Download presentation

Presentation is loading. Please wait.

Published byFreddy Jessel Modified about 1 year ago

1
Automating Relatively Complete Verification of Higher-Order Functional Programs Hiroshi Unno (University of Tsukuba) Tachio Terauchi (Nagoya University) Naoki Kobayashi (University of Tokyo) 2013/1/23POPL 20131

2
Path-Sensitive Verifier for Functional Programs (cf. SLAM, BLAST, … for Imperative Programs) 2013/1/23POPL let rec mc x = if x > 100 then x – 10 else mc (mc (x + 11)) in let n = randi() in if n · 101 then assert (mc n = 91) Verifier Program & Spec. Result Certificate or Counterexample All these verifiers are based on refinement type system (cf. Hoare logic for first-order imperative programs) Demo Refinement type inference by Horn clause solving [Unno and Kobayashi 2008, 2009] Liquid Types [Rondon, Kawaguchi and Jhala 2008, …] Depcegar [Terauchi 2010] MoCHi [Sato, Unno and Kobayashi 2011, 2013] HMC [Jhala, Majumdar and Rybalchenko 2011]

3
Refinement Types 2013/1/23POPL FOL formulas for refinement

4
2013/1/23POPL Well-typed!

5
Automated Verification via Refinement Type Inference 2013/1/23POPL 20135

6
Incompleteness: There is a safe but untypable program 2013/1/23POPL whereas Hoare logic is relatively complete

7
Example: Safe but Untypable Program 2013/1/23POPL 20137

8
Our Contributions 2013/1/23POPL 20138

9
Our Contributions 2013/1/23POPL 20139

10
2013/1/23POPL

11
Our Approach: Restricted Use of Quantification Add one universal quantifier over integer just before each function parameter [Goerdt 1985, German, Clarke, and Halpern 1983, 1989] 2013/1/23POPL

12
2013/1/23POPL Well-typed!

13
2013/1/23POPL

14
Our Contributions 2013/1/23POPL

15
2013/1/23POPL

16
Our Approach 2013/1/23POPL

17
Our Approach 2013/1/23POPL

18
Counterexample Guided Refinement Type Inference 2013/1/23POPL unsafe Step 1: Fixed-Point Type Inference [1,2] Step 3: Refinement [1,2] safe yes no unknown [1] Terauchi POPL 2010 [2] Kobayashi, Sato, Unno PLDI 2011

19
Our Approach 2013/1/23POPL

20
2013/1/23POPL unsafe Step 1: Fixed-Point Type Inference [1,2] safe yes no [1] Terauchi POPL 2010 [2] Kobayashi, Sato, Unno PLDI 2011 Step 3: Refinement [1,2]

21
2013/1/23POPL

22
Example: Reduction to Non-Linear Constraint Solving 2013/1/23POPL

23
Example: Non-linear Constraint Solving (1/2) 2013/1/23POPL

24
Example: Non-linear Constraint Solving (2/2) 2013/1/23POPL Bit-vector modeling & SMT [Gulwani, Srivastava, Venkatesan 2008]

25
Implementation 2013/1/23POPL let rec mc x = if x > 100 then x – 10 else mc (mc (x + 11)) in let n = randi() in if n · 101 then assert (mc n = 91) MoCHi Program & Spec. Result Certificate or Counterexample

26
Conclusion 2013/1/23POPL

Similar presentations

© 2016 SlidePlayer.com Inc.

All rights reserved.

Ads by Google