A relational logic for higher-order programs

Abstract

Relational program veri cation is a variant of program veri cation where one can reason about two programs and as a special case about two executions of a single program on di erent inputs. Relational program veri cation can be used for reasoning about a broad range of properties, including equivalence and re nement, and specialized notions such as continuity, information ow security or relative cost. In a higher-order se ing, relational program veri cation can be achieved using relational re nement type systems, a form of re nement types where assertions have a relational interpretation. Relational re nement type systems excel at relating structurally equivalent terms but provide limited support for relating terms with very di erent structures.We present a logic, called Relational Higher Order Logic (RHOL), for proving relational properties of a simply typed λ-calculus with inductive types and recursive de nitions. RHOL retains the type-directed avour of relational re nement type systems but achieves greater expressivity through rules which simultaneously reason about the two terms as well as rules which only contemplate one of the two terms. We show that RHOL has strong foundations, by proving an equivalence with higher-order logic (HOL), and leverage this equivalence to derive key meta-theoretical properties: subject reduction, admissibility of a transitivity rule and set-theoretical soundness. Moreover, we de ne sound embeddings for several existing relational type systems such as relational re nement types and type systems for dependency analysis and relative cost, and we verify examples that were out of reach of prior work. ACM Reference format:Contributions. We present a new logic, called Relational Higher Order Logic (RHOL, § 5), for reasoning about relational properties of higher-order programs wri en in a variant of Plotkin's PCF ( § 2). e logic manipulates judgments of the form:where Γ is a simply typed context, σ 1 and σ 2 are (possibly di erent) simple types, t 1 and t 2 are terms, Ψ is a set of assertions, and ϕ is an assertion. Our logic retains the type-directed nature of (relational) re nement type systems, and features typing rules for reasoning about structurally similar terms. However, disentangling types from assertions also makes it possible to de ne type-directed rules operating on a single term (le or right) of the judgment. is confers great expressivity to the logic, without signi cantly a ecting its type-directed nature, and opens the possibility to alternate freely between two-sided and one-sided reasoning, as done in rst-order imperative languages. e validity of judgments is expressed relative to a set-theoretical semantics-our variant of PCF is restricted to terms which admit a set-theoretical semantics, including strongly normalizing terms. More precisely, a judgment Γ | Ψ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | ϕ is valid if for every valuation ρ (mapping variables in the context Γ to elements in the interpretation of their types), the interpretation of ϕ is true whenever the interpretation of (a...

Monadic refinements for relational cost analysis

“…Since cost analysis often depends on functional properties, U C builds-in an expressive program logic using the assertions of L C . In this aspect, U C is inspired by UHOL, a program logic/refinement type system for proving functional properties of pure expressions [Aguirre et al 2017b]. U C uses two judgments:…”

“…The first judgment, also called the pure judgment, is based on RHOL [Aguirre et al 2017b] and means that under assumptions Ψ, e 1 (of simple type τ 1 ) and e 2 (of simple type…”

“…Aguirre et al [2017b] present a translation of RelCost directly into RHOL. However, since RHOL lacks a specific treatment of cost, that translation encodes an expression's cost as a second output of the expression, resulting in a substantially more complex encoding and one in which the cost is an ordinary value, not an effect.…”

“…Our current framework, like the framework RHOL/UHOL [Aguirre et al 2017b] it builds on, does not support mutable state. However, we believe that it is possible to extend both the underlying framework (without costs) and our development (with costs) to stateful programs.…”

“…Here, we choose to build on a recent, theoretically lightweight but expressive logic, RHOL [Aguirre et al 2017b]. RHOL is a syntax-directed relational program/refinement logic for a simply typed variant of PCF.…”