## Liquid types (2008)

### Cached

### Download Links

- [www.cs.ucsd.edu]
- [goto.ucsd.edu]
- [goto.ucsd.edu]
- [pho.ucsd.edu]
- [goto.ucsd.edu]
- [pho.ucsd.edu]
- DBLP

### Other Repositories/Bibliography

Citations: | 32 - 6 self |

### BibTeX

@TECHREPORT{Rondon08liquidtypes,

author = {Patrick M. Rondon and Ming W. Kawaguchi and Ranjit Jhala},

title = {Liquid types},

institution = {},

year = {2008}

}

### OpenURL

### Abstract

We present Logically Qualified Data Types, abbreviated to Liquid Types, a system that combines Hindley-Milner type inference with Predicate Abstraction to automatically infer dependent types precise enough to prove a variety of safety properties. Liquid types allow programmers to reap many of the benefits of dependent types, namely static verification of critical properties and the elimination of expensive run-time checks, without the heavy price of manual annotation. We have implemented liquid type inference in DSOLVE, which takes as input an OCAML program and a set of logical qualifiers and infers dependent types for the expressions in the OCAML program. To demonstrate the utility of our approach, we describe experiments using DSOLVE to statically verify the safety of array accesses on a set of OCAML benchmarks that were previously annotated with dependent types as part of the DML project. We show that when used in conjunction with a fixed set of array bounds checking qualifiers, DSOLVE reduces the amount of manual annotation required for proving safety from 31 % of program text to under 1%.

### Citations

1399 |
A Discipline of Programming
- Dijkstra
- 1976
(Show Context)
Citation Context ...sons). DSOLVE successfully typechecks the fixed version. 6. Related Work The first component of our approach is predicate abstraction, [1, 15] which has its roots in early work on axiomatic semantics =-=[8]-=-. Predicate abstraction has proven effective for path-sensitive verification of control-dominated properties of first-order imperative programs [3, 16, 11, 4, 29, 17]. The second component of our appr... |

599 | Construction of abstract state graphs with PVS
- Graf, Saïdi
- 1997
(Show Context)
Citation Context ... split the complex template constraints into simple constraints over the liquid type variables, and then solves these simple constraints using a fixpoint computation inspired by predicate abstraction =-=[1, 15]-=-. Of course, there may be safe programs which cannot be welltyped in our system due either to an inappropriate choice of qualifiers or the conservativeness of our notion of subtyping. In the former ca... |

597 | Counterexample-Guided Abstraction Refinement
- Clarke, Grumberg, et al.
(Show Context)
Citation Context ... a notion of type counterexample and adapt proof-based methods to check if the counterexample is feasible (i.e., there is an error) or if not, to lazily extract new qualifiers from the counterexample =-=[6, 3, 16]-=-. Third, we would like to extend the system to include reasoning about imperative features. With such an extension, liquid types could be profitably applied to verify C++, Java and C# programs which u... |

370 | The SLAM project: debugging system software via static analysis
- Ball, Rajamani
- 2002
(Show Context)
Citation Context ...nding Hindley-Milner type inference with predicate abstraction, a technique for synthesizing loop invariants for imperative programs that forms the algorithmic core of several software model checkers =-=[3, 16, 4, 29, 17]-=-. Our system takes as input a program and a set of logical qualifiers which are simple boolean predicates over the program variables, a special value variable ν, and a special placeholder variable ⋆ t... |

358 |
Principal type-schemes for functional programs
- Damas, Milner
- 1982
(Show Context)
Citation Context ...le types is bounded. We use these features to design a threestep algorithm for dependent type inference (Section 4). Step 1: Hindley-Milner Type Inference: First, our algorithm invokes Hindley-Milner =-=[7]-=- to infer types for each subexpression and the necessary type generalization and instantiation annotations. Next, our algorithm uses the computed ML types to assign to each subexpression a template, a... |

289 | Dependent types in practical programming
- Xi, Pfenning
- 1999
(Show Context)
Citation Context ...d with type inference. The notion of type refinements was introduced in [14] with refinements limited to restrictions on the structure of algebraic datatypes, for which inference is decidable. DML(C) =-=[28]-=- extends ML with dependent types over a constraint domain C; type checking is shown to be decidable modulo the decidability of the domain, but inference is still undecidable. Liquid types can be viewe... |

