A type-directed abstraction refinement approach to higher-order model checking

Abstract

The trivial-automaton model checking problem for higher-order recursion schemes has become a widely studied object in connection with the automatic verification of higher-order programs. The problem is formidably hard: despite considerable progress in recent years, no decision procedures have been demonstrated to scale robustly beyond recursion schemes that comprise more than a few hundred rewrite rules. We present a new, fixed-parameter polynomial time algorithm, based on a novel, type directed form of abstraction refinement in which behaviours of a scheme are distinguished by the abstraction according to the intersection types that they inhabit (the properties that they satisfy). Unlike other intersection type approaches, our algorithm reasons both about acceptance by the property automaton and acceptance by its dual, simultaneously, in order to minimize the amount of work done by converging on the solution to a problem instance from both sides. We have constructed Preface, a prototype implementation of the algorithm, and assembled an extensive body of evidence to demonstrate empirically that the algorithm readily scales to recursion schemes of several thousand rules, well beyond the capabilities of current state-of-the-art higher-order model checkers.

On the relationship between higher-order recursion schemes and higher-order fixpoint logic

“…Among others, Kobayashi and Ong [12,13] have provided a type-based characterization of HORS model checking, which inspired our type system for HFL model checking in Section 4. The type-based characterization of HORS model checking has lead to development of practical algorithms for HORS model checking [3,10,11,24,27]. We therefore expect that our type-based characterization of HFL model checking also yields practical algorithms for HFL model checking.…”

“…In the translation from HFL to HORS, the key challenge was how to encode big numbers into order-(k−1) terms of HORS. Our encoding may be seen as a combination of Jones' encoding of big numbers as functions [7], and encoding of Boolean expressions into order-0 terms (with an added automaton to evaluate these expressions); the latter encoding was used in the benchmark of the HORS model checker PREFACE [27].…”

“…The type-based characterization of HFL model checking mentioned above should be of independent interest. A type-based characterization of HORS model checking is well established [12,13] and has been used for studies of practical algorithms [3,10,11,24,27], parameterized complexity [13,14], decidability proofs [13,32], etc. of HORS model checking.…”

A ZDD-Based Efficient Higher-Order Model Checking Algorithm

“…Actually, the higher-order model checking problem is k-EXPTIME complete for order-k HORS [19,11], so there is no hope to obtain an algorithm that works well for all the inputs. Nevertheless, several practical algorithms have been developed and implemented, which run reasonably fast for many typical inputs [9,8,18,3,21]. The state-of-the-art higher-order model checkers HorSat [3] and Preface [21] can handle HORS consisting of hundreds of lines of rewriting rules (and it has been reported [21] that Preface works even for thousands of lines of HORS for a specific problem instance).…”

“…Nevertheless, several practical algorithms have been developed and implemented, which run reasonably fast for many typical inputs [9,8,18,3,21]. The state-of-the-art higher-order model checkers HorSat [3] and Preface [21] can handle HORS consisting of hundreds of lines of rewriting rules (and it has been reported [21] that Preface works even for thousands of lines of HORS for a specific problem instance). Despite the recent advance, they are still not scalable enough to be applied to verification of thousands or millions of lines of programs.…”