A Type-Based HFL Model Checking Algorithm

Abstract

Higher-order modal fixpoint logic (HFL) is a higher-order extension of the modal µ-calculus, and strictly more expressive than the modal µ-calculus. It has recently been shown that various program verification problems can naturally be reduced to HFL model checking: the problem of whether a given finite state system satisfies a given HFL formula. In this paper, we propose a novel algorithm for HFL model checking: it is the first practical algorithm in that it runs fast for typical inputs, despite the hyper-exponential worst-case complexity of the HFL model checking problem. Our algorithm is based on Kobayashi et al.'s type-based characterization of HFL model checking, and was inspired by a saturation-based algorithm for HORS model checking, another higherorder extension of model checking. We prove the correctness of the algorithm and report on an implementation and experimental results.The syntax of formulas on the first two lines is identical to that of the modal µ-calculus formulas, except that the variable X can range over higher-order predicates, rather than just propositions. Intuitively, µX η .ϕ (νX η .ϕ, resp.) denotes the least (greatest, resp.) predicate of type η such that X = ϕ. Higher-order predicates can be manipulated by using λ-abstractions and applications. The type o denotes the type of propositions. A type environment H for simple types is a map from a finite set of variables to the set of simple types. We often treat H as a set of type bindings of the form X : η, and write X : η ∈ H when H(X) = η. A type judgment relation H ⊢ ϕ : η is derived by the typing rules in Figure 1.

An Overview of the HFL Model Checking Project

“…One approach [18] to proving the validity of a νHFL(Z) formula ϕ is to apply predicate abstraction to obtain a pure νHFL formula ϕ (i.e., a νHFL(Z) formula without integers) as an underapproximation of ϕ, and then apply an algorithm for pure HFL model checking [17] 2 (recall that pure HFL model checking is decidable; despite its high worst-case complexity, practical algorithms exist, which do not always suffer from the high complexity). This approach may be viewed as a generalization of the HORS model checking approach to (un)reachability verification [26] and non-termination verification [31].…”