Verifying a Local Generic Solver in Coq

Abstract

Abstract. Fixpoint engines are the core components of program analysis tools and compilers. If these tools are to be trusted, special attention should be paid also to the correctness of such solvers. In this paper we consider the local generic fixpoint solver RLD which can be applied to constraint systems x fx, x ∈ V , over some lattice D where the right-hand sides fx are given as arbitrary functions implemented in some specification language. The verification of this algorithm is challenging, because it uses higher-order functions and relies on side effects to track variable dependences as they are encountered dynamically during fixpoint iterations. Here, we present a correctness proof of this algorithm which has been formalized by means of the interactive proof assistant Coq.

How to combine widening and narrowing for non-monotonic systems of equations

“…A local solver such as [21], however, is not generic in the sense of the present paper-meaning that a naive enhancement with the operator is no longer guaranteed to return sound results. As our main contribution, we therefore present a variation of this algorithm which always returns a (partial) post solution and, moreover, is guaranteed to terminate-at least for monotonic equation systems and if only finitely many unknowns are encountered.…”

“…One more elaborate algorithm for local solving is formalized by Hofmann et al [21], namely the solver RLD as shown in Figure 5. This algorithm has the benefit of visiting nodes in a more efficient order, first stabilizing innermost loops before iterating on outer loops.…”

On Monadic Parametricity of Second-Order Functionals

“…The provided characterization of pure functionals of type Func can be used for verification of generic off-the-shelf fixpoint algorithms which are used to compute a (local) solution of a constraint system x F x , x ∈ V , defined over a bounded join-semilattice D of abstract values and a set of variables V . The local solver RLD, which relies on self-observation, applies F to a special stateful function to discover variable dependencies and perform demand-driven evaluations [7]. In order to reason about the algorithm formally, we implement RLD in purely functional manner and model side-effects by means of the state monad.…”

“…(A → State S B) → State S C. The motivation there was rigorous verification of a generic fixpoint algorithm RLD [7] that used state. As it turns out [8], we could not use the standard notion of relational parametricity [17,18] The functional invokes its argument k to compute a result b but then discards the new state and restores the initial one instead.…”

Side-Effecting Constraint Systems: A Swiss Army Knife for Program Analysis

“…The goal, therefore, is to abandon dedicated analysis algorithms and instead provide one specification formalism together with a single solver engine to compute the invariants. Proofs of soundness are then vastly simplified as the verification task is separated into proving the constraint system correct and independently proving the correctness of a generic fixpoint engine, along the lines of [12].…”