Relatively complete refinement type system for verification of higher-order non-deterministic programs

Abstract

This paper considers verification of non-deterministic higher-order functional programs. Our contribution is a novel type system in which the types are used to express and verify (conditional) safety, termination, non-safety, and non-termination properties in the presence of ∀-∃ branching behavior due to non-determinism. For instance, the judgement ⊢ e : {u :int | ϕ(u)} ∀∀ says that every evaluation of e either diverges or reduces to some integer u satisfying ϕ(u), whereas ⊢ e : {u :int | ψ (u)} ∃∀ says that there exists an evaluation of e that either diverges or reduces to some integer u satisfying ψ (u). Note that the former is a safety property whereas the latter is a counterexample to a (conditional) termination property. Following the recent work on type-based verification methods for deterministic higher-order functional programs, we formalize the idea on the foundation of dependent refinement types, thereby allowing the type system to express and verify rich properties involving program values, branching behaviors, and the combination thereof.Our type system is able to seamlessly combine deductions of both universal and existential facts within a unified framework, paving the way for an exciting opportunity for new type-based verification methods that combine both universal and existential reasoning. For example, our system can prove the existence of a path violating some safety property from a proof of termination that uses a well-foundedness termination argument. We prove that our type system is sound and relatively complete, and further, thanks to having both modes of non-determinism, we show that our types are closed under complement.

Higher-Order Program Verification via HFL Model Checking

“…A notable exception is the recent work of Unno et al [40], which provides a relatively complete type system for the classes of properties discussed in Sect. 5.…”

Nondeterministic Manifest Contracts

“…One solution to the problem would be to restrict predicates of refinement types to pure ones, that is, predicates has no nondeterminism. Although the restriction seems reasonable and could be easily accomplished [Unno et al 2018], we avoid such a restriction to give programmers full expressiveness in writing software contracts.…”

“…Static verification by using a dependent refinement type system. Although we give only dynamic checking in this paper, there are broad studies on static verification of higher-order functional programs [Cosman and Jhala 2017;Kobayashi et al 2011;Rondon et al 2008;Terauchi 2010;Unno and Kobayashi 2009;Unno et al 2018;Vazou et al 2014;Zhu and Jagannathan 2013]. The main difference from a manifest contract calculus is that predicates of their refinement types are written in logical formulae.…”

“…We should relate [Unno et al 2018] in more detail. They proposed a verification method for a nondeterministic functional programming language.…”

Lambda Y-Calculus With Priorities

“…Higher-order model-checking has become a successful foundation for verification of higher-order programs. While at first it was restricted to call-by-name purely functional programs, in recent years its scope has been substantially enlarged [1][2][3][4][5].…”