268 | The essence of compiling with continuations
- Flanagan, Sabry, et al.
- 1993
(Show Context)
Citation Context ... sum k = if k < 0 then 0 else (s + sum (k-1)) was non-negative, as it cannot use the fact that sum (k-1) is non-negative when inferring the type of the else expression. This is solved by A-Normalizing=-=[12]-=- the program so that intermediate subexpressions are bound to temporary variables, thus allowing us to use information about types of intermediate expressions, as in the original sum implementation. 5... |

265 |
Constructive mathematics and computer programming
- Martin-Löf
- 1982
(Show Context)
Citation Context ...e language can only provide a weaker dynamic safety guarantee at the additional cost of high performance overhead. In an exciting development, several authors have proposed the use of dependent types =-=[20]-=- as a mechanism for enhancing the expressivity of type systems [14, 27, 2, 22, 10]. Such a system can express the fact i :: {ν :int | 1 ≤ ν ∧ ν ≤ 99} which is the usual type int together with a refine... |

216 | Cayenne–a language with dependent types
- Augustsson
- 1998
(Show Context)
Citation Context ...e additional cost of high performance overhead. In an exciting development, several authors have proposed the use of dependent types [20] as a mechanism for enhancing the expressivity of type systems =-=[14, 27, 2, 22, 10]-=-. Such a system can express the fact i :: {ν :int | 1 ≤ ν ∧ ν ≤ 99} which is the usual type int together with a refinement stating that the run-time value of i is an always an integer between 1 and 99... |

211 | Abstractions from proofs
- Henzinger, Jhala, et al.
- 2004
(Show Context)
Citation Context ...nding Hindley-Milner type inference with predicate abstraction, a technique for synthesizing loop invariants for imperative programs that forms the algorithmic core of several software model checkers =-=[3, 16, 4, 29, 17]-=-. Our system takes as input a program and a set of logical qualifiers which are simple boolean predicates over the program variables, a special value variable ν, and a special placeholder variable ⋆ t... |

172 | Refinement types for ML
- Freeman, Pfenning
- 1991
(Show Context)
Citation Context ...e additional cost of high performance overhead. In an exciting development, several authors have proposed the use of dependent types [20] as a mechanism for enhancing the expressivity of type systems =-=[14, 27, 2, 22, 10]-=-. Such a system can express the fact i :: {ν :int | 1 ≤ ν ∧ ν ≤ 99} which is the usual type int together with a refinement stating that the run-time value of i is an always an integer between 1 and 99... |

169 | Eliminating array bound checking through dependent types
- Xi, Pfenning
- 1998
(Show Context)
Citation Context ...e additional cost of high performance overhead. In an exciting development, several authors have proposed the use of dependent types [20] as a mechanism for enhancing the expressivity of type systems =-=[14, 27, 2, 22, 10]-=-. Such a system can express the fact i :: {ν :int | 1 ≤ ν ∧ ν ≤ 99} which is the usual type int together with a refinement stating that the run-time value of i is an always an integer between 1 and 99... |

118 |
Hybrid type checking
- Flanagan
- 2006
(Show Context)
Citation Context |

106 |
Techniques for program verification
- Nelson
- 1981
(Show Context)
Citation Context ...em, our system uses a conservative but decidable implication check, shown in rule [DEC-<:-BASE] of Figure 3. Let EUFA be the decidable logic of equality, uninterpreted functions and linear arithmetic =-=[21]-=-. We write [[e]] for the embedding of the expression e into terms of the logic EUFA by encoding expressions corresponding to integers, addition, multiplication and division by constant integers, equal... |

94 |
Predicate abstraction for software verification
- FLANAGAN, S
(Show Context)
Citation Context ...h has its roots in early work on axiomatic semantics [8]. Predicate abstraction has proven effective for path-sensitive verification of control-dominated properties of first-order imperative programs =-=[3, 16, 11, 4, 29, 17]-=-. The second component of our approach is constraint-based program analysis, an example of which is the ML type inference algorithm. Unlike other investigations of type inference for HM with subtyping... |

93 | Scalable error detection using boolean satisfiability
- Xie, Aiken
- 2005
(Show Context)
Citation Context ...nding Hindley-Milner type inference with predicate abstraction, a technique for synthesizing loop invariants for imperative programs that forms the algorithmic core of several software model checkers =-=[3, 16, 4, 29, 17]-=-. Our system takes as input a program and a set of logical qualifiers which are simple boolean predicates over the program variables, a special value variable ν, and a special placeholder variable ⋆ t... |

