## Automating Type Soundness Proofs via Decision Procedures and Guided Reductions (2002)

### Cached

### Download Links

- [research.microsoft.com]
- [www.research.microsoft.com]
- [www.research.microsoft.com]
- [research.microsoft.com]
- DBLP

### Other Repositories/Bibliography

Venue: | In 9th International Conference on Logic for Programming Artificial Intelligence and Reasoning, volume 2514 of LNCS |

Citations: | 3 - 0 self |

### BibTeX

@INPROCEEDINGS{Syme02automatingtype,

author = {Don Syme and Andrew D. Gordon},

title = {Automating Type Soundness Proofs via Decision Procedures and Guided Reductions},

booktitle = {In 9th International Conference on Logic for Programming Artificial Intelligence and Reasoning, volume 2514 of LNCS},

year = {2002},

pages = {418}

}

### OpenURL

### Abstract

Operational models of fragments of the Java Virtual Machine and the .NET Common Language Runtime have been the focus of considerable study in recent years, and of particular interest have been specifications and machine-checked proofs of type soundness. In this paper we aim to increase the level of automation used when checking type soundness for these formalizations. We present a semi-automated technique for reducing a range of type soundness problems to a form that can be automatically checked using a decidable first-order theory. Deciding problems within this fragment is exponential in theory but is often efficient in practice, and the time required for proof checking can be controlled by further hints from the user. We have applied this technique to two case studies, both of which are type soundness properties for subsets of the .NET CLR. These case studies have in turn aided us in our informal analysis of that system.

### Citations

539 | A Syntactic Approach to Type Soundness
- Wright, Felleisen
- 1994
(Show Context)
Citation Context ...uch properties, it oers asrst step in that direction. Related Work Wright and Felleisen's 1994 work presented a systematic syntactic approach to a range of type soundness proofs for source languages [=-=18]-=-, and we have used many aspects of their methodology in this paper. No prior work has attempted to systematically apply decision procedures or other particular automated techniques to type soundness p... |

458 | Comprehending Monads - Wadler - 1990 |

176 | M.: A type system for Java bytecode subroutines
- Stata, Abadi
- 1999
(Show Context)
Citation Context ...at system. 1 Introduction Formalizations of virtual machines such as the Java Virtual Machine (JVM) or the .NET Common Language Runtime (CLR) have been the focus of considerable study in recent years =-=[4, 11, 13, 14-=-]. Of particular interest have been specications and proofs of type soundness for these systems, frequently involving machinechecked proofs using interactive theorem provers [15-17]. While the automat... |

151 | Validity checking for combinations of theories with equality
- Barrett, Dill, et al.
- 1996
(Show Context)
Citation Context ...splitting and validity checking within a combination of decidablesrst-order theories. The particular decision procedure used in this paper is the algorithm used by the Stanford Validity Checker (SVC) =-=[1-=-], which has been successfully applied to large hardware verication proofs. We have applied this technique to models of subsets of the CLR, which has in turn aided our informal analysis of that system... |

121 | MONA: Monadic second-order logic in practice
- Henriksen, Jensen, et al.
- 1995
(Show Context)
Citation Context ...partial functions, total functions andsnite maps. SVC has been successfully used for proofs about abstracted descriptions of microprocessors. It is an open question if other decision procedures (e.g. =-=[6]) can-=- be applied to the kind of proofs described in this paper. Variations on the \transform and give to a decision procedure" theme are used on an ad hoc basis in theorem proving and the combination ... |

69 | D.: Typing a multi-language intermediate code
- Gordon, Syme
- 2001
(Show Context)
Citation Context ...at system. 1 Introduction Formalizations of virtual machines such as the Java Virtual Machine (JVM) or the .NET Common Language Runtime (CLR) have been the focus of considerable study in recent years =-=[4, 11, 13, 14-=-]. Of particular interest have been specications and proofs of type soundness for these systems, frequently involving machinechecked proofs using interactive theorem provers [15-17]. While the automat... |

