In fact, the converse of Lemma 2.5 and Corollar 2.6 also hold, as eplained in the appendi. Thus, the termination of subject program p is formall reducible to the well-foundedness of its transition relation. It is this well-foundedness problem that is addressed b size-change analsis. Definition 2.7. Let be an transition relation and (W, W ) a well-ordering. A -ranking function into (W, W ) is a mapping ρ : St W such that ρ(s ) < W ρ(s) whenever s c s, where < W is the strict part of W. Recall that St = Fun D. In the remainder of the article, the notation ρ f (s) will be used to indicate that ρ is being applied to a state of the form (f, v), although in eamples, it is customar to appl ρ f directl to the argument tuple v. Clearl, the eistence of a p -ranking function implies the well-foundedness of p and consequentl the termination of program p. A straightforward approach to termination analsis is to derive somehow such a ranking function. 2.2 Size-Change Graphs and Their Semantics In this subsection, the size-change graph is formall defined, and it is eplained how a set of graphs is seen as specifing an over-approimation of p. Definition 2.8. A size-change graph for call-site c : g f is formall a triple consisting of source function g, target function f, and a digraph G c, described below. The triple is written as G c : g f or g Gc f. When g and f are unimportant or clear from contet, the ma be omitted. The nodes of G c consists of two partitions: a set of source nodes labeled b Param(g) and a set of target nodes labeled b Param(f). The arcs of G c, called size-change arcs, are directed from the source nodes to the target nodes. Each arc is labeled uniquel with either or =. An arc is therefore specified b a triple in Param(g) {, = } Param(f). Write γ G c if G c has an arc from source to target labeled with size-change γ. The arc is strict if γ =, else non-strict. Semanticall, a size-change arc signifies a relationship between a pair of data values. Recall that the data domain D forms a well-ordering with the relation D, whose strict part is < D. A size-change arc from to in G c asserts that for s c p s, the value u of in s is related to the value v of in s. If the arc is strict, v < D u, else v D u. This interpretation leads to a natural notion of what it means for a set G of size-change graphs to be safe for transition relation.

13 Ranking Functions for Size-Change Termination 13 Definition 2.9. (Safet of G) Let be an transition relation, and let G contain a size-change graph G c for each call-site c. (1) Let c : g f and suppose that s c s for s = (g, u) and s = (f, v). Now consider G c : g f, the size-change graph in G corresponding to call-site c. Let be the i-th parameter of f and the j-th parameter of g. A size-change arc G c is safe for (s, c, s ) of if ( v) i < D ( u) j. A size-change arc = G c is safe for (s, c, s ) of if ( v) i D ( u) j. (2) A size-change arc of G c is safe for if it is safe for ever (s, c, s ) of. (3) The graph G c : g f is safe for if ever arc of G c is safe for. (4) The set G is safe for if each graph of G is safe for. Call a unar operator destructive if an value that it returns is strictl smaller than its input. More formall, op is destructive if O[[op]]u = lift v implies that v < D u. For eample, tl and - 1 are destructive. The following is a simple and formall justifiable wa to construct a G that is safe for p. Let f(e 1,..., e K ) be the epression labeled b call-site c. Consider each argument epression e i in turn. Let be the i-th parameter of f. If e i is the application of one or more destructive operators to a parameter, e.g., - 1 or tl (tl ), include the arc in G c, and if e i is just the parameter, include the arc = in G c. A sntactic analsis like this is good enough to produce all the size-change graphs seen in Section 1 ecept the ones for Eample 1.6. To obtain those graphs, it is necessar to analze the conditions of if-epressions. In general, global program analsis ma be required to deduce a relation that holds between an argument epression and an input parameter. A safe set of size-change graphs G is an over-approimation of p in the following sense. Let G be the maimal subset of Calls for which G is safe. Then G can be identified with the transition relation G. Clearl, G is safe for p just when p is a subset of G. Refer to an (s, c, s ) in G as a G-transition, and write s c G s (read: s transits via c to s in G). Note that if s c G s, then G c is safe for (s, c, s ). The SCT condition. Size-change termination analsis is appealing because it is often eas to derive a safe G that contains sufficient information to prove the termination of the subject program p and because the problem of whether G is well-founded is decidable. Clearl, the well-foundedness of G implies the wellfoundedness of p, which implies the termination of p b Corollar 2.6. One wa to establish the well-foundedness of G is to look for a G -ranking function, a mapping ρ from the program states St to elements of a well-ordering (W, W ) such that if s c G s, then ρ(s ) < W ρ(s). However, the problem can be tackled without an reference to ranking functions. Definition (Multipaths and threads) Let G contain a size-change graph G c for each call-site c. (1) Call a (finite or infinite) call-site sequence cs = c 1 c 2... control-flow legal if for some sequence f 0, f 1, f 2,... of elements of Fun, each c t : f t 1 f t.

