Higher-order multi-parameter tree transducers and recursion schemes for program verification

Abstract

We introduce higher-order, multi-parameter, tree transducers (HMTTs, for short), which are kinds of higher-order tree transducers that take input trees and output a (possibly infinite) tree. We study the problem of checking whether the tree generated by a given HMTT conforms to a given output specification, provided that the input trees conform to input specifications (where both input/output specifications are regular tree languages). HMTTs subsume higher-order recursion schemes and ordinary tree transducers, so that their verification has a number of potential applications to verification of functional programs using recursive data structures, including resource usage verification, string analysis, and exact type-checking of XML-processing programs.We propose a sound but incomplete verification algorithm for the HMTT verification problem: the algorithm reduces the verification problem to a model-checking problem for higher-order recursion schemes extended with finite data domains, and then uses (an extension of) Kobayashi's algorithm for model-checking recursion schemes. While the algorithm is incomplete (indeed, as we show in the paper, the verification problem is undecidable in general), it is sound and complete for a subclass of HMTTs called linear HMTTs. We have applied our HMTT verification algorithm to various program verification problems and obtained promising results.

Verification of tree-processing programs via higher-order mode checking

“…The soundness of the latter step is shown by Kobayashi et al (2010). We prove the soundness of the former step below.…”

“…In Kobayashi et al (2010), we have presented a (sound but incomplete) verification method for the restricted case (which we call HMTT verification problems), where P is an HMTT (i.e., for the case, where P does not contain coerce L (·)). In the next section, we reduce an EHMTT verification problem to HMTT verification problems.…”

Higher-Order Model Checking: From Theory to Practice

“…Kobayashi et al [31] introduced a restricted class of higher-order treeprocessing programs called higher-order multi-parameter tree transducers, and proposed a method to verify that treeprocessing programs conform to input and output specifications. They [43] later extended the method to handle arbitrary tree-processing functional programs, by requiring user annotations on certain invariants.…”

“…According to experiments, the stateof-the-art higher-order model checker TRECS [23] can check many recursion schemes consisting of a few hundred function definitions in a few seconds, but that is not sufficient in the context of applications to program verification [30,31], as higher-order recursion schemes obtained from source programs are typically larger than the source programs. As for algorithms, the new fixed-parameter linear time algorithm [26] is attractive but requires further investigation, as the current implementation is actually much slower than TRECS for many inputs.…”

“…Secondly, a new algorithm for higher-order model checking has been found [22], which does not always suffer from the n-EXPTIME bottleneck. A higher-order model checker TRECS [23] has been implemented based on the new algorithm, and is used as the core of recent verification tools for functional programs [30,31].…”