61 | C formalised in HOL
- Norrish
- 1998
(Show Context)
Citation Context ...ed proof checking [12, 4], as well as a set of extensive Abstract State Machine (ASM) descriptions of the JVM [13]. The work presented in this paper has also been inspired by Norrish's treatment of C =-=[10-=-] and the general background of HOL theorem proving [5]. 2 Spark We now give a concrete example of a type soundness specication that serves to motivate our techniques to substantially automate type so... |

43 |
Introduction to HOL: a theorem-proving environment for higher-order logic
- Gordon, Melham
- 1993
(Show Context)
Citation Context ...e Abstract State Machine (ASM) descriptions of the JVM [13]. The work presented in this paper has also been inspired by Norrish's treatment of C [10] and the general background of HOL theorem proving =-=[5-=-]. 2 Spark We now give a concrete example of a type soundness specication that serves to motivate our techniques to substantially automate type soundness proofs. A larger case study is discussed in x4... |

43 |
The Objective Caml system, documentation and user’s guide. http://caml.inria.fr/ocaml/htmlman
- Leroy, Rémy, et al.
- 1999
(Show Context)
Citation Context ...in x4.2. Our example is motivated by the instruction set of the CLR [8] and is called Spark. We describe execution and verication of Spark programs by programming functions in the Caml dialect of ML [=-=7]-=-. Our code avoids all the imperative features of ML and use no recursion. Hence, we can directly interpret our ML data structures and procedures as mathematical sets and total functions, respectively.... |

37 | Proving the soundness of a java bytecode verifier specification in isabelle/hol
- Pusch
- 1999
(Show Context)
Citation Context ...at system. 1 Introduction Formalizations of virtual machines such as the Java Virtual Machine (JVM) or the .NET Common Language Runtime (CLR) have been the focus of considerable study in recent years =-=[15, 12, 14, 4]-=-. Of particular interest have been specifications and proofs of type soundness for these systems, frequently involving machine-checked proofs using interactive theorem provers [16, 18, 17]. While the ... |

29 | A generalization of Shostak’s method for combining decision procedures
- Barrett, Dill, et al.
- 2002
(Show Context)
Citation Context ...tomated reasoning, as it is necessary to produce simple counterexamples for failed proof eorts. We will apply the technique implemented by the SVC [1] (equally applicable would be its successor, CVC [=-=2-=-]). This procedure checks the validity of quantier-free formulasrst-order logic with respect to theories for arithmetic, products, arrays (maps), sums and conditionals. Good counterexamples can be gen... |

25 | The Machine-Assisted Proof of Programming Language Properties - VanInwegen - 1996 |

22 |
Declarative Theorem Proving for Operational Semantics
- Syme
- 1998
(Show Context)
Citation Context ... on using interactive theorem proving for these kinds of proofs [9, 11, 16, 17]. Syme's work on Java used a more restrictive proof style and applied decision procedures to prove resulting obligations =-=[15-=-]. There have been other eorts to formalize aspects of virtual machine descriptions but without mechanized proof checking [12, 4], as well as a set of extensive Abstract State Machine (ASM) descriptio... |

20 | Equality reasoning in sequentbased calculi
- Degtyarev, Voronkov
- 2001
(Show Context)
Citation Context ...perations and perform a proof search. However it is well known that combining such problems is dicult, and while progress has been made recently to determine forms of such problems that are tractable =-=[3-=-], it is not yet clear if the techniques will scale up to very large verication problems while providing the high-quality counterexample feedback that is required. Second, the problem statement may in... |

20 |
A formal specification of Java[TM] virtual machine instructions for objects, methods and subroutines
- Qian
(Show Context)
Citation Context ...tual Machines In this section we consider the typical structure of a type soundness specification for a virtual machine. A good supply of examples exists against which to compare this structure, e.g. =-=[16, 12, 13, 11]-=-, and we have examined these examples to check that they fall within the general structure described here. A structured operational semantics (SOS) used in a type soundness proof typically has the fol... |