14 14 C. S. Lee (2) A G-multipath of a control-flow legal call-site sequence cs = c 1 c 2... c t... is a sequence of the form: G c1 G c2 M cs = f 0 f1 f2... Gc t f t... G ct where f t 1 ft G for each t > 0. The multipath is usuall regarded a digraph. The node set of this digraph consists of partitions, one for each value of t; the nodes within partition t are labeled b Param(f t ). There is a γ-labeled arc in the digraph from node in partition (t 1) to node in partition t just when γ G ct. For a pictorial representation, see Figure 1 or Figure 2. (3) A path in M cs (regarded as a digraph) is called a thread. A thread does not have to start at the beginning of the multipath, i.e., from a node in partition 0. Suppose that it starts from a node in partition d. Then it has the form: γ 1 γ 2 th = γt t... γ t where t 1 t G cd+t for each t > 0. The thread is maimal if it is a maimal path in M cs and complete if it starts at the beginning of the multipath and is as long as the multipath. It is descending if it contains a strict arc and has infinite descent if it contains infinitel man strict arcs. (4) Multipath M cs has infinite descent if it has a thread with infinite descent. Since the graph in G for call-site c represents an s c G s, a G-multipath can be seen as representing a set of G -chains. The notion of unrealizable G -chains motivates the following. Definition Let G contain a size-change graph G c for each call-site c. Then G satisfies the SCT propert (or simpl, is SCT) if ever infinite G-multipath has infinite descent. In the remainder of this section, it will be shown that the SCT propert is decidable and that G is SCT just when G is well-founded. Consequentl, it can be decided whether G is well-founded. If G is safe for p, the transition relation of the subject program p, then G is an over-approimation of p. A successful verification of the well-foundedness of G implies the well-foundedness of p and hence the termination of p. 2.3 Deciding SCT via ω-automata One wa to decide whether G satisfies the SCT propert involves manipulating ω-automata. Below, some basic theor is reviewed. Definition (Büchi automata) (1) A Büchi automaton (BA) is a tuple B = (Q, Σ, q 0, Q, A Q ), where Q is a finite set called states, Σ is a finite set called the alphabet, q 0 Q is the initial state, and A Q S is the set of accepting states. The transition relation is the set Q Q Σ Q. The elements of this set are called transition triples, or simpl transitions.

15 Ranking Functions for Size-Change Termination 15 (2) The transition relation Q is deterministic if for ever r Q and a Σ, there is at most one r Q such that (r, a, r ) Q. An automaton is deterministic if its transition relation is deterministic. (3) A run of B on a (finite or infinite, but non-empt) word w = a 1 a 2... is a sequence of states ϱ = r 0 r 1 r 2... such that (r t 1, a t, r t ) Q for each t > 0. The word w is said to label ϱ. It is also called a labeling of ϱ. The run ϱ enters an accepting state if r t A Q for some t > 0. B convention, a run has at least two states. For t 0 < t 1, call r t0... r t1 a sub-run of ϱ. For t 0 < t 1 < t 2, the sub-runs r t0... r t1 and r t1... r t2 are consecutive. (4) Denote b inf (ϱ) the set of states occurring infinitel in ϱ. (5) The run ϱ is tail-accepting if inf (ϱ) A Q { }, i.e., some accepting state occurs infinitel in ϱ. It is accepting if it is tail-accepting and starts with q 0. (6) The set of words L ω (B) = {w some run on w is accepting} is called the language accepted b B. The set of all infinite words is denoted Σ ω. A subset L of Σ ω is called ω-regular if L = L ω (B) for some (not necessaril deterministic) Büchi automaton B. There eists a non-deterministic BA whose language is not accepted b an deterministic BA, which eplains wh, in the definition of ω-regularit, it is emphasized that the BA is not necessaril deterministic. However, an non-deterministic BA can be determinized as a Rabin automaton (RA). In other words, given an BA, it is possible to build an RA with a deterministic