Refine your types!

I describe what refinement types are, and how they can help us write better software, while showcasing a few concrete examples written in LiquidHaskell.

In the second part of the talk, I take a closer look at the theory behind refinement types.

At last, I show how to build your own programming language with refinement types, by making use of Inox, a powerful interface for SMT solvers.

Transcript

1. Refine your types! Romain Ruetschi 31.05.2018 Romain Ruetschi Refine your types! 31.05.2018 1 / 30
2. Two words about me Hi, my name is Romain Ruetschi, but you can also call me Romac. I am usually found online under various spellings of “romac”. Twitter: https://twitter.com/_romac GitHub: https://github.com/romac Homepage: https://romac.me Romain Ruetschi Refine your types! 31.05.2018 2 / 30
3. Refinement types Romain Ruetschi Refine your types! 31.05.2018 3 / 30
4. Outline Refinement types 1 A quick introduction 2 Under the hood 3 In the wild Romain Ruetschi Refine your types! 31.05.2018 4 / 30
5. A quick introduction A quick introduction Romain Ruetschi Refine your types! 31.05.2018 5 / 30
6. A quick introduction Types Int Romain Ruetschi Refine your types! 31.05.2018 6 / 30
7. A quick introduction Types Int Boolean Romain Ruetschi Refine your types! 31.05.2018 6 / 30
8. A quick introduction Types Int Boolean List[Int] Romain Ruetschi Refine your types! 31.05.2018 6 / 30
9. A quick introduction Types Int Boolean List[Int] List[A] → Int Romain Ruetschi Refine your types! 31.05.2018 6 / 30
10. A quick introduction Types 3 : Int Romain Ruetschi Refine your types! 31.05.2018 7 / 30
11. A quick introduction Types 3 : Int true : Boolean Romain Ruetschi Refine your types! 31.05.2018 7 / 30
12. A quick introduction Types 3 : Int true : Boolean List(1, 2, 3) : List[Int] Romain Ruetschi Refine your types! 31.05.2018 7 / 30
13. A quick introduction Types 3 : Int true : Boolean List(1, 2, 3) : List[Int] (xs: List[A]) => xs.length : List[A] → Int Romain Ruetschi Refine your types! 31.05.2018 7 / 30
14. A quick introduction Refinement types { x : T | p } Romain Ruetschi Refine your types! 31.05.2018 8 / 30
15. A quick introduction Refinement types { n : Int | n > 0 } Romain Ruetschi Refine your types! 31.05.2018 9 / 30
16. A quick introduction Refinement types { n : Int | n > 0 } { xs : List[A] | !xs.isEmpty } Romain Ruetschi Refine your types! 31.05.2018 9 / 30
17. A quick introduction Refinement types { n : Int | n > 0 } { xs : List[A] | !xs.isEmpty } { t : Tree | isBalanced(t) } Romain Ruetschi Refine your types! 31.05.2018 9 / 30
18. A quick introduction Refinement types { xs : List[A] | xs.length = 0} → A Romain Ruetschi Refine your types! 31.05.2018 10 / 30
19. A quick introduction Refinement types { xs : List[A] | xs.length = 0} → A List[A] → { n : Int | n ≥ 0} Romain Ruetschi Refine your types! 31.05.2018 10 / 30
20. A quick introduction Refinement types A → { n : Int | x ≥ 0} → { xs : List[A] | xs.length = n } Romain Ruetschi Refine your types! 31.05.2018 11 / 30
21. A quick introduction Relation with dependent types Not easy to precisely define either system. One view is that: With dependent types, types can refer to terms, the calculus is normalizing. With refinement types, types don’t necessarily need to be able to refer to terms, and the calculus does not need to be normalizing, because proofs are discharged to a solver. In practice, it is natural to allow refinement types to refer to terms. Romain Ruetschi Refine your types! 31.05.2018 12 / 30
22. A quick introduction Relation with dependent types, continued If we restrict ourselves to the view that dependent types ≈ Coq and refinement types ≈ LiquidHaskell, then: Dependent types are more expressive than refinement types, ie. one can model pretty much any kind of mathematics using dependent types, tactics, and manual proofs. Refinement types are more suited for automation, as predicates are drawn from a decidable logic, and proof obligations can thus be discharged to an SMT solver. Romain Ruetschi Refine your types! 31.05.2018 13 / 30
23. Under the hood Under the hood Romain Ruetschi Refine your types! 31.05.2018 14 / 30
24. Under the hood Subtyping Refinement types rest on the following notion of subtyping: Γ { x : A | p } { y : A | q } ⇔ Valid Γ ∧ p ⇒ q ⇔ CheckSat ¬( Γ ∧ p ⇒ q ) = UNSAT Romain Ruetschi Refine your types! 31.05.2018 15 / 30
