When Types are Not Enough

Live code: https://gist.github.com/larsrh/d931ae84e48b2089d981

It is well-known that tests provide an existential guarantee (if the test fails, there is a bug), and that types provide a universal guarantee (the program can't go wrong). Combined, both are useful tools to gain more confidence in the correctness of a given program. However, not all languages provide a sophisticated type system which is able to encode strong properties. Some do, but the syntax is cumbersome. Luckily, there are tools which help to verify code without having to resort to rewriting it completely in a different language.

In this talk, we’ll explore the meanings of specification and implementation, how to formally specify programs, and how to create a connection between these two. We will also look at how to produce one from the other, and present some of the existing tools.

Transcript

1. When Types are Not Enough Lars Hupel September 22nd, 2015
2. So ware Development ▶ there are many methodologies out there ... ▶ in Scala: universal agreement that types and tests should be used for correctness ▶ What is correctness? ▶ Who defines correctness? 2
3. Example Task Implement a func on which sorts a list of numbers. 3
4. Example Task Implement a func on which sorts a list of numbers. Solu on? ▶ numbers? 3
5. Example Task Implement a func on which sorts a list of numbers. Solu on? ▶ numbers? ▶ sort? 3
6. Example Task Implement a func on which sorts a list of numbers. Solu on? ▶ numbers? ▶ sort? ▶ duplicates? ordering? stability? 3
7. Specifica ons 4
8. Specifica ons 4
9. Assump ons ▶ There is a clear specifica on. ▶ ... if only for a subsystem. ▶ The specifica on makes sense. ▶ The specifica on doesn’t contradict itself. 5
10. Specifica on vs. Implementa on How to check adherence of an implementa on to a specifica on? tests “in these cases, the output is correct” types “for all inputs, the output is wellformed” proofs “for all inputs, the output is correct” 6
11. Specifica on vs. Implementa on How to check adherence of an implementa on to a specifica on? tests “in these cases, the output is correct” types “for all inputs, the output is wellformed” proofs “for all inputs, the output is correct” 6 It looks like you want to prove something. Need help with that?
12. What can types do? “ A type system is a tractable syntac c method of proving the absence of certain program behaviors by classifying phrases according to the kinds of values they compute. Benjamin Pierce ” 7
13. Types vs. Proofs ▶ Curry-Howard tells us that types are proposi ons and values are proofs ▶ Dependently-typed languages: unified values & types ▶ process of construc ng values entails proving correctness ▶ intrinsic connec on 8
14. Example data Color = Red | Black data Tree a = Leaf | Node color (Tree a) a (Tree a) isRBT :: Tree a -> Bool 9
15. Example data Color = Red | Black data Nat = Z | S Nat data Tree :: * -> Color -> Nat -> * where Leaf :: Tree a Black Z NodeR :: a -> Tree a Black n -> Tree a Black n -> Tree a Red n NodeB :: a -> Tree a c n -> Tree a c’ n -> Tree a Black (S n) 9
16. Programming & Proving systems Type expressiveness Proof suitability 10
17. Example data Color = Red | Black data Nat = Z | S Nat data Tree :: * -> Color -> Nat -> * where Leaf :: Tree a Black Z NodeR :: a -> Tree a Black n -> Tree a Black n -> Tree a Red n NodeB :: a -> Tree a c n -> Tree a c’ n -> Tree a Black (S n) 11
18. Proving with Simple Types ▶ even without fancy types, proofs are s ll possible ▶ enforces separa on of terms and proposi ons 12
19. Q & A  larsr h  larsrh