1 / 26

Facilitating Program Verification with Dependent Types

Facilitating Program Verification with Dependent Types. Hongwei Xi Boston University. Talk Overview. Motivation Detecting program errors (at compile-time) Detecting more program errors (at compile-time) Dependently typed programming languages Imperative: Xanadu Programming examples

wendi
Download Presentation

Facilitating Program Verification with Dependent Types

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Facilitating Program Verificationwith Dependent Types Hongwei Xi Boston University

  2. Talk Overview • Motivation • Detecting program errors (at compile-time) • Detecting more program errors (at compile-time) • Dependently typed programming languages • Imperative: Xanadu • Programming examples • Current status and future work

  3. A Wish List • We would like to have a programming language that should • be simple and general • support extensive error checking • facilitate proofs of program properties • possess correct and efficient implementation • ... ... • But …

  4. Reality • Invariably, there are many conflicts among this wish list • These conflicts must be resolved with careful attention paid to the needs of the user

  5. Some Advantages of Types • Capturing errors at compile-time • Enabling compiler optimizations • Facilitating program verification • Using types to encode program properties and verifying the encoded properties through type-checking • Serving as program documentation • Unlike informal comments, types can be fully trusted after type-checking

  6. Limitations of (Simple) Types • Not general enough • Many correct programs cannot be typed • For instance, type casts are widely used in C • Not specific enough • Many interesting properties cannot be captured • For instance, types in Java cannot handle safe array access

  7. Dependent Types • Dependent types are types that are • more refined • dependent on the values of expressions • Examples • int(i): singleton type containing only integer i • <int> array(n): type for integer arrays of size n

  8. Examples of Dependent Types • int(i,j) is defined as[a:int | i < a < j] int(a),that is, the sum of all types int(a) for i < a < j • int[i,j), int(i,j] , int[i,j] are defined similarly • nat is defined as[a:int | a >=0] int(a)

  9. Informal Program Comments /* the function should not be applied toa negative integer */ int factorial (x: int) { /* defensive programming */ if (x < 0) exit(1); if (x == 0) return 1;else return (x * factorial (x-1)); }

  10. Formalizing Program Comments {n:nat} int factorial (x: int(n)) { if (x == 0) return 1;else return (x * factorial (x-1)); } Note: factorial (-1) is ill-typed and thus rejected!

  11. Informal Program Comments /* arrays a and b are of equal size */ double dotprod (double a[], double b[]) { int i; double sum = 0.0; if (a.size != b.size) exit(1); for (i = 0; i < a.size; i = i + 1) { sum = sum + a[i] * b[i]; } return sum; }

  12. Formalizing Program Comments {n:nat} double dotprod (a: <double>array(n),b: <double>array(n)){ /* dotprod is assigned the following type: {n:nat}. (<float> array(n), <float> array(n)) -> float */ … … … }

  13. Xanadu • Xanadu is a dependently typed imperative programming language with C-like syntax • The type of a variable in Xanadu can change during execution • The programmer may need to provide dependent type annotations for type-checking purpose

  14. Dependent Record Types (I) • A polymorphic type for arrays:{n:nat} <‘a> array(n) { size: int(n); data[n]: ‘a}

  15. Dependent Record Types (II) • A polymorphic type for 2-dimensional arrays:{m:nat,n:nat} <‘a> array2(m,n) { row: int(m); col: int(n); data[m][n]: ‘a}

  16. Dependent Record Types (III) • A polymorphic type for sparse arrays: {m:nat,n:nat}<‘a>sparseArray(m,n) { row: int(m); col: int(n); data[m]: <int[0,n)* ‘a> list}

  17. A Program in Xanadu {n:nat}unit init (intvec[n]) { var: int ind, size;; /* arraysize: {n:nat} <‘a> array(n)  int(n) */ size = arraysize(vec); invariant: [i:nat] (ind: int(i)) for (ind=0; ind<size; ind=ind+1) { vec[ind] = ind; /* safe array subscripting */ } }

  18. Binary Search in Xanadu {n:nat} int bs(key: int, vec: <int> array(n)) { var: l: int [0, n], h: int [-1,n); int m, x;; l = 0; h = vec.size - 1; while (l <= h) { m = (l + h) / 2; x = vec.data[m]; if (x < key) { l = m - 1; } else if (x > key) { h = m + 1; } else { return m; } } return –1; }

  19. Dependent Union Types • A polymorphic type for lists:union <‘a> list with nat = { Nil(0);{n:nat} Cons(n+1) of ‘a * <‘a> list(n) } • Nil: <‘a> list(0) • Cons: {n:nat} ‘a * <‘a> list(n) -> <‘a> list(n+1)

  20. Reverse Append on Lists (‘a) {m:nat,n:nat} <‘a> list(m+n) revApp (xs:<‘a> list(m),ys:<‘a> list(n)) {var: ‘a x;;invariant:[m1:nat,n1:nat | m1+n1=m+n] (xs:<‘a> list(m1), ys:<‘a> list(n1))while (true) { switch (xs) { case Nil: return ys; case Cons (x, xs): ys = Cons(x, ys); } } exit; /* can never be reached */ }

  21. Constraint Generation • The following constraint is generated when the revApp example is type-checked: m:nat,n:nat,m1:nat,n1:nat,m1+n1=m+n,a:nat,m1=a+1 implies a+(n1+1)=m+n

  22. Current Status of Xanadu • A prototype implementation of Xanadu in Objective Caml that • performs two-phase type-checking, and • generates assembly level code • An interpreter for interpreting assembly level code • A variety of examples athttp://www.cs.bu.edu/~hwxi/Xanadu/Xanadu.html

  23. Conclusion (I) • It is still largely an elusive goal in practice to verify the correctness of a program • It is therefore important to identify those program properties that can be effectively verified for realistic programs

  24. Conclusion (II) • We have designed a type-theoretic approach to capturing simple arithmetic reasoning • The preliminary studies indicate that this approach allows the programmer to capture many more properties in realistic programs while retaining practical type-checking

  25. Future Work • Adding more programming features into Xanadu • in particular, OO features • Certifying compilation: constructing a compiler for Xanadu that can translate dependent types from source level into bytecode level • Incorporating dependent types into (a subset of) Java and …

  26. End of the Talk • Thank you! Questions?

More Related