Regular language type inference with term rewriting

Abstract

This paper defines a new type system applied to the fully automatic verification of safety properties of treeprocessing higher-order functional programs. We use term rewriting systems to model the program and its semantics and tree automata to model algebraic data types. We define the regular abstract interpretation of the input term rewriting system where the abstract domain is a set of regular languages. From the regular abstract interpretation we derive a type system where each type is a regular language. We define an inference procedure for this type system which allows us check the validity of safety properties. The inference mechanism is built on an invariant learning procedure based on the tree automata completion algorithm. This invariant learning procedure is regularly-complete and complete in refutation, meaning that if it is possible to give a regular type to a term then we will eventually find it, and if there is no possible type (regular or not) then we will eventually find a counterexample. CCS Concepts: • Software and its engineering → Formal software verification; Functional languages; Automated static analysis.

Pattern Eliminating Transformations

“…Thus, while providing sometimes a more precise characterization of the approximations of the normal forms, these techniques are constrained, in terms of termination, by some syntactical conditions. When testing 5 of our base case scenarios with two popular implementations, Timbuk3 [14] seems less powerful than our approach, while Timbuk4 [18] can check more systems but less eciently than our approach. For Timbuk3, the over-approximation strategies were to broad to check all considered examples.…”

“…This was, for example, the case for a rewritten version of the attening TRS which avoided the nested function calls, in order to build a TRS of a known terminating class for automata completion without approximation [15]. Timbuk4, recently proposed to use a counter-example based abstraction renement procedure to control the over-approximation [18], could check all the examples including a version of the attening TRS which could not be veried with our current approach. On the other hand, the computational performance is considerably worse than for our approach (∼ 700ms for the atten case compared to ∼ 20µs for our approach).…”

Detection of Uncaught Exceptions in Functional Programs by Abstract Interpretation

“…Generalising string automata, tree automata are an established formalism to represent sets of trees. They have been used to define static analysers for term-rewriting systems (TRSs) [3] and higher-order programs [20]. They have been extended to lattice tree automata to support arbitrary non-relational abstract domains at their leaves [17,18], and improve the performance of analysers for TRSs.…”

Beyond the elementary representations of program invariants over algebraic data types

“…Recently, Haudebourg et al [28] proposed a regular abstract interpretation framework for invariant generation for higher-order functional programs over ADTs. Authors derive a type system where each type is a regular language and use CEGAR to infer regular invariants.…”