Verifying higher-order programs with the dijkstra monad

Abstract

Modern programming languages, ranging from Haskell and ML, to JavaScript, C# and Java, all make extensive use of higher-order state. This paper advocates a new verification methodology for higher-order stateful programs, based on a new monad of predicate transformers called the Dijkstra monad.Using the Dijkstra monad has a number of benefits. First, the monad naturally yields a weakest pre-condition calculus. Second, the computed specifications are structurally simpler in several ways, e.g., single-state post-conditions are sufficient (rather than the more complex two-state post-conditions). Finally, the monad can easily be varied to handle features like exceptions and heap invariants, while retaining the same type inference algorithm.We implement the Dijkstra monad and its type inference algorithm for the F programming language. Our most extensive case study evaluates the Dijkstra monad and its F implementation by using it to verify JavaScript programs.Specifically, we describe a tool chain that translates programs in a subset of JavaScript decorated with assertions and loop invariants to F . Once in F , our type inference algorithm computes verification conditions and automatically discharges their proofs using an SMT solver. We use our tools to prove that a core model of the JavaScript runtime in F respects various invariants and that a suite of JavaScript source programs are free of runtime errors.

Hoare-style reasoning with (algebraic) continuations

“…Hoare reasoning through dependent types Related systems that employ Hoare-style specification via types are HTT [30] and F * [44]. HTT is a direct precursor of HTTcc, but does not include the control operators.…”

Dijkstra and Hoare monads in monadic computation

“…In [30] the 'Dijkstra' monad is introduced, as a variant of the 'Hoare' monad from [27]. It captures weakest precondition computations for the state monad X → (S × X) S , where S is a fixed collection of states (the heap).…”

“…For the powerset monad P, a first version of the Dijkstra monad, following the description in [30], yields D P : Sets → Sets defined as:…”

“…So-called Hoare monads [27,31] and Dijkstra monads [30] have been defined in a systematic approach to program verification. Via these monads one describes not only a program but also the associated correctness assertions.…”

“…Here we do so not only for the Dijkstra monad (like in [16]), but also for the Hoare monad. We generalise the original definition from [30,27,31] and show that 'Dijkstra' and 'Hoare' monads D T and H T can be associated with various well-known monads T that are used for modeling computations.…”