Verifying Catamorphism-Based Contracts using Constrained Horn Clauses

Abstract

We address the problem of verifying that the functions of a program meet their contracts, specified by pre/postconditions. We follow an approach based on constrained Horn clauses (CHCs) by which the verification problem is reduced to the problem of checking satisfiability of a set of clauses derived from the given program and contracts. We consider programs that manipulate algebraic data types (ADTs) and a class of contracts specified by catamorphisms, that is, functions defined by simple recursion schemata on the given ADTs. We show by several examples that state-of-the-art CHC satisfiability tools are not effective at solving the satisfiability problems obtained by direct translation of the contracts into CHCs. To overcome this difficulty, we propose a transformation technique that removes the ADT terms from CHCs and derives new sets of clauses that work on basic sorts only, such as integers and booleans. Thus, when using the derived CHCs there is no need for induction rules on ADTs. We prove that the transformation is sound, that is, if the derived set of CHCs is satisfiable, then so is the original set. We also prove that the transformation always terminates for the class of contracts specified by catamorphisms. Finally, we present the experimental results obtained by an implementation of our technique when verifying many non-trivial contracts for ADT manipulating programs.

Contract Strengthening through Constrained Horn Clause Verification

“…Our technique is based on the translation of the program functions and their contracts for which STAINLESS is not successful, into a set of constrained Horn clauses (CHCs) [5,13]. Then, in the case where programs manipulate Algebraic Data Structures, those clauses are transformed by VeriCaT [9], so that their satisfiability can hopefully be proved by SPACER (or a different CHC solver) in the domain of integers and/or booleans. If satisfiability is proved and a model for those clauses is found (which is defined by constraints on integers and/or booleans), then via a final translation step, we derive from that model suitable strengthened postconditions for the contracts.…”

“…Then, we proceed according to Step (ii) of our technique, which consists in applying a transformation that removes all ADT terms from ReverseCHCs. Indeed, we apply Algorithm T cata [9], implemented in the VeriCaT tool, and we get the new set TransfReverseCHCs of clauses (see Figure 3), whose satisfibility implies the satisfiability of the set ReverseCHCs. In particular, starting from goal GR, by transformation we obtain clauses T1-T5, and starting goal GS, by transformation we obtain clauses T6-T8.…”

“…It is only important to note that all variables in TransfReverseCHCs are of sort boolean or integer. Indeed, Algorithm T cata always terminates and generates a set of clauses without ADT variables in the case where, as in our set ReverseCHCs of clauses, the contracts are specified by means of catamorphisms [9], that is, total functions defined by a simple recursion schema on the ADT structure. (The notion of catamorphism used here is an adaptation to CHCs of the one popularized by Meijer et al [21] in the area of functional programming.…”

“…Let us briefly discuss the soundness of our technique for strengthening contracts. We consider the class of contracts specified by catamorphisms considered in previous work [9], where the termination of the transformation algorithm T cata is guaranteed. Soundness of our technique will be shown by proving that, if a given contract is valid and a CHC solver is able to prove the satisfiability of the set of clauses obtained by T cata , then also the strengthened version of the contract, which is derived by using our technique, is valid.…”

“…Step (ii): Then, by using already known methods [6,7], we transform this set of CHCs into a new set where all ADT terms are removed. In particular, we use the VeriCaT tool [9]. These methods are sound, in the sense that the satisfiability of the transformed clauses implies the satisfiability of the original set of clauses.…”