transition relation that accepts the same language [Safra 1988; Muller and Schupp 1995; Althoff et al. 2005]. Definition (Rabin automata) (1) A Rabin automaton (RA) is a tuple R = (R, Σ, q 0, R, Ω R ) where the first four components are the same as for a BA. The acceptance condition is specified b Ω R, which is a set of acceptance pairs. An acceptance pair has the form (E, F ), where E, called a miss set, and F, called a hit set, are subsets of R. The automaton is deterministic if its transition relation is deterministic. (2) A run of R on an infinite word w = a 1 a 2... is defined as for a BA. A run ς is tail-accepting if for some acceptance pair (E, F ), inf (ς) E = { } and inf (ς) F { }, i.e., ς eventuall misses all the states of the miss set and infinitel hits some state of the hit set. The run is accepting if it is tail-accepting and starts with q 0. (3) The set of words L ω (R) = {w some run on w is accepting} is called the language accepted b R. THEOREM ([Vardi 1996]) Suppose that B 1, B 2 are Büchi automata. Let L 1 = L ω (B 1 ) and L 2 = L ω (B 2 ). It is possible to construct Büchi automata to accept the following languages: L 1 L 2, L 1 L 2, Σ ω \ L 1, and it can be checked algorithmicall whether L 1 is empt. Deciding SCT. There is a decision procedure for SCT based on the fact that the following sets of call-site sequences are ω-regular. FLOW = {cs cs is control-flow legal} DESC = {cs 0 cs 1 cs 0 Sites, M cs1 has complete thread with infinite descent}

16 16 C. S. Lee Consider the BA B fl = (Fun {q fl 0 }, Sites, qfl 0, fl, Fun), where q fl 0 is a distinguished start state, and fl contains (q fl 0, c, f), if c : g f for some g, and (g, c, f), if c : g f. It is a simple eercise to show that B fl accepts FLOW. For DESC, build a BA such that an accepting run eventuall traces out a thread in some multipath. To allow the run to reflect size changes seen in the thread, a state of the automaton will be a pair consisting of a program parameter and a size change γ {, = }. The run will be accepting onl if the corresponding thread has infinite descent. Specificall, define B de = (Q de, Sites, q0 de, de, A de ), where q0 de is a distinguished start state, Q de = (Par {, = }) {q0 de }, A de = Par { }, and de contains the following triples: (q de 0, c, q de 0 ), for c Sites, (q de 0, c, (, γ)), if γ G c for some, and ((, δ), c, (, γ)), if γ G c and δ {, = }. It is a simple eercise to show that B de has an accepting run on cs just when cs can be written as cs 0 cs 1, where cs 0 is a finite call-site sequence, and M cs1 has a complete thread with infinite descent. It follows that the BA accepts DESC. THEOREM It is decidable whether G satisfies SCT. Proof. Construct the automata for FLOW and DESC. Then construct the BA that accepts FLOW \ DESC = FLOW (Sites ω \ DESC ), which is possible b Theorem Call it B. Clearl, B accepts cs just when cs is control-flow legal and M cs has no infinite descent, i.e., just when SCT is violated. It follows that G is SCT just when L ω (B) is empt. B Theorem 2.14, it can be checked algorithmicall whether L ω (B) is empt. 2.4 Ranking Functions and SCT It is now time to connect the satisfaction of SCT b G with the eistence of a G -ranking function. THEOREM G is SCT just when G is well-founded. Proof. (Soundness) Suppose that G is SCT but there is an infinite G -chain s 0 c 1 s 1 c 2 s A contradiction will be derived. First, note that cs = c 1 c 2... must be control-flow legal, so M cs is a G-multipath. Since G satisfies SCT, M cs has a thread: γ 1 γ 2 th = γt t..., γ t where t 1 t G cd+t for each t > 0, and γ t = for infinitel man values of t. Recall that d 0 indicates the start position of th in M cs. For t 0, let v t be the value of t in program state s d+t. Then for t > 0, it follows from (s d+t 1, c d+t, s d+t ) G that v t < D v t 1 if γ t = and v t D v t 1 if γ t = =. As γ t = for infinitel man values of t, the well-foundedness of relation < D is violated. (Completeness) Suppose that G is not SCT. It will be eplained how an infinite G -chain can be defined.

