Automatically Proving the Termination of Functional Programs

ion of the actual system. We use CCGs to perform a local analysis which, if successful, can determine that the definitions terminate. To do this, we start by assigning calling context measures to contexts in the CCG. 8.4 Calling Context Measures and Termination Definition 8.4.1. Given a calling context, c = 〈f,G, e〉, and a set S ⊆ Val , the set of calling context measures (CCMs) for c over S, denoted CCM c S is the set {e ∈ Expr | 〈∀ ∈ Env : Hh JGK : free(e) ⊆ {xf1 , . . . x f ar(f)} ∧ JeK h ∈ S〉}. CCMs simply map the parameters of a function into some set. We annotate CCGs with CCMs using a CCM annotation. Definition 8.4.2. Given a set of calling contexts, C, and a set, S ⊆ Val , a CCM annotation for C over S is a function m : C → P(Expr) such that 〈∀c ∈ C :: m(c) ⊆ CCM c S〉. Now we create a mechanism for comparing the CCM of two adjacent contexts in a CCG. Definition 8.4.3. Let G = (C,E) be a CCG with e = 〈c1, c2〉 ∈ E, such that c1 = 〈f1, G1, e1〉 and c2 = 〈f2, G2, e2〉, where e1 = (f2 e1,1 . . . e1,ar(f2)). Let 〈S,≺〉 be a wellfounded structure, and m : C → P(Expr) be a CCM annotation for C over S. Then a CCM function (CCMF) for e with annotation m and order ≺ is a function φc1 c2 : m(c1)×m(c2)→ {>,≥,×} such that φ(s1, s2) = > only if 〈∀ ∈ Env : 〈∀i : 1 ≤ i ≤ ar(f2) : Je1,iK 6= ⊥〉 ∧ H JG1 ∪G2σe1K : Js1K Js2σe1K 〉 and φ(s1, s2) = ≥ only if 〈∀ ∈ Env : 〈∀i : 1 ≤ i ≤ ar(f2) : Je1,iK 6= ⊥〉 ∧ H JG1 ∪G2σe1K : Js1K Js2σe1K 〉. We represent CCM functions for 〈c1, c2〉 graphically with a box containing the CCMs for c1, c2 on the left and right, respectively. An edge is drawn from s1, a left CCM, to s2, a right CCM, with the label φ(s1, s2) iff it is > or ≥. If φ(s1, s2) is ×, no edge is drawn. We now consider some examples. For the function f in Figure 23 on page 85, we use the acl2-count function in Figure 25 on the next page applied to f’s parameter, x, as the only CCM for both contexts. The range of acl2-count is the set of natural numbers, and the function is designed to mirror common induction schemes, e.g., induction on the size of a list. Notice that for each context in our example, the CCM decreases for all values