1. Automating Relatively Complete Verification of Higher-Order Functional Programs Hiroshi Unno (University of Tsukuba) Tachio Terauchi (Nagoya University) Naoki Kobayashi (University of Tokyo) 2013/1/23POPL 20131

2. Path-Sensitive Verifier for Functional Programs (cf. SLAM, BLAST, … for Imperative Programs) 2013/1/23POPL 20132 let rec mc x = if x > 100 then x – 10 else mc (mc (x + 11)) in let n = randi() in if n · 101 then assert (mc n = 91) Verifier Program & Spec. Result Certificate or Counterexample All these verifiers are based on refinement type system (cf. Hoare logic for first-order imperative programs) Demo Refinement type inference by Horn clause solving [Unno and Kobayashi 2008, 2009] Liquid Types [Rondon, Kawaguchi and Jhala 2008, …] Depcegar [Terauchi 2010] MoCHi [Sato, Unno and Kobayashi 2011, 2013] HMC [Jhala, Majumdar and Rybalchenko 2011]

3. Refinement Types 2013/1/23POPL 20133 FOL formulas for refinement

4. 2013/1/23POPL 20134 Well-typed!

5. Automated Verification via Refinement Type Inference 2013/1/23POPL 20135

6. Incompleteness: There is a safe but untypable program 2013/1/23POPL 20136 whereas Hoare logic is relatively complete

7. Example: Safe but Untypable Program 2013/1/23POPL 20137

8. Our Contributions 2013/1/23POPL 20138

9. Our Contributions 2013/1/23POPL 20139

10. 2013/1/23POPL 201310

11. Our Approach: Restricted Use of Quantification Add one universal quantifier over integer just before each function parameter [Goerdt 1985, German, Clarke, and Halpern 1983, 1989] 2013/1/23POPL 201311

12. 2013/1/23POPL 201312 Well-typed!

13. 2013/1/23POPL 201313

14. Our Contributions 2013/1/23POPL 201314

15. 2013/1/23POPL 201315

16. Our Approach 2013/1/23POPL 201316

17. Our Approach 2013/1/23POPL 201317

18. Counterexample Guided Refinement Type Inference 2013/1/23POPL 201318 unsafe Step 1: Fixed-Point Type Inference [1,2] Step 3: Refinement [1,2] safe yes no unknown [1] Terauchi POPL 2010 [2] Kobayashi, Sato, Unno PLDI 2011

19. Our Approach 2013/1/23POPL 201319

20. 2013/1/23POPL 201320 unsafe Step 1: Fixed-Point Type Inference [1,2] safe yes no [1] Terauchi POPL 2010 [2] Kobayashi, Sato, Unno PLDI 2011 Step 3: Refinement [1,2]

21. 2013/1/23POPL 201321

22. Example: Reduction to Non-Linear Constraint Solving 2013/1/23POPL 201322

23. Example: Non-linear Constraint Solving (1/2) 2013/1/23POPL 201323

24. Example: Non-linear Constraint Solving (2/2) 2013/1/23POPL 201324 Bit-vector modeling & SMT [Gulwani, Srivastava, Venkatesan 2008]

25. Implementation 2013/1/23POPL 201325 let rec mc x = if x > 100 then x – 10 else mc (mc (x + 11)) in let n = randi() in if n · 101 then assert (mc n = 91) MoCHi Program & Spec. Result Certificate or Counterexample

26. Conclusion 2013/1/23POPL 201326