68 | Simplifying subtyping constraints
- Pottier
- 1996
(Show Context)
Citation Context ...cond component of our approach is constraint-based program analysis, an example of which is the ML type inference algorithm. Unlike other investigations of type inference for HM with subtyping, e.g., =-=[19, 23, 25]-=-, our goal is algorithmic dependent type inference, which requires incorporating path-sensitivity and decision procedures for EUFA. We also draw inspiration from type qualifiers [13] that refine types... |

46 | Type inference with constrained types
- Odersky, Sulzmann, et al.
- 1999
(Show Context)
Citation Context ...cond component of our approach is constraint-based program analysis, an example of which is the ML type inference algorithm. Unlike other investigations of type inference for HM with subtyping, e.g., =-=[19, 23, 25]-=-, our goal is algorithmic dependent type inference, which requires incorporating path-sensitivity and decision procedures for EUFA. We also draw inspiration from type qualifiers [13] that refine types... |

31 | Dynamic Typing with Dependent Types
- Ou
- 2004
(Show Context)
Citation Context |

27 | Type Qualifiers: Lightweight Specifications to Improve Software Quality
- Foster
- 2002
(Show Context)
Citation Context ...ng, e.g., [19, 23, 25], our goal is algorithmic dependent type inference, which requires incorporating path-sensitivity and decision procedures for EUFA. We also draw inspiration from type qualifiers =-=[13]-=- that refine types with a lattice of built-in and programmer-specified annotations. Our Shape and Fresh functionsare similar to strip and embed from [13]. Liquid types extend qualifiers by assigning ... |

25 | Efficient verification of sequential and concurrent C programs
- Chaki, Clarke, et al.
- 2009
(Show Context)
Citation Context |

25 | Algorithmic aspects of type inference with subtypes
- Lincoln, Mitchell
- 1992
(Show Context)
Citation Context ...cond component of our approach is constraint-based program analysis, an example of which is the ML type inference algorithm. Unlike other investigations of type inference for HM with subtyping, e.g., =-=[19, 23, 25]-=-, our goal is algorithmic dependent type inference, which requires incorporating path-sensitivity and decision procedures for EUFA. We also draw inspiration from type qualifiers [13] that refine types... |

22 | Inference of User-Defined Type Qualifiers and Qualifier Rules
- Chin, Markstrum, et al.
- 2006
(Show Context)
Citation Context ...ur inference algorithm combines value flow (via the subtyping constraints) with information drawn from guards and assignments. The idea of assigning semantics to qualifiers has been proposed recently =-=[5]-=-, but with the intention of checking and inferring rules for qualifier derivations. Our approach is complementary in that the rules themselves are fixed, but allow for the use of guard and value bindi... |

22 | Model Checking C Programs Using F-SOFT
- Ivanicic, Shlyakhter, et al.
(Show Context)
Citation Context |

13 | Type reconstruction for general refinement types
- Knowles, Flanagan
- 2007
(Show Context)
Citation Context ...a alpha renaming, that each variable is bound only once in the environment, is essential for ensuring the soundness of our system [24]. The alternative of existentially quantifying the local variable =-=[18]-=- makes algorithmic checking hard. Liquid Type Checking Γ ⊢Q e : S1 Γ ⊢ S1 <: S2 Γ ⊢ S2 Γ ⊢Q e : S2 Γ(x) = {ν :B | e} Γ ⊢Q x : {ν :B | ν = x} [LT-VAR] Γ ⊢Q c : ty(c) [LT-CONST] Γ; x: ˆ Tx ⊢Q e : ˆ T Γ ... |

4 |
DML code examples. http://www.cs.bu.edu/fac/hwxi/DML
- Xi
(Show Context)
Citation Context ... accesses. Even when DSOLVE needs extra qualifiers, the types inferred using QBC help the programmer quickly identify the relevant extra qualifiers. Benchmarks. We use benchmarks from the DML project =-=[26]-=- (ported to OCAML) that were previously annotated with dependent types with the goal of statically proving the safety of array accesses [27]. The benchmarks are listed in the first column of Table 1. ... |