Efficient software model checking of soundness of type systems

Abstract

This paper presents novel techniques for checking the soundness of a type system automatically using a software model checker. Our idea is to systematically generate every type correct intermediate program state (within some finite bounds), execute the program one step forward if possible using its small step operational semantics, and then check that the resulting intermediate program state is also type correct-but do so efficiently by detecting similarities in this search space and pruning away large portions of the search space. Thus, given only a specification of type correctness and the small step operational semantics for a language, our system automatically checks type soundness by checking that the progress and preservation theorems hold for the language (albeit for program states of at most some finite size). Our preliminary experimental results on several languages-including a language of integer and boolean expressions, a simple imperative programming language, an object-oriented language which is a subset of Java, and a language with ownership types-indicate that our approach is feasible and that our search space pruning techniques do indeed significantly reduce what is otherwise an extremely large search space. Our paper thus makes contributions both in the area of checking soundness of type systems, and in the area of reducing the state space of a software model checker.

Ontologically correct taxonomies by construction

“…To support that the soundness results in Table 1 are significant, we rely on the small scope hypothesis, which basically claims most design errors can be found in small counterexamples [20]. Experimental results suggest that exhaustive testing within a small finite domain does indeed catch all type system errors in practice [21], and many case studies using the formal language and tool Alloy have confirmed the hypothesis by performing an analysis in a variety of scopes and showing, retrospectively, that a small scope would have sufficed to find all the bugs discovered [22]. A more detailed discussion concerning the implications of the small scope hypothesis for our verification tasks is presented in Section 2.3.3.…”

Extrinsically typed operational semantics for functional languages

“…Model Checking. Roberson et al [Roberson et al 2008] propose a model checking approach to type soundness in which configurations are generated, steps are computed, and then type checked. Similarly to testing, this approach can detect bugs but cannot guarantee type soundness.…”

αCheck: A mechanized metatheory model checker

“…Other more specific approaches include Roberson et al (2008), where the authors extend their previous work on using a software model checker for data structure properties to the realm of ASTs and type soundness. The idea is to exhaustively generate all possible program states, that is, well-typed expressions in an object PL, execute one step and check that types are preserved and execution does not get stuck.…”