15 |
E.: Java and the Java Virtual Machine
- Stärk, Schmid, et al.
- 2001
(Show Context)
Citation Context ...at system. 1 Introduction Formalizations of virtual machines such as the Java Virtual Machine (JVM) or the .NET Common Language Runtime (CLR) have been the focus of considerable study in recent years =-=[4, 11, 13, 14-=-]. Of particular interest have been specications and proofs of type soundness for these systems, frequently involving machinechecked proofs using interactive theorem provers [15-17]. While the automat... |

13 | JlJava: Embedding a Programming Language in a Theorem Prover
- Nipkow, Oheimb, et al.
- 2000
(Show Context)
Citation Context ...y apply decision procedures or other particular automated techniques to type soundness proofs. However, there has been considerable work on using interactive theorem proving for these kinds of proofs =-=[9, 11, 16, 17-=-]. Syme's work on Java used a more restrictive proof style and applied decision procedures to prove resulting obligations [15]. There have been other eorts to formalize aspects of virtual machine desc... |

12 | Machine-checking the Java Specification: Proving Type-Safety
- Oheimb, Nipkow
- 1999
(Show Context)
Citation Context ...nt years [15, 12, 14, 4]. Of particular interest have been specifications and proofs of type soundness for these systems, frequently involving machine-checked proofs using interactive theorem provers =-=[16, 18, 17]-=-. While the automation available in interactive theorem provers has increased, both the kind of automation applied (e.g. rewriting) and the manner of its application (e.g. tactics) tend to be substant... |

12 |
A syntactic approach to type soundness. Information and Computation, 115:38–94, 1994. traverse( new C ( v1
- Wright, Felleisen
(Show Context)
Citation Context ... believe it offers a first step in that direction. 1.2 Related Work Wright and Felleisen's 1994 work presented a systematic syntactic approach to a range of type soundness proofs for source languages =-=[20]-=-, and in common with many other authors we have adopted aspects of their methodology in this paper. No prior work has attempted to systematically apply decision procedures or other particular automate... |

9 |
Machine-checking the Java speci Proving type-safety
- Oheimb, Nipkow
- 1999
(Show Context)
Citation Context ...y apply decision procedures or other particular automated techniques to type soundness proofs. However, there has been considerable work on using interactive theorem proving for these kinds of proofs =-=[9, 11, 16, 17-=-]. Syme's work on Java used a more restrictive proof style and applied decision procedures to prove resulting obligations [15]. There have been other eorts to formalize aspects of virtual machine desc... |

7 |
Proving the soundness of a Java bytecode veri speci in Isabelle /HOL
- Pusch
- 1999
(Show Context)
Citation Context |

7 |
A Formal Speci of Java Virtual Machine Instructions for Objects, Methods and Subroutines
- Qian
- 1999
(Show Context)
Citation Context ...roof style and applied decision procedures to prove resulting obligations [15]. There have been other eorts to formalize aspects of virtual machine descriptions but without mechanized proof checking [=-=12, 4]-=-, as well as a set of extensive Abstract State Machine (ASM) descriptions of the JVM [13]. The work presented in this paper has also been inspired by Norrish's treatment of C [10] and the general back... |

2 | A generalization of Shostak's method for combining decision procedures - Springer-Verlag - 1996 |

2 |
Microsoft IL Assembly Programmer's Reference Manual, July 2000
- Corporation
(Show Context)
Citation Context ...ivate our techniques to substantially automate type soundness proofs. A larger case study is discussed in x5. Our example is motivated by the instruction set of the .NET Common Language Runtime (CLR) =-=[9, 8]-=- and is called Spark.3 We informally introduce Spark 3The CLR project was once called Lightning, hence the name: Spark, a little Lightning. 2sin x2.1, and x2.2 gives a mixed relational/functional spec... |