Verifying relational properties of functional programs by first-order refinement

Abstract

Much progress has been made recently on fully automated verification of higher-order functional programs, based on refinement types and higher-order model checking. Most of those verification techniques are, however, based on first-order refinement types, hence unable to verify certain properties of functions (such as the equality of two recursive functions and the monotonicity of a function, which we call relational properties). To relax this limitation, we introduce a restricted form of higher-order refinement types where refinement predicates can refer to functions, and formalize a systematic program transformation to reduce type checking/inference for higher-order refinement types to that for first-order refinement types, so that the latter can be automatically solved by using an existing software model checker. We also prove the soundness of the transformation, and report on implementation and experiments.

Verifying Relational Properties of Functional Programs by First-Order Refinement

“…Furthermore, we require that every refinement predicate is welltyped and have type int. (See the full version of this paper [3] for the details.) To enable the reduction to first-order refinement type checking, we shall further restrict the syntax of types later in Section 2.3.…”

“…Those conditions are achieved by the preprocessing (−) 3 , (−) 2 , and (−) 1 explained below. 3 Replication of functions If a function variable occurs n (> 1) times in a refinement predicate, we replicate the function and make a tuple consisting of n copies of the function. For example, for a typing…”

“…We give formal definitions of the transformations (−) 1 , (−) 2 , (−) 3 , and (−) 4 in this order. (1) where, for the type τ = (y k ) k : k (y k : ρ k ) P ,…”

“…3 We face even more difficulties when dealing with higher-order functions. Consider the program in Figure 1.…”

“…We conclude the paper in Section 7. For the space restriction, proofs and some definitions are omitted, which are available in a full version [3].…”