The impact of higher-order state and control effects on local relational reasoning

Abstract

Reasoning about program equivalence is one of the oldest problems in semantics. In recent years, useful techniques have been developed, based on bisimulations and logical relations, for reasoning about equivalence in the setting of increasingly realistic languages-languages nearly as complex as ML or Haskell. Much of the recent work in this direction has considered the interesting representation independence principles enabled by the use of local state, but it is also important to understand the principles that powerful features like higher-order state and control effects disable. This latter topic has been broached extensively within the framework of game semantics, resulting in what Abramsky dubbed the "semantic cube": fully abstract game-semantic characterizations of various axes in the design space of ML-like languages. But when it comes to reasoning about many actual examples, game semantics does not yet supply a useful technique for proving equivalences.In this paper, we marry the aspirations of the semantic cube to the powerful proof method of step-indexed Kripke logical relations. Building on recent work of Ahmed et al. (2009), we define the first fully abstract logical relation for an ML-like language with recursive types, abstract types, general references and call/cc. We then show how, under orthogonal restrictions to the expressive power of our language-namely, the restriction to first-order state and/or the removal of call/cc-we can enhance the proving power of our possibleworlds model in correspondingly orthogonal ways, and we demonstrate this proving power on a range of interesting examples. Central to our story is the use of state transition systems to model the way in which properties of local state evolve over time.

Functional Big-Step Semantics

“…The technique of step-indexed logical relations [2] supports reasoning about programs that have recursive types, higher-order state, or other features that introduce aspects of circularity into a language's semantics [1,12]. The soundness of these relations is usually proved with respect to a small-step semantics, because the length of a small-step trace can be used to make the relation well-founded when following the structure of the language's cyclic constructs (e.g., when following a pointer cycle in the heap or unfolding a recursive type).…”

Reasoning about Object Capabilities with Logical Relations and Effect Parametricity

“…We construct a relatively rich type of Kripke worlds to model arbitrary invariants and protocols on shared state [13], [16]. Our notations loosely follow Birkedal et al [15] and we use their recipe for constructing recursive worlds (see below).…”

“…We have generally followed the notations used by Birkedal et al [15] and we used their recipe for defining recursive worlds using ultrametric space theory. Our worlds are inspired by Dreyer et al's [16]. The region-based effect interpretation used in Section 6 produces a logical relation related to one used by Thamsborg et al for proving relational results about a region-based type-and-effect system [17].…”

“…Section 3 repeats the definition of λ JS , a pre-existing core calculus for JavaScript [14] and presents the logical relation capturing its capability-safety. It uses ideas and techniques from previous work [15]- [17] but also novel ideas, in particular a variation on Dreyer et al's public/private transitions [16] for modelling authority over shared data and our notion of effect parametricity to support custom properties about effects. We demonstrate in Section 4 that the logical relation can be used to verify nontrivial examples involving evolvable invariants on shared data structures, restricted authority over them (like the webpage-with-an-ad example above) and isolating components with restricted communication channels.…”

Verifying efficient function calls in CakeML

“…This is now a wellexplored technique for establishing a semantic correspondence between a lower-level and a higherlevel language via a typing discipline [Benton and Hur 2009;Hur and Dreyer 2011;Perconti and Ahmed 2014], or for establishing contextual equivalences between diferent implementation of ADTs that encapsulate signiicant representation changes behind type abstractions [Dreyer et al 2012]. In contrast to those approaches, we are not trying to establish a type discipline on ClosLang, nor do our optimisations afect the global state.…”