Facilitating Program Verification with Dependent Types

1. Facilitating Program Verificationwith Dependent Types Hongwei Xi Boston University

2. Talk Overview • Motivation • Detecting program errors (at compile-time) • Detecting more program errors (at compile-time) • Dependently typed programming languages • Imperative: Xanadu • Programming examples • Current status and future work

3. A Wish List • We would like to have a programming language that should • be simple and general • support extensive error checking • facilitate proofs of program properties • possess correct and efficient implementation • ... ... • But …

4. Reality • Invariably, there are many conflicts among this wish list • These conflicts must be resolved with careful attention paid to the needs of the user

5. Some Advantages of Types • Capturing errors at compile-time • Enabling compiler optimizations • Facilitating program verification • Using types to encode program properties and verifying the encoded properties through type-checking • Serving as program documentation • Unlike informal comments, types can be fully trusted after type-checking

6. Limitations of (Simple) Types • Not general enough • Many correct programs cannot be typed • For instance, type casts are widely used in C • Not specific enough • Many interesting properties cannot be captured • For instance, types in Java cannot handle safe array access

7. Dependent Types • Dependent types are types that are • more refined • dependent on the values of expressions • Examples • int(i): singleton type containing only integer i • <int> array(n): type for integer arrays of size n

8. Examples of Dependent Types • int(i,j) is defined as[a:int | i < a < j] int(a),that is, the sum of all types int(a) for i < a < j • int[i,j), int(i,j] , int[i,j] are defined similarly • nat is defined as[a:int | a >=0] int(a)

9. Informal Program Comments /* the function should not be applied toa negative integer */ int factorial (x: int) { /* defensive programming */ if (x < 0) exit(1); if (x == 0) return 1;else return (x * factorial (x-1)); }

10. Formalizing Program Comments {n:nat} int factorial (x: int(n)) { if (x == 0) return 1;else return (x * factorial (x-1)); } Note: factorial (-1) is ill-typed and thus rejected!

11. Informal Program Comments /* arrays a and b are of equal size */ double dotprod (double a[], double b[]) { int i; double sum = 0.0; if (a.size != b.size) exit(1); for (i = 0; i < a.size; i = i + 1) { sum = sum + a[i] * b[i]; } return sum; }

12. Formalizing Program Comments {n:nat} double dotprod (a: <double>array(n),b: <double>array(n)){ /* dotprod is assigned the following type: {n:nat}. (<float> array(n), <float> array(n)) -> float */ … … … }

13. Xanadu • Xanadu is a dependently typed imperative programming language with C-like syntax • The type of a variable in Xanadu can change during execution • The programmer may need to provide dependent type annotations for type-checking purpose

14. Dependent Record Types (I) • A polymorphic type for arrays:{n:nat} <‘a> array(n) { size: int(n); data[n]: ‘a}

15. Dependent Record Types (II) • A polymorphic type for 2-dimensional arrays:{m:nat,n:nat} <‘a> array2(m,n) { row: int(m); col: int(n); data[m][n]: ‘a}

16. Dependent Record Types (III) • A polymorphic type for sparse arrays: {m:nat,n:nat}<‘a>sparseArray(m,n) { row: int(m); col: int(n); data[m]: <int[0,n)* ‘a> list}

17. A Program in Xanadu {n:nat}unit init (intvec[n]) { var: int ind, size;; /* arraysize: {n:nat} <‘a> array(n)  int(n) */ size = arraysize(vec); invariant: [i:nat] (ind: int(i)) for (ind=0; ind<size; ind=ind+1) { vec[ind] = ind; /* safe array subscripting */ } }

18. Binary Search in Xanadu {n:nat} int bs(key: int, vec: <int> array(n)) { var: l: int [0, n], h: int [-1,n); int m, x;; l = 0; h = vec.size - 1; while (l <= h) { m = (l + h) / 2; x = vec.data[m]; if (x < key) { l = m - 1; } else if (x > key) { h = m + 1; } else { return m; } } return –1; }

19. Dependent Union Types • A polymorphic type for lists:union <‘a> list with nat = { Nil(0);{n:nat} Cons(n+1) of ‘a * <‘a> list(n) } • Nil: <‘a> list(0) • Cons: {n:nat} ‘a * <‘a> list(n) -> <‘a> list(n+1)

20. Reverse Append on Lists (‘a) {m:nat,n:nat} <‘a> list(m+n) revApp (xs:<‘a> list(m),ys:<‘a> list(n)) {var: ‘a x;;invariant:[m1:nat,n1:nat | m1+n1=m+n] (xs:<‘a> list(m1), ys:<‘a> list(n1))while (true) { switch (xs) { case Nil: return ys; case Cons (x, xs): ys = Cons(x, ys); } } exit; /* can never be reached */ }

21. Constraint Generation • The following constraint is generated when the revApp example is type-checked: m:nat,n:nat,m1:nat,n1:nat,m1+n1=m+n,a:nat,m1=a+1 implies a+(n1+1)=m+n

22. Current Status of Xanadu • A prototype implementation of Xanadu in Objective Caml that • performs two-phase type-checking, and • generates assembly level code • An interpreter for interpreting assembly level code • A variety of examples athttp://www.cs.bu.edu/~hwxi/Xanadu/Xanadu.html

23. Conclusion (I) • It is still largely an elusive goal in practice to verify the correctness of a program • It is therefore important to identify those program properties that can be effectively verified for realistic programs

24. Conclusion (II) • We have designed a type-theoretic approach to capturing simple arithmetic reasoning • The preliminary studies indicate that this approach allows the programmer to capture many more properties in realistic programs while retaining practical type-checking

25. Future Work • Adding more programming features into Xanadu • in particular, OO features • Certifying compilation: constructing a compiler for Xanadu that can translate dependent types from source level into bytecode level • Incorporating dependent types into (a subset of) Java and …

26. End of the Talk • Thank you! Questions?