17 Ranking Functions for Size-Change Termination 17 In the proof of Theorem 2.15, it was seen that FLOW \DESC is ω-regular. As G does not satisf SCT, there is a control-flow legal call-site sequence whose multipath has no infinite descent. It follows that FLOW \ DESC is non-empt. It is wellknown that a non-empt ω-regular set contains a word of the form cs = cs 0 cs ω 1, where cs 0, cs 1 are finite words, and cs is the concatenation of cs 0 with infinitel man repetitions of cs 1. Note that M cs is a multipath with no infinite descent. An infinite G -chain can be defined b assigning D values to the nodes of M cs in a wa that respects the size-change arcs of M cs. Instead of directl assigning D values, natural numbers can be used. A number n will then be interpreted as (n) D, the n-th smallest element of D. An assignment to the nodes of a multipath which respects the arcs of the multipath will be called consistent. G c1 G c2 Let M cs = f 0 f1 f2.... As a digraph, the nodes of this multipath consists of infinitel man partitions, with the nodes of partition t labeled b Param(f t ), for t 0. Let the length of cs 0 be n 0 and suppose that numbers have been assigned consistentl to the nodes of M (cs1) ω. Then the same numbers can be assigned to the nodes of M cs starting from partition n 0. Let the maimum number assigned to the nodes of partition n 0 be m. For 0 t < n 0, assigning all the nodes of partition t the number m + (n 0 t) is consistent and completes the job. Can numbers be assigned consistentl to the nodes of M cs ω 1? Note that the multipath M cs1 has to start and end at the same program function. Consider the digraph M cs 1, obtained b identifing each node at the end of M cs1 with the node labeled b the same parameter at the start of the multipath, i.e., b directing the arcs between the final two partitions of M cs1 to the nodes at the start of the multipath. Clearl an consistent assignment to the nodes of M cs 1 implies a consistent assignment to the nodes of M cs ω 1. Now, M cs 1 cannot contain an ccle with a strict arc, for otherwise M cs ω 1 would have a thread with infinite descent. This means that the nodes in each strongl connected component of M cs 1 are connected to one another b non-strict arcs. It is possible to arrange the SCCs of M cs 1 in reverse topological order [Cormen et al. 2001]. Let C 1,..., C N be such an ordering. Then an strict arc from a node of C i to a node of C j implies that j < i. For each node in C i, assign it the number i. This assignment is consistent. COROLLARY Let G be a set of size-change graphs that is safe for p, the transition relation of the subject program p. If G is SCT, then p is terminating. Proof. Suppose that G satisfies SCT. B Theorem 2.16, G is well-founded. B assumption, G is safe for p, so p is a subset of G. It follows that p is well-founded. Finall, b Corollar 2.6, subject program p is terminating. The strateg of size-change analsis is now plain. From the subject program p, derive a set of size-change graphs G whose transition relation over-approimates the transition relation of p, then test the well-foundedness of the larger transition relation b checking SCT. If the test succeeds, the termination of p is verified. There is another test of the SCT propert that does not involve ω-automata [Lee et al. 2001]. This test is possibl more suited for implementation [Frederiksen 2001; Wahlstedt 2000; Thiemann and Giesl 2003; Jones and Bohr 2004]. However, it is the ω-automaton approach that is relevant to the result in this article.

18 18 C. S. Lee z 1 z 2 z 3 7 z 1 z 2 z 3 z 1 z 2 z 3 z 1 z 2 z 3 z 1 z 2 z1 7 z 2 z 3 z 3 G 1 : m m G 2 : m m G 3 : m m Fig. 3. Mster descent 2005, with strict arcs onl The problem, defined. Let G be a given set of size-change graphs. For succinctness, refer to a G -ranking function as a G-ranking function. The problem tackled in this article can now be stated as follows: Given that G satisfies SCT, is there a wa to construct a G-ranking function? If G is safe for p, the transition relation of the subject program p, the constructed ranking function is automaticall a p -ranking function. 3. RESTRICTED PROBLEMS As a stepping-stone to the main result of this article a procedure for constructing G-ranking functions a ver simple restricted problem will first be considered. This is followed b a review of a BA determinization procedure [Althoff et al. 2005], needed in the correctness proof of a more comple ranking-function construction. 3.1 Strict Arcs Onl Throughout this subsection, it will be assumed that G is a set of size-change graphs with the following properties: (1) There is onl one program function, denoted f. For an call-site c, G c : f f. (2) The size-change graphs of G have onl strict arcs. (3) G satisfies SCT. Eample 3.1. (Mster descent 2005) Such a restricted G, due to Amir Ben-Amram, is depicted in Figure 3. Now, consider an infinite G-multipath M = m Gc 1 m Gc 2 m.... Define a sequence of parameters as follows: Let 0 = z i where i {1, 2, 3} \ {c 1 }, and for each t > 0, let t = z i where i {1, 2, 3} \ {c t, c t+1 }. It is a simple matter to verif that is a complete thread in M. Consequentl, M has infinite descent, and G satisfies SCT. So what function of the parameter values decreases for ever state transition of G? Ben-Amram made the fascinating observation that the median of the parameter values alwas decreases. A more general development follows. Definition 3.2. Let c Sites. (1) For Par, let down c () = { G c }. (2) For X Par, let down c (X) = X down c().