Proving Non-termination Using Max-SMT Daniel Larraz 1 , Kaustubh Nimkar 2 , Albert Oliveras 1 , Enric Rodr´ ıguez-Carbonell 1 , and Albert Rubio 1 1 Universitat Polit` ecnica de Catalunya, Barcelona 2 University College London Abstract. We show how Max-SMT-based invariant generation can be exploited for proving non-termination of programs. The construction of the proof of non- termination is guided by the generation of quasi-invariants – properties such that if they hold at a location during execution once, then they will continue to hold at that location from then onwards. The check that quasi-invariants can indeed be reached is then performed separately. Our technique considers strongly con- nected subgraphs of a program’s control flow graph for analysis and thus pro- duces more generic witnesses of non-termination than existing methods. More- over, it can handle programs with unbounded non-determinism and is more likely to converge than previous approaches. 1 Introduction While the problem of proving program termination has now been extensively studied [1–22], relatively less work has been done on proving non-termination of programs. In this paper we present a new method for proving non-termination of sequential non-deterministic programs that leverages Max-SMT-based invariant generation [23, 24]. Our method analyses each Strongly Connected SubGraph (SCSG) of a program’s control flow graph and, by means of Max-SMT solving, tries to find a formula at every node of the SCSG that satisfies certain properties. First, the formula has to be a quasi- invariant, i.e, it must satisfy the consecution condition of inductive invariants, but not necessarily the initiation condition. Hence, if it holds at the node during execution once, then it continues to hold from then onwards. Second, the formula has to be edge-closing, meaning that it forbids taking any of the outgoing edges from that node that exit the SCSG. Now, once we have computed an edge-closing quasi-invariant for every node of the SCSG, if a state is reached that satisfies one of them, then program execution will remain within the SCSG from then onwards. The existence of such a state is tested with an off-the-shelf reachability checker. If it succeeds, we have proved non-termination of the original program, and the edge-closing quasi-invariants of the SCSG and the trace given by the reachability checker form the witness of non-termination. Our approach differs from previous methods in two major ways. First, edge-closing quasi-invariants are more generic properties than non-termination witnesses produced by other provers, and thus are likely to carry more information and be more useful in bug finding. Second, our non-termination witnesses include SCSGs, which are larger structures than, e.g., lassos. Note that the number of SCSGs present in any CFG is