View
224
Download
1
Tags:
Embed Size (px)
Citation preview
2
Type verification in a functional languagewe choose the let-polymorphic type
interpreter type verification à la ML
• same type system
• verification does not require any fixpoint computation
3
Abstract verificationF= abstract semantic evaluation functionS = specification of the property, i.e., abstraction
of the intended concrete semanticspartial correctness: (lfp F) S
sufficient partial correctness condition: F( S)S
4
The language: syntaxtype ide = Id of string
type exp = | Eint of int | Var of ide | Sum of exp * exp | Diff of exp * exp | Ifthenelse of exp * exp * exp | Fun of ide * exp | Rec of ide * exp | Appl of exp * exp | Let of ide * exp * exp | Letrec of ide * exp * exp
5
The abstract domain of parametric polytypes
type evalt = Notype| Vvar of string| Intero | Mkarrow of evalt * evalt
type tscheme = Forall of (string list) * evalt
type eval = tscheme * (evalt * evalt) list
6
Abstract verification of types F( S)S
a program is an expression in the language its specification S is its intended type
rather than taking an element of eval, we take an element of evalt• a further abstraction in which we forget quantifiers and constraints
• not important for closed expressions without global environment
the abstract semantic evaluation function Fis of course the abstract interpreter sem
what is the meaning of F( S)
7
The meaning of F( S)S
in a language with constructs which create a global environment (typically containing functions),
S is an abstract environment associating to each global name its specification
the new expression is evaluated in such an environment• assuming that all the global values satisfy their specification
• using the specification rather than the semantics for the global objects small, modular proofs, which allow us to locate possible bugs
in our language we have closed expressions only F( S) is exactly the same as F for all the syntactic constructs,
apart from recursive function definition, where S(when available, top level) has to be used as first approximation of their abstract value
8
The implementation of F( S)
let new (e:exp) spec =
let r = emptyenv in
match e with
| Rec(i,e1) -> sem e1 (bind(r,i,(Forall([],spec),[])))
| _ -> sem e r)
9
Why checking F( S)S rather than lfp FS
why computing F( S)rather than lfp F
no fixpoint computation more efficient possible even with non-noetherian domains
modular proofs in which the proof of a component uses the specification rather
than the semantics of the other components
10
The implementation of F( S)S
let le (t,spec) = let sigma = unifylist [(spec,t)] in match sigma with
|Fail -> false |Subst(_) -> let t1= (generalize spec (Subst []) emptyenv,[]) in let t2= (generalize (applysubst sigma spec) (Subst []) emptyenv,[]) in abstreq(t1,t2)
let check (e:exp) spec = let r = emptyenv in match new e spec with
|(Forall(_,Notype),_) -> false |(Forall(_,t1),_) -> le(t1,spec)
11
Examples 1# let f x = x in f f;;
- : '_a -> '_a = <fun>
#let ff = Let(Id "f",Fun(Id "x", Var(Id "x")),Appl(Var(Id "f"),Var(Id "f")));;
# sem1 ff [] 0;;
- : evalt * (string * evalt) list = Mkarrow (Vvar "var2", Vvar "var2"), []
# check ff (Mkarrow (Vvar "a", Vvar "a"));;
- :bool = true
# check ff (Mkarrow (Intero, Intero));;
- :bool = true
# check ff (Mkarrow (Intero, Vvar "a"));;
- :bool = false
# check ff (Mkarrow (Mkarrow (Vvar "a", Vvar "a"), Mkarrow (Vvar "a", Vvar "a")));;
- :bool = true
# check ff (Mkarrow (Mkarrow (Vvar "a", Vvar "a"), Mkarrow (Vvar "a", Vvar "b")));;
- :bool = false
12
Examples 2# sem1 monster [] 2;;
- : evalt * (string * evalt) list = Mkarrow(Mkarrow (Vvar "var43", Vvar "var43"), Mkarrow(Mkarrow (Vvar "var43", Vvar "var36"), Mkarrow(Intero, Mkarrow (Vvar "var43", Vvar "var36")))), []
# check monster (Mkarrow(Mkarrow (Vvar ”A", Vvar ”A"), Mkarrow(Mkarrow (Vvar ”A", Vvar ”B"),Mkarrow(Intero, Mkarrow (Vvar ”A", Vvar ”B")))));;
- :bool = true
13
Examples 3# let loop = Rec(Id "loop",Fun(Id "p",Fun(Id "f",Fun(Id "x",Ifthenelse(Appl(Var(Id "p"),Var(Id
"x")),Var(Id "x"), Appl(Appl(Appl(Var(Id "loop"),Var(Id "p")),Var(Id "f")), Appl(Var(Id
"f"),Var(Id "x"))))))));;
# sem1 loop [] 0;; - : evalt * (string * evalt) list =Mkarrow (Mkarrow (Vvar "var15", Intero), Mkarrow (Mkarrow
(Vvar "var15", Vvar "var15"), Mkarrow (Vvar "var15", Vvar "var15"))), []
# check loop (Mkarrow(Mkarrow (Vvar "a", Intero), Mkarrow(Mkarrow (Vvar "a", Vvar "a"), Mkarrow (Vvar "a", Vvar "a"))));;
- :bool = true
# check loop (Mkarrow(Mkarrow (Vvar "b", Intero), Mkarrow(Mkarrow (Vvar "a", Vvar "a"), Mkarrow (Vvar "a", Vvar "a"))));;
- :bool = false
# check loop (Mkarrow(Mkarrow (Intero, Intero), Mkarrow(Mkarrow (Intero, Intero), Mkarrow (Intero, Intero ))));;
- :bool = true