Refinement types for Haskell

Abstract

SMT-based checking of refinement types for call-by-value languages is a well-studied subject. Unfortunately, the classical translation of refinement types to verification conditions is unsound under lazy evaluation. When checking an expression, such systems implicitly assume that all the free variables in the expression are bound to values. This property is trivially guaranteed by eager, but does not hold under lazy, evaluation. Thus, to be sound and precise, a refinement type system for Haskell and the corresponding verification conditions must take into account which subset of binders actually reduces to values. We present a stratified type system that labels binders as potentially diverging or not, and that (circularly) uses refinement types to verify the labeling. We have implemented our system in LIQUIDHASKELL and present an experimental evaluation of our approach on more than 10,000 lines of widely used Haskell libraries. We show that LIQUIDHASKELL is able to prove 96% of all recursive functions terminating, while requiring a modest 1.7 lines of termination-annotations per 100 lines of code.

LiquidHaskell

“…For example, we define a measure len to write properties about the number of elements in a list. Measure definitions are not arbitrary Haskell code but a very restricted subset [39]. Each measure has a single equation per constructor that defines the value of the measure for that constructor.…”

“…Core LIQUIDHASKELL uses GHC to reduce the source to the Core IL [35], and, to facilitate source-level error reporting, creates a map from Core expressions to locations in the Haskell source. Constraints Then, it uses the abstract interpretation framework of Liquid Typing [29], modified to ensure soundness under lazy evaluation [39], to generate logical constraints from the Core IL. Solution Next, it uses a fixpoint algorithm (from [29]) combined with an SMT solver to solve the constraints, and hence infers a valid refinement typing for the program.…”

“…To soundly account for Haskell's non-strict evaluation, a refinement type checker must distinguish between terms that may potentially diverge and those that will not [39]. Thus, by default, LIQUID-HASKELL proves termination of each recursive function.…”

“…In practice, due to a careful choice of defaults, this amounts to about a line of termination-related hints per hundred lines of source. Details about the termination checker may be found in [39], we include a brief description here to make the paper self-contained. Simple Metrics As a starting example, consider the fac function fac :: n:Nat -> Nat / [n] fac 0 = 1 fac n = n * fac (n-1)…”

Type-based Exception Analysis for Non-strict Higher-order Functional Languages with Imprecise Exception Semantics

“…Resolving this discrepancy without sacrificing precision would involve adding a termination analysis (cf. Vazou et al 2014). While we believe this can be accommodated with minor changes to the analysis, we shall not further address this issue in remainder of the paper.…”