ICE-Based Refinement Type Discovery for Higher-Order Functional Programs

Champion, Adrien; Chiba, Tomoya; Kobayashi, Naoki; Satô, Ryôsuke

doi:10.1007/978-3-319-89960-2_20

Cited by 32 publications

(37 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The example can be fully automatically and promptly verified by our approach using HoIce [12,11] as the back-end CHC solver; see § 4.…”

Section: Advanced Examplesmentioning

confidence: 99%

“…Both RustHorn and SeaHorn generated CHCs sufficiently fast (about 0.1 second for each program). After that, we measured the time of CHC solving by Spacer [40] in Z3 (version 4.8.7) [69] and HoIce (version 1.8.1) [12,11] for the generated CHCs. SeaHorn's outputs were not accepted by HoIce, especially because SeaHorn generates CHCs with arrays.…”

Section: Benchmarks and Experimentsmentioning

confidence: 99%

“…It is related to a continuation introduced by letcont in λ Rust 11. Here 'syntactically' means that detailed information such that a branch condition on match or non-termination is ignored 12.…”

mentioning

confidence: 99%

See 2 more Smart Citations

RustHorn: CHC-Based Verification for Rust Programs

Matsushita¹,

Tsukada²,

Kobayashi³

2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Reduction to the satisfiablility problem for constrained Horn clauses (CHCs) is a widely studied approach to automated program verification. The current CHC-based methods for pointer-manipulating programs, however, are not very scalable. This paper proposes a novel translation of pointer-manipulating Rust programs into CHCs, which clears away pointers and heaps by leveraging ownership. We formalize the translation for a simplified core of Rust and prove its correctness. We have implemented a prototype verifier for a subset of Rust and confirmed the effectiveness of our method. 17 The first character of each variable indicates the pointer kind (o/m corresponds to own/mutα). We swap the branches of the match statement in take-max, to fit the order to C/Rust's if.

show abstract

“…The example can be fully automatically and promptly verified by our approach using HoIce [12,11] as the back-end CHC solver; see § 4.…”

Section: Advanced Examplesmentioning

confidence: 99%

Section: Benchmarks and Experimentsmentioning

confidence: 99%

See 1 more Smart Citation

RustHorn: CHC-Based Verification for Rust Programs

Matsushita¹,

Tsukada²,

Kobayashi³

2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Its effectiveness for software model checking is now widely appreciated. For example, the SMT solver Z3 [29] comes with a Horn-clause solver Spacer [21] that uses PDR internally; Horn-clause solving is one of the cutting-edge techniques to verify functional programs [6,8,17] and programs with loops [6].…”

Section: Introductionmentioning

confidence: 99%

Generalized Property-Directed Reachability for Hybrid Systems

Suenaga¹,

Ishizawa²

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Generalized property-directed reachability (GPDR) belongs to the family of the model-checking techniques called IC3/PDR. It has been successfully applied to software verification; for example, it is the core of Spacer, a state-of-the-art Horn-clause solver bundled with Z3. However, it has yet to be applied to hybrid systems, which involve a continuous evolution of values over time. As the first step towards GPDRbased model checking for hybrid systems, this paper formalizes HGPDR, an adaptation of GPDR to hybrid systems, and proves its soundness. We also implemented a semi-automated proof-of-concept verifier, which allows a user to provide hints to guide verification steps.

show abstract

“…The algorithm we design for learning decision trees builds on top of a learning algorithm recently proposed by Ezudheen et al [4], which learns from data in form of Horn clauses. For this setting, other learning algorithms have been developed as well [11], [12]. We have chosen Ezudheen et al's algorithm specifically for its property to guarantee convergence to a solution in many practical scenarios.…”

Section: Introductionmentioning

confidence: 99%

Learning-Based Synthesis of Safety Controllers

Neider

Markgraf

2019

2019 Formal Methods in Computer Aided Design (FMCAD)

View full text Add to dashboard Cite

We propose a machine learning framework to synthesize reactive controllers for systems whose interactions with their adversarial environment are modeled by infinite-duration, two-player games over (potentially) infinite graphs. Our framework targets safety games with infinitely many vertices, but it is also applicable to safety games over finite graphs whose size is too prohibitive for conventional synthesis techniques. The learning takes place in a feedback loop between a teacher component, which can reason symbolically about the safety game, and a learning algorithm, which successively learns an approximation of the winning region from various kinds of examples provided by the teacher. We develop a novel decision tree learning algorithm for this setting and show that our algorithm is guaranteed to converge to a reactive safety controller if a suitable approximation of the winning region can be expressed as a decision tree. Finally, we empirically compare the performance of a prototype implementation to existing approaches, which are based on constraint solving and automata learning, respectively.

show abstract

ICE-Based Refinement Type Discovery for Higher-Order Functional Programs

Cited by 32 publications

References 30 publications

RustHorn: CHC-Based Verification for Rust Programs

RustHorn: CHC-Based Verification for Rust Programs

Generalized Property-Directed Reachability for Hybrid Systems

Learning-Based Synthesis of Safety Controllers

Contact Info

Product

Resources

About