Model-Checking Higher-Order Programs with Recursive Types

“…While HORS generalizes finite-state and pushdown systems, its model checking problem remains decidable while in this ideal setting of simply-type λ-calculus and finite base types [Kobayashi 2009b;Ong 2006]; however, there remains a significant gulf between this and real-world language features. Other work has broadened the applicability of this approach to cases [Neatherway et al 2012], to untyped languages [Kobayashi and Igarashi 2013;Tsukada and Kobayashi 2010], and to infinite data domains such as integers and algebraic datatypes [Kobayashi et al 2011;Ong and Ramsay 2011]. The complexity of higher-order model checking is n-EXPTIME-hard [Kobayashi and Ong 2009] but practical progress has lead to engines which can handle checking some "small but tricky … functional programs in under a second" [Kobayashi 2009a].…”

Section: Higher-order Model Checkingmentioning

confidence: 99%

Soft contract verification for higher-order stateful programs

Nguyen

Gilray

Tobin-Hochstadt

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Software contracts allow programmers to state rich program properties using the full expressive power of an object language. However, since they are enforced at runtime, monitoring contracts imposes significant overhead and delays error discovery. Soft contract verification aims to guarantee all or most of these properties ahead of time, enabling valuable optimizations and yielding a more general assurance of correctness. Existing methods for static contract verification satisfy the needs of more restricted target languages, but fail to address the challenges unique to those conjoining untyped, dynamic programming, higher-order functions, modularity, and statefulness. Our approach tackles all these features at once, in the context of the full Racket system-a mature environment for stateful, higher-order, multi-paradigm programming with or without types. Evaluating our method using a set of both pure and stateful benchmarks, we are able to verify 99.94% of checks statically (all but 28 of 49, 861).Stateful, higher-order functions pose significant challenges for static contract verification in particular. In the presence of these features, a modular analysis must permit code from the current module to escape permanently to an opaque context (unspecified code from outside the current module) that may be stateful and therefore store a reference to the escaped closure. Also, contracts themselves, being predicates written in unrestricted Racket, may exhibit stateful behavior; a sound approach must be robust to contracts which are arbitrarily expressive and interwoven with the code they monitor. In this paper, we present and evaluate our solution based on higher-order symbolic execution, explain the techniques we used to address such thorny issues, formalize a notion of behavioral approximation, and use it to provide a mechanized proof of soundness.

show abstract

“…Subsequently, an untyped variant of HORS has been developed (Tsukada and Kobayashi, 2010), which has applications to languages with more advanced type systems, but despite the name it does not led to a model checking procedure for the untyped λ-calculus. A subclass of untyped HORS is the class of recursively typed recursion schemes, which has applications to typed object-oriented programs (Kobayashi and Igarashi, 2013). In this setting, model checking is undecidable, but relatively complete with a certain recursive intersection type system (anything typeable in this system can be verified).…”

Section: Model Checking Higher Order Recursion Schemesmentioning

confidence: 99%

Higher order symbolic execution for contract verification and refutation

2016

View full text Add to dashboard Cite

We present a new approach to automated reasoning about higher-order programs by endowing symbolic execution with a notion of higher-order, symbolic values.To validate our approach, we use it to develop and evaluate a system for verifying and refuting behavioral software contracts of components in a functional language, which we call soft contract verification. In doing so, we discover a mutually beneficial relation between behavioral contracts and higher-order symbolic execution. Contracts aid symbolic execution by providing a rich language of specifications that can serve as the basis of symbolic higher-order values; the theory of blame enables modular verification and leads to the theorem that verified components can't be blamed; and the run-time monitoring of contracts enables soft verification whereby verified and unverified components can safely interact and verification is not an all-or-nothing proposition. Conversely, symbolic execution aids contracts by providing compile-time verification which increases assurance and enables optimizations; automated test-case generation for contracts with counter-examples; and engendering a virtuous cycle between verification and the gradual spread of contracts.Our system uses higher-order symbolic execution, leveraging contracts as a source of symbolic values including unknown behavioral values, and employs an updatable heap of contract invariants to reason about flow-sensitive facts. Whenever a contract is refuted, it reports a concrete counterexample reproducing the error, which may involve solving for an unknown function. The approach is able to analyze first-class contracts, recursive data structures, unknown functions, and control-flow-sensitive refinements of values, which are all idiomatic in dynamic languages. It makes effective use of an offthe-shelf solver to decide problems without heavy encodings. Our counterexample search is sound and relatively complete with respect to a first-order solver for base type values. Therefore, it can form the basis of automated verification and bug-finding tools for higher-order programs. The approach is competitive with a wide range of existing tools-including type systems, flow analyzers, and model checkers-on their own benchmarks. We have built a tool which analyzes programs written in Racket, and report on its effectiveness in verifying and refuting contracts. Higher-order symbolic execution for contract verification and refutation3 what a modular analysis means in this setting is tricky, but again contracts provide the answer. By re-using the concept of blame from Findler and Felleisen (2002), we define the errors that we rule out as exactly those that blame the portion of the program under consideration. This crucial distinction will become especially important when considering the behavior of unknown higher-order values.To demonstrate the first step in applying our approach, consider the following contrived, but illustrative example. Let positive? and negative? be predicates for positive and negative integers. Contracts ...

show abstract

Model-Checking Higher-Order Programs with Recursive Types

Cited by 23 publications

References 30 publications

From Linear Types to Behavioural Types and Model Checking

From Linear Types to Behavioural Types and Model Checking

Soft contract verification for higher-order stateful programs

Higher order symbolic execution for contract verification and refutation

Contact Info

Product

Resources

About