25. Under the hood Subtyping (example) { val x: Int = 42 } { y: Int | y > x } { z: Int | z > 0 } ⇔ Valid (x = 42 ∧ y > x ∧ z = y) ⇒ z > 0) ⇔ CheckSat ¬((x = 42 ∧ y > x ∧ z = y) ⇒ z > 0) = UNSAT Romain Ruetschi Refine your types! 31.05.2018 16 / 30
26. Under the hood Contracts This function def f(x: Int { x > 0 }): { y: Int | y < 0 } = 0 - x is correct if { x: Int | x > 0 } { z: Int | z = 0 - x } { y: Int | y < 0 } ⇔ Valid (x > 0 ∧ (z = 0 − x) ∧ (y = z)) ⇒ y < 0 Romain Ruetschi Refine your types! 31.05.2018 17 / 30
27. Under the hood Solving constraints with SMT solvers Satisfiability Modulo Theories: Akin to a SAT solver with support for additional theories: algebraic data types, integer arithmetic, real arithmetic, bitvectors, sets, etc. Can choose from Z3, CVC4, Yices, Princess, and others. In practice, cannot just translate from the host language into SMT because of quantifiers, recursive functions, polymorphism, etc. Lots of work, difficult to get right (ie. sound and complete). Romain Ruetschi Refine your types! 31.05.2018 18 / 30
28. Under the hood Solving constraints with Inox2 1 Solver for higher-order functional programs which provides first-class support for features such as: 1 Recursive and first-class functions 2 ADTs, integers, bitvectors, strings, set-multiset-map abstractions 3 Quantifiers 4 ADT invariants 2 Implements a very involved unfolding strategy to deal with all of the above [1, 2, 3] 3 Interfaces with various SMT solvers (Z3, CVC4, Princess) 4 Powers Stainless, a verification system for Scala1 1https://github.com/epfl-lara/stainless 2https://github.com/epfl-lara/inox Romain Ruetschi Refine your types! 31.05.2018 19 / 30
29. Under the hood Write your own language with refinement types Demo Romain Ruetschi Refine your types! 31.05.2018 20 / 30
30. In the wild In the wild Romain Ruetschi Refine your types! 31.05.2018 21 / 30
31. In the wild LiquidHaskell Modern incarnation of refinement types for Haskell, ie. Liquid types [4] Refinement are quantifier-free predicates drawn from a decidable logic. [4] Type refinement are specified as comments in the source code. Romain Ruetschi Refine your types! 31.05.2018 22 / 30
32. In the wild LiquidHaskell Demo Romain Ruetschi Refine your types! 31.05.2018 23 / 30
33. In the wild F∗ General-purpose dialect of ML with effects aimed at program verification. Dependently-typed language with refinements, type checking done via an SMT solver. Can be extracted to efficient OCaml, F, or C code. Initially developed at Microsoft Research. Romain Ruetschi Refine your types! 31.05.2018 24 / 30
34. In the wild F∗ Part of Project Everest, an in-progress verified implementation of HTTPS, TLS, X.509, and cryptographic algorithms.3 3https://project-everest.github.io Romain Ruetschi Refine your types! 31.05.2018 25 / 30
35. In the wild Scala 3 (one day?) Ongoing effort by Georg Schmid to add refinement types to Dotty/Scala 3[5] Romain Ruetschi Refine your types! 31.05.2018 26 / 30
36. In the wild Acknowledgement Many thanks to Georg Schmid for his insights and for taking time to answer my questions. Go check out his work! [5] Romain Ruetschi Refine your types! 31.05.2018 27 / 30
37. In the wild Thanks! Romain Ruetschi Refine your types! 31.05.2018 28 / 30
38. In the wild References I [1] P. Suter, A. S. Köksal, and V. Kuncak, “Satisfiability modulo recursive programs,” in Proceedings of the 18th International Conference on Static Analysis, SAS’11, Springer-Verlag, 2011. [2] N. Voirol and V. Kuncak, “Automating verification of functional programs with quantified invariants,” p. 17, 2016. [3] N. Voirol and V. Kuncak, “On satisfiability for quantified formulas in instantiation-based procedures,” 2016. [4] R. Jhala, “Refinement types for haskell,” in Proceedings of the ACM SIGPLAN 2014 Workshop on Programming Languages Meets Program Verification, PLPV ’14, pp. 27–27, ACM, 2014. Romain Ruetschi Refine your types! 31.05.2018 29 / 30
39. In the wild References II [5] G. S. Schmid and V. Kuncak, “Smt-based checking of predicate-qualified types for scala,” in Proceedings of the 2016 7th ACM SIGPLAN Symposium on Scala, SCALA 2016, pp. 31–40, ACM, 2016. Romain Ruetschi Refine your types! 31.05.2